Timezone: »

 
Certified defences hurt generalisation
Piersilvio De Bartolomeis · Jacob Clarysse · Fanny Yang · Amartya Sanyal

@
in I Can’t Believe It’s Not Better: Understanding Deep Learning Through Empirical Falsification »
Event URL: https://openreview.net/forum?id=h1j5I0WVxoI »

In recent years, much work has been devoted to designing certified defences for neural networks, i.e., methods for learning neural networks that are provably robust to certain adversarial perturbations. Due to the non-convexity of the problem, dominant approaches in this area rely on convex approximations, which are inherently loose. In this paper, we question the effectiveness of such approaches for realistic computer vision tasks. First, we provide extensive empirical evidence to show that certified defences suffer not only worse accuracy but also worse robustness and fairness than empirical defences. We hypothesise that the reason for why certified defences suffer in generalisation is (i) the large number of relaxed non-convex constraints and (ii) strong alignment between the adversarial perturbations and the "signal" direction. We provide a combination of theoretical and experimental evidence to support these hypotheses.

Author Information

Piersilvio De Bartolomeis (ETH Zürich)
Jacob Clarysse (ETH)
Fanny Yang (ETH Zurich)
Amartya Sanyal (ETH Zurich)

More from the Same Authors