Towards Practical Robustness Analysis for DNNs based on PAC-Model Learning
To analyse local robustness properties of deep neural networks (DNNs), we present a practical framework from a model learning perspective. Based on black-box model learning with scenario optimisation, we abstract the local behaviour of a DNN via an affine model with the probably approximately correct (PAC) guarantee. From the learned model, we can infer the corresponding PAC-model robustness property. The innovation of our work is the integration of model learning into PAC robustness analysis: that is, we construct a PAC guarantee on the model level instead of sample distribution, which induces a more faithful and accurate robustness evaluation. This is in contrast to existing statistical methods without model learning. We implement our method in a prototypical tool named DeepPAC. As a black-box method, DeepPAC is scalable and efficient, especially when DNNs have complex structures or high-dimensional inputs. We extensively evaluate DeepPAC, with 4 baselines (using formal verification, statistical methods, testing and adversarial attack) and 20 DNN models across 3 datasets, including MNIST, CIFAR-10, and ImageNet. It is shown that DeepPAC outperforms the state-of-the-art statistical method PROVERO, and it achieves more practical robustness analysis than the formal verification tool ERAN. Also, its results are consistent with existing DNN testing work like DeepGini.
Code (1)
Tasks
Adversarial AttackDNN TestingSimilar Papers 제목 키워드 기반
Robustness Verification of Classification Deep Neural Networks via Linear Programming
There is a pressing need to verify robustness of classification deep neural networks (CDNNs) as they are embedded in many safety-critical applications. Existing robustness verification approaches rely on computing the o…
ClassificationGeneral ClassificationEmpirical Study of the Decision Region and Robustness in Deep Neural Networks
In general, the Deep Neural Networks (DNNs) is evaluated by the generalization performance measured on the unseen data excluded from the training phase. Along with the development of DNNs, the generalization performance …
Adversarial AttackAdversarial RobustnessOn the Relationship Between Adversarial Robustness and Decision Region in Deep Neural Network
In general, Deep Neural Networks (DNNs) are evaluated by the generalization performance measured on unseen data excluded from the training phase. Along with the development of DNNs, the generalization performance converg…
Adversarial AttackAdversarial RobustnessAdaptive Adversarial Training to Improve Adversarial Robustness of DNNs for Medical Image Segmentation and Detection
It is known that Deep Neural networks (DNNs) are vulnerable to adversarial attacks, and the adversarial robustness of DNNs could be improved by adding adversarial noises to training data (e.g., the standard adversarial t…
Adversarial RobustnessImage SegmentationMedical Image AnalysisMedical Image Segmentation+33DeformRS: Certifying Spatial Deformations on Point Clouds
3D computer vision models are commonly used in security-critical applications such as autonomous driving and surgical robotics. Emerging concerns over the robustness of these models against real-world deformations must b…
Autonomous Driving