C ERTIFIED T RAINING : S MALL B OXES ARE A LL Y OU N EED
Anonymous authors
Paper under double-blind review
A BSTRACT
To obtain non-trivial, deterministic robustness guarantees against adversarial perturbations, specialized training methods are used.
We propose, SABR, a novel certiﬁed training method, based on the key insight that propagating interval bounds for a small but carefully selected subset of the adversarial input region is sufﬁcient to approximate the worst-case loss over the whole region while signiﬁcantly reducing approximation errors.
We show in an extensive empirical evaluation that SABR outperforms existing certiﬁed defenses across perturbation magnitudes on MNIST, CIFAR-10, and T INY I MAGE N ET , in terms of both standard and certiﬁable accuracies , pointing to a new class of certiﬁed training methods promising to alleviate the robustness-accuracy trade-off.
I NTRODUCTION
As neural networks are increasingly deployed in safety-critical domains, formal robustness guarantees against adversarial examples (Biggio et al., 2013; Szegedy et al., 2014) are more important than ever.
However, despite signiﬁcant progress, specialized training methods that improve certiﬁability at the cost of severely reduced accuracies are still required to obtain deterministic guarantees.
Generally, both training and certiﬁcation methods compute a network’s reachable set given an input region deﬁned by an adversary speciﬁcation and a concrete input, by propagating a symbolic overapproximation of this region through the network (Singh et al., 2018; 2019a; Gowal et al., 2018a).
Depending on the method used for propagation, both the computational complexity and tightness of this approximation can vary widely.
For certiﬁed training, an over-approximation of the worst-case loss is computed from this reachable set and then optimized (Mirman et al., 2018; Zhang et al., 2020;
Wong et al., 2018).
Surprisingly, the least precise propagation methods yield the highest certiﬁed accuracies as more precise methods induce signiﬁcantly harder optimization problems (Jovanovi´c et al., 2022).
However, the large approximation errors incurred by these imprecise methods lead to over-regularization and thus poor accuracy.
Combining precise worst-case loss approximations and a tractable optimization problem is thus the core challenge of certiﬁed training.
In this work, we tackle this challenge and propose a novel certiﬁed training method, SABR, S mall
A dversarial B ounding R egions, based on the following key insight: by propagating small but carefully selected subsets of the adversarial input region with imprecise methods (i.e., B OX ), we can obtain both well behaved optimization problems and precise approximations of the worst case loss.
This yields less over-regularized networks, enabling higher standard and certiﬁed accuracies and pointing to a new class of certiﬁed training methods.
SABR, thus, improves on state-of-the-art certiﬁed defenses in terms of standard and certiﬁed accuracies on the MNIST ( (cid:15) ∈ { 0 . 1 , 0 . 3 } ),
CIFAR-10 ( (cid:15) ∈ { 2 / 255 , 8 / 255 } ), and T INY I MAGE N ET ( (cid:15) = 1 / 255 ) datasets.
Main Contributions
Our main contributions are:
• A novel certiﬁed training method, SABR, reducing over-regularization to improve both standard and certiﬁed accuracy (§3).
• A theoretical investigation motivating SABR by deriving new insights into the growth of B OX relaxations during propagation (§4).
• An extensive empirical evaluation demonstrating that SABR outperforms all state-of-theart certiﬁed training methods in terms of both standard and certiﬁable accuracies on MNIST, CIFAR-10, and T INY I MAGE N ET (§5).
B ACKGROUND
In this section, we provide the necessary background for SABR.
Adversarial Robustness Consider a classiﬁcation model h : R d in (cid:55)→ R c that, given an input x ∈
X ⊆ R d in , predicts numerical scores
y :
= h ( x ) for every class.
We say that h is adversarially robust on an (cid:96) p -norm ball B (cid:15) p p ( x ) of radius (cid:15) p if it consistently predicts the target class t for all perturbed inputs x (cid:48) ∈ B (cid:15) p p ( x ) .
More formally, we deﬁne adversarial robustness as:
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
[Equation]
[Figure]
Neural Network Veriﬁcation To verify that a neural network h is adversarially robust, several veriﬁcation techniques have been proposed.
