Certiﬁed Training: Small Boxes are All You Need
Abstract
We propose the novel certiﬁed training method, SABR, which outperforms existing methods across perturbation magnitudes on MNIST, CIFAR-10, and T INYI MAGE N ET , in terms of both standard and certiﬁable accuracies .
The key insight behind SABR is that propagating interval bounds for a small but carefully selected subset of the adversarial input region is sufﬁcient to approximate the worstcase loss over the whole region while signiﬁcantly reducing approximation errors.
SABR does not only establish a new state-of-the-art in all commonly used benchmarks but, more importantly, points to a new class of certiﬁed training methods promising to overcome the robustness-accuracy trade-off.
Introduction
As neural networks are increasingly deployed in safety-critical domains, formal robustness guarantees against adversarial examples (Biggio et al., 2013; Szegedy et al., 2014) are more important than ever.
However, despite signiﬁcant progress, specialized training methods that improve certiﬁability at the cost of severely reduced accuracies are still required to obtain deterministic guarantees.
Generally, both training and certiﬁcation methods compute a network’s reachable set given an input region deﬁned by an adversary speciﬁcation and a concrete input, by propagating a symbolic overapproximation of this region through the network (Singh et al., 2018, 2019; Gowal et al., 2018a).
Depending on the method used for propagation, both the computational complexity and tightness of this approximation can vary widely.
For certiﬁed training, an over-approximation of the worst-case loss is computed from this reachable set and then optimized (Mirman et al., 2018; Zhang et al., 2020;
Wong et al., 2018).
Surprisingly, the least precise propagation methods yield the highest certiﬁed accuracies as more precise methods induce signiﬁcantly harder optimization problems (Jovanovic et al., 2021).
However, the large approximation errors incurred by these imprecise methods lead to over-regularization and thus poor accuracy.
Combining precise worst-case loss approximations and a tractable optimization problem is thus the core challenge of certiﬁed training.
In this work, we tackle this challenge and propose a novel certiﬁed training method, SABR, S mall
A dversarial B ounding R egions, based on the following key insight: by propagating small but carefully selected subsets of the adversarial input region with imprecise methods (i.e., B OX ), we can obtain both well behaved optimization problems and precise approximations of the worst case loss.
This yields networks with complex neuron interactions, enabling higher standard and certiﬁed accuracies, while pointing to a new class of certiﬁed training methods with signiﬁcantly reduced regularization.
SABR, thus, achieves state-of-the-art standard and certiﬁed accuracies across all commonly used settings on the MNIST, CIFAR-10, and T INY I MAGE N ET datasets.
Main Contributions
Our main contributions are:
• A novel certiﬁed training method, SABR, reducing over-regularization to improve both standard and certiﬁed accuracy (§3).
• A theoretical investigation motivating SABR by deriving new insights into the growth of B OX relaxations during propagation (§4).
• An extensive empirical evaluation demonstrating that SABR outperforms all state-of-theart certiﬁed training methods in terms of both standard and certiﬁable accuracies on MNIST, CIFAR-10, and T INY I MAGE N ET (§5).
Background
In this section, we provide the necessary background for SABR.
Adversarial Robustness Consider a classiﬁcation model h : R d in (cid:55)→ R c that, given an input x ∈
X ⊆ R d in , predicts numerical scores
y :
= h ( x ) for every class.
We say that h is adversarially robust on an (cid:96) p -norm ball B (cid:15) p p ( x ) of radius (cid:15) p if it consistently predicts the target class t for all perturbed inputs x (cid:48) ∈ B (cid:15) p p ( x ) .
More formally, we deﬁne adversarial robustness as:
[Equation]
Neural Network Veriﬁcation To verify that a neural network h is adversarially robust, several veriﬁcation techniques have been proposed.
A simple but effective such method is veriﬁcation with the B OX relaxation (Mirman et al., 2018), also called interval bound propagation (IBP)
(Gowal et al., 2018b).
Conceptually, we propagate the input region B (cid:15) p p ( x ) in form of a hyper-box relaxation (each dimension is described as an interval) through the network to compute an over-approximation of its reachable set and then check whether all included outputs yield the correct classiﬁcation.
