Exact and Efﬁcient Adversarial Robustness with Decomposable Neural Networks
Abstract
As deep neural networks are notoriously vulnerable to adversarial attacks, there has been signiﬁcant interest in defenses with provable guarantees.
Recent solutions advocate for a randomized smoothing approach to provide probabilistic guarantees, by estimating the expectation of a network’s output when the input is randomly perturbed.
As the convergence of the estimated expectations depends on the number of Monte Carlo samples, and hence network evaluations, these techniques come at the price of considerable additional computation at inference time.
We take a different route and introduce a novel class of deep models—decomposable neural networks (DecoNets)—which compute the required expectation exactly and efﬁciently using a single network evaluation .
This remarkable feature of DecoNets stems from their network structure, implementing a hierarchy of decomposable multiplicative interactions over non-linear input features, which allows to reduce the overall expectation into many “small” expectations over input units, thus delivering exact guarantees .
INTRODUCTION
Deep learning has revolutionized machine learning (ML) and artiﬁcial intelligence (AI) over the past decade and has seen a wide adoption in sensitive domains such as autonomous driving and decision support systems in hiring, jurisdiction, and medical diagnosis.
Recent years, however, have also highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, —small engineered input perturbations that lead to a dramatic change in the DNN’s output [Szegedy et al., 2014, Goodfellow et al., 2015]— which makes their usage in such domains problematic.
This vulnerability has motivated the design of adversar-
[Figure]
accuracy computation for σ = 1 and R = 2 σ (time in seconds, y-axis) for DecoNets,
DNNs and ConvNets of equivalent number of parameters (xaxis).
The Monte-Carlo estimate for DNNs and ConvNets is done for different conﬁdence levels ( 99 . 99 , 92 .
25 , 22 . 577 ) requiring respectively 10 4 , 10 3 , 10 2 samples, evaluated in a single batch on a single GPU.
DecoNets are able to obtain a non-probabilistic guarantee ( 100% conﬁdence) in a single network evaluation.
See Sec.
5 for details.
ial defenses, i.e., training and inference techniques which aim to protect a model from adversarial attacks.
Many recent works focus on certiﬁed defenses, which allow one to prove the non-existence of adversarial examples in a region of interest, no matter what adversarial attack is employed.
One of the most promising techniques in this area is randomized smoothing [Lecuyer et al., 2019, Cohen et al., 2019, Salman et al., 2019a].
This approach transforms a classiﬁer f (without robustness guarantees) into a certiﬁed smoothed classiﬁer g , deﬁned by Cohen et al.
[2019] as g ( x ) := arg max c P [ f ( x + (cid:15) )
=
c ] , where (cid:15) ∼ N (0 , σ I ) is isotropic Gaussian noise.
That is, the input x is assigned the class which is predicted with highest probability by f when the input x is perturbed with noise.
The smoothed classiﬁed g guarantees a constant pre- diction in a certain (cid:96) 2 -ball
and hence the non-existence of an adversarial example in such a ball.
More formally, let p A
=
P
[ f ( x + (cid:15) )
=
g ( x )] be the probability of the most likely class, and p B = max c (cid:54) =
g ( x ) P [ f ( x + (cid:15) )
=
c ] , the probability of the runner-up class, then g ( x +
[Equation]
g
[Equation]
where Φ is the standard Gaussian CDF.
In Salman et al.
[2019a], this result is generalized using guarantees on the
Lipschitz constant of bounded, soft classiﬁer functions when computing not p A but their expected outputs, that is when smoothing them.
Deﬁnition 1.1 (Smoothed function) .
Let f : X
(cid:55)→ R C be a C -output function.
Its smoothed version ¯ f σ is deﬁned as ¯ f σ ( x ) =
( ¯ f σ, 1 ( x ) , . . .
, ¯ f σ,C ( x )) (cid:62) , where
[Equation]
and (cid:15) is zero-mean Gaussian noise with covariance σ I .
As shown in Salman et al.
[2019a], ¯ f , the smoothed version of a classiﬁer f : X (cid:55)→ [0 , 1] C , essentially realizes a low-pass ﬁltered version of f using a Gaussian ﬁlter and hence is (cid:113) 2 πσ 2 Lipschitz, leading to an immediate robustness guarantee within a certain (cid:96) 2 -ball around a sample x .
In particular, let c ∗ = arg max c =1 ,...,C ¯ f σ,c ( x ) be the predicted class and c ∗ = arg max c (cid:54) =
c ∗ ¯ f σ,c
( x ) be the runner up class.
Then an attacker needs to move x at least by a distance
[Equation]
to ﬂip the decision of the smoothed classiﬁer.
