Improving Certified Robustness via Statistical Learning with Logical Reasoning
Abstract
Intensive algorithmic efforts have been made to enable the rapid improvements of certificated robustness for complex ML models recently.
However, current robustness certification methods are only able to certify under a limited perturbation radius.
Given that existing pure data-driven statistical approaches have reached a bottleneck, in this paper, we propose to integrate statistical ML models with knowledge (expressed as logical rules) as a reasoning component using
Markov logic networks (MLN), so as to further improve the overall certified robustness.
This opens new research questions about certifying the robustness of such a paradigm, especially the reasoning component (e.g., MLN).
As the first step towards understanding these questions, we first prove that the computational complexity of certifying the robustness of MLN is #P -hard.
Guided by this hardness result, we then derive the first certified robustness bound for MLN by carefully analyzing different model regimes.
Finally, we conduct extensive experiments on five datasets including both high-dimensional images and natural language texts, and we show that the certified robustness with knowledge-based logical reasoning indeed significantly outperforms that of the state-of-the-arts.
Introduction
Given extensive studies on adversarial attacks against ML models recently [3, 13, 39, 24, 64, 23, 53], building models that are robust against such attacks is an important and emerging topic.
Thus, a plethora of empirical defenses have been proposed to improve the ML robustness [30, 59, 22, 43, 53, 52]; however, most of these are attacked again by stronger adaptive attacks [3, 1, 46].
To end such repeated security cat-and-mouse games, there is a line of research focusing on developing certified defenses for DNNs under certain adversarial constraints [8, 26, 25, 54, 28, 61, 27, 60, 58].
Though promising, existing certified defenses are restricted to certifying the model robustness within a limited ℓ p norm bounded perturbation radius [56, 8].
One potential reason for such limitations for existing robust learning approaches is inherent in the fact that most of them have been treating machine learning as a “pure data-driven" technique that solely depends on a given training set, without interacting with the rich exogenous information such as domain knowledge (e.g., a stop sign should be of the octagon shape ); while we know human, who has knowledge and inference abilities, is resilient to such attacks.
Indeed, a recent seminal work [17] illustrates that integrating knowledge rules can significantly improve the empirical robustness of ML models, while leaving the certified robustness completely unexplored.
In this paper, we follow this promising Learning+Reasoning paradigm [17] and conduct, to our best knowledge, the first study on certified robustness for it.
Actually, such a Learning+Reasoning paradigm has enabled a diverse range of applications [38, 62, 2, 37, 32, 55, 17] including the ECCV’ best paper [10] that encodes label relationships as a probabilistic graphical model and improves the empirical performance of deep neural networks on ImageNet.
In this work, we first provide a concrete
Sensing-reasoning pipeline following such paradigm to integrate statistical learning with logical reasoning as illustrated in Figure 1.
In particular, the Sensing Component contains a set of statistical
ML models such as deep neural networks (DNNs) that output their predictions as a set of Boolean random variables; and the Reasoning Component takes this set of Boolean random variables as inputs for logical inference models such as Markov logic networks (MLN) [40] or Bayesian networks (BN) [36] to produce the final output.
We then prove the hardness of certifying the robustness of such a pipeline with MLN for reasoning.
Finally, we provide an algorithm to certify the robustness of sensing-reasoning pipeline and we evaluate it on five datasets including both image and text data.
[Figure]
𝑝 ”!)
*+” ∈[0.9,1.0] 𝑝 *,"-&#’ ∈[0.9,1.0] 𝑣 !"
#$!
%&’ 𝑣 ”!)
*+” 𝑣 *,"-&#’ 𝑣 !"
#$!
%&’ ⇒𝑣 *,"-&#’ 𝑣 ”!)
*+” ⇒𝑣 !"
#$!
%&’ 𝑝 !"
#$!
%&’ ∈[0.7,1.0] 𝑝 ”!)
*+” ∈[0.95,1.0] 𝑝 *,"-&#’ ∈[0.95,1.0]
L Cannotcertify
J Certified!
+ = Better Certified Robustness
Improved RobustnessCertificates
[Figure]
However, certifying the robustness of sensingreasoning pipeline is challenging, especially given the inference complexity of the reasoning component.
Our goal is to take the first step in tackling this challenge.
In particular, the robustness certification of sensing-reasoning pipeline can be expressed as the confidence interval of the marginal probability for the final output of reasoning component .
That is to say, we can use existing state-of-the-art methods to certify the robustness of the sensing component that contains DNNs or ensembles [8, 42, 57].
Thus, to provide the end-to-end certification for the whole pipeline, what is left is to understand how to certify the reasoning component , which is the focus of this work.