Given an input region B (cid:15) p p ( x ) , we over-approximate it as a hyper-box, centered at ¯ x 0 :
= x and with radius δ 0 := (cid:15) p , such that we have the i th dimension of the input x 0 i ∈
[¯ x 0 i − δ
i , ¯ x 0 i + δ 0 i ] .
Given a linear layer f
i ( x i − 1 ) =
W x i − 1 + b
=: x i , we obtain the hyper-box relaxation of its output deﬁned by center ¯ x i
=
W ¯ x i − 1 + b and radius δ i =
| W | δ i − 1 , where | · | denotes the elementwise absolute value.
A ReLU activation ReLU( x i − 1 ) :
= max(0 , x i − 1 ) can be relaxed by propagating the lower and upper bound separately, resulting in the output hyper-box with ¯ x i =
u i + l iand
δ i
= u
i − l iwhere l i = ReLU(¯ x i − 1 − δ i − 1 ) and u i = ReLU(¯ x i − 1 + δ i − 1 ) .
We can now show provable robustness if we ﬁnd the upper bound on the logit difference y ∆ i :=
y i − y t < 0 , ∀ i (cid:54)
=
t to be smaller than 0 .
Beyond B OX , more precise veriﬁcation approaches track more relational information at the cost of increased computational complexity (Palma et al., 2022;
Wang et al., 2021; Ferrari et al., 2022).
Training for Robustness For neural networks to be certiﬁably robust, special training is necessary.
Given a data distribution ( x , t ) ∼ D , standard training generally aims to ﬁnd a network parametrization θ that minimizes the expected cross-entropy loss:
[Equation]
When training for robustness, we, instead, wish to minimize the expected worst case loss around the data distribution, leading to the min-max optimization problem:
[Equation]
Unfortunately, solving the inner maximization problem is generally intractable.
Therefore, it is commonly under- or over-approximated, yielding adversarial and certiﬁed training, respectively.
Adversarial Training Adversarial training optimizes a lower bound on the inner optimization objective in Eq.
(3) by ﬁrst computing concrete examples x (cid:48)
∈ B
[Equation]
p p ( x ) that maximize the loss term and then optimizing the network parameters θ for these samples.
While networks trained this way typically exhibit good empirical robustness, they remain hard to formally verify and sometimes also vulnerable to stronger or different attacks (Tramèr et al., 2020; Croce & Hein, 2020).
[Figure]
F C
Latent Space x
R e L
U ...
F C
Output y ∆ incorrect correct
Box relaxation
Adversarial example
Exact propagation
Certiﬁed Training Certiﬁed training optimizes an upper bound on the inner maximization objective in Eq.
(3), obtained via a bound propagation method.
These methods compute an upper bound u y ∆ on the logit differences y ∆ := y − y t 1 to obtain the robust cross-entropy loss
L CE,rob ( B (cid:15) p p
( x ) , t )
=
L CE ( u y ∆ , t ) .
Surprisingly, using the imprecise B OX relaxation (Mirman et al., 2018; Gowal et al., 2018b) (denoted IBP) consistently produces better results than methods based on tighter abstractions (Zhang et al., 2020; Balunovic & Vechev, 2020; Wong et al., 2018).
Jovanovic et al.
(2021) trace this back to the optimization problems induced by the more precise methods becoming intractable to solve.
While the heavily regularized, certiﬁably trained networks are amenable to certiﬁcation, they suffer from severely reduced (standard) accuracies.
Overcoming this robustness-accuracy trade-off remains a key challenge of robust machine learning.
Method – Small Regions for Certiﬁed Training
We address this challenge by proposing a novel certiﬁed training method, SABR — S mall
A dversarial B ounding R egions — yielding networks that are amenable to certiﬁcation and retain relatively high standard accuracies.
We leverage the key insight that computing an over-approximation of the worst-case loss for a small but carefully selected subset of the input region B (cid:15) p p ( x ) often still captures the actual worst-case loss, while signiﬁcantly reducing approximation errors.
We illustrate this in Fig.
Existing certiﬁed training methods propagate the whole input region (dashed box in the input panel), yielding quickly growing approximation errors.
The resulting imprecise over-approximations of the worst case loss (compare the red and green regions to the dashed box in the output panel) cause signiﬁcant over-regularization (large blue arrow ).
Adversarial training methods, in contrast, only consider individual points ( × in Fig. 1) and fail to capture the worst-case loss, leading to insufﬁcient regularization (small blue arrow in the output panel).
We tackle this problem by propagating small, adversarially chosen subsets of the input region (solid box in the input panel), which we call propagation regions .
This yields signiﬁcantly reduced approximation errors and thus more precise, although not necessarily sound over-approximation of the loss (see the solid box in the output panel).
The resulting intermediate level of regularization (medium blue arrow ) allows us to train networks that are both robust and accurate.
We observe that, depending on the size of the propagated region, SABR can be seen as a continuous interpolation between adversarial training for inﬁnitesimally small regions and standard certiﬁed training for the full input region.
2 (cid:15) {+
+}
τ x x ∗ x (cid:48)
[Figure]
Selecting the Propagation Region We parametrize the propagation region as an (cid:96) p -norm ball B τ p p ( x (cid:48) ) with center x (cid:48) and radius τ p ≤ (cid:15) p − (cid:107) x − x (cid:48)
(cid:107) p , ensuring that we indeed propagate a subset of the original region B (cid:15) p p ( x ) .
For notational clarity, we drop the subscript p .
We ﬁrst choose τ = λ(cid:15) by scaling the original perturbation radius (cid:15) with the subselection ratio λ ∈ (0 , 1] .
We then select x (cid:48) by ﬁrst conducting a
PGD attack, yielding the preliminary center x ∗ , and then ensuring that the obtained region is fully contained in the original one by projecting x ∗ onto B (cid:15)
− τ ( x ) to obtain x (cid:48) .
We show this in Fig.
Propagation Method While SABR can be instantiated with any certiﬁed training method, we chose B OX propagation (D IFF AI Mirman et al.
(2018) or IBP (Gowal et al., 2018b)) to obtain well-behaved optimization problems (Jovanovic et al., 2021).
Understanding SABR – Robust Loss and Growth of Small Boxes
In this section, we aim to uncover the reasons behind SABR’s success.
Towards this, we ﬁrst analyze the relationship between robust loss and over-approximation size before investigating the growth of the B OX approximation with propagation region size.
Robust Loss Analysis Certiﬁed training typically optimizes an over-approximation of the worstcase cross-entropy loss L CE,rob , computed via the softmax of the upper-bound on the logit differences y ∆ := y − y t .
When training with the B OX relaxation and assuming the target class t , w.l.o.g., we obtain y ∆ ∈
[¯ y ∆ − δ ∆ , ¯ y ∆ + δ ∆ ] and the robust cross entropy loss L CE, rob ( x ) =
ln (cid:0) 1 + (cid:80) ni
=2 e ¯ y ∆ i + δ ∆ i (cid:1) .
Further, we note that the B OX relaxations of many functions preserve the box centers, i.e., ¯ x i = f
(¯ x i − 1 ) .
Only unstable ReLUs, i.e., ReLUs containing 0 in their input bounds, introduce a slight shift.
However, these are empirically few in certiﬁably trained networks (see Table 5).
We can thus decompose the logit differences determining the robust loss into an accuracy term ¯ y ∆ , corresponding to the misclassiﬁcation margin of the adversarial example x (cid:48) at the center of the propagation region, and a robustness term δ ∆ , bounding the difference to the actual worst-case logits.
As these terms generally represent conﬂicting objectives, robustness and accuracy are balanced to minimize the robust optimization objective.
Consequently, reducing the regularization induced by the robustness term will bias the optimization process towards (standard) accuracy.
−−
[Figure] [Figure]
B OX Growth We investigate the growth of B OX relaxations for an L -layer network with linear layers f i and ReLU activation functions σ .
Given a B OX input with radius δ i − 1 and center distribution ¯ x i − 1 ∼ D , we deﬁne the per-layer growth rate κ i = E D
[Figure]
1 as the ratio of input and expected output radius.
