O N
THE C ONVERGENCE OF C ERTIFIED
R
OBUST T RAINING WITH I NTERVAL B OUND P ROPAGATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Interval Bound Propagation (IBP) is so far the base of state-of-the-art methods for training neural networks with certiﬁable robustness guarantees when potential adversarial perturbations present, while the convergence of IBP training remains unknown in existing literature.
In this paper, we present a theoretical analysis on the convergence of IBP training.
With an overparameterized assumption, we analyze the convergence of IBP robust training.
We show that for a randomly initialized two-layer ReLU neural network with logistic loss, with sufﬁciently small perturbation radius and large network width, gradient descent for IBP training can converge to zero training robust error with a linear convergence rate for with a high probability, and at this convergence state the robustness certiﬁcation by IBP can accurately reﬂect the true robustness of the network
I NTRODUCTION
It has been shown that deep neural networks are vulnerable against adversarial examples (Szegedy et al., 2014; Goodfellow et al., 2015; Carlini & Wagner, 2017; Kurakin et al., 2016), where a human imperceptible adversarial perturbation can easily alter the prediction by neural networks.
This poses concerns to safety-critical applications such as autonomous vehicles, healthcare or ﬁnance systems.
To combat adversarial examples, many defense mechanisms have been proposed in the past few years (Kurakin et al., 2016;
Madry et al., 2018; Zhang et al., 2019; Guo et al., 2018; Song et al., 2018; Xiao et al., 2020).
However, due to the lack of reliable measurement on adversarial robustness, many defense methods are later broken by stronger attacks (Carlini & Wagner, 2017; Athalye et al., 2018; Tramer et al., 2020).
There are recently a line of robust training works, known as certiﬁed defense , focusing on training neural networks with certiﬁed robustness, where the evaluation of robustness needs to be provable – the network is considered robust on a test example if and only if the prediction is provably correct for any perturbation in a predeﬁned set (e.g., a small (cid:96) ∞ ball)
(Wang et al., 2018b; Bunel et al., 2018;
Zhang et al., 2018; Wang et al., 2018c; Wong & Kolter, 2018; Singh et al., 2018; 2019; Weng et al., 2018; Xu et al., 2020).
Unlike empirical methods that evaluate robustness with adversarial attacks and thus the evaluation can be limited by the strength of the attack algorithm, certiﬁed defense methods provide provable robustness guarantees without referring to any speciﬁc attack.
To obtain a neural network with certiﬁed robustness, a common practice is to derive a neural network veriﬁcation method that computes the upper and lower bounds of output neurons given an input region under perturbation (e.g., a small (cid:96) ∞ ball around an unperturbed sample), and then train the neural network to optimize the loss deﬁned not on the original output, but on the worst-case output produced by the veriﬁcation method.
Many methods along this line have been proposed in the past few years (Wong & Kolter, 2018;
Wong et al., 2018; Mirman et al., 2018; Gowal et al., 2018; Raghunathan et al., 2018a; Zhang et al., 2020a).
Among these methods, Interval Bound Propagation (IBP) (Mirman et al., 2018; Gowal et al., 2018) is a simple but effective and efﬁcient method for certiﬁed robust training.
It simply propagates the interval bound of each neuron through the network in the forward pass to obtain output bounds of the network.
Most of the latest state-ofthe-art certiﬁed defense methods are still at least partly based on IBP training (Zhang et al., 2020a;
Shi et al., 2021; Lyu et al., 2021; Zhang et al., 2021).
Despite being one of the most successful certiﬁed defense methods, the convergence properties of
IBP training remained unknown.
For natural neural network training (training without considering adversarial perturbation, aka standard training), it has been shown that gradient descent for overparameterized networks can provably converge to a global minimizer with random initialization (Li & Liang, 2018; Du et al., 2019b;a; Jacot et al., 2018; Allen-Zhu et al., 2019; Zou et al., 2018).
Compared to natural neural network training, IBP-based robust training has a very different training scheme, and thus requires a different convergence analysis.
First, in the robust training problem, input data can contain adversarial perturbations, and the training objective is to minimize a robust loss rather than a natural loss.
Second, IBP training essentially optimizes an augmented network which contains IBP bound computation rather than standard neural networks, as illustrated in Zhang et al.
(2020a).
Third, in IBP training, the activation state of each neuron depends on the certiﬁed bounds rather than the value in natural neural network computation, and this introduces additional perturbation-related terms in the convergence analysis for IBP.
In this paper, we conduct a theoretical analysis to study the convergence of IBP training.
Following recent convergence analysis on Stochastic Gradient Descent (SGD) for natural training, we consider IBP robust training with gradient ﬂow (gradient descent with inﬁnitesimal step size) for a two-layer overparameterized neural network on a classiﬁcation task.
We summarize our contributions below:
• We provide the ﬁrst convergence analysis for IBP-based certiﬁed robust training.
On a two-layer overparameterized ReLU network with logistic loss, with sufﬁciently small perturbation radius and large network width, gradient ﬂow with IBP has a linear convergence rate, and is guaranteed to converge to zero training error with high probability.
• Our result implies that IBP converges to a state where the certiﬁed robust accuracy measured by IBP bounds tightly reﬂects the true robustness of the network.
• We show additional perturbation-related conditions required to guarantee the convergence of IBP training so far, and identify additional challenges in the convergence analysis for
IBP training compared to standard training.
R ELATED W ORK 2. C ERTIFIED R OBUST T RAINING
The goal of certiﬁed robust training is to maximize the robust accuracy of the model under the evaluation by provable robustness veriﬁers.
Some works add heuristic regularizations during adversarial training to improve certiﬁed robustness (Xiao et al., 2019; Balunovic & Vechev, 2020).
Some others optimize a certiﬁed robust loss which is a certiﬁed upper bound of the loss function under all considered perturbations, computed from certiﬁed bounds by robustness veriﬁers.
Among them, Wong & Kolter (2018); Mirman et al.
; Dvijotham et al.
; Wong et al.
Wang et al.
(2018a) used veriﬁcation with linear relaxation for nonlinear activation functions, and Raghunathan et al.
(2018b) used semi-deﬁnite relaxation.
However, Interval Bound Propagation (IBP) (Mirman et al., 2018; Gowal et al., 2018) which computes and propagates an interval lower and upper bound for each neuron, has been shown as efﬁcient and effective and can even outperform methods using more complicated relaxation as partly discussed by Lee et al.
; Jovanovi´c et al.
At least partly based on IBP, Zhang et al.
(2020a) combined IBP with linear relaxation bounds; Lyu et al.
(2021) designed a parameterized activation; Zhang et al.
(2021) designed a 1-Lipschitz layer with (cid:96) ∞ -norm computation before layers using IBP; Shi et al.
(2021) improved IBP training with shortened training schedules.
Yet, the state-of-the-art methods still contain IBP as an important part, and thus we focus on analyzing the convergence of IBP training in this paper.
On the theoretical analysis for IBP bounds, Baader et al.
(2020) analyzed the universal approximation of IBP veriﬁcation bounds, and Wang et al.
(2020) extended the analysis to other activation functions beyond ReLU.
However, to the best of our knowledge, there is still no existing work analyzing the convergence of IBP training.
The aforementioned methods for certiﬁed robustness target at robustness with deterministic certiﬁcation.
There are also some other works on probabilistic certiﬁcation such as randomized smoothing (Cohen et al., 2019;
Li et al., 2019;
Salman et al., 2019) which is out of our scope.
2. C ONVERGENCE OF S TANDARD N EURAL N ETWORK T RAINING
There have been many works analyzing the convergence of standard neural network training.
For two-layer ReLU neural networks with quadratic loss, Du et al.
(2019b) proved that randomly initialized gradient descent can converge to a globally optimum with a large enough network width m which is polynomial in the number of training examples n .
Ji & Telgarsky (2019) pushed the requirement of network width m to a polylogarithmic function.
For deep neural networks, Allen-Zhu et al.
(2019) proved that for randomly initialized ReLU deep neural networks, gradient descent has a linear convergence rate for various loss functions with width polynomial in network depth and number of training examples.
And Chen et al.
(2019) proved that a polylogarithmic width is also sufﬁcient for deep neural networks to converge to the optimal point.
However, these works only focus on standard training, and cannot be directly adapted to the robust training setting.
2. C ONVERGENCE OF E MPIRICAL A DVERSARIAL T RAINING
Robust training including both certiﬁed training and empirical adversarial training is essentially a min-max optimization.
For a training data distribution X , the objective for learning a model f θ parameterized by θ can be written as 1 :
[Equation]
(1) where ( x , y ) is an example sampled from X , (cid:96) ( · , y ) is the loss function for ground truth y , S is the space of all possible perturbations.
Empirical adversarial training approximately solves the inner minimization by running adversarial attacks.
Some works have analyzed the convergence of adversarial training.
Wang et al.
(2019) considered a ﬁrst-order stationary condition for solving the inner constrained maximization problem.
Gao et al.
; Zhang et al.
(2020b) showed that overparameterized networks with projected gradient descent can converge to a state where the surrogate robust loss by adversarial attack is close to the true robust loss (i.e., the inner maximization by adversarial attack is mostly optimal) and the robust loss is close to 0.
Zou et al.
(2021) showed that adversarial training provably learns robust halfspaces in the presence of noise.
However, there is a signiﬁcant difference between empirical adversarial training and IBP training.
In adversarial training, there is a concrete perturbation ∆ generated for the inner maximization, and there is a concrete adversarial input x + ∆ .
However, in IBP-based training, the inner maximization is computed from certiﬁed bounds, where for each layer, the interval certiﬁed bounds of each neuron are computed independently.
