Automatic Perturbation Analysis on General Computational Graphs

2020·Arxiv

Abstract

Abstract

Linear relaxation based perturbation analysis (LiRPA) for neural networks, which computes provable linear bounds of output neurons given a certain amount of input perturbation, has become a core component in robustness verification and certified defense. The majority of LiRPA-based methods focus on simple feed-forward networks and need particular manual derivations and implementations when extended to other architectures. In this paper, we develop an automatic framework to enable perturbation analysis on any neural network structures, by generalizing existing LiRPA algorithms such as CROWN to operate on general computational graphs. The flexibility, differentiability and ease of use of our framework allow us to obtain state-of-the-art results on LiRPA based certified defense on fairly complicated networks like DenseNet, ResNeXt and Transformer that are not supported by prior works. Our framework also enables loss fusion, a technique that significantly reduces the computational complexity of LiRPA for certified defense. For the first time, we demonstrate LiRPA based certified defense on Tiny ImageNet and Downscaled ImageNet where previous approaches cannot scale to due to the relatively large number of classes. Our work also yields an open-source library for the community to apply LiRPA to areas beyond certified defense without much LiRPA expertise, e.g., we create a neural network with a provably flat optimization landscape by applying LiRPA to network parameters. Our open source library is available at https://github.com/KaidiXu/auto_LiRPA.

1 Introduction

Bounding the range of a neural network outputs given a certain amount of input perturbation has become an important theme for neural network verification and certified adversarial defense [47, 30, 44, 56]. However, computing the exact bounds for output neurons is usually intractable [20]. Recent research studies have developed perturbation analysis bounds that are sound, computationally feasible, and relatively tight [47, 53, 39, 46, 37, 45]. For a neural network function , to study its behaviour at with bounded perturbation such that (e.g., S is a norm ball around ), these works provide two linear functions guaranteed lower and upper bounds respectively for output neurons w.r.t. the input under perturbation: . We refer to this line of work as a Linear Relaxation based Perturbation Analysis (LiRPA). Beyond its usage in neural network verification and certified defense, LiRPA is capable to serve as a general toolbox to understand the behavior of deep neural networks (DNNs) within a predefined input region, and has been demonstrated useful for interpretation and explanation of DNNs [23, 36].

To compute LiRPA bounds, the first step is to obtain linear relaxations of any non-linear units [53, 35] (e.g., activation functions) in a network. Then, these relaxations need to be “glued” together according to the network structure to obtain the final bounds. Early developments of LiRPA focused on feed-forward networks, and it has been extended to a few more complicated network structures for real-world applications. For example, Wong et al. [49] implemented LiRPA for convolutional ResNet on computer vision tasks; Zügner & Günnemann [58] extended [47] to graph convolutional networks; Ko et al. [23] and Shi et al. [36] extended CROWN [53] to recurrent neural networks and Transformers respectively. Unfortunately, each of these works extends LiRPA with an ad-hoc implementation that only works for a specific network architecture. This is similar to the “pre-automatic differentiation” era where researchers have to implement gradient computation by themselves for their designed network structure. Since LiRPA is significantly more complicated than backpropagation, non-experts in neural network verification can find it challenging to understand and use LiRPA for their purpose.

Our paper takes a big leap towards making LiRPA a useful tool for general machine learning audience, by generalize existing LiRPA algorithms to general computational graphs. Our framework is a superset of many existing works [48, 53, 46, 23, 36], and our automatic perturbation analysis algorithm is analogous to automatic differentiation. Our algorithm can compute LiRPA automatically for a given PyTorch model without manual derivation or implementation for the specific network architecture. Importantly, our LiRPA bounds are differentiable which allows efficient training of these bounds. In addition, our proposed framework enables the following contributions:

• The flexibility and ease-of-use of our framework allow us to easily obtain state-of-the-art certified defense results for fairly complicated networks, such as DenseNet, ResNeXt and Transfomer that no existing work supports due to tremendous efforts required for manual LiRPA implementation.

• We propose loss fusion, a technique that significantly reduces the computational complexity of LiPRA for certified defense. We demonstrate the first LiPRA-based certified defense training on Tiny ImageNet and Downscaled ImageNet [4], with a two-magnitude improvement on training efficiency. • Our framework allows flexible perturbation specifications beyond -balls. For example, we demonstrate a dynamic programming approach to concretize linear bounds under discrete perturbation of synonym-based word substitution in a sentiment analysis task.

• We showcase that LiRPA can be a valuable tool beyond adversarial robustness, by demonstrating how to create a neural network with a provably flat optimization landscape and revisit a popular hypothesis on generalization and the flatness of optimization landscape. This is enabled by our unified treatment and automatic derivation of LiRPA bounds for parameter space variables (model weights).

2 Background and Related Work

Giving certified lower and upper bounds for neural networks under input perturbations is the core problem in robustness verification of neural networks. Early works formulated robustness verification for ReLU networks as satisfiability modulo theory (SMT) and integer linear programming (ILP) problems [9, 20, 42], which are hardly feasible even for a MNIST-scale small network. Wong & Kolter [48] proposed to relax the verification problem with linear programming and investigated its dual solution. Many other works have independently discovered similar algorithms [7, 30, 37, 46, 53, 39, 45] in either primal or dual space which we refer to as linear relaxation based perturbation analysis (LiRPA). Recently, Salman et al. [35] unified these algorithms under the framework of convex relaxation. Among them, CROWN [53] and DeepPoly [39] achieve the tightest bound for efficient single neuron linear relaxation and are representative algorithms of LiRPA. Several further refinements for the LiRPA bounding process were also proposed recently, including using an optimizer to choose better linear bounds [6, 28], relaxing multiple neurons [38] or further tighten convex relaxations [41], but these methods typically involve much higher computational costs. The contribution of our work is to extend LiRPA to its most general form, and allow automatic derivation and computation for general network architectures. Additionally, our framework allows a general purpose perturbation analysis for any nodes in the graph and flexible perturbation specifications, not limiting to perturbations on input nodes or -ball perturbation specifications. This allows us to use LiRPA as a general tool beyond robustness verification.

The neural network verification problem can also be solved via many other techniques, for example, semidefinite programming [8, 32], bounding local or global Lipschitz constant [14, 32, 55]. However, LiRPA based verification methods typically scale much better than alternatives, and they are a keystone for many state-of-the-art certified defense methods. Certified adversarial defenses typically seek for a guaranteed upper bound on test error, which can be efficiently obtained using LiRPA bounds. By incorporating the bounds into the training process (which requires them to be efficient and differentiable), a network can become certifiably robust [47, 30, 44, 11, 54]. In addition, while interval bound propagation (IBP) [30, 11] that propagates constant bounding intervals can be easily extended to general computational graphs, bounds computed by IBP can be very loose and make stable training challenging [56]. Along with these methods, randomization based probabilistic defenses have been proposed [5, 27, 26, 34], but in this work we mostly focus on LiRPA based deterministic certified defense method.

Backpropagation [33] is a classic algorithm to compute the gradients of a complex error function. It can be applied automatically once the forward computation is defined, without manual derivation of gradients. It is essential in most deep learning frameworks, such as TensorFlow [1] and PyTorch [31]. The backward bound propagation in our framework is analogous to backpropagation as our computation is also automatic given the computational graph created by forward propagation, but we aim to automatically derive bounds for output neurons instead of gradients. Our algorithm is significantly more complicated. On the other hand, LiRPA based bounds have been implemented manually in many previous works [48, 53, 44, 29], but they mostly focus on specific types of networks (e.g., feedforward or residual networks) for their empirical study, and do not have the flexibility to generalize to general computational graphs and irregular networks.