A simple but effective such method is veriﬁcation with the B OX relaxation (Mirman et al., 2018), also called interval bound propagation (IBP)
(Gowal et al., 2018b).
Conceptually, we ﬁrst compute an over-approximation of a network’s reachable set by propagating the input region B (cid:15) p p ( x ) through the neural network and then check whether all outputs in the reachable set yield the correct classiﬁcation.
This propagation sequentially computes a hyper-box (each dimension is described as an interval) relaxation of a layer’s output, given a hyperbox input.
As an example, consider an L -layer network h
=
f L ◦ σ ◦ f L − 2 ◦ . . .
◦ f 1 , with linear lay-
ers f i and ReLU activation functions σ .
Given an input region B (cid:15) p p ( x ) , we over-approximate it as a hyperbox, centered at ¯ x 0 :
= x and with radius δ 0 := (cid:15) p , such that we have the i th dimension of the input x 0 i ∈
[¯ x 0 i − δ
i , ¯ x 0 i + δ 0 i ] .
Given a linear layer f
i ( x i − 1 ) =
W x i − 1 + b
=: x i , we obtain the hyper-box relaxation of its output deﬁned by centre ¯ x i
=
W ¯ x i − 1 + b and radius δ i =
| W | δ i − 1 , where | · | denotes the elementwise absolute value.
A ReLU activation ReLU( x i − 1 ) :
= max(0 , x i − 1 ) can be relaxed by propagating the lower and upper bound separately, resulting in the output hyper-box with ¯ x i =
u i + l iand
δ i
= u
i − l iwhere l i = ReLU(¯ x i − 1 − δ i − 1 ) and u i = ReLU(¯ x i − 1 + δ i − 1 ) .
Proceeding this way for all layers, we obtain lower and upper bounds on the network output y and can check if the output score of the target class is greater than that of all other classes by computing the upper bound on the logit difference y ∆ i :
[Equation]
We illustrate this propagation process for a one-layer network in Fig.
There, the blue shapes ( ) show an exact propagation of the input region and the red shapes ( ) their hyper-box relaxation.
Note how after the ﬁrst linear and ReLU layer (third row), the relaxation (red) contains already many points not reachable via exact propagation (blue), despite it being the smallest hyper-box containing the exact region.
These so-called approximation errors accumulate quickly, leading to an increasingly imprecise abstraction, as can be seen by comparing the two shapes after an additional linear layer (last row).
To verify that this network classiﬁes all inputs in [ − 1 , 1] 2 to class 1 , we have to show the upper bound of the logit difference y 2 − y 1 to be less than 0 .
While the concrete maximum of − 0 .
3 ≥ y 2 − y 1 (black × ) is indeed less than 0 , showing that the network is robust, the B OX relaxation only yields 0 .≥
y 2 − y 1 (red × ) and is thus too imprecise to prove it.
Beyond B OX , more precise veriﬁcation approaches track more relational information at the cost of increased computational complexity (Palma et al., 2022; Wang et al., 2021).
A recent example is
MN-B A B (Ferrari et al., 2022), which improves on B OX in two key ways: First, instead of propagating axis-aligned hyper-boxes, it uses much more expressive polyhedra, allowing linear layers to be captured exactly and ReLU layers much more precisely.
Second, if the result is still too imprecise, the veriﬁcation problem is recursively split into easier ones, by introducing a case distinction between the two linear segments of the ReLU function.
This is called the branch-and-bound (BaB) approach (Bunel et al., 2020).
We refer the interested reader to Ferrari et al.
for more details.
Training for Robustness For neural networks to be certiﬁably robust, special training is necessary.
Given a data distribution ( x , t ) ∼ D , standard training generally aims to ﬁnd a network parametrization θ that minimizes the expected cross-entropy loss (see App.
B.1):
[Equation]
When training for robustness, we, instead, wish to minimize the expected worst case loss around the data distribution, leading to the min-max optimization problem:
[Equation]
Unfortunately, solving the inner maximization problem is generally intractable.
Therefore, it is commonly under- or over-approximated, yielding adversarial and certiﬁed training, respectively.
For notational clarity, we henceforth drop the subscript p .
Adversarial Training Adversarial training optimizes a lower bound on the inner optimization objective in Eq.
(3) by ﬁrst computing concrete examples x
(cid:48) ∈ B (cid:15) ( x ) maximizing the loss term and then optimizing the network parameters θ for these samples.
Typically, x (cid:48) is computed by initializing x (cid:48) 0 uniformly at random in B (cid:15) ( x ) and then updating it over N projected gradient descent steps (PGD
[Equation]
(Madry et
[Equation]
)) , with step size α and projection operator Π .
While networks trained this way typically exhibit good empirical robustness, they remain hard to formally verify and sometimes remain vulnerable to stronger or different attacks (Tramèr et al., 2020; Croce & Hein, 2020).
Certiﬁed Training Certiﬁed training optimizes an upper bound on the inner maximization objective in Eq.
(3), obtained via a bound propagation method.
These methods compute an upper bound u y ∆ on the logit differences y ∆ := y − y t 1 as described above to obtain the robust cross-entropy loss L CE,rob ( B (cid:15) ( x ) , t ) =
L CE ( u y ∆ , t ) .
We will use B OX to refer to the veriﬁcation and propagation approach, and IBP to refer to the corresponding training method.
Surprisingly, using the imprecise B OX relaxation (Mirman et al., 2018; Gowal et al., 2018b; Shi et al., 2021) consistently produces better results than methods based on tighter abstractions (Zhang et al., 2020; Balunovic & Vechev, 2020; Wong et al., 2018).
Jovanovi ´ c et al.
(2022) trace this back to the optimization problems induced by the more precise methods becoming intractable to solve.
While the heavily regularized, certiﬁably trained networks are amenable to certiﬁcation, they suffer from severely reduced (standard) accuracies.
Overcoming this robustness-accuracy trade-off remains a key challenge of robust machine learning.
M ETHOD – S MALL R EGIONS FOR C ERTIFIED T RAINING
To train networks that are not only robust and amenable to certiﬁcation but also retain comparatively high standard accuracies, we propose the novel certiﬁed training method, SABR — S mall
A dversarial B ounding R egions.
We leverage the key insight that computing an over-approximation of the worst-case loss over a small but carefully selected subset of the input region B (cid:15) ( x ) often yields a good proxy for the worst-case loss over the whole region, while signiﬁcantly reducing approximation errors.
We illustrate this intuition in Fig. 2.
Existing certiﬁed training methods always consider the whole input region (dashed box in the input panel).
Propagating such large regions through the network yields quickly growing approximation errors and thus very imprecise over-approximations of the actual worst case loss (compare the reachable set in red and green to the dashed box in the output panel), causing signiﬁcant over-regularization (large blue arrow ).
Adversarial training methods, in contrast, only consider individual points in the input space ( × in Fig. 2) and often fail to capture the actual worst-case loss.
This leads to insufﬁcient regularization (small blue arrow in the output panel) and yields networks which are not amenable to certiﬁcation and potentially not robust.
We tackle this problem by propagating small, adversarially chosen subsets of the input region (solid box in the input panel of Fig. 2), which we call the propagation region .
This leads to signiﬁcantly reduced approximation errors (see the solid box in the output panel) inducing a level of regularization in-between certiﬁed and adversarial training methods (medium blue arrow ), allowing us to train networks that are both robust and accurate.
[Figure]
[Figure]
correct
[Figure]
relaxation
[Figure]
More formally, we deﬁne an auxiliary objective for the robust optimization problem Eq.
(3) as
[Equation]
where we replace the maximum over the whole input region B (cid:15) ( x ) with that over a carefully selected subset B τ ( x (cid:48) ) .
While choosing x (cid:48)
=
Π B (cid:15) − τ ( x ) arg max x ∗ ∈B (cid:15) ( x ) L CE ( x ∗ , t ) , would recover the original robust training problem (Eq.
(3)), both, computing the maximum loss over a given input region (Eq.
and ﬁnding a point that realizes this loss is generally intractable.
