Verifiably Robust Conformal Prediction

Conformal Prediction (CP) is a popular uncertainty quantification method that provides distribution-free, statistically valid prediction sets, assuming that training and test data are exchangeable. In such a case, CP's prediction sets are guaranteed to cover the (unknown) true test output with a user-specified probability. Nevertheless, this guarantee is violated when the data is subjected to adversarial attacks, which often result in a significant loss of coverage. Recently, several approaches have been put forward to recover CP guarantees in this setting. These approaches leverage variations of randomised smoothing to produce conservative sets which account for the effect of the adversarial perturbations. They are, however, limited in that they only support $\ell^2$-bounded perturbations and classification tasks. This paper introduces VRCP (Verifiably Robust Conformal Prediction), a new framework that leverages recent neural network verification methods to recover coverage guarantees under adversarial attacks. Our VRCP method is the first to support perturbations bounded by arbitrary norms including $\ell^1$, $\ell^2$, and $\ell^\infty$, as well as regression tasks. We evaluate and compare our approach on image classification tasks (CIFAR10, CIFAR100, and TinyImageNet) and regression tasks for deep reinforcement learning environments. In every case, VRCP achieves above nominal coverage and yields significantly more efficient and informative prediction regions than the SotA.

Paper

Similar papers

Peer review

Reviewer gWvg5/10 · confidence 3/52024-07-05

Summary

The authors propose a novel method to recover coverage guarantees for conformal predictions in the presence of adversarial attacks. Unlike previously proposed approaches, the authors directly leverage verifiable methods for NN to compute prediction scores. Through empirical tests, the authors prove the benefit of the proposed approach against attacks bounded by different norms.

Strengths

1. Empirical results support the benefit of the proposed approach against vanilla CP, RSCP+ 2. The proposed approach seems to be robust across different values of the adversarial perturbation 3. The approach is well-described and the coverage guarantees are supported by theoretical arguments

Weaknesses

1. In the paper, the authors focus on PDG. However, the literature offers more advanced and sophisticated attacks. It would be beneficial to assess the robustness of the proposed approach against other type of attacks. 2. Since it is not specified in the paper, I assume the ML model under attack has not been trained using adversarial training. The reader might wonder whether the benefit of the proposed approach remains valid in the presence of an adversarially trained model. Concerning the latter case, will vanilla CP still violate the coverage guarantees? 3. Figure 2 is hard to read. Which curve represents the proposed approach, and which one represents the benchmarks? Concerning Figure 2a: Why does the coverage go to one as the magnitude of the adversarial perturbation goes to one? Perhaps it is because all the methods converge to a trivial prediction set. However, this should be clearly explained in the text. Concerning Figure 2b: Why does the coverage decrease as a function of the number of samples?

Questions

See Weaknesses

Rating

5

Confidence

3

Soundness

3

Presentation

3

Contribution

2

Limitations

Limitations are discussed

Reviewer iDUp5/10 · confidence 4/52024-07-12

Summary

The paper provides a verifiably robust conformal prediction method via neural network verification. It considers two paradigms for considering the perturbation either at the calibration stage or the inference stage. They also consider the validity of method for both classification and regression.

Strengths

1. The paper is well written. I believe people with other background can also understand it well. 2. The methods work for me. It is clear that NN verification provides a lower/upper bound of the logits, which are transformed to certified bound for conformity scores.

Weaknesses

1. Novelty: I understand that it is a new angle that combines NN verification and conformal prediction to provide a certifiably robust conformal prediction framework, but I wonder technically, can we do more about the combination. For example, can we have new conformity score adapted to NN verification that can provide tighter bound? Or at least empirically, we can analyze what types of conformity scores are more suitable for randomized certification? What are more suitable for deterministic certification (NN verification). 2. What is the intuition that the method can outperform RSCP+ in Table 1? Since usually randomized smoothing provides better certification than NN verification, then coming to the conformal prediction context, what makes the difference? 3. Missing related work: Kang, Mintong, et al. COLEP: Certifiably Robust Learning-Reasoning Conformal Prediction via Probabilistic Circuits. ICLR 2024.