3 Algorithm

3.1 Framework of Perturbation Analysis on General computational Graphs

Notations We define a computational graph as a Directed Acyclic Graph (DAG) G = (V, E). is a set of nodes in G. E is a set of node pairs (i, j) which denotes that node i is an input argument of node j. For simplicity, we denote the in-degree of node i as m(i), and the set of input nodes for node i as where . Each node i has a few associated attributes: is the associated computation function, is the vector produced by node i. Although can be a tensor in practice, we assume it has been flattened into a vector for simplicity in this paper. Each node i is either an independent node with m(i) = 0 representing the input nodes of the graph (e.g., network parameters, model inputs), or a dependent node representing some computations (e.g., ReLU, MatMul). For independent nodes, is an identity function and we denote be the concatenation of all , such that the output of each node i can be written as a function of , without explicitly referring to . Without losing generality, we assume that the computational graph has a single output node o. To conduct perturbation analysis, we consider to be arbitrarily taken from an input space . In particular, if is not perturbed, and is a constant vector. We denote S to be the space of X when each part of , is perturbed within respectively.

Linear Relaxation based Perturbation Analysis (LiRPA) Our final goal is to compute provable lower and upper bounds for the value of output node , i.e., lower bound and upper bound

(element-wise), when X is perturbed within . In LiRPA, we find tight lower and upper bounds by first computing linear bounds w.r.t. X:

where is bounded by linear functions of X with parameters . We generalize existing LiRPA approaches into two categories: forward mode perturbation analysis and backward mode perturbation analysis. Both methods aim to obtain bounds (1) in different manners:

• Forward mode: forward mode LiRPA propagates the linear bounds of each node w.r.t. all the independent nodes, i.e., linear bounds w.r.t. X, to its successor nodes in a forward manner, until reaching the output node o.

• Backward mode: backward mode LiRPA propagates the linear bounds of output node o w.r.t. dependent nodes to further predecessor nodes in a backward manner, until reaching all the independent nodes.

We describe these two different modes in details below.

Forward Mode LiRPA on General Computation Graphs For each node i on the graph, we compute the linear bounds of w.r.t. all the independent nodes:

We start from independent nodes. For an independent node so we trivially have the bounds . For a dependent node i, we have a forward LiRPA oracle function which takes for every as input and produce new linear bounds for node i, assuming all node have been bounded:

We defer the discussions on oracle function to a later section. Now, we focus on extending this method on a general graph with known oracle functions in Algorithm 1. The forward mode perturbation analysis is straightforward to extend to a general computational graph: for each dependent node i, we can obtain its bounds by recursively applying (2). We check every input node j and compute the bounds of node j if they are unavailable. We then use to obtain the linear bounds of node i. The correctness of this procedure is guaranteed by the property of as inputs, it always produces valid bounds for node i. We analyze its complexity in Appendix A.2.

Backward Mode LiRPA on General Computation Graphs For each node i, we maintain two attributes: , representing the coefficients in the linear bounds of

where d, d are bias terms that are maintained in our algorithm. Suppose that the output dimension of node , then the shape of matrices . Initially, we trivially have

which makes (3) hold true. When node i is a dependent node, we have a backward LiRPA oracle function aiming to compute the lower bound of and the upper bound of , and represent the bounds with linear functions of its predecessor nodes

We substitute the with the new bounds (5), and thereby these terms are backward propagated to the predecessor nodes and replaced by the related terms in (5). In the end, all such terms are propagated to the independent nodes and will be bounded by linear functions of independent nodes only, where (3) becomes equivalent to (1).

Figure 1: Illustration of the backward mode perturbation analysis. Node are independent nodes and the others are dependent nodes. Red arrows represent the flow of A matrices including both A and A that are propagated from the final output node (node 14) to previous nodes. Finally, only independent nodes retain non-zero A matrices (highlighted in red), and these matrices represent linear bounds w.r.t. independent nodes.

We present the full algorithm in Algorithm 2. We let denote the number of unprocessed output nodes of node i that node o depends on, which is initially obtained by a “GetOutDegree” function detailed in Appendix A.3. We use a BFS for propagating the linear bounds, starting from node o as (4). For each node i picked from the head of the queue, we backward propagate using (5). We update the bound parameters and decrease all by one. If becomes true for a dependent node j, all its related successor nodes have been processed and we push node j to the queue. We repeat this process until the queue is empty. Figure 1 illustrates the flow of backward propagating the bound parameters on an example computational graph, and Figure 2 illustrates the BFS algorithm. We show its soundness in Theorem 1 and its proof is given in Appendix B.1. Theorem 1 (Soundness of backward mode LiRPA). When Algorithm 2 terminates, we have

where are guaranteed to be 0 for all dependent nodes, and thus we obtain provable linear upper and lower bounds of node o w.r.t. all independent nodes.

Oracle Functions Oracle functions and are defined for each type of operations.1 Previous works [47, 53, 35, 36] have covered many common operations such as affine transformations, activation functions, matrix multiplication, etc. Since the major focus of this paper is on handling general computational graph structures, rather than deriving bounds for these elementary operations, we left the detailed form of these oracle functions in Appendix A.1.

Figure 2: Flowchart of the BFS in Algorithm 2. In this example, node 6 is the final output node and is the number of unprocessed output nodes of node i that node 6 depends on.

Some oracle functions depend on certain graph attributes. For example, with a nonlinear operation typically requires (typically referred to as “pre-activation bounds” in previous works). We can obtain by assuming node j as the output node and apply Algorithm 2, then concretize the linear bounds as will be discussed in Sec 3.2. However, this can be very expensive because Algorithm 2 needs to be applied for every node is required, rather than just the output node. A typically more efficient approach is to obtain for all dependent nodes except o using a cheaper method and then apply backward mode LiRPA for node o only. This leads to two variants of hybrid approaches, Forward+Backward and IBP+Backward, where produced by Foward LiRPA or IBP, respectively. For certified training, IBP+Backward (generalized from Zhang et al. [56]) is the best for efficiency. We discuss the time complexity of these methods in Appendix A.2.

3.2 General Perturbation Specifications and Bound Concretization

Once the linear bounds are obtained as (1), concrete bounds can be found by solving the following optimization problems (this step is referred to as the “concretization” of linear bounds):

We show two examples: classic -ball perturbations, and synonym-based word substitution in language tasks.

-ball Perturbations In this setting, assuming that is the clean input, the input space is defined by , which means that the actual input X is perturbed within an -ball centered at with a radius of . Linear bounds can be concretized as Zhang et al. [53]:

Synonym-based Word Substitution Beyond -ball perturbations, we show an example of a perturbation specification defined by synonym-based word substitution in language tasks. Let the clean input to the model be a sequence of words mapped to embeddings . Following a common adversarial perturbation setting in NLP [17, 19], we allow at most words to be replaced and each word can be replaced by words within its pre-defined substitution set is constructed from the synonyms of and validated with a language model. We denote each actual input word as , and we show that the linear bounds of node k can be concretized with dynamic programming (DP) in Theorem 2 as proved in Appendix B.2.

Theorem 2. Let be columns in that correspond to the coefficients of in the linear bounds. The lower bound of when j words among have been replaced, denoted as , can be computed by:

and . The concrete lower bound is . The upper bound can also be computed similarly by taking the maximum instead of the minimum in the above DP computation.

3.3 Loss Fusion for Scalable Training of Certifiably Robust Neural Networks

The optimization problem of robust training can be formulated as minimizing the robust loss:

where is the network output at the logit layer, and y is the ground truth. Let be the margin between the ground truth label and all the classes (similarly defined in Wong & Kolter [48], Zhang et al. [56]). In previous works, the cross-entropy loss is upper bounded by lower bounds on margins, as a consequence of Theorem 2 in Wong & Kolter [48]: where . This requires us to first lower bound using LiRPA. The most efficient LiRPA approach [56] used IBP+backward to obtain this bound, requiring O(Kr) time where K is the output (logit) layer size (or number of labels), and O(r) is the time complexity of a regular propagation without computing bounds (see Appendix A.2). This cannot scale to large datasets when K is large (e.g. in Tiny ImageNet K = 200; in ImageNet K = 1000).

We propose a new technique, loss fusion, which computes an upper bound of directly without as a surrogate. This is possible by treating L as the output node of the computational graph. When L is the cross entropy loss, we have , where S(X, y) = . We can thus compute a LiRPA lower bound for S(X, y) directly. This is a novel method that has not appeared in previous works and it yields two benefits. First, this reduces the time complexity of upper bounding to O(r), as now the output layer size has been reduced from K to 1. This is the first time in the literature that a tight LiRPA based bound can be computed in the same asymptotic complexity as forward propagation and IBP. Second, we show that this is not only faster, but also produces tighter bounds in certain cases:

Theorem 3. Given same concrete lower and upper bounds of as and which may be used in linear relaxation, for

where L is the cross-entropy loss, S(X, y) is the lower bound of S(X, y) by backward mode LiRPA. This theorem is proved in Appendix B.3. Intuitively, the original approach of propagating through the cross-entropy loss is similar to using IBP for bounding the loss function, but in loss fusion we treat the loss function as part of the computational graph and apply LiRPA bounds to it directly; it produces tighter bounds as we can use a tighter relaxation for the nonlinear function S(X, y).

4 Experiments

Table 2: Error rates of different certifiably trained models on CIFAR-10 and Tiny-ImageNet datasets (results on downscaled ImageNet are in Table 4). “Standard”, ‘PGD” and “verified” rows report the standard test error, test error under PGD attack, and verified test error, respectively.

Table 4: Certified defense on Downscaled ImageNet dataset. We use WideResNet in this experiment. Robust Training of Large-scale Vision Models Our loss fusion technique allows us to scale to Tiny-ImageNet [25] and downscaled ImageNet [4]; to the best of our knowledge, this is the first LiRPA based certified defense on Tiny-ImageNet and downscaled ImageNet with a large number of class labels (200 and 1000,

respectively). Besides, the automatic LiRPA bounds allow us to train certifiably robust models on complicated network architectures (WideResNet [52], DenseNet [16] and ResNeXt [51]) and achieve state-of-the-art results, where previous works use simpler models [49, 30, 44, 56] due to

Table 3: Per-epoch training time and memory usage of the 4 large models on CIFAR-10 with batch of memory. Numbers in parentheses are multiples of natural training time or memory usage. With loss fusion, LiRPA based bounds are only 3 to 5 times slower than natural training even on datasets with many labels. Without loss fusion (e.g., in [56]) LiRPA cannot scale to the TinyImageNet dataset.

Table 5: Verification and certified defense for LSTM and Transformer based NLP models. represent the number of perturbed synonym words during training and evaluation. For the most important setting , we run training with 5 different seeds and report the mean and standard deviation. stands for natural training (no robust objective); stands for evaluating clean (standard) test accuracy. “IBP+Backward (alt.)” on has an alternative training schedule focusing on the small (see Appendix C.2).

implementation difficulty. We extend CROWN-IBP [56] to the general IBP+backward approach: we use IBP to compute bounds of intermediate nodes of graph and use tight backward mode LiRPA for the bounds of the last layer. Unlike in CROWN-IBP, we apply loss fusion to avoid the time complexity dependency on the number of class labels, and we train a few state-of-the-art classification models ([56] used a simple CNN feedforward network). We compare our results to IBP training [11]. We provide detailed hyperparameters in Appendix C.1. We report results on CIFAR-10 [24] with perturbation and Tiny-ImageNet with in Table 2, and Downscaled-ImageNet [4] which has 1, 000 class labels with perturbation in Table 4. We find that in all settings, our tight LiRPA bounds improve both clean and verified errors compared to IBP. Additionally, we achieve state-of-the-art verified error of 66.62% on CIFAR-10 with , better than latest published works [11, 56, 3] in certified defense.

In Table 3, we report wall clock time and GPU memory usage for regular training, pure IBP training, LiRPA training on logit layer without loss fusion (same as [56]) and LiRPA training with loss fusion. We use the same batch size 256 for all settings and conduct the experiments on 4 Nvidia GTX 1080Ti GPUs. With loss fusion, LiRPA is efficient and only 3-4 times slower than natural training on both CIFAR-10 and Tiny ImageNet. With loss fusion, we can enable LiRPA at a cost similar to IBP, allowing us to use much tighter bounds and obtain better-verified errors than IBP (Table 2). The computational cost is significantly better than [56] which is up to 10 (number of labels) times slower than natural training on CIFAR-10, and impossible to scale to Tiny ImageNet with 200 labels or downscaled ImageNet with 1000 labels. We also report an additional comparison where we use the largest possible batch size rather than a fixed batch size in each setting in Appendix C.1.

Verifying and Training Robust NLP Models Previous works were only able to implement simple algorithms such as IBP on simple (e.g. CNN and LSTM) NLP models [19, 17] for certified defense. None of them can handle complicated models like Transformer [43] or train with tighter LiRPA bounds. We show that our algorithm can train certifiably robust models for LSTM and Transfomrer sentiment classifiers on SST-2 [40]. We consider synonym-based word substitution with (up

Figure 3: Application of applying LiRPA bounds to network parameters to obtain a model with a provably “flat” loss surface. (a) Test accuracy of naturally trained models and “flat” objective trained models on MNIST and FashionMNIST with different combinations of data size and batch size. (b) The training loss landscape of models trained with nature and flat objective on 10% data of MNIST with 0.1N batch size. We plot the loss surface along the gradient direction and a random direction.

to 6 word substitutions). We provide more backgrounds and training details in Appendix C.2. In Table 5, we first verify normally trained () LSTM and Transformer. Unfortunately, most configurations cannot yield a non-trivial verified accuracy (larger than 1%), except for the case of using the forward mode and forward+backward mode perturbation analysis on a Transformer. We then conduct certified defense with using IBP as in [19, 17] and our efficient IBP+Backward perturbation analysis. Models trained using IBP+Backward outperforms pure IBP (similar to our observations in computer vision tasks), and the verified test accuracy is significantly better than naturally trained models. The results demonstrate that our framework allows us to better verify and train complex NLP models using tight LiRPA bounds.

Training Neural Networks with Guaranteed Flatness Recently, some researchers [13, 18, 12, 15] have hypothesized that DNNs optimized with stochastic gradient descent (SGD) can find wide and flat local minima which may be associated with good generalization performance.

