[Paper Review] Certified Defenses against Adversarial Examples

Aditi Raghunathan, Jacob Steinhardt+1 more|arXiv (Cornell University)|Jan 29, 2018

Adversarial Robustness in Machine LearningComputer Science55 references339 citations

TL;DR

The paper introduces a certifiable, trainable defense against adversarial examples for two-layer neural networks using a semidefinite relaxation to certify robustness and a dual training objective to jointly optimize robustness certificates with model parameters.

ABSTRACT

While neural networks have achieved high accuracy on standard image classification benchmarks, their accuracy drops to nearly zero in the presence of small adversarial perturbations to test inputs. Defenses based on regularization and adversarial training have been proposed, but often followed by new, stronger attacks that defeat these defenses. Can we somehow end this arms race? In this work, we study this problem for neural networks with one hidden layer. We first propose a method based on a semidefinite relaxation that outputs a certificate that for a given network and test input, no attack can force the error to exceed a certain value. Second, as this certificate is differentiable, we jointly optimize it with the network parameters, providing an adaptive regularizer that encourages robustness against all attacks. On MNIST, our approach produces a network and a certificate that no attack that perturbs each pixel by at most ε= 0.1 can cause more than 35% test error.

Motivation & Objective

• Motivate robust classification under adversarial perturbations within an l_infinity ball.
• Develop a tractable certificate that upper-bounds worst-case adversarial loss for networks with one hidden layer.
• Provide a trainable regularizer derived from the certificate to encourage robustness during learning.
• Demonstrate a practical method that yields certifiably robust networks on MNIST.
• Compare against alternative bounds and prior work to assess effectiveness and scalability.

Proposed method

• Define the margin f^i(x) = f^i(x) - f^y(x) for class i over the true class y.
• Derive an upper bound on the worst-case attack f(A(x)) by integrating gradients over the adversarial path and bounding with ||∇f(·)||_1 over the perturbation ball.
• Specialize the bound to two-layer neural networks to obtain a quadratic program (QP) bound f_QP(x).
• Relax the non-convex QP to a semidefinite program (SDP) f_SDP(x) to obtain a convex, computable certificate.
• Use duality to convert the SDP inner maximization into a differentiable objective, enabling training with stochastic gradient methods (Equation 21).
• Optionally compare with spectral and Frobenius bounds (f_spectral, f_frobenius) and discuss training choices.

Experimental results

Research questions

• RQ1 Can we compute a certifiable upper bound on the worst-case adversarial loss for neural networks with one hidden layer?
• RQ2 Can this certificate be differentiable and used as a training objective to produce robust models?
• RQ3 How tight are SDP-based certificates compared to other bounds when classifying MNIST data?
• RQ4 Does training with the SDP certificate improve actual robustness against strong attacks beyond traditional defenses?
• RQ5 How does the SDP-based approach compare to LP-based or other verifiable methods in terms of scalability and robustness?

Key findings

• The SDP-based certificate yields an upper bound on adversarial loss tighter than Frobenius and spectral bounds across tested networks.
• Training with the SDP certificate produces networks with improved robustness and certifiable guarantees, notably SDP-NN showing meaningful robustness at ε=0.1 on MNIST.
• SDP-NN achieves a lower observed PGD error (15%) with an SDP bound of 35% and LP-bound of 99% on MNIST, illustrating complementary bounds and the impact of network architecture.
• Adversarial training alone (AT-NN) improves robustness to some attacks but does not yield as tight certificates as SDP-based training.
• The dual certificate during training closely matches the fully solved SDP certificate, enabling practical robustness tracking during optimization.
• Compared to a four-layer CNN from related work, the two-layer SDP approach provides competitive robustness within its architectural constraints; deeper networks may further improve bounds.