Towards Stable and Efficient Training of Verifiably Robust Neural Networks

Training neural networks with verifiable robustness guarantees is\nchallenging. Several existing approaches utilize linear relaxation based neural\nnetwork output bounds under perturbation, but they can slow down training by a\nfactor of hundreds depending on the underlying network architectures.\nMeanwhile, interval bound propagation (IBP) based training is efficient and\nsignificantly outperforms linear relaxation based methods on many tasks, yet it\nmay suffer from stability issues since the bounds are much looser especially at\nthe beginning of training. In this paper, we propose a new certified\nadversarial training method, CROWN-IBP, by combining the fast IBP bounds in a\nforward bounding pass and a tight linear relaxation based bound, CROWN, in a\nbackward bounding pass. CROWN-IBP is computationally efficient and consistently\noutperforms IBP baselines on training verifiably robust neural networks. We\nconduct large scale experiments on MNIST and CIFAR datasets, and outperform all\nprevious linear relaxation and bound propagation based certified defenses in\n$\\ell_\\infty$ robustness. Notably, we achieve 7.02% verified test error on\nMNIST at $\\epsilon=0.3$, and 66.94% on CIFAR-10 with $\\epsilon=8/255$. Code is\navailable at https://github.com/deepmind/interval-bound-propagation\n(TensorFlow) and https://github.com/huanzhang12/CROWN-IBP (PyTorch).\n