Most previous works on LiRPA based certified defense only implemented input perturbations analysis. Our framework naturally extends to perturbation analysis on network parameters as they are also independent nodes in a computational graph (e.g., node in Figure 2). This requires to relax the multiplication operation (e.g., the MatMul nodes in Figure 2) which was first discussed in Shi et al. [36], and our Algorithm 2 can then be directly applied. With this advantage, LiRPA can compute provable upper and lower bounds on the local “flatness” around a certain point for some loss L:

where are linear functions of that can be found using LiRPA. This is a “zeroth order” flatness criterion, where we guarantee that the loss value does not change too much in a small region around , and we do not have further assumptions on gradients or Hessian of the loss. When is a good solution, is close to 0, so we can simply set the left hand side of (8) to 0 and upper bound to ensure flatness. Using our framework, we can train a classifier that guarantees flatness of local optimization landscape, by minimizing the “flat” objective perturbation set where is the current network parameter. When this “flat” objective is close to 0, we guarantee that L is close to 0 for all . We build a three-layer MLP model with [64, 64, 10] neurons in each layer and conduct experiments using only 10% and 1% of the training data in MNIST and FashionMNIST, and we then test on the full test set to aggressively evaluate the generalization performance. We also aggressively set the batch size to {0.01N, 0.1N, N} as in [18] where N is the size of training dataset. Additional details can be found in Appendix C.3.

The test accuracies of the models trained with regular cross entropy and our “flat” objective are shown in Figure 3a. We visualize their loss surfaces in Figure 3b. When batch size is increased or fewer data are used, test accuracy generally decreases due to overfitting, which is consistent with [21]. For models trained with the flat objective, the accuracy tends to be better, especially when a very large batch size is used. These observations provide some evidence for the hypothesis that a flat local minimum generalizes better, however, we cannot exclude the possibility that the improvements come from side effects of our objective. Our focus is to demonstrate potential applications beyond neural network verification of our framework rather than proving this hypothesis.

Broader Impact

In this paper, we develop an automatic framework to enable perturbation analysis on any neural network structures. Our framework can be used in a wide variety of tasks ranging from robustness verification to certified defense, and potentially many more applications requiring a provable perturbation analysis. It can also play an important building block for several safety-critical ML applications, such as transportation, engineering, and healthcare, etc. We expect that our framework will significantly improve the robustness and reliability of real-world ML systems with theoretical guarantees.

An important product of this paper is an open-source LiRPA library with over 10,000 lines of code, which provides automatic and differentiable perturbation analysis. This library can tremendously facilitate the use of LiRPA for the research community as well as industrial applications, such as verifiable plant control [50]. Our library of LiRPA on general computational graphs can also inspire further improved implementations on automatic outer bounds calculations with provable guarantees.

Although our focus on this paper has been on exploring known perturbations and providing guarantees in such clairvoyant scenarios, in real-world an adversary (or nature) may not adhere to our assumptions. Thus, we may additionally want to understand implication of these unknown scenarios on the system performance. This is a relatively unexplored area in robust machine learning, and we encourage researchers to understand and mitigate the risks arising from unknown perturbations in these contexts.

Acknowledgments and Disclosure of Funding

This work was performed under the auspices of the U.S. Department of Energy by Lawrence Livermore National Laboratory under Contract DE-AC52-07NA27344 and was partly supported by the National Science Foundation CNS-1932351, NSFC key project No. 61936010, NSFC regular project No. 61876096, NSF IIS-1901527, NSF IIS-2008173, and ARL-0011469453.

References

[1] Abadi, M., Agarwal, A., Barham, P., Brevdo, E., Chen, Z., Citro, C., Corrado, G. S., Davis, A., Dean, J., Devin, M., Ghemawat, S., Goodfellow, I., Harp, A., Irving, G., Isard, M., Jia, Y., Jozefowicz, R., Kaiser, L., Kudlur, M., Levenberg, J., Mane, D., Monga, R., Moore, S., Murray, D., Olah, C., Schuster, M., Shlens, J., Steiner, B., Sutskever, I., Talwar, K., Tucker, P., Vanhoucke, V., Vasudevan, V., Viegas, F., Vinyals, O., Warden, P., Wattenberg, M., Wicke, M., Yu, Y., and Zheng, X. Tensorflow: Large-scale machine learning on heterogeneous distributed systems, 2016.

[2] Alzantot, M., Sharma, Y., Elgohary, A., Ho, B.-J., Srivastava, M., and Chang, K.-W. Generating natural language adversarial examples. In EMNLP, pp. 2890–2896, 2018.

[3] Balunovic, M. and Vechev, M. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2020.

[4] Chrabaszcz, P., Loshchilov, I., and Hutter, F. A downsampled variant of imagenet as an alternative to the cifar datasets. arXiv preprint arXiv:1707.08819, 2017.

[5] Cohen, J. M., Rosenfeld, E., and Kolter, J. Z. Certified adversarial robustness via randomized smoothing. In ICML, 2019.

[6] Dvijotham, K., Gowal, S., Stanforth, R., Arandjelovic, R., O’Donoghue, B., Uesato, J., and Kohli, P. Training verified learners with learned verifiers. arXiv preprint arXiv:1805.10265, 2018.

[7] Dvijotham, K., Stanforth, R., Gowal, S., Mann, T., and Kohli, P. A dual approach to scalable verification of deep networks. UAI, 2018.

[8] Dvijotham, K. D., Stanforth, R., Gowal, S., Qin, C., De, S., and Kohli, P. Efficient neural network verification with exactness characterization. UAI, 2019.

[9] Ehlers, R. Formal verification of piece-wise linear feed-forward neural networks. In International Symposium on Automated Technology for Verification and Analysis, pp. 269–286. Springer, 2017.

[10] Gao, J., Lanchantin, J., Soffa, M. L., and Qi, Y. Black-box generation of adversarial text sequences to evade deep learning classifiers. In 2018 IEEE Security and Privacy Workshops (SPW), pp. 50–56. IEEE, 2018.

[11] Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Mann, T., and Kohli, P. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715, 2018.

[12] Goyal, P., Dollár, P., Girshick, R., Noordhuis, P., Wesolowski, L., Kyrola, A., Tulloch, A., Jia, Y., and He, K. Accurate, large minibatch sgd: Training imagenet in 1 hour. arXiv preprint arXiv:1706.02677, 2017.

[13] He, H., Huang, G., and Yuan, Y. Asymmetric valleys: Beyond sharp and flat local minima. In Advances in Neural Information Processing Systems, pp. 2549–2560, 2019.

[14] Hein, M. and Andriushchenko, M. Formal guarantees on the robustness of a classifier against adversarial manipulation. In Advances in Neural Information Processing Systems (NIPS), pp. 2266–2276, 2017.

[15] Hoffer, E., Hubara, I., and Soudry, D. Train longer, generalize better: closing the generalization gap in large batch training of neural networks. In Advances in Neural Information Processing Systems, pp. 1731–1741, 2017.

[16] Huang, G., Liu, Z., Van Der Maaten, L., and Weinberger, K. Q. Densely connected convolutional networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 4700–4708, 2017.

[17] Huang, P.-S., Stanforth, R., Welbl, J., Dyer, C., Yogatama, D., Gowal, S., Dvijotham, K., and Kohli, P. Achieving verified robustness to symbol substitutions via interval bound propagation. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 4074–4084, 2019.

[18] Jastrzebski, S., Kenton, Z., Arpit, D., Ballas, N., Fischer, A., Bengio, Y., and Storkey, A. J. Finding flatter minima with sgd. In ICLR (Workshop), 2018.

[19] Jia, R., Raghunathan, A., Göksel, K., and Liang, P. Certified robustness to adversarial word substitutions. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pp. 4120–4133, 2019.

[20] Katz, G., Barrett, C., Dill, D. L., Julian, K., and Kochenderfer, M. J. Reluplex: An efficient smt solver for verifying deep neural networks. In International Conference on Computer Aided Verification, pp. 97–117. Springer, 2017.

[21] Keskar, N. S., Mudigere, D., Nocedal, J., Smelyanskiy, M., and Tang, P. T. P. On largebatch training for deep learning: Generalization gap and sharp minima. arXiv preprint arXiv:1609.04836, 2016.

[22] Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980, 2014.

[23] Ko, C.-Y., Lyu, Z., Weng, T.-W., Daniel, L., Wong, N., and Lin, D. Popqorn: Quantifying robustness of recurrent neural networks. In International Conference on Machine Learning, pp. 3468–3477, 2019.

[24] Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. Technical Report TR-2009, 2009.

[25] Le, Y. and Yang, X. Tiny imagenet visual recognition challenge. CS 231N, 2015.

[26] Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 656–672. IEEE, 2019.

[27] Li, B., Chen, C., Wang, W., and Carin, L. Certified adversarial robustness with additive noise. In Advances in Neural Information Processing Systems, pp. 9464–9474, 2019.

[28] Lyu, Z., Ko, C.-Y., Kong, Z., Wong, N., Lin, D., and Daniel, L. Fastened crown: Tightened neural network robustness certificates. arXiv preprint arXiv:1912.00574, 2019.

[29] Maurer, J., Singh, G., Mirman, M., Gehr, T., Hoffmann, A., Tsankov, P., Cohen, D. D., and Püschel, M. Eran user manual. Manual, 2018.

[30] Mirman, M., Gehr, T., and Vechev, M. Differentiable abstract interpretation for provably robust neural networks. In International Conference on Machine Learning, pp. 3575–3583, 2018.

[31] Paszke, A., Gross, S., Massa, F., Lerer, A., Bradbury, J., Chanan, G., Killeen, T., Lin, Z., Gimelshein, N., Antiga, L., Desmaison, A., Kopf, A., Yang, E., DeVito, Z., Raison, M., Tejani, A., Chilamkurthy, S., Steiner, B., Fang, L., Bai, J., and Chintala, S. Pytorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems 32, pp. 8024–8035. Curran Associates, Inc., 2019.

[32] Raghunathan, A., Steinhardt, J., and Liang, P. S. Semidefinite relaxations for certifying robustness to adversarial examples. In Advances in Neural Information Processing Systems, pp. 10877–10887, 2018.

[33] Rumelhart, D. E., Hinton, G. E., and Williams, R. J. Learning representations by backpropagating errors. nature, 323(6088):533–536, 1986.

[34] Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., and Yang, G. Provably robust deep learning via adversarially trained smoothed classifiers. In Advances in Neural Information Processing Systems, pp. 11289–11300, 2019.

[35] Salman, H., Yang, G., Zhang, H., Hsieh, C.-J., and Zhang, P. A convex relaxation barrier to tight robustness verification of neural networks. In Advances in Neural Information Processing Systems 32, pp. 9832–9842, 2019.

[36] Shi, Z., Zhang, H., Chang, K.-W., Huang, M., and Hsieh, C.-J. Robustness verification for transformers. In International Conference on Learning Representations, 2020.

[37] Singh, G., Gehr, T., Mirman, M., Püschel, M., and Vechev, M. Fast and effective robustness certification. In Advances in Neural Information Processing Systems, pp. 10825–10836, 2018.

[38] Singh, G., Ganvir, R., Püschel, M., and Vechev, M. Beyond the single neuron convex barrier for neural network certification. In Advances in Neural Information Processing Systems, pp. 15072–15083, 2019.

[39] Singh, G., Gehr, T., Püschel, M., and Vechev, M. An abstract domain for certifying neural networks. Proceedings of the ACM on Programming Languages, 3(POPL):41, 2019.

[40] Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C. D., Ng, A., and Potts, C. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 conference on empirical methods in natural language processing, pp. 1631–1642, 2013.

[41] Tjandraatmadja, C., Anderson, R., Huchette, J., Ma, W., Patel, K., and Vielma, J. P. The convex relaxation barrier, revisited: Tightened single-neuron relaxations for neural network verification. arXiv preprint arXiv:2006.14076, 2020.

[42] Tjeng, V., Xiao, K., and Tedrake, R. Evaluating robustness of neural networks with mixed integer programming. ICLR, 2019.

[43] Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A. N., Kaiser, Ł., and Polosukhin, I. Attention is all you need. In Advances in neural information processing systems, pp. 5998–6008, 2017.

[44] Wang, S., Chen, Y., Abdou, A., and Jana, S. Mixtrain: Scalable training of formally robust neural networks. arXiv preprint arXiv:1811.02625, 2018.

[45] Wang, S., Pei, K., Whitehouse, J., Yang, J., and Jana, S. Efficient formal safety analysis of neural networks. In Advances in Neural Information Processing Systems, pp. 6367–6377, 2018.

[46] Weng, T.-W., Zhang, H., Chen, H., Song, Z., Hsieh, C.-J., Daniel, L., Boning, D., and Dhillon, I. Towards fast computation of certified robustness for relu networks. In International Conference on Machine Learning, pp. 5273–5282, 2018.

[47] Wong, E. and Kolter, J. Z. Provable defenses against adversarial examples via the convex outer adversarial polytope. In ICML, 2018.

[48] Wong, E. and Kolter, Z. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, pp. 5283–5292, 2018.

[49] Wong, E., Schmidt, F., Metzen, J. H., and Kolter, J. Z. Scaling provable adversarial defenses. In NIPS, 2018.

[50] Wong, E., Schneider, T., Schmitt, J., Schmidt, F. R., and Kolter, J. Z. Neural network virtual sensors for fuel injection quantities with provable performance specifications. arXiv preprint arXiv:2007.00147, 2020.

[51] Xie, S., Girshick, R., Dollár, P., Tu, Z., and He, K. Aggregated residual transformations for deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1492–1500, 2017.

[52] Zagoruyko, S. and Komodakis, N. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016.

[53] Zhang, H., Weng, T.-W., Chen, P.-Y., Hsieh, C.-J., and Daniel, L. Efficient neural network robustness certification with general activation functions. In Advances in neural information processing systems, pp. 4939–4948, 2018.

[54] Zhang, H., Cheng, M., and Hsieh, C.-J. Enhancing certifiable robustness via a deep model ensemble. arXiv preprint arXiv:1910.14655, 2019.

[55] Zhang, H., Zhang, P., and Hsieh, C.-J. Recurjac: An efficient recursive algorithm for bounding jacobian matrix of neural networks and its applications. AAAI Conference on Artificial Intelligence, 2019.

[56] Zhang, H., Chen, H., Xiao, C., Li, B., Boning, D., and Hsieh, C.-J. Towards stable and efficient training of verifiably robust neural networks. In International Conference on Learning Representations, 2020.

[57] Zhu, C., Ni, R., Chiang, P.-y., Li, H., Huang, F., and Goldstein, T. Improving the tightness of convex relaxation bounds for training certifiably robust classifiers. arXiv preprint arXiv:2002.09766, 2020.

[58] Zügner, D. and Günnemann, S. Certifiable robustness and robust training for graph convolutional networks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pp. 246–256, 2019.

In Appendix A, we provide more discussions on LiRPA bounds, including detailed algorithm and complexity analysis, comparison of different LiRPA implementations, and also a small numerical example in Appendix A.4. In Appendix B, we provide proofs of the theorems. We provide additional experiments, including more LiRPA trained TinyImageNet models and IBP baselines in Appendix C.1, and we also provide details for each experiment in Appendix C.

A Additional Discussions on LiRPA Bounds

A.1 Oracle Functions and the Linear Relaxation of Nonlinear Operations

In this section, we summarize some examples of oracle functions as derived in previous works [53, 45, 36]. In Table 6, we provide a list of oracle functions of three basic operation types, including affine transformation, unary nonlinear function, and binary nonlinear function. Most common operations involved in neural networks can be addressed following these basic operation types. For example, dense layers and convolutional layers are affine transformations, activation functions are unary nonlinear functions, multiplication and division are binary nonlinear functions, and matrix multiplication or dot product of two variable matrices can be considered as multiplications with an affine transformation.

Parameters in Table 6 are involved in the linear relaxation of nonlinear operations. For example, for ReLU, , is a piecewise linear function and can be linearly relaxed w.r.t. the bounds of , denoted as . When or is a linear function on , and thus is a linear function, i.e., we can take . Otherwise, for l < 0 < u, we can take the line passing and as the linear upper bound, i.e., . For the lower bound, it can be any line with . To minimize the relaxation error, Zhang et al. [53] proposed to adaptively choose in LiRPA. Alternatively, we can also select , and thereby the linear relaxation can be provably tighter than IBP bounds. This lower bound can be used for training ReLU networks with loss fusion. Figure 4 compares the linear bounds in LiRPA and IBP respesctively.

Figure 4: An example of ReLU relaxation when . Here we take the blue dashed lines as the linear bounds, where any line passing (0, 0) with a slope between 0 and 1 can be a valid lower bound. In contrast, IBP takes the fixed red dashed lines as the lower and upper bounds respectively, which is a looser relaxation.

The detailed derivation of the oracle functions shown in Table 6 has been covered in previous works [53, 45, 36] and is not a focus of this paper. We refer readers to those existing works for details.

A.2 Complexity Comparison between Different Perturbation Analysis Modes

In this section, we compare the computational cost of different perturbation analysis modes. We assume that and are the total dimension of the perturbed independent nodes and the final output node respectively. We focus on a usual case in classification models, where the final output

Table 6: A list of common types of operations, their definition , and their corresponding oracle functions and . Subscript “+” stands for taking positive elements from the matrix or vector while setting other elements to zero, and vice versa for subscript “-”. diagstands for constructing a diagonal matrix from a vector. are parameters of linear relaxation that can be derived for each specific nonlinear function.

node is a logits layer whose dimension equals to the number of classes and thus usually holds true, or the final output is a loss function with if loss fusion is enabled. We also assume that the time complexity of a regular forward pass of the computational graph (e.g., a regular inference pass) is O(r), and the complexity of a regular back propagation pass in gradient computation is also asymptotically O(r). Note that the overall time complexity of LiRPA depends on oracle functions, and in the below analysis we focus on common cases (e.g., common activation functions in Table 6).

Interval bound propagation (IBP) IBP can be seen as a special and degenerated case of LiRPA bounds. The time complexity of pure IBP is still O(r) since it computes two output values, a lower bound and a upper bound, for each neuron, and thus the time complexity is the same as a regular forward pass which computes one output value for each neuron. However, pure IBP cannot give tight enough bounds especially for models without certifiably robust training.

Backward mode bound propagation Backward mode LiRPA oracles typically require bounds of intermediate nodes for all for a node i (referred to as “pre-activation bounds” in some works). Assuming these intermediate bounds are known; in this case, the oracle function typically has the same time complexity as back propagation of gradients through node i (e.g., for linear layers it is the transposed operation of ). However, unlike in back propagation where the gradients is computed for a scalar function, in backward mode LiRPA we need to compute values for each neuron, and these values stand for the coefficients of the linear bounds of the output neurons. The time complexity is roughly times back propagation time,

For a purely backward perturbation analysis that can be extended from CROWN [53], the bounds of intermediate nodes needed for the oracle functions are also computed with a backward mode LiRPA. Assuming there are N nodes in total (including output nodes and all intermediate nodes) that require LiRPA bounds, the total time complexity is asymptotically O(Nr) where N can be a quite large number (e.g., for feed-forward ReLU networks N includes hidden neurons over all layers and ), so this approach cannot scale to large graphs or be used for efficient training.

Forward mode bound propagation In the forward mode perturbation analysis, since we represent the bounds of each neuron with linear functions w.r.t. the perturbed independent nodes, we need to compute values for each neuron. Usually, the oracle functions has the same asymptotic complexity as the computation function ; however, the inputs of include dimension the total time complexity of is roughly . Note that in the implementation of the forward mode, we do not compute linear functions w.r.t. all the independent nodes, but we only need to consider those perturbed independent nodes while treating the other independent nodes as constants, and thereby may be much smaller than the dimension of X, e.g., model parameters can be excluded if they are not perturbed.

Efficient hybrid bounds Among the LiRPA variants, IBP+Backward with a complexity of is usually most efficient for classification models and is used in our certified training experiments. When loss fusion is enabled, during training, and thereby the complexity of IBP+Backward is O(r), which is the same as that of IBP. In this way, our loss fusion technique can significantly improve the scalability of certified training with LiRPA bounds. To obtain tighter bounds for intermediate nodes which can also tighten the final output bounds, we may use pure forward or Forward+Backward mode with a complexity of which is usually larger than that of IBP+Backward when . The forward mode LiRPA can be potentially useful for situations where for generative models with a large output dimension. We leave this as our future work.

A.3 The GetOutDegree Auxiliary Function in Backward Mode Perturbation Analysis

As mentioned in Section 3.4, we have an auxiliary “GetOutDegree” function for computing the degree of each node i, which is defined as the the number of outputs nodes of node i that the node o is dependent on. This function is illustrated in Algorithm 3. We use a BFS pass. At the beginning, node o is added into the queue. Next, each time we pick a node i from the head of the queue. Node o is dependent on node i, and thus we increase the degree of its input nodes, each , by 1. Node o is also dependent on node and we add node j to the queue if it has never been in the queue yet. We repeat this process until the queue becomes empty, and at this time any node i that node o is dependent on has been visited and has contributed to the of its input nodes.

A.4 A Small Example of LiRPA Bounds

We provide a small example to illustrate the computation of our LiRPA methods. We assume that we have a simple ReLU network with 2 hidden layers, with weight matrix of each layer as below:

and we do not consider bias terms of the layers here for simplicity.

Given a clean input and perturbation with , we can compute the bounds of the last layer and compare the results from IBP, forward mode LiRPA and backward mode LiRPA respectively.

IBP

In the following computation of LiRPA bounds, we always use zero as the lower bound of ReLU activation.

Forward Mode LiRPA

Backward Mode LiRPA Here we reuse the intermediate results from the forward mode LiRPA

We then compute the linear bounds from the last layer to the first layer and finally concretize the linear bounds:

As we can see from this example, the bounds from the backward mode LiRPA are the tightest compared to those from forward mode LiRPA and IBP, even if we reuse the intermediate relaxation results from the forward mode LiRPA.

A.5 Existing LiRPA implementations

We list and compare a few notable LiRPA implementations in Table 7.

ward network).

a “Automatic” is defined as an user can easily obtain bounds using existing model source code, without manual conversion or implementation. b ERAN has a TensorFlow frontend to read TensorFlow models, but its backend is written in C++ and partially CUDA. c Other types of bounds like k-ReLU [38] are provided, but typically much less efficient than IBP or backward mode perturbation analysis. d User supplied perturbation specifications.

B Proofs of the Theorems

B.1 Proof of Theorem 1

Initially, this inequality holds true with

because then

meets (9).

Without loss of generality, we assume that the nodes are numbered in topological order, i.e., for each node i and its input node holds true, and we assume that there are independent nodes. Then, we have o = n, and all the independent nodes have the smallest numbers. This can be achieved via a topological sort for any computational graph. We can also ignore nodes that node o does not depend on. With these assumptions, we show a lemma:

Lemma 4. In Algorithm 2, every dependent node will be visited once and only once. And when node i is visited, all nodes that depend on node i must have been visited.

Proof. First, node o is added to the queue and will be visited, and since it has no successor node, it will not be added to the queue again during the BFS. We assume that node i . . . n will be visited once and only once, and this is initially true with i = o = n. For , we show that node will also be visited once and only once. When node i . . . n have all been visited, the successor nodes of node have been visited and , and node is a dependent node. Therefore, node will be added to the queue and visited. From the assumption on node i . . . n, all nodes that depend on the successor nodes of node have also been visited. Nodes that depend on node consist of the successor nodes of node and nodes that depend on these successors, and thus they have all been visited. Since node i . . . n will not be visited more than once, node will not be added to the queue by its successor nodes more than once. Therefore, node will also be visited once and only once. Using mathematical induction, we can prove that the lemma holds true for all node

According to Lemma 4, every dependent node i is visited once and exactly once. When node i is visited, Algorithm 2 performs the following changes to attributes and u(i)):

where come from oracle function as shown in (5), and

Thereby, with changes in (11) and (12), the linear lower bound in (9) becomes

which remains a valid linear lower bound in the form of (9). Similarly, this also holds true for the linear upper bound. In this way, and are propagated to its input nodes and set to 0. Thereby the term w.r.t. is eliminated in the linear bounds, as shown in (13).

At this time, all successor nodes of node i have been visited and will not been visited again. Therefore, will keep to be 0 after node i is visited. Therefore, when Algorithm 2 terminates, of all dependent node i will be 0, and thereby we will obtain linear bounds of node o w.r.t. all the independent nodes.

B.2 Proof of Theorem 2

Theorem 2 shows that linear bounds under perturbation defined by synonym-based word substitution can be concretized with a dynamic programming. Specifically, to concretize a linear lower bound, we need to compute

where is embedding of the t-th word in the input, are columns in corresponding to the coefficients of in the linear bound. In the dynamic programming, we compute denotes the lower bound of words among the first have been replaced. If has not been replaced, , otherwise

For i = 0, obviously . For must have not been replaced and thus holds true. Therefore, For i, j > 0, we consider whether has been replaced. If has not been replaced, words have been replaced among the first words. In this case, . For the other case if has been replaced, words have been replaced among the first words, and , where . We combine these two cases and take the minimum of their results, and thus:

The result of (14) is . The upper bounds can also be computed in a similar way simply by changing from taking the minimum to taking the maximum in the above derivation.

B.3 Proof of Theorem 3

In Theorem 3, we show that given concrete lower and upper bounds of as and

where S(X, y) is the upper bound of S(X, y) from the backward mode LiRPA.

is the cross entropy loss with softmax normalization, and

Now we are going to show that . Here we assume that the concrete bounds of intermediate layers used for linear relaxations and also the concrete lower and upper bounds of (denoted as ) are the same.

Figure 5: Illustration of different upper bounds of exp(x) within . The linear bound (blue line) is a tighter bound than the IBP bound (red line). The blue area stands for the gap between the two upper bounds. Note that for this particular setting of upper bounding S(X, y) we need only upper bounds for this non-linear function.

Computing is essentially propagating through exp and summa- tion in the loss function using IBP, while S(X, y) is directly computed from the LiRPA bound of S(X, y). Using , a matrix of ones with size , to replace the summation, we can unify these two processes as computing the upper bound of using LiRPA with different relaxations for exp. For S(X, y), the linear upper bound of is a line passing and , while it is when computing . We illustrate the two different relaxations in Figure 5. Since elements in are all positive, the lower bound of exp(x) will not be involved, and thus with the same concrete bounds of the relaxation on exp in S(X, y) is strictly tighter when l < u.

After relaxing exp, we can obtain two linear upper bounds from the two methods respectively, where and are obtained by merging the relaxation of exp and . Note that since the relaxed function in IBP has no linear term, in this case and the upper bound will simply be . We then back propagate to the input and concretize the bounds to get S(X, y) and respectively. Since in the calculation of linear bounds, the exp relaxation is the only difference and the relaxation for S(X, y) is no looser than that for , the upper linear bound of S(X, y) is tighter than that of , and we can conclude that for the concrete bounds holds true, and thereby

Remark 1. Despite the assumptions involved above, in the implementation, we generally have different concrete bounds and for computing S(X, y) with loss fusion (e.g., our IBP+backward scheme), compared to the case of computing without loss fusion (e.g., the scheme used in CROWN-IBP [56]). In the former case, and are regarded as intermediate bounds and obtained with IBP, while in the later case, is obtained with LiRPA and is unused. Therefore, the relaxation on exp when using loss fusion may not be strictly tighter than the IBP bound in computing

C Additional Details on Experiments

C.1 Details on Large-Scale Certified Defense

Training settings In order to perform fair comparable experiments, for all experiments on training large-scale vision models (Table 2 and 4), we use a same setting for LiRPA and IBP. Across all datasets, the networks were trained using the Adam [22] optimizer with an initial learning rate of . Also, gradient clipping with a maximum norm of 8 is applied. We gradually increase within a fixed epoch length (800 epochs for CIFAR-10, 400 epochs for Tiny-ImageNet and 80 epochs for Downscaled-ImageNet). We uniformly divide the epoch length with a factor 0.4, and exponentially increase during the former interval and linearly increase during the latter interval, so that to avoid a sudden growth of at the beginning stage. Following [56], for LiRPA training, a hyperparameter to balance LiRPA bounds and IBP bounds for the output layer is set and gradually decreases from 1 to 0 (1 for only using LiRPA bounds and 0 for only using IBP bounds), as per the same schedule of , and the end for training is set to 10% higher than the one in test. All models are trained on 4 Nvidia GTX 1080TI GPUs (44GB GPU memory in total). For different datasets, we further have settings below:

• CIFAR-10 . We train 2,000 epochs with batch size 256 in total, the first 200 epochs are clean training, then we gradually increase per batch with a schedule length of 800, finally we conduct 1,100 epochs pure IBP training. We decay the learning rate by at the 1,400-th and 1,700-th epochs respectively. During training, we add random flips and crops for data augmentation, and normalize each image channel, using the channel statistics from the training set.

• Tiny-ImageNet . We train 800 epochs with batch size 120 in total (for WideResNet, we reduce batch size to 110 due to limited GPU memory), the first 100 epochs are clean training, then we gradually increase per batch with a schedule length of 400, finally we conduct 500 epochs of pure IBP training. We decay the learning rate by at the 600-th and 700-th epochs respectively. During training, we use random crops of 56 56 and random flips. During testing, we use a central 56 56 crop. We also normalize each image channel, using the channel statistics from the training set.

• Downscaled-ImageNet . We train 240 epochs with batch size 110 in total, the first 100 epochs are clean training, then we gradually increase per batch with a schedule length of 80, finally we conduct 60 epochs of pure IBP training. We decay the learning rate by at the 200-th and 220-th epochs respectively. During training, we use random crops of 56 56 and random flips. During testing, we use a central 56 56 crop. We also normalize each image channel, using the channel statistics from the training set.

All verified error numbers are evaluated on the test set using IBP with for CIFAR-10 and for Tiny-ImageNet and Downscaled-ImageNet.

Model Structures The details of vision model structures we used are described bellow (note that we omit the final linear layer which has 10 neurons for CIFAR-10 and 200 neurons for Tiny-ImageNet):

• CNN-7+BN Conv-BN-ReLU layers with {64, 64, 128, 128, 128} filters respectively, and a linear layer with 512 neurons.

• DenseNet {2, 4, 4} Dense blocks with growth rate 32 and a linear layer with 512 neurons.

• WideResNet Wide basic blocks (CIFAR-10, widen factor = 10 for Tiny-ImageNet and Downscaled-ImageNet. An additional linear layer with 512 neurons is added for CIFAR-10.

• ResNeXt {1, 1, 1} blocks for CIFAR-10 and {2, 2, 2} blocks for Tiny-ImageNet and cardinality = 2, bottleneck width = 32 and a linear layer with 512 neurons.

It is worthwhile to mention that both [56] and [57] conducted experiments on expensive 32 TPU cores which has up to 512 GB TPU memory in total. In comparison, our framework with loss fusion can be quite efficient working on 44 GB GPU memory.

Moreover, the running time with maximum batch size on 4 Nvidia GTX 1080TI GPUs of all models on two datasets is reported in Table 8. Note that large-scale models cannot be trained with previous LiRPA methods without loss fusion, even if the mini-batch size on each GPU is only 1 for DenseNet and WideResNet.

C.2 Details on Verifying and Training NLP Models

For the perturbation specification defined on synonym-based word substitution, each word w has a substitution set S(w), such that the actual input word . We adopt the approach

Table 8: Per-epoch training time and memory usage of the 4 large models on CIFAR-10 and Tiny- out of memory. Numbers in parentheses are relative to natural training time.

for constructing substitution sets used by Jia et al. [19]. For a word w in a input sentence, they first follow Alzantot et al. [2] to find the nearest 8 neighbors of w in a counter-fitted word embedding space where synonyms are generally close while antonyms are generally far apart. They then apply a language model to only retain substitution words that the log-likelihood of the sentence after word substitution does not decrease by more than 5.0, which is also similar to the approach by Alzantot et al. [2]. We reuse their open-source code2 to pre-compute the substitution sets of words in all the examples. Note that although we use the same approach for constructing the lists of substitution words as [19], our perturbation space is still different from theirs, because we follow Huang et al. [17] and allow setting a small budget that limits the maximum number of words to be replaced simultaneously [23, 10]. We do not adopt the synonym list from Huang et al. [17] as it appears to be not publicly available when this work is done.

We use two models in the experiments for sentiment classification: Transformer and LSTM. For Transformer, we use a one-layer model, with 4 attention heads, a hidden size of 64, and ReLU activations for feed-forward layers. Following Shi et al. [36], we also remove the variance related terms in layer normalization, which can make Transformer easier to be verified while keeping comparable clean accuracies. For the LSTM, we use a one-layer bidirectional model, with a hidden size of 64. The vocabulary is built from the training data and includes all the words that appear for at least twice. Input tokens to the models are truncated to no longer than 32.

In the certified defense, although we are not using norm perturbations, we have an artifial that manually shrinks the gap between the clean input and perturbed input during the warmup stage, which makes the objective easier to be optimized [11, 19]. Specifically, for clean input word actual input word , we shrink the gap between the embeddings of respectively:

is linearly increased from 0 to 1 during the first 10 warmup epochs. We then train the model for 15 more epochs with . During the first 20 epochs, all the nodes on the parse trees of training examples are used, and later we only use the root nodes, i.e., the full text only. The models are trained using Adam optimizer [22], and the learning rate is set to for Transformer and LSTM. We also use gradient clipping with a maximum norm of 10.0. When using LiRPA bounds for training, we combine bounds by LiRPA and IBP weighted by a coefficient respectively, and decreases from 1 to 0 during the warmup stage, following CROWN-IBP [56] as also mentioned in Appendix C.1. In this setting, since we use pure IBP for training in the last epochs, we actually end up training the models on since IBP for LSTM and Transformer does not consider (see the next paragraph). But we still use LiRPA bounds with the given non-trivial for testing. Alternatively, for IBP+Backward (alt.) in the experiments, we always use LiRPA bounds and set . And for this setting, the models tend to have a lower verified accuracy when tested on a larger than that in the training, as shown in Sec. 4.

Huang et al. [17] has a convex hull method to handle word replacement with a budget limit in IBP. For a word sequence , they construct a convex hull for the input node 1. They consider the perturbation of each word , and for each possible , they add vector to the convex hull. The convex hull is an over-estimation of . They require the first layer of the network to be an affine layer and concretize the convex hull to interval bounds after passing the first layer, where each vertex in the convex hull is passed through the first layer respectively and they then take the interval lower and upper bound of all the vertexes in the convex hull. They worked on CNN, but on Transformer when there is no interaction between different sequence positions in the first layer, their method is a -time more over-estimation than simply assuming all the words can be replaced at the same time, and this method cannot work either when the first layer is not an affine layer. Therefore, for verifying and training LSTM and Transformer with IBP, we can only adopt the baseline in Jia et al. [19] without considering . In contrast, our dynamic programming method for concretizing linear bounds under the synonym-based word substitution scenario in Sec. 3.2 takes the budget into consideration regardless of the network structure.

C.3 Details on Training for a Flat Objective

Hyperparameter Setting For training the three-layer MLP model we used in weight perturbation experiments, we follow similar training strategy in vision models. The differences are summarized here: We use the SGD optimizer with an initial learning rate of 0.1 and decay the learning rate with a factor of increases. We use to bound the weights of all three layers and linearly increase per batch.

Certified Flatness Using bounds obtained from LiRPA, we can obtain a certified upper bound on training loss. We define the flatness based on certified training cross entropy loss at a point

A small F guarantees that L does not change wildly around . Note that since the weight of each layer can be in quite different scales, we use a normalized and set . This also allows us to make fair comparisons between models with weights in different scales. The flatness F of the models we obtained are shown in Table 9. As we can see, the models trained by “flat” objective show extraordinary smaller flatness F compare with the nature trained models on bot MNIST and FashionMNIST with all combination of dataset sizes and batch sizes. The results also fit the observation of training loss landscape in Figure 3b.

Table 9: The flatness F of naturally trained models and models trained using the “flat” objective (16) with different dataset sizes (10%, 1%) and batch sizes (0.01N, 0.1N, N). A small F guarantees that L does not change wildly around (model parameters found by SGD). The flat objective provably reduces the range of objective around