Fast Certified Robust Training with Short Warmup

DNNs, such as adversarial training (Madry et al., 2018), provide no provable robustness guarantees, Both IBP and CROWN-IBP with loss fusion (Xu et al., 2020) have a per-batch training time For example, generalized CROWN-IBP in Xu et al. (2020) used 900 epochs for warmup and 2,000 He et al., 2015a), but prior works for certified training generally use weight initialization methods originally designed for standard DNN training, while certified training is essentially optimizing a different type of augmented network defined by robustness verification (Zhang et al., 2020). It can however hamper classification performance if too many neurons are dead.