Hence, one can guarantee constant classiﬁcation within an (cid:96) 2 -ball of diameter R around x : arg max c ¯ f σ,c
( x + δ ) =
arg max c ¯ f σ,c ( x ) for (cid:107) δ (cid:107) < R .
Randomized smoothing is compelling since it is simple, scalable, model agnostic and provides strong guarantees, which have been shown to be tight
[Cohen et al., 2019].
However, one of the central challenges in randomized smoothing is that smoothed classiﬁers are in fact intractable , since neither P [ f ( x + (cid:15) )
=
c ] nor E (cid:15) [ f ( x + (cid:15) )] can be computed exactly in general, especially when f is represented by an arbitrary
DNN.
To overcome this limitation, the required probabilities (or expectations) are replaced with Monte Carlo estimates , which can only give probabilistic guarantees for the nonexistence of adversarial examples .
As usual in Monte Carlo techniques, this introduces a trade-off between inference quality —determined by the variance of the estimator, and scaling indirectly with number L of Monte Carlo samples— and inference time —scaling directly with L .
Fewer samples lead to weaker probabilistic guarantees and smaller certiﬁed regions, while more samples require more network evaluations.
For example, Cohen et al.
[2019] report that 100 ,
Monte Carlo samples are needed for a conﬁdence level of 99 . 9% for a radius 4 σ —that is, in order to certify a single test sample, one needs to evaluate the DNN 100 , 000 times.
This incurs a signiﬁcant increase in computational cost, which becomes prohibitive in real-time and high-throughput applications.
In this paper, we argue that (in-)tractability is a choice, and in particular, a structural choice.
In particular, we introduce a novel class of deep models, decomposable neural networks (DecoNets), which are able to compute the functional E (cid:15)
[ f ( x + (cid:15) )]
exactly and in a single network evaluation .
Compared to the Monte Carlo approaches to randomized smoothing, DecoNets not only provide exact adversarial certiﬁcation (i.e., with a conﬁdence level of 100% ) but also dramatically reduce the time needed to certify the non-existence of adversarial examples, as shown in Fig.
DecoNets are able to deliver this by combining expressive architectural patterns like multiplicative interaction layers [Jayakumar et al., 2019], from which they inherit universal approximation, with decomposable computational graphs such as probabilistic circuits (PCs)
[Vergari et al., 2020, Choi et al., 2020] which enable the tractable computation of multivariate integrals.
Speciﬁcally, DecoNets realize set-multilinear polynomials over arbitrary non-linear input features, represented as standard neural networks over sub-scopes of the inputs.
In the following sections we introduce the layers in
DecoNets as operations one is allowed to combine to obtain exact computation of their smoothed outputs and provide a general recipe to combine them for image data while retaining these guarantees throughout the whole architecture.
DECOMPOSABLE NEURAL NETWORKS
While randomized smoothing is simple and effective, it faces a major challenge, namely the computation of the expectations E [ f c ( x + (cid:15) )] which are analytically intractable in general DNNs.
In Cohen et al.
[2019], Salman et al.
[2019a] the expectations are approximated with Monte Carlo estimation, which comes with the usual caveats, namely i) high computational cost and ii) probabilistic guarantees only.
These two caveats also form a trade-off, since tighter probabilistic guarantees require more computation, since the estimator variance decreases reciprocal with the number of Monte Carlo samples.
It seems to be a tacit assumption in the community that an exact and efﬁcient computation E [ f c ( x + (cid:15) )] must remain a hopeless endeavor, or vice versa, that any model which does allow this computation cannot live up to the performance of DNNs.
In this paper, we challenge this assumption and propose decomposable neural networks (DecoNets), a ﬂexible class of DNNs which does facilitate an exact and efﬁcient computation of E [ f c ( x + (cid:15) )] .
In order to introduce DecoNets, note that any DNN classiﬁer is a directed acyclic computational graph over modules (or layers), many-to-many functions whose inputs are given by the output of other modules or by the input vector x , and whose outputs are arbitrary tensors, subsuming scalars, vectors, matrices, etc.
We can naturally distinguish two types of modules, namely input modules , whose input stems exclusively from x , and internal modules , which receive input from at least one other module in the graph.
An important property in DecoNets is that each module depends only on a sub-vector of x (cid:48) ⊆
x ,which we call the scope or receptive ﬁeld of the module, and which we denote with x g for any module g .
For example, if x = ( x 1 , x 2 , x 3 ) (cid:62) and g ( x ) :=
x 3 − x 21 , then x g = ( x 1 , x 3 ) .
Note, that given the scopes of the input modules, the scopes of the internal modules can be easily determined by recursion.
The principle of DecoNets is relatively simple and is based on two requirements.
First, if g is an input module, we require that the smoothing operator E
[ g ( x + (cid:15) )] can be computed easily (e.g. in closed form).
Note that E [ g ( x + (cid:15) )]
=
E [ g ( x g + (cid:15) (cid:48) )] where (cid:15) (cid:48) is a isotropic Gaussian noise vector of the same length as x g , i.e. the smoothing operator can be restricted to the scope of g .
Second, we require that internal modules are commutative with the smoothing operator, i.e., if g ( i, h, j, . . . )
is an internal module, then E [ g ( h ( x + (cid:15) ) , i ( x + (cid:15) ) , j ( x + (cid:15) ) , . . . )]
=
g ( E [ h ( x + (cid:15) )] , E
[ i ( x + (cid:15) )] , E [ j ( x + (cid:15) )] , . . . ) .
In the following, we introduce four modules—the decomposable multiplicative interaction , the input , the normalization , and the output layers —that satisfy the two aforementioned desiderata and as such guarantee to exactly compute the expectations required for distilling a smoothed classiﬁer (Def. 1.1) efﬁciently when composed together in a computational graph for a DecoNet.
We then describe in Sec.
3 how to use them to build a DecoNet tailored for image data.
2.1 DECOMPOSABLE MULTIPLICATIVE INTERACTION MODULES
Multiplicative interactions [Jayakumar et al., 2019] are a general way to combine multiple input streams by realizing a bilinear tensor product.
This module has been particularized in a number of successful recent neural architectures such as gating and attention layers [Vaswani et al., 2017,
Bahdanau et al., 2014], dynamic convolutions [Wu et al., 2019], and hypernetworks [Ha et al., 2017].
Unfortunately, all these architectural variants cannot efﬁciently compute
Eq.
To overcome this issue, we design a multiplicative interaction moduel with an additional structural constraint— decomposability —which ensures that the input streams are functions with non-overlapping scopes.
Deﬁnition 2.1 (Decomposable multiplicative interactions) .
Let g ( X 1 ) ∈
R m and h (
X 2 ) ∈
R n be functions deﬁned over disjoint sets of variables, i.e., X 1 ∩ X 2 = ∅ .
Then, a parameterized function f ( X ) ∈ R
o realizes a decomposable multiplicative interaction (DeMI) module over variables
X =
X 1 ∪ X 2 if it takes the following form for an input x = ( x 1 ,
[Equation]
[Equation]
where W ∈ R m,o,n , U ∈ R m,o , V ∈ R n,o and b ∈ R o are parameter tensors and the k -th entry of the ﬁrst term computes
[Equation]
Decomposability restricts the multiplicative interactions to encode set-multilinear polynomials [Shpilka and Yehudayoff, 2010] whose indeterminates are given by the output entries of the functions g and h .
However, imposing decomposability does not hinder the universal approximator capabilities of DeMI layers, as discussed in Sec. 2.5, but is the key to unlocking tractable computation of Eq.
(2), as illustrated by the following theorem.
Theorem 2.1 (Smoothed decomposable multiplicative interactions) .
Let f be a decomposable multiplicative interaction module.
Then, its smoothed output ¯ f σ ( x ) for an input x ∈ X and Gaussian noise magnitude σ is given by
[Equation]
where ¯ g σ and ¯ h σ are the smoothed versions of g and h .
In essence, Thm. 2.1 states that if the inputs of a multiplicative interaction module admit tractable smoothing, so does the module itself.
We can ensure this recursively by composing several multiplicative interaction modules while paying preserving decomposability (we will provide our architectural recipe to do so in Sec. 3) and alternating them with normalization layers (Sec. 2.3).
We enlarge these options by including standard perceptrons and convolutions as possible input layers showing how they can be tractably smoothed.
2.2 INPUT MODULES: RELU PERCEPTRONS AND CONVOLUTIONS
Even for the simple case of a single perceptron f ( x ) = r ( w T · x ) , i.e., an afﬁne function followed by a non-linear activation r , tractable computation of its smoothing depends on the choice of r .
For example, if r is the sigmoid activation, then computing Eq.
(2) exactly might not be possible, as no closed-form integral is known for the expectation of an arbitrary sigmoid with Gaussian inputs.
Fortunately, this is not the case for rectiﬁed linear units (ReLUs), as the next proposition shows.
Proposition 2.1.
Let f denote an afﬁne function with a
ReLU activation, i.e., f ( x ) = max(0 , w (cid:62) x + b ) .
The smoothing of f has the following expectation:
[Equation]
where γ = w T x + b σ (cid:107) w (cid:107) and Φ is the standard normal CDF.
As such, we are allowed to create input modules that concatenate the outputs of I perceptrons.
Note that this result extends also to convolutions followed by ReLU activations, as they realize linear operators with parameter sharing [LeCun, 1998].