Compared with previous efforts focusing on certified robustness of neural networks, the reasoning component brings its own challenges and opportunities.
Different from a neural network whose inference can be executed in polynomial time, many reasoning models such as MLN can be #Pcomplete for inference.
However, as many reasoning models define a probability distribution in the exponential family, we have more functional structures that could potentially make the robustness optimization (which essentially solves a min-max problem) easier.
In this paper, we provide the first treatment to this problem characterized by these unique challenges and opportunities.
We focus on MLN as the reasoning component , and explored three technical questions, each of which corresponds to a technical contribution of this work.
Is certifying robustness for the reasoning component feasible when the inference of the reasoning component is #P -hard?
(Section 3)
Before any concrete algorithm can be proposed, it is important to understand the computational complexity of the robustness certification.
We first prove that the famous problem of counting in statistical inference [49] can be reduced to the problem of checking the certified robustness of general reasoning components and MLN.
Therefore, checking certified robustness is no easier than counting on the same family of distribution.
In other words, when the reasoning component is a graphical model such as MLN, checking certified robustness is no easier than calculating the partition function of the underlying graphical model, which is #P -hard.
Can we efficiently reason about the certified robustness for the reasoning component when given an oracle for statistical inference?
(Section 4.2) Given the above hardness result, we focus on certifying the robustness given an inference oracle.
However, even when statistical inference can be done by a given oracle [21, 18], it is still challenging to certify the robustness of MLN.
Our second technical contribution is to develop such an algorithm for MLN as the reasoning component.
We prove that providing certified robustness for MLN is possible because of the structure inherent in the probabilistic graphical models and distributions in the exponential family, which could lead to monotonicity and convexity properties under certain conditions for solving the certification optimization.
Can a reasoning component improve the certified robustness compared with the state-of-the-art certification methods?
(Section 5)
We test our algorithms on multiple sensing-reasoning pipelines, in which the sensing components contain the state-of-the-art deep neural networks .
We construct these pipelines to cover a range of applications including image classification and natural language processing tasks.
We show that based on our certification method on the reasoning component, the knowledge-enriched sensing-reasoning pipelines achieves significantly higher certified robustness than the state-of-the-art certification methods for DNNs.
The rest of the paper is organized as follows.
We will first introduce the design of the sensingreasoning pipeline in Section 2.1, followed by concrete illustrations taking the Markov Logic
Networks as an example of the reasoning component in Section 2.2.
Next, to certify the robustness of the sensing-reasoning pipeline, especially for the reasoning component, we first prove that certifying the robustness of the reasoning component itself is #P
-complete
(Section 3), and therefore we propose a certification algorithm to upper/lower bound the certification in Section 4, We provide the evaluation of our robustness certification considering different tasks in Section 5.
Robust Statistical Learning with Logical Reasoning
In this section, we first provide a sensing-reasoning pipeline and then formally defined its certified robustness, and particularly links it to certifying the robustness for the reasoning component.
2.1 Sensing-Reasoning Pipeline
[Figure]
) 𝑓 "#$ 𝑓 &’( 𝑓 ’)
*+’, 𝑣 "#$ 𝑣 &’( 𝑣 ’)*+’, 𝑓 "⇒’ 𝑓 &⇒’ factor factor function weight 𝑓 "#$ 𝑓 "#$ 𝑣 =𝑣 log 𝑝 "#$ (𝑋) 1−𝑝 "#$ (𝑋)
[Figure]
⇒’
[Figure]
A sensing-reasoning pipeline contains a set of n sensors { S i } i ∈ [ n ] and a reasoning component R .
Each sensor is a binary classifier (for multi-class classifier it corresponds to a group of sensors) — given an input data example X , each of the sensor S
i outputs a probability p
i ( X ) (i.e., if S i is a neural network, p i ( X ) represents its output after the final softmax layer).
The reasoning component takes the outputs of all sensing models as its inputs, and outputs a new Boolean random variable R ( { p i ( X ) } i ∈ [ n ] ) .
One natural choice of the reasoning component is to use a probabilistic graphical model (PGM).
In the following subsection, we will make the reasoning component R more concrete by instantiating it as a Markov logic network (MLN).
The output of a sensing-reasoning pipeline on the input data example X is the expectation of the output of reasoning component R : E
[ R ( { p i ( X ) } i ∈ [ n ] )] .
Example.
A sensing-reasoning pipeline provides a generic, principled way of integrating domain knowledge with the output of statistical predictive models such as neural networks.
One such example is [10] the task of ImageNet classification.
Here each sensing model corresponds to the classifier for one specific class in ImageNet, e.g., S dog ( X ) and S animal ( X ) .
