B OOSTING C ERTIFIED R OBUSTNESS OF D EEP N ETWORKS VIA A C OMPOSITIONAL A RCHITECTURE
Anonymous authors
Paper under double-blind review
A BSTRACT
A core challenge with existing certiﬁed defense mechanisms is that while they improve certiﬁed robustness, they also tend to drastically decrease natural accuracy, making it difﬁcult to use these methods in practice.
In this work, we propose a new architecture which addresses this challenge and enables one to boost the certiﬁed robustness of any state-of-the-art deep network, while controlling the overall accuracy loss, without requiring retraining.
The key idea is to combine this model with a (smaller) certiﬁed network where at inference time, an adaptive selection mechanism decides on the network to process the input sample.
The approach is compositional: one can combine any pair of state-of-the-art (e.g., EfﬁcientNet or ResNet) and certiﬁed networks, without restriction.
The resulting architecture enables much higher natural accuracy than previously possible with certiﬁed defenses alone, while substantially boosting the certiﬁed robustness of deep networks.
We demonstrate the effectiveness of this adaptive approach on a variety of datasets and architectures.
For instance, on CIFAR-10 with an (cid:96) ∞ perturbation of 2/255, we are the ﬁrst to obtain a high natural accuracy (90.1%) with non-trivial certiﬁed robustness (27.5%).
Notably, prior state-of-the-art methods incur a substantial drop in accuracy for a similar certiﬁed robustness.
I NTRODUCTION
Most recent defenses against adversarial examples have been broken by stronger and more adaptive attacks (Athalye et al., 2018;
Tramer et al., 2020), underlying the importance of investigating certiﬁed defenses with suitable robustness guarantees (Raghunathan et al., 2018; Wong & Kolter, 2018; Zhang et al., 2020; Balunovi´c & Vechev, 2020).
And while there has been much progress in developing new certiﬁed defenses, a fundamental roadblock to their practical adoption is that they tend to produce networks with an unsatisfying natural accuracy.
In this work we propose a novel architecture which brings certiﬁed defenses closer to practical use: the architecture enables boosting certiﬁed robustness of state-of-the-art deep neural networks without incurring signiﬁcant accuracy loss and without requiring retraining.
Our proposed architecture is compositional and consists of three components: (i) a core-network with high natural accuracy, (ii) a certiﬁcation-network with high certiﬁable robustness (need not have high accuracy), and (iii) a selection mechanism that adaptively decides which one of the two networks should process the input sample.
The beneﬁt of this architecture is that we can plug in any state-of-the-art deep neural network as a core-network and any certiﬁed defense for the certiﬁcation-network, thus beneﬁting from any future advances in standard training and certiﬁed defenses.
A key challenge with certifying the robustness of a decision made by the composed architecture is obtaining a certiﬁable selection mechanism.
Towards that, we propose two different selection mechanisms, one based on an auxiliary selection-network and another based on entropy, and design effective ways to certify both.
Experimentally, we demonstrate the promise of this architecture: we are able to train a model with much higher natural accuracy than models trained using prior certiﬁed defenses while obtaining non-trivial certiﬁed robustness.
For example, on the challenging CIFAR10 dataset with an (cid:96) ∞ perturbation of 2/255, we obtain 90.1% natural accuracy and a certiﬁed robustness of 27.5%.
On the same task, prior approaches cannot obtain the same natural accuracies for any non-trivial certiﬁed robustness.
Main contributions Our main contributions are:
• A new architecture, called ACE (short for Architecture for Certiﬁcation), which boosts certiﬁed robustness of networks with high natural accuracy (e.g., EfﬁcientNet).
• Methods to train our newly proposed architecture and to certify the robustness of the entire composed network, including the certiﬁcation of the selection mechanism.
• Experimental evaluation on the CIFAR-10 and ImageNet200 datasets, demonstrating the promise of ACE: at the same non-trivial certiﬁed robustness levels, we can achieve significantly higher accuracies than prior work.
R ELATED WORK
There has been much recent work on certiﬁed defenses, that is, training neural networks with provable robustness guarantees.
These works include methods based on semideﬁnite relaxations (Raghunathan et al., 2018), linear relaxations and duality (Wong & Kolter, 2018;
Wong et al., 2018; Xu et al., 2020), abstract interpretations (Mirman et al., 2018), and interval bound propagation (Gowal et al., 2018).
The three most recent advances are COLT (Balunovi´c & Vechev, 2020), based on convex layer-wise adversarial training, CROWN-IBP (Zhang et al., 2020), based on a combination of linear relaxations Zhang et al.
and interval propagation, and LiRPA (Xu et al., 2020) scaling to problems with many more classes by directly bounding the cross entropy loss instead of logit margins.
As mentioned earlier, a key challenge with these methods is that in order to gain certiﬁed robustness, they tend to drastically drop natural accuracy.
In parallel to certiﬁed defenses, there has also been interest in certifying already trained models (Katz et al., 2017; Tjeng et al., 2017; Gehr et al., 2018;
Weng et al., 2018; Bunel et al., 2018; Wang et al., 2018a; Singh et al., 2019).
While these methods were initially focused mostly on L p robustness, these works (as well as ours) can be naturally extended to other notions of robustness, such as geometric (Balunovi´c et al., 2019) or semantic (Mohapatra et al., 2020) perturbations.
A line of work that weakens deterministic guarantees so to scale to larger networks is that of randomized smoothing which offers probabilistic guarantees (Lecuyer et al., 2018;
Cohen et al., 2019;
Salman et al., 2019a).
While interesting, this technique incurs overhead at inference time due to additional sampling, and further, generalizing smoothing to richer transformations (e.g., geometric) is non-trivial Fischer et al.
In contrast, our work handles large networks while providing deterministic guarantees and because of its compositional nature, directly beneﬁts from any advancements in certiﬁcation and certiﬁed defenses with richer perturbations.
Our proposed architecture is partially inspired by prior work on designing custom architectures for dynamic routing in neural networks (Teerapittayanon et al., 2016;
Bolukbasi et al., 2017; McGill & Perona, 2017; Wang et al., 2018b).
While the main goal of these architectures is to speed up inference, our observation is that similar type of ideas are applicable to the problem of enhancing certiﬁable robustness of existing neural networks.
B ACKGROUND
We now present necessary background needed to deﬁne our method later.
Adversarial Robustness We deﬁne adversarial robustness of a model h as a requirement that h classiﬁes all inputs in a p -norm ball B p(cid:15) ( x ) of radius (cid:15) around the sample x to the same class:
[Equation]
In this work we focus on an (cid:96) ∞ based threat model and use the notation (cid:15) p to indicate the upper bound to the (cid:96) p -norm of admissible perturbations.
The robust accuracy of a network is derived from this deﬁnition as the probability that an unperturbed sample from the test distribution is classiﬁed correctly and Equation 1 holds.
As it is usually infeasible to compute exact robustness, we deﬁne certiﬁably robust accuracy (also certiﬁable accuracy or certiﬁable robustness), as a provable lower bound to the robust accuracy of a network.
This lower bound is obtained by attempting to prove adversarial robustness for all correctly classiﬁed samples x using any certiﬁcation method.
For a x h bθ b h tθ t h sθ s h sθ s ( x ) > T h sθ s ( x ) ≤ T (a) SelectionNet ACE x h bθ b h tθ t p ( y ) softmax
H ( p ( y ))
<
T
H ( p ( y )) ≥ T (
[Figure]
Entropy ACE ﬁxed, arbitrary certiﬁcation method, we introduce the binary function cert( X , f, y ) as the result of an attempt to certify that f ( x ) =
y, ∀ x ∈ X . In practice, adversarial robustness is usually evaluated as an upper bound to the exact robust accuracy of a network and denoted as adversarial accuracy.
This upper bound is usually computed using an adversarial attack such as PGD (Madry et al., 2017).
Certiﬁcation and Training with Convex Relaxations Here we brieﬂy summarize robustness certiﬁcation via convex relaxations.
The idea is to start with an initial convex set capturing all admissible perturbations of an original sample x , denoted as C 0 ⊇ B ∞ (cid:15) ( x ) and then propagate this convex set sequentially through all layers of the network.
The key challenge is to design, for each function f corresponding to a layer,
a transformer T f that maps a convex input set to a convex output set while ensuring soundness : we need to guarantee that each point x in the convex input set C in is mapped to a point in the convex output set, i.e. f ( x ) ∈ C out :=
T f ( C in ) .
Finally, we obtain a convex shape that captures all possible outputs of the network.
To prove robustness, we have to show that the output of the target class is greater than that of any other class, which is often simple.
Depending on the type of transformer T f used, this framework leads to various certiﬁcation methods such as
IBP (Gowal et al., 2018) or DeepZ (Singh et al., 2018).
A more comprehensive description of these methods can be found in Salman et al.
(2019b).
There has recently been a plethora of work which uses these methods to train provably robust neural networks, which we reference in Section 2.
In this work we use models pretrained with CROWN-IBP (Balunovi´c & Vechev, 2020), LiRPA (Xu et al., 2020) and COLT and train selection- and certiﬁcation-networks using IBP and COLT.
IBP (Mirman et al., 2018; Gowal et al., 2018) computes a convex relaxation of the loss using intervals and minimizes this loss during training.
COLT (Balunovi´c & Vechev, 2020) proceeds layer by layer and tries to ﬁnd adversarial examples inside the convex relaxations of the latent spaces of perturbed samples, using PGD adversarial attacks.
C OMPOSITIONAL A RCHITECTURE FOR C ERTIFIABLE R OBUSTNESS
In this section, we formally introduce our proposed compositional architecture.
Overview We
ﬁrst describe the idea behind the two variants of our architecture, illustrated in
Figure 1.
The ﬁrst variant, named SelectionNet ACE, is shown in Figure 1a.
Here, the selection mechanism is an auxilliary selection network h s θ s which decides whether to pass sample x through the core- or the certiﬁcation-network.
If the output of the selection network is greater than T , then we pass x through the certiﬁcation-network h bθ b , and otherwise we pass it through the core-network h tθ t .
The second variant, Entropy ACE, is shown in Figure 1b.
Here we perform the selection for every sample x based on the output probabilities p ( y ) produced by the certiﬁcation-network h bθ b via the softmax function.
If the entropy H ( p ( y )) of the output probability distribution exceeds a ﬁxed threshold T , we pass the sample through the core-network h tθ t , otherwise we return the output of the certiﬁcation-network.
In Figure 1 we show the selection mechanism using dashed arrows and the two possible outputs of the end-to-end architecture using solid, red and blue arrows.
Formally, we propose the compositional neural network architecture h
θ : X → Y deﬁned as
[Equation]
The architecture combines three components: A selection-mechanism g θ s : X → { 0 , 1 } de- cides whether to forward an input x through the core- or certiﬁcation-network ( g θ s is instantiated in two different ways below), while the core-network h tθ t : X → Y and the certiﬁcation-network h bθ b : X → Y assign an output label y ∈ Y to an input x ∈ X .
We note that arbitrary network architectures and training methods can be used for each of the component networks.
We evaluate some of these choices in our experimental evaluation section later.
4. S ELECTION M ECHANISM
The core of ACE is a selection mechanism that decides which network to use for inference.
Ideally, the selection mechanism should pass inputs for which the certiﬁcation-network is correct and certiﬁably robust through the certiﬁcation-network, and all other inputs through the core-network.
To train this mechanism, we set the following selection target for each sample x in the training set:
[Equation]
[Equation]
The output of the binary function cert , explained in Section 3, is
if and only if we can certify that network h bθ b classiﬁes all inputs from the region B ∞ (cid:15) ( x ) to a label y .
If the separation described above were fully accurate and certiﬁable, the certiﬁable robustness of the certiﬁcation-network would be retained by the combined network, while the natural accuracy and adversarial robustness would be lower bounded by those of the core-network.
However, as the task of predicting certiﬁable correctness is a strictly more difﬁcult variant of the meta recognition task (Scheirer et al., 2012), a perfect selection is usually unattainable.
Here, we balance a tradeoff between certiﬁable and natural accuracy, as a higher selection rate and consequently recall will generally increase certiﬁable accuracy at the cost of a larger drop in natural and adversarial accuracy.
Clearly, a lower selection rate and consequently higher precision have the opposite effect.
Note that, if there exist perturbations x (cid:48) 1 , x (cid:48) 2 ∈ B ∞ (cid:15) ( x ) such that g θ s ( x (cid:48) 1 ) =
and g θ s ( x (cid:48) 2 )
= 1 , then we would have to certify the robustness of both the core- and certiﬁcation-network (we would like to avoid certifying the core-network).
Thus, only if we can prove that such a pair does not exist, meaning that the selection is robust, we can certify only one of these two networks.
As the typically large and deep core-network tends to have a very low certiﬁable accuracy, low robustness of the selection mechanism leads directly to low certiﬁable accuracy of the composed network (because we would need to certify the core-network more often).
An ideal selection mechanism has to be robust, accurate, and allow tuning of the selection rate.
Towards that, we suggest two variants that ﬁt these requirements: (i) SelectionNet, a selectionnetwork trained on the binary selection task, and (ii) Entropy Selection, based on a threshold on the entropy of the output of the certiﬁcation-network.
We refer to the resulting architectures as
SelectionNet ACE and Entropy ACE.
4.1. S ELECTION N ET
We propose using a selection-network h sθ s : X → R to make the decision, which leads to the architecture illustrated in Figure 1a with the following inference procedure: (i)
Pass sample x through the selection-network resulting in the output h sθ s ( x ) .
(ii)
If the output is greater than the threshold
T , the sample is passed through the certiﬁcation-network, and otherwise through the core-network.
Formally, we deﬁne the selection mechanism as g θ s ( x ) := 1 h sθs ( x ) >T .
Training After training a provable certiﬁcation-network using any choice of a provable training mechanism, we obtain the selection targets according to Equation 3.
We then frame the selection problem as a binary classiﬁcation task and train the selection-network directly on the inputs from the training set using the selection targets obtained above as labels.
We note that for the selectionnetwork, similarly to the certiﬁcation-network, one can use any network architecture and provable training mechanism.
Further, we propose to reduce the training time by using the certiﬁcationnetwork as a feature extractor and only training the last linear layer of the selection-network.
This also reduces the selection overhead during inference and certiﬁcation with convex relaxation based methods.
The core-network is trained completely independently, typically using a pre-trained model.
4.1. E NTROPY S ELECTION
As a second variant we propose using an entropy based selection mechanism g θ s ( x ) :
= H (softmax( h bθ b ( x ))) <
T , inspired by Teerapittayanon et al.
(2016), which leads to the network architecture illustrated in Figure 1b and a slightly different inference procedure:
We ﬁrst map the output of the certiﬁcation-network y b = h bθ b ( x ) to a discrete probability distribution p ( y b ) over the labels, via the softmax function.
Then we can compute the entropy H ( p ( y b )) as
[Equation]
If the entropy is below a threshold T , we return the certiﬁcation-network output, otherwise we pass the sample through the core-network.
Certiﬁcation Using convex relaxation-based certiﬁcation methods requires sound overapproximations of all layers.
To derive an approximation of the entropy, we ﬁrst recast Equation 4, including softmax and introduce the log-sum-exp trick to improve numerical stability, as
[Equation]
We provide a proof of this identity in Appendix G.6.
We can now construct an entropy transformer from element-wise transformations corresponding to individual operations in Equation 5.
In this work we use intervals and zonotopes (Appendix G), however, one can explore other approximations.
Joint Training Using vanilla provable training for the certiﬁcation-network leads to a signiﬁcant dependence of the entropy on the difﬁculty of a sample perturbation.
This causes a wide range of possible entropies over the admissible perturbations, reducing the robustness of a thresholding based selection.
To address this, we would like to decrease the width of the entropy range, while ideally decreasing the entropy for certiﬁable samples and increasing it for non-certiﬁable samples.
We do this by introducing an entropy loss term L H ( y b , y s ( x ))
=
sign( y s ( x )) · H (softmax( y b )) using the convention sign(0) = − 1 , and the weighting factor λ :
[Equation]
We replace the cross entropy loss L CE with the joint loss L joint enabling adversarial and prov- able training against perturbations targeting both classiﬁcation and entropy, improving selection robustness.
We train the certiﬁcation-network with this joint loss, completely independent from the core network.
The selection target y s ( h bθ b , x ) for the natural, adversarial, and robust losses is, unlike in Equation 3, computed based on the natural, adversarial, and certiﬁable correctness of the certiﬁcation-network, respectively, and not always on the certiﬁable correctness.
Using this loss with networks of low accuracy has the disadvantage that the entropy loss encourages a more ambiguous output distribution for samples that are not classiﬁed (provably) correctly.
Therefore, we perform pretraining with λ = 0 .
4. E ND - TO -E ND C ERTIFICATION
After the network is trained, we need to prove that the classiﬁcation by the compositional network
[Equation]
is correct and robust (as deﬁned by Equation 1).
Using one of the certiﬁcation methods introduced in
Section 3 to instantiate the certiﬁcation function cert( X , f, y ) , the proof of robustness can be broken down into the following steps:
Evaluate the selection mechanism g θ s on the unperturbed sample x resulting in g θ s ( x ) .
Certify robustness of the decision of the selection mechanism cert( B ∞ (cid:15) ( x ) , g θ s , g θ s ( x )) .
If this certiﬁcation was successful, certify the network selected for the unperturbed sample, otherwise certify both the core- and the certiﬁcation-network cert( B ∞ (cid:15) ( x ) , h { b,t } θ { b,t } , y ) .
The deep core-network is typically not trained for certiﬁability and certiﬁcation is often computationally infeasible.
Therefore, we assume that certiﬁcation of the core-network always fails.
Consequently, only samples with a positive natural selection decision can be certiﬁed, making certiﬁcation independent of the core-network.
The results of the ﬁrst and the second step can be used to determine which network will classify the unperturbed sample and which networks could classify a perturbed sample.
This information can be used to compute the natural and adversarial accuracy of the combined network without evaluating them jointly.
E XPERIMENTAL EVALUATION
In this section, we demonstrate the effectiveness of ACE by showing that existing certiﬁed defenses cannot achieve the high natural accuracies at non-trivial provable accuracies that we obtain.
We will release our code, datasets, and pretrained models as open source to ensure reproducibility.
Models and Datasets We evaluate ACE on 3 different certiﬁcation-network architectures similar to the models used in Gowal et al.
and Balunovi ´ c & Vechev (2020), on CIFAR-10,
ImageNet200, and TinyImageNet with (cid:96) ∞ perturbations between 1/255 and 8/255, reporting Top1 accuracies.
TinyImageNet is a selection of 200 classes from ImageNet with samples cropped to meaningful regions of the image and downscaled to 64 × 64 .
ImageNet200 is the full sized ImageNet restricted to the same 200 classes but always center cropped for evaluation.
We denote as Conv2,
Conv3 and Conv5 feed-forward networks with 2, 3, and 5 convolutional layers, respectively.
Conv corresponds to the largest network from Balunovi´c & Vechev (2020), and Conv5 corresponds to the largest network from Zhang et al.
(2020), DM-Large.
More details can be found in Appendix A, Table 3.
We use an adversarially trained EfﬁcientNet-B0 (Tan & Le, 2019) with ImageNet pretraining as a core-network, using adversarial instead of natural training, as we believe empirical robustness to also be relevant in domains where deterministic guarantees are desired.
Training and Certiﬁcation
We perform all experiments, with the exception of reference network training, on a single GeForce RTX 2080 Ti GPU and implement training and certiﬁcation in PyTorch (Paszke et al., 2019).
We train selection- and certiﬁcation-networks using IBP (Gowal et al., 2018) and COLT (Balunovi´c & Vechev, 2020).
The hyperparameters can be found in Appendix B.
We use adversarial pretraining for COLT trained models.
For Entropy Selection we set the joint loss factor to λ = 0 .
We only use the relatively fast, convex relaxation-based certiﬁcation methods IBP (Gowal et al., 2018) and DeepZ (Singh et al., 2018) for IBP and COLT trained networks respectively, unless speciﬁed otherwise.
We use 40 step PGD to evaluate adversarial accuracy, using the strategy described in Appendix E to avoid gradient masking effects (Papernot et al., 2017).
Comparison with Existing Architectures We show that ACE can, in contrast to state-of-theart provable training methods, achieve both high natural and non-trivial provable accuracies, by enabling an efﬁcient trade-off between natural and certiﬁable accuracy instead of maximizing provable robustness at any cost.
As direct comparison with prior work is difﬁcult, we show that using our best effort we were not able to achieve comparable combinations of natural and certiﬁable accuracy using the state-of-the-art COLT and CROWN-IBP provable training methods.
COLT is computationally expensive, restricting it to relatively small models.
We train the biggest model evaluated by Balunovi ´ c & Vechev (2020), Conv3, on CIFAR-10 at (cid:15) ∞ = 2 / 255 using COLT with a varying natural loss component and use DeepZ for certiﬁcation. In Figure 2 we show certiﬁed vs natural accuracy for each of these models (yellow points).
To compare with our approach, we train an ACE model (teal squares) using one of these networks (teal triangle) as certiﬁcation-network.
We observe that the ACE model obtains higher certiﬁed accuracies at all natural accuracies, still yielding a certiﬁed accuracy of 36.8% at the highest natural accuracy (85.1%) obtained using an individual, naturally trained Conv3 network. Using the Conv3 model trained by Balunovi ´ c & Vechev (2020) [Figure] [Figure]
(teal) and IBP trained Conv3 (blue). All selectionnetworks are IBP trained (blue triangle) in combination with MILP certiﬁcation as certiﬁcation-network, we obtain an even stronger ACE model (blue squares). We compare to CROWN-IBP trained reference networks in
Appendix C, yielding the same conclusion.
CROWN-IBP can be applied to larger models, includes an inherent robustness-accuracy trade-off parameter κ , weighting the natural and robust loss components, and outperforms COLT on CIFAR10 at (cid:15) ∞
= 8 / 255 , making it the perfect benchmark for these larger perturbations.
Using the original implementation and the largest model Zhang et al.
(2020) evaluate on CIFAR-10, Conv5, we vary κ end to obtain several models.
We show certiﬁed vs natural accuracy for each of these CROWNIBP models (yellow points) in Figure 3.
Using the Conv5 network published by Zhang et al.
{+(2020) with κ end = 0 . 
+}
(red triangle) and one we trained with κ end = 0 .
5 (teal triangle), we train ACE models (red and teal squares) using IBP for the selection network training, which both outperform the individual Conv5 networks over a wide range of natural accuracies.
Even when using a much weaker certiﬁcation-network, such as an IBP trained Conv3 (blue triangle), we obtain an ACE model (blue squares) yielding more attractive trade-offs at high natural accuracies.
These results show that across different provable training and certiﬁcation methods, network architectures and perturbation sizes, ACE produces much more favorable robustness-accuracy tradeoffs than varying hyperparameters of existing certiﬁed defenses. ACE models can always use a certiﬁcation-network trained at the efﬁciency sweetspot of the employed provable training method, allowing any improvements in certiﬁed defenses to be utilized, while allowing for ﬂexibility in the trade-off between accuracy and robustness.
As ACE is truly orthogonal to all of these methods, it should be seen as a complement to and not a replacement for provable training methods.
[Figure] [Table]
[Table]
The compositional structure of ACE has the additional advantage of permitting every component network to work at a different resolution.
For tasks where high resolution images are available, the core network can process with full-scale images, while down-scaled versions can be passed through the selection and certiﬁcation network.
For ImageNet200, we use full-scale images in the corenetwork to obtain a high natural (70.0%) accuracies, while the certiﬁcation- and selection-network yields a non-trivial certiﬁable accuracy (3.1%) at (cid:15) ∞ = 1 / 255 using samples scaled down to 64 × 64 .
Here, the certiﬁable accuracy is limited by the lack of a strong certiﬁably robust network to use as a certiﬁcation-network.
For TinyImageNet no full size images are available, reducing the advantage of an ACE model.
However using the LiRPA trained WideResNet (black triangle in Figure 4) from Xu et al.
(2020) as certiﬁcation-network and feature extractor for the otherwise IBP trained selection-network, we train an ACE model (black squares) showing a very similar trade-off characteristic as the CIFARmodels, demonstrating that ACE scales to larger tasks. In Table 1 we present results on the CIFAR-10 and TinyImageNet datasets for selected models.
An extended table showing more results can be found in Appendix F.
Selection Recall that the key to our compositional architecture is a provably robust selection mechanism that can differentiate samples based on their certiﬁability by the certiﬁcation-network.
We try to certify the natural selection decision made by a Conv3 selection-network on CIFAR-10 at (cid:15) ∞
= 2 / 255 and split samples into three groups: samples selected for all admissible perturbations (provably selected), samples not selected for any admissible perturbation (provably non-selected), and the remainder for which we cannot prove either decision (non-provably selected).
In Table 2 we show that for the provably selected samples the certiﬁable accuracy (72.9%) is much higher than on the full test set (47.9%), and it is much lower for the provably non-selected samples (28.4%).
This shows that the selection-network successfully separates samples based on certiﬁcation difﬁculty.
Evaluating Core- and Certiﬁcation-Networks Next, we train two ACE networks for CIFARwith (cid:15) ∞ = 2 / 255 using COLT: one with a selection-network and Conv3 certiﬁcation-network, and
[Figure]
[Figure]
another with entropy selection and a Conv2 certiﬁcation-network.
Both use EfﬁcientNet-B0 as a core-network.
We evaluate the natural and adversarial accuracy of both the core- and certiﬁcationnetwork on the full test set and its subsets selected by the selection mechanism.
The results are shown in Figure 5.
We observe that the accuracy of both certiﬁcation-networks is signiﬁcantly higher on their respective selected datasets, while the accuracy of the core-networks decreases.
This indicates that the selection mechanism can successfully separate samples by classiﬁcation difﬁculty and assign easier samples to the certiﬁcation- and difﬁcult samples to the core-network. [Table] [Table]
that we introduced the entropy loss to make
Entropy Selection more robust, by decreasing the sensitivity to different perturbations.
To assess its effectiveness, we train two Conv certiﬁcation-networks using COLT for CIFAR10 with (cid:15) ∞
= 2 / 255 , with and without entropy loss.
Note that using entropy loss corresponds to λ = 0 . 5 and not using it corresponds to λ = 0 .
in Equation 6.
We split the test set into two groups based on whether an adversarial attack on the certiﬁcation-network is successful (adversarial) or not (non-adversarial).
For each sample, we compute the difference between the largest and the smallest entropy that can be obtained by perturbing it.
Figure 6 shows histograms of these differences (or widths) for both the adversarial and non-adversarial group.
Clearly, the nonadversarial samples lead to much narrower entropy ranges if an entropy loss was used, while there is no signiﬁcant difference if no entropy loss is used.
This demonstrates that the entropy loss successfully increased the robustness of the entropy selection mechanism for non-adversarial samples (as adversarial ones are not certiﬁable anyway).
C ONCLUSION
We proposed a new architecture that boosts the certiﬁable robustness of any state-of-the-art network, while retaining high accuracy and without requiring retraining.
The key idea is to combine this network with a provably trained certiﬁcation-network and a certiﬁable selection mechanism, which adaptively decides at inference-time which of the two networks to use.
We presented two such selection mechanisms with corresponding training and certiﬁcation methods.
Our experiments show that using this method, one can achieve both high natural accuracies and non-trivial certiﬁable robustness, beyond the reach of state-of-the-art certiﬁed defenses.
Our architecture is also fully orthogonal to certiﬁed defenses, allowing any advances in this ﬁeld to be carried over directly.
A N ETWORK A RCHITECTURES
In Table 3 we list the detailed architectures for CIFAR-10 and ImageNet200, respectively, used in the experiments described in Section 5.
The Conv3 architecture for CIFAR-10 is identical to the largest network from Balunovi´c & Vechev (2020)
[Table]
[Table]
B T RAINING H YPERPARAMETERS
CIFAR-10 Training For CIFAR-10 IBP training is conducted for 200 epochs, annealing (cid:15) and κ over the ﬁrst 100 epochs, with an initial learning rate of 1e-3, reducing by half every 10 epochs after annealing is completed.
We choose κ end = 0 .
5 for all models.
COLT training is conducted forepochs per stage with an initial learning rate of 1e-3, decreasing by a factor of 0.75 between stages and by a factor of 0.5 every 5 epochs after an initial loss mixing period of 5 epochs.
ImageNet Training For IBP training on ImageNet200 and TinyImageNet we train for 50 epochs using a batch size of 100, an initial learning rate of 1e-3, reducing it by half every 5 epochs after annealing both κ and (cid:15) for 10 epochs.
We choose κ end = 0 .
5 for all models.
For COLT training on ImageNet200 we use feature extraction and freeze all weights up to the last linear layer.
We train for 20 epochs per stage, using an initial learning rate of 1e-3, reduced by a factor of 0.75 between stages and 0.5 every 3 epochs after an initial loss mixing period of 5 epochs.
C A DDITIONAL E XPERIMENTS C OMPARING WITH CROWN-IBP
In this section we present additional experiments comparing ACE models with CROWN-IBP.
CROWN-IBP trained networks can not match the performance of COLT trained and MILP certiﬁed networks on CIFAR-10 at (cid:15) ∞
= 2 / 255 (Balunovi´c & Vechev, 2020;
Zhang et al., 2020)
However, as they can reach higher certiﬁed accuracies than COLT trained networks certiﬁed using only the cheaper DeepZ certiﬁcation, we compare our COLT based ACE models also to the largest model
Zhang et al.
(2020) evaluate on CIFAR-10, Conv5.
We follow their instructions for multi GPU training and obtain several models by varying the parameter κ end , obtaining very similar results for the settings they report ( κ end ∈ { 0 , 0 . 5 } ).
Note that every setpoint requires about 4 GPU days, while a Conv3 based ACE model can be trained using COLT in roughly 1.5 days and new setpoints evaluated in minutes. In Figure 7 we show certiﬁable vs natural accuracy for each of these CROWNIBP models (yellow points). To compare it with our method, we choose a COLT certiﬁcationnetwork (teal triangle) with similar performance to a CROWN-IBP trained network and use it to train our ACE models with various thresholds T , shown as teal squares in Figure 7. Clearly, our models achieve much better robustness-accuracy trade-offs, especially in regions of high natural accuracy.
We do not compare the CROWN-IBP results to those obtained using MILP in the abstract, as the latter requires a much more expensive certiﬁcation approach.
However, even when using a much weaker certiﬁcation network, such as an IBP trained Conv3 (purple triangle), we can still train ACE models (purple squares) obtaining more attractive trade-offs at high natural accuracies.
[Figure]
In this section we describe additional experiments using COLT trained Conv3 networks.
We use the Conv3 network published by Balunovi´c & Vechev (2020) and certify it using DeepZ (Singh et al., 2018) and MILP (Tjeng et al., 2017). To unlock the full potential of this MILP certiﬁed certiﬁcaiton network, we would ideally want to train our selection network with MILP based labels.
However, certifying the whole or a signiﬁcant portion of the training set using MILP is infeasible. Therefore, we have to use surrogate labels when training the selection-network.
We evaluate three approaches to training a selection network and present the results in Figure 8:
• Transfer the selection network of a different ACE model based on a certiﬁcation-network with higher zonotope certiﬁed accuracy (teal) • Compute selection labels using zonotope certiﬁcation (brown) • Compute selection labels using adversarial correctness (yellow)
We observe that using the last approach consistently, over a range of selection rates, performs worse than both other methods, suggesting that the selection network can learn features that make a sample hard to certify while not necessarily leading to successful adversarial attacks.
Interestingly, the selection network transferred from a different Conv3 network (with a higher zonotope certiﬁed accuracy), does not only help to improve the performance of the ACE model at high natural accuracies when certiﬁed using MILP, but also when using DeepZ. This suggests that the properties making a sample difﬁcult to certify show at least some level of stability over different networks.
E A DVERSARIAL A CCURACY C OMPUTATION
The adversarial accuracies listed in Table 1 are intended to be purely informative and not to be considered as a strong indicator of the true robust accuracy.
Nevertheless, we consider the potential problem of gradient masking (Papernot et al., 2017) caused by the compositional structure and developed the following three approaches to calculate adversarial accuracy
: • We compute separate adversarial samples attacking the core-, selection- and certiﬁcationnetwork.
If we ﬁnd any perturbation leading to the selection of a classiﬁcation network, we consider it reachable and evaluate the corresponding adversarial example.
Only if no attack on a reachable network is successful, we consider the adversarial attack to have failed.
Note, that a successful adversarial example to either classiﬁcation network would not necessarily be classiﬁed by this network.
Therefore, this approach does not provide a true upper bound to the robust accuracy.
• We attack the classiﬁcation networks as described above, but use certiﬁable instead of empirical reachability, that is consider a network reachable unless we can proof that it can not be reached.
This approach provides an even more conservative adversarial accuracy.
[Figure]
• We compute two adversarial attacks.
One aimed at the core- and the other at the certiﬁcation-network.
To this end, we combine the classiﬁcation networks loss term with a loss component from the selection network, designed to perturb the sample such that the currently targeted network gets selected.
We only consider an attack successful, if an adversarial example gets classiﬁed incorrectly by the compositional network.
To reduce the gradient obfuscation problem in this setting, we weight the selection network loss term based on whether we already select the currently targeted network.
While the gap between the ﬁrst two approaches is usually very small at less than 1%, the third approach sometimes yields notably higher adversarial accuracies.
Therefore, we decided to report the most conservative numbers, obtained using the second approach.
We use PGD with 40 steps, a step size of 0 .
035 (cid:15) and one restart with a random initialization of the perturbation.
In Table 4 we present selected setpoints of ACE models trained on CIFAR-10, TinyImageNet and ImageNet200, demonstrating that ACE can be applied to a range of models, datasets and provable training methods.
G Z ONOTOPE T RANSFORMERS
For both training and certiﬁcation with convex relaxations it is essential to have precise, also called tight, transformers to reduce the accumulation of errors.
Singh et al.
(2018) provide such transformers for the ReLU, tanh and sigmoid function.
In this section a general approach to constructing transformers for the zonotope domain and C 1 continuous, concave or convex functions will be described and transformers for the exponential and logarithm function, and the product of two zonotopes introduced.
These can then be combined into a transformer for the entropy function.
G. Z ONOTOPE D OMAIN
The zonotope domain Ghorbal et al.
(2009) is a classic numeric abstract domain, shown to be suitable as convex relaxation for analyzing neural networks Gehr et al.
(2018), as it is exact for afﬁne transformations and efﬁcient abstract transformers for the ReLU, sigmoid and tanh function exist
Singh et al.
A zonotope Z ⊆ R n approximation of a n-dimensional variable x ∈ R n is described by an afﬁne form ˆ x j for every dimension x j as
[Equation]
[Table]
with the center coefﬁcient a j, 0 , error coefﬁcients a j,i and shared error terms (cid:15) i .
These shared error terms allow the representation of implicit dependencies between dimensions and make the zonotope domain strictly more powerful then the interval domain (equivalence is given for a diagonal error matrix).
Further, the matrix notation
[Equation]
makes afﬁne transformations of the form y =
Bx + c very simple to apply:
[Equation]
G. G ENERAL T RANSFORMER C ONSTRUCTION
Sound neuron-wise transformers for the zonotope domain can be visualized in the input-outputplane of the to be approximated function as parallelograms with vertical left and right edges, fully enclosing the function on the input interval.
They can be described as
[Equation]
) for the j th dimension of the input zonotope ˆ x with p error terms and the neuron-/dimension-wise parameters slope λ j , offset ξ j and looseness µ j
The height of the parallelogram 2 µ j corresponds to the magnitude of the new error term.
As the width is only dependent on the range of the input, the parallelogram’s area is only dependent on this height.
A transformer is strictly more precise than another, if the parallelogram representation of the former is fully enclosed in the one of the latter.
While a smaller area generally corresponds to a smaller loss of precision, no guarantees can be given.
Viability shall be deﬁned as the absence of strictly more precise transformers of the same form.
The looseness µ of viable transformers is uniquely determined by the slope λ , as the offset ξ and µ can be chosen so that both the upper and lower edges touch the function plot in at least one point.
All transformers with different offsets and looseness but the same slope will enclose this viable transformer and are therefore strictly less precise.
If one of these contact point lies within the input interval x ∈ [ x lb , x ub ] , the slope is by deﬁnition a subgradients to the function at this point.
If one contact points lie on the borders of the input interval, the slope can be reduced/increased in the direction of the local one-sided gradient until either it is the tangent to that point or an additional contact point is made.
The new slope is in both cases by deﬁnition a subgradient to the function on the input domain at both contact points.
This new transformer is also strictly more precise than the original one.
It follows, that all viable slopes are subgradients to the function at one point in the interval.
Convexity can be assumed without loss of generality for convex and concave functions as the latter can be negated to ensure convexity.
For convex, C 1 continuous functions all tangents to the curve of the function yield viable transformers, consequently they can be parametrized by the xposition x lb ≤ t ≤ x ub of the contact point.
Using the mean value theorem and convexity it follows that there will be a point t crit where the upper edge of the parallelogram will connect the lower and upper endpoints of the graph.
For t < t crit it will make contact on the upper endpoint and for t > t crit on the lower endpoint.
This allows to describe the parameters λ , ξ and µ of a zonotope transformer for an element-wise function f ( x ) :
R → R on the interval [ x lb , x ub ] as
[Equation] [Equation]
Minimum Area Transformer – A minimum area transformer can now be derived by minimizing the looseness µ for x lb ≤ t ≤ t crit and t crit ≤ t ≤ x ub .
This yields the constrained optimization problems:
[Equation]
These can be solved using the method of Lagrange multipliers.
Equation 16 yields the Lagrangian function:
[Equation]
As x lb < t crit < x ub
[Equation]
at most one of the two constraints can be active at any time.
This yields three cases:
Case 1: neither constraint is active,
[Equation]
[Table]
[Equation]
Analogously, equation 17 yields a boundary minimum at t = t crit .
Consequently t =
t crit yields the minimum area transformer for convex functions.
t crit can be computed either analytically or numerically by solving equation 15 as the point where the local gradient is equal to the mean gradient over the whole interval.
It can be observed that this yields the same slope as the minimum area transformer for the ReLU function Singh et al.
(2018) even though this derivation can not be applied there directly due to the ReLU functions C 1 discontinuity.
G. E XPONENTIAL T RANSFORMER
The exponential function has the feature that its output is always strictly positive, which is important when used as input to the logarithmic function to compute the entropy.
Therefore, a guarantee of positivity for the output zonotope is desirable.
A constraint yielding such a guarantee can be obtained by inserting ˆ x j = x lb , (cid:15) p +
= − sign( µ ) and ˆ y j ≥ 0 with λ ( t ) =
e t into equation 11:
[Equation]
This constitutes the additional upper limit t crit, 2 on t .
Therefore it is sufﬁcient to reevaluate 16 as it will either be inactive in equation 17 if t crit ≤ t crit 2 for the solutions computed previously or the constraints will be insatiable ensuring that 17 will have no solutions.
If a strictly positive output is required a small delta can simply be subtracted from the upper limit t crit, 2 .
It is easy to see that t is now constrained to [ x lb , min( x ub , t crit, 2 )] and that the minimum area solution will be obtained with t opt = min( t crit , t crit, 2 ) .
The critical points can be computed explicitly to t crit = log ( e xub − e xlb x ub − x lb ) and t crit, 2 = x lb + 1 .
This can be inserted into equations 11 to 14 to obtain a positive, sound and viable transformer.
This transformer is visualized for different choices of t in ﬁgure 9.
[Figure]
If there is no point in the input interval where the gradient of the to be approximated function is 0, as is always the case for the exponential function, the box transformer is not a viable zonotope transformer.
But the viable transformer with the smallest gradient at t = x lb is strictly more precise than the box transformer (cf. ﬁgure 9).
G. L OGARITHMIC T RANSFORMER
The logarithmic transformer can be constructed by plugging f ( t )
= − log ( t ) and f (cid:48) ( t )
= − 1 x into equations 12 to 14 and their results into equation 11.
Equation 15 can be solved to t crit = x
lb − x ub ln ( x lb ) − ln
( x ub ) .
The resulting transformer is visualized in ﬁgure 10.
It becomes apparent that the choice of λ can have a signiﬁcant impact on the looseness of the obtained transformer.
[Figure]
Similar to the exponential transformer, the box transformer is not a viable logarithmic zonotope transformer, but the viable transformer with the smallest gradient at t = x ub is strictly more precise than the box transformer (cf. ﬁgure 10).
G. P RODUCT T RANSFORMER
The pointwise or Hadamard product is different from the previously introduced transformers as it involves two zonotopes instead of just one.
For this derivation the two one-dimensional zonotopes ˆ x and ˆ z with p shared error terms and k 1 and k 2 individual error terms shall be considered.
Typically, error terms will be shared up to a certain index (potentially 0) and all following error terms will be individual to one of the zonotopes.
In any case this form can obtained by reordering the error terms and can therefore be assumed without loss of generality.
[Equation]
  , ˆ z = b 0 + B ind    (cid:15) 1 . (cid:15) p (cid:15) p + k 1 + . . . (cid:15) p + k 1 + k   a
[Equation]
R
[Equation] A ind ∈
[Equation] R p + k A shared error vector (cid:15) ∈ with q = p + k 1 + k 2 error terms can be obtained, by concatenating the individual error terms of the second zonotope ˆ z to the error vector of the ﬁrst and padding the error coefﬁcient matrices correspondingly with zeros:
[Equation]

[Equation]   [Equation]

[Equation]

[Equation]

[Equation]
Now the Hadamard product can be written as
[Equation]
[Equation] [ − [Equation] To bring ˆ y (cid:48) into zonotope form ˆ y , the term 24 has to be approximated by adding a new error term (cid:15)
q +1 with the error coefﬁcient c
q +1 and a constant c (cid:48)(cid:48) 0 :
[Equation]
[Equation] Unfortunately evaluating equation 25 and 26 is quadratic in the number of error terms in time and when using a matrix formulation utilizing GPU vector operations in space.
When the number of error terms is too high and using the transformer described above becomes infeasible, a switch to the box transformer is possible:
[Equation]
G. E NTROPY T RANSFORMER
Based on these elementary transformers, the entropy transformer can be assembled by chaining transformers for the individual component functions according to equation 5, which is reproduced below for convenience.
[Equation]
The second term requires four transformers (product, exponential, logarithmic, exponential) adding 3 n class + 1 error terms ( n class , n class , 1 , n class ) to the output.
Since the log-sum-exp term has to be computed only once the ﬁrst term does not add any additional error terms, while still increasing the corresponding error coefﬁcients.
G.6. T IGHTNESS
The tightness of the entropy transformer was evaluated in comparison to a box transformer and an upper bound obtained from an optimization approach.
To compute the looseness, random input zonotopes with fully populated error coefﬁcient matrices drawn from N (0 , σ 2 (cid:15) ) and centre coefﬁcients drawn from N (1 , 3 2 ) were created and then propagated through an entropy transformer, before the looseness was computed as the difference between upper and lower bounds.
When an input box was required, the zonotopes where converted to a box representation with the same bounds.
The mean over 50 samples is reported.
The following ﬁve different transformer versions were considered:
• ZonoIter – The zonotope transformer obtained by chaining the previously introduced transformers and optimizing the slopes λ of all transformers sample-wise to minimize looseness.
• ZonoIterLM – As ZonoIter, but using the box transformer for the product to obtain a low memory requirement transformer.
• Zono – As ZonoIter, but using minimum area slopes instead.
• ZonoLM – As Zono, ut using the box transformer for the product to obtain a low memory requirement transformer.
• Box – The transformer obtained by using interval arithmetic to propagate bounds.
An analysis of the looseness over input error size, illustrated in ﬁgure 11. shows that while the box transformer is clearly the least precise over the whole domain, different errors dominated the behaviour of the various zonotope transformers in different regimes.
The high looseness of Zono and ZonoLM at large input errors suggest that minimum area slopes are not ideal in this regime, while the small penalty for switching to the low memory versions indicates that the error terms incurred from the product transformer are small by comparison to the log and exp contributions.
Reducing the input errors on step, ﬂips this behaviour.
The product error dominates the differences between minimum area and optimized slopes by a signiﬁcant margin.
[Figure]