Thereby, the certiﬁed bounds of the network generally no longer correspond to any concrete ∆ .
Due to this signiﬁcant difference, prior theoretical analysis on adversarial training, which required there to be a concrete ∆ for inner maximization, is not applicable to IBP.
P RELIMINARIES 3. N EURAL N ETWORKS
We consider a similar network architecture as used in Du et al.
(2019b) – a two-layer ReLU network.
Unlike Du et al.
(2019b) which considered a regression task with a square loss, here we consider a classiﬁcation task where IBP is usually used, and we consider binary classiﬁcation for simplicity.
On a training dataset { ( x i , y i ) } ni =1 , for every i ∈ [ n ] , ( x i , y i ) is a training example with d -dimensional input x i ( x i ∈ R d ) and label y i ( y i ∈{± 1 } ) , and the network output is:
[Equation]
where m is the width of hidden layer (the ﬁrst layer) in the network, W ∈ R m × d is the weight matrix of the hidden layer, w r ( r ∈ [ m ]) is the r -th row of W , a ∈ R m is the weight vector of the second layer (output layer) with elements a 1 , · · · , a m , and σ ( · ) is the activation function. We assume the activation is ReLU as IBP is typically used with ReLU.
For initialization, we set a r ∼ unif [ { 1 , − 1 } ] and w r ∼ N (0 , I ) .
Following Du et al. (2019b), we assume the second layer is ﬁxed after initialization, and we only train the ﬁrst layer.
Since we consider binary classiﬁcation, we use a logistic loss. For training example ( x i , y i ) , we deﬁne u i ( W , a , x i ) : =
y i f
( W , a , x i ) , and then the loss for this example is computed as l ( u i ( W , a , x i ))
= log(1 + exp( − u
i ( W , a , x i ))) , and the standard training loss on the whole training set is
[Equation]
3. C ERTIFIED R OBUST T RAINING
In the robust training setting, for some original input x i ( ∀ i ∈ [ n ] ), we consider that the actual input to the model may be perturbed into x i + ∆ i by perturbation ∆ i .
For a widely adopted setting in the adversarial robustness area, we consider (cid:96) ∞ perturbations, where the perturbation is bounded by an (cid:96) ∞ ball with radius (cid:15) (0 ≤ (cid:15) ≤ 1) , i.e., (cid:107) ∆ i (cid:107) ∞ ≤ (cid:15) .
For the convenience of subsequent analysis and without loss of generality, we set the following assumption on each x i :
Assumption 1.
∀ i ∈ [ n ] , we assume there exists some ξ > 0 , such that x i ∈
[ (cid:15), 1] d , (cid:107) x i (cid:107) 2 ≥ ξ .
This assumption can be easily satisﬁed by normalizing the training data. Through out the remaining part of this paper, we assume this assumption holds.
In Du et al.
(2019b), they also assume there are no parallel data points, and in our case we assume this holds under any possible perturbation, formulated as:
Assumption 2.
For perturbation radius (cid:15) , we assume that
[Equation]
where B ∞ ( x i , (cid:15) ) stands for the (cid:96) ∞ ball with radius (cid:15) centered at x i .
IBP training computes and optimizes a robust loss L , which is an upper bound of the standard loss for any possible perturbation ∆ i ( ∀ i ∈ [ n ]) :
[Equation]
To compute L , since log( · ) and exp( · ) are both monotonic, for every i ∈ [ n ] , IBP ﬁrst computes the lower bound of u i ( W , a , x i + ∆ i ) for (cid:107) ∆ i (cid:107) ∞ ≤ (cid:15) , denoted as u i .
Then the IBP robust loss is:
[Equation]
where
[Equation]
For all i ∈ [ n ] , IBP computes and propagates an interval lower and upper bound for each neuron in the network, and then u i is equivalent to the lower bound of the ﬁnal output neuron.
Initially, the interval bound of the input is [ x i − (cid:15) · 1 , x + (cid:15) · 1 ] .
Given constraints of ∆ i , we have the interval bound of each neuron in the ﬁrst layer:
[Equation]
Then these interval bounds are propagated to the second layer.
We focus on the lower bound of u i , which can be computed from the bounds of the ﬁrst layer by considering the sign of multiplier y i a r :
[Equation]
Then the IBP robust loss can be obtained as Eq.
And we deﬁne u :=
( u 1 , u 2 , · · · , u n ) .
For certiﬁed robust training, we can deﬁne a certiﬁed robust accuracy in IBP training, which is the percentage of examples that IBP bounds can successfully certify that the prediction is correct for any possible perturbation.
For every example i ( i ∈ [ n ]) , it is considered as classiﬁed correctly and robustly under IBP veriﬁcation, if and only if u i > 0 where u i is computed from IBP.
Let ˜ u
i be the exact solution of the minimization in Eq.
(6) rather than relaxed IBP bounds, we can also deﬁne a true robust accuracy , where the robustness of prediction requires ˜ u i > 0 .
The certiﬁed robust accuracy by IBP is a provable lower bound of the true robust accuracy.
3. G RADIENT F LOW
To analyze the convergence of IBP training, we adopt a continuous time analysis with gradient ﬂow, which is gradient descent with inﬁnitesimal step size and is also used in prior works for standard training (Arora et al., 2018; Du et al., 2019a;b).
In the gradient ﬂow for IBP training,
[Equation]
where w 1 ( t ) , w 2 ( t ) , · · · , w m ( t ) are rows of the weight matrix at time t , and L ( t ) is the IBP robust loss deﬁned as Eq.
(6) using weights at time t .
3. G RAM M ATRIX
Under the gradient ﬂow setting as Eq.
(10), for all i ∈ [ n ] , we analyze the dynamics of u i during IBP training, and we use u i ( t ) to denote the value of u i at time t :
[Equation]
where l (cid:48) ( u j ) is the derivative of the loss, H ( t ) is deﬁned as H ij ( t ) =
[Equation]
( ∀ 1 ≤ i, j ≤ n ) , and we provide a detailed derivation in Appendix B.1.
With the deﬁnition of H , we can describe the dynamic of u i under the gradient ﬂow using H .
From Eq.
(9), ∀ i ∈ [ n ] , r ∈ [ m ] , derivative ∂u i ( t ) ∂ w r ( t ) can be computed as follows:
[Equation]
where sign( w r ( t )) is element-wise for w r ( t ) , and we deﬁne indicators
[Equation]
where terms ( w r ( t ) (cid:62) x i − (cid:15) (cid:107) w r ( t ) (cid:107) 1 > 0) and ( w r ( t ) x i + (cid:15) (cid:107) w r ( t ) (cid:107) 1 > 0) stand for the active status of the activation.
Then elements in H can be written as ( ∀ 1 ≤ i, j ≤ n ):
[Equation]
[Equation]
16) where
[Equation]
[Equation]
[Equation] Further, we deﬁne Gram matrix H ∞ which is the elementwise expectation of H (0) , to characterize
H (0) on the random initialization basis:
[Equation]
where H ij (0) depends on the initialization of weights w r and a r .
We also deﬁne λ 0 := λ min ( H ∞ ) as the smallest eigenvalue of H ∞ .
We will show that H ∞ is positive deﬁnite, and with high probability, we can upper bound the difference between H (0) and H ∞ , and thereby we can prove that H (0) is positive deﬁnite.
C ONVERGENCE A NALYSIS FOR IBP T RAINING
We present the following main theorem which shows the convergence of IBP training under certain conditions on perturbation radius and network width:
Theorem 1 (Convergence of IBP Training) .
Suppose Assumption 1 and 2 hold for the training data, and the (cid:96) ∞ perturbation radius satisﬁes (cid:15) ≤ O (min( δ 2 λ 20 d 2 .
5 n 3 , √ 2 dR log( √ 2 πdR ξ ) )) , where R = cδλ 0 d 1 . 5 n 2 , c = √ 2 πξ 384 . For a two-layer ReLU network (Eq. , suppose its width for the ﬁrst hidden layer satisﬁes m ≥ Ω (cid:18)(cid:16)
d 1 . 5 n 4 δλ 0 δ 2 λ 20 − (cid:15)d 2 .
5 n 4 (cid:17) 2 (cid:19) , and the network is randomly initialized as a r ∼ unif [ { 1 , − 1 } ] , w r ∼ N (0 , I ) , with the second layer ﬁxed during training. Then for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , IBP training with gradient ﬂow can converge to zero training error.
In the following part of this section, we provide the proof sketch for the main theorem.
4. S TABILITY OF THE G RAM M ATRIX DURING IBP T RAINING
We ﬁrst analyze the stability of the Gram matrix H during training, since H can be used to characterize the dynamic of the training as deﬁned in Eq.
We aim to show that when there exists some R such that the change of w r ( ∀ r ∈ [ m ]) is restricted to (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R during training, we can guarantee that the minimum eigenvalue of H ( t ) remains positive with high probability. This property will be later used to reach the conclusion on the convergence.
We defer the derivation for the constraint on R to the later part of this section.
For all r ∈ [ m ] , with the aforementioned constraint on w r ( t ) , we ﬁrst show that during the IBP training, most of α rij ( t ) , β rij ( t ) , γ rij ( t ) terms in Eq.
(16) remain the same as their initialized values ( t = 0 ).
This is because for for each of α rij ( t ) , β rij ( t ) , γ rij ( t ) , the probability that its value changes during training can be upper bounded by a polynomial in R , and thereby the probability can be made sufﬁciently small for a sufﬁciently small R , as the following lemma shows:
Lemma 1.
∀ r ∈ [ m ] , at some time t > 0 , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds for some R , and (cid:15) ≤ √ 2 dR log( √ 2 πdR ξ ) holds, then for all 1 ≤ i, j ≤ n , we have
[Equation]
12 √
[Equation]
The full proof for the lemma is provided in Appendix A.1.
Here we give a overview of the proof. Probabilities in Lemma 1 can be bounded as long as the probability that each of indicator A + ri ( t ) , A − ri ( t ) , A + rj ( t ) , A − rj ( t ) changes can be upper bounded respectively.
When the change of w r ( t ) is bounded, the indicators can change during the training only if at initialization | w r (0) (cid:62) x i ± (cid:15) (cid:107) w r (0) (cid:107) 1 | is sufﬁciently small with | w r (0) (cid:62) x i ± (cid:15) (cid:107) w r (0) (cid:107) 1 | ≤ (1 + (cid:15) ) √ dR as we show in the proof, whose probability can be upper bounded (the notation ± here means the analysis is consistent for both + and − cases).
To upper bound this probability, our analysis is different compared to that for standard training in Du et al.
(2019b), because we have additional perturbationrelated terms (cid:15) (cid:107) w r (0) (cid:107) 1 .
Du et al.
(2019b) simply used the anti-concentration of standard Gaussian distribution to bound Pr( | w r (0) (cid:62) x i | ) ≤ R (they did not have √ d on the right-hand-side due to a different assumption on (cid:107) x (cid:107) ).
Here when (cid:15) (cid:107) w r (0) (cid:107) 1 presents for the IBP case, we split the original probability into two parts, Pr( | w [Equation]
[Equation] √ dR and Pr( [Equation] ) √ dR ) , and then combine the results to upper bound the original probability.
The ﬁrst probability can still be bounded by anti-concentration, while the second probability can be bounded by the tail bound of standard Gaussian.
Thereby we can prove the lemma.
Then we can then bound the change of the Gram matrix, i.e., (cid:107) H ( t ) − H (0) (cid:107) 2 :
Lemma 2.
∀ r ∈ [ m ] , at some time t > 0 , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds for some constant R , for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , it holds that
[Equation]
It can be proved by ﬁrst upper bound E [ | H ij ( t ) − H ij (0) | ]( ∀ 1 ≤ i, j ≤ n ) , using Lemma 1, and then by Markov’s inequality, we can upper bound (cid:107) H ( t ) − H (0) (cid:107) 2 with high probability.
We provide the proof in Appendix A.2.
And by triangle inequality, we can also lower bound λ min ( H ( t )) :
Corollary 1.
∀ r ∈ [ m ] , at some time t > 0 , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds for some constant R , for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , it holds that
[Equation]
where λ min ( · ) stands for the minimum eigenvalue.
We also need to lower bound λ min ( H (0)) to lower bound λ min ( H ( t )) .
Given Assumption 2, we show that the minimum eigenvalue of H ∞ is positive.
Lemma 3.
When the dataset satisﬁes Assumption 2, λ 0 : = λ min ( H ∞ ) > 0 holds true.
The lemma can be similar proved as Theorem 3.1 in Du et al.
(2019b), but here we have a different Assumption 2 which considers perturbations. We discuss in more detail in Appendix A.3.
Then we can lower bound λ min ( H (0)) by Lemma 3.1 from Du et al.
(2019b):
Lemma 4 (Lemma 3.1 from Du et al. (2019b)) .
If λ 0 > 0 , for any conﬁdence δ (0 < δ < 1) , take m = Ω( n 2 λ 20 log( nδ )) , then with probability at least 1 − δ , it holds true that λ min ( H (0)) ≥ 34 λ 0 .
Although we have different values in the Gram matrix H (0) for IBP training compared to the Gram matrix in Du et al. (2019b) for standard training, we can still adopt their original lemma because their proof by Hoeffding’s inequality is general for values in H (0) given the deﬁnition on λ 0 .
Given λ min ( H (0)) ≥ 34 λ 0 , we can guarantee that λ min ( H ( t )) remains positive by solving an inequality and choosing a proper R such that
[Equation]
(24) as shown in the following lemma (proved in Appendix A.4):
Lemma 5.
For any conﬁdence δ (0 < δ < 1) , ∀ r ∈ [ m ] , suppose (cid:107) w r ( t ) − w r (0) (cid:107) 2 ≤ R holds, where R = cδλ 0 d 1 . 5 n 2 with c = √ 2 πξ 384 , then probability at least 1 − δ , λ min ( H ( t )) ≥ λ 0 2 holds.
Therefore, we have shown that with overparameterization (required by Lemma 4), when w r is relatively stable during training for all r ∈ [ m ] , i.e., the maximum change on w r ( t ) is upper bounded during training (characterized by the (cid:96) 2 norm of weight change restricted by R ), H ( t ) is also relatively stable and remains positive deﬁnite with high probability.
4. C ONVERGENCE OF THE IBP R OBUST L OSS
Next, we can derive the upper bound of the IBP loss during training.
In the following lemma, we show that when H ( t ) remains positive deﬁnite, the IBP loss L ( t ) descends in a linear convergence rate, and meanwhile we have an upper bound on the change of w r ( t ) w.r.t.
time t .
Lemma 6.
Suppose for 0 ≤ s ≤ t , λ min ( H ( t )) ≥ λ 0 2 , we have
[Equation]
This lemma is proved in Appendix A.5, which follows the proof of Lemma 5.4 in Zou et al.
In this lemma, to guarantee that λ min ( H ( s )) ≥ λ 0 2 for 0 ≤ s ≤ t , by Lemma 5, we only require
[Equation]
Meanwhile, for each example i , the model can be certiﬁed by IBP on example i with any (cid:96) ∞ perturbation within radius (cid:15) , if and only if u i > 0 , and this condition is equivalent to l ( u i ) < κ , where κ := log(1 + exp(0)) .
Therefore, to reach zero training error on the whole training set at time t , we can require L ( t ) < κ , which implies that ∀ 1 ≤ i ≤ n, l ( u i ) < κ .
Then with Lemma 6, we want the upper bound of L ( t ) to be less than κ :
[Equation]
To make Eq.
(27) reachable at some t , with the constraint in Eq. (26) we require: [Equation] The left-hand-side of Eq.
(28) can be relaxed as
[Equation]
then the requirement Eq.
(28) can be relaxed as
[Equation] where c (cid:48) : = c 8 and c 0 are positive constants. Since L (0) has randomness from the randomly initialized weight W , we need to upper bound the value of L (0) as we show in the following lemma (proved in Appendix A.6 by concentration):
Lemma 7.
In natural training, for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , L (0) =
O ( nδ ) holds.
In IBP training, for any conﬁdence δ (0 < δ < 1) , with probability at least 1 − δ , L (0) =
O ( n √ md(cid:15)δ + nδ ) holds.
And this lemma implies that with large n and m , there exist constants c 1 , c 2 , c
3 such that
[Equation]
Plug Eq.
(30) into Eq. (29), and then requirement Eq. (29) can be relaxed into:
[Equation]
(31) where c 4 :
= c 3 + c 0 is a constant.
As long as Eq.
(31) holds, Eq.
(28) also holds, and thereby IBP training is guaranteed to converge to zero IBP robust loss on the training set. 4. P ROVING THE M AIN T HEOREM
Finally, we are ready to prove the main theorem.
To make Eq.
(28) satisﬁed, we want to make its relaxed version, Eq.
(31), hold by sufﬁciently enlarging m .
This requires that the coefﬁcient of √ m in Eq.
(31) , c (cid:48) δλ 20 d 1 .
5 n 3 − c 1 nd(cid:15)δ to be positive, and we also plug in the constraint on (cid:15) in Lemma 1:
[Equation]
Then by Eq.
(31), our requirement on width m is m >
[Equation]
[Figure]
This completes the proof of the main theorem.
In our analysis, we focus on IBP training with (cid:15) > 0 .
But IBP with (cid:15) = 0 can also be viewed as standard training.
By setting (cid:15) = 0 , if m ≥ Ω( n 8 d 3 λ 40 δ 4 ) , our result implies that for any conﬁdence δ (0 < δ < 1) , standard training with logistic loss also converges to zero training error with probability at least 1 − δ .
And as (cid:15) gets larger, the required m for convergence also becomes larger.
E XPERIMENTS
We further conduct experiments to compare the convergence of networks with different width m for natural training and IBP training respectively.
We use the MNIST (LeCun et al., 2010) dataset and choose digit images with label 2 and 5 to construct a binary classiﬁcation dataset. And we use a two-layer fully-connected ReLU network with a variable width.
In each experiment, we train the model for 70 epochs.
For IBP training, we keep (cid:15) ﬁxed throughout the whole training process.
For all the experiments, we use the SGD optimizer.
We present results in Figure 1.
First, compared with standard training, for the same network width m , IBP has higher training errors (Figure 1a).
Second, for relatively large (cid:15) ( (cid:15) = 0 . 04 ), even if we enlarge m up to 80,000 which is limited by the memory of a single GeForce RTX 2080 GPU, IBP certiﬁed robust error is far away from 0 (Figure 1a).
This is consistent to our main theorem that when (cid:15) is too large, simply enlarging m can not guarantee the convergence.
Moreover, when (cid:15) grows even larger, it can be difﬁcult to even start the training, although standard training is possible.
IBP training stucks in a local minima of random guess (with errors close to 50% ) at the beginning of training (Figure 1b).
Therefore in IBP-based training, existing works typically use a scheduling on (cid:15) to gradually increase (cid:15) from 0 until the target value.
Theoretically, we believe that this is partly because λ 0 can be very small with a large perturbation, and then the training can be much more difﬁcult, while this difﬁculty cannot be alleviated by simply enlarging the network width m .
Overall, the empirical observations match our theoretical results.
C ONCLUSION
In this paper, we present the ﬁrst theoretical analysis of IBP-based certiﬁed robust training, and we show that IBP training can converge to zero training error with high probability, under certain conditions on perturbation radius and network width.
Meanwhile, since the certiﬁed robust accuracy by IBP is a lower bound of the true robust accuracy (see Section 3.2), and we have shown that it can converge to 100% on the training set, the true robust accuracy also converges to 100% on the training set. Therefore, our results also imply that upon convergence, the certiﬁcation by IBP accurately reﬂects the true robustness of the network.
However, our results have a condition requiring a small upper bound on (cid:15) .
For future work, it will be interesting to study how to relax this condition, extend our analysis to deeper networks, or take the effect of (cid:15) scheduling into consideration.
E THICS STATEMENT
This work is basically a theoretical analysis on an existing method for training certiﬁably robust neural networks.
We believe there is no potential ethical issue in our work.
R EPRODUCIBILITY STATEMENT
For all our theoretical results the assumptions are stated clearly and the complete proof can be found either in the main text or the appendix.
We only have a small toy experiment by running IBP training with the open-source code from Shi et al. (2021) and any difference in the setting has been fully described in Section 5.
Therefore, the results are reproducible
A P ROOF OF L EMMAS A. P ROOF OF L EMMA
Proof.
For all i ∈ [ n ] , r ∈ [ m ] , we ﬁrst consider the change of indicator 1 ( w r ( t ) (cid:62) x i ± (cid:15) (cid:107) w r ( t ) (cid:107) 1 > 0) during training compared to the value at t =
(the notation ± here means the analysis is consistent for both + and − cases).
Under the constraint that (cid:107) w r ( t ) ± w r (0) (cid:107) 2 ≤ R
and (cid:107) x
i (cid:107) ∞ ∈ [0 , 1] d , we have (see Appendix B.2 for details):
[Equation] [Equation]
Thereby, if sign( w r ( t ) (cid:62) x i [Equation] [Equation]
= sign
[Equation]
) (cid:62)
[Equation]
± (cid:15) (cid:107) w
[Equation]
0) (cid:107) 1 ) , then at initialization, we must have
[Equation]
We want to upper bound the probability that Eq.
(35) holds.
It is easy to show that if the following two inequalities hold, then Eq.
(35) does not hold for sure:
[Equation]
Therefore,
[Equation]
For Eq.
[Equation] by anti-concentration inequality for Gaussian [Equation] we have
[Equation]
In other words [Equation] with probability at least 1 − 4(1 + (cid:15) ) √ dR/ ( √ 2 πξ ) , Eq.
(36) holds.
And for Eq.
(37), by the tail bound of standard Gaussian and union bound [Equation] we have
[Equation]
Combining Eq.
(40) and Eq.
(41), Eq.
(35) holds with at most the following probability
[Equation]
Here we require (cid:15) to be sufﬁciently small such that
[Equation]
and we can solve the inequality to obtain an upper bound for (cid:15) (detailed in Appendix B.3): [Equation]
[Equation]
and in this case Eq.
(42) holds with probability at least
[Equation]
Therefore, we upper bound the probability:
[Equation]
Thereby
[Equation]
Note that at least one of A + ri ( t ) and A − ri ( t ) always remains zero during training, because condition y i a r = 1 in A + ri ( t ) and condition y i a r = − 1 in A − ri ( t ) are mutually exclusive.
Then
[Equation]
Next we can upper bound the probability that each of α rij ( t ) , β rij ( t ) , γ rij ( t ) ( ∀ i, j ∈ [ n
[Equation]
, r ∈ [ m ] ) changes respectively:
[Equation]
A. P ROOF OF L EMMA
Proof.
With Lemma 1, we can bound the expectation of the change for each element in H ( t ) (Eq.
(16)) as:
[Equation]
2 π ( ∀ i, j ∈ [ n ])
Then by Markov’s inequality, we have that with probability at least 1 − δ , (cid:107) H ( t ) − H (0) (cid:107) [Equation] ≤ (cid:88) i ∈ [ n ] ,j ∈ [ n ] [Equation]
√
[Equation]
R. A. P ROOF OF L EMMA
Proof.
First for simplicity, we deﬁne φ ( x i )( w r (0))
=
y i ( x i + κ i (cid:15) sign( w r (0)) 1 ( w r (0) (cid:62) ( x i
+ ρ i (cid:15) sign( w r (0))) > 0) where ( ρ i = − A
+ ri (0) + A − ri (0)) ∈ { 1 , − 1 } .
Similar as Theorem 3.1 in Du et al. (2019b), we need to prove that if η 1 , ..., η n ∈ R satisfy η 1 φ ( x i )( w r (0)) + ...
+ η n φ ( x {+n )( w r (0)) = 
 a.e., we have η+} i = 0 for all i .
In Theorem 3.1 in
Du et al. (2019b), it is proved that if x i ∦ x j , ∀ i (cid:54) = j , for φ ( x i )( w ) = x i 1 ( w (cid:62) x i ) , this statement is true. Similarly if ∀ i, j ∈ [ n ] , i (cid:54) =
j, ∀ x (cid:48) i ∈ B ∞ ( x i , (cid:15) ) , ∀ x (cid:48) j ∈ B ∞ ( x j , (cid:15) ) , x (cid:48) i ∦ x (cid:48) j , this statement is true.
A. P ROOF OF L EMMA
The lemma can be proved by solving inequality Eq.
Proof.
According to Lemma 4, λ min ( H (0)) ≥ 34 λ 0 .
And with Eq.
(23), in order to ensure λ min ( H ( t )) ≥ λ 0 2 , we can make
[Equation]
This yields
[Equation]
Note that 0 ≤ (cid:15) ≤ 1 , and thus 1 + (cid:15) ≤ 2 and 1 + 2 (cid:15) + (cid:15) 2 ≤ 4 can be upper bounded by constants respectively.
Then we can take
[Equation]
where c = √ 2 πξ 384 , and in this case λ min ( H ( t )) ≥ λ 0 2 w.p. at least 1 − δ probability.
A. P ROOF OF L EMMA
Proof.
The proof of this lemma is inspired by the proof of Lemma 5.4 in Zou et al.
In our proof, we deﬁne f ( x ) =
( f ( x 1 ) , f ( x 2 ) , ..., f ( x n )) , where f ( x ) is a scalar function and x is a vector of length n .
When λ min ( H )( s ) ≥ λ 0 2 holds for 0 ≤ s ≤ t , we can bound the derivative of L ( t ) : [Equation] n (cid:88)
[Equation]
=
[Equation]
[Equation]
[Equation]
[Equation]
=
[Equation]
(cid:48)
[Equation]
u
[Equation]
( ii )
[Equation]
[Equation]
(cid:88)
[Equation]
=
[Equation]
(cid:48) ( u i ) ( iii )
[Equation]
(cid:88) [Equation] [Equation] where (i) is due to λ min ( H ) ≥ λ 0 , (ii) is due to − l (cid:48) ( u ) ≤ 1 , (iii) holds due to the following property of cross entropy loss − l (cid:48)
( u ) ≥ min(1 / 2 , l ( u ) 2 ) , (iv) holds due to the function min(1 / 2 , x ) is a concave function and Jenson’s inequality, (v) holds due to min( a, b ) ≥ 1
/a +1 /b
Therefore, we have
[Equation]
By integration on both sides from 0 to t [Equation] we have
[Equation]
Therefore, we have
[Equation]
which yields
[Equation]
And we can bound the change of w r .
[Equation]
where σ (cid:48) ( · ) stands for the derivative of the ReLU activation.
Thus
[Equation]
A. P ROOF OF L EMMA
Proof.
We ﬁrst prove the standard training part.
As we have deﬁned previously that
[Equation]
) , where
[Equation]
For each a r σ ( w r (0) (cid:62) x i ) , r ∈ [ m ] , i ∈ [ n ] , note that the randomness only comes from random initialization for w r , there is 12 possibility that it is equal to 0, and another 12 possibility that it follows a normal distribution N (0 , σ 2 i ) , where σ i = (cid:107) x i (cid:107) 22 .
Therefore, we have
[Equation]
Therefore, by Chebyshev’s inequality, we can bound
Pr
[Equation]
And we can bound L (0) =
O ( n max ni =1 σ 2 i 2 δ )
=
O ( nδ ) with probability at least 1 − δ .
For IBP training,
[Equation]
Thus
[Equation]
By E ( (cid:107) w r (cid:107) 1 ) =
O ( d ) and Markov’s inequality, with probability at least 1 − δ , | u
i (0) − u i ( [Equation] | ≤ O ( √ md(cid:15) δ ) .
And we can bound L (0) =
O ( n √ md(cid:15)δ + nδ ) with probability at least 1 − δ .
B D ETAILED D ERIVATION FOR O THER E QUATIONS OR I NEQUALITIES B. D ERIVATION ON THE D YNAMICS OF u i ( t )
We provide a detailed derivation on the dynamics of u i ( t ) presented in Eq.
(11), which we use H i ( t ) to describe ddt u i ( t ) :
[Equation]
B. D ERIVATION FOR E Q . (34)
Eq.
(34) basically comes by triangle inequality:
[Equation]
w r ( t ) (cid:107) 1 − (cid:107) w r
0) (cid:107) 1 (cid:12)(cid:12) ≤ | ( w r ( t ) − w r (0))
(cid:62) x
i | + (cid:15) (cid:13)(cid:13) w r ( t ) − w r (0) (cid:13)(cid:13)≤ (1 + (cid:15) ) √ dR.
B. D ERIVATION FOR E Q . (44)
We solve the inequality in Eq.
(43) to derive an upper bound for (cid:15) in Eq.
[Equation]
and then we can require
[Equation]