The reasoning component then encodes domain knowledge such that “ If an image is classified as a dog then it must also be classified as an animal ” using a PGM.
There is no prior work considering the certified robustness of such a knowledge-enabled ML pipeline.
Figure 2 illustrates a concrete sensing-reasoning pipeline, in which the reasoning component is implemented as an MLN.
2.2 Reasoning Component as Markov Logic Networks
Given the generic definition of a sensing-reasoning pipeline, one can use different models to implement the reasoning components.
In this paper, we focus on Markov logic networks (MLN), which is a popular way to define a probabilistic graphical model using first-order logic [41].
Concretely, we define the reasoning component implemented as an MLN, which contains a set of weighted first-order logic rules, as illustrated in Figure 2(b).
After grounding, an MLN defines a joint probabilistic distribution among a collection of random variables, as illustrated in Figure 2(c).
We adapt the standard MLN semantics to a sensing-reasoning pipeline and use a slightly more general variant compared with the original MLN [41].
Each MLN program corresponds to a factor graph — Due to the space limitation, we will not discuss the grounding part and point the readers to [41].
We focus on defining the result after grounding, i.e., the factor graph.
Specifically, a grounded MLN is a factor graph G =
( V , F ) , where V is a set of Boolean random variables.
Specific to a sensing-reasoning pipeline, there are two types of random variables V
= X ∪Y :
Interface Variables X
= { x i } i ∈ [ n ] : Each sensing model S i corresponds to one interface variable x
i in the grounded factor graph; 2.
Interior variables Y =
{ y i } i ∈ [ m ] are other variables introduced by the MLN model.
Each factor F ∈ F contains a weight w F and a factor function f F defined over a subset of variables ¯ v F ⊆ V that returns { 0 , 1 } .
There are two sets of factors F = G ∪ H :
Interface Factors G : For each interface variable x
i , we create one interface factor G i with weight w G i = log
[ p i ( X ) / (1 − p
i ( X ))] and factor function f
G i ( a ) =
I [ a = 1] defined over ¯ v f Gi = { x i } .
Interior Factors H are other factors introduced by the MLN program.
Remarks: MLN-specific Structure.
Our result applies to a more general family of factor graphs and are not necessarily specific to those grounded by MLN.
Moreover, MLN provides an intuitive way of grounding such a factor graph with domain knowledge, and factor graphs grounded by MLN have certain properties that we will use later, e.g., all factors only return non-negative values, and there are no unusual weight sharing structures.
The above factor graph defines a joint probability distribution among all variables V .
We define a possible world as a function σ : V (cid:55)→ { 0 , 1 } that corresponds to one possible assignment of values to each random variable.
Let Σ denote the set of all (exponentially many) possible worlds.
The statistical inference process of a reasoning component implemented using MLNs [41] computes the marginal probability of a given variable v ∈ V :
[Equation]
where the partition functions Z 1 and Z 2 are defined as
[Equation]

[Equation]
Why w G i = log[ p i ( X ) / (1 − p
i ( X ))] ?
When the MLN does not introduce any interior variables and interior factors, it is easy to see that setting w G i = log
[ p i ( X ) / (1 − p
i ( X ))] ensures that the marginal probability of each interface variable equals to the output of the original sensing model p i ( X ) .
This means that if we do not have additional knowledge in the reasoning component, the pipeline outputs the same distribution as the original sensing component.
Learning Weights for Interior Factors?
In this paper, we view all weights for interior factors as hyperparameters.
These weights can be learned by maximizing the likelihood with weight learning algorithms for MLNs [29].
Beyond Marginal Probability for a Single Variable.
We have assumed that the output of a sensingreasoning pipeline is the marginal probability distribution of a given random variable in the grounded factor graph.
However, our result can be more general — given a function over possible worlds and outputs { 0 , 1 } , the output of a pipeline can be the marginal probability of such a function.
This will not change the algorithm that we propose later.
Hardness of Certifying Reasoning Robustness
Given a reasoning component R , how hard is it to reason about its robustness?
In this section, we aim at understanding this fundamental question.
In order to provide the certified robustness of the reasoning component, which is defined as the lower bound of model predictions for inputs considering an adversarial perturbation with bounded magnitude [8], we need to analyze the hardness of this certification problem first.
Specifically, we present the hardness results of determining the robustness of the reasoning component defined above, before we can provide our certification algorithm in
Section 4.2.
We start by defining the counting [49] and robustness problems on general distribution.
We prove that counting can be reduced to checking for reasoning robustness, and hence the latter is at least as hard; We then prove the complexities of reasoning with MLN.
