Unlocking Deterministic Robustness Certification on ImageNet

Despite the promise of Lipschitz-based methods for provably-robust deep learning with deterministic guarantees, current state-of-the-art results are limited to feed-forward Convolutional Networks (ConvNets) on low-dimensional data, such as CIFAR-10. This paper investigates strategies for expanding certifiably robust training to larger, deeper models. A key challenge in certifying deep networks is efficient calculation of the Lipschitz bound for residual blocks found in ResNet and ViT architectures. We show that fast ways of bounding the Lipschitz constant for conventional ResNets are loose, and show how to address this by designing a new residual block, leading to the \emph{Linear ResNet} (LiResNet) architecture. We then introduce \emph{Efficient Margin MAximization} (EMMA), a loss function that stabilizes robust training by simultaneously penalizing worst-case adversarial examples from \emph{all} classes. Together, these contributions yield new \emph{state-of-the-art} robust accuracy on CIFAR-10/100 and Tiny-ImageNet under $\ell_2$ perturbations. Moreover, for the first time, we are able to scale up fast deterministic robustness guarantees to ImageNet, demonstrating that this approach to robust learning can be applied to real-world applications. We release our code on Github: \url{https://github.com/klasleino/gloro}.

Paper

References (61)

Scroll for more · 38 remaining

Similar papers

Peer review

Reviewer YimP6/10 · confidence 5/52023-07-03

Summary

This paper addresses the issue of certified accuracy with deterministic approaches by utilizing the Lipschitz property of neural networks. The authors propose a novel layer called LiResNet, which enables easy computation of the Lipschitz constant. Additionally, they introduce a new loss function called Efficient Margin Maximization (EMMA), that stabilizes robust training by simultaneously penalizing worst-case adversarial examples from all classes. Finally, the authors conduct experiments on CIFAR-10/100, Tiny-ImageNet, and ImageNet datasets, demonstrating that their approach achieves state-of-the-art results in certified accuracy under $\ell_2$ perturbations and $\epsilon = 36/255$.

Strengths

- The paper is clear and well-written. - Improving certified accuracy with deterministic approaches is clearly an important problem and the improvement over state-of-the-art is impressive.

