Training verified learners with learned verifiers

2018/05/25 by Krishnamurthy Dvijotham, Dvijotham, Krishnamurthy, Sven Gowal +13 · 7 citations
Computer Science · Mathematics · #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Explainable Artificial Intelligence (XAI) #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.1805.10265

openalex publication_date 2018/05/25 · arxiv created 2018/05/29 · arxiv updated 2018/05/30 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

This paper proposes a new algorithmic framework, predictor-verifier training, to train neural networks that are verifiable, i.e., networks that provably satisfy some desired input-output properties. The key idea is to simultaneously train two networks: a predictor network that performs the task at hand,e.g., predicting labels given inputs, and a verifier network that computes a bound on how well the predictor satisfies the properties being verified. Both networks can be trained simultaneously to optimize a weighted combination of the standard data-fitting loss and a term that bounds the maximum violation of the property. Experiments show that not only is the predictor-verifier architecture able to train networks to achieve state of the art verified robustness to adversarial examples with much shorter training times (outperforming previous algorithms on small datasets like MNIST and SVHN), but it can also be scaled to produce the first known (to the best of our knowledge) verifiably robust networks for CIFAR-10.

Citations

• Adversarial Examples: Attacks and Defenses for Deep Learning
• Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Survey
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Learning Multiple Layers of Features from Tiny Images

Cited by

• Bridging Efficiency and Safety: Formal Verification of Neural Networks with Early Exits
• TriGuard: Testing Model Safety with Attribution Entropy, Verification, and Drift
• On Training Robust PDF Malware Classifiers
• Practical Solutions for Machine Learning Safety in Autonomous Vehicles
• Learning to Optimize by Differentiable Programming
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Enhancing Certifiable Robustness via a Deep Model Ensemble
• Towards Robust Detection of Adversarial Examples

Related

• VNN: Verification-Friendly Neural Networks with Hard Robustness Guarantees
• PROVEN: Certifying Robustness of Neural Networks with a Probabilistic Approach
• Fast Training of Provably Robust Neural Networks by SingleProp
• Training Verification-Friendly Neural Networks via Neuron Behavior Consistency
• Neural Network Robustness as a Verification Property: A Principled Case Study