3.1 Harness of Certifying General Reasoning Model
Let X = { x 1 , x 2 , . . .
, x n } be a set of variables.
Let π α be a distribution over D [ n ] defined by a set of parameters α ∈ P [ m ] , where D is the domain of variables, either discrete or continuous, and P is the domain of parameters.
We call π accessible if for any σ ∈ D [ n ] , π α ( σ ) ∝ w ( σ ; α ) , where w : D [ n ] × P [ m ] → R ≥ 0 is a polynomial-time computable function.
We will restrict our attention to accessible distributions only.
We use Q : D [ n ] → { 0 , 1 } to denote a Boolean query, which is a polynomial-time computable function.
We define the following two oracles:
Definition 1 (C OUNTING ) .
Given input polynomial-time computable weight function w ( · ) and query function Q ( · ) , parameters α , a real number ϵ > 0 , a C OUNTING oracle outputs a real number Z that
[Equation]
Definition 2 (R OBUSTNESS ) .
Given input polynomial-time computable weight function w ( · ) and query function Q ( · ) , parameters α , two real numbers ϵ > 0 and δ > 0 , a R OBUSTNESS oracle decides, for any α ′ ∈ P [ m ] such that ∥ α − α ′ ∥ ∞ ≤ ϵ , whether the following is true:
[Equation]
We can prove that R OBUSTNESS is at least as hard as C OUNTING by a reduction argument.
Theorem 1 (C OUNTING ≤ t R OBUSTNESS ) .
Given polynomial-time computable weight function w ( · ) and query function Q ( · ) , parameters α and real number ϵ > 0 , the instance of C OUNTING , ( w, Q, α, ϵ ) can be determined by up to O (1 /ε 2 c ) queries of the R OBUSTNESS oracle with input perturbation
ϵ
=
O ( ε c ) .
Proof-sketch.
We define the partition function Z i :=
(cid:80) σ : Q ( σ )=
i w ( σ ; α ) and E [ σ ∼ π α ] Q ( σ ) =
Z 1 / ( Z 0 + Z 1 ) .
We then construct a new weight function t ( σ ; α ) :
= w ( σ ; α ) exp( βQ ( σ )) by introducing an additional parameter β , such that τ β ( σ ) ∝ t ( σ ; β ) , and E [ σ ∼ τ β ] Q ( σ ) =
e β Z 1 Z 0 + e β Z 1 .
Then we consider the perturbation β ′ =
β ± ϵ , with ϵ =
O ( ε c ) and query the R OBUSTNESS oracle with input ( t, Q, β, ϵ, δ ) multiple times to perform a binary search in δ to estimate | E [ σ ∼ π β ] Q ( σ ) − E [ σ ∼ π β ′ ]
Q ( σ ) | .
Perform a further “outer" binary search to find the β which maximizes the perturbation.
This yields a good estimator for log Z 0 Z 1 which in turn gives
E [ σ ∼ π α ] Q ( σ ) with ε c multiplicative error.
We leave detailed proof to Appendix A.
3.2 Hardness of Certifying Markov Logic Networks
Given Theorem 1, we can now state the following result specifically for MLNs:
Theorem 2 (MLN Hardness) .
Given an MLN whose grounded factor graph is G =
( V , F ) in which the weights for interface factors are w G
i = log p
i ( X ) / (1 − p
i ( X )) and constant thresholds δ, { C i } i ∈ [ n ] , deciding whether
[Equation]
} i ∈ [ n ] ( ∀ i. | ϵ
i | < C i ) =
⇒ (cid:12)(cid:12) E R MLN ( { p i ( X ) } i ∈ [ n ] ) − E R MLN ( { p i ( X ) + ϵ i } i ∈ [ n ] ) (cid:12)(cid:12) <
δ is as hard as estimating E R MLN ( { p i ( X ) } i ∈ [ n ] ) up to ε c multiplicative error, with ϵ i
= O ( ε c ) .
Proof.
Let α =
[ p i ( X )] , query function Q ( . )
=
R MLN ( . ) and π α defined by the marginal distribution over interior variables of MLN.
Theorem 1 directly implies that O (1 /ε 2 c ) queries of a
R OBUSTNESS oracle can be used to efficiently estimate E R MLN ( { p i ( X ) } i ∈ [ n ] ) .
In general, statistical inference in MLNs is #P -complete, and checking robustness for general MLNs is also #P -hard.
Certifying the Robustness of Sensing-Reasoning Pipeline
Given a sensing-reasoning pipeline with n sensors { S i } i ∈ [ n ] and a reasoning component R , we will first formally define its end-to-end certified robustness and then its connection to the robustness of each component.
