On Certifying Non-uniform Bound against Adversarial Attacks

Abstract

This work studies the robustness certification problem of neural network models, which aims to find certified adversary-free regions as large as possible around data points. In contrast to the existing approaches that seek regions bounded uniformly along all input features, we consider non-uniform bounds and use it to study the decision boundary of neural network models. We formulate our target as an optimization problem with nonlinear constraints. Then, a framework applicable for general feedforward neural networks is proposed to bound the output logits so that the relaxed problem can be solved by the augmented Lagrangian method. Our experiments show the non-uniform bounds have larger volumes than uniform ones and the geometric similarity of the non-uniform bounds gives a quantitative, data-agnostic metric of input features' robustness. Further, compared with normal models, the robust models have even larger non-uniform bounds and better interpretability.

References in corpus (14)

• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Certified Defenses against Adversarial Examples
• Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality
• Countering Adversarial Images using Input Transformations
• Robustness May Be at Odds with Accuracy
• PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
• An approach to reachability analysis for feed-forward ReLU neural networks
• Stochastic Activation Pruning for Robust Adversarial Defense
• Mitigating Adversarial Effects Through Randomization
• Semidefinite relaxations for certifying robustness to adversarial examples
• Towards Fast Computation of Certified Robustness for ReLU Networks
• Scaling provable adversarial defenses

Cited by in corpus (6)

• Towards Security Threats of Deep Learning Systems: A Survey
• Semantics Preserving Adversarial Learning
• Adversarial Robustness with Non-uniform Perturbations
• Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models
• Localized Uncertainty Attacks
• A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification