{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/scaling-provable-adversarial-defenses","title":"Scaling provable adversarial defenses","arxiv_id":"1805.12514","date":"2018-05-31","proceeding":"NeurIPS 2018 12","authors":["Eric Wong","Frank R. Schmidt","Jan Hendrik Metzen","J. Zico Kolter"],"abstract":"Recent work has developed methods for learning deep network classifiers that\nare provably robust to norm-bounded adversarial perturbation; however, these\nmethods are currently only possible for relatively small feedforward networks.\nIn this paper, in an effort to scale these approaches to substantially larger\nmodels, we extend previous work in three main directions. First, we present a\ntechnique for extending these training procedures to much more general\nnetworks, with skip connections (such as ResNets) and general nonlinearities;\nthe approach is fully modular, and can be implemented automatically (analogous\nto automatic differentiation). Second, in the specific case of $\\ell_\\infty$\nadversarial perturbations and networks with ReLU nonlinearities, we adopt a\nnonlinear random projection for training, which scales linearly in the number\nof hidden units (previous approaches scaled quadratically). Third, we show how\nto further improve robust error through cascade models. On both MNIST and CIFAR\ndata sets, we train classifiers that improve substantially on the state of the\nart in provable robust adversarial error bounds: from 5.8% to 3.1% on MNIST\n(with $\\ell_\\infty$ perturbations of $\\epsilon=0.1$), and from 80% to 36.4% on\nCIFAR (with $\\ell_\\infty$ perturbations of $\\epsilon=2/255$). Code for all\nexperiments in the paper is available at\nhttps://github.com/locuslab/convex_adversarial/.","url_abs":"http://arxiv.org/abs/1805.12514v2","url_pdf":"http://arxiv.org/pdf/1805.12514v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"scaling-provable-adversarial-defenses","repo_url":"https://github.com/locuslab/convex_adversarial","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"scaling-provable-adversarial-defenses","repo_url":"https://github.com/ColinQiyangLi/LConvNet","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"scaling-provable-adversarial-defenses","repo_url":"https://github.com/KaidiXu/auto_LiRPA","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"scaling-provable-adversarial-defenses","repo_url":"https://github.com/sungyoon-lee/bcp","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[{"method_slug":"relu","method_name":"ReLU"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1805.12514","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}