On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models

By Sven Gowal, Krishnamurthy (Dj) Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovi'c, Timothy A. Mann, Pushmeet Kohli. 2018

640 citations recorded by the source corpus.

Recent work has shown that it is possible to train deep neural networks that are provably robust to norm-bounded adversarial perturbations. Most of these methods are based on minimizing an upper bound on the worst-case loss over all possible adversarial perturbations. While these techniques show promise, they often result in difficult optimization procedures that remain hard to scale to larger networks. Through a comprehensive analysis, we show how a simple bounding technique, interval bound propagation (IBP), can be exploited to train large provably robust neural networks that beat the state-of-the-art in verified accuracy. While the upper bound computed by IBP can be quite weak for general networks, we demonstrate that an appropriate loss and clever hyper-parameter schedule allow the network to adapt such that the IBP bound is tight. This results in a fast and stable learning algorithm that outperforms more sophisticated methods and achieves state-of-the-art results on MNIST, CIFAR-10 and SVHN. It also allows us to train the largest model to be verified beyond vacuous bounds on a downscaled version of ImageNet.

Subfields: Artificial Intelligence, Control and Systems Engineering, Safety, Robustness & Interpretability

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Control and Systems Engineering

In Safety, Robustness & Interpretability

Citations in the corpus

Privacy Risks of Securing Machine Learning Models against Adversarial Examples (2019, methodology): “model to misbehave on some test inputs [6, 27, 43]. In response to these attacks, the security community has designed new training algorithms to secure machine learning models against evasion attacks [16, 33, 34, 50, 61, 66] or poisoning attacks [24, 55]. In the privacy domain, the adversary aims to”
Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, methodology): “Veriﬁcation methods are now applicable to multi-layer neural networks using techniques ranging from semi-deﬁnite programming relaxations (Raghunathan et al., 2018), mixed integer linear programming (Tjeng et al., 2019), and duality (Dvijotham et al., 2018).”
Certified Adversarial Robustness via Randomized Smoothing (2019, background): “…have been proposed in the literature (Wong & Kolter, 2018; Wang et al., 2018a;b; Raghunathan et al., 2018a;b; Wong et al., 2018; Dvijotham et al., 2018b;a; Croce et al., 2018; Gehr et al., 2018; Mirman et al., 2018; Singh et al., 2018; Gowal et al., 2018; Weng et al., 2018a; Zhang et al., 2018).”
Continual Learning with Guarantees via Weight Interval Constraints (2022, methodology): “These operations are independent of each other, so as explained in Gowal et al. (2018) we can implement them efficiently for GPUs by calculating the center prediction and the intervals in parallel.”
On Evaluating Adversarial Robustness (2019, background): “While work in this space does exist (Katz et al., 2017; Tjeng et al., 2019; Xiao et al., 2019; Gowal et al., 2018), it is often computationally intractable to verify even modestly sized neural networks.”
Unlabeled Data Improves Adversarial Robustness (2019, background): “Other lines of work attain certified robustness, though often at a cost to empirical robustness compared to heuristics [36, 49, 37, 50, 17].”
Are Labels Required for Improving Adversarial Robustness? (2019, background): “01 respectively, which are standard for studying adversarial robustness of image classifiers [18, 30, 54, 48].”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, background): “On the bright side, these methods are more scalable and efficient which makes some of them useful for building certified defenses [38, 35, 36, 27, 28, 39, 10, 9, 7, 13, 26, 30, 15, 37, 40].”
Fast is better than free: Revisiting adversarial training (2020, background): “have been scaled to reasonably sized networks (Wong et al., 2018; Mirman et al., 2018; Gowal et al., 2018; Cohen et al., 2019; Salman et al., 2019), the guarantees don’t match the empirical robustness obtained through adversarial training.”
Lipschitz-Certifiable Training with a Tight Outer Bound (2020, methodology): “Thus, for (cid:96) ∞ -bound, BCP can be considered as a generalized version of IBP (Interval Bound Propagation) [13].”
Adversarial Examples on Object Recognition (2020, positive): “Statistical Detection [67] Guard - Adversarial Detector * ** ** ** Binary Classification [62] Guard - Adversarial Detector * ** * * In-Layer Detection [117] Guard - Adversarial Detector * ** *** ** Detecting from Artifacts [52] Guard - Adversarial Detector * ** ** ** SafetyNet [111] Guard - Adversar”
Interpretable and Trustworthy Deepfake Detection via Dynamic Prototypes (2021, background): “The importance of safety veriﬁcation, especially in critical domains such as healthcare or autonomous driving, was highlighted when the discovery of adversarial attacks [57, 22] prompted many lines of work in robust veriﬁcation in ML [32, 28, 23, 25, 68, 10, 39].”
Blind Backdoors in Deep Learning Models (2020, background): “Finally, we report the performance overhead of our attacks and discuss better defenses, including certified robustness [27, 71] and trusted computational graphs.”
Sponge Examples: Energy-Latency Attacks on Neural Networks (2020, methodology): “‘Max density’ refers to the largest possible density obtained through IBP.”
advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch (2019, methodology): “Robust Training: Adversarially augmented training (Kurakin et al., 2016; Madry et al., 2017; Ding et al., 2018) and provably robust training (Wong and Kolter, 2018; Mirman et al., 2018; Gowal et al., 2018) have been shown to be the most eﬀective methods against worst-case perturbations.”
Overfitting in adversarially robust deep learning (2020, background): “…Zhang et al., 2019b), randomized smoothing (Cohen et al., 2019; Lecuyer et al., 2019; Salman et al., 2019a), distributional robustness (Sinha et al., 2017), abstract interpretations (Gehr et al., 2018; Mirman et al., 2018; Singh et al., 2018), and interval bound propagation (Gowal et al., 2018).”
Certifying LLM Safety against Adversarial Prompting (2023, methodology): “They use techniques such as interval-bound propagation (Gowal et al., 2018; Huang et al., 2019; Dvijotham et al., 2018; Mirman et al., 2018), curvature bounds (Wong & Kolter, 2018; Raghunathan et al.”
Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations (2020, methodology): “, the dual network in Wong & Kolter [79]), and computingRs(θμ) is only a constant factor slower than computingRs(s, θμ) (for a fixed s) when an efficient relaxation [44, 19, 88] is used.”
Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models (2019, methodology): “[2018] or malware detection Grosse et al. [2017], where security is a priority.”