mlsanityData to 7 Oct 2026

Towards Stable and Efficient Training of Verifiably Robust Neural Networks

arXiv 1906.06316 ↗First posted 14 Jun 2019cs.LG cs.CR stat.MLcited by 204

Not on the map. Why?

Abstract (arXiv)

Training neural networks with verifiable robustness guarantees is challenging. Several existing approaches utilize linear relaxation based neural network output bounds under perturbation, but they can slow down training by a factor of hundreds depending on the underlying network architectures. Meanwhile, interval bound propagation (IBP) based training is efficient and significantly outperforms linear relaxation based methods on many tasks, yet it may suffer from stability issues since the bounds are much looser especially at the beginning of training. In this paper, we propose a new certified adversarial training method, CROWN-IBP, by combining the fast IBP bounds in a forward bounding pass and a tight linear relaxation based bound, CROWN, in a backward bounding pass. CROWN-IBP is computationally efficient and consistently outperforms IBP baselines on training verifiably robust neural networks. We conduct large scale experiments on MNIST and CIFAR datasets, and outperform all previous linear relaxation and bound propagation based certified defenses in ℓ_∞ robustness. Notably, we achieve 7.02% verified test error on MNIST at ε=0.3, and 66.94% on CIFAR-10 with ε=8/255. Code is available at https://github.com/deepmind/interval-bound-propagation (TensorFlow) and https://github.com/huanzhang12/CROWN-IBP (PyTorch).

Key facts. Cited by 204 papers in the map (data through 7 Oct 2026). First posted on arXiv 14 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 47; 2022: 46; 2023: 44; 2024: 36; 2025: 15; 2026: 16.

204 papers.

Sort:

By area:

  1. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 224
  2. 2021Trustworthy AI: From Principles to Practicescited by 206
  3. 2021Robust Reinforcement Learning on State Observations with Learned Optimal Adversarycited by 133
  4. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  5. 2021Globally-Robust Neural Networkscited by 106
  6. 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 64
  7. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  8. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 61
  9. 2023First Three Years of the International Verification of Neural Networks Competition (VNN-COMP)cited by 58
  10. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  11. 2022Certified Training: Small Boxes are All You Needcited by 51
  12. 2021Fast Minimum-norm Adversarial Attacks through Adaptive Norm Constraintscited by 50
38 more
  1. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  2. 2022AdvDO: Realistic Adversarial Attacks for Trajectory Predictioncited by 48
  3. 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 48
  4. 2024Neural Network Verification with Branch-and-Bound for General Nonlinearitiescited by 47
  5. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46
  6. 2021Fast Certified Robust Training with Short Warmupcited by 45
  7. 2022Efficiently Computing Local Lipschitz Constants of Neural Networks via Bound Propagationcited by 45
  8. 2022Efficient Adversarial Training without Attacking: Worst-Case-Aware Robust Reinforcement Learningcited by 42
  9. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  10. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
  11. 2022The Third International Verification of Neural Networks Competition (VNN-COMP 2022): Summary and Resultscited by 39
  12. 2023When Deep Learning Meets Polyhedral Theory: A Surveycited by 39
  13. 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 35
  14. 2021A Review of Formal Methods applied to Machine Learningcited by 33
  15. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 33
  16. 2021Reliably fast adversarial training via latent adversarial perturbationcited by 29
  17. 2023Understanding Certified Training with Interval Bound Propagationcited by 26
  18. 2025SynthID-Image: Image watermarking at internet scalecited by 26
  19. 2021Boosting the Certified Robustness of L-infinity Distance Netscited by 24
  20. 2022Certified Robustness Against Natural Language Attacks by Causal Interventioncited by 23
  21. 2022GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothingcited by 23
  22. 2023Expressive Losses for Verified Robustness via Convex Combinationscited by 23
  23. 2021Taxonomy of Machine Learning Safety: A Survey and Primercited by 22
  24. 2022Safety Certification for Stochastic Systems via Neural Barrier Functionscited by 22
  25. 2022Double Sampling Randomized Smoothingcited by 22
  26. 2022IBP Regularization for Verified Adversarial Robustness via Branch-and-Boundcited by 21
  27. 2023Defending against Adversarial Audio via Diffusion Modelcited by 20
  28. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  29. 2021Fighting Gradients with Gradients: Dynamic Defenses against Adversarial Attackscited by 19
  30. 2021Adversarial Robustness via Fisher-Rao Regularizationcited by 19
  31. 2021Provably Robust Detection of Out-of-distribution Data (almost) for freecited by 17
  32. 2021ROMAX: Certifiably Robust Deep Multiagent Reinforcement Learning via Convex Relaxationcited by 17
  33. 2022CertiFair: A Framework for Certified Global Fairness of Neural Networkscited by 17
  34. 2022Adversarial Patch Attacks and Defences in Vision-Based Tasks: A Surveycited by 17
  35. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  36. 2021Robustness Certification for Point Cloud Modelscited by 16
  37. 2022PointDP: Diffusion-driven Purification against Adversarial Attacks on 3D Point Cloud Recognitioncited by 16
  38. 2021Towards Evaluating and Training Verifiably Robust Neural Networkscited by 15

50 most cited of 204 All 204 (JSON)