In particular, based on the above hardness result for certifying the robustness of the reasoning component in Section 3, we will provide an effective certification method to upper/lower bound the certification, taking any oracle for the inference of the reasoning component into account.
With the certification of the reasoning component, we will finally provide the robustness certification for the sensing-reasoning pipeline by combining the certification of sensing and reasoning components.
Definition 3 ( ( C I , C E , p ) -robustness) .
A sensing-reasoning pipeline with n sensors { S i } i ∈ [ n ] and a reasoning component R is ( C I , C E , p ) -robust
on the input X , if for input perturbation η, ||
η || p ≤ C
I (cid:12)(cid:12) E
[ R ( { p i ( X ) } i ∈ [ n ] )] − E
[ R ( { p
[Equation] [Equation]
+
[Equation] [Equation]
[Equation]
] (cid:12)(cid:12)
[Equation]
E .
I.e., a perturbation ||
η || p <
C I on the input only changes the final pipeline output by at most C E .
Sensing Robustness and Reasoning Robustness.
We decompose the end-to-end certified robustness of the pipeline into two components.
The first component, which we call the sensing robustness , has been studied by the research community recently [20, 45, 8] — given a perturbation
||
η || p <
C I on the input X , we say each sensor S
i is ( C I , C ( i ) S , p ) -robust
if
[Equation]
The robustness of the reasoning component R is defined as: Given a perturbation | ϵ i | < C ( i ) S on the output of each sensor
S i ( X ) , we say the reasoning component R is (cid:16) { C ( i ) S } i ∈ [ n ] , C E (cid:17) -robust
if ∀ ϵ 1 , ..., ϵ n , ( ∀ i. | ϵ i | ≤ C ( i ) S )
=
⇒ (cid:12)(cid:12) E
[ R ( { p i ( X ) } i ∈ [ n ] )] − E
[ R ( { p i ( X )
+ ϵ i } i ∈ [ n ] )] (cid:12)(cid:12)
≤ C E .
It is easy to see that when the sensing component is (cid:16) C I , { C ( i ) S } i ∈ [ n ] , p (cid:17) -robust
and the reasoning component is (cid:16) { C ( i ) S } i ∈ [ n ] , C E (cid:17) -robust on X , the sensing-reasoning pipeline is ( C I , C E , p ) -robust.
Since the sensing robustness has been intensively studied by previous work, in this paper, we mainly focus on the reasoning robustness and therefore analyze the robustness of the pipeline.
4.1 Certifying Sensing Robustness
There are several existing ways to certify the robustness of sensing models, such as Interval Bound
Propagation (IBP) [16], Randomized Smoothing [8], and others [63, 51].
Here we will leverage randomized smoothing to provide an example for certifying the robustness of sensing components.
Corollary 1.
Given a sensing model S i , we construct a smoothed sensing model
g i ( X ; ˆ σ ) =
E ξ ∼N (0 , ˆ σ 2 ) p i ( X + ξ ) .
With input perturbation
||
η || 2 ≤ C
I , the smoothed sensing model satisfies
[Equation]
where Φ is the Gaussian CDF and Φ − 1 as its inverse.
Algorithm 1 Algorithms for MLN robustness upper bound (algorithm of lower bound is similar)
[Table] [Table]
- bations {
[Table]
} i
[Table]
[ n ] .
[Table] [Table]
( X ) + ϵ i } )
[Table]
: initialize λ 3: for search budgets do 4: update
5: for to do 6: if then 7:
C
8: else if then 9:
C
C
10: end if 11:
R ← (cid:102) Z n
(cid:102)
Z i }
i
[ n
R min ← min( R min , R ) 13: end for 14: end for 15: return R min
Thus, the output probability of smoothed sensing model can be bounded given input perturbations.
Note that the specific ways of certifying sensing robustness is orthogonal to certifying reasoning robustness, and one can plug in different sensing certification strategies.
4.2 Certifying Reasoning Robustness
Given the hardness results for certifying reasoning robustness in Section 3.2, in this paper, we assume that we have access to an oracle for statistical inference, and provide a novel algorithm to certify the reasoning robustness.
I.e., we assume that we are able to calculate the two partition functions
Z 1 ( { p i ( X ) } i ∈ [ n ] ) and Z 2 ( { p i ( X ) } i ∈ [ n ] ) .
Lemma 4.1 (MLN Robustness) .
Given access to partition functions Z 1 ( { p i ( X ) } i ∈ [ n ] ) and
Z 2 ( { p i ( X ) } i ∈ [ n ] ) , and maximum perturbations
{ C i } i ∈ [ n ] , ∀ ϵ 1 , ..., ϵ n , if ∀ i. | ϵ
i | <
C i , we have that ∀ λ
[Equation]
, ..., λ n ∈ R ,
[Equation]
where
[Equation]
We leave the proof to the Appendix B.
