Rethinking Evaluation Paradigms in IBP-based Certified Training

• URL: http://arxiv.org/abs/2606.02134v1
• Date: Mon, 01 Jun 2026 12:00:15 GMT
• Title: Rethinking Evaluation Paradigms in IBP-based Certified Training
• Abstract summary: Deep neural networks achieve strong performance on many supervised learning tasks but remain vulnerable to adversarial perturbations.<n>To mitigate this, certified training techniques optimise for verifiable robustness during training.<n>We show that prior advancements are less pronounced than assumed and revealing previously unreported performance complementarities.
• Score: 7.29878846692057
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Deep neural networks achieve strong performance on many supervised learning tasks but remain vulnerable to adversarial perturbations. Neural network verification provides mathematically rigorous robustness guarantees, yet at substantial computational cost. To mitigate this, certified training techniques optimise for verifiable robustness during training, typically inducing a trade-off between natural and certified accuracy controlled by method-specific hyperparameters. Because these metrics are inherently conflicting, the common practice of reporting a single configuration is problematic: it can mislead conclusions about overall performance and prevents unbiased assessments of the state of the art. We address this by evaluating certified training methods via Pareto front comparisons over the natural--certified accuracy trade-off. To enable fair, method-agnostic comparisons, we perform efficient automated multi-objective hyperparameter optimisation to identify a set of Pareto-optimal configurations for each method. This approach often uncovers substantial undertuning in previously reported configurations, yielding superior performance and establishing a new state of the art. Leveraging these fronts, we present the first comprehensive multi-objective comparison of certified training approaches, showing that prior advancements are less pronounced than assumed and revealing previously unreported performance complementarities.

Related papers

• Improving Certified Robustness via Adversarial Distillation [2.969291853301593]
  We introduce AD-CERT, a certified training objective that combines adversarial distillation with an IBP upper bound.<n>We show that AD-CERT achieves state-of-the-art certified performance on several benchmarks.
  arXiv  Detail & Related papers  (2026-06-30T13:31:35Z)
• Learning Robustness at Test-Time from a Non-Robust Teacher [3.723585565253798]
  This work studies how adversarial training strategies behave when integrated into adaptation schemes for the unsupervised test-time setting.<n>We propose a label-free framework that uses the predictions of a non-robust teacher model as a semantic anchor for both the clean and adversarial objectives.
  arXiv  Detail & Related papers  (2026-04-13T15:05:21Z)
• PRIME: A Process-Outcome Alignment Benchmark for Verifiable Reasoning in Mathematics and Engineering [71.15346406323827]
  We introduce PRIME, a benchmark for evaluating verifiers on Process-Outcome Alignment verification.<n>We find that current verifiers frequently fail to detect derivation flaws.<n>We propose a process-aware RLVR training paradigm utilizing verifiers selected via PRIME.
  arXiv  Detail & Related papers  (2026-02-12T04:45:01Z)
• Learning Better Certified Models from Empirically-Robust Teachers [53.51898477987441]
  Adrial training attains strong empirical robustness to specific adversarial attacks by training on concrete adversarial perturbations.<n>It produces neural networks that are not amenable to strong robustness certificates through neural network verification.<n>Earlier certified training schemes directly train on bounds from network relaxations to obtain models that are certifiably robust, but display sub-par standard performance.
  arXiv  Detail & Related papers  (2026-02-02T16:30:53Z)
• TULiP: Test-time Uncertainty Estimation via Linearization and Weight Perturbation [11.334867025651233]
  We propose TULiP, a theoretically-driven uncertainty estimator for OOD detection.<n>Our approach considers a hypothetical perturbation applied to the network before convergence.<n>Our method exhibits state-of-the-art performance, particularly for near-distribution samples.
  arXiv  Detail & Related papers  (2025-05-22T17:16:41Z)
• Towards Calibrated Robust Fine-Tuning of Vision-Language Models [97.19901765814431]
  This work proposes a robust fine-tuning method that improves both OOD accuracy and confidence calibration simultaneously in vision language models. We show that both OOD classification and OOD calibration errors have a shared upper bound consisting of two terms of ID data. Based on this insight, we design a novel framework that conducts fine-tuning with a constrained multimodal contrastive loss enforcing a larger smallest singular value.
  arXiv  Detail & Related papers  (2023-11-03T05:41:25Z)
• It's Simplex! Disaggregating Measures to Improve Certified Robustness [32.63920797751968]
  This work presents two approaches to improve the analysis of certification mechanisms. New certification approaches have the potential to more than double the achievable radius of certification. Empirical evaluation verifies that our new approach can certify $9%$ more samples at noise scale $sigma = 1$.
  arXiv  Detail & Related papers  (2023-09-20T02:16:19Z)
• Doubly Robust Instance-Reweighted Adversarial Training [107.40683655362285]
  We propose a novel doubly-robust instance reweighted adversarial framework. Our importance weights are obtained by optimizing the KL-divergence regularized loss function. Our proposed approach outperforms related state-of-the-art baseline methods in terms of average robust performance.
  arXiv  Detail & Related papers  (2023-08-01T06:16:18Z)
• Adversarial Robustness with Semi-Infinite Constrained Learning [177.42714838799924]
  Deep learning to inputs perturbations has raised serious questions about its use in safety-critical domains. We propose a hybrid Langevin Monte Carlo training approach to mitigate this issue. We show that our approach can mitigate the trade-off between state-of-the-art performance and robust robustness.
  arXiv  Detail & Related papers  (2021-10-29T13:30:42Z)
• Automating Control of Overestimation Bias for Continuous Reinforcement Learning [65.63607016094305]
  We present a data-driven approach for guiding bias correction. We demonstrate its effectiveness on the Truncated Quantile Critics -- a state-of-the-art continuous control algorithm.
  arXiv  Detail & Related papers  (2021-10-26T09:27:12Z)
• Robust Pre-Training by Adversarial Contrastive Learning [120.33706897927391]
  Recent work has shown that, when integrated with adversarial training, self-supervised pre-training can lead to state-of-the-art robustness. We improve robustness-aware self-supervised pre-training by learning representations consistent under both data augmentations and adversarial perturbations.
  arXiv  Detail & Related papers  (2020-10-26T04:44:43Z)
• Certified Distributional Robustness on Smoothed Classifiers [27.006844966157317]
  We propose the worst-case adversarial loss over input distributions as a robustness certificate. By exploiting duality and the smoothness property, we provide an easy-to-compute upper bound as a surrogate for the certificate.
  arXiv  Detail & Related papers  (2020-10-21T13:22:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.