Robustness Certificates Against Adversarial Examples for ReLU Networks
While neural networks have achieved high performance in different learning tasks, their accuracy drops significantly in the presence of small adversarial perturbations to inputs. Defenses based on regularization and adversarial training are often followed by new attacks to defeat them. In this paper, we propose attack-agnostic robustness certificates for a multi-label classification problem using a deep ReLU network. Although computing the exact distance of a given input sample to the classification decision boundary requires solving a non-convex optimization, we characterize two lower bounds for such distances, namely the simplex certificate and the decision boundary certificate. These robustness certificates leverage the