Asymmetric Certified Robustness via Feature-Convex Neural Networks

Samuel Pfrommer, Brendon G. Anderson, Julien Piet, Somayeh Sojoudi

Keywords: robustness, certification, convex, machine learning

Abstract: Recent works have introduced input-convex neural networks (ICNNs) as learning models with advantageous training, inference, and generalization properties linked to their convex structure. In this paper, we propose a novel feature-convex neural network (FCNN) architecture as the composition of an ICNN with a Lipschitz feature map in order to achieve adversarial robustness. We consider the asymmetric binary classification setting with one "sensitive" class, and for this class we prove deterministic, closed-form, and easily-computable certified robust radii for arbitrary $\ell_p$-norms. We theoretically justify the use of these models by characterizing their decision region geometry, extending the universal approximation theorem for ICNN regression to the classification setting, and proving a lower bound on the probability that such models perfectly fit even unstructured uniformly distributed data in sufficiently high dimensions. Experiments on Malimg malware classification as well as subsets of MNIST, CIFAR-10, and ImageNet-scale datasets show that FCNNs can attain orders of magnitude larger certified $\ell_1$-radii than competing methods while maintaining substantial $\ell_2$- and $\ell_{\infty}$-radii.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics

Submission Guidelines: Yes

Please Choose The Closest Area That Your Submission Falls Into: General Machine Learning (ie none of the above)

TL;DR: We propose a novel, convexity-based learning architecture which enables closed-form adversarial robustness certificates for all norm balls in an asymmetric robustness setting.

Community Implementations: [ 1 code implementation](https://www.catalyzex.com/paper/asymmetric-certified-robustness-via-feature/code)