Weaknesses

While the experimental results are good and interesting. The paper suffers from overclaiming important contributions and not discussing important related works. 1. **Overclaim on Lipschitz Residual layer**: The claim that the paper is the first to propose a Lipschitz Residual layer is incorrect. The CPL layer [1], and more recently the SLL layer [2], are two previous works that have introduced a 1-Lischitz _Residual_ layer with ReLU activation. The authors mention these two papers in the related work without discussing their contribution. The authors should discuss these works. 2. **On the efficiency and tightness of the approach**: In the abstract, the authors have written: "We show that fast ways of bounding the Lipschitz constant for conventional ResNets are loose, and show how to address this by designing a new residual block" - **On the efficiency of the approach**: I don't see how the approach is more efficient than previous works, since the authors just use the power iteration (verified in the code provided in the supplementary material as this is not mentioned in the paper or the appendix). The power iteration has been used in three previous works [3, 4, 1]. We can also note that the authors use a power iteration with 10 iterations (default value in the code) while [3,4,1] showed that using only 1 iteration was sufficient and more efficient. Therefore, I don't see how the author’s approach is "more efficient" than previous work. - **On the tightness of the bound**: It is true that the value of the Lipschitz constant of LiResNet is tighter than the one from a Residual Layer with nonlinearity, in fact, the power iteration computes the _exact_ Lipschitz of LiResNet, since LiResNet is a _linear_ layer -- the PM computes the Lipschitz of the map $x \mapsto (I + W) x$. Computing the Lipschitz of a Residual layer with a nonlinearity leads to a looser bound, because the nonlinearity allows for a lower Lipschitz. The authors should clarify this. 3. **On the new EMMA loss**. The Efficient Margin MAximization (EMMA) loss introduced in the paper is very similar to the one provided by [3]. The authors discuss the difference between their loss and the one from [3] in Appendix A, arguing that the main difference is the use of the _Lipschitz constant for each margin_ while [3] uses the _global Lipschitz constant_ (I believe this paragraph deserves to be in the main paper). This is true, however, the use of the Lipschitz constant for each margin has been proposed twice before [5, 6] (the last layer normalization reduces to the same Lipschitz), therefore, the EMMA loss is a simple combination of two known approaches. 4. **On the experiments**: Table 1 presents results only for the perturbation level of $\epsilon = 36/255$. The authors should present results for a multitude of values to show the overall robustness of their approach (or make a graph with certified accuracy vs \epsilon). A large body of work [1, 2, 6, 7, 8, 9, 10] has presented the certified robustness of their model for at least 3 or 4 perturbation thresholds. I would like to see the same comparison. In Table 2, the authors talk about "VRA performance (%)". What does VRA performance (%) mean? Again the authors should provide VRA with respect to a specific perturbation and not assert that the overall robustness of a model can be computed with only one single perturbation threshold. **Conclusion**: The paper feels like a patchwork of several existing ideas and looks more like engineering work than research work. The paper has combined the work of [3] and [5,6] for the loss, used the same algorithm (power iteration) as [3,4,1] to compute the Lipschitz, and proposed a new linear layer that seems to have good properties. They used several tricks (epsilon scheduler presented in Appendix B1, normalization trick presented in Appendix B2) without ablation study. With all this, they showed that it is possible to improve the certified accuracy for $\epsilon = 36/255$ and managed to achieve very good certified accuracy on ImageNet, which has not been done before. I find the results of this paper interesting because I think the overall problem is interesting and important, but I think the paper (in its current form) has little impact on the topic of certified accuracy with deterministic approaches. To improve the research value of the paper, the authors should provide a comprehensive ablation study and explain how and why these different techniques, when combined together, significantly improve certified accuracy. [1] Meunier et al., A Dynamical System Perspective for Lipschitz Neural Networks ICML 2022 [2] Araujo et al., A Unified Algebraic Perspective on Lipschitz Neural Networks, ICLR 2023 [3] Tsuzuku et al., Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks, NeurIPS 2018 [4] Farnia et al., Generalizable Adversarial Training via Spectral Normalization, ICLR 2019 [5] Leino et al., Globally-Robust Neural Networks, ICML 2021 [6] Singla et al. Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100, ICLR 2022 [7] Trockman et al., Orthogonalizing Convolutional Layers with the Cayley Transform, ICLR 2021 [8] Singla et al, Skew Orthogonal Convolutions, ICML 2021 [9] Prach et al., Almost-Orthogonal Layers for Efficient General-Purpose Lipschitz Networks, ECCV 2022 [10] Huang et al., Training certifiably robust neural networks with efficient local Lipschitz bounds, NeurIPS 2021

Questions

The authors have combined many different techniques and tricks to achieve their certified robustness. An ablation study would be interesting to identify those that increase the certified robustness. - What is the performance of the author's architecture with an SLL layer that is 1 Lipschitz? - What is the performance of the author's architecture with the loss from [3]? How does the EMMA loss improve the VRA? The authors added some tricks for better training: the epsilon scheduler presented in Appendix B1 and the normalization trick presented in Appendix B2. - How does the epsilon scheduler affect the final certified accuracy? - How does the normalization trick affect the final certified accuracy? - What is the certified accuracy for other perturbation thresholds? (e.g. $72/255$, $108/255$, $1$ to allow comparison with other work) [3] Tsuzuku et al., Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networks, NeurIPS 2018

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

2 fair

Presentation

2 fair

Contribution

2 fair

Limitations

The authors discussed the limitation of robust classification.

Reviewer jf6o5/10 · confidence 4/52023-07-04

Summary

This paper proposes Linear ResNet (LiResNet) and Efficient Margin Maximization (EMMA) loss for scalable training of provably robust deep neural network classifiers. With these two contributions, this work is able to achieve SOTA deterministic VRA on medium-to-large classification tasks.