For linear layers with weight matrix W , we obtain an output radius δ i = | W | δ i − 1 and thus a constant growth rate κ i , corresponding to the row-wise (cid:96) 1 norm of the weight matrix | W j, · | 1 .
Empirically, we ﬁnd most linear and convolutional layers to exhibit growth rates between 10 and 100 .
For ReLU layers x i = σ ( x i − 1 ) , the growth rate depends on the location and size of the inputs.
Shi et al.
(2021) assume the input B OX centers ¯ x i − 1 to be symmetrically distributed around 0 ,
i.e., P D (¯ x i − 1 ) =
P D ( − ¯ x i − 1 ) , and obtain a constant growth rate of κ i = 0 .
While this assumption holds at initialization, trained networks tend to have more inactive than active ReLUs (see Table 5), indicating asymmetric distributions with more negative inputs (see also Fig. 3).
We investigate this more realistic setting.
When input radii are δ i − 1 ≈ 0 , active neurons will stay stably active, yielding δ i
=
δ i − 1 and inactive neurons will stay stably inactive, yielding δ i = 0 .
Thus, we obtain a growth rate, equivalent to the portion of active neurons.
In the other extreme δ i − 1 → ∞ , all neurons will become unstable with ¯ x i − 1 (cid:28)
δ i − 1 , yielding δ i ≈ 0 .
5 δ i − 1 , and thus a constant growth rate of κ i = 0 . 5 .
Assuming pointwise asymmetry favouring negative inputs, i.e., p (¯ x i − 1 = − z ) > p (¯ x i − 1 = z ) , ∀ z ∈ R > 0 , we show that between those two extremes, output radii grow strictly super-linear in the input size :
Theorem 4.1 (Hyper-Box Growth) .
Let y :
=
σ ( x ) = max(0 , x ) be a ReLU function and consider box inputs with radius
δ x and asymmetrically distributed centers ¯ x ∼ D such that P D (¯ x = − z ) > P
D (¯ x = z ) , ∀ z ∈ R > 0 .
Then the mean output radius δ y will grow super-linearly in the input radius δ x .
More formally:
[Equation]
We defer a proof to App.
A and illustrate this behavior in Fig. 4.
Multiplying all layer-wise growth rates, we obtain the overall growth rate κ = (cid:81) Li
=
2 κ i , which is exponential in network depth and super-linear in input radius.
When not speciﬁcally training with the B OX relaxation, we empirically observe that the large growth factors of linear layers dominate the shrinking effect of the
ReLU layers, leading to a quick exponential growth in network depth.
Further, for both SABR and
IBP trained networks, the super-linear growth in input radius empirically manifests as exponential behavior (see Figs.
7 and 8).
Using SABR, we thus expect the regularization induced by the robustness term to decrease super-linearly, and empirically even exponentially, with subselection ratio λ , explaining the signiﬁcantly higher (standard) accuracies compared to IBP
[Figure]
Evaluation
In this section
[Figure]
we evaluate SABR in the challenging (cid:96) ∞ -norm setting, deferring a detailed description of the experimental setup to App.
B
[Figure]
-hand corner is best.
Main Results We compare SABR to state-of-the-art certiﬁed training methods in Table 2 and Fig.
5, reporting the best results achieved with a given method on any architecture.
In Fig.
5, we show certiﬁed over standard accuracy (upper right-hand corner is best) and observe that SABR ( ) dominates all other methods, achieving both the highest certiﬁed and standard accuracy across all settings.
Methods striving to balance accuracy and regularization by bridging the gap between provable and adversarial training ( , )(Balunovic & Vechev, 2020; Palma et al., 2022) perform only slightly worse than SABR at small perturbation radii, but much worse at large radii, e.g., attaining only 27 .
5% ( ) and 27 .
9% ( ) certiﬁable accuracy for CIFAR-10 at (cid:15) = 8 / 255 compared to 35 .
Similarly, methods focusing only on certiﬁed accuracy by directly optimizing over-approximations of the worst-case loss ( , ) (Gowal et al., 2018b; Zhang et al., 2020) tend to perform well at large perturbation radii, but poorly at small perturbation radii, e.g., on CIFAR-10 at (cid:15)
= 2 / 255 , SABR improves certiﬁed accuracy to 62 .
