Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach

Abstract

The robustness of neural networks to adversarial examples has received great attention due to security implications. Despite various attack approaches to crafting visually imperceptible adversarial examples, little has been developed towards a comprehensive measure of robustness. In this paper, we provide a theoretical justification for converting robustness analysis into a local Lipschitz constant estimation problem, and propose to use the Extreme Value Theory for efficient evaluation. Our analysis yields a novel robustness metric called CLEVER, which is short for Cross Lipschitz Extreme Value for nEtwork Robustness. The proposed CLEVER score is attack-agnostic and computationally feasible for large neural networks. Experimental results on various networks, including ResNet, Inception-v3 and MobileNet, show that (i) CLEVER is aligned with the robustness indication measured by the ${\ell }_2$ and ${\ell }_{\infty }$ norms of adversarial examples from powerful attacks, and (ii) defended networks using defensive distillation or bounded ReLU indeed achieve better CLEVER scores. To the best of our knowledge, CLEVER is the first attack-independent robustness metric that can be applied to any neural network classifier.

arXiv commentAccepted by Sixth International Conference on Learning Representations (ICLR 2018). Tsui-Wei Weng and Huan Zhang contributed equally

References in corpus (13)

• Distilling the Knowledge in a Neural Network
• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• Explaining and Harnessing Adversarial Examples
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Towards Deep Learning Models Resistant to Adversarial Attacks
• Improved Techniques for Training GANs
• Robust Physical-World Attacks on Deep Learning Models
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• MagNet: a Two-Pronged Defense against Adversarial Examples
• Towards Proving the Adversarial Robustness of Deep Neural Networks
• EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examples
• Towards Robust Neural Networks via Random Self-ensemble

Cited by in corpus (54)

• Adversarial Sample Detection for Deep Neural Network through Model Mutation Testing
• Towards Fast Computation of Certified Robustness for ReLU Networks
• advertorch v0.1: An Adversarial Robustness Toolbox based on PyTorch
• A Closer Look at Accuracy vs. Robustness
• Testing Robustness Against Unforeseen Adversaries
• On the Robustness of Interpretability Methods
• Sensitivity Analysis of Deep Neural Networks
• Adversarial Explanations for Understanding Image Classification Decisions and Improved Neural Network Robustness
• Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentation
• Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks
• Towards Robust Neural Networks via Random Self-ensemble
• Adversarial Examples - A Complete Characterisation of the Phenomenon
• Opportunities and Challenges in Deep Learning Adversarial Robustness: A Survey
• Exactly Computing the Local Lipschitz Constant of ReLU Networks
• The RFML Ecosystem: A Look at the Unique Challenges of Applying Deep Learning to Radio Frequency Applications
• Gradient Masking Causes CLEVER to Overestimate Adversarial Perturbation Size
• There is Limited Correlation between Coverage and Robustness for Deep Neural Networks
• Semialgebraic Optimization for Lipschitz Constants of ReLU Networks
• PAC-learning in the presence of evasion adversaries
• Discovering and Explaining the Representation Bottleneck of DNNs
• A Formalization of Robustness for Deep Neural Networks
• A Statistical Approach to Assessing Neural Network Robustness
• Sampling-based Reachability Analysis: A Random Set Theory Approach with Adversarial Sampling
• Explaining Knowledge Distillation by Quantifying the Knowledge
• Evaluations and Methods for Explanation through Robustness Analysis
• Towards Verifying Robustness of Neural Networks Against Semantic Perturbations
• Orthogonalizing Convolutional Layers with the Cayley Transform
• Neural Architecture Dilation for Adversarial Robustness
• Input Validation for Neural Networks via Runtime Local Robustness Verification
• Certifying Incremental Quadratic Constraints for Neural Networks via Convex Optimization
• Lipschitz Bounds and Provably Robust Training by Laplacian Smoothing
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Markov-Lipschitz Deep Learning
• Safe Predictors for Enforcing Input-Output Specifications
• Data Quality Matters For Adversarial Training: An Empirical Study
• Uncertainty Quantification and Confidence Intervals for Naive Rare-Event Estimators
• A Survey on Trust Metrics for Autonomous Robotic Systems
• Abstraction and Symbolic Execution of Deep Neural Networks with Bayesian Approximation of Hidden Features
• Deep Manifold Transformation for Nonlinear Dimensionality Reduction
• RecurJac: An Efficient Recursive Algorithm for Bounding Jacobian Matrix of Neural Networks and Its Applications
• AdvFoolGen: Creating Persistent Troubles for Deep Classifiers
• On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm
• Non-Stochastic Information Theory
• Interpreting and Disentangling Feature Components of Various Complexity from DNNs
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• Mitigating Deep Learning Vulnerabilities from Adversarial Examples Attack in the Cybersecurity Domain
• Deterministic Gaussian Averaged Neural Networks
• Resilience from Diversity: Population-based approach to harden models against adversarial attacks
• Is Ordered Weighted ${\ell }_1$ Regularized Regression Robust to Adversarial Perturbation? A Case Study on OSCAR
• Hidden Cost of Randomized Smoothing
• An Efficient and Margin-Approaching Zero-Confidence Adversarial Attack
• Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search
• Adversarial Machine Learning for Cybersecurity and Computer Vision: Current Developments and Challenges
• PipeSim: Trace-driven Simulation of Large-Scale AI Operations Platforms