L OSS L ANDSCAPE M ATTERS : T RAINING C ERTIFIABLY R OBUST M ODELS WITH F AVORABLE L OSS L ANDSCAPE
Anonymous authors
Paper under double-blind review
A BSTRACT
In this paper, we study the problem of training certiﬁably robust models.
Certiﬁable training minimizes an upper bound on the worst-case loss over the allowed perturbation, and thus the tightness of the upper bound is an important factor in building certiﬁably robust models.
However, many studies have shown that Interval Bound Propagation (IBP) training uses much looser bounds but outperforms other models that use tighter bounds.
We identify another key factor that inﬂuences the performance of certiﬁable training: smoothness of the loss landscape .
We consider linear relaxation-based methods and ﬁnd signiﬁcant differences in the loss landscape across these methods.
Based on this analysis, we propose a certiﬁable training method that utilizes a tighter upper bound and has a landscape with favorable properties.
The proposed method achieves performance comparable to state-of-the-art methods under a wide range of perturbations.
I NTRODUCTION
Despite the success of deep learning in many applications, the existence of adversarial example, an imperceptibly modiﬁed input that is designed to fool the neural network (Szegedy et al., 2013;
Biggio et al., 2013), hinders the application of deep learning to safety-critical domains.
There has been increasing interest in building a model that is robust to adversarial attacks (Goodfellow et al., 2014; Papernot et al., 2016; Kurakin et al., 2016; Madry et al., 2018; Tram ` er et al., 2017; Zhang et al., 2019a;
Xie et al., 2019).
However, most defense methods evaluate their robustness with adversarial accuracy against predeﬁned attacks such as PGD attack (Madry et al., 2018) or C&W attack (Carlini & Wagner, 2017).
Thus, these defenses can be broken by new attacks (Athalye et al., 2018).
To this end, many training methods have been proposed to build a certiﬁably robust model that can be guaranteed to be robust to adversarial perturbations (Hein & Andriushchenko, 2017; Raghunathan et al., 2018b; Wong & Kolter, 2018; Dvijotham et al., 2018; Mirman et al., 2018; Gowal et al., 2018;
Zhang et al., 2019b).
They develop an upper bound on the worst-case loss over valid adversarial perturbations and minimize it to train a certiﬁably robust model.
These certiﬁable training methods can be mainly categorized into two types: linear relaxation-based methods and bound propagation methods.
Linear relaxation-based methods use relatively tighter bounds, but are slow, hard to scale to large models, and memory-inefﬁcient (Wong & Kolter, 2018;
Wong et al., 2018; Dvijotham et al., 2018).
On the other hand, bound propagation methods, represented by Interval Bound Propagation (IBP), are fast and scalable due to the use of simple but much looser bounds (Mirman et al., 2018;
Gowal et al., 2018).
One would expect that training with tighter bounds would lead to better performance, but IBP outperforms linear relaxation-based methods in many cases, despite using much looser bounds.
These observations on the performance of certiﬁable training methods raise the following questions:
Why does training with tighter bounds not result in a better performance?
What other factors may inﬂuence the performance of certiﬁable training?
How can we improve the performance of certiﬁable training methods with tighter bounds?
In this paper, we provide empirical and theoretical analysis to answer these questions.
First, we demonstrate that IBP (Gowal et al., 2018) has a more favorable loss landscape than other linear relaxation-based methods, and thus it often leads to better performance even with much looser bounds.
To account for this difference, we present a uniﬁed view of IBP and linear relaxation-based methods and ﬁnd that the relaxed gradient approximation (which will be deﬁned in Deﬁnition 1) of each method plays a crucial role in its optimization behavior.
Based on the analysis of the loss landscape and the optimization behavior, we propose a new certiﬁable training method that has a favorable landscape with tighter bounds.
The performance of the proposed method is comparable to that of state-of-the-art methods under a wide range of perturbations.
We summarize the contributions of this study as follows:
• We provide empirical and theoretical analysis of the loss landscape of certiﬁable training methods and ﬁnd that smoothness of the loss landscape is important for building certiﬁably robust models.
• We propose a certiﬁable training method with tighter bounds and a favorable loss landscape, obtaining comparable performance with state-of-the-art methods under a wide range of perturbations.
R ELATED W ORK
Earlier studies on training certiﬁably robust models were limited to 2-layered networks (Hein &
Andriushchenko, 2017; Raghunathan et al., 2018a).
To scale to larger networks, a line of work has proposed the use of linear relaxation of nonlinear activation to formulate a robust optimization.
Then, a dual problem is considered and a dual feasible solution is used to simplify the computation further.
By doing so, Wong & Kolter (2018) built a method that can scale to a 4-layered network, and later,
Wong et al.
(2018) used Cauchy random projections to scale to much larger networks.
However, they are still slow and memory-inefﬁcient.
Dvijotham et al.
(2018) proposed a method called predictorveriﬁer training (PVT), which uses a veriﬁer network to optimize the dual solution.
This is similar to our proposed method but we do not require any additional network.
Xiao et al.
(2018) proposed to add regularization technique with adversarial training for inducing ReLU stability, but it is less effective than other certiﬁed defenses.
We also encourage our model to avoid unstable ReLUs, but we train the model with an upper bound of the worst-case loss and investigate ReLU stability from the loss landscape perspective.
Mirman et al.
(2018) proposed the propagation of a geometric bound (called domain) through the network to yield an outer approximation in logit space.
This can be done with an efﬁcient layerwise computation that exploits interval arithmetic.
Over the outer domain, one can compute the worstcase loss to be minimized during training.
Gowal et al.
(2018) used a special case of the domain propagation called Interval Bound Propagation (IBP) using the simplest domain, the interval domain (or interval bound).
In IBP, the authors introduced a different objective function, heuristic scheduling on the hyperparameters, and elision of the last layer to stabilize the training and to improve the performance.
Both approaches, linear relaxation-based methods and bound propagation methods, use an upper bound on the worst-case loss.
Bound propagation methods exploit much looser upper bounds, but they enjoy an unexpected beneﬁt in many cases: better robustness than linear relaxation-based methods.
Balunovic & Vechev (2019) hypothesized that the complexity of the loss computation makes the optimization more difﬁcult, which could be a reason why IBP outperforms linear relaxationbased methods.
They proposed a new optimization procedure with the existing linear relaxation.
In this paper, we further investigate the causes of the difﬁculties in the optimization.
Recently, Zhang et al.
(2019b) proposed CROWN-IBP which uses linear relaxation in a veriﬁcation method called
CROWN (Zhang et al., 2018) in conjunction with IBP to train a certiﬁably robust model.
Although beyond our focus here, there is another line of work on randomized smoothing (Li et al., 2018; Lecuyer et al., 2019;
Cohen et al., 2019;
Salman et al., 2019), which can probabilistically certify the robustness with arbitrarily high probability by using a smoothed classiﬁer.
