Efficient Neural Network Robustness Certification with General Activation Functions

Abstract

Finding minimum distortion of adversarial examples and thus certifying robustness in neural network classifiers for given data points is known to be a challenging problem. Nevertheless, recently it has been shown to be possible to give a non-trivial certified lower bound of minimum adversarial distortion, and some recent progress has been made towards this direction by exploiting the piece-wise linear nature of ReLU activations. However, a generic robustness certification for general activation functions still remains largely unexplored. To address this issue, in this paper we introduce CROWN, a general framework to certify robustness of neural networks with general activation functions for given input data points. The novelty in our algorithm consists of bounding a given activation function with linear and quadratic functions, hence allowing it to tackle general activation functions including but not limited to four popular choices: ReLU, tanh, sigmoid and arctan. In addition, we facilitate the search for a tighter certified lower bound by adaptively selecting appropriate surrogates for each neuron activation. Experimental results show that CROWN on ReLU networks can notably improve the certified lower bounds compared to the current state-of-the-art algorithm Fast-Lin, while having comparable computational efficiency. Furthermore, CROWN also demonstrates its effectiveness and flexibility on networks with general activation functions, including tanh, sigmoid and arctan.

Accepted by NIPS 2018. Huan Zhang and Tsui-Wei Weng contributed equally

References in corpus (9)

• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Defenses against Adversarial Examples
• Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulation
• An approach to reachability analysis for feed-forward ReLU neural networks
• Provably Minimally-Distorted Adversarial Examples
• Deep Neural Networks as 0-1 Mixed Integer Linear Programs: A Feasibility Study

Cited by in corpus (81)

• A Game-Based Approximate Verification of Deep Neural Networks with Provable Guarantees
• Verification of Neural Network Behaviour: Formal Guarantees for Power System Applications
• Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond
• PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximations
• MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius
• Improving Adversarial Robustness via Channel-wise Activation Suppressing
• Convergence of Adversarial Training in Overparametrized Neural Networks
• Adversarial Robustness of Deep Neural Networks: A Survey from a Formal Verification Perspective
• A Survey of Safety and Trustworthiness of Deep Neural Networks: Verification, Testing, Adversarial Attack and Defence, and Interpretability
• Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers
• Certified Adversarial Robustness for Deep Reinforcement Learning
• Fault Sneaking Attack: a Stealthy Framework for Misleading Deep Neural Networks
• Open- and Closed-Loop Neural Network Verification using Polynomial Zonotopes
• Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks
• Robust Reinforcement Learning on State Observations with Learned Optimal Adversary
• The Convex Relaxation Barrier, Revisited: Tightened Single-Neuron Relaxations for Neural Network Verification
• NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networks
• Towards Stable and Efficient Training of Verifiably Robust Neural Networks
• Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations
• Denoised Smoothing: A Provable Defense for Pretrained Classifiers
• A Causal View on Robustness of Neural Networks
• Robustness Verification for Transformers
• DNNV: A Framework for Deep Neural Network Verification
• Algorithms for Verifying Deep Neural Networks
• HYDRA: Pruning Adversarially Robust Neural Networks
• Randomized Smoothing of All Shapes and Sizes
• Globally-Robust Neural Networks
• Efficient Exact Verification of Binarized Neural Networks
• Learning Certified Individually Fair Representations
• Learning Security Classifiers with Verified Global Robustness Properties
• A Novel Hybrid Machine Learning Model for Rapid Assessment of Wave and Storm Surge Responses Over an Extended Coastal Region
• Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Framework
• More Data Can Expand the Generalization Gap Between Adversarially Robust and Standard Models
• Improving adversarial robustness of deep neural networks by using semantic information
• Robust Deep Reinforcement Learning through Adversarial Loss
• Learning Lyapunov Functions for Piecewise Affine Systems with Neural Network Controllers
• A Learning- and Scenario-based MPC Design for Nonlinear Systems in LPV Framework with Safety and Stability Guarantees
• Bit Error Robustness for Energy-Efficient DNN Accelerators
• Understanding Adversarial Robustness: The Trade-off between Minimum and Average Margin
• On the Certified Robustness for Ensemble Models and Beyond
• Fantastic Four: Differentiable Bounds on Singular Values of Convolution Layers
• Refactoring Neural Networks for Verification
• Boosting the Certified Robustness of L-infinity Distance Nets
• Improving Certified Robustness via Statistical Learning with Logical Reasoning
• ART: Abstraction Refinement-Guided Training for Provably Correct Neural Networks
• Robustness Certificates Against Adversarial Examples for ReLU Networks
• Contraction-Guided Adaptive Partitioning for Reachability Analysis of Neural Network Controlled Systems
• Certified Adversarial Defenses Meet Out-of-Distribution Corruptions: Benchmarking Robustness and Simple Baselines
• Understanding Adversarial Attacks on Observations in Deep Reinforcement Learning
• Certifying Incremental Quadratic Constraints for Neural Networks via Convex Optimization
• Almost Tight L0-norm Certified Robustness of Top-k Predictions against Adversarial Perturbations
• Lipschitz Bounds and Provably Robust Training by Laplacian Smoothing
• Enhancing Certified Robustness via Smoothed Weighted Ensembling
• Adversarial Robustness with Non-uniform Perturbations
• Detection as Regression: Certified Object Detection by Median Smoothing
• Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbation
• NLP Verification: Towards a General Methodology for Certifying Robustness
• CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothing
• On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples
• Certifying Neural Network Robustness to Random Input Noise from Samples
• Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
• Certifiable Robustness to Adversarial State Uncertainty in Deep Reinforcement Learning
• GoTube: Scalable Stochastic Verification of Continuous-Depth Models
• Universal Approximation with Certified Networks
• Fast Geometric Projections for Local Robustness Certification
• Towards Query-Efficient Black-Box Adversary with Zeroth-Order Natural Gradient Descent
• A Geometrical Approach to Evaluate the Adversarial Robustness of Deep Neural Networks
• Scalable and Interpretable Verification of Image-based Neural Network Controllers for Autonomous Vehicles
• Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracy
• Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Model
• Towards Evaluating and Training Verifiably Robust Neural Networks
• Work In Progress: Safety and Robustness Verification of Autoencoder-Based Regression Models using the NNV Tool
• On ${\ell }_p$-norm Robustness of Ensemble Stumps and Trees
• Hidden Cost of Randomized Smoothing
• Training Provably Robust Models by Polyhedral Envelope Regularization
• Recent Advances in Large Margin Learning
• Reachability Analysis of Neural Networks with Uncertain Parameters
• Certified Robustness to Programmable Transformations in LSTMs
• Neural Network Repair with Reachability Analysis
• Failing with Grace: Learning Neural Network Controllers that are Boundedly Unsafe
• Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Search