[Paper Review] Training verified learners with learned verifiers

Krishnamurthy Dvijotham, Sven Gowal+5 more|arXiv (Cornell University)|May 25, 2018

Adversarial Robustness in Machine LearningComputer Science22 references98 citations

TL;DR

This paper introduces predictor-verifier training (PVT) to jointly train a predictor and a verifier network that bounds worst-case specification violations, achieving state-of-the-art verified robustness on MNIST/SVHN and nontrivial bounds on CIFAR-10 with faster training times.

ABSTRACT

This paper proposes a new algorithmic framework, predictor-verifier training, to train neural networks that are verifiable, i.e., networks that provably satisfy some desired input-output properties. The key idea is to simultaneously train two networks: a predictor network that performs the task at hand,e.g., predicting labels given inputs, and a verifier network that computes a bound on how well the predictor satisfies the properties being verified. Both networks can be trained simultaneously to optimize a weighted combination of the standard data-fitting loss and a term that bounds the maximum violation of the property. Experiments show that not only is the predictor-verifier architecture able to train networks to achieve state of the art verified robustness to adversarial examples with much shorter training times (outperforming previous algorithms on small datasets like MNIST and SVHN), but it can also be scaled to produce the first known (to the best of our knowledge) verifiably robust networks for CIFAR-10.

Motivation & Objective

• Motivate the need for verifiable robustness in neural networks beyond empirical defenses.
• Propose a scalable framework that jointly trains a predictor and a verifier to certify specifications.
• Leverage duality-based verification to bound worst-case violations without per-example optimization during training.
• Amortize verification cost across training examples by learning dual variables.
• Demonstrate scalability to larger datasets and state-of-the-art verified robustness results.

Proposed method

• Define a predictor network that performs the task (e.g., classification).
• Define a verifier network that outputs dual variables to bound the worst-case violation of the specification.
• Train both networks jointly using a loss that combines data-fitting with a dual-bound term (Equation 8).
• Use a dual relaxation of the verification problem to obtain an upper bound that is differentiable with respect to predictor and verifier parameters.
• Experiment with different verifier architectures (Constant, Direct, Backward-Forward) to study their impact on verification tightness and accuracy.
• Demonstrate amortized verification costs by replacing per-example optimization with a learned verifier.

Experimental results

Research questions

• RQ1 Can a neural verifier learn dual variables to tighten verification bounds during training?
• RQ2 Does predictor-verifier training enable scalable, verifiably robust models across datasets beyond MNIST/SVHN?
• RQ3 How do different verifier architectures affect verified and nominal accuracy and training efficiency?
• RQ4 Can PVT produce nontrivial verifiable robustness bounds on CIFAR-10 and compare favorably to adversarial training?

Key findings

• PVT achieves state-of-the-art verified accuracy under L_infinity perturbations for MNIST and SVHN.
• PVT scales to CIFAR-10 and provides the first nontrivial verified adversarial bound reported for this dataset.
• PVT is substantially faster to train than previous verified-training methods (e.g., 6 minutes to reach MNIST performance versus ~5 hours for a competing method).
• Verifer architectures (direct vs backward-forward) can yield competitive or better verified bounds on different datasets (constant performs worst).
• PVT outperforms standard adversarial training on verified robustness but may trade off nominal accuracy, indicating room for further improvement on clean accuracy.
• Verification time analyses show PVT models enable near-optimal bounds with modest per-example verification time (e.g., 15 ms budget).