Scaling provable adversarial defenses

By Eric Wong, Frank R. Schmidt, Jan Hendrik Metzen, J. Kolter. 2018

474 citations recorded by the source corpus.

Recent work has developed methods for learning deep network classifiers that are provably robust to norm-bounded adversarial perturbation; however, these methods are currently only possible for relatively small feedforward networks. In this paper, in an effort to scale these approaches to substantially larger models, we extend previous work in three main directions. First, we present a technique for extending these training procedures to much more general networks, with skip connections (such as ResNets) and general nonlinearities; the approach is fully modular, and can be implemented automatically (analogous to automatic differentiation). Second, in the specific case of $\ell_\infty$ adversarial perturbations and networks with ReLU nonlinearities, we adopt a nonlinear random projection for training, which scales linearly in the number of hidden units (previous approaches scaled quadratically). Third, we show how to further improve robust error through cascade models. On both MNIST and CIFAR data sets, we train classifiers that improve substantially on the state of the art in provable robust adversarial error bounds: from 5.8% to 3.1% on MNIST (with $\ell_\infty$ perturbations of $\epsilon=0.1$), and from 80% to 36.4% on CIFAR (with $\ell_\infty$ perturbations of $\epsilon=2/255$). Code for all experiments in the paper is available at this https URL.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Safety, Robustness & Interpretability

Citations in the corpus

Scalable agent alignment via reward modeling: a research direction (2018, methodology): “The size of veriﬁed models has been pushed beyond MNIST-size to over a million parameters (Dvijotham et al., 2018b; Wong et al., 2018), which indicates that verifying practically sized RL models might soon be within reach.”
Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, methodology): “The whole CIFAR10 training set have too many points to be robustly fitted with the verifiable defense algorithm: the robust CIFAR10 classifier [62] with ε = 2/255 has the train accuracy below 70%.”
Adversarial Training for Free! (2019, background): “Recently, there has been a surge of certiﬁed defenses [Wong and Kolter, 2017, Wong et al., 2018, Raghunathan et al., 2018a,b, Wang et al., 2018].”
Exploiting Excessive Invariance caused by Norm-Bounded Adversarial Robustness (2019, background): “, 2019) and researchers working on (provable) robustness to adversarial examples have moved on to other, larger vision datasets such as CIFAR-10 (Madry et al., 2017; Wong et al., 2018) or ImageNet (Lecuyer et al.”
Certified Adversarial Robustness via Randomized Smoothing (2019, methodology): “…a panoply of practical solutions have been proposed in the literature (Wong & Kolter, 2018; Wang et al., 2018a;b; Raghunathan et al., 2018a;b; Wong et al., 2018; Dvijotham et al., 2018b;a; Croce et al., 2018; Gehr et al., 2018; Mirman et al., 2018; Singh et al., 2018; Gowal et al., 2018;…”
Efficient Formal Safety Analysis of Neural Networks (2018, background): “Another line of research has focused on strengthening network robustness either by incorporating these relaxation methods into training process [43, 8, 24] or by leveraging techniques like differential privacy [22].”
Verifying Neural Networks with Mixed Integer Programming (2017, neutral): “0; thus max(x;0) x 8 return (l best;u best) xcould be either positive or negative. The process of progressive bounds tightening is naturally extensible to more procedures. Kolter & Wong (2017); Wong et al. (2018); Dvijotham et al. (2018); Weng et al. (2018) each discuss procedures to determine b”
Robustness May Be at Odds with Accuracy (2018, neutral): “Similar eﬀects were also observed in prior and concurrent work (Kurakin et al., 2016b; Madry et al., 2017; Dvijotham et al., 2018b; Wong et al., 2018; Xiao et al., 2018b; Su et al., 2018).”
Unlabeled Data Improves Adversarial Robustness (2019, methodology): “In Figure 1b we compare RSTstab(50K+500K) to the state-of-the-art in certified `1 robustness, showing a a 10% improvement over single models, and performance on par with the cascade approach of [50].”
Are Labels Required for Improving Adversarial Robustness? (2019, background): “[48] CIFAR-10 7 - 27.”
On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models (2018, methodology): “[25], which trains models that are provably robust.”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, background): “On the bright side, these methods are more scalable and efficient which makes some of them useful for building certified defenses [38, 35, 36, 27, 28, 39, 10, 9, 7, 13, 26, 30, 15, 37, 40].”
Fast is better than free: Revisiting adversarial training (2020, background): “While certiﬁed defenses have been scaled to reasonably sized networks (Wong et al., 2018; Mirman et al., 2018; Gowal et al., 2018; Cohen et al., 2019; Salman et al., 2019), the guarantees don’t match the empirical robustness obtained through adversarial training.”
Semidefinite relaxations for certifying robustness to adversarial examples (2018, background): “[30] extended this approach to train bigger networks with improved certified error and on larger datasets.”
The Curse of Concentration in Robust Learning: Evasion and Poisoning Attacks from Concentration of Measure (2018, background): “There is also a recent line of work that which provides robustness guarantees on individual instances, up to certain degree (Kolter and Wong 2017; Raghunathan, Steinhardt, and Liang 2018; Sinha, Namkoong, and Duchi 2017; Wong et al. 2018).”
Benchmarking Adversarial Robustness on Image Classification (2020, methodology): “Certified Defenses: There are a lot of works [42, 49, 56, 57, 43, 59] on training certified defenses, which are provably guaranteed to be robust against adversarial perturbations under some threat models.”
A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks (2019, methodology): “Our results can be easily extended to networks with convolutional layers and skip connections as well, similar to what is done in Wong et al. [2018], as these can be seen as special forms of (2).”