Instead, we instantiate SABR by combining different approximate approaches for the two key components: a) a method for choosing the location x (cid:48) and size τ of the propagation region, and b) a method used for propagating the thus selected region. We describe our choices below and refer to App.
D.5 for more detail. We note that we generally do not obtain a sound over-approximation of the loss on B (cid:15) ( x ) .
Depending on the size of the propagated region B τ ( x (cid:48) ) , SABR can be seen as a continuous interpolation between adversarial training for inﬁnitesimally small regions τ = 0 and standard certiﬁed training for the full input region τ = (cid:15) .
2 (cid:15)
τ x x ∗ x (cid:48)
Selecting the Propagation Region
SABR aims to ﬁnd and propagate a small subset of the adversarial input region B (cid:15) ( x ) that contains the inputs leading to the worst-case loss.
To this end, we parametrize this propagation region as an (cid:96) p -norm ball B τ ( x (cid:48) ) with centre x (cid:48) and radius τ ≤ (cid:15) −(cid:107) x − x (cid:48) (cid:107) p .
We ﬁrst choose τ = λ(cid:15) by scaling the original perturbation radius (cid:15) with the subselection ratio λ ∈ (0 , 1] .
We then select x (cid:48) as follows:
We conduct a PGD attack, choosing the preliminary centre x ∗ as the sample with the highest loss.
We then ensure the obtained region is fully contained in the original one by projecting x ∗ onto B (cid:15) − τ ( x ) to obtain x (cid:48) .
We show this in Fig.
Propagation Method Having found the propagation region B τ ( x (cid:48) ) , we can use any symbolic propagation method to compute an over-approximation of its worst-case loss.
We chose B OX propagation (D IFF AI Mirman et al.
(2018) or IBP (Gowal et al., 2018b)) to obtain well-behaved optimization problems (Jovanovi´c et al., 2022).
There, choosing small propagation regions ( τ (cid:28) 1 ), can signiﬁcantly reduce the incurred over-approximation errors, as we will show later (see §4).
U NDERSTANDING SABR: R OBUST L OSS AND G ROWTH OF S MALL B OXES
In this section, we aim to uncover the reasons behind SABR’s success.
Towards this, we ﬁrst analyse the relationship between robust loss and over-approximation size before investigating the growth of the B OX approximation with propagation region size.
Robust Loss Analysis Certiﬁed training typically optimizes an over-approximation of the worstcase cross-entropy loss L CE,rob , computed via the softmax of the upper-bound on the logit differences y ∆ := y − y t .
When training with the B OX relaxation and assuming the target class t , w.l.o.g., we obtain the logit difference y ∆ ∈
[¯ y ∆ − δ ∆ , ¯ y ∆ + δ ∆ ] and thus the robust cross entropy loss
[Equation]
We observe that samples with high ( > 0 ) worst-case misclassiﬁcation margin ¯ y ∆ + δ ∆ := max i ¯ y ∆ i + δ ∆ i dominate the overall loss and permit the per-sample loss term to be approximated as
[Equation]
Further, we note that the B OX relaxations of many functions preserve the box centres, i.e., ¯ x i = f
(¯ x i − 1 ) .
Only unstable ReLUs, i.e., ReLUs containing 0 in their input bounds, introduce a slight shift.
However, these are empirically few in certiﬁably trained networks (see Table 4).
These observations allow us to decompose the robust loss into an accuracy term ¯ y ∆ , corresponding to the misclassiﬁcation margin of the adversarial example x (cid:48) at the centre of the propagation region, and a robustness term δ ∆ , bounding the difference to the actual worst-case loss.
These terms generally represent conﬂicting objectives, as local robustness requires the network to disregard high frequency features (Ilyas et al., 2019).
Therefore, robustness and accuracy are balanced to minimize the optimization objective Eq.
Consequently, reducing the regularization induced by the robustness term will bias the optimization process towards standard accuracy.
Next, we investigate how
SABR reduces exactly this regularization strength, by propagating smaller regions.
[Figure] [Figure]
box centres ¯ x ∼N ( µ = − 1 . 0 , σ =0 . 5) .
B OX Growth To investigate how B OX approximations grow as they are propagated, let us again consider an L -layer network h
=
f L ◦ σ ◦ f L − 2 ◦ . . .
◦ f 1 , with linear layers f i and ReLU activation functions σ .
Given a B OX input with radius δ i −and centre distribution ¯ x i − 1 ∼ D , we now deﬁne the per-layer growth rate κ i as the ratio of input and expected output radius:
[Equation]
For linear layers with weight matrix W , we obtain an output radius δ i = | W | δ i − 1 and thus a constant growth rate κ i , corresponding to the row-wise (cid:96) 1 norm of the weight matrix | W j, · | 1 .
Empirically, we ﬁnd most linear and convolutional lay-
ers to exhibit growth rates between 10 and 100 (see Table 10 in
App.
D.4).
For ReLU layers x i = σ ( x i − 1 ) , computing the growth rate is more challenging, as it depends on the location and size of the inputs.
Shi et al.
(2021) assume the input B OX centres ¯ x i −to be symmetrically distributed around 0 , i.e., P D (¯ x i − 1 ) =
P D ( − ¯ x i − 1 ) , and obtain a constant growth rate of κ i = 0 . 5 .
While this assumption holds at initialization, we observe that trained networks tend to have more inactive than active ReLUs (see Table 4), indicating asymmetric distributions with more negative inputs (see also Fig. 4).
We now investigate this more realistic setting.
We ﬁrst consider the two limit cases where input radii δ
i − 1 go againstand ∞ .
When input radii are δ i − 1 ≈ 0 , active neurons will stay stably active, yielding δ i
=
δ i − 1 and inactive neurons will stay stably inactive, yielding δ i = 0 .
Thus, we obtain a growth rate, equivalent to the portion of active neurons.
In the other extreme δ i − 1 → ∞ , all neurons will become unstable with ¯ x i − 1 (cid:28)
δ i − 1 , yielding δ i ≈ 0 .
5 δ i − 1 , and thus a constant growth rate of κ i = 0 .
To analyze the behavior in between those extremes, we assume pointwise asymmetry favouring negative inputs, i.e., p (¯ x i − 1 = − z ) > p (¯ x i − 1 = z ) , ∀ z ∈ R > 0 .
In this setting, we ﬁnd that output radii grow strictly super-linear in the input size:
Theorem 4.1 (Hyper-Box Growth) .
Let y :
=
σ ( x ) = max(0 , x ) be a ReLU function and consider box inputs with radius
δ x and asymmetrically distributed centres ¯ x ∼ D such that P D (¯ x = − z ) >
P
D (¯ x = z ) , ∀ z ∈ R > 0 .
Then the mean output radius δ y will grow super-linearly in the input radius δ x .
More formally:
[Equation]
We defer a proof to App.
A and illustrate this behaviour in Fig.
5 for the box centre distribution ¯ x ∼ N ( µ = − 1 . 0 , σ = 0 . 5) .
There, we clearly observe that the actual super-linear growth (purple) outpaces a linear approximation (orange).
While even the qualitative behaviour depends on the exact centre distribution and the input box size δ x , we can solve special cases analytically.
For example, a piecewise uniform centre distribution yields quadratic growth on its support (see App.
A).
Multiplying all layer-wise growth rates, we obtain the overall growth rate κ = (cid:81) Li
=
2 κ i , which is exponential in network depth and super-linear in input radius.
When not speciﬁcally training with the
B OX relaxation, we empirically observe that the large growth factors of linear layers dominate the shrinking effect of the ReLU layers, leading to a quick exponential growth in network depth.
Further, for both SABR and IBP trained networks, the super-linear growth in input radius empirically manifests as exponential behaviour (see Figs.
8 and 9).
Using SABR, we thus expect the regularization induced by the robustness term to decrease super-linearly, and empirically even exponentially, with subselection ratio λ , explaining the signiﬁcantly higher accuracies compared to IBP.
E VALUATION
In this section, we ﬁrst compare SABR to existing certiﬁed training methods before investigating its behavior in an ablation study.
For extended results see App.
