Adaptive Verifiable Training Using Pairwise Class Similarity

Verifiable training has shown success in creating neural networks that are provably robust to a given amount of noise. However, despite only enforcing single robustness criterion, its performance scales poorly with dataset complexity. On CIFAR10, non-robust LeNet model 21.63% error rate, while created using verifiable and L-infinity criterion 8/255, an rate 57.10%. Upon examination, we find when labeling visually similar classes, the model's is as high 61.65%. Thus, attribute loss inter-class similarity. Classes (i.e., close feature space) increase difficulty learning model. While it may be desirable train for large region, pairwise class similarities limit potential gains. Furthermore, consideration must made regarding relative cost mistaking one another. In security or safety critical tasks, classes likely belong same group, thus equally sensitive. this work, propose new approach utilizes similarity improve create models respect multiple adversarial criteria. First, cluster agglomerate clustering assign criteria based on degree between clusters. Next, two methods apply our approach: (1) Inter-Group Robustness Prioritization method, which uses custom term guarantees (2) decision tree trains sub-classifiers different combines them architecture. Our experiments Fashion-MNIST CIFAR10 demonstrate by prioritizing most dissimilar groups, clean up 9.63% 30.89% respectively. CIFAR100, reduces 26.32%.