Strengths

- The paper is clearly written. - The proposed method demonstrates strong empirical performance.

Weaknesses

I am willing to raise the score by 1 or 2 points if the authors answer my questions satisfactorily. **Weakness 1 : Ambiguity regarding the scalability of LiResNets.** - The authors do not exactly pinpoint why LiResNets are scalable. In Table 2 (b), the authors show VRA of ConvNets, ResNets, and LiResNets at various depths. Then, the authors just describe the table as-is, without any further discussion or analysis. Why do ConvNets diverge? Is it because of vanishing or exploding gradients? Why do ResNets have lower VRA than LiResNets? Is it because LiResNets enable tighter Lipschitz constant estimation? Is it because LiResNets allow faster convergence to optima? If there are multiple factors at work, how much does each factor contribute to the final VRA? **Weakness 2 : Hand-wavy logic regarding the rotating threatening class phenomenon and EMMA.** - Section 5.2, line 282, "rotating threatening class phenomenon observed during training may contribute to suboptimal training." --> Table 2 (a) only shows VRA before and after applying EMMA. How do we know whether performance gain comes because EMMA prevents the rotating threatening class phenomenon? Only a hand-wavy explanation in Section 4, line 209-215 is given. I would appreciate a more rigorous theoretical or experimental analysis of EMMA. **Concern 1 : Representation power of LiResNets.** - I get that LiResNet can admit tighter Lipschitz constant estimation. However, how scalable is LiResNet compared to ResNet in terms of clean accuracy when trained with cross entropy? Doesn't using linear residual blocks reduce the representation power of ResNets? If LiResNets have less representation power than ResNets, wouldn't we eventually have to return to ResNets when we have better training techniques and aim for even higher VRA?

Questions

**Question 1** : Power method is used throughout training to estimate the global Lipschitz constant. How many iterations of power method is used at each step of training? How tight is the Lipschitz constant estimate? **Question 2** : It is widely known that there is an accuracy-robustness trade-off. TRADES offers a hyper-parameter to control that trade-off. Would it be possible to control the trade-off for EMMA as well? How does the accuracy-robustness pareto frontier for LiResNet+EMMA compare to other methods?

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

3 good

Contribution

3 good

Limitations

Discussed in Section 6.

Reviewer diKy4/10 · confidence 3/52023-07-06

Summary

- The paper investigates Lipschitz-based Certification of neural networks. - Authors aim to certify ResNets by extending the techniques from GLORO. - Authors note that it is difficult to come up with a tight approximation of the residual block - So authors replace the non-linear residual block to a linear block. They are then able to adapt GLORO results - Authors add the non-linearities after the linear residual block.

Strengths

1. Good writing - The paper is well written. I could follow all the sections in one pass. - Authors have now also added sections discussing transformers and complications with verifying them. 2. Thorough experiments - A wide range of experiments are conducted on various datasets. - The experimental results look decent. - I have a question regarding the clean accuracy, which I have added in the questions section. 3. Good problem - Certifying residual blocks is definitely worth doing. - As authors mentioned, residual connections are also used in Transformers.

Weaknesses

1. about the effectiveness of LiResNet - Main trouble in verification comes from the non-linearity. It feels natural that removing non-linearities will make things easier. The authors are not really verifying the resnet as such. - If $x + conv(x)$ can be written as a conv layer, then are you really verifying residual connections or just verifying a linear layer?

Questions

- Regarding the clean accuracy, why is it higher than the baselines? - Can you compare the numbers with networks of the same size? - This will explain whether having such a network (as opposed to usual ResNet) is useful more broadly.

Rating

4: Borderline reject: Technically solid paper where reasons to reject, e.g., limited evaluation, outweigh reasons to accept, e.g., good evaluation. Please use sparingly.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

3 good

Presentation

3 good

Contribution

2 fair

Limitations

Yes, limitations are discussed well.

