mlsanityData to 14 Oct 2026

Towards Stable and Efficient Training of Verifiably Robust Neural Networks

arXiv 1906.06316 ↗First posted 14 Jun 2019cs.LG cs.CR stat.MLcited by 205

Not on the map. Why?

Abstract (arXiv)

Training neural networks with verifiable robustness guarantees is challenging. Several existing approaches utilize linear relaxation based neural network output bounds under perturbation, but they can slow down training by a factor of hundreds depending on the underlying network architectures. Meanwhile, interval bound propagation (IBP) based training is efficient and significantly outperforms linear relaxation based methods on many tasks, yet it may suffer from stability issues since the bounds are much looser especially at the beginning of training. In this paper, we propose a new certified adversarial training method, CROWN-IBP, by combining the fast IBP bounds in a forward bounding pass and a tight linear relaxation based bound, CROWN, in a backward bounding pass. CROWN-IBP is computationally efficient and consistently outperforms IBP baselines on training verifiably robust neural networks. We conduct large scale experiments on MNIST and CIFAR datasets, and outperform all previous linear relaxation and bound propagation based certified defenses in ℓ_∞ robustness. Notably, we achieve 7.02% verified test error on MNIST at ε=0.3, and 66.94% on CIFAR-10 with ε=8/255. Code is available at https://github.com/deepmind/interval-bound-propagation (TensorFlow) and https://github.com/huanzhang12/CROWN-IBP (PyTorch).

Key facts. Cited by 205 papers in the map (data through 14 Oct 2026). First posted on arXiv 14 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 47; 2022: 46; 2023: 44; 2024: 36; 2025: 15; 2026: 17.

205 papers.

Sort:

By area:

  1. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 228
  2. 2021Trustworthy AI: From Principles to Practicescited by 207
  3. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 135
  4. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  5. 2021Globally-Robust Neural Networkscited by 108
  6. 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 65
  7. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  8. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
  9. 2023First Three Years of the International Verification of Neural Networks Competition (VNN-COMP)cited by 58
  10. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  11. 2022Certified Training: Small Boxes are All You Needcited by 52
  12. 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 51
38 more
  1. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
  2. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  3. 2022AdvDO: Realistic Adversarial Attacks for Trajectory Predictioncited by 49
  4. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 48
  5. 2024Neural Network Verification with Branch-and-Bound for General Nonlinearitiescited by 47
  6. 2021Fast Certified Robust Training with Short Warmupcited by 46
  7. 2022Efficiently Computing Local Lipschitz Constants of Neural Networks via Bound Propagationcited by 45
  8. 2022Efficient Adversarial Training without Attacking: Worst-Case-Aware Robust Reinforcement Learningcited by 43
  9. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 41
  10. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  11. 2022The Third International Verification of Neural Networks Competition (VNN-COMP 2022): Summary and Resultscited by 39
  12. 2023When Deep Learning Meets Polyhedral Theory: A Surveycited by 39
  13. 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 36
  14. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  15. 2021A Review of Formal Methods applied to Machine Learningcited by 33
  16. 2025SynthID-Image: Image watermarking at internet scalecited by 31
  17. 2021Reliably fast adversarial training via latent adversarial perturbationcited by 29
  18. 2023Understanding Certified Training with Interval Bound Propagationcited by 26
  19. 2021Taxonomy of Machine Learning Safety: A Survey and Primercited by 25
  20. 2021Boosting the Certified Robustness of L-infinity Distance Netscited by 24
  21. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 24
  22. 2022GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothingcited by 23
  23. 2023Defending against Adversarial Audio via Diffusion Modelcited by 23
  24. 2023Expressive Losses for Verified Robustness via Convex Combinationscited by 23
  25. 2022Safety Certification for Stochastic Systems via Neural Barrier Functionscited by 22
  26. 2022Double Sampling Randomized Smoothingcited by 22
  27. 2022IBP Regularization for Verified Adversarial Robustness via Branch-and-Boundcited by 21
  28. 2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 20
  29. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  30. 2021Adversarial Robustness via Fisher-Rao Regularizationcited by 19
  31. 2021Provably Robust Detection of Out-of-distribution Data (almost) for freecited by 18
  32. 2021ROMAX: Certifiably Robust Deep Multiagent Reinforcement Learning via Convex Relaxationcited by 17
  33. 2022CertiFair: A Framework for Certified Global Fairness of Neural Networkscited by 17
  34. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  35. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  36. 2021Robustness Certification for Point Cloud Modelscited by 16
  37. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  38. 2021Towards Evaluating and Training Verifiably Robust Neural Networkscited by 15

50 most cited of 205 All 205 (JSON)