Timezone: »

 
Connecting Certified and Adversarial Training
Yuhao Mao · Mark Müller · Marc Fischer · Martin Vechev

Fri Jul 28 06:20 PM -- 06:50 PM (PDT) @
in 2nd Workshop on Formal Verification of Machine Learning »
Training certifiably robust neural networks remains a notoriously hard problem. While adversarial training optimizes under-approximations of the worst-case loss, which leads to insufficient regularization for certification, certified training methods, optimize loose over-approximations, leading to over-regularization and poor accuracy. In this work, we propose TAPS, a novel certified training method combining IBP and PGD training to optimize more precise, although not necessarily sound, worst-case loss approximations, reducing over-regularization and increasing certified accuracy. Empirically, TAPS achieves a new state-of-the-art in many settings, e.g., reaching a certified accuracy of 22\% on TinyImageNet for $\ell_\infty$-perturbations with radius $\epsilon=1/255$.

Author Information

Yuhao Mao (ETH Zurich)
Mark Müller (ETH Zurich)
Marc Fischer (ETH Zurich)
Martin Vechev (ETH Zurich)

More from the Same Authors