D.1–D.3. Experimental Setup We implement SABR in PyTorch (Paszke et al., 2019) and use MN-B A B (Ferrari et al., 2022) for certiﬁcation.
We conduct experiments on MNIST (LeCun et al., 2010),
CIFAR-10 (Krizhevsky et al., 2009), and T INY I MAGE N ET (Le & Yang, 2015) for the challenging (cid:96) ∞ perturbations, using the same 7-layer convolutional architecture CNN7 as prior work (Shi et al., 2021) unless indicated otherwise (see App.
C for more details).
We choose similar training hyperparameters as prior work (Shi et al., 2021) and provide more detailed information in App. C.
5. M AIN R ESULTS
[Figure]
We compare SABR to state-of-the-art certiﬁed training methods in Table 1 and Fig. 6, reporting the best results achieved with a given method on any architecture.
In Fig.
6, we show certiﬁed over standard accuracy (upper right-hand corner is best) and observe that SABR ( ) dominates all other methods, achieving both the highest certiﬁed and standard accuracy across all settings.
As existing methods typically perform well either at large or small perturbation radii (see Table 1 and Fig. 6), we believe the high performance of SABR across perturbation radii to be particularly promising.
Methods striving to balance accuracy and regularization by bridging the gap between provable and adversarial training ( , )(Balunovic & Vechev, 2020; Palma et al., 2022) perform only slightly worse than SABR at small perturbation radii (CIFAR-10 (cid:15) = 2 / 255 ), but much worse at large radii, e.g., attaining only 27 .
5% ( ) and 27 .
9% ( ) certiﬁable accuracy for CIFAR-10 (cid:15) = 8 / 255 compared to 35 .
Similarly, methods focusing purely on certiﬁed accuracy by directly optimizing over-approximations of the worst-case loss ( , ) (Gowal et al., 2018b; Zhang et al., 2020) tend to perform well at large perturbation radii (MNIST (cid:15)
= 0 . 3 and
CIFAR-10 (cid:15) = 8 / 255 ), but poorly at small perturbation radii, e.g. on CIFAR-10 at (cid:15) = 2 / 255 ,
SABR improves natural accuracy to 79 .
5% ( ) up from 66 .
8% ( ) and 71 .
5% ( ) and even more signiﬁcantly certiﬁed accuracy to 62 .
6% ( ) up from 52 .
9% ( ) and 54 .
On the particularly challenging T INY I MAGE N ET , SABR again dominates all existing certiﬁed training methods, improving certiﬁed and standard accuracy by almost 3% .
To summarize, SABR improves strictly on all existing certiﬁed training methods across all commonly used benchmarks with relative improvements exceeding 25% in some cases.
[Table]
[Figure]
this work
[Figure]
[Table]
In contrast to certiﬁed training methods Zhang et al.
(2021) propose a new architecture with inherent (cid:96) ∞ -robustness properties.
While these networks attain higher certiﬁed accuracies on
CIFAR-10 at (cid:15) = 8 / 255 , their training is notoriously hard (Zhang et al., 2021; 2022a), yielding low standard accuracies of, e.g., only 60 . 6% compared to 79 .
52% for CIFAR-10 at (cid:15) = 2 / 255 .
Further robustness can only be obtained against one perturbation type at a time.
5. A BLATION S TUDIES
Certiﬁcation Method and Size of Training Regions To analyze the interaction between the precision of the certiﬁcation method and the size of the propagation region, we train a range of models with subselection ratios λ varying from 0 . 0125 to 1 . 0 and analyze them with veriﬁcation methods of increasing precision (B OX , D EEP P OLY , MN-B A B).
Further, we compute adversarial accuracies using a 50-step PGD attack (Madry et al., 2018) with 5 random restarts and the targeted logit margin loss (Carlini & Wagner, 2017).
We illustrate results in Fig.
7 and observe that standard and adversarial accuracies increase with decreasing λ , as regularization decreases.
For λ = 1 , i.e., IBP training, we observe little difference between the veriﬁcation methods.
However, as we decrease λ , the B OX veriﬁed accuracy decreases quickly, despite B OX relaxations being used during training.
In contrast, using the most precise method, MN-B A B, we initially observe increasing certiﬁed accuracies, as the reduced regularization yields more accurate networks, before the level of regularization becomes insufﬁcient for certiﬁcation.
While D EEP P OLY loses precision less quickly than
B OX , it can not beneﬁt from more accurate networks.
This indicates that the increased accuracy, enabled by the reduced regularization, may rely on complex neuron interactions, only captured by
MN-B A B.
These trends hold across perturbation magnitudes (Figs.
7a and 7b)
and become even more pronounced for narrower networks (Fig. 7c), which are more easily over-regularized.
This qualitatively different behavior depending on the precision of the certiﬁcation method highlights the importance of recent advances in neural network veriﬁcation for certiﬁed training.
Even more importantly, these results clearly show that provably robust networks do not necessarily require the level of regularization introduced by IBP training.
[Figure]
Loss Analysis In Fig.
8, we compare the robust loss of an SABR and an IBP trained network across different propagation region sizes (all centred around the original sample) depending on the bound propagation method used.
We ﬁrst observe that, when propagating the full input region ( λ = 1 ), the SABR trained network yields a much higher robust loss than the IBP trained one.
However, when comparing the respective training subselection ratios, λ = 0 .
05 for SABR and λ = 1 .
for IBP, SABR yields signiﬁcantly smaller training losses.
Even more importantly, the difference between robust and standard loss is signiﬁcantly lower, which, recalling §4, directly corresponds to a reduced regularization for robustness and allows the
SABR trained network to reach a much lower standard loss.
Finally, we observe the losses to clearly grow super-linearly with increasing propagation region sizes (note the logarithmic scaling of the y-axis) when using the B OX relaxation, agreeing well with our theoretical results in §4.
While the more precise D EEP P OLY (DP) bounds yield signiﬁcantly reduced robust losses for the SABR trained network, the IBP trained network does not beneﬁt at all, again highlighting its over-regularization.
See App.
C for extended results.
[Table] [Table]
[Table] [Table]
[Table]
Gradient Alignment To analyze whether SABR training is actually more aligned with standard accuracy and empirical robustness, as indicated by our theory in §4, we conduct the following experiment for
CIFAR-10 and (cid:15) = 2 / 255 : We train one network using SABR with λ = 0 .
05 and one with IBP, corresponding to λ = 1 . 0 .
For both, we now compute the gradients ∇ θ of their respective robust training losses
L rob and the cross-entropy loss L CE applied to unperturbed (Std.) and adversarial (Adv.)
samples.
We then report the mean cosine similarity between these gradients across the whole test set in Table 3.
We clearly observe that the SABR loss is much better aligned with both the crossentropy loss of unperturbed and adversarial samples, corresponding to standard accuracy and empirical robustness, respectively.
[Table]
ReLU Activation States
The portion of ReLU activations which are (stably) active, inactive, or unstable has been identiﬁed as an important characteristic of certiﬁably trained networks (Shi et al., 2021).
We evaluate these metrics for IBP, SABR, and adversarially (PGD) trained networks on CIFAR-10 at (cid:15) = 2 / 255 , using the
B OX relaxation to compute intermediate bounds, and report the average over all layers and test set samples in
Table 4.
We observe that, when evaluated on concrete points, the SABR trained network has around 37% more active ReLUs than the IBP trained one and almost as many as the PGD trained one, indicating a signiﬁcantly smaller level of regularization.
While the SABR trained network has around 3 -times as many unstable ReLUs as the IBP trained network, when evaluated on the whole input region, it has 20 -times fewer than the PGD trained one, highlighting the improved certiﬁability.
R ELATED W ORK
Veriﬁcation Methods Deterministic veriﬁcation methods analyse a given network by using abstract interpretation (Gehr et al., 2018; Singh et al., 2018; 2019a), or translating the veriﬁcation into an optimization problem which they then solve using linear programming (LP) (Palma et al., 2021;
Müller et al., 2022; Wang et al., 2021; Zhang et al., 2022b), mixed integer linear programming (MILP) (Tjeng et al., 2019; Singh et al., 2019b), or semideﬁnite programming (SDP) (Raghunathan et al., 2018; Dathathri et al., 2020).
