PaperlayerView exact revision on arXiv

Source-linked AI summary

Towards Stable and Efficient Training of Verifiably Robust Neural Networks

Huan Zhang, Hongge Chen, Chaowei Xiao, Sven Gowal, Robert Stanforth, Bo Li, Duane Boning, Cho-Jui Hsieh

arXiv:1906.06316v2cs.LGcs.CRstat.ML

TL;DR

Training verifiably robust neural networks requires bounds that are both computationally manageable and sufficiently tight for stable optimization. The paper proposes CROWN-IBP, combining IBP forward bounds with CROWN backward bounds, and reports consistent improvements over IBP baselines and state-of-the-art verified errors for ℓ∞ robustness.

  • Problem

    Linear-relaxation bounds can increase training time by hundreds of times, while IBP is efficient but unstable because its bounds are initially loose.

  • Method

    CROWN-IBP combines an IBP-based forward bounding pass with a tight CROWN-style backward bounding pass inside certified adversarial training.

  • Results

    CROWN-IBP consistently outperforms IBP baselines and achieves state-of-the-art verified test errors for ℓ∞ robustness on MNIST and CIFAR-10.

  • Takeaways & Limitations

    CROWN-IBP provides an efficient and flexible certified-defense approach that can trade off standard and verified accuracy through training settings.

  • Takeaways & Limitations

    Pure IBP training can diverge or require an ϵ schedule and mixed loss to stabilize optimization, motivating CROWN-IBP's design.

Abstract

from arXiv · show

Training neural networks with verifiable robustness guarantees is challenging. Several existing approaches utilize linear relaxation based neural network output bounds under perturbation, but they can slow down training by a factor of hundreds depending on the underlying network architectures. Meanwhile, interval bound propagation (IBP) based training is efficient and significantly outperforms linear relaxation based methods on many tasks, yet it may suffer from stability issues since the bounds are much looser especially at the beginning of training. In this paper, we propose a new certified adversarial training method, CROWN-IBP, by combining the fast IBP bounds in a forward bounding pass and a tight linear relaxation based bound, CROWN, in a backward bounding pass. CROWN-IBP is computationally efficient and consistently outperforms IBP baselines on training verifiably robust neural networks. We conduct large scale experiments on MNIST and CIFAR datasets, and outperform all previous linear relaxation and bound propagation based certified defenses in $\ell_\infty$ robustness. Notably, we achieve 7.02% verified test error on MNIST at $ε=0.3$, and 66.94% on CIFAR-10 with $ε=8/255$. Code is available at https://github.com/deepmind/interval-bound-propagation (TensorFlow) and https://github.com/huanzhang12/CROWN-IBP (PyTorch).

1 INTRODUCTION

Verifiable robustness training must balance computational cost, bound tightness, and training stability. CROWN-IBP combines efficient IBP forward bounds with tighter CROWN backward bounds and achieves strong verified robustness on MNIST and CIFAR-10.

  • Linear relaxation methods can increase training time by hundreds of times despite providing tractable robust-optimization bounds.These methods construct convex adversarial polytopes through linear relaxations of neural networks.
  • IBP is efficient and achieves state-of-the-art verified error on many datasets, but its initially loose bounds can destabilize training and increase hyperparameter sensitivity.
  • CROWN-IBP combines a fast IBP forward bounding pass with a tight CROWN convex-relaxation backward pass.The backward pass scales linearly with neural-network output size and is efficient for low-dimensional outputs.
  • 7.02% IBP verified error is achieved on MNIST at ℓ∞ distortion ϵ = 0.3, compared with 8.55% for the IBP baseline.At ϵ = 0.4, the corresponding verified errors are 12.06% for CROWN-IBP and 15.01% for IBP.
  • 46.03% verified error is achieved on CIFAR-10 at ϵ = 2/255, down from 55.88% with IBP, while larger ϵ values yield a noticeable advantage over other methods.

2 RELATED WORK AND BACKGROUND

Robustness verification seeks tractable bounds on network outputs because exact ranges are computationally difficult. Certified adversarial training uses upper bounds of robust loss, while IBP and linear-relaxation approaches trade off scalability, tightness, and stability.

