  Training neural networks with high certified accuracy against adversarial
examples remains an open problem despite significant efforts. While
certification methods can effectively leverage tight convex relaxations for
bound computation, in training, these methods perform worse than looser
relaxations. Prior work hypothesized that this is caused by the discontinuity
and perturbation sensitivity of the loss surface induced by these tighter
relaxations. In this work, we show theoretically that Gaussian Loss Smoothing
can alleviate both issues. We confirm this empirically by proposing a certified
training method combining PGPE, an algorithm computing gradients of a smoothed
loss, with different convex relaxations. When using this training method, we
observe that tighter bounds indeed lead to strictly better networks. While
scaling PGPE training remains challenging due to high computational cost, we
show that by using a not theoretically sound, yet much cheaper smoothing
approximation, we obtain better certified accuracies than state-of-the-art
methods when training on the same network architecture. Our results clearly
demonstrate the promise of Gaussian Loss Smoothing for training certifiably
robust neural networks.
