Towards Stable and Efficient Training of Verifiably Robust Neural Networks

By Huan Zhang, Hongge Chen, Chaowei Xiao, Bo Li, Duane S. Boning, Cho-Jui Hsieh. 2019

393 citations recorded by the source corpus.

Training neural networks with verifiable robustness guarantees is challenging. Several existing approaches utilize linear relaxation based neural network output bounds under perturbation, but they can slow down training by a factor of hundreds depending on the underlying network architectures. Meanwhile, interval bound propagation (IBP) based training is efficient and significantly outperforms linear relaxation based methods on many tasks, yet it may suffer from stability issues since the bounds are much looser especially at the beginning of training. In this paper, we propose a new certified adversarial training method, CROWN-IBP, by combining the fast IBP bounds in a forward bounding pass and a tight linear relaxation based bound, CROWN, in a backward bounding pass. CROWN-IBP is computationally efficient and consistently outperforms IBP baselines on training verifiably robust neural networks. We conduct large scale experiments on MNIST and CIFAR datasets, and outperform all previous linear relaxation and bound propagation based certified defenses in $\ell_\infty$ robustness. Notably, we achieve 7.02% verified test error on MNIST at $\epsilon=0.3$, and 66.94% on CIFAR-10 with $\epsilon=8/255$. Code is available at this https URL (TensorFlow) and this https URL (PyTorch).

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Emergency Medicine

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Emergency Medicine

Citations in the corpus

Relating Adversarially Robust Generalization to Flat Minima (2021, background): “Besides certified and provable defenses [22, 138, 66, 147, 146, 130, 41, 39, 84, 113, 72, 23], adversarial training (AT) has become the de-facto standard, as discussed in the main paper.”
Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (2020, neutral): “, `2 and `∞) perturbations (Cohen et al., 2019; Wong & Kolter, 2018; Tsuzuku et al., 2018; Lécuyer et al., 2019; Weng et al., 2018; Balunovic & Vechev, 2020; Zhang et al., 2020).”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, methodology): “We highlight the work by Zhang et al. (2019a) who proposed TRADES which balances the trade-off between standard and robust accuracy, and the work by Carmon et al. (2019); Uesato et al. (2019); Najaﬁ et al. (2019); Zhai et al. (2019) who simultaneously proposed the use of additional unlabeled data…”
Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond (2020, methodology): “In addition, while interval bound propagation (IBP) [30, 11] that propagates constant bounding intervals can be easily extended to general computational graphs, bounds computed by IBP can be very loose and make stable training challenging [56].”
Blind Backdoors in Deep Learning Models (2020, background): “Certification techniques include [11, 27, 71, 99]; certification can also help defend against data poisoning [83].”
Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification (2021, background): “The main beneﬁt of CROWN is its efﬁciency: CROWN can be efﬁciently implemented on machine learning accelerators such as GPUs [44] and TPUs [47], and it can be a few magnitudes faster than an LP veriﬁer which is hard to parallelize on GPUs.”
Overfitting in adversarially robust deep learning (2020, methodology): “Robust overﬁtting is also not speciﬁc to PGD-based adversarial training, and affects faster adversarial training methods such as FGSM adversarial training 3 (Wong et al., 2020) as well as top performing algorithms for adversarially robust training such as TRADES (Zhang et al., 2019c).”
Globally-Robust Neural Networks (2021, background): “Meanwhile, a large volume of prior work applies `∞-specific certification strategies that proven effective for `∞ certification (Zhang et al., 2020; Balunovic & Vechev, 2020; Gowal et al., 2019).”
Lipschitz-Certifiable Training with a Tight Outer Bound (2020, methodology): “In contrast, layer-wise propagation approach proposed the worst-case logit or the certiﬁable margin in the logit space to obtain a differentiable upper bound on the robust classiﬁcation error [36, 13, 44].”
Geometry-aware Instance-reweighted Adversarial Training (2020, methodology): “We believe this degradation is due to the mismatch between PGD-adversarial training and C&W attacks, which is the common deflect of the empirical defense (Tsuzuku et al., 2018; Wong & Kolter, 2018; Cohen et al., 2019; Balunovic & Vechev, 2020; Zhang et al., 2020a).”
Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations (2020, methodology): “, the dual network in Wong & Kolter [79]), and computingRs(θμ) is only a constant factor slower than computingRs(s, θμ) (for a fixed s) when an efficient relaxation [44, 19, 88] is used.”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, background): “Interestingly, the most (empirically) resistant model on MNIST is one trained for obtaining provable certificates on the exact robust accuracy, and comes with a verified lower bound on it of 93.32% (Zhang et al., 2020).”
Trustworthy AI: From Principles to Practices (2021, background): “To address the issue that the exact computation of such bounds is intractable for large networks, various relaxations or approximations, such as References [352, 378], have been proposed as alternatives to regularization.”