  • Exact neural-network output ranges are non-convex and NP-complete to compute, motivating relatively tight tractable bounds.
  • PGD-based adversarial training does not provide verified error guarantees because PGD computes only a lower bound of the inner maximization.Failure to find a high-loss perturbation does not establish that no such perturbation exists.
  • Certified adversarial training instead computes an upper bound of the inner maximum and updates model parameters using that bound.Minimizing this upper bound preserves the robust-optimization guarantee described in the paper.
  • Linear-relaxation training provides upper bounds but is computationally expensive because convex adversarial-polytope propagation is costly.
  • IBP scales to larger networks and can outperform prior results, but its loose initial bounds make training unstable and difficult to tune.Gowal et al. mitigate this instability with a mixture of regular and minimax robust cross-entropy loss.

3 METHODOLOGY

CROWN-IBP combines efficient IBP propagation with tighter CROWN bounds to stabilize certified training while reducing the computational cost of linear-relaxation methods.

  • Verification framework: Certified robustness is evaluated through lower bounds on class margins over norm-bounded perturbation sets.If every lower-bounded margin is positive, the input is verifiably robust.
  • IBP and linear relaxation: IBP is efficient and can perform well at large ε, but its loose initial bounds make training unstable and sensitive to hyperparameters.Pure IBP frequently diverges, motivating schedules and mixed natural and robust losses.
  • IBP and linear relaxation: Linear-relaxation training can over-regularize networks at large ε by driving weight norms downward, potentially reducing capacity and increasing verified error.In the MNIST analysis, the second CNN-layer norm begins decreasing around ε = 0.2, approximately at epoch 40.
  • CROWN-IBP: CROWN-IBP uses an IBP forward pass for intermediate bounds and a CROWN backward pass for tighter output bounds.The backward pass propagates a small specification matrix using transposed operators and scales with output size.
  • CROWN-IBP: CROWN-IBP reduces bound-propagation complexity from O(Ln^2(Ln + nL)) to O(Ln^2nL), avoiding ordinary CROWN’s quadratic dependence on depth.The IBP forward pass takes twice regular forward-propagation time, while backward propagation is O((L −1)nLn^2).

4 EXPERIMENTS

Experiments compare CROWN-IBP with IBP across datasets, perturbation settings, κ schedules, and model architectures. CROWN-IBP consistently improves verified performance and the standard–verified accuracy trade-off, while stability is evaluated across models and ramp-up schedules.

  • Comparison to IBP: 7.02% verified error replaces 8.21% for IBP on MNIST at ε = 0.3.
  • Comparison to IBP: 46.03% verified error replaces 55.88% for IBP on CIFAR-10 at ε = 2/255.
  • Trade-off Between Standard Accuracy and Verified Accuracy: At verified error 70%, CROWN-IBP reduces standard error from roughly 55% to 45%.Across κ settings, lower verified errors generally accompany higher standard errors, but CROWN-IBP improves both metrics and shifts the Pareto front lower-left.
  • Comparison to IBP: CROWN-IBP outperforms IBP under all κ settings on MNIST and CIFAR-10 across the reported perturbation strengths.Table 2 reports standard, verified, and PGD attack errors for DM-large models.
  • Training Stability: CROWN-IBP performs better consistently across schedule lengths, while IBP with κ = 0 may fail to stably converge on all models when schedules are short.The stability experiments cover multiple small and medium architectures on MNIST and CIFAR-10.

5 CONCLUSIONS

The paper concludes that CROWN-IBP combines IBP efficiency with CROWN tightness to stabilize certified training. Experiments support consistent improvements over IBP baselines and state-of-the-art verified errors for ℓ∞ robustness.

  • 5 CONCLUSIONS: CROWN-IBP combines a fast IBP forward bounding pass with a tight CROWN backward bounding pass.The backward CROWN bound scales linearly with neural network output size.
  • 5 CONCLUSIONS: CROWN-IBP consistently outperforms IBP baselines in standard and verified errors and achieves state-of-the-art ℓ∞ verified test errors.The paper reports this conclusion across MNIST and CIFAR-10 experiments.
  • 5 CONCLUSIONS: IBP training can be viewed as training a simple augmented ReLU network whose inputs are xk − ε and xk + ε.Its negated lower-bound margins are passed to softmax, and correct prediction corresponds to positive margins throughout the perturbation interval.
  • 5 CONCLUSIONS: IBP bounds are initially loose, making robust-loss optimization ineffective and training sensitive to initialization, κ, and schedule length.This instability can produce large performance variance and sub-optimal verified errors.
  • 5 CONCLUSIONS: CROWN-IBP begins with tighter bounds and gradually replaces them with IBP bounds, allowing the network to learn tighter IBP bounds during training.The described transition uses βstart = 1 and βend = 0.

D HYPERPARAMETERS AND MODEL STRUCTURES FOR TRAINING STABILITY EXPERIMENTS

Training-stability experiments use many small and medium models with short, controlled single-GPU runs. MNIST and CIFAR settings vary warmup, ε ramp-up, optimization, augmentation, and model structures.

  • MNIST: MNIST training uses 100 epochs, batch size 256, one warmup epoch, and an ε ramp-up schedule of length 60.Adam uses learning rate 5 × 10^-4, with no data augmentation.
  • CIFAR: CIFAR training uses 200 epochs, batch size 128, ten warmup epochs, and an ε ramp-up schedule of length 120.Training uses random flips and crops, with the three channels normalized by dataset statistics.
  • Verification setting: All reported verified errors are evaluated with IBP after ε reaches the target training value, except CIFAR ε = 2/255, evaluated with β = 1 using CROWN-IBP.
  • Models and training settings: 18 MNIST and 17 CIFAR-10 architectures are evaluated in the stability experiments, using small and medium model groups.Models A–J are small; models K–T are medium, with model A excluded from CIFAR-10 because it is too small.

E OMITTED RESULTS ON DM-SMALL AND DM-MEDIUM MODELS

Across model structures and κ settings, CROWN-IBP consistently outperforms IBP in the reported MNIST and CIFAR-10 experiments.

  • CROWN-IBP consistently outperforms IBP for every evaluated model structure and κ setting.The comparison covers DM-Small, DM-Medium, and DM-Large models.
  • The experiments use three model structures from the DM-Small, DM-Medium, and DM-Large families.These models are evaluated on MNIST and CIFAR-10 datasets.
  • The reported analysis evaluates IBP and CROWN-IBP under the same three κ settings.

F ADDITIONAL EXPERIMENTS ON SMALLER MODELS USING A SINGLE GPU

Additional single-GPU experiments compare IBP and CROWN-IBP across many smaller models, while documenting an MNIST small-ε overfitting condition and evaluation details.

  • The experiments compare performance statistics across a wide range of smaller MNIST and CIFAR-10 models rather than a few hand-selected models.Models are trained on a single GPU, with best, median, and worst verified and clean test errors reported.
  • Small-ε MNIST experiments with εtrain = εtest exhibit overfitting, producing verified errors worse than those obtained in the main settings.The issue can be alleviated by using εtrain > εtest or explicit ℓ1 regularization.
  • CROWN-IBP outperforms IBP under the same κ setting and achieves state-of-the-art ℓ∞ robustness on MNIST and CIFAR datasets across all ε.
  • The reported comparisons use IBP verified errors from Gowal et al. (2018) for fairness against their more computationally expensive MIP and LP evaluations.
  • Gowal et al.'s 68.44% IBP verified error requires an additional PGD adversarial training loss, while 72.91% LP/MIP or 73.52% IBP verified error is achievable without PGD.
  • For one setting, βstart = βend = 1, so the CROWN-IBP bound is used to evaluate verified error.
  • Figure C summarizes verified error over schedule lengths 30, 60, 90, and 120 for nine CIFAR-10 small models using medians and best-to-worst error bars.

G REPRODUCIBILITY

Repeated MNIST runs provide evidence that CROWN-IBP produces reproducible verified and standard test errors across the evaluated models.

  • Standard deviations of verified errors are very small across five runs of each MNIST experiment.The experiments cover 10 MNIST models and report means and standard deviations for verified and standard errors.
  • Each of the 10 MNIST models is trained five times to compute mean and standard deviation estimates.

H TRAINING STABILITY EXPERIMENTS ON OTHER ϵ

Across varied ε schedule lengths and κ settings, CROWN-IBP improves training stability and consistently outperforms IBP in the reported MNIST and CIFAR-10 experiments.