2.3 NORMALIZATION AND REGULARIZATION MODULES
A miscellaneous of regularization and normalization layers commonly used in deep learning can be readily incorporated in DecoNets as modules whose computations at inference time would easily commute with the expectation as they realize afﬁne functions.
For example, a dropout layer receiving input from a module f would simply realize p d · f ( x ) at inference time, where 1 − p d is the probability of zeroing the outputs of f at training time.
Hence, its smoothed version can be easily computed as p d · ¯ f σ ( x ) .
Similarly, as a batch norm module would realize the afﬁne transformation of the k -th dimension as γ k · (( f ( x ) k − µ k ) /σ BN ) + β k , where γ k and β k are some learned parameters and µ k and σ BN are the mean and standard deviation statistics estimated on the training set (and hence constant at inference time), then smoothing it equals computing γ k · (( ¯ f σ,k ( x ) − µ k ) / σ BN )
+ β k .
2.4 OUTPUT MODULE
The layers introduced so far guarantee the tractable computation of their smoothed equivalents, but they do not guarantee their outputs to be bounded in [0 , 1] C , which is a requirement for a classiﬁer f to retrieve the radius guarantees in
Eq.
(3) as shown in Salman et al.
[2019a].
Since we are not allowed to simply normalize the DecoNet predictions in [0 , 1] through a sigmoid or softmax layer, as a closed-form expectation for it is not known (Sec. 2.2), we propose to scale them with an afﬁne function.
Speciﬁcally, we adopt the following element-wise min-max transformation as the last layer:
[Equation]
where f ( x ) i is the unnormalized prediction for the i -th class as output by the penultimate layer, and f min i (resp.
f max i ) are theoretical bounds over the predictions of f .
As the bounds are constants at inference time, we can again easily commute Eq.
(7) with the expectation operator to smooth it.
For a DecoNet with input modules realizing ReLU perceptrons, we can efﬁciently compute a practical upper (resp.
lower) bound for f max i (resp.
f min i ).
Speciﬁcally, for an upper bound, we can formulate the following optimization problem
[Equation]
where X f is the range for feasible input values, e.g., [ − 0 . 5 , 0 .
5] D for zero-centered images comprising D pixels and f in 1 ( z ) , . . .
, f in K ( z ) denote K different input modules in the DecoNet.
For f min i we can formulate an equivalent minimization problem.
Note that to compute Eq.
(7) we do not require optimal bounds on the values of f min i and f max i , only relaxations f
upp i and f low i such that f min
i ≥ f low i and f max i ≤ f upp i .
We rewrite Eq.
(8) as a quadratic program with non-linear constraints making it amenable to off-theshelf solvers like Gurobi.
Speciﬁcally we introduce for every quadratic term multiplied by another linear (or quadratic) term appearing in our DeMI modules a new variable in the objective function which has a hard constraint equal to the product of the higher order polynomial term.
As a result, we can use a few iterations of Gurobi to compute f upp i and f low i to plug in Eq.
(7) and ensure that the output of the DecoNet lies in [0 , 1] C .
For a dataset like FMNIST and a DecoNet of one million parameters, this computation takes roughly 300-400 seconds depending on the tightness of the bound required.
Note that we need to perform this computation only once and therefore we can amortize its cost for all possible queries to certify every input at inference time.
2.5 REPRESENTATIONAL POWER OF DECONETS
DecoNets realize a hierarchy of multiplicative interactions over non-linear inputs that are ReLU perceptrons.
At the same time, as pointed out in Sec. 2.1, DecoNets are compact representations for set-multilinear polynomials with potentially exponentially many terms.
Each term in such a polynomial would comprise a product of non-linear functions deﬁned over disjoint sets of variables.
It follows from the above statements that DecoNets inherit from their neural and polynomial nature the universal approximator property: by adding more neurons either in the input layers as ReLU perceptrons or by increasing the parameterization of the
DeMI layers DecoNets could better approximate any target function with reduced error.
While the above statements tell us that DecoNets can be as expressive as general DNNs and other feedforward networks such as ConvNets, they do not guarantee that they are equivalently expressive efﬁcient [Shpilka and Yehudayoff, 2010, Martens and Medabalimi, 2014], that is that they can approximate a target function equivalently well than other models with the same model capacity, here expressed in terms of number of parameters.
We settle this question with our empirical evaluation in Sec.
5 where we show that
DecoNets are competitive in terms of natural accuracy on a number of datasets when compared to DNNs and ConvNets with an equivalent number of parameters.
Lastly, we clarify the relationship between DecoNets and probabilistic circuits (PCs)
[Vergari et al., 2020, Choi et al., 2020].
PCs compactly represent complex distributions as computational graphs comprising only sum, product and input units.
Imposing structural constraints on their graphs equals to guarantee tractability for certain computations.
For instance, decomposability guarantees tractable marginalization in PCs when in conjunction with smoothness , 2 and maximization when associated to determinism , two additional structural properties for circuits [Choi et al., 2020].
DecoNets can be understood as special circuits if we abstract their input layers into single computational units, as their inner layers already comprise only sum and product operations.
Speciﬁcally, under this light DecoNets can be represented as non-monotonic 3 and decomposable circuits whose input units encode DNNs.
In fact, differently from
PCs, which are required to have positive parameters (also called monotonic circuits), DecoNets are not restricted to model probability distributions, and therefore allow for arbitrary parameterizations.
Furthermore, DecoNets are also less restricted structure-wise: while all the aforementioned special classes of PCs require some combination of decomposability, smoothness and determinism for tractable inference, only decomposability is truly necessary in DecoNets to tractably compute Eq.
This additional ﬂexibility allows us to leverage architectural biases in DecoNets that are not allowed in standard PCs because they would “break” some other structural property or the probabilistic semantics of the circuit (e.g., BatchNorm).
At the same time, we can leverage the rich literature of PCs for effortless ways to build a structure for DecoNets whose layers are guaranteed to preserve decomposability, as the next section discusses.
A DECONET FOR IMAGES
We now give a simple recipe to compose the tractable ingredients introduced in the previous section to obtain a DecoNet that can robustly classify and efﬁciently certify image data.
The main challenge in stacking multiple modules of this kind together is preserving decomposability across all
DeMI layers.
To this end, we adapt an approach to build decomposable PCs ﬁrst introduced by Poon and Domingos [2011] and then extended to tensorized representations by
Peharz et al.
[2020a].
At a high level, this process consists of two steps: i) building a hierarchical decomposition of the global function scope, also called a region graph and then ii) following it to build a computational graph that properly stacks DeMI layers.
We describe these two steps next, illustrated in Fig.
Building the region graph.
The region graph is a bipartite graph comprising two kinds of nodes: regions and partitions.
Regions encode subsets of variables X , among them the so-called "top region" representing a the full scope X .
“Leaf regions” indicate the regions in the graph with the smallest scope.
In the context of images, regions correspond to patches, e.g., collection of pixels that are highlighted with different shades of blue in Fig. 2, left.
On the other hand, partitions are collections of disjoint regions and represent ways to decompose a region.
Without loss of generality, we consider partitioning regions into two sub-regions only.
More formally, for a region with scope X r , a partition denotes the collection ( X r 1 , X r 2 ) where X r 1 ∩
X r 2 = ∅ and
X r 1 ∪ X r 2 =
X r .
For example, the top region in Fig.
2, with scope ( r, s, t, u, v, w ) is decomposed by the partition denoted by a black square indexed by 8 into two sub-regions, one of which (indexed as 7 ) has scope ( r, s, u, v ) and the other one ( t, w ) .
Note that a region can be partitioned in different ways.
It is easy to see that such a region graph admits only decomposable partitions by construction and realizes a poset over the possible subsets of the top region.
Given some image data with height H and width W , to build a region graph we perform a recursive partitioning process that starts from the top region—the full image—and then keeps on partitioning it into axis-aligned patches, until the generated regions have a large enough scope—becoming the leaf regions.
Speciﬁcally, we execute d horizontal (resp. vertical) splits on a region r to partition H r (resp W r ) in equal parts (up to integer rounding) until we cannot split a region’s dimension in d parts anymore.
We then connect each region to its corresponding sub-regions via partitions, by caching the nodes we introduced in the region graph to obtain a DAG as the one depicted in Fig.
2 where each region or partition are unique.
Tensorizing DecoNet layers.
Once a region graph is available, we can build a computational graph for DecoNets in the following way.
For each leaf in the region graph we introduce an input layer comprised of I neurons with ReLU activations as described in Sec. 2.2.
Then, for each partition node in the region graph, partitioning a region r with scope X r into two sub-regions with scopes X r 1 and X rwe introduce a block comprised of a DeMI layer followed by Dropout and Batch Norm layers, as indicated by colors in Fig.
2 right.
The DeMI layer is parameterized by W and realizes the function g ( x r 1 ) T · W · h ( x r 2 ) , where g and h represent the outputs of the blocks associated to the two subregions in the current partition.
To speed up computations, we implement these DeMI layers as a monolithic einsum op-
D r o p o u t
B N D e M I
D e M I
D r o p o u t
B N
D e M I
D r o p o u t
B N eration as in [Peharz et al., 2020b].
Lastly, as one region can be partitioned in multiple ways, we mix the aforementioned blocks associated to the partitions into a single output by a weighted sum operation (indicated by (cid:80) in Fig. 2).
RELATED WORK
Decomposability and Circuit Representations.
