Training verified learners with learned verifiers

Abstract

This paper proposes a new algorithmic framework, predictor-verifier training, to train neural networks that are verifiable, i.e., networks that provably satisfy some desired input-output properties. The key idea is to simultaneously train two networks: a predictor network that performs the task at hand,e.g., predicting labels given inputs, and a verifier network that computes a bound on how well the predictor satisfies the properties being verified. Both networks can be trained simultaneously to optimize a weighted combination of the standard data-fitting loss and a term that bounds the maximum violation of the property. Experiments show that not only is the predictor-verifier architecture able to train networks to achieve state of the art verified robustness to adversarial examples with much shorter training times (outperforming previous algorithms on small datasets like MNIST and SVHN), but it can also be scaled to produce the first known (to the best of our knowledge) verifiably robust networks for CIFAR-10.

References in corpus (5)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
• Adversarial Examples: Attacks and Defenses for Deep Learning
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey

Cited by in corpus (53)

• Robustness May Be at Odds with Accuracy
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
• Scalable agent alignment via reward modeling: a research direction
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond
• Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifiers
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Practical Solutions for Machine Learning Safety in Autonomous Vehicles
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• Provably Robust Boosted Decision Stumps and Trees against Adversarial Attacks
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Defense against Adversarial Attacks in NLP via Dirichlet Neighborhood Ensemble
• Randomized Smoothing of All Shapes and Sizes
• Efficient Exact Verification of Binarized Neural Networks
• Towards a Robust Deep Neural Network in Texts: A Survey
• Learning Security Classifiers with Verified Global Robustness Properties
• On Fast Adversarial Robustness Adaptation in Model-Agnostic Meta-Learning
• Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation
• Certified Robustness to Adversarial Word Substitutions
• ML-LOO: Detecting Adversarial Examples with Feature Attribution
• A Provable Defense for Deep Residual Networks
• Towards Robust Detection of Adversarial Examples
• A Research Agenda: Dynamic Models to Defend Against Correlated Attacks
• Online Robustness Training for Deep Reinforcement Learning
• Bag of Tricks for Adversarial Training
• Enhancing Certifiable Robustness via a Deep Model Ensemble
• Cost-Aware Robust Tree Ensembles for Security Applications
• SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions
• Feature Prioritization and Regularization Improve Standard Accuracy and Adversarial Robustness
• On Training Robust PDF Malware Classifiers
• Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers
• Fast Certified Robust Training with Short Warmup
• Adversarial robustness via robust low rank representations
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• Towards Improving Adversarial Training of NLP Models
• Defending Pre-trained Language Models from Adversarial Word Substitutions Without Performance Sacrifice
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
• Generating Adversarial Examples with Graph Neural Networks
• Differentially Private Adversarial Robustness Through Randomized Perturbations
• On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
• Neural Network Branch-and-Bound for Neural Network Verification
• Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models
• Universal Approximation with Certified Networks
• A Distributionally Robust Optimization Method for Adversarial Multiple Kernel Learning
• Learning Neural Models for Natural Language Processing in the Face of Distributional Shift
• Towards Evaluating and Training Verifiably Robust Neural Networks
• Learning to Give Checkable Answers with Prover-Verifier Games