  • CROWN-IBP consistently outperforms IBP across different ε schedule lengths and κ settings.The comparison uses schedule lengths 10, 15, 30, and 60 on MNIST, and 30, 60, 90, and 120 on CIFAR-10.
  • The stability experiments compare best, worst, and median verified errors across 18 MNIST models and nine CIFAR-10 small models.Error bars represent worst and best verified errors, while solid boxes represent median values.
  • The results indicate that CROWN-IBP can improve training stability under varied ε schedules.

I OVERFITTING ISSUE WITH SMALL ϵ

For small ϵ, CROWN-IBP can overfit, while shorter ϵ schedules and small ℓ1 regularization improve verified test error. Across tested schedule lengths, CROWN-IBP achieves the best verified errors.

  • CROWN-IBP can overfit at small ϵ because its training verified error becomes very small, sometimes exactly zero.The authors attribute this to IBP’s strong learning power without sufficient over-regularization.
  • Shorter ϵ schedules improve verified error for small ϵ because early stopping prevents overfitting.Figure D compares schedule lengths 10, 15, 30, and 60 on 8 medium MNIST models.
  • All best verified errors are achieved by CROWN-IBP regardless of schedule length on the tested MNIST models.This result is reported for both 8 medium models and 10 small models.
  • A small ℓ1 regularization term improves CROWN-IBP’s verified test error when ϵ_train = 0.1 or 0.2.With λ = 5 × 10^-5, CROWN-IBP reaches 3.60% best certified error at ϵ = 0.1, versus 3.67% for convex adversarial polytope training on the reported models.

J TRAINING TIME

CROWN-IBP substantially reduces the training-time cost of tight certified bounds compared with purely linear-relaxation methods, while remaining moderately slower than IBP.

  • CROWN-IBP is practically 1.5 to 3.5 times slower than IBP on representative models.Experiments were measured on RTX 2080 Ti GPUs, using 4 GPUs for two DM-Large models.
  • Theoretically, CROWN-IBP is up to 10 times slower than IBP.The footnote specifies a more precise upper factor of 9 times because an all-zero row can be omitted from the specification matrix.
  • Purely linear-relaxation methods can be over hundreds times slower than IBP, especially on deeper networks.The paper uses 50 random Cauchy projections for the convex adversarial polytope comparison, but random projections alone do not scale to larger datasets.
  • The timing comparison covers IBP, CROWN-IBP, and convex adversarial polytope training under GPU and batch-size settings specified in Table G.The reported batch sizes are 256 for MNIST and 128 for CIFAR-10 for IBP and CROWN-IBP.

K REPRODUCING CIFAR-10 RESULTS ON MULTI-GPUS

The paper evaluates CROWN-IBP across TPU and multi-GPU implementations and describes the CROWN bounds used within its propagation procedure. GPU training produces comparable verified errors to TPU training.

  • Reproducing CIFAR-10 results on multi-GPUs: GPU training achieves verified errors comparable to TPU training for the CIFAR-10 DM-Large models.The reported GPU–TPU differences are around ±0.5%.
  • CROWN-IBP bound construction: CROWN replaces nonlinear activations with linear upper and lower hyperplanes, allowing linear bounds to propagate through network layers.The framework can handle activations including ReLU, tanh, sigmoid, and max-pooling when suitable bounds are provided.
  • ReLU relaxation: For ReLU neurons, CROWN uses diagonal relaxation matrices whose coefficients depend on whether neurons are always active, always inactive, or otherwise unstable.The listed cases assign coefficients 1, 0, or α with 0 ≤ α ≤ 1, depending on the pre-activation range.
  • CROWN-IBP bound construction: CROWN-IBP uses IBP to obtain pre-activation bounds required by CROWN-style linear bounds.These bounds are assumed valid for all inputs in the perturbation set S.
  • CROWN lower bound: The general CROWN lower-bound theorem provides an output bound for every class of an L-layer network over the input set S.The construction uses network weight matrices, ReLU relaxation matrices, and a standard unit vector for the selected output neuron.
  • CROWN-IBP implementation: CROWN-IBP computes only the lower bound needed for m, avoiding upper-bound A matrices and saving half the computation cost of ordinary CROWN.Affine layers, including CNN convolutional layers, are supported; transposed convolutions implement the procedure efficiently on GPUs.
  • Scope: Although the paper focuses on ReLU activations, CROWN supports other general activation functions.The authors refer to prior work for the more general derivation.
Loading 1906.06316v2…