Improving the Tightness of Convex Relaxation Bounds for Training Certifiably Robust Classifiers
arXiv:2002.09766
Abstract
Convex relaxations are effective for training and certifying neural networks against norm-bounded adversarial attacks, but they leave a large gap between certifiable and empirical robustness. In principle, convex relaxation can provide tight bounds if the solution to the relaxed problem is feasible for the original non-convex problem. We propose two regularizers that can be used to train neural networks that yield tighter convex relaxation bounds for robustness. In all of our experiments, the proposed regularizers result in higher certified accuracy than non-regularized baselines.
References in corpus (15)
- Adam: A Method for Stochastic Optimization
- Distilling the Knowledge in a Neural Network
- Certified Defenses against Adversarial Examples
- Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
- Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Models
- Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Models
- An approach to reachability analysis for feed-forward ReLU neural networks
- A Dual Approach to Scalable Verification of Deep Networks
- Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability
- Provably Minimally-Distorted Adversarial Examples
- Training verified learners with learned verifiers
- You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle
- Deep Neural Networks as 0-1 Mixed Integer Linear Programs: A Feasibility Study