However, as neural network veriﬁcation is generally
NP-complete (Katz et al., 2017), many of these methods trade precision for scalability, yielding socalled incomplete certiﬁcation methods, which might fail to prove robustness even when it holds.
In this work, we analyze our SABR trained networks with deterministic methods.
Certiﬁed Training
D IFF AI (Mirman et al., 2018) and IBP (Gowal et al., 2018b) minimize a sound over-approximation of the worst-case loss computed using the B OX relaxation.
Wong et al.
(2018) instead use the D EEP Z relaxation (Singh et al., 2018), approximated using Cauchy random matrices.
Wong & Kolter (2018) compute worst-case losses by back-substituting linear bounds using ﬁxed relaxations.
CROWN-IBP (Zhang et al., 2020) uses a similar back-substitution approach but leverages minimal area relaxations introduced by Zhang et al.
(2018) and Singh et al.
(2019a) to bound the worst-case loss while computing intermediate bounds using the less precise but much faster B OX relaxation.
Shi et al.
(2021) show that they can obtain the same accuracies with much shorter training schedules by combining IBP training with a special initialization.
COLT (Balunovic & Vechev, 2020) combines propagation using the D EEP Z relaxation with adversarial search.
IBP-R (Palma et al., 2022) combines adversarial training with much larger perturbation radii and a ReLUstability regularization based on the B OX relaxation.
We compare favorably to all (recent) methods above in our experimental evaluation (see §5).
The idea of propagating subsets of the adversarial input region has been explored in the settings of adversarial patches (Chiang et al., 2020) and geometric perturbations (Balunovic et al., 2019), where the number of subsets required to cover the whole region is linear or constant in the input dimensionality.
However, these methods are not applicable to the (cid:96) p -perturbation setting, we consider, where this scaling is exponential.
Robustness by Construction Li et al.
, Lécuyer et al.
(2019), and Cohen et al.
(2019) construct locally Lipschitz classiﬁers by introducing randomness into the inference process, allowing them to derive probabilistic robustness guarantees.
Extended in a variety of ways (Salman et al., 2019; Yang et al., 2020), these methods can obtain strong robustness guarantees with high probability (Salman et al., 2019) at the cost of signiﬁcantly (100x) increased runtime during inference.
We focus our comparison on deterministic methods.
Zhang et al.
(2021) propose a novel architecture based on so-called (cid:96) ∞ -distance neurons, which inherently exhibit (cid:96) ∞ -Lipschitzness properties, allowing them to efﬁciently derive corresponding robustness guarantees.
Zhang et al.
(2022a) build on this work by improving the challenging training process.
C ONCLUSION
We introduced a novel certiﬁed training method called SABR ( S mall A dversarial B ounding
R egions) based on the key insight, that propagating small but carefully selected subsets of the input region combines small approximation errors and thus regularization with well-behaved optimization problems.
This allows SABR trained networks to outperform all existing certiﬁed training methods on all commonly used benchmarks in terms of both standard and certiﬁed accuracy.
Even more importantly, SABR lays the foundation for a new class of certiﬁed training methods promising to alleviate the robustness-accuracy trade-off and enable the training of networks that are both accurate and certiﬁably robust.
E THICS S TATEMENT
As SABR improves both certiﬁed and standard accuracy compared to existing approaches, it could help make real-world AI systems more robust to both malicious and random interference.
Thus any positive and negative societal effects these systems have could be ampliﬁed.
Further, while we achieve state-of-the-art results on all considered benchmark problems, this does not (necessarily) indicate sufﬁcient robustness for safety-critical real-world applications, but could give practitioners a false sense of security when using SABR trained models.
R EPRODUCIBILITY S TATEMENT
We publish our code, all trained models, and detailed instructions on how to reproduce our results at ANONYMIZED, providing an anonymized version to the reviewers.
Further, we provide proofs for our theoretical contributions in App.
A and a detailed description of all hyper-parameter choices as well as a discussion of the used data sets including all preprocessing steps in App. C.