[Paper Review] RobustNeuralNetworks.jl: a Package for Machine Learning and Data-Driven Control with Certified Robustness

Nicholas H. Barbara, Max Revay+3 more|arXiv (Cornell University)|Jun 22, 2023

Model Reduction and Neural Networks4 citations

TL;DR

This paper introduces RobustNeuralNetworks.jl, a Julia package that enables training of neural networks with certified robustness using Recurrent Equilibrium Networks (RENs) and Lipschitz-Bounded Deep Networks (LBDNs). By directly parameterizing weights to satisfy user-defined robustness constraints—such as Lipschitz bounds—it achieves certified robustness without expensive adversarial training, enabling reliable deployment in safety-critical applications like control and state estimation.

ABSTRACT

Neural networks are typically sensitive to small input perturbations, leading to unexpected or brittle behaviour. We present RobustNeuralNetworks.jl: a Julia package for neural network models that are constructed to naturally satisfy a set of user-defined robustness metrics. The package is based on the recently proposed Recurrent Equilibrium Network (REN) and Lipschitz-Bounded Deep Network (LBDN) model classes, and is designed to interface directly with Julia's most widely-used machine learning package, Flux.jl. We discuss the theory behind our model parameterization, give an overview of the package, and provide a tutorial demonstrating its use in image classification, reinforcement learning, and nonlinear state-observer design.

Motivation & Objective

• To address the brittleness of standard neural networks under small input perturbations, especially in safety-critical applications.
• To provide a computationally efficient alternative to adversarial training and constrained optimization for robust neural network training.
• To integrate certified robustness into existing machine learning workflows via seamless interoperability with Flux.jl.
• To enable robust training of controllers and observers in reinforcement learning and nonlinear state estimation with formal guarantees.
• To make advanced robust neural network architectures accessible to researchers and practitioners through a high-level, user-friendly package.

Proposed method

• Utilizes Recurrent Equilibrium Networks (RENs), a flexible neural network architecture parameterized to satisfy user-defined robustness constraints.
• Employs Lipschitz-Bounded Deep Networks (LBDNs), a specialized feedforward subclass of RENs with built-in upper bounds on the Lipschitz constant.
• Directly parameterizes network weights and biases to enforce robustness, enabling training with standard optimization (e.g., SGD) while guaranteeing robustness.
• Leverages Julia’s multiple dispatch and type system for efficient and composable implementation of robust neural network layers.
• Integrates natively with Flux.jl, allowing users to compose robust models within existing machine learning pipelines.
• Uses differentiable simulation and backpropagation through dynamics to train controllers end-to-end with certified robustness.

Figure 2: Simulation of a contracting REN with a single internal state. The system is simulated from two different initial states with the same sinusoidal input. The contracting system exponentially forgets its initial condition.

Experimental results

Research questions

• RQ1 Can a neural network architecture be designed such that its robustness is guaranteed by construction, rather than learned through adversarial training?
• RQ2 How can Lipschitz constraints be embedded directly into neural network weights to ensure bounded sensitivity to input perturbations?
• RQ3 To what extent can certified robustness be achieved in real-world control tasks like reinforcement learning and state estimation without sacrificing performance?
• RQ4 How efficiently can robust neural networks be trained and deployed in practice using a high-level scientific computing language like Julia?
• RQ5 Can the integration of robust models with existing machine learning frameworks like Flux.jl be achieved with minimal code changes and full compatibility?

Key findings

• The REN and LBDN architectures allow training of neural networks with certified robustness using standard, unconstrained optimization methods.
• The package enables end-to-end training of robust controllers in reinforcement learning tasks with a Lipschitz bound of γ=20, ensuring bounded response to input variations.
• The LBDN controller successfully stabilizes a nonlinear mass-spring-damper system across 80 randomly sampled goal positions, demonstrating robustness in state estimation and control.
• The integration with Flux.jl allows seamless use of robust models in existing machine learning workflows, including differentiable simulation and backpropagation.
• The method achieves the 'best of both worlds'—robustness guarantees without the computational overhead of adversarial training or constrained optimization.
• The tutorial demonstrates successful application in image classification, reinforcement learning, and nonlinear state-observer design, validating the framework’s versatility.

Figure 3: Association of models and their parameters in (a) Flux.jl and (b) RobustNeuralNetworks.jl . In (a), model parameters $\theta$ are associated with the model . In (b), the direct parameters $\theta$ are associated with the parameterization model_ps , and are converted to explicit parameters