mlsanityData to 7 Oct 2026

TAPS: Connecting Certified and Adversarial Training

arXiv 2305.04574 ↗First posted 8 May 2023cs.LGcited by 11

Not on the map. Why?

Abstract (arXiv)

Training certifiably robust neural networks remains a notoriously hard problem. On one side, adversarial training optimizes under-approximations of the worst-case loss, which leads to insufficient regularization for certification, while on the other, sound certified training methods optimize loose over-approximations, leading to over-regularization and poor (standard) accuracy. In this work we propose TAPS, an (unsound) certified training method that combines IBP and PGD training to yield precise, although not necessarily sound, worst-case loss approximations, reducing over-regularization and increasing certified and standard accuracies. Empirically, TAPS achieves a new state-of-the-art in many settings, e.g., reaching a certified accuracy of 22% on TinyImageNet for ℓ_∞-perturbations with radius ε=1/255. We make our implementation and networks public at https://github.com/eth-sri/taps.

Key facts. Cited by 11 papers in the map (data through 7 Oct 2026). Builds on 34 of its 51 references that are in the map. First posted on arXiv 8 May 2023.

Builds on

34 of 51 references.

References · 34

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,160
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  5. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  6. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  7. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  9. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  10. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  11. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  12. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
22 more
  1. 2018Certified Defenses against Adversarial Examplescited by 305
  2. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 224
  3. 2018Sorting out Lipschitz function approximationcited by 211
  4. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  5. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  6. 2018Scaling provable adversarial defensescited by 141
  7. 2019Branch and Bound for Piecewise Linear Neural Network Verificationcited by 138
  8. 2022General Cutting Planes for Bound-Propagation-Based Neural Network Verificationcited by 102
  9. 2022Complete Verification via Multi-Neuron Relaxation Guided Branch-and-Boundcited by 92
  10. 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
  11. 2020Enabling certification of verification-agnostic networks via memory-efficient semidefinite programmingcited by 65
  12. 2023First Three Years of the International Verification of Neural Networks Competition (VNN-COMP)cited by 58
  13. 2022Certified Training: Small Boxes are All You Needcited by 51
  14. 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 48
  15. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  16. 2021Fast Certified Robust Training with Short Warmupcited by 45
  17. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  18. 2022The Third International Verification of Neural Networks Competition (VNN-COMP 2022): Summary and Resultscited by 39
  19. 2021Boosting the Certified Robustness of L-infinity Distance Netscited by 24
  20. 2022IBP Regularization for Verified Adversarial Robustness via Branch-and-Boundcited by 21
  21. 2021On the Paradox of Certified Trainingcited by 12
  22. 2022Robust and Accurate -- Compositional Architectures for Randomized Smoothingcited by 12

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 3; 2025: 2; 2026: 1.

11 papers.

  1. 2023Understanding Certified Training with Interval Bound Propagationcited by 26
  2. 2023Expressive Losses for Verified Robustness via Convex Combinationscited by 23
  3. 2023Certified Robustness via Dynamic Margin Maximization and Improved Lipschitz Regularizationcited by 19
  4. 2023Expressivity of ReLU-Networks under Convex Relaxationscited by 8
  5. 2023How robust accuracy suffers from certified training with convex relaxationscited by 1
  6. 2024Improving Adversarial Training using Vulnerability-Aware Perturbation Budgetcited by 1
  7. 2024Cross-Input Certified Training for Universal Perturbationscited by 1
  8. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
  9. 2026Learning Better Certified Models from Empirically-Robust Teacherscited by 1
  10. 2025Support is All You Need for Certified VAE Trainingcited by 0
  11. 2025Compression Aware Certified Trainingcited by 0