Constraining computational graphs to enable the tractable computation of certain quantities of interest has a long history in
ML and AI [Davis et al., 1962, Darwiche and Marquis, 2002,
Bacchus et al., 2009, Kimmig et al., 2017].
Decomposability, in particular, has been ﬁrst introduced as a structural property enabling tractable computations of SAT and weighted model counting in the literature of logical circuits [Darwiche and Marquis, 2002], the logical counterpart of PCs, encoding Boolean functions with computational graphs of and and or gates.
Within the literature of PCs, only a few works have investigated decomposable discriminative circuits for classiﬁcation [Rooshenas and Lowd, 2016, Rahman et al., 2019, Liang and Van den Broeck, 2019, Shao et al., 2020].
However, all of them introduce additional structural properties such as determinism or structured-decomposability that further limit their expressive efﬁciency as well as their ability to accommodate for the most recent neural architectural advancements (Sec. 2.5).
Equally crucially, to retain a probabilistic semantics they additionally restrict their computational graphs to compute valid probabilities throughout it by limiting the choice of input layers, forcing network parameters to be in a simplex, or squashing the output value through a sigmoid.
DecoNets, on the other hand, require only decomposability and do not enforce a probabilistic semantics, as such they can easily accommodate convolutions and batch norm layers (Sec. 2).
Furthermore, circuits directly encoding a conditional probability distribution P ( Y | X ) [Rooshenas and Lowd, 2016, Rahman et al., 2019, Shao et al., 2020] can only impose decomposability over the output variables
Y thus hindering the possibility to solve Eq.
(2) efﬁciently.
Non-certiﬁed Defenses.
There have been countless works proposing empirical defenses against adversarial examples.
Perhaps the most successful approach so far as been adversarial training Kurakin et al.
[2016], Madry et al.
[2018], in which training is performed on worst-case examples within a local neighborhood of each training example.
However, since none of these defenses possess provable guarantees, there is always the possibility that a new proposed attack could break them.
Indeed, most empirical techniques which are purported to be robust are quickly circumvented by better design of adversarial examples Athalye et al.
[2018], Athalye and Carlini [2018], Tramer et al.
As a result, many in the community have directed their attention towards approaches which provide certiﬁed protection.
Certiﬁed Defenses.
Many recent approaches provide certiﬁable guarantees that no adversarial example exists within a certain radius of a point.
Several of these approaches are exact, including those based on SMT solvers Katz et al.
[2017], Ehlers [2017] or mixed integer linear programs Tjeng et al.
[2017], Lomuscio and Maganti [2017],
Fischetti and Jo [2017].
Unfortunately, these approaches are generally not computationally efﬁcient due to the underlying optimization techniques.
Other recent works sacriﬁce these exact guarantees for conservative ones (i.e., a point’s certiﬁed radius may be more narrow than its true one) in order to reduce computation Wong and Kolter [2018], Wang et al.
[2018], Raghunathan et al.
[2018a,b], Dvijotham et al.
[2018a,b], Mirman et al.
[2018], Zhang et al.
[2018], Salman et al.
[2019b], though it still has trouble scaling to large network sizes.
Randomized smoothing is the most relevant approach to our investigation.
This achieves better scalability than other certiﬁed methods, though the guarantees
% c e r t i f i e d p o i n t s
DecoNet DNN
ConvNet
MNIST (ε = 4.0)
Gaussian noise (σ) 0.
0.4     % c
[Figure]
r t i f i e d p o i n t s
[Figure] [Figure]
[Figure] [Figure]
where DecoNets and FMNIST (bottom).
We can see that
DecoNets are competitive with ConvNets for all σ values and with DNNs for σ ≤ 1 , for larger values adversarial samples are not easily recognizable by humans.
provided are only probabilistic.
The ﬁrst applications of randomized smoothing were empirical defenses Liu et al.
[2018], Cao and Gong [2017], but Lecuyer et al.
Lecuyer et al.
[2019] proved certiﬁed (cid:96) 2 robustness using techniques from differential privacy Dwork et al.
[2006], which later works reﬁned Cohen et al.
[2019], Salman et al.
[2019a].
Other works have applied randomized smoothing for certiﬁed robustness in other distances, including (cid:96) 1 , (cid:96) ∞ , (cid:96) 0 , and Wasserstein distance Teng et al.
[2019], Zhang et al.
[2019], Levine and Feizi [2020a,b], Lee et al.
[2019], Yang et al.
Finally, yet another line of work guarantees certiﬁed (cid:96) ∞ -robustness by imposing a Lipschitz property on the network via alternative architectures Anil et al.
Li et al.
While our approach also introduces a new architecture for robustness, we differ in that our architecture instead supports closed-form computation of expectations, and we certify (cid:96) 2 rather than (cid:96) ∞ robustness.
