A Provable Defense for Deep Residual Networks
arXiv:1903.12519
Abstract
We present a training system, which can provably defend significantly larger neural networks than previously possible, including ResNet-34 and DenseNet-100. Our approach is based on differentiable abstract interpretation and introduces two novel concepts: (i) abstract layers for fine-tuning the precision and scalability of the abstraction, (ii) a flexible domain specific language (DSL) for describing training objectives that combine abstract and concrete losses with arbitrary specifications. Our training method is implemented in the DiffAI system.
References in corpus (14)
- Ensemble Adversarial Training: Attacks and Defenses
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Towards Deep Neural Network Architectures Robust to Adversarial Examples
- Certified Defenses against Adversarial Examples
- Adversarially Robust Generalization Requires More Data
- Robust Physical-World Attacks on Deep Learning Models
- Detecting Adversarial Samples from Artifacts
- On the (Statistical) Detection of Adversarial Examples
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Learning with a Strong Adversary
- Generating Adversarial Examples with Adversarial Networks
- Training verified learners with learned verifiers
- On the Geometry of Adversarial Examples
- Perturbed affine arithmetic for invariant computation in numerical program analysis
Cited by in corpus (8)
- Towards Stable and Efficient Training of Verifiably Robust Neural Networks
- Online Robustness Training for Deep Reinforcement Learning
- Perfectly Parallel Fairness Certification of Neural Networks
- Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neurons
- Fast and Stable Interval Bounds Propagation for Training Verifiably Robust Models
- Universal Approximation with Certified Networks
- Improving the Certified Robustness of Neural Networks via Consistency Regularization
- Robustness to Programmable String Transformations via Augmented Abstract Training