The high-level proof idea is to decouple Z 1 /Z 2 into two sub-problems via a collection of Lagrangian multipliers, i.e., { λ i } .
For any assignment of { λ i } , we obtain a valid upper/lower bound, which reduces the certification process to the process of searching for an assignment of these multipliers that minimize the upper bound (maximize the lower bound).
To efficiently search for the optimal assignment of { λ i } , it is crucial to consider the interactions between these { λ i } and the corresponding solution of (cid:102) Z r , which hinges on the structure of MLN.
In particular, we can prove the following (Detailed proofs and discussions in Appendix C):
Proposition 1 (Monotonicity) .
When λ i ≥ 0 , (cid:102) Z r ( { ϵ i } i ∈ [ n ] ) monotonically increases w.r.t.
ϵ i ; When λ i ≤ − 1 , (cid:102)
Z r ( { ϵ i } i ∈ [ n ] ) monotonically decreases w.r.t.
ϵ i .
Proposition 2 (Convexity) .
(cid:102)
Z r ( { ˜ ϵ i } i ∈ [ n ] ) is a convex function in ˜ ϵ
i , ∀ i with
[Equation]
Implication.
Given the monotonicity region, the maximal and minimal of (cid:102)
Z r are achieved at either ϵ i = − C
i or ϵ i
= C i respectively.
Given the convexity region, the maximal is achieved at ϵ i ∈ {− C i , C i } , and the minimal is achieved at ϵ i ∈ {− C i , C i } or at the zero gradient of (cid:102)
Z r ( { ˜ ϵ i } i ∈ [ n ] ) .
As a result, our analysis leads to the following certification algorithm.
Algorithm of Certifying Reasoning Robustness.
Algorithm 1 illustrates the detailed algorithm based on the above result to upper bound the robustness of MLN.
The main step is to explore different regimes of the { λ i } .
In this paper, we only explore regimes where λ ∈ ( −∞ , − 1] ∪ [0 , + ∞ ) as this already provides reasonable solutions in our experiments.
The function update ( { λ i } ) defines the exploration strategy — Depending on the scale of the problem, one can explore { λ i } using grid search, random sampling, or even gradient-based methods.
For experiments in this paper, we use either grid search or random sampling.
It is an exciting future direction to understand other efficient exploration and search strategies.
We leave the detailed explanation of the algorithm to Appendix C.
Experiments
We conduct intensive experiments on five datasets to evaluate the certified robustness of the sensingreasoning pipeline.
We focus on two tasks with different modalities: image classification task on
Road Sign dataset created based on GTSRB dataset [44] following the standard setting as [17]; and information extraction task with stocks news on text data.
We also report additional results on two other image classification tasks (Word50 [6] and PrimateNet, which is a subset of ImageNet
ILSVRC2012 [9]) with natural knowledge rules in Appendix G and Appendix F. We also report results on standard image benchmarks (MNIST and CIFAR10) with manually constructed knowledge rules in Appendix H.
The code is provided at https://github.com/Sensing-Reasoning/
Sensing-Reasoning-Pipeline .
5.1 Experimental Setup
Datasets and Tasks.
For the road sign classification task, we follow [17] and use the same dataset
GTSRB [44], which contains 12 types of German road signs {"Stop”, "Priority Road”, "Yield”, "Construction Area”, "Keep Right”, "Turn Left”, "Do not Enter”, "No Vihicles”, "Speed Limit 20”, "Speed Limit 50”, "Speed Limit 120”, "End of Previous Limitation”}.
It consists of 14880 training samples, 972 validation samples, and 3888 testing samples.
We also include 13 additional detectors for knowledge integration, detecting attributes such as whether the border has an octagon shape (See
Appendix D for a full list).
For the information extraction task, we use the HighTech dataset which consists of both daily closing asset price and financial news from 2006 to 2013 [12].
We choose 9 companies with the most news, resulting in 4810 articles related to 9 stocks filtered by company name.
We split the dataset into training and testing days chronologically.
We define three information extraction tasks as our sensing models: StockPrice(Day, Company, Price) , StockPriceChange(Day, Company,
Percent) , StockPriceGain(Day, Company) .
The domain knowledge that we integrate depicts the relationships between these relations (See Appendix E for more details).
Knowledge Rules.
We integrate different types of knowledge rules for these two applications.
We provide the full list of knowledge rules in the Appendix D.
