POPQORN: Quantifying Robustness of Recurrent Neural Networks

Abstract

The vulnerability to adversarial attacks has been a critical issue for deep neural networks. Addressing this issue requires a reliable way to evaluate the robustness of a network. Recently, several methods have been developed to compute $\text{robustness quantification}$ for neural networks, namely, certified lower bounds of the minimum adversarial perturbation. Such methods, however, were devised for feed-forward networks, e.g. multi-layer perceptron or convolutional networks. It remains an open problem to quantify robustness for recurrent networks, especially LSTM and GRU. For such networks, there exist additional challenges in computing the robustness quantification, such as handling the inputs at multiple steps and the interaction between gates and states. In this work, we propose $\text{POPQORN}$ ($\text{P}$ropagated-$\text{o}$ut$\text{p}$ut $\text{Q}$uantified R$\text{o}$bustness for $\text{RN}$Ns), a general algorithm to quantify robustness of RNNs, including vanilla RNNs, LSTMs, and GRUs. We demonstrate its effectiveness on different network architectures and show that the robustness quantification on individual steps can lead to new insights.

arXiv comment10 pages, Ching-Yun Ko and Zhaoyang Lyu contributed equally, accepted to ICML 2019. Please see arXiv source codes for the appendix by clicking [Other formats]

Cited by in corpus (14)

• On Recurrent Neural Networks for learning-based control: recent results and ideas for future developments
• Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond
• Robustness Verification for Transformers
• Towards a Robust Deep Neural Network in Texts: A Survey
• Exploring Robust Architectures for Deep Artificial Neural Networks
• Framing RNN as a kernel method: A neural ODE approach
• NLP Verification: Towards a General Methodology for Certifying Robustness
• A Review of Formal Methods applied to Machine Learning
• Probabilistic Verification of Neural Networks Against Group Fairness
• Robustness Guarantees for Deep Neural Networks on Videos
• Certified Robustness to Programmable Transformations in LSTMs
• What's in a Name? Are BERT Named Entity Representations just as Good for any other Name?
• Do Deep Minds Think Alike? Selective Adversarial Attacks for Fine-Grained Manipulation of Multiple Deep Neural Networks
• Robustness to Programmable String Transformations via Augmented Abstract Training