sabr

Classification losses over SABR's adversarially selected input subregions.

get_sabr_loss(hardened_model, original_model, data, target, eps, subselection_ratio, criterion, device='cuda', n_classes=10, x_L=None, x_U=None, data_min=None, data_max=None, pgd_steps=8, pgd_step_size=0.5, pgd_restarts=1, pgd_early_stopping=True, pgd_decay_factor=0.1, pgd_decay_checkpoints=(4, 7), pgd_ptb=None, return_stats=False, return_bounds=False, relu_upper_retention=1.0, pgd_eps_factor=1.0, **kwargs)

Compute the classification loss on SABR's selected input subregion.

The loss uses IBP bounds around an adversarially chosen centre. It encourages robustness on that subregion; it does not provide a certificate for the full nominal input region.

Parameters:

Name	Type	Description	Default
hardened_model	BoundedModule	The bounded model to be trained.	required
original_model	Module	The original model.	required
data	Tensor	Input data.	required
target	Tensor	Target labels.	required
eps	float	Perturbation radius in model input coordinates.	required
subselection_ratio	float	Factor to shrink epsilon by.	required
criterion	callable	Loss function to use.	required
device	str	Device to run the computation on.	'cuda'
n_classes	int	Number of classes.	10
x_L	Tensor	Lower bound for input data.	None
x_U	Tensor	Upper bound for input data.	None
data_min	Tensor	Minimum value for input data.	None
data_max	Tensor	Maximum value for input data.	None
pgd_steps	int	Number of PGD steps.	8
pgd_step_size	float	Step size for PGD.	0.5
pgd_restarts	int	Number of PGD restarts.	1
pgd_early_stopping	bool	Whether to use early stopping in PGD.	True
pgd_decay_factor	float	Decay factor for PGD step size.	0.1
pgd_decay_checkpoints	tuple	Checkpoints for PGD step size decay.	(4, 7)
pgd_ptb	PerturbationLpNorm	Perturbation bounds used for the PGD centre search. The certified SABR subregion remains constrained to the nominal bounds defined by eps or x_L/x_U.	None
return_stats	bool	Whether to return robustness statistics.	False
return_bounds	bool	Whether to return bounds.	False
relu_upper_retention	float	Unstable ReLU upper bound fraction for this training bound; default 1. Values below 1 are not sound certificates.	1.0
pgd_eps_factor	float	Positive PGD search-range factor; nominal IBP bounds are unchanged. Explicit pgd_ptb, when provided, takes precedence.	1.0

Returns:

Type	Description
tuple	A tuple containing the loss, and optionally robustness statistics (robust_err, adv_err).

Source code in CTRAIN/train/certified/losses/sabr.py

def get_sabr_loss(hardened_model, original_model, data, target, eps, subselection_ratio, criterion, device='cuda', 
                      n_classes=10, x_L=None, x_U=None, data_min=None, data_max=None, pgd_steps=8, pgd_step_size=.5, pgd_restarts=1, pgd_early_stopping=True, pgd_decay_factor=.1, pgd_decay_checkpoints=(4,7), pgd_ptb=None, return_stats=False, return_bounds=False, relu_upper_retention=1.0, pgd_eps_factor=1.0, **kwargs):

    """Compute the classification loss on SABR's selected input subregion.

    The loss uses IBP bounds around an adversarially chosen centre. It encourages
    robustness on that subregion; it does not provide a certificate for the full
    nominal input region.

    Args:
        hardened_model (auto_LiRPA.BoundedModule): The bounded model to be trained.
        original_model (torch.nn.Module): The original model.
        data (torch.Tensor): Input data.
        target (torch.Tensor): Target labels.
        eps (float): Perturbation radius in model input coordinates.
        subselection_ratio (float): Factor to shrink epsilon by.
        criterion (callable): Loss function to use.
        device (str, optional): Device to run the computation on.
        n_classes (int, optional): Number of classes.
        x_L (torch.Tensor, optional): Lower bound for input data.
        x_U (torch.Tensor, optional): Upper bound for input data.
        data_min (torch.Tensor, optional): Minimum value for input data.
        data_max (torch.Tensor, optional): Maximum value for input data.
        pgd_steps (int, optional): Number of PGD steps.
        pgd_step_size (float, optional): Step size for PGD.
        pgd_restarts (int, optional): Number of PGD restarts.
        pgd_early_stopping (bool, optional): Whether to use early stopping in PGD.
        pgd_decay_factor (float, optional): Decay factor for PGD step size.
        pgd_decay_checkpoints (tuple, optional): Checkpoints for PGD step size decay.
        pgd_ptb (PerturbationLpNorm, optional): Perturbation bounds used for the
            PGD centre search. The certified SABR subregion remains constrained
            to the nominal bounds defined by ``eps`` or ``x_L``/``x_U``.
        return_stats (bool, optional): Whether to return robustness statistics.
        return_bounds (bool, optional): Whether to return bounds.
        relu_upper_retention (float): Unstable ReLU upper bound fraction for this training
            bound; default 1. Values below 1 are not sound
            certificates.
        pgd_eps_factor (float): Positive PGD search-range factor; nominal IBP bounds are
            unchanged. Explicit pgd_ptb, when provided, takes
            precedence.

    Returns:
        (tuple): A tuple containing the loss, and optionally robustness statistics (robust_err, adv_err).
    """
    lb, ub, adv_output = bound_sabr(
        hardened_model=hardened_model,
        original_model=original_model,
        data=data,
        data_min=data_min,
        data_max=data_max,
        target=target,
        eps=eps,
        subselection_ratio=subselection_ratio,
        device=device,
        n_classes=n_classes,
        x_L=x_L,
        x_U=x_U,
        n_steps=pgd_steps,
        step_size=pgd_step_size,
        restarts=pgd_restarts,
        early_stopping=pgd_early_stopping,
        decay_checkpoints=pgd_decay_checkpoints, 
        decay_factor=pgd_decay_factor,
        pgd_ptb=pgd_ptb,
        return_adv_output=True,
        relu_upper_retention=relu_upper_retention,
        pgd_eps_factor=pgd_eps_factor
    )
    loss = get_loss_from_bounds(lb, criterion=criterion)

    return_tuple = (loss,)

    if return_bounds:
        assert False, "Return bounds is not implemented for MTL-IBP"
    elif return_stats:
        robust_err = torch.sum(~(lb > 0).all(dim=1)).item() / data.size(0)
        adv_err = torch.sum(torch.argmax(adv_output, dim=1) != target).item() / data.size(0)
        return_tuple = return_tuple + (robust_err, adv_err)

    return return_tuple