For road sign classification , we follow [17], which includes two different types of knowledge rules —
Indication rules (road sign class u indicates attribute v ) and Exclusion rules (attribute classes u and v with the same general type such as "Shape”, "Color”, "Digit” or "Content” are naturally exclusive).
For information extraction , we integrate knowledge about the relationships between the sensing models (e.g., StockPrice , StockPriceChange , StockPriceGain ).
For example, the stock prices of two consecutive days, StockPrice ( d 1 , Company, p 1 ) and StockPrice ( d 2 , Company, p 2 ) , should be consistent with StockPriceChange ( d 2 , Company, p ) , i.e., p = ( p 2 − p 1 ) /p 1 .
Implementation Details.
Throughout the road sign classification experiment, we implement all sensing models using the GTSRB-CNN [13] architecture.
During training, we train all sensors with
Isotropic Gaussian ϵ ∼ N (0 , ˆ σ 2 I d ) augmented data with 50000 training iterations until converge and tune the training parameters on the validation set, following [8].
We use the SGD-momentum with the initial learning rate as 0 . 01 and the weight decay parameter as 10 − 4 to train all the sensors for 50000 iterations with 200 as the batch size, following [17].
During certification, we adopt the same smoothing parameter for training to construct the smoothed model based on Monte-Carlo sampling.
For information extraction, we use BERT as our model architecture.
During training, we use the final hidden state of the first token
[CLS] from BERT as the representation of the whole input and apply dropout with probability p = 0 .
5 on this final hidden state.
Additionally, there is a fully connected layer added on top of BERT for classification.
To fine-tune the BERT classifiers for three information tasks, we use the Adam optimizer with the initial learning rate as 10 − 5 and the weight decay parameter as 10 − 4 .
We train all the sensors for 30 epochs, and the batch size 32 .
Evaluation Metrics.
We adopt the standard certified accuracy as our evaluation metric, defined by the percentage of instances that can be certified under certain ℓ p -norm bounded perturbations.
Specifically, given the input x with ground-truth label y , once we can certify the bound of the model’s output confidence on predicting label y under the norm-bounded perturbation as [ L , U ] , the certified accuracy can be defined by: 1 N (cid:80) Ni
=
I ([ L i > 0 . 5]) where I ( · ) denotes the indicator function.
Since each sensing component’s certification is performed by randomized smoothing, which yields the failure probability characterized by ζ 0 , we will control the failure probability ζ for the whole sensing-reasoning pipeline pipeline with n sensing models as ζ 0 = 1 − (1 − ζ ) 1 /n by applying the union bound.
Throughout all the experiments, ζ is kept to 0 .
so our end-to-end certification is guaranteed to be correct with at least 99 . 9% confidence.
5.2 Results of Road Sign Classification
In this section, we evaluate the certified robustness of our sensing-reasoning pipeline under the ℓ 2 -norm bounded perturbation.
We first report the ℓ 2 certified accuracy of our sensing-reasoning pipeline and compare it to a strong baseline as a vanilla randomized smoothing trained model (without knowledge).
Note that it is flexible to replace the sensing component with other robust training algorithms.
We conduct our evaluation under different smoothing parameters ˆ σ = { 0 . 12 , 0 .
and various ℓ 2 perturbation magnitudes on the input image
C I = { 0 .
(Table 1).
During certification, we evaluate our certification time per sample with 25 sensors as 5.39s, which shows that the overall certification time is generally acceptable.
As shown in Table 1, we can see that with knowledge integration, sensing-reasoning pipeline achieves consistently higher certified accuracy compared to the baseline smoothed ML model without
[Table] [Table]
[Table]
knowledge under all the perturbation magnitudes C I and smoothing parameter ˆ σ settings.
Under the small perturbation magnitude cases, our improvement is very significant (around 5% ).
More interestingly, given large C I but small smoothing parameter ˆ σ , vanilla randomized smoothing-based certification directly fails ( 0% certified accuracy) due to the looseness of the hypothesis testing bound, while the sensing-reasoning pipeline could still achieve reasonable certified robustness (over 71% on
C I = 0 .
50 , 49% on C I = 1 . 00 )
under the same ( C I , ˆ σ ) settings.
This indicates a very realistic case: we always under-estimate the attacker’s ability easily under the real-world setting – in this case, the sensing-reasoning pipeline could remain robust even provide reasonable certified accuracy with a conservative smoothing parameter.
5.3 Results of Information Extraction
[Table]
In this section, we conduct the certified robustness evaluation on the information extraction task on text data.
Since there is no good certification method on discrete NLP data for sensing models, we directly assume the maximal perturbation on the output of sensors ( C S ).
