CTBench: A Library and Benchmark for Certified Training

We are happy to hear that Reviewer $\Rs$ considers our work is well-written, utilizes “beyond impressive” amounts of experiments and computational resources on a good problem, and derives particularly helpful insights into the deterministic certified training.

Q1: Should this paper overlook the advancements in randomized certified robustness?

As clearly stated at the beginning of the abstract and introduction, we focus solely on deterministic certified robustness. We acknowledge the advances in randomized certified robustness, but randomized certificates are not comparable to deterministic certificates. For example, one provides high confidence certificates while the other provides deterministic certificates, and one brings additional inference overhead while the other does not have inference overhead. Therefore, as an in-depth study regarding deterministic certified robustness, we do not refer to randomized smoothing literature.

Q2: This paper only considers $L_\infty$ norm; could the authors provide some insights into other perturbation norms? Do we need a separate library in case one wants to implement other norms?

Unfortunately, the field of deterministic certified radius focuses on the $L_\infty$ norm and no deterministic certified training algorithms for other norms have been developed. This makes us unable to provide any insights into other perturbation norms. However, we choose to design our library such that norm types are disentangled: if one wants to implement another norm, they can easily migrate their solution into our library, as relaxations (core aspects about norms) are modularized and thus extensible. This allows development regarding other norms in the future.

Q3: Could you decompose the improvements and quantify contributions of individual components?

Great question! We discuss improvement decomposition thoroughly in Appendix A.1. In short, improvements often bring additional hyperparameter vectors for tuning, and thus formal decomposition of benefits is not practically feasible. More details can be found in Appendix A.1.

Q4: Is the developed library extensible to other architectures other than the state-of-the-art CNN7?

Yes, architectures are modularized, and thus incorporating another architecture is trivial for our library. In particular, the current library has multiple architectures implemented; we report CNN7 in the paper because this is the state-of-the-art architecture and represents the most important aspects of certified training.

Q5: Interest in (adversarially) robust models seem to have declined recently; potential reasons include practicability and the increased interest in generative models. While this paper makes valuable contributions (towards certified robustness), is this direction outdated and no longer meaningful?

We are glad to discuss this from our own perspective, but not representing ideas in general. Adversarial robustness is an essential requirement for artificial intelligence, thus it will never be outdated or meaningless until we solve it. In addition, adversarial robustness is not losing interest, as many works are shifted to jailbreaking or discovering other attack vectors for generative models. Furthermore, many start-ups regarding model robustness have been established, thus its practicability in certain areas has been acknowledged. Many legitimate rules are also developed, and one frequent requirement is robustness. Therefore, we believe the decreased number of publications does not mean declined necessity; instead, it represents a hard time for problem solvers, because this problem has been shown to be non-trivial.

Q6: Is adversarial robustness for PGD lower than the state-of-the-art adversarial robustness? Is this because the authors use CNN7 (rather than a much larger model used in the adversarial machine learning literature)?

Yes, this is because we use CNN7, for a fair comparison with certified models.

Q7: Does L133 define certified accuracy imprecisely?

Yes, thanks for the correction!

We are happy to hear that Reviewer $\Rt$ considers our work important, clearly written, leading to interesting and surprising insights into the deterministic certified training. In the following, we address all concrete questions raised by Reviewer $\Rt$.

Q1: Is accuracy-robustness tradeoff not considered? For example, some algorithms in Table 1 might get better certified robustness at the cost of reduced accuracy. How is this handled by this work (and this field)?

We would like to note that in practice, this field mostly focuses on improving the best certified accuracy, regardless of the drop in clean accuracy. More specifically, all recent SOTA works [1,2,3,4] select their best model solely based on the best certified accuracy, which is thus the basis of literature numbers reported in Table 1. This effectively means that accuracy-robustness tradeoff in this field translates to the right-most point one algorithm can get. With this in mind, we remark that based on the current algorithms, one cannot get better certified accuracy than the numbers reported to the best of their implementation/algorithms, regardless of whether they decide to sacrifice more clean accuracy or not. This is also because all these algorithms are trained solely on the objective of certified robustness, but not clean accuracy.

Q2: Error bars are not provided for Table 1. Could this make the result statistically insignificant?

