  Certified defenses based on convex relaxations are an established technique
for training provably robust models. The key component is the choice of
relaxation, varying from simple intervals to tight polyhedra. Paradoxically,
however, it was empirically observed that training with tighter relaxations can
worsen certified robustness. While several methods were designed to partially
mitigate this issue, the underlying causes are poorly understood. In this work
we investigate the above phenomenon and show that tightness may not be the
determining factor for reduced certified robustness. Concretely, we identify
two key features of relaxations that impact training dynamics: continuity and
sensitivity. We then experimentally demonstrate that these two factors explain
the drop in certified robustness when using popular relaxations. Further, we
show, for the first time, that it is possible to successfully train with
tighter relaxations (i.e., triangle), a result supported by our two properties.
Overall, we believe the insights of this work can help drive the systematic
discovery of new effective certified defenses.
