[Paper Review] Scaling provable adversarial defenses

Eric Wong, Frank R. Schmidt+2 more|arXiv (Cornell University)|May 31, 2018

Adversarial Robustness in Machine LearningComputer Science17 references120 citations

TL;DR

The paper extends provably robust training to large networks with skip connections using modular duals, linear-scaling bound computation via random projections, and cascade models to improve certified robustness under l-infinity attacks.

ABSTRACT

Recent work has developed methods for learning deep network classifiers that are provably robust to norm-bounded adversarial perturbation; however, these methods are currently only possible for relatively small feedforward networks. In this paper, in an effort to scale these approaches to substantially larger models, we extend previous work in three main directions. First, we present a technique for extending these training procedures to much more general networks, with skip connections (such as ResNets) and general nonlinearities; the approach is fully modular, and can be implemented automatically (analogous to automatic differentiation). Second, in the specific case of $\ell_\infty$ adversarial perturbations and networks with ReLU nonlinearities, we adopt a nonlinear random projection for training, which scales linearly in the number of hidden units (previous approaches scaled quadratically). Third, we show how to further improve robust error through cascade models. On both MNIST and CIFAR data sets, we train classifiers that improve substantially on the state of the art in provable robust adversarial error bounds: from 5.8% to 3.1% on MNIST (with $\ell_\infty$ perturbations of $ε=0.1$), and from 80% to 36.4% on CIFAR (with $\ell_\infty$ perturbations of $ε=2/255$). Code for all experiments in the paper is available at https://github.com/locuslab/convex_adversarial/.

Motivation & Objective

• Motivate scalable provable robustness against norm-bounded adversarial perturbations for larger, modern architectures.
• Develop a modular dual-function framework to bound adversarial loss for networks with skip connections and general activations.
• Achieve linear-time bound computation for l-infinity perturbations through nonlinear random projections.
• Improve robust performance using cascade (ensemble) models that certify harder examples.
• Demonstrate substantial improvements over prior provable defenses on MNIST and CIFAR-10.

Proposed method

• Construct dual networks by composing modular dual layers using Fenchel conjugates of layer operations.
• Generalize to networks with skip connections and arbitrary activations, not just feedforward structures.
• Use nonlinear random projections to estimate the adversarial bound, achieving linear scaling in hidden units for l-infinity perturbations with ReLUs.
• Provide concrete dual layers for linear operators and ReLU activations (and other activations via references), enabling automatic construction of the dual network.
• Introduce a cascading ensemble strategy where later classifiers are trained to certify only those examples not certified by earlier stages.
• Report exact probabilistic bounds at test time and discuss exact vs. projected bound computation.

Experimental results

Research questions

• RQ1 Can provable robustness bounds be extended to networks with skip connections and arbitrary activations beyond simple feedforward architectures?
• RQ2 How can we compute robust bounds efficiently for large networks under l-infinity perturbations without quadratic scaling?
• RQ3 Does integrating a cascade of robust models improve certified robustness beyond single-model defenses?
• RQ4 What are the empirical gains in verified robust error for MNIST and CIFAR-10 when scaling up network size and using projections?
• RQ5 How do these methods compare to prior provable defenses in terms of robustness bounds and training efficiency?

Key findings

• Certified robust error on MNIST improves from 5.8% to 3.1% at epsilon = 0.1.
• On CIFAR-10, robust error improves from 80% to 36.4% at epsilon = 2/255.
• For MNIST, a large model achieves 3.7% robust error (epsilon = 0.1) with non-cascaded training; cascade reduces to 3.1%.
• For CIFAR-10, ResNet achieves 46.1% robust error (epsilon = 2/255) with cascade reducing to 36.4%.
• Cascades increase nominal error but improve robust error, offering a trade-off between robustness and accuracy.
• Random projection with 50 dimensions provides similar test performance to exact bounds on MNIST, with substantial speedups.