However, it requires a large number of samples for inference.
There are many other works on certiﬁable veriﬁcation (Weng et al., 2018; Singh et al., 2018a; 2019; 2018b; Zhang et al., 2018;
Boopathy et al., 2019;
Lyu et al., 2020).
However, our work focuses on ”certiﬁable training”.
B ACKGROUND
First, we provide a brief overview of certiﬁable training methods.
Then, we consider IBP (Gowal et al., 2018) as a special case of linear relaxation-based methods.
This uniﬁed view on certiﬁable training methods helps us to comprehensively analyze the differences between the two approaches: bound propagation and linear relaxation.
We present the details of the IBP in Appendix B.
3. N OTATIONS AND C ERTIFIABLE T RAINING
We consider a c -class classiﬁcation problem with a neural network f ( x ; θ ) with the layerwise operations z ( k )
=
h ( k ) ( z ( k − 1) )
( k = 1 , · · · , K ) and the input z (0) =
x in the input space X .
The corresponding probability function is denoted by p f = softmax ◦ f : X → [0 , 1] c with subscript f .
We denote a subnetwork with k operations as h [ k ] = h ( k ) ◦· · ·◦ h (1) .
For a linear operation h ( k ) , we use
W ( k ) and b ( k ) to denote the weight and the bias for the layer.
We consider the robustness of the classiﬁer against the norm-bounded perturbation set B ( x , (cid:15) )
= { x
(cid:48) ∈
X : || x (cid:48) − x || ≤ (cid:15) } with the pertur- bation level (cid:15) .
Here, we mainly focus on the (cid:96) ∞ -norm bounded set.
To compute the margin between the true class y for the input x and the other classes, we deﬁne a c × c matrix C ( y )
=
I − 1 e ( y ) T with ( C ( y )
z
( K ) ) m
=
z ( K ) m
− z ( K ) y
( m = 0 , · · · , c − 1 ).
For the last linear layer, the weights W ( K ) and the bias b ( K ) are merged with C ( y ) , that is, W ( K ) ≡ C ( y ) W ( K ) and b ( K ) ≡ C ( y ) b
( K ) , yielding the margin score function s ( x , y ; θ ) =
C ( y ) f
( x ; θ ) =
f
( x ; θ ) − f y ( x ; θ ) 1 satisfying p s = p f .
Then we can deﬁne the worst-case margin score s ∗ ( x , y, (cid:15) ; θ ) =
max x (cid:48) ∈ B ( x ,(cid:15) ) s ( x (cid:48) , y ; θ ) where max is element-wise maximization.
With an upper bound s on the worst-case margin score, s ≥ s ∗ , we can provide an upper bound on the worst-case loss over valid adversarial perturbations as follows:
[Equation]
for cross-entropy loss L (Wong & Kolter, 2018).
Therefore, we can formulate certiﬁable training as a minimization of the upper bound, min θ L ( s ( x , y, (cid:15) ; θ ) , y ) , instead of directly solving min θ max x (cid:48)
∈ B ( x ,(cid:15) )
L ( f ( x (cid:48) ; θ ) , y ) which is infeasible.
Note that adversarial training (Madry et al., 2018) uses a strong iterative gradient-based attack (PGD) to provide a lower bound on the worst-case loss to be minimized, but it cannot provide a certiﬁably robust model.
Whenever possible, we will simplify the notations by omitting variables such as x , y, (cid:15), and θ .
3. L INEAR R ELAXATION - BASED M ETHODS
For a subnetwork h [ k ] , given with the pre-activation upper/lower bounds, u and l , for each nonlinear activation function h in h [ k ] , linear relaxation-based methods (Wong & Kolter (2018)
; Wong et al.
; Zhang et al.
(2019b)) use a relaxation of the activation function by two elementwise linear function bounds, h and h , that is, h ( z ) ≤ h ( z ) ≤ h ( z ) for l ≤ z ≤ u .
We denote the function bounds as h ( z )
= a (cid:12) z
+ b and h ( z ) = a (cid:12) z
+ b for some a , b , a , and b , where (cid:12) denotes the elementwise (Hadamard) product.
Using all the function bounds h ’s
and h ’s for the nonlinear activations in conjunction with the linear operations in h [ k ] , an i th (scalar) activation h
[ k ] i ( · ) ∈ R can be upper bounded by a linear function g T · + b over B ( x , (cid:15) ) as in Zhang et al.
This can be equivalently explained with the dual relaxation viewpoint in Wong & Kolter (2018).
Further details are provided in Appendix C. Now we are ready to upper bound the activation
h [ k ] i over B ( x , (cid:15) ) .
Deﬁnition 1 (Linear Relaxation with Relaxed Gradient Approximation) .
For each neuron activation h [ k ] i , a linear relaxation method computes an upper approximation of the activation over B ( x , (cid:15) ) by using g ∈ R d and b ∈ R as follows:
[Equation]
We call g the relaxed gradient approximation of h [ k ] i over B ( x , (cid:15) ) .
Similarly, we can obtain the corresponding lower bound.
Inductively using these upper/lower bounds on the output of the subnetwork, we can obtain the bounds for the next subnetwork h
[ k +1]
and then for the whole network s .
The ﬁnal bound s on the whole network s can then be used in the objective
Uniﬁed view of IBP and linear relaxation-based methods IBP can also be considered as a linear relaxation-based method using zero-slope ( a = a = 0 ) linear bounds, h ( z )
= u + and h ( z )
=
l + , where v + = max( v , 0 ) and v − = min( v , 0 ) .
Thus, the bounds of a nonlinear activation depend only on the pre-activation bounds u and l for the activation layer, substantially reducing the feedforward/backpropagation computations.
CROWN-IBP (Zhang et al., 2019b) applies different linear relaxation schemes to the subnetworks and the whole network.
It uses the same linear bounds as
IBP for the subnetworks h
[ k ] for k < K except for the network s = h
[ K ] itself, and uses h ( z ) = u + u + − l − (cid:12) ( z − l − ) and h ( z ) =
1 [ u + + l − > 0] (cid:12) z for the whole network s .
Moreover, CROWNIBP uses interpolations between two bounds with the mixing weight β , IBP bound and CROWN-IBP bound, with the following objective:
[Equation]
Convex Adversarial Polytope (CAP) (Wong & Kolter, 2018;
Wong et al., 2018) uses the linear bounds h ( z )
=
u + u + −
[Equation]
− (cid:12) ( z − l
[Equation]
and h ( z ) =
u + u + − l − (cid:12) z for all subnetworks h
[ k ] and the entire network.
As CAP utilizes the linear bounds for each neuron, it is slow and memory-inefﬁcient.
It can be easily shown that tighter relaxations on nonlinear activations yield a tighter bound on the worstcase margin score s ∗ .
To specify the linear relaxation variable φ ≡ { a , a , b , b } used in relaxation, we use the notation s ( x , y, (cid:15) ; θ , φ ) .
CROWN-IBP and CAP generally yield a much tighter bound than IBP.
These relaxation schemes are illustrated in Figure 6 in Appendix D.
W HAT FACTORS INFLUENCE THE PERFORMANCE OF CERTIFIABLE TRAINING ?
One would expect that a tighter upper bound on the worst-case loss in (1) is beneﬁcial in certiﬁable training.
However, several previous works have shown that this is not the case: IBP performs better than linear relaxation-based methods in many cases while utilizing a much looser bound.
We investigate the loss landscape and the optimization behavior of IBP and other linear relaxation-based methods, and ﬁnd that the non-smoothness of the relaxed gradient approximation of linear relaxations negatively affects their performance.
Detailed settings of the following analyses are presented in Appendix A.
4. L OSS L ANDSCAPE OF C ERTIFIABLE T RAINING
[Figure]
IBP, achieving the best performance among these four methods (see Table 1).
We empirically show that models that have tighter bounds, CROWN-IBP (Zhang et al., 2019b) and
CAP (Wong & Kolter, 2018), tend to have non-smooth loss landscapes, which hinder optimization during training.
We examine the learning curves of IBP and these linear relaxation-based methods.
For a simple analysis, we avoid considering the mixture of the two logits in (3), and use β =to consider CROWN-IBP logit only.
Figure 1 (left) shows the learning curves on CIFAR-10 under (cid:15) train = 8 / 255 .
We use (cid:15) -scheduling with the warm-up (regular training) for the ﬁrst 10 epochs and the ramp-up during epochs 10-130 where we linearly increases the perturbation radius from 0 to the target perturbation (cid:15) train .
Thus, the training loss may increase even during learning.
In the early phase of the ramp-up period, in which the models are trained with small (cid:15) , CAP and
CROWN-IBP have lower losses than IBP as expected because they use much tighter relaxation bounds than IBP.
In particular, CAP has much tighter bounds than the others because CAP uses tighter relaxations for each subnetwork.
This is consistent with the known results, that CAP tends to outperform the others at small perturbations, such as (cid:15) train = 2 / 255 on CIFAR-10 (see Table 1 for details).
However, at the end of the training, when the perturbation reaches its maximum target value ( (cid:15) train ), the opposite result is observed where CAP and CROWN-IBP perform worse than IBP.
To understand this inconsistency, we measure the variation of the loss along the gradient direction as in Santurkar et al.
(2018), which is represented as the shaded region in Figure 1 (left).
We ﬁnd that linear relaxation-based methods have large variations, while IBP maintains a small variation throughout the entire training phase.
It is known that a smooth loss landscape with a small loss variation induces stable and fast optimization with well-behaved gradients (Santurkar et al., 2018).
Therefore, even though CAP and CROWN-IBP show robustness in the early phase of training, the non-smooth loss landscape in the ramp-up period might have hindered the optimization, yielding less robust models.
As will be discussed in the following section, we ﬁnd that the loss variation is highly related to the relaxed gradient approximation g used in linear relaxation.
We further explore the loss landscape near the local region of the parameter space at the current parameter θ ( now ) toward the next parameter θ ( next ) along the gradient in Figure 1 (right).
We plot the landscapes for the later phase of the ramp-up period (epochs 50-130) during which large perturbations are used.
IBP has ﬂatter landscapes compared to the others, whereas CROWN-IBP has landscapes with large curvature along the gradient, and thus it tends to move towards a sharp local minimum and it may remain stuck there.
Therefore, it may overﬁt to be robust to small perturbations, but is not robust to the target perturbation (cid:15) train .
[Figure]
Next, we establish a relationship between the optimization procedure and linear relaxation.
Figure 2 (top) shows the directional deviation between two successive loss gradient steps in terms of cosine similarity during training.
Simultaneously, Figure 2 (bottom) shows the ratio of the number of unstable ReLUs for which the pre-activation bounds l and u span zero.
We observe that the cosine similarity value is low when the number of unstable ReLUs is large - for example, in the early stage of CAP and the middle stage of CROWN-IBP.
In particular, in the middle of the ramp-up period,
CROWN-IBP has a large number of unstable ReLUs and exhibits abrupt changes in gradient steps.
It often has deviation angles larger than 90 ◦ , leading to parameter updates in the opposite direction of the previous one, bouncing in the basin of a local minimum.
This is consistent with the results shown in Figure 1.
Moreover, since the gradient directions are not well-aligned, it may not enjoy the advantages of momentum-based optimizers and be sensitive to the learning rate.
To summarize, a large number of unstable ReLUs, high nonlinearity, leads to an unfavorable landscape that can negatively affect the optimization process.
4. S MOOTHNESS OF R ELAXED G RADIENT APPROXIMATION
In this section, we investigate the loss landscape further from a theoretical perspective to answer the question: ”What makes some landscapes more favorable than others?”
We ﬁnd that the relaxed gradient approximation of a linear relaxation affects the smoothness of the landscape.
First, we need some mild smoothness assumptions that are natural when the network parameters θ 1 and θ 2 are close to each other, especially they are two consecutive parameters from SGD update.
Assumption 1.
Given linear relaxation method, we make the following assumptions on the bias b ( x ; θ ) in the linear relaxation and the probability function p ( x ; θ ) :
(1) ||∇ θ b ( x ; θ 1 ) − ∇ θ b ( x ; θ 2 ) ||
≤ L b θθ || θ 1 − θ 2 || for all θ 1 , θ 2 and x . (2) || p ( x ; θ 1 ) − p ( x ; θ 1 ) || ≤
L pθ ||
θ 1 − θ 2 || for all θ 1 , θ 2 and x .
With the above assumptions, we can provide an upper bound on the loss gradient difference for linear relaxation-based methods to measure the non-smoothness of the loss landscape as follows:
Theorem 1.
Given input x ∈ X and perturbation radius (cid:15) , let M be max x (cid:48)
∈ B ( x ,(cid:15) )
||
x (cid:48)
|| .
For a linear relaxation-based method with the upper bound s m ( x ; θ ) =
max x (cid:48) ∈ B ( x ,(cid:15) )
g ( m ) ( x ; θ ) T x (cid:48)
+ b ( m ) ( x ; θ ) , if b ( m ) satisﬁes Assumption 1 (1) for each m and p s satisﬁes Assumption 1 (2), then
[Equation]
for any θ 1 , θ 2 , where L ( m ) =
L b ( m ) θθ + L p s θ ||∇ θ s ( x ; θ 1 , 2 ) ||
and θ 1 , 2 can be any of θ 1 and θ 2 .
According to Theorem 1, the relaxed gradient approximations g ( m ) in the linear relaxation play a major role in shaping the loss landscape.
The smoother the relaxed gradient approximations are, the smoother the loss landscape is.
Especially for IBP, using the zero-slope relaxed gradient approximation g ( m ) ≡ 0 for all m , the loss difference is upper bounded by only the last term, max L ( m )
||
θ 1 − θ 2 || , and it is relatively small for a single gradient step.
On the other hand, for other linear relaxation-based methods using non-zero relaxed gradient approximation g ( m ) (cid:54) = 0 , the gradient updates used in the training are more unstable than IBP.
It is consistent with the empirical results shown in Figure 1 that there are signiﬁcant differences between the loss variations of IBP and others.
P ROPOSED M ETHOD
Our analyses so far suggest that tightness of the upper bound on the worst-case loss and smoothness of the loss landscape are important for building a certiﬁably robust model.
Therefore, we aim to design a new certiﬁable training method to improve the aforementioned factors (favorable landscape and tighter bound).
More favorable landscape via less a =
We observe that CROWN-IBP ( β = 1 ) tends to have more unstable ReLU and less smooth landscape than the others.
What, in the objective of CROWNIBP, does lead to these results?
To answer this question, we investigate variants of CROWN-IBP with different a settings for unstable ReLUs.
For each setting, we sample a ∈ { 0 , 1 } with different ( p, q ) with P ( a = 1 | | l | > | u | ) =
p and P ( a = 1 | | l | ≤ | u | )
=
q for each neuron with pre- activation bounds l and u .
We use a = 1 [ u + + l − > 0 ] for the other stable ReLUs.
For the other elements of the linear relaxation variable φ = { ( a , a , b , b ) } , we ﬁx a = u + u + − l − , b = − u
+ l − u + − l − , and b =
for each activation node, because they are the optimal choices for tightening the bound (see
Appendix C.2 for details).
Figure 3 shows that it tends to have more unstable ReLUs as the number
[Figure]
of a satisfying a = 1 increases.
This observation implies that it is required to have smaller portion of a with a = 1 to have a more favorable landscape.
However, reducing the portion of a with a = 1 is not enough to achieve robustness unless the tightness is guaranteed.
Through manually adjusting the a , variants of CROWN-IBP achieve favorable landscapes, but they show looser upper bounds which lead to a worse performance.
Further investigation of variants of CROWN-IBP is presented in
Appendix E. Therefore, it is required to search for appropriate values of a that can achieve both tightness and favorable landscape.
Tighter bound via optimization Now, we aim to reduce the number of a satisfying a = 1 and to tighten the upper bound in (1), simultaneously.
We can achieve both by minimizing the upper bound over the linear relaxation variable φ as follows:
[Equation]
It can be equivalently understood as solving the dual optimization in CAP rather than using a dual feasible solution.
However, solving the dual optimization is computationally prohibited for the linear relaxation of CAP.
To resolve this problem, we use the same linear relaxation as IBP for the subnetworks of s except for s itself, similar to CROWN-IBP.
Further, we efﬁciently compute a surrogate ˆ a of the minimizer a ∗ = arg min a L ( s ( x , y, (cid:15) ; θ , φ ) , y ) using the one-step projected gradient update of the relaxation variable a .
Speciﬁcally, we have
[Equation]
) with an initial point a 0 ∼ U [0 , 1] n and η ≥ 1 , yielding the ﬁnal objective L ( s ( x , y, (cid:15) ; θ , ˆ φ ) , y ) where ˆ φ = { ( a , ˆ a , b , b ) } .
E XPERIMENTS
In this section, we demonstrate the proposed method satisﬁes two key criteria required for building certiﬁably robust models: 1) tightness of the upper bound on the worst-case loss, and 2) smoothness of the loss landscape.
Subsequently, we evaluate the performance of the method by comparing it with others certiﬁable training methods.
Details on the experimental settings are in Appendix A.
Tightness To validate that the proposed method (OURS) has tighter bounds than other relaxations, we analyze various linear relaxation methods in Figure 4.
We deﬁne a tightness measure as a sum over the worst-case margin for each class m , (cid:80) c − 1 m =
s m ( x , y, (cid:15) ; θ ) , obtained from (2).
Then, we evaluate multiple methods on a single ﬁxed model pre-trained with the proposed training method.
The compared methods are, from left to right, OURS, CROWN-IBP (Zhang et al., 2019b), CAPIBP, and RANDOM.
All methods use the same IBP relaxation for subnetworks, but use different linear relaxation variables a for the whole network s .
CROWN-IBP, CAP-IBP, and RANDOM use a = 1 [ u + + l − > 0] , a = u + u + − l − and a ∼ U [0 , 1] n , respectively.
We ﬁx the other variables a , b , and b , as in Section 5.
In both ﬁgures, our method shows the lowest value on average, which indicates that a single gradient step in (6) is sufﬁcient to obtain tighter bounds compared to other relaxation methods.
See Appendix P for the equivalent tightness violin plots of other models.
[Figure]
[Figure]
Smoothness Figure 1 shows that the proposed method has small loss variations along the gradient as with IBP, whereas CROWN-IBP ( β = 1 ) has a wide range of loss values.
This is because
CROWN-IBP ( β = 1 ) has more unstable ReLUs than our methods as shown in Figure 2.
As mentioned above, number of a is closely related to the amount of unstable ReLUs
[Figure]
and Figure 5 shows that our method has successfully reduced the number of a = 1 .
Further, we conduct analysis on smoothness of the loss landscape with the loss gradient change (the left term in (4)) in Appendix H.
Robustness We evaluate the performance of the proposed method and compare it to that of stateof-the-art certiﬁable training methods: IBP (Gowal et al., 2018), CROWN-IBP ( β = 1) (Zhang et al., 2019b), and CAP (Wong et al., 2018), as in Section 4.1.
On MNIST, we follow Zhang et al.
(2019b) and use (cid:15) train ≥ (cid:15) test ; whereas for CAP, we use the same (cid:15) train = (cid:15) test which yields better results.
We used three evaluation metrics: standard (clean) error, 100-step PGD error, and veriﬁed error.
For the veriﬁed error, we evaluated with the bound s of each method.
Table 1 summarizes the evaluation results under different (cid:15) test for each dataset.
In general, when (cid:15) test is low, methods with tighter linear relaxations show good performance, whereas IBP tends to perform better as (cid:15) test increases.
In short, the state-of-the-art methods perform well for a speciﬁc range of (cid:15) test .
For example, IBP show relatively better performance in the case of (cid:15) test = 0 .
3 , 0 .on
MNIST and (cid:15) test = 6 / 255 , 8 / 255 , 16 / 255 on CIFAR-10.
On the other hand, CAP and CROWN-IBP ( β = 1 ) outperform IBP in the case of (cid:15) test = 0 .
1 on MNIST, (cid:15) test = 2 / 255 on CIFAR-10 and (cid:15) test = 0 .
001 on SVHN.
This result is consistent with the analysis shown in Figure 1 that CAP and
CROWN-IBP ( β = 1 ) have lower loss than IBP at small (cid:15) , but their loss landscape is less smooth than IBP, leading to worse performance at large (cid:15) .
Moreover, CAP cannot be trained on MNIST when (cid:15) train = 0 .
As the case is also not speciﬁed in Wong et al.
, it seems that CAP is hard to be robust to (cid:15) train ≥ 0 .
On the other hand, the proposed method shows consistent performance in a wide range of (cid:15) test values, achieving the best performance in most cases, since it has tighter bounds and a favorable landscape, not overﬁtting to a local minimum during the (cid:15) -scheduling.
We also compared our method with other prior work (Xiao et al., 2018; Mirman et al., 2018; Balunovic & Vechev, 2019) in Appendix K. We also conduct additional experiments on the hyperparameters in Appendix L, M, and N.
[Table]
Unlike standard training, certiﬁable training requires (cid:15) -scheduling.
It is implicitly assumed that a set of weights that makes the network robust to a small (cid:15) is a good initial point to learn robustness to a large (cid:15) train .
However, linear relaxation-based methods with tighter bounds start with a lower loss at a small (cid:15) , but with an unfavorable loss landscape, they cannot explore a sufﬁciently large area of the parameter space.
Hence, they overﬁt to be robust to a small perturbation, and not generalize to a large perturbation.
CAP and CROWN-IBP ( β = 1 ) are typical examples that demonstrate the overﬁtting.
This may overegularize the weight norm and decrease the model capacity (Wong et al., 2018; Zhang et al., 2019b).
On the other hand, with a favorable landscape, the proposed method can achieve robustness at large (cid:15) .
[Table] [Table]
Understanding β -scheduling
For CROWN-IBP, we use two different settings of β in (7),
CROWN-IBP 1 → 1 and CROWN-IBP 1 → 0 , where the subscript β start → β end refers to the linear scheduling on β from β start to β end .
Zhang et al.
(2019b) found that the β -scheduling of CROWNIBP 1 → 0 could help to improve the robustness performance.
And they argued that this is because training with a tighter bound of CROWN-IBP at the beginning can provide a good initialization for later IBP training.
On the other hand, we provide another explanation that CROWN-IBP 1 → 0 starts with a tighter bound (CROWN-IBP only) but not overﬁts to small perturbation by gradually introducing the IBP objective which has a smoother landscape.
Despite using a single objective without the mixture parameter β , the proposed method can outperforms CROWN-IBP 1 → 0 on CIFAR-10 as shown in Table 2.
C ONCLUSION
In this work, we have investigated the loss landscape of certiﬁable training and found that the smoothness of the loss landscape is an important factor that inﬂuences in building certiﬁably robust models.
To this end, we proposed a method that satisﬁes the two criteria: tightness of the upper bound on the worst-case loss and smoothness of the loss landscape.
Then, we empirically demonstrated that the proposed method achieves robustness comparable to state-of-the-art methods under a wide range of perturbations.
We believe that with an improved understanding of the loss landscape, better certiﬁably robust models can be built.
A E XPERIMENTAL S ETTINGS
Datasets and Architectures In the experiments, we use three datasets: MNIST, CIFAR-10 and
SVHN and model architectures ( Small , Medium , and Large ) in Gowal et al.
and their variants ( Small* and Large* ) as follows:
• Small : Conv( · ,16,4,2) - Conv(16,32,4,1) - Flatten - FC( · ,100) - FC(100,c) •
Small* : Conv( · ,16,4,2) - Conv(16,32,4,2) - Flatten - FC( · ,100) - FC(100,c) • Medium : Conv( · ,32,3,1) - Conv(32,32,4,2) - Conv(32,64,3,1) - Conv(64,64,4,2) - FlattenFC( · ,512) - FC(512,512) - FC(512,c)
Large : Conv( · ,64,3,1) - Conv(64,64,3,1) - Conv(64,128,3,2) - Conv(128,128,3,1) - Conv(128,128,3,1) -
Flatten - FC( · ,512) - FC(512,c) •
Large* : Conv( · ,64,3,1) - Conv(64,128,3,2) - Conv(128,128,3,1) - Conv(128,128,3,1) - Flatten - FC( · ,512) - FC(512,c)
where Conv( c 1 , c 2 , k, s ) is a conv layer with input channel c 1 , output channel c 2 , kerner size k , and stride s , and FC( d 1 , d 2 ) is a fully-connected layer with input dimension d 1 and output dimension d 2 .
All layers are followed by ReLU activation except for the last layer and the ﬂatten layer (Flatten).
Loss and training schedules For general training schedules, we refer to Appendix C, D of Zhang et al.
(2019b) with a single GPU (Titan Xp).
We use the following mixed cross-entropy loss as in
Zhang et al.
(2019b):
[Equation]
where κ is the mixing weight between the natural loss and the robust loss, and β is the mixing weight between the two bounds obtained with IBP and given relaxation method (e.g. CROWN-IBP).
A. S ETTINGS IN S ECTION 4.
Figure 1 We conduct the experiment in Figure 1 on CIFAR-10 dataset with Medium architecture over all four methods.
We train the model with (cid:15) train = 8 / 255 for 200 epochs using (cid:15) -scheduling with 10 warm-up epochs and 120 ramp-up epochs.
We use Adam optimizer with learning rate 0.001.
We reduce the learning rate by 50% every 10 epochs after (cid:15) -scheduling ends.
To demonstrate the instability of each training, we describe the variation of the loss along the gradient direction as Santurkar et al.
We take steps of different lengths in the direction of the gradient and measure the loss values obtained at each step.
For the sake of consistency, we ﬁx a
Cauchy random matrix when evaluating CAP to obtain deterministic loss landscapes, not introducing randomness.
The loss variation is computed with
[Equation]
where L ( s ( θ
[Equation]
s
[Equation] [Equation]
[Equation] [Equation]
and
[Equation] [Equation]
where θ 0 (= θ (0)) is the current model parameters and η is the learning rate.
For the step of length t , we sample ten points from a range of [0,5] on a log scale.
In Figure 1 (right), θ ( now )
= θ (0) and θ ( next )
=
θ (1) .
Figure 2 (top)
In Figure 2, with the same model used in Figure 1, we plot cosine similarity between two successive loss gradient steps during training as follows:
[Equation]
where cos ( v 1 , v 2 ) is the cosine value of the angle between two vectors v 1 and v 2 .
A. S ETTINGS IN T ABLE
For MNIST, we use the same hyper-parameters as in Appendix C of Zhang et al.
(2019b).
We train for 200 epochs (10 warm-up epochs and 50 ramp-up epochs) on Large model with batch sizes of 100.
we decay the learning rate, 0.0005, by 10% in [130,190] epochs.
As mentioned in Zhang et al.
(2019b), we also found the same issue when training with small (cid:15) (see Appendix N for details).
To alleviate the issue, we use (cid:15) train = min(0 .
4 , (cid:15) test + 0 . 1) for each (cid:15) test as Table 2 of Zhang et al.
(2019b).
For CIFAR-10, we train for 400 epochs (20 warm-up epochs and 240 ramp-up epochs) on Medium model with batch sizes of 128.
We decay the learning rate, 0.003, by 2 × every 10 epochs after the ramp-up period.
For SVHN, we train for 200 epochs (10 warm-up epochs and 120 ramp-up epochs) on Large model with batch sizes of 128 (OURS with batch sizes of 80 to avoid out of memory).
We decay the learning rate, 0.0003, by 2 × every 10 epochs after the ramp-up period.
Only for SVHN, we apply normalization with mean (0.438, 0.444, 0.473) and standard deviation (0.198, 0.201, 0.197) for each channel.
In Table 1, we use κ -scheduling from 1 to 0.
For the corresponding results of κ -scheduling fromto 0, we refer the reader to Table 5.
We modify the source code for CAP 1 to match our settings.
For example, we introduce the warmup period and linear (cid:15) -scheduling.
We avoid using the reported results in the literature and aim to make a fair comparison under the same settings with only minor differences - for example, because
CAP does not support the channel-wise normalization, we could not use the input normalization.
Also, due to the memory limit of CAP, we use a smaller batch size of 32 and try other smaller architectures.
We found that it often achieves better results with smaller architectures (similar to the results in Table 3 of Wong et al.
Thus, we present the performance with Large* , Medium , and Small* on MNIST, CIFAR-10, and SVHN, respectively.
Throughout the experiments, CAP uses the ﬁxed κ = 0 .
B I NTERVAL B OUND P ROPAGATION (IBP)
IBP (Gowal et al., 2018) starts from the interval bound I (0) ≡ { z : l (0)
≤ z ≤ u (0) } =
B ( x , (cid:15) ) in the input space with the upper bound u (0) =
x + (cid:15) 1 and the lower bound l (0) =
x − (cid:15) 1 where 1 is a column vector ﬁlled with 1.
Then we propagate the interval bound I ( k − 1) ≡ { z : l ( k − 1)
≤ z ≤ u ( k − 1) } by using following equations iteratively:
[Equation]
(9) for element-wise monotonic increasing nonlinear activation h ( k ) with the pre-activation bounds u ( k − 1) and l ( k − 1) , and
[Equation]
(cid:19)
+ b ( k ) and (10)
[Equation]
(cid:19)
[Equation]
(cid:18)
[Equation]
−
[Equation] [Equation]
(cid:19)
+ b (
[Equation]
(11) for linear function h ( k ) ( k = 1 , · · · , K ).
Finally, IBP uses the worst-case margin s = u ( K ) to formulate the objective in (1) for certiﬁable training.
C D ETAILS ON L INEAR R ELAXATION C. L INEAR RELAXATION EXPLAINED IN CROWN (Z HANG ET AL ., 2018)
To make the paper self-contained, we provide details of linear relaxation given in the supplementary material of CROWN (Zhang et al., 2018).
We refer readers to the supplementary for more details.
Given a network h
[ k ] , we want to upper bound the activation
h [ k ] i .
We have h [ k ] i ( x (cid:48) )
=
W ( k ) i, : h ( k − 1)
( h [ k − 2] ( x (cid:48) ))
+ b ( k ) i
= W ( k ) i, : h ( k − 1)
( z ( k − 2) (cid:48) )
+ b ( k ) i where z ( k − 2) (cid:48)
=
h [ k − 2] ( x (cid:48) ) .
With the linear function bounds of h ( k − 1) and h ( k − 1) on the activation function h ( k − 1) , we have
[Equation]
[Equation]
where ˜ W ( k ) i, : = W ( k ) i, : D ( k − 1) with the diagonal matrix D ( k − 1) j,j = a ( k − 1) j for j satisfying
W ( k ) i,j < 0 and D ( k − 1) j,j = a ( k − 1) j for j satisfying W ( k ) i
[Equation] [Equation]
(cid:80) W ( k ) i,j ≥
[Equation]
) i,j b
[Equation] [Equation]
i
[Equation]
( k
[Equation]
and ˆ b ( k −
[Equation]
i
[Equation]
Ap
[Equation]
plying similar method iteratively, we can obtain g and b in (2) for the linear relaxation of h [ k ] i .
C. D UAL O PTIMIZATION V IEW
We ﬁrst modify some notations in the main paper and use the notations similar to Wong & Kolter (2018).
We use the following hat notations: ˆ z ( k +1)
=
W ( k +1)
z ( k )
+ b ( k +1) and z ( k )
=
h ( k ) (ˆ z ( k ) ) where h ( k ) is the k -th nonlinear activation function.
We can build a primal problem with c T = C m, : as follows:
[Equation]
such that
[Equation]
Note that our c is negation of that of Wong & Kolter (2018).
Now we can derive the dual of the primal (12) as follows:
[Equation]
It leads to c + ν K = 0 , ξ + − ξ − − W (1) T ν 1 = 0 , and − W ( k +1)
T ν k +
+ˆ ν k
=
( k = 1 , · · · , K − 1) .
Alternatively, they are represented as follows:
[Equation]
Now we need relationship between ˆ ν k and ν k , i.e., ν k
= g
(ˆ ν k ) .
With the further relaxation ν k = α k (cid:12) ˆ ν k , we have a relaxed problem as follows:
[Equation]
such that
[Equation]
We decompose the ﬁrst term in (14), and ignore the subscript k as follows ˆ ν T h (ˆ z ) − ( α (cid:12) ˆ ν ) T ˆ z .
Further, we decompose this for each element, ˆ νh (ˆ z ) − α ˆ
ν ˆ z
= ˆ ν ( h (ˆ z ) − α ˆ z ) .
If the pre-activation bounds for h are both positive (active ReLU), then α should be 1 not to make the inner supremum ∞ .
Similarly, if the pre-activation bounds for h are both negative (dead ReLU), then α should be 0.
In the case of unstable ReLU ( l ≤ 0 ≤ u ), if ˆ ν < 0 , then we need to solve max α inf
ˆ z h
(ˆ z ) − α ˆ z .
The inner inﬁmum is 0 for 0 ≤ α ≤ 1 , and is −∞ otherwise.
On the other hand, if ˆ ν ≥ 0 , then we need to solve min α sup ˆ z h
(ˆ z ) − α ˆ z .
The inner supremum is max { u − αu, − αl } , and thus the optimal dual variable is α ∗ = uu − l which yields the optimal value (multiplied by ˆ ν ) as ˆ ν ( u − uu − l u ) =
− ulu − l ˆ ν which is equivalent to using linear relaxation with a (cid:12) z
+ b = uu − l (cid:12) ( z − l ) .
We can represent it as a (cid:12) z
+ b = u + u + − l − (cid:12) ( z − l − ) to include the case of active/dead ReLU.
For the lower linear bound h ( z ) =
a (cid:12) z
+ b in case of unstable ReLU, we can use any 0 ≤ a ≤ 1 and b =
according to the dual relaxation with α .
While CAP and CROWN-IBP use a dual feasible solution like α
= u + u + − l − or α = 1 [ u + + l − > 0] , our proposed method aims to optimize over the dual variable α or equivalently optimize over 0 ≤ a ≤ 1 to further tighten the upper bound on the loss.
D I LLUSTRATION OF L INEAR R ELAXATIONS
Figure 6 provides some illustrations of linear relaxations used in IBP, CAP, CROWN-IBP
[Figure]
and the proposed method.
CROWN-IBP adaptively chooses the relaxation variable so that the area between h and h is minimized.
However, the smaller area does not necessarily imply the tighter bound
[Figure]
and the proposed method achieves tighter bounds than CROWN-IBP relaxation as shown in Figure
[Figure]
E L EARNING CURVES FOR VARIANTS OF CROWN-IBP
It seems that a certiﬁable training with a looser bound tends to favor stable ReLUs.
For example, IBP starts with small number of unstable ReLUs while CAP starts with large number of ReLUs as shown in Figure 2 (bottom).
However, a tighter bound does not directly lead to many unstable ReLUs.
We ﬁnd that 0 .
5 / 1 and 1 / 1 have looser bounds than CROWN-IBP (as shown in Figure 7) but they have more unstable ReLUs (as shown in Figure 3) where p/q denotes the variant with sampling a ∈ { 0 , 1 } with P ( a = 1 | | l | > | u | ) = p and P ( a = 1 | | l | ≤ | u | ) =
q for unstable ReLUs.
On the other hand, 0 / 0 , 0 / 0 .
[Figure]
and 0 / 0 .
5 have looser bounds than CROWN-IBP and they have less unstable ReLUs, which leads to small loss variations as in Figure 7.
Therefore, this observation implies that it is more important to have less a = 1 to have a more smooth landscape
[Figure]
[Figure]
[Table]
F P ROOF
To prove Theorem 1, we ﬁrst prove the following proposition.
We note that θ
and g are vectorized and the matrix norm of Jacobian is naturally deﬁned - for example, ||∇ θ g || is induced by the vector norms deﬁned in
X and Θ .
Proposition 1.
Given input x ∈ X and perturbation radius (cid:15) , let M = max {|| x (cid:48)
|| :
x (cid:48) ∈ B ( x , (cid:15) ) } .
Then, for the upper bound s ( x ; θ ) =
max x (cid:48) ∈ B ( x ,(cid:15) )
g ( x ; θ ) T x (cid:48)
+ b ( x ; θ ) with b satisfying Assumption 1 (1), we have
[Equation]
15) for any θ 1 , θ 2 , where θ 1 , 2 can be any of θ 1 and θ 2 .
Proof.
Say f
( x (cid:48) ; θ )
=
g ( x ; θ ) T x (cid:48)
+ b ( x ; θ ) and the maximizer x ∗ i = arg max x (cid:48)
∈ B
[Equation]
x
[Equation]
) f
( x (cid:48) ; θ i ) for each θ i
= θ 1 , θ 2 .
Then, we have |
[Equation]
The ﬁrst term on the RHS can be upper bounded as follows:
[Equation]
where g i = g ( x ; θ i ) , b i =
b
( x ; θ i ) ,
˜ g
Ti = [ g Ti ; b i ] and ˜ x T
=
[ x T ; 1] .
And the second term on the
RHS can be upper bounded as follows:
[Equation]
Therefore
[Equation]
we obtain
[Equation]
Note that θ 1 in the ﬁrst term is arbitrarily chosen in (16).
Therefore, this leads to the ﬁnal inequality (15).
Theorem 1.
Given input x ∈ X and perturbation radius (cid:15) , let M be max x (cid:48)
∈ B ( x ,(cid:15) )
||
x (cid:48)
|| .
For a linear relaxation-based method with the upper bound s m ( x ; θ ) =
max x (cid:48) ∈ B ( x ,(cid:15) )
g ( m ) ( x ; θ ) T x (cid:48)
+ b ( m ) ( x ; θ ) , if b ( m ) satisﬁes Assumption 1 (1) for each m and p s satisﬁes Assumption 1 (2), then
[Equation]
(4) for any θ 1 , θ 2 , where L ( m ) =
L b ( m ) θθ + L p s θ ||∇ θ s ( x ; θ 1 , 2 ) ||
and θ 1 , 2 can be any of θ 1 and θ 2 .
Proof.
We simplify the notation p s as p .
Then we have
[Equation]
G L EARNING CURVE FOR (cid:15) train
Figure 9 shows the learning curves for the target perturbation (cid:15) train during the ramp-up period, while Figure 1 shows the corresponding curves for the scheduled value of (cid:15) .
The two ﬁgures use the same settings in Appendix A.1.
[Figure]
H S MOOTHNESS
We empirically measure the non-smoothness of the loss landscape with the difference between the two consecutive loss gradients at θ 1 = θ (0) and θ 2 = θ (1) in (8), says gradient difference ( ≡ ||∇ θ L ( x ; θ (0))
− ∇ θ L ( x ; θ (1)) || ).
It is highly related to the ratio of the number of unstable ReLUs (nonlinearity of the classiﬁer) as shown in Figure
[Figure]
I M ODE C ONNECTIVITY
In this section, we check the mode connectivity (Garipov et al., 2018) between two models that are trained using certiﬁable training methods.
Mode connectivity is a framework that investigates the connectedness between two models by ﬁnding a high accuracy curve between those models.
It enables us to understand the loss surface of neural networks.
Let w 0 and w 1 be two sets of weight corresponding to two different well-trained neural networks.
Moreover, let φ θ c ( t ) with t ∈ [0 , 1] be a continuous piece-wise smooth parametric curve with parameters θ c such that φ θ c (0)
=
w 0 and φ θ c (1) =
w 1 .
To ﬁnd a low-loss path between w 0 and w 1 ,
Garipov et al.
(2018) suggested to ﬁnd the parameter θ c that minimizes the expectation of a loss (cid:96) ( w ) over a distribution q θ c ( t ) on the curve,
[Equation]
To optimize L ( θ c ) for θ c , we use uniform distribution U [0 , 1] as q θ c ( t ) and Bezier curve (Farouki, 2012) as φ θ c ( t ) , which provides a convenient parameterization of smoothness on the paths connecting two end points ( w 0 and w 1 ) as follows:
[Equation]
A path φ θ c is said to have a barrier if ∃ t such that (cid:96) ( φ θ c ( t ))
>
max { (cid:96) ( w 0 ) , (cid:96) ( w 1 ) } .
