[Paper Review] Provable defenses against adversarial examples via the convex outer adversarial polytope

Eric Wong, J. Zico Kolter|arXiv (Cornell University)|Nov 2, 2017

Adversarial Robustness in Machine Learning712 citations

TL;DR

The paper presents a method to train deep ReLU classifiers with provable robustness to norm-bounded adversarial perturbations by optimizing over a convex outer bound of the adversarial polytope, implemented via a dual network that enables efficient training. It achieves certified robustness on MNIST and other datasets, outperforming prior bounds on several tasks.

ABSTRACT

We propose a method to learn deep ReLU-based classifiers that are provably robust against norm-bounded adversarial perturbations on the training data. For previously unseen examples, the approach is guaranteed to detect all adversarial examples, though it may flag some non-adversarial examples as well. The basic idea is to consider a convex outer approximation of the set of activations reachable through a norm-bounded perturbation, and we develop a robust optimization procedure that minimizes the worst case loss over this outer region (via a linear program). Crucially, we show that the dual problem to this linear program can be represented itself as a deep network similar to the backpropagation network, leading to very efficient optimization approaches that produce guaranteed bounds on the robust loss. The end result is that by executing a few more forward and backward passes through a slightly modified version of the original network (though possibly with much larger batch sizes), we can learn a classifier that is provably robust to any norm-bounded adversarial attack. We illustrate the approach on a number of tasks to train classifiers with robust adversarial guarantees (e.g. for MNIST, we produce a convolutional classifier that provably has less than 5.8% test error for any adversarial attack with bounded $\ell_\infty$ norm less than $ε= 0.1$), and code for all experiments in the paper is available at https://github.com/locuslab/convex_adversarial.

Motivation & Objective

• Motivate and quantify the need for classifiers with provable robustness to adversarial perturbations.
• Introduce a convex outer bound (convex relaxation) of the adversarial polytope for deep ReLU networks.
• Develop a dual network approach to efficiently compute robust loss bounds during training.
• Provide a training objective that yields provably robust classifiers and attack detection on unseen data.

Proposed method

• Define the adversarial polytope Z_epsilon(x) for k-layer ReLU networks.
• Replace ReLU constraints with a convex upper envelope to form a tractable outer bound tilde{Z}_epsilon(x).
• Derive a dual formulation of the resulting linear program to obtain a network-like backward pass that provides a bound J_epsilon(x, g_theta).
• Compute activation bounds ell and u via a backward-pass-based algorithm (Algorithm 1) exploiting the dual structure.
• Train with a robust loss that upper-bounds the worst-case loss over the epsilon-ball using Theorem 2 (L(-J_epsilon(...), y)).
• Provide certified robustness guarantees (Corollaries 1 and 2) and compute epsilon-distance to the decision boundary (Eq. 17).

Experimental results

Research questions

• RQ1 Can we train deep ReLU networks with provable robustness against norm-bounded adversarial perturbations?
• RQ2 Is it possible to efficiently compute tight robust loss bounds via a dual formulation that resembles standard backpropagation?
• RQ3 What are the empirical robustness guarantees achievable on MNIST, Fashion-MNIST, HAR, and SVHN compared to non-robust baselines and other robust methods?

Key findings

• On MNIST, a robust model achieves 5.82% robust test error under l_infinity perturbations with epsilon=0.1, while a non-robust model has 100% robust bound and much higher actual errors under attacks.
• The robust model significantly reduces FGSM and PGD errors (3.93% and 4.11%) compared to the standard model (50.01% and 81.68%).
• Across datasets, robust bounds are markedly tighter than PGD-based robust performance, e.g., Fashion-MNIST robust error 34.53% vs PGD 31.63% (within the same order).
• The approach scales to convolutional networks and medium-sized problems, achieving the largest verified networks for which robustness can be guaranteed (e.g., MNIST).
• The method provides zero false negatives for adversarial detection: if the bound certifies robustness, the example cannot be adversarial within epsilon.
• The dual network enables efficient computation of robust bounds via a single backward pass, avoiding traditional LP solvers.