6% ( ) up from 52 .
9% ( ) and 54 .
[Table]
[Table] [Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
In contrast to certiﬁed training, Zhang et al.
(2021) propose an architecture with inherent (cid:96) ∞ -robustness properties.
While they attain higher certiﬁed accuracies on CIFAR-10 (cid:15) = 8 / 255 , their training is notoriously hard (Zhang et al., 2021, 2022), yielding low standard accuracies of, e.g., only 60 . 6% compared to 79 .
52% at (cid:15) = 2 / 255 .
Further, robustness can only be obtained against one perturbation type at a time.
[Figure]
Certiﬁcation Method and Propagation Region Size
To analyze the interaction between certiﬁcation method precision and propagation region size, we train a range of models with subselection ratios λ varying from 0 . 0125 to 1 . 0 and analyze them with veriﬁcation methods of increasing precision (B OX , D EEP P OLY ,
MN-B A B) and a 50-step PGD attack (Madry et al., 2018) with 5 random restarts and the targeted logit margin loss (Carlini & Wagner, 2017).
We illustrate results in Fig.
6 and observe that standard and adversarial accuracies increase with decreasing λ , as regularization decreases.
For λ = 1 , i.e., IBP training, we observe little difference between the veriﬁcation methods.
However, as we decrease λ , the B OX veriﬁed accuracy decreases quickly, despite B OX relaxations being used during training.
In con-
[Table]
trast, using the most precise method, MN-B A B, we initially observe increasing certiﬁed accuracies, as the reduced regularization yields more accurate networks, before the level of regularization becomes insufﬁcient for certiﬁcation.
While D EEP P OLY loses precision less quickly than B OX , it can not beneﬁt from more accurate networks.
This indicates that the increased accuracy, enabled by the reduced regularization, may rely on complex neuron interactions, only captured by MN-B A
B.
This qualitatively different behavior depending on the precision of the certiﬁcation method highlights the importance of recent advances in neural network veriﬁcation for certiﬁed training.
Even more importantly, these results clearly show that provably robust networks do not necessarily require the level of regularization introduced by IBP training.
[Figure]
Loss Analysis In Fig.
7, we compare the robust loss of a
SABR and an IBP trained network across different propagation region sizes (all centered around the original sample) depending on the bound propagation method used.
When propagating the full input region ( λ = 1 ), the SABR trained network yields a much higher robust loss than the
IBP trained one.
However, when comparing the respective training subselection ratios, λ = 0 .
05 for SABR and λ = 1 .
for IBP, SABR yields signiﬁcantly smaller training losses, allowing the SABR trained network to reach a much lower standard loss.
Finally, we observe the losses to clearly grow super-linearly with increasing propagation region sizes (note the logarithmic scaling of the y-axis) agreeing well with our theoretical results in §4.
Conclusion
We introduced a novel certiﬁed training method called SABR ( S mall A dversarial B ounding
R egions) based on the key insight, that propagating small but carefully selected subsets of the input region combines small approximation errors and thus regularization with well-behaved optimization problems.
This allows SABR trained networks to outperform all existing certiﬁed training methods on all commonly used benchmarks in terms of both standard and certiﬁed accuracy.
Even more importantly, SABR lays the foundation for a new class of certiﬁed training methods promising to overcome the robustness-accuracy trade-off and enabling the training of networks that are both accurate and certiﬁably robust.
A Deferred Proofs
In this section
[Equation]
we provide the proof for Lemma A.1.
Let us ﬁrst consider the following Lemma:
Lemma A.1 (Hyper-Box Growth) .
Let y :
=
σ ( x ) = max(0 , x ) be a ReLU function and consider box inputs with radius δ x and centers ¯ x ∼ D .
Then the mean radius E δ y of the output boxes will satisfy:
[Equation]
and
[Equation]
Proof.
Recall that given an input box with center ¯ x and radius δ x , the output relaxation of a ReLU layer is deﬁned by:
[Equation]
We thus obtain the expectation
[Equation]
its derivative
[Equation]
and its curvature
[Equation]
Now
[Equation]
we can easily proof Theorem
[Equation]
1, restated below for convenience
[Equation]
Theorem 4.1 (Hyper-Box Growth) .