Following the discussion above, all numbers in Table 1 are the best numbers one can get to the best of their efforts. In the case of CTBench numbers (our benchmark), we use the same random seed for all algorithms (thus fixing random batches, etc.) and the same training schedule (thus the same training steps), and then perform a thorough hyperparameter tuning for all algorithms separately. This procedure means Table 1 numbers are highly costly, as also pointed out by Reviewer $\Rs$. Simply selecting a different random seed and reusing the same hyperparameter cannot get the same performance, thus reporting error bars means repeating this full procedure multiple times, which is prohibitively expensive. In addition, based on the described procedure, our numbers all represent the best numbers we can get for each algorithm, rather than the result of a random experiment. This highly reduces the variance of the result, as we perform hyperparameter tuning in a search space of size roughly 50, as described in Appendix B.4.

Q3: Is training and certification cost considered and how?

We report the complete training and certification cost in Appendix B.6. Regarding training, we fix the number of steps taken by each algorithm (the same training schedule). Regarding certification, we fix the certification algorithm (one of the SOTA complete verifiers, MN-BaB) and the timeout (1000 seconds per sample). Details can be found in Appendix B.3 and B.5.

Q4: How should Table 1 be parsed? Could accuracy-robustness plots help with clarity?

Table 1 reports the clean (natural) accuracy, adversarial accuracy and certified accuracy, both in literature and in our benchmarks. We note that, as discussed in Q1, all models in literature and in our benchmark are selected solely based on the best certified accuracy. Therefore, adding accuracy-robustness plots is not meaningful for Table 1. In addition, our work is completely in parallel to [5], which develops conclusions about the maximum certifiable radius. We would also like to note that since our certification budget is 1000 seconds per sample at a given perturbation size, searching for the maximum certifiable radius is computationally prohibitive, thus such plots are naturally impossible to create.

Q5: Could average certified radius be plotted for the studied deterministic certified training methods? Could adaptive training methods improve certified training?

Following the discussion above, computing maximum certified radius is computationally prohibitive, thus computing average certified radius is also impossible for us. Regarding adaptive training methods, we acknowledge that such approaches may improve certified training, but this is out of the scope of this work, which designs the library and benchmark.

Reference

[1] Shi et al., Fast certified robust training with short warmup, 2021.

[2] Müller et al., Certified training: Small boxes are all you need, 2023.

[3] Mao et al., Connecting certified and adversarial training, 2023.

[4] De Palma et al., Expressive losses for verified robustness via convex combinations, 2024.

[5] Nurlanov et al., Adaptive Certified Training: Towards Better Accuracy-Robustness Tradeoffs.

Statistical Significance of Results

We appreciate the reviewer’s concern and agree that additional statistical analysis will strengthen the manuscript. We commit to including this in the revised version.

Regarding hyperparameter tuning, the approach depends on the goal:

• To study the variance of the best numbers, one would tune for every seed.
• To analyze sensitivity to hyperparameters, one would use the same hyperparameters across all seeds.

In our work, we use the latter approach, fixing hyperparameters to focus on sensitivity analysis.

As for the results (numbers are provided in the last response), the improvements for SABR and TAPS on MNIST are statistically significant, with SABR achieving improvements of 6 sigma (98.22 to 98.40 ± 0.03) for MNIST 0.1 and 4 sigma (93.40 to 93.64 ± 0.06) for MNIST 0.3, and TAPS achieving 3 sigma in both settings. We note that we are comparing our average performance to the best performance in the literature reported across random seeds, further highlighting the statistical significance. For CIFAR-10 at $\epsilon=2/255$, larger standard deviations are offset by more substantial improvements, yielding comparable statistical significance. At $\epsilon=8/255$, improvements across methods remain minimal, consistent with prior work. We will incorporate detailed numbers in the revised manuscript.

We hope this clarification reassures the reviewer about the robustness and significance of our results.

Accuracy-Robustness Tradeoff

We thank the reviewer for raising this point but note that the comments appear directed at the broader field of deterministic certified robustness rather than the specific contributions of our work. The tradeoff between natural accuracy and certified robustness is a well-known challenge in this domain, and obtaining robustness for large perturbations in realistic settings is particularly difficult.

Obtaining even empirical robustness inherently requires sacrificing natural accuracy, as shown by methods like EDAC (78.95% natural accuracy for 42.48% empirical robustness on CIFAR 8/255). Achieving near-standard training natural accuracy is possible but leads to almost zero certified accuracy, making evaluation meaningless. Unlike adversarial robustness evaluation, where computational cost is uniform, certification often involves significant computational expense (e.g., 1000 seconds per input) for unverified samples, emphasizing the practical constraints.

In addition, we would like to point out that not all methods exhibit the same tradeoff. For methods such as IBP and CROWN-IBP, there is no inherent tradeoff between certified accuracy and natural accuracy, as is the case for methods like SABR and MTL-IBP, which can specifically tune parameters to achieve networks with varying levels of robustness. We note that the discussion is limited to training with robust loss solely, as adopted by every certified training method in the literature. We also want to mention again that extensive plots analyzing the accuracy-robustness tradeoff have already been provided in previous works, and adding similar plots to our paper would not represent a novelty. Our goal is to benchmark the existing methods systematically, and while we will provide additional plots in the appendix for completeness, we do not believe this addition will significantly change the analysis presented in previous work.

We are happy to hear that Reviewer $\Rz$ considers our work is well-written, tackles an important problem, needed by the field and provides novel insights into the deterministic certified training. In the following, we address all concrete questions raised by Reviewer $\Rz$.

Q1: Is the proposed benchmark sustainable? How could others submit their work to the existing leaderboard?

We would like to note that the primary goal of our work is to develop a benchmark rather than a leaderboard. Benchmarks differ from leaderboards in that a benchmark needs to evaluate in fair and comparable settings, while leaderboards simply take numbers reported in the literature as grounded. Therefore, benchmarks are naturally less sustainable than leaderboards. In addition, as the field advances, the benchmark setting often evolves. For example, we expect the field will make advances towards scalable certified training, and thus in the future, a larger model than the current SOTA architecture may be used in the future benchmarks. Our benchmark represents the current knowledge of the field, and thus we do not expect submissions of new numbers to this benchmark, otherwise it may introduce unfair evaluations. This deviation of benchmarks and leaderboards has been observed in practice. For example, [1] develops a benchmark along with a leaderboard. While their leaderboard is maintained, their benchmark is never updated, as expected. However, this does not imply that a benchmark is unnecessary for the field, as a fair and high-quality evaluation provides more scientific conclusions than a leaderboard which merely draws reported numbers from literature. In addition, our provided library makes development of future benchmarks much easier than before, increasing the sustainability of the benchmark.

Q2: Regarding Section 5.1, why do we care if certified models have fewer flipped neurons (less fragmentation)? Is this expected given that the models are more robust?

Robustness is not directly related to less fragmentation. For example, as shown in Figure 3, the more robust SABR model has more fragmentation than the less robust IBP model. Therefore, robustness does not imply less fragmentation.

Loss fragmentation is of special interest to certified models. This is because the complexity and thus computational costs of certification algorithms highly depend on loss fragmentation. Therefore, understanding loss fragmentation is important for certified training, and our study and insights about how certified training affects loss fragmentation facilitates future work in certified training.

Q3: Regarding Section 5.3, why do methods like TAPS and MTL-IBP deactivate more neurons (for clean input) but achieve better accuracy (compared to IBP)? Is there a theoretical framework to explain the relationship between neuron deactivation and (certified) robustness?

While insufficient model utilization (number of neurons activated) strongly affects performance when the model does not have sufficient capacity, high model utilization does not necessarily bring better performance, e.g., in adversarial training, EDAC has better clean accuracy than PGD but less model utilization. This potentially explains why IBP is worse than MTL-IBP in terms of clean accuracy. Regarding the relationship between the number of deactivated neurons and certified robustness, there is some preliminary but not yet complete theoretical framework explaining this. For example, [2] shows that certified training increases propagation tightness, a metric relating to the tightness of certification, and one way to increase propagation tightness is to deactivate more neurons. Intuitively, this is because IBP bounds of deactivated neurons are zero, which matches the exact bounds.

Q4: Is there a way to leverage shared mistake patterns to improve certified training?

We believe this is one promising future direction for certified training. As discussed in Section 6, algorithms leveraging this, e.g., curriculum learning, might further improve certified training. These attempts are out of the scope of this work, and we leave them as future work.

Reference

[1] Li et al., Sok: Certified robustness for deep neural networks, 2023.

[2] Mao et al., Understanding certified training with interval bound propagation, 2024.

Q4: Previous works have shown adversarial training tends to have a higher sample complexity and overfit more easily (less regularization); what is unique about the findings presented in Section 5.4?

Adversarial training is known to overfit easily, called robust overfit. We would like to note this is not directly related to less regularization, as adversarial training naturally puts more regularization than standard training, e.g., increasing local smoothness. The nuance here is that not all regularization relates to overfitting; instead, each regularization simply introduces an inductive bias into the model. For example, while $L_2$ regularization which asks for small weights usually prevents overfitting, we could also ask for large weights as a special inductive bias. Therefore, investigating different regularization has its own value.