Table 2 shows the certified accuracy on the final outputs of the reasoning component.
We see that the sensing-reasoning pipeline provides significantly higher certified robustness, and even under a high perturbation magnitude on all sensing models’ output confidence ( C S = 0 . 5 ), which means the sensing-reasoning pipeline can still leverage the knowledge to help enhance the robustness given strong attacker.
To further illustrate intuitively why such knowledge-based reasoning helps, Figure 3 shows the “margin” — the probability of the ground truth class minus the probability of the wrong class — with or without knowledge integration.
We see that, with knowledge integration, we can significantly increase the number of examples with a large “margin” under adversarial perturbations.
This explains the improvement of certified robustness, which highly relies on such prediction confident margin.
We also conduct experiments on PrimateNet, Word50, MNIST, CIFAR10 datasets for the image classification tasks in Appendix F- Appendix H. We observe similar results that knowledge integration significantly boosts the certified robustness.
Related Work
Robustness for Single ML model and ML Ensemble.
Lots of efforts have been made to improve the robustness of single ML or ensemble models.
Adversarial training [15], and its variations [47, 31, 53] have generally been more successful in practice, but usually come at the cost of accuracy and increased training time [48, 53].
To further provide certifiable robustness guarantees for ML models, various certifiable defenses and robustness verification approaches have been proposed [20, 45, 8, 27, 25].
Among these strategies, randomized smoothing [8] has achieved scalable performance.
With improvements in training, including pretraining and adversarial training, the certified robustness
[Figure]
Wrong
Correct with knowledge without knowledge
[Figure]
[Figure] [Figure]
[Figure]
P[
[Figure]
] –P
[Figure]
P
[Figure]
] –P
[Figure]
[Figure]
F r e qu e n cy bound can be further improved [4, 42].
In addition to the single ML model, some work proposed to promote the diversity of classifiers and therefore develop a robust ML ensemble [34, 59, 57, 58].
Although promising, these defense approaches, either empirical or theoretical, can only improve the robustness of a single ML or ensemble model.
Certifying or improving the robustness of such single or pure ensemble models is very challenging, given that there is no additional information that can be utilized.
In addition, the ML learning process usually favors a pipeline that is able to incorporate different sensing components as well as domain knowledge in practice.
Thus, certifying the robustness of such pipelines is of great importance.
Robustness of End-to-end ML Systems.
There have been intensive studies on joint inference between multiple models, and the predictions based on joint inference can help to further improve the clean accuracy of ML pipelines [55, 10, 38, 33, 7, 5], which have been applied to a range of real-world applications [2, 37, 32].
Often, these approaches use different statistical inference models such as factor graphs [50], Markov logic networks [41], and Bayesian networks [35] as a way to integrate domain knowledge.
In this paper, we take a different perspective on this problem — instead of treating joint inference as a way to improve the clean accuracy , we explore the possibility of using it as exogenous information to improve the end-to-end certified robustness of ML pipelines.
A recent work [17] explores the empirical robustness improvement via knowledge integration, while there is no robustness guarantee provided.
As we show in this paper, by integrating domain knowledge, we are able to improve the certified robustness of the ML pipelines significantly.
Conclusions
We provide the first certifiably robust sensing-reasoning pipeline with knowledge-based logical reasoning.
We theoretically prove the certified robustness of such ML pipelines, and provide complexity analysis for certifying the reasoning component.
Our extensive empirical results demonstrate the certified robustness of sensing-reasoning pipeline, and we believe our work would shed light on future research towards improving and certifying robustness for general ML frameworks as well as different ways to integrate logical reasoning with statistical learning.
Acknowledgements This work is partially supported by the NSF grant No.1910100, NSF CNS No.2046726, C3 AI, and the Alfred
P. Sloan Foundation.
CZ and the DS3Lab gratefully acknowledge the support from the Swiss State Secretariat for Education, Research and
Innovation (SERI) under contract number MB22.00036 (for European Research Council (ERC)
Starting Grant TRIDENT 101042665), the
Swiss National Science Foundation (Project Number 200021_184628, and 197485), Innosuisse/SNF BRIDGE Discovery (Project Number 40B2-0_187132), European Union Horizon 2020 Research and Innovation Programme (DAPHNE, 957407), Botnar Research Centre for Child
Health, Swiss Data Science Center, Alibaba, Cisco, eBay, Google Focused Research Awards, Kuaishou Inc., Oracle Labs, Zurich Insurance, and the Department of Computer Science at ETH Zurich.
HG has received funding from the European Research Council (ERC) under the European
Union’s Horizon 2020 research and innovation programme (grant agreement No. 947778).