Questions

Please refer to the weakness part. Overall, I do not have many concerns about the paper's soundness. If the authors can provide more insights into comparisons between randomized certification and deterministic certification in robust conformal prediction, it would be beneficial to the community. Basically, the authors need more support of why NN verification-based conformal prediction is worthy besides it can provide a general $\ell_p$ norm guarantee.

Rating

5

Confidence

4

Soundness

3

Presentation

3

Contribution

2

Limitations

discussed in Sec 6.1

Reviewer cbGx6/10 · confidence 4/52024-07-16

Summary

This submission proposes VRCP, a framework for verifiably robust conformal prediction under Lp-bounded adversarial attacks. The framework integrates existing bound propagation tools for verification of conformal predictions. Two variants, VRCP-I that triggers bound computation at inference time and VRCP-C that triggers bound computation at calibration time, are proposed. VRCP-I has inference overhead but the set size is smaller. Experiments on CIFAR10, CIFAR100, and a regression task demonstrate the effectiveness.

Strengths

1. The submission introduces a feasible method to turn well-studied neural network verifiers into conformal prediction verifiers. The method is sound in theory and is also verified empirically. This is a novel contribution to the field. 2. Compared to existing verifiably robust conformal prediction methods, VRCP has superior empirical performance especially when compared to randomized smoothing, demonstrating its practical value. 3. Presentation is generally great and easy to follow.

Weaknesses

1. The framework is relatively straightforward. The foundation is some probability relaxations that can be intuitively derived. I would not view this intuitiveness as a weakness. However, it would be great if the authors could discuss some extensions and optimizations, e.g., proof sharing for VRCP-C, alternative but more verification-friendly score function design, etc. 2. Some in-depth discussion could benefit the submission. Concretely, why does VRCP work with different Lp norms? Does the benefit come from the existing verifier's flexibility? Does the bound tightness differ with different Lp norms? Why does the method surpass RSCP? 3. The experimental setup is not very clear: What is the model's normal accuracy? Could you provide more background on the setup of regression experiments especially the physical meaning of the reward bound and nominal performance? The setting is not very common in the literature. Minor: Line 129-130: the lengthy sentence seems to be lacking a period or comma.

Questions

See weaknesses.

Rating

6

Confidence

4

Soundness

3

Presentation

4

Contribution

3

Limitations

Yes, authors discuss the limitations in the last paragraph of the main text.

Reviewer iDUp2024-08-11

Thanks for the rebuttal

Thank the authors for the rebuttal. Overall, I think this paper is technically sound and the first combination work of NN verification and conformal certification. I will maintain a borderline because the motivation for using it instead of RSCP is not very strong besides the arbitrary $\ell_p$ norm. Although, RSCP requires many samples, this work is also not efficient due to NN verification. I also do not think RSCP can not be tailored for regression tasks.

Reviewer gWvg2024-08-12

I would like to thank the authors to take the time to write the rebuttal to address my concerns. Although I appreciate the paper motivation, I think that the contribution is limited. I will keep my previous score.

Reviewer cbGx2024-08-14

Thanks for the response! Most of my concerns are resolved. So I maintain my score. > Does the bound tightness differ with different Lp norms? Sorry the question may not be clear enough. I was asking whether the gap between verifier's score bound and actual score minimum / maximum for perturbed inputs can become larger/smaller among different Lp norms.

Authorsrebuttal2024-08-14

Thank you for your response. > Sorry the question may not be clear enough. I was asking whether the gap between verifier's score bound and actual score minimum / maximum for perturbed inputs can become larger/smaller among different Lp norms. Yes, it differs between different $\ell_p$ norms. For example, $\ell_\infty$ results in larger gaps for the same attack budget $\epsilon$. This is because the $\ell_\infty$ ball contains other $\ell_p$ balls. However, it should be noted that verifiers tend to over-approximate non-linear norms (e.g., $\ell_2, \ell_3, \dots$) more than linear norms (e.g., $\ell_1$ and $\ell_\infty$). This means for non-linear norms, we may get larger gaps than linear norms. We hope this answers your questions.

Program Chairsdecision2024-09-25

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC