{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/mixtrain-scalable-training-of-verifiably","title":"MixTrain: Scalable Training of Verifiably Robust Neural Networks","arxiv_id":"1811.02625","date":"2018-11-06","proceeding":null,"authors":["Shiqi Wang","Yizheng Chen","Ahmed Abdou","Suman Jana"],"abstract":"Making neural networks robust against adversarial inputs has resulted in an\narms race between new defenses and attacks. The most promising defenses,\nadversarially robust training and verifiably robust training, have limitations\nthat restrict their practical applications. The adversarially robust training\nonly makes the networks robust against a subclass of attackers and we reveal\nsuch weaknesses by developing a new attack based on interval gradients. By\ncontrast, verifiably robust training provides protection against any L-p\nnorm-bounded attacker but incurs orders of magnitude more computational and\nmemory overhead than adversarially robust training.\n  We propose two novel techniques, stochastic robust approximation and dynamic\nmixed training, to drastically improve the efficiency of verifiably robust\ntraining without sacrificing verified robustness. We leverage two critical\ninsights: (1) instead of over the entire training set, sound\nover-approximations over randomly subsampled training data points are\nsufficient for efficiently guiding the robust training process; and (2) We\nobserve that the test accuracy and verifiable robustness often conflict after\ncertain training epochs. Therefore, we use a dynamic loss function to\nadaptively balance them for each epoch.\n  We designed and implemented our techniques as part of MixTrain and evaluated\nit on six networks trained on three popular datasets including MNIST, CIFAR,\nand ImageNet-200. Our evaluations show that MixTrain can achieve up to $95.2\\%$\nverified robust accuracy against $L_\\infty$ norm-bounded attackers while taking\n$15$ and $3$ times less training time than state-of-the-art verifiably robust\ntraining and adversarially robust training schemes, respectively. Furthermore,\nMixTrain easily scales to larger networks like the one trained on ImageNet-200,\nsignificantly outperforming the existing verifiably robust training methods.","url_abs":"http://arxiv.org/abs/1811.02625v2","url_pdf":"http://arxiv.org/pdf/1811.02625v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"mixtrain-scalable-training-of-verifiably","repo_url":"https://github.com/ARiSE-Lab/DeepInspect","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1811.02625","atlas_url":"https://app.syntology.ai/?focus=1811.02625","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1811.02625"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ARiSE-Lab/DeepInspect","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":1,"unverified":5},"by_repo_kind":{"listed":{"samples":6,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ec2c08983ca02f3d","entry":"make_layers","repo":"ARiSE-Lab/DeepInspect","repo_kind":"listed","path":"deepinspect/cifar100/model.py","file_url":"https://github.com/ARiSE-Lab/DeepInspect/blob/HEAD/deepinspect/cifar100/model.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ec2c08983ca02f3d"}},{"code_sha256_prefix":"f0c9a29156911331","entry":"accuracy","repo":"ARiSE-Lab/DeepInspect","repo_kind":"listed","path":"deepinspect/imagenet/imagenet_coverage.py","file_url":"https://github.com/ARiSE-Lab/DeepInspect/blob/HEAD/deepinspect/imagenet/imagenet_coverage.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f0c9a29156911331"}},{"code_sha256_prefix":"d3fc7fab3961070d","entry":"cifar10","repo":"ARiSE-Lab/DeepInspect","repo_kind":"listed","path":"deepinspect/cifar100/model.py","file_url":"https://github.com/ARiSE-Lab/DeepInspect/blob/HEAD/deepinspect/cifar100/model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d3fc7fab3961070d"}},{"code_sha256_prefix":"01d6cf907175f18b","entry":"cifar100","repo":"ARiSE-Lab/DeepInspect","repo_kind":"listed","path":"deepinspect/cifar100/model.py","file_url":"https://github.com/ARiSE-Lab/DeepInspect/blob/HEAD/deepinspect/cifar100/model.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"01d6cf907175f18b"}},{"code_sha256_prefix":"1105016d5d85ced6","entry":"get10","repo":"ARiSE-Lab/DeepInspect","repo_kind":"listed","path":"deepinspect/cifar100/dataset.py","file_url":"https://github.com/ARiSE-Lab/DeepInspect/blob/HEAD/deepinspect/cifar100/dataset.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"1105016d5d85ced6"}},{"code_sha256_prefix":"3f52f8cdc8cfa3b6","entry":"get100","repo":"ARiSE-Lab/DeepInspect","repo_kind":"listed","path":"deepinspect/cifar100/dataset.py","file_url":"https://github.com/ARiSE-Lab/DeepInspect/blob/HEAD/deepinspect/cifar100/dataset.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3f52f8cdc8cfa3b6"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}