Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers

TL;DR

This paper introduces two regularizers that improve the tightness of convex relaxation bounds in training neural networks for certifiable robustness, leading to higher certified accuracy against adversarial attacks.

Contribution

The paper proposes novel regularizers that enhance the tightness of convex relaxations, resulting in more accurate robustness certification in neural network training.

Findings

Regularizers increase certified accuracy across experiments.

Tighter bounds reduce the gap between certifiable and empirical robustness.

Regularized models outperform non-regularized baselines.

Abstract

Convex relaxations are effective for training and certifying neural networks against norm-bounded adversarial attacks, but they leave a large gap between certifiable and empirical robustness. In principle, convex relaxation can provide tight bounds if the solution to the relaxed problem is feasible for the original non-convex problem. We propose two regularizers that can be used to train neural networks that yield tighter convex relaxation bounds for robustness. In all of our experiments, the proposed regularizers result in higher certified accuracy than non-regularized baselines.