EXPERIMENTS
In this section, we aim to answer the following questions:
Q1)
Are DecoNets as expressive as other deep models like
DNNs and convolutional neural networks (ConvNets)?
Q2)
Do DecoNets possess similar robustness properties as these other architectures?
Q3)
How do Deconets compare to these other models in terms of time and accuracy when certifying data points?   ε - L2 Norm Bound R o b u s t A cc
[Figure]
[Figure]
MNIST (σ=0.1)
DecoNet
DNN
ConvNet   ε - L2 Norm Bound
[Figure]
(σ=
[Figure]
Datasets.
To answer the aforementioned questions, we utilize MNIST LeCun [1998] and Fashion-MNIST Xiao et al.
In future works we plan to scale DecoNets to accurately classify larger image problems such as ImageNet
Deng et al.
[2009], which undoubtedly requires to accomodate additional architectural biases in our framework as well as more computational resources to run a systematical empirical evaluation.
Model Architectures.
The baseline models being used are fully connected DNNs with ReLU activations and ConvNets with a fully-connected classiﬁcation layer.
For the
DecoNet trained on MNIST (resp.
FMNIST), we build a region graph splitting each region dimensions into 5 ( d ,
Sec. 3) pieces and we use 8 (resp.
12) input perceptrons per input regions.
For DecoNets we use a weight decay of 0 . 0002 and experimented with dropout, ﬁnding it less MNIST FMNIST (1M) DNN
C ONV N ET
D ECO N ET
DNN C ONV N ET D ECO N ET 98. we can
, the DecoNet is able to obtain comparable beneﬁcial for certiﬁed accuracies.
Finally, we employ for
DecoNets a uniform combination of multiple classiﬁcation output layers as to have gradients backpropagate at different depths as in GoogLeNetSzegedy et al.
Additional architectural details are reported in the Appendix.
All models on MNIST (resp.
FMNIST) have roughly 300K (resp.million) parameters.
Q1)
Natural accuracy.
Tab. 1 summarizes the accuracy of all models on all datasets.
DecoNets perform comparably to all baselines despite having a an additional structural constraint like decomposability.
As the models have the same parameter counts, we can deduce that DecoNets can be as expressive efﬁcient as ConvNets and DNNs.
These results are quite promising since they hint that a deep model that allows to perform smoothing exactly and in a single pass can be as accurate as intractable ones, therefore we can answer our research question afﬁrmatively.
Q2)
Robust accuracy.
To answer this question we considered the (cid:96) 2 -PGD attack Madry et al.
Note that this attack produces similar results to the DDN (cid:96) 2 attack
Rony et al.
[2019], which just requires fewer iterations.
For this attack, we ﬁx the number of iterations to be 40 and the epsilon threshold to vary from 2 to 4 in increments of 0.2.
The method for adversarial training employed in this paper is the same as the robust training procedure in Madry et al.
This procedure takes the attacked data point as the input for the DecoNet and trains on this sample instead of the existing sample.
Tab. 1 collects our results.
DecoNets have comparable robust accuracy as the baseline model comparisons with results for Fashion-MNIST, DecoNets that are only approximately 2% worse in robust accuracy.
Despite this, we observe that DecoNets share the same properties as deep networks when it comes to adversarial defenses.
In
Fig.
4 we notice that as the value of (cid:15) increases, the change in the robust accuracy is not large.
Q3)
Certiﬁed accuracy and times Fig.
3 illustrates our results.
For small values of σ ≤ 1 , DecoNets are able to certify more samples than ConvNets and DNNs for MNIST and still surpass ConvNets on FMNIST.
For larger σ , DNNs certify a higher percentage but have a lower natural accuracy.
On the other hand, DecoNets are always competitive with ConvNets.
This is quite promising for a novel deep model class such as DecoNets: with respect to these other baselines they introduce an additional structural constraint, decomposability, have not access to the myriad of “tricks of the trade” brought up in the burgeoning deep learning literature and yet perform competitively.
More importantly, they can deliver much faster and exact certiﬁcation guarantees.
Fig.
1 shows that despite GPU computations and batching
Monte Carlo samples, to certify a single input point for σ = 1 , a radius of 2 σ and with 99 . 99% conﬁdence for both
DNNs and ConvNets of different sizes takes up to 4 orders of magnitude more than for DecoNets.
DISCUSSION AND CONCLUSION
In this paper, we introduced DecoNets, a promising novel class of deep classiﬁers that is able to provide exact guarantees for adversarial robustness in a fraction of the time that comparably expressive deep and convolutional neural networks would require to match them with very high probability.
We also proposed a simple way to build DecoNets for image data, by combining recent advancements in the literature of deep classiﬁers and probabilistic circuits.
At the same time, several interesting questions arise around this novel model class.
First, we would like to scale building and learning DecoNets for larger benchmarks including
Cifar-10 and ImageNet, employ more sophisticated modules from “the deep learning toolkit” such as residual connections and demonstrate their robustness properties as well.
Finally, we would like to investigate which other inference scenarios the structural properties of DecoNets can tractably deal with, thus distilling deep classiﬁers that are reliable and yet efﬁcient.
A APPENDIX Proof of Thm. 2.
Proof.
By linearity of expectations and by grouping expectations into tensors as in Def.
1.1 we obtain that:
[Equation]
where a, b, c denote the functionals a ( x )
=
g ( x 1 ) T · W · h ( x 2 ) , b
= g ( x 1 ) T · U and c = V · h ( x 2 )
+ b .
Then, by noting that each i -th entry in a computes (cid:80) m,n W m,i,n · g ( x 1 ) m · h ( x 2 ) n and that the joint Gaussian density over the noise fully factorizes as N ( (cid:15) ; 0 , σ 2 I ) =
N ( (cid:15) 1 ; 0 m , σ 2 I m ) · N ( (cid:15) 2 ; 0 n , σ 2 I n ) where (cid:15) =
[ (cid:15) 1 ; (cid:15) 2 ] denotes the Gaussian noise vector partitioned in the same way as x = [ x 1 ; x 2 ] we obtain that
[Equation]
by ﬁrst applying the linearity of expectations and then by noting that we can break the expectation over the product of functions over independent variables as the product of expectations.
By collecting all these entries in tensors we obtain that
[Equation]
Lastly, we can retrieve the second and third term in Eq.
(5) by noting that the i -th component of ¯ f bσ ( x ) can be computed as ¯ f bσ ( x ) i =
[Equation]
N
[Equation]
1 ; 0 m , σ
[Equation]
I
[Equation] [Equation]
N
[Equation] [Equation]
[Equation]
g
[Equation] [Equation]
[Equation]
U : ,i d (cid:15) 1 × (cid:82) N ( (cid:15) 2 ; 0 n , σ 2 I n ) d (cid:15) 2 = (cid:0) ¯ f gσ ( x 1 ) (cid:1) T · U : ,i and equivalently ¯ f cσ ( x ) j = V j, : · ¯ f hσ · ( x 2 ) .
Rearranging these entries in tensor form completes the proof.
Proof of Prop. 2.
Proof.
First note that
[Equation]
Equation (10) is further
[Equation]
where H = { (cid:15) : w (cid:62) (cid:15) ≥ − w (cid:62) x − b } .
Concerning the ﬁrst term in (12), note that w (cid:62) (cid:15) is a univariate Gaussian with w (cid:62) (cid:15) ∼ N (0 , σ 2 (cid:107) w (cid:107) 2 ) .
Thus,
[Equation]
γ
[Equation]
where Φ is the standard normal CDF and γ = w T x + b σ (cid:107) w (cid:107) .
Note that the second term in (12) can be written as (cid:82) H p ( (cid:15) ) w (cid:62) (cid:15) d (cid:15)
= (cid:82) H p ( (cid:15) (cid:48) )
σ w (cid:62) (cid:15) (cid:48)
d (cid:15) (cid:48) , where (cid:15) (cid:48) ∼ N ( 0 , I ) .
Furthermore we can re-write the half-space H as H =
(cid:110) (cid:15) (cid:48) :
w (cid:62) (cid:107) w (cid:107) (cid:15) (cid:48) ≥ − w (cid:62) x − b σ (cid:107) w (cid:107) (cid:111) .
We can use now Theorem 5 in Sharples and
Pezzey [2007], which provides an exact expression for integrals of linear functions with respect to the Gaussian measure over halfspaces, precisely the form of this term.
This yields
[Equation]
(13) concluding the proof.
B EXPERIMENTS B.1 MODEL ARCHITECTURES
The architecture for the DNNs is a fully connected layer, followed by a ReLU activation, repeated three times and ﬁnally a fully connected head to the number of classes to be predicted followed by a softmax layer.
The number of units in each layer is dependent on which dataset is being used.
For MNIST, the units at each layer are [340, 150, 50, 10].
For Fashion-MNIST, the units are [700, 500, 200, 10].
For MNIST, the number of parameters is 326110 and for Fashion-MNIST, the number of parameters is 1,002,210.
The ConvNet’s architecture is two convolutional layers with a
kernel size of 5, followed by 4 fully connected layers and a softmax layer.
The ConvNet contains 305,510 parameters for MNIST and 1,033,140 parameters for Fashion-MNIST. The DecoNet has 319,440 parameters for MNIST and 1,051,260 parameters for FMNIST.