Semidefinite relaxations for certifying robustness to adversarial examples
Despite their impressive performance on diverse tasks, neural networks fail catastrophically in the presence of adversarial inputs-imperceptibly but adversarially perturbed versions of natural inputs. We have witnessed an arms race between defenders who attempt to train robust networks and attackers who try to construct adversarial examples. One promise of ending the arms race is developing certified defenses, ones which are provably robust against all attackers in some family. These certified defenses are based on convex relaxations which construct an upper bound on the worst case loss over all attackers in the family. Previous relaxations are loose on networks that are not trained against the respective relaxation. In this paper, we propose a new semidefinite relaxation for certifying robustness that applies to arbitrary ReLU networks. We show that our proposed relaxation is tighter than previous relaxations and produces meaningful robustness guarantees on three different foreign networks whose training objectives are agnostic to our proposed relaxation.
Summary =============== The paper proposes a method to certify the adversarial robustness of a given ReLU neural network. The main difficulty in certifying these networks is dealing with the non-convex ReLU constraints. The proposed method formulates these as quadratic constraints to obtain a quadratic program that is then relaxed to an SDP. The idea is natural and well-executed. An important feature of this approach is that the verified network does not need to be "verification-aware" (i.e. trained towards the goal of being verifiable by this procedure). The experimental results are compelling, constructing the first certificate of robustness for verification-oblivious MNIST models w.r.t. moderate sized L_infty perturbations. This is a clear step of progress towards robust and verifiable modes, thus I recommend acceptance.  Quality =============== The problem studied is important and has received significant attention recently. The method is natural and effective. All necessary experiments are conducted. There is a good amount of analysis explaining how the method differs in terms of approximation tightness from the corresponding LP relaxations qualitatively and quantitatively.  Clarity =============== The paper is well-written. The approach and analysis is clear. There are a few places where writing looks sloppy (e.g. beginning of Section 3.2) but this has no effect on the overall readability.  Originality =============== The approach is novel and is clearly differentiated from prior work. While SDP formulations for NN verification where also proposed in Raghunathan et al [17] the approach is essentially completely different. In fact, it's unclear if these SDP relaxation could scale reasonably to more than a single layer.  Significance =============== Training adversarially robust models is an important topic. There are currently three approaches towards evaluating these models: a) empirical, b) exact verification, c) efficient upper bounds. This paper makes a significant step in direction c). In fact it is the first method to verify independently trained networks on MNIST against moderate-sized adversaries (eps=0.1).  Additional comments =============== I don't understand the choice of using a 2-layer neural network for the LP-NN. The paper of Kolter and Wong [11] uses larger models and achieves a provable error rate of at most 8% with LP-cert (half the error rate you report in Table 1). Why wasn't the original model from their paper used?  Comments to the authors =============== 66. "..and is likely intractable.": In fact the ReLUplex paper shows that verifying ReLU networks is NP-hard in general. 274. "tighte", typo References: you list Madry et al. twice.  ** UPDATE ** ============== While I stand behind my original score based on the technical contributions of the paper, I agree with Reviewer 2 that several improvements to the exposition are in order. I believe that the authors should implement these improvements independent of the final decision. I personally would like to see experimental results for LP-NN applied to large models.