Our study focuses on one special inductive bias (regularization) which is closely related to certified training: propagation tightness [7]. Basically, high propagation tightness makes certification easier for loose relaxations, but not necessarily for tight relaxations. Therefore, understanding propagation tightness introduced by different certified training algorithms helps the field to gain insights and develop future algorithms.

Q5: Regarding Section 5.5, is there an explanation about why certified models perform worse for some corruptions? Could different training norms affect this?

This is a very good question. Since all corruptions we studied are out-of-distribution and not directly controlled by certified training, we do not know the exact answer about why some corruptions appear to be more difficult. Different training norms might affect this, and we agree that intuitively training with regard to the $L_2$ norm might resist Gaussian noise better. However, we would like to note that currently the field of deterministic certified training focuses on $L_\infty$ norm and other norms are largely overlooked. In particular, no well-performing $L_2$-norm deterministic certified training algorithm has been developed. Therefore, it is out of the scope of our work to investigate this question.

Reference

[1] Li et al., Sok: Certified robustness for deep neural networks, 2023.

[2] https://sokcertifiedrobustness.github.io/leaderboard/

[3] Lyu et al., Towards Evaluating and Training Verifiably Robust Neural Networks, 2021.

[4] De Palma et al., Expressive losses for verified robustness via convex combinations, 2024.

[5] Müller et al., Certified training: Small boxes are all you need, 2023.

[6] Mao et al., Connecting certified and adversarial training, 2023.

[7] Mao et al., Understanding certified training with interval bound propagation, 2024.

We are happy to hear that Reviewer $\Rx$ feels that our unified library, implementation correction, systematic study and our novel findings into the deterministic certified training are useful and facilitate future research. In the following, we address all concrete questions raised by Reviewer $\Rx$.

Q1: Authors incorrectly state that the benchmark from [1] is not up-to-date; at the time of this review, the number on their leaderboard website is updated. Does this mean that the authors might have pulled their numbers from a stale source?

We would like to distinguish a benchmark with a leaderboard. Benchmarks differ from leaderboards in that a benchmark needs to evaluate in fair and comparable settings, while leaderboards simply take numbers reported in the literature as grounded. In fact, other than a leaderboard which simply draws reported numbers from the publications, [1] also provides a benchmark study, as can be seen from their website. This benchmark is not updated and is what we referenced, reporting 89% best certified accuracy for MNIST $\epsilon=0.3$.

On the other hand, their leaderboard is updated by the original authors, collecting reported numbers from the literature. This means that this leaderboard is mixed: different algorithms use different architecture, particularly different activations. This makes this leaderboard unfair in the sense that different algorithms are not directly comparable. To solve this, we consider all algorithms based on ReLU networks rather than specialized activations, as this matches the wide practice of deep learning. We pull our literature numbers from a series of the most recent SOTA publications [4,5,6], representing the best practices in the field.

Q2: Improved comprehensiveness over [1] is expected. However, this work only evaluates deterministic certified training while Li et al. evaluates certification methods and deterministic/randomized certified training methods on different norms. Does this mean the contribution of this work is covered/shaded by [1]?

We would like to note that [1] is a SoK paper providing a meta-analysis about the general certified robustness area, while our work develops a library and benchmark about deterministic certified robustness. Therefore, our contributions are in nature not directly comparable to theirs in comprehensiveness, as they focus on comprehensiveness while we focus on an in-depth study regarding deterministic certified robustness. Readers should not expect the same coverage in our study, as we are not meta-analyzing the field. In contrast, we provide an easy-to-use library for deterministic certified training, while [1] did not provide such toolboxes. In addition, the benchmark in [1] naturally does not cover the most recent advances, and thus cannot draw insights about the current progress, while our study achieves both goals. Therefore, our contribution is by no means covered by [1].

Q3: Previous works have shown robust (adversarial) training increases local smoothness; what is unique about the findings presented in Section 5.1?

Section 5.1 observes certified training induces less loss fragmentation. While this relates to increased local smoothness, they are not equivalent. For example, models with the same level of loss fragmentation could have different local smoothness. In addition, instead of studying smoothness, we focus on loss fragmentation for a specific reason in certified training: the complexity of certification algorithms highly depends on loss fragmentation, but not on local smoothness. This is why understanding loss fragmentation is important for certified training, but local smoothness is not directly related, to the best of our knowledge. Therefore, Section 5.1 is of specific interest to the deterministic certified training community, which is the main goal of our study.