TAPS: Connecting Certified and Adversarial Training

Summary

The paper presents TAPS, an unsound certified training method that combines the advantages of certified training IBP and adversarial training PGD. TAPS first splits the neural network into two parts, the feature extractor, and the classifier. TAPS then uses IBP to propagate the over-approximation through the feature extractor. TAPS uses PGD to estimate multiple adversarial examples inside the over-approximated box and trains with these adversarial examples. The challenge is how to backpropagate gradients through the PGD part in the middle. TAPS designs a gradient estimator to connect the backpropagation. TAPS can also be combined with the current state-of-the-art method, SABR, to reduce the regularization in the feature extractor further, leading to higher natural accuracy and certified accuracy. The experiment results show that TAPS and STAPS (TAPS+SABR) achieve the highest certified accuracy on MNIST, CIFAR10, and TinyImageNet, except for CIFAR-10 8/255.

Strengths

1. The paper presents a training method that beats the state of the art. 2. The paper conducts extensive abolition studies.

Weaknesses

1. In Table 1, STAPS has the best results in two out of five settings. And TAPS has worse results than SABR in two out of five settings. It seems SABR is as important as TAPS for STAPS. Then the discussion in Section 3.5 needs more rigorous justification. For example, the paper states that "the exponential growth of BOX abstractions still causes a strong regularization of later layers". The experimental illustration of this claim is missing. A layer by layer comparison of Figure 5 would be interesting to see.

Questions

Comment: 1. In line 92, $\bar{\mathbf{o}}^\Delta > 0$ should be $\bar{\mathbf{o}}^\Delta < 0$. 2. In Section 3.4, between lines 123 and 124, the gradient has an additional factor $2$. Questions: 1. In lines 162-164, the paper states that the j-th dimension of the latent adversarial examples is independent of the bounds in the i-th dimension. However, PGD will be affected by each dimension. Is this statement in the paper an assumption or these dimensions are in fact independent? 2. In Figure 3, it seems $c$ cannot be greater than 0.5, otherwise the gradient connector cannot be a valid function. However, in Figure 7, $c$ can be larger than 0.5, and even achieves higher natural accuracy. What do I miss here? 3. In Table 2, some settings have a time limit on MN-BaB. Does it means the certified accuracy is over-approximated, e.g., time-outed ones are considered as not certified?

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

4 excellent

Presentation

4 excellent

Contribution

2 fair

Limitations

The paper does not address any limitation. How to efficiently select hyper-parameters is a large problem for this type of training methods. For example, in Table 2, it might not be possible to completely compute the certified accuracy and to compare settings based on these metrics.

Summary

This paper aims to improve the combination of adversarial training and certified training for certified robustness. A gradient connector is proposed for jointly conducting these two kinds of training. Results show some improvement on the certified robustness after the training, as well as a more precise approximation on the worst-case loss.

Strengths

- This paper proposes a "gradient connector" which enables end-to-end training with both adversarial training and IBP-based certified training. - There is some empirical improvement on the certified accuracy on some settings (TinyImageNet), compared to prior works combining adversarial training and IBP training. - The proposed method can more precisely estimate the worst-case loss, compared to PGD, iBP, or prior methods doing the combination.

Weaknesses

The empirical improvement on the major metric, certified accuracy, is very marginal and sometimes negative: - Compared to SABR (Muller et al., 2022a), the absolute improvement on MNIST is only 0.17% or 0.22%. - On CIFAR, simply using the proposed method does not bring any improvement but may even yield lower certified accuracy. - On CIFAR eps=2/255, combining SABR and the proposed method only has an absolute improvement of 0.14%. On CIFAR eps=8/255, doing this combination still leads to worse results compared to SABR alone. Overall, the current results on all the three datasets do not sufficiently demonstrate that the proposed method is effective in practice. It is still possible that the tiny difference on MNIST and CIFAR may come from randomness, yet standard deviation is not reported. ==Updates== Thanks to the authors for the explanations. I understand that both TAPS and STAPS are contributions of this work. However, while this paper looks overall good, empirical results still look kind of weak to me (as mentioned in the first point and the third point in my original review). Thus I am maintaining my original rating.

Questions

See "Weaknesses".

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

3 good

Contribution

2 fair

Limitations

Not discussed.

Summary

This paper proposes a method called Training via Adversarial Propagation through Subnetworks (TAPS) for improving certified adversarial robustness. Specifically, TAPS splits the network $f$ into a feature extractor $f_E$ and a classifier $f_C$. During training, TAPS first uses interval bound propagation (IBP) to bound the feature extractor's exact reachable set in the embedding space and conducts adversarial attacks (PGD) in the embedding space to the classifier. This method can also be combined with other state-of-the-art methods like SABR (called STAPS) that can further improve its performance. ## post-rebuttal I've updated my score since my concerns are adequately addressed.

Strengths

1. This paper is well-motivated and well-organized. 2. The idea of connecting adversarial training and IBP training is novel and impressive. 3. The experiments show that the proposed method can outperform state-of-the-art methods for several settings.

Weaknesses

1. The certified robustness for a larger perturbation bound (8/255) is not comparable with SortNet, showing the limitation of TAPS/STAPS under certain settings. Additionally, the comparison under a larger perturbation bound (>1/255) for TinyImageNet is not provided. Based on the comparison under 8/255 for CIFAR-10, this reviewer infers that SortNet may also outperform TAPS/STARPS for a larger dataset with a larger perturbation bound. 2. The details of how to combine TAPS and SABR are not provided in Section 3.5. 3. This work only focuses on $\ell_\infty$ robustness and does not show scalability to other metrics of robustness, such as $\ell_2$-norm. 4. It seems that several experiments in this paper were not completed when submitted (Tables 2 and 3). However, I think this is acceptable since the main comparison is complete. The authors should complement the missing results if accepted. ### Minor Comments 1. Line 11. I personally suggest removing the claim of publication for your implementation and networks, even though you have anonymized the code link. As this paper is still under review, the code has not yet been published. 2. Line 44. Lack of the full spelling and reference for SABR. Also, the details for SABR are not sufficiently introduced in this paper. 3. Line 105. I suggest replacing the claim "vulnerable" of adversarial training under stronger attacks with a more moderate tone. Even under AutoAttack, the robustness of an adversarially trained model is slightly lower than PGD. So far, adversarial training is still one of the most effective methods to improve adversarial robustness. Thus, this assertion on adversarial training methods is unfair for this research area and may mislead the community. 4. Line 148. Is $\theta_F$ exactly $\theta_E$? 5. Line 595. The author stated that they provided detailed descriptions, but the location is shown as "??".

Questions

1. Line 36: Can you explain what "tractable" means in this context? 2. Lines 114-115: How is $x'$ selected for SABR? I suggest adding more details here since SABR is the main baseline of your method. 3. Although the code is provided, this reviewer strived to understand it. In particular, where is the command and variable for splitting the network? 4. What is the constraint ($\epsilon$-ball) for PGD attack in TAPS? Since PGD is conducted in the embedding space, the constraint on the input space may not be effective. 5. How about using PGD for the feature extractor and IBP for the classifier?

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

3: You are fairly confident in your assessment. It is possible that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work. Math/other details were not carefully checked.

Soundness

4 excellent

Presentation

3 good

Contribution

3 good

Limitations

N/A

Summary

The paper proposes TAPS -- a method to combine IBP and PGD to train better certified networks. The authors observe that IBP on its own leads to overestimation of the inner adversarial loss, where as PGD leads to an underestimation. Therefore, intuitively, the approximation errors may compensate for each other during training. Thus, TAPS leverages PGD on the pre-classification logits output using IBP to generate a better loss approximate. Given the non-differentiable nature of this, the authors propose a rectified linear gradient approximation to allow end to end training. Empirical results are provided for CIFAR10, MNIST and TinyImagenet, showing improvement over pure IBP and other IBP-approximation approaches.

Strengths

1. The proposed approach is well-motivated and the authors provide clear justification through experimental analysis. 2. The gradient connector is novel mechanism allowing end to end training of PGD + IBP networks. This is a creative approach towards combining two connected but complementary methods, essentially improving on COLT which sequentially leverages both. 3. The experiments are thorough and support the claims in the paper. 4. The paper is well-written and thoughtfully explains the intuition for every step in the algorithm.

Weaknesses

While not a major weakness, I would be interested to see if leveraging stronger or weaker attacks during the PGD training step significantly changes results. Perhaps a simple experiment with varying PGD iterations, or even a stronger attack like Autoattack would clearly answer this.

Questions

1. What is the computational overhead of TAPS/STAPS over other methods?

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

5: You are absolutely certain about your assessment. You are very familiar with the related work and checked the math/other details carefully.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

The authors have clearly mentioned limitations.

Response to Authors

Thanks for authors' efforts and detailed replies. I will raise my score. Overall, I'd like to see this paper being accepted. For Q1, please add a corresponding discussion to the relevant section. For Q2 please add how do you compute the numbers, i.e., "evaluate part of the test set and then report the mean across the evaluated portion", to the paper or appendix.

Comment on the rebuttal

Thank you for answering my questions. After reading through the other reviews and the rebuttal, I maintain my earlier score. Overall, I find the paper to present an interesting approach to connecting adversarial training and certification based methods.