Let y :
=
σ ( x ) = max(0 , x ) be a ReLU function and consider box inputs with radius
δ x and asymmetrically distributed centers ¯ x ∼ D such that P D (¯ x = − z ) > P
D (¯ x = z ) , ∀ z ∈ R > 0 .
Then the mean output radius δ y will grow super-linearly in the input radius δ x .
More formally:
[Equation] [Equation]
Proof.
We apply Lemma A.1 by substituting an asymmetric center distribution D , satisfying
P D (¯ x = − z ) > P D (¯ x = z ) , ∀ z ∈ R > 0 into Eq.
(6) to obtain:
[Equation]
The theorem follows trivially from the strictly positive curvature.
Example for Piecewise Uniform Distribution Let us assume the centers ¯ x ∼ D are distributed according to:
[Equation]
where a and b .
Then we have by Lemma A.
[Equation]
We observe quadratic growth for a > b and recover the symmetric special case of E D [ δ y ] = 0 .
5 δ x for a = b .
B Additional Experimental Details
In this section, we provide detailed informations on the exact experimental setup.
Experimental Setup We implement SABR in PyTorch (Paszke et al., 2019) and use MN-B A B (Ferrari et al., 2022) for certiﬁcation.
We conduct experiments on MNIST (LeCun et al., 2010),
CIFAR-10 (Krizhevsky et al., 2009), and T INY I MAGE N ET (Le & Yang, 2015) for the challenging (cid:96) ∞ perturbations, using the same 7-layer convolutional architecture CNN7 as prior work (Shi et al., 2021) unless indicated otherwise (see App.
B for more details).
We choose similar training hyperparameters as prior work (Shi et al., 2021) and provide more detailed information in App.
B.
Datasets We conduct experiments on the MNIST (LeCun et al., 2010), CIFAR-10 (Krizhevsky et al., 2009), and T INY I MAGE N ET (Le & Yang, 2015) datasets.
For T INY I MAGE N ET and CIFAR
we follow Shi et al.
and use random horizontal ﬂips and random cropping as data augmentation during training and normalize inputs after applying perturbations.
Following prior work (Xu et al., 2020; Shi et al., 2021), we evaluate CIFAR-10 and MNIST on their test sets and T INYI MAGE N ET on its validation set, as test set labels are unavailable.
Following Xu et al.
(2020) and in contrast to Shi et al.
(2021), we train and evaluate T INY I MAGE N ET with images cropped to 56 × 56 .
[Table]
Training Hyperparameters We mostly follow the hyperparameter choices from Shi et al.
(2021) including their weight initialization and warm-up regularization 2 , and use ADAM (Kingma & Ba, 2015) with an initial learning rate of 5 ×
10 − 4 , decayed twice with a factor of 0.2.
For CIFAR-10 we train 160 an 180 epochs for (cid:15) = 2 / 255 and (cid:15)
= 8 / 255 , respectively, decaying the learning rate after 120 and 140 and 140 andepochs.
For T INY I MAGE N ET (cid:15) = 1 / 255 we use the same settings as for CIFAR-10 at (cid:15) = 8 / 255 .
For MNIST we trainepochs, decaying the learning rate after 50 and 60 epochs.
We choose a batch size of 128 for CIFAR-10 and T INY I MAGE N ET , and 256 for MNIST.
We use (cid:96)regularization with factors according to Table 3.
For all datasets, we perform one epoch of standard training ( (cid:15) = 0 ) before annealing (cid:15) from 0 to its ﬁnal value over 80 epochs for CIFAR-10 and T INY I MAGE N ET and for 20 epochs for MNIST.
We use an n = 8 step PGD attack with an initial step size of α = 0 . 5 , decayed with a factor of 0 .
1 after the 4 th and 7 th step to select the center of the propagation region.
We use a constant subselection ratio λ with values shown in Table 3.
For CIFAR-10 (cid:15) = 2 / 255 we use shrinking with c s = 0 .
8 (see below).