The existence of a barrier suggests the modes of two well-trained models are not connected by the path in terms of the given loss function (cid:96)
(Zhao et al., 2020).
We test the mode connectivity between the models trained with IBP, CROWN-IBP, and OURS.
For example, to check the mode connectivity between two different models trained with CROWNIBP and IBP, we use the loss function used on each model as a user-speciﬁed loss for training the parametric curve φ θ c .
Therefore, we can obtain two curves as depicted in Figure 11, 12, and 13 for each pair of models.
Here, we use the identical settings in Appendix A.1.
Figure 11 shows the mode-connectivity between CROWN-IBP and IBP.
We use CROWN-IBP loss as user-speciﬁc loss in Figure 11a and IBP loss in Figure 11b.
In this ﬁgure, we ﬁnd that using
CROWN-IBP loss (11a), there exists a barrier between the two models.
This suggests they are not connected by the path in terms of CROWN-IBP loss.
However, with IBP loss, there is no loss barrier separating the two models.
This indicates that using CROWN-IBP, it is hard to optimize the parameters from w 0 to w 1 , but IBP can.
Figure 12 shows the mode-connectivity results on IBP and OURS.
We ﬁnd that two models are not connected to each other using either IBP bound or OURS bound, since there exists a barrier in both curves.
In this ﬁgure, we can also notify that OURS has tighter bounds than IBP because the value of the loss function using OURS is lower than that of IBP.
Finally, Figure 13 illustrates the mode connectivity between CROWN-IBP and OURS.
Using
CROWN-IBP as a user-speciﬁed loss function, we can ﬁnd that the robust loss on the curve is higher than that of the end points.
However, when OURS is used as a loss function, the robust loss generally decreases as the t increases.
It shows that OURS has much favorable loss landscape compared to CROWN-IBP.
In addition, we can ﬁnd that OURS has a tighter bound than CROWN-IBP, since the value of the robust loss using OURS is lower than CROWN-IBP.
[Figure]
[Figure] [Figure]
J R E LU
In this section, we investigate how pre-activation bounds u and l for the activation layer change during training.
For each activation node, it is said to be ”active” when the pre-activation bounds are both positive ( 0 < l ≤ u ), ”unstable” when they span zero ( l ≤ 0 ≤ u ), and ”dead” when they are both negative ( l ≤ u < 0 ).
Figure 14 shows the ratios of the number of active and dead ReLUs during the ramp-up period.
Notably, we ﬁnd that CROWN-IBP has more active ReLUs during training compared to the other three methods.
Simultaneously, CROWN-IBP has the lowest ratio of dead ReLUs.
Figure 15 shows the numbers of active, unstable, and dead ReLUs during the ramp-up period.
We ﬁnd that in CROWN-IBP, the number of unstable and active ReLUs increases as the number of dead
ReLUs decreases.
This indicates that a number of dead ReLUs change to unstable ReLUs as the training (cid:15) increases.
However, in the other methods, the number of unstable ReLUs is consistently small, while the number of active ReLUs decreases as the number of dead ReLUs increases.
Figure 16 depicts the histograms of the distribution of the slope
[Equation]
of the unstable ReLUs during the ramp-up period.
In the early stages of CAP training, the slope distribution is concentrated around 0.4.
However as the training progresses with a larger (cid:15) , the histogram distribution moves to left, which indicates unstable ReLUs change to dead ReLUs.
It is consistent with the results in
Figure 15c.
On the other hand, in the case of CROWN-IBP, the histogram distribution moves to right during training.
It is the same with the results in Figure 15b, which shows that number of active ReLUs increases during training.
[Figure] [Figure]
[Figure] [Figure]
K C OMPARISON WITH OTHER PRIOR WORK
All experiments and results (except for Table 4) in this paper are based on our own reimplementation.
For the unimplemented prior work, we compare to the best reported results in the literature in Table 4.
We note that the results in Xiao et al.
(2018) and Balunovic & Vechev (2019) are evaluated with a MILP based exact veriﬁer (Tjeng et al., 2017).
[Table]
L β - AND κ - SCHEDULINGS
Table 5 shows the evaluation results of the models as in Table 1 but trained with different κscheduling (from 0 to 0).
Table 6 shows the evaluation results of the proposed models trained with different κ - and β -schedulings.
[Table]
M ONE - STEP VS MULTI - STEP
To get a tighter bound, we propose multi-step version of (6) as follows:
[Equation]
We compare the original 1-step method ( α ≥ 1 ) to 7-step ( t = 7 ) method with α = 0 .
The results are summarized in Table 7.
We found no signiﬁcant difference between two methods even though multi-step takes multiple times with multi-step.
Therefore, we decide to focus on one-step method.
[Table]
[Table] [Table]
N.
[Table]
[Equation]
Zhang et al.
(2019b) and Gowal et al.
(2018) observed that IBP performs better when using (cid:15) train ≥ (cid:15) test than (cid:15) train =
(cid:15) test .
Figure 8 shows the results with different (cid:15) train ’s for each (cid:15) test .
The overﬁtting issue is more prominent in the case of IBP and CROWN-IBP 1 → 0 than the proposed method and CROWN-IBP 1 → 1 .
However, using larger perturbations compromises the standard accuracy
[Table]
and thus it is desirable to use smaller (cid:15) train .
[Table]
N. (cid:15) train = 1 . 1 (cid:15) test ON CIFAR-
As mentioned in Gowal et al.
[Table]
we also train with (cid:15) train = 1 . 1 (cid:15) test on CIFAR-10.
The results are shown in Table 9.
They attain slightly improved performances in 2 / 255 , but not in 8 / 255 and larger (cid:15) .
[Table]
O T RAINING TIME
All the training times are measured on a single TITAN X (Pascal) on Medium for CIFAR-10.
We train with a batch size of 128 for OURS, CROWN-IBP 1 → 1 and IBP, but with a batch size of 32 for
CAP due to its high
• OURS: 115.9 sec / epoch • CROWN-IBP 1 → 1 : 51.68 sec / epoch • IBP: 14.85 sec / epoch • CAP (batch size 32, 1 GPU): 751.0 sec / epoch • CAP (batch size 64, 1 GPU): 724.6 sec / epoch • CAP (batch size 128, 2 GPUs): 387.9 sec / epoch
P L OSS AND T IGHTNESS VIOLIN PLOTS
We plot the equivalent tightness violin plots in Section 6 for models trained with other methods.
The proposed method achieves the best results in terms of loss and tightness followed by CROWN-IBP,
CAP-IBP
[Figure]
and RANDOM.
Figure 17 (a)-(b), (c)-(d)
[Figure]
and (e)-(f) show the tightness evaluated on the model trained by CROWN-IBP 1 → 0 , CROWN-IBP 1 → 1 and IBP, respectively
[Figure]