Existing work in trustworthy machine learning primarily focuses on
single-input adversarial perturbations. In many real-world attack scenarios,
input-agnostic adversarial attacks, e.g. universal adversarial perturbations
(UAPs), are much more feasible. Current certified training methods train models
robust to single-input perturbations but achieve suboptimal clean and UAP
accuracy, thereby limiting their applicability in practical applications. We
propose a novel method, CITRUS, for certified training of networks robust
against UAP attackers. We show in an extensive evaluation across different
datasets, architectures, and perturbation magnitudes that our method
outperforms traditional certified training methods on standard accuracy (up to
10.3\%) and achieves SOTA performance on the more practical certified UAP
accuracy metric.

我们提出了一种新的方法 CITRUS，用于训练网络以对抗 UAP 攻击者，通过广泛的评估表明，我们的方法在标准准确性方面表现出色（高达 10.3%），并在实际应用中实现了最佳认证 UAP 准确性指标的性能。

跨输入认证培训：通用扰动

Cross-Input Certified Training for Universal Perturbations

As robustness verification methods are becoming more precise, training
certifiably robust neural networks is becoming ever more relevant. To this end,
certified training methods compute and then optimize an upper bound on the
worst-case loss over a robustness specification. Curiously, training methods
based on the imprecise interval bound propagation (IBP) consistently outperform
those leveraging more precise bounding methods. Still, we lack an understanding
of the mechanisms making IBP so successful.
In this work, we thoroughly investigate these mechanisms by leveraging a
novel metric measuring the tightness of IBP bounds. We first show theoretically
that, for deep linear models, tightness decreases with width and depth at
initialization, but improves with IBP training, given sufficient network width.
We, then, derive sufficient and necessary conditions on weight matrices for IBP
bounds to become exact and demonstrate that these impose strong regularization,
explaining the empirically observed trade-off between robustness and accuracy
in certified training.
Our extensive experimental evaluation validates our theoretical predictions
for ReLU networks, including that wider networks improve performance, yielding
state-of-the-art results. Interestingly, we observe that while all IBP-based
training methods lead to high tightness, this is neither sufficient nor
necessary to achieve high certifiable robustness. This hints at the existence
of new training methods that do not induce the strong regularization required
for tight IBP bounds, leading to improved robustness and standard accuracy.

该论文研究了基于粗略区间边界传播（IBP）的证明训练方法，探讨了其较高的成功率和紧密性机制，并说明了其在可证明的训练中鲜明的鲁棒性和准确性之间的权衡。