[Figure]
ReLU-Transformer with Shrinking Additionally to standard SABR, outlined in §3, we propose to amplify the B OX growth rate reduction (see § 4 ) affected by smaller propagation regions, by adapting the ReLU transformer as follows:
[Equation]
We call c
s the shrinking coefﬁcient, as the output radius of unstable ReLUs is shrunken by multiplying it with this factor.
We only use these transformers for the marked ( ∗ ) CIFAR-10 (cid:15)
= 2 /network discussed in Table 2.
Architectures Similar to prior work (Shi et al., 2021), we use a 7-layer convolutional architecture,
CNN7 .
The ﬁrst 5 layers are convolutional layers with ﬁlter sizes [64, 64, 128, 128, 128], kernel size 3, strides [1, 1, 2, 1, 1], and padding 1.
They are followed by a fully connected layer withhidden units and the ﬁnal classiﬁcation.
All
but the last layers are followed by batch normalization (Ioffe & Szegedy, 2015) and ReLU activations.
For the BN layers, we train using the statistics of the unperturbed data similar to Shi et al.
During the PGD attack we use the BN layers in evaluation mode.
We further consider narrower version, CNN7-narrow which is identical to CNN expect for using the ﬁlter sizes [32, 32, 64, 64, 64] and a fully connected layer with 216 hidden units.
[Table] [Table]
Hardware and Timings We train and certify all networks using single NVIDIA RTX 2080Ti, 3090, Titan RTX, or
A6000.
Training takes roughly 3 and 7 hours for MNIST and
CIFAR-10, respectively, with T INY I MAGE N ET taking two and a half days on a single NVIDIA RTX 2080Ti.
For more Details see Table 4.
Veriﬁcation with MN-B A B takes around 34 h for MNIST, 28 h for CIFAR-10 and 2 h for T INY I MAGE N ET on a NVIDIA Titan RTX.
C Additional Experimental Results
[Figure]
Loss Analysis In Fig.
8, we show the error growth of an adversarially trained (left) and IBP trained model over increasing subselection ratios λ .
We observe that errors grow only slightly super-linear rather than exponential for the adversarially trained network.
We trace this back to the large portion of crossing ReLUs (Table 5), especially in later layers, leading to the layerwise growth being only linear.
For the IBP trained model, in contrast, we observe exponential growth across a wide range of propagation region sizes, as the heavy regularization leads to a small portion of active and unstable ReLUs.
In Fig.
9, we compare B OX errors around the unperturbed sample and the center computed with an adversarial attack, as described in §3.
We observe that while the loss is larger around the adversarial centers, especially for small propagation regions, this effect is small compared to the difference between training or certiﬁcation methods.
[Table]
ReLU Activation States
The portion of ReLU activations which are (stably) active, inactive, or unstable has been identiﬁed as an important characteristic of certiﬁably trained networks (Shi et al., 2021).
We evaluate these metrics for IBP, SABR, and adversarially (PGD) trained networks on CIFAR-10 at (cid:15) = 2 / 255 , using the
B OX relaxation to compute intermediate bounds, and report the average over all layers and test set samples in
Table 5.
We observe that, when evaluated on concrete points, the SABR trained network has around 37% more active ReLUs than the IBP trained one and almost as many as the PGD trained one, indicating a signiﬁcantly smaller level of regularization.
While the SABR trained network has around 3 -times as many unstable ReLUs as the IBP trained network, when evaluated on the whole input region, it has 20 -times fewer than the PGD trained one, highlighting the improved certiﬁability.
[Table]
Gradient Alignment To analyze whether SABR training is actually more aligned with standard accuracy and empirical robustness, as indicated by our theory in §4, we conduct the following experiment for
CIFAR-10 and (cid:15) = 2 / 255 : We train one network using SABR with λ = 0 .
05 and one with IBP, corresponding to λ = 1 . 0 .
For both, we now compute the gradients ∇ θ of their respective robust training losses
L rob and the cross-entropy loss L CE applied to unperturbed (Std.) and adversarial (Adv.)
samples.
We then report the mean cosine similarity between these gradients across the whole test set in Table 6.
We clearly observe that the SABR loss is much better aligned with both the crossentropy loss of unperturbed and adversarial samples, corresponding to standard accuracy and empirical robustness, respectively.