Fast Geometric Projections for Local Robustness Certification

Abstract

Local robustness ensures that a model classifies all inputs within an ${\ell }_2$-ball consistently, which precludes various forms of adversarial inputs. In this paper, we present a fast procedure for checking local robustness in feed-forward neural networks with piecewise-linear activation functions. Such networks partition the input space into a set of convex polyhedral regions in which the network's behavior is linear; hence, a systematic search for decision boundaries within the regions around a given input is sufficient for assessing robustness. Crucially, we show how the regions around a point can be analyzed using simple geometric projections, thus admitting an efficient, highly-parallel GPU implementation that excels particularly for the ${\ell }_2$ norm, where previous work has been less effective. Empirically we find this approach to be far more precise than many approximate verification approaches, while at the same time performing multiple orders of magnitude faster than complete verifiers, and scaling to much deeper networks.

arXiv commentAppearing in ICLR 2021

References in corpus (10)

• Theoretically Principled Trade-off between Robustness and Accuracy
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Certified Adversarial Robustness via Randomized Smoothing
• Efficient Neural Network Robustness Certification with General Activation Functions
• Formal Security Analysis of Neural Networks using Symbolic Intervals
• On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
• Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
• Provable Robustness of ReLU networks via Maximization of Linear Regions
• Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes
• Hierarchical Verification for Adversarial Robustness

Cited by in corpus (1)

• Scalable Verification of GNN-based Job Schedulers