Reviewer xiEp7/10 · confidence 4/52023-07-07

Summary

This paper aims to scale up deterministic certified robustness to deeper neural networks (ResNet) and more complicated datasets (ImageNet). To this end, the authors proposed a new residual block named LiResNet and a new loss function named Efficient Margin Maximization. The proposed method achieves the state of the art results on various benchmarks.

Strengths

This paper is very well written and easy to follow. Each design choice is well motivated and thorough experiments demonstrated the effectiveness of the proposed methods. - The proposed LiResNet architecture is a simple but effective technique to bypass the difficulty in certifying ResNet. Experiments also showed its scalability to deeper networks. - The new loss is well motivated by the experiment finding that the inconsistency of the threatening classes increases when number of classes increases. - Comprehensive experiments on various datasets have shown the effectiveness of the proposed methods and established new state-of-the-art.

Weaknesses

- Despite the effectiveness of LiResNet in certified robustness, it may be still less expressive and scalable than the actual ResNet. It would be good to discuss the limitation of the LiResNet architecture: what do we sacrifice by "linearizing" the skipping connection? - The new proposed loss is well motivated, but it seems that in the experiment there is no ablation study on it. It'd be good to include Gloro + LiResNet but without EMMA to show the improvement of EMMA compared to the Gloro loss.

Questions

Is there any normalization layer in the LiResNet architecture? There seems to be none in Figure 2(a). It is a bit surprising the it can scale so well in depth without any normalization layers.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

4 excellent

Contribution

3 good

Limitations

Yes.

Reviewer jf6o2023-08-11

Updated Score

The authors have answered my questions satisfactorily, and I have raised the score by a point.

Authorsrebuttal2023-08-11

Thanks for reading our response and increasing the score.

Reviewer YimP2023-08-14

Thank you for this extensive rebuttal. Some further comments.

Thank you for this extensive rebuttal. Here are some further comments: 1. **On the tightness of the bound** : thank you for providing this experiment, however, in my opinion, it is not even necessary to provide this comparison. The looseness of the bound on the residual layer with ReLU comes from the nonlinear activation, by removing it the calculation of the Lipschitz of the layer becomes exact. It is actually straightforward. Nevertheless, a small discussion must be provided in the paper: computing the exact bound using power iteration, the PM can approximate the Lipschitz of the layer with arbitrary precision with respect to the number of iterations. A small number of iterations can be done during training as the PM can converge progressively during training. A large number of iterations can be performed during inference as the values can be cached given they are independent of the input. 2. **Comparison between SLL and LiResNet**: I strongly believe that this experiment was missing in the original version of the paper. It justifies why LiResNet is a good idea and useful. The remaining experiments are, in my opinion, further optimizations to improve the accuracy. I would suggest expanding the discussion on state-of-the-art ResNet-Like Lispchitz layers (which is almost non-existent in the current version) and explaining the difference between LiResNet and SLL. 3. **Regarding the title of the paper**: The authors insist on the "depth" and on "unlocking certified accuracy on ImageNet". First, from Table 2 (b), the increase in certified accuracy with respect to the depth is minimal, so I would assume that certified accuracy clearly saturates very quickly. Furthermore, it is not very clear that depth allows for an increase in certified accuracy, it could also be the increase in the number of parameters. Therefore, I am not sure that the authors should focus on this specific parameter. Second, the title claims the first certified accuracy with ImageNet, which is incorrect. Randomized smoothing has provided probabilistic certificates on ImageNet for a long time. What the authors have shown is the first method that provides certified accuracy on ImageNet with _deterministic_ certificates and this is not emphasized enough. Maybe a better title would be: "Unlocking Deterministic Robustness Certification on ImageNet" or something similar. I will raise my score and encourage the authors to update the paper accordingly.

Authorsrebuttal2023-08-21

Thank you for your responses.

Thanks for providing us with more feedback! We would love to add the comparisons with SLL nets and the discussion on LiResNet v.s. SLL nets to the main body of the paper once we are giving a chance to update the writing. The discussion of PM will also go in the writing in the near feature. We thank for the suggestions on the title. "Unlocking Deterministic Robustness Certification on ImageNet" seems to be a good one. We will reword a bit but the reviewer's concern on the deterministic v.s. probabilistic aspect makes sense to us. Thank you!

Reviewer xiEp2023-08-21

Thanks the authors for their response. Although LiResNet is not as expressive as ResNet, it is a step towards scaling up certified robustness to larger architecture and more complicated dataset. Therefore, I lean towards accepting the paper.

Reviewer diKy2023-08-21

Comment

Hi, Thanks to the authors for their response. 'We would like to highlight that main issue with the Lipschitz-based approaches on conventional ResNet is not originated from the nonlinearity of the module – it comes from bounding the addition of the residual branch and the skip connection , which is a linear part in a ResNet block.' If the problem is not coming from the non-linearity, then why are you able to get a tighter bound when you replace g(x) with conv(x)? For r(x) = x + g(x), as long as g is a linear layer of a conv layer, you can get a tight bound. As soon as g(x) contains a non-linearity, your bound is loose. So you replace it with a simple linear/conv layer. Is this not what you do? 'This is exactly analogous to how a convolutional layer can be written as a dense layer, while clearly a convolutional network is not the same as a dense network in any meaningful way.' Yes, it can. In verification papers, for deriving bounds for conv layers, they are indeed treated as linear layers. but there the non-linearity comes before the residual connection not after. If you take r(x) = x + g(x), where g(x) is a conv and non-linearity, then this cannot be written as a linear layer. Regarding the clean accuracy, why is it higher than the baselines? This is an important question. Firstly, I would like to decouple the architecture from the method. Secondly, I don't quite understand why the network has better accuracy than normal ResNet. Is the claim that your network is better than ResNet? That is a very strong claim. I barely understant what this means ' facilitate a better trade-off between expressiveness (depth) and tight Lipschitz bounds, allowing us to learn a robust function with less overregularization; thus the clean accuracy is also higher.' Can you compare the numbers with networks of the same size? I would like to understand in more detail, what is causing the difference in results. This relates to my previous question. I have already seen the results from the paper.

Authorsrebuttal2023-08-22

Response to the follow-up questions (1/2)

_High-level Comment_ Based on the discussion, we believe there is confusion regarding the primary contribution of this work. We are not proposing a new certification technique. Rather, we - (1) identify a fundamental problem for certified training of ResNets, and - (2) propose a new type of residual architecture that solves this problem. The LiResNet architecture is specifically made to make existing certification techniques (e.g., GloRo) more effective and scalable, and we show that it can lead to significant increases in the SoTA for deterministically certified accuracy. _Responses to Questions_ > If the problem is not coming from the non-linearity, then why are you able to get a tighter bound when you replace g(x) with conv(x)? For r(x) = x + g(x), as long as g is a linear layer of a conv layer, you can get a tight bound. As soon as g(x) contains a non-linearity, your bound is loose. So you replace it with a simple linear/conv layer. Is this not what you do? Perhaps we misunderstood your original question. It is true that we remove the nonlinearity from inside the residual block (making the residual branch linear) and place it after the skip connection is joined. But this does *not* remove the nonlinearities from the network as a whole, so they can still introduce looseness, but not in a way that is as problematic as when the bound is estimated as the sum of the residual and skip branches. We suspect the major concern here is about the term “ResNet.” It is true that we are not verifying the “conventional” ResNet as proposed in [1]; however, our LiResNet block maintains the skip connections, which is why this is a true residual architecture. E.g., according to the original authors in [1]: “Formally, in this paper we consider a building block defined as: $y = F(x, \{W\}) + x$." Notably there is no stipulation that $F$ must be nonlinear. The most conventional ResNet, “[in] the example in Fig. 2..., $F = W_2\sigma(W_1 x)$" is clearly simply an instantiation of the general residual framework. Regardless, the goal in this work is not to certify a specific architecture, but rather, to make the benefits of residual networks possible in the context of certified training in order to train deeper certified networks with higher VRA. We will try to clarify the writing so there is not confusion over what we mean by “verifying ResNet.” > 'This is exactly analogous to how a convolutional layer can be written as a dense layer, while clearly a convolutional network is not the same as a dense network in any meaningful way.' Yes, it can. In verification papers, for deriving bounds for conv layers, they are indeed treated as linear layers. but there the non-linearity comes before the residual connection not after. If you take r(x) = x + g(x), where g(x) is a conv and non-linearity, then this cannot be written as a linear layer. We believe you might have misunderstood our reply. Any conv layer can be written as a dense layer. But this doesn’t mean there is no meaningful difference between a conv layer and a dense layer. This is just as true for a LiResNet block. It can be written as a conv (or dense) layer by reparameterization, but it adds an additional constraint that allows the gradient to flow through the skip connection, thus it is meaningfully different from a conv layer. By saying there is a meaningful difference, we don’t mean it requires a new certification technique. Of course, LiResNet blocks can have their LC bounded in the same way as other linear layers (e.g., convolutions), but note that the novel part of our work is not the use of the power method for obtaining the bound on the LC of a layer, which has been used by prior work.

Authorsrebuttal2023-08-22

Responses to the follow-up questions (2/2)

> Regarding the clean accuracy, why is it higher than the baselines? This is an important question. Firstly, I would like to decouple the architecture from the method. Secondly, I don't quite understand why the network has better accuracy than normal ResNet. Is the claim that your network is better than ResNet? That is a very strong claim. I barely understant what this means ' facilitate a better trade-off between expressiveness (depth) and tight Lipschitz bounds, allowing us to learn a robust function with less overregularization; thus the clean accuracy is also higher.' We are still unclear what comparisons you are asking for (also, we would like to point out that the architecture is the major contribution, not the way the network is certified—we did not propose a new certification method). Our results do indicate that LiResNet is better than standard ResNet **for certified training**. This is because the LC estimation is too loose on the standard ResNet, leading to over-regularization and loose certificates; the former negatively impacts the clean accuracy, and both negatively impact the VRA. LiResNet allows us to train deep networks while maintaining a tighter bound, which leads to less unnecessary regularization, and tighter certificates. We did not claim that LiResNet is better than ResNet in settings where we are not training specifically for certified robustness. Note that the models in our evaluation are trained for certified robustness, and “clean accuracy” is measured on these same models, not on models that were trained using standard (non-robust) training (this is standard practice in the literature on deterministic robustness certification). Regarding the comparison to the “baseline” we are unsure what baseline you are referring to, and which models you believe don’t have a comparison to a similarly-sized model. *As it approaches the deadline of the rebuttal phase and in case we are not able to continue the conversation, we have provided a few alternative replies below*: - **If by “the baseline” you mean the ResNet column in table 2b**, the answer is that these ResNet and LiResNet architectures are roughly the same size, and the difference in performance primarily stems from the looser bound on ResNets. As mentioned, the looser bound leads to over-regularization: when the bound is loose, the model effectively has to certify at a much larger radius. Because we empirically observe a robustness-accuracy trade-off (as referenced by reviewer jf6o), certifying at a higher effective radius leads to the model sacrificing clean accuracy. - **If by “the baseline” you mean the ResNet rows in table 1**, those rows use a different approach to certifying standard ResNets from prior work (SLL). In table 3 in the attached pdf (in the global Rebuttal), we provide an apples-to-apples comparison of our architecture with the LiResNet blocks replaced by SLL layers (which yields a more conventional ResNet). Here we see that the performance of the conventional ResNet (SLL) is a lot lower than the LiResNet. Overall, we hope our responses are helpful to address the reviewer's concerns in the contributions and some empirical results. We are grateful for the reviewer's feedback on the paper and our conversations should be reflected in the writing when we are given a chance to do so in the near future. #### Reference [1] Kaiming He et al. Deep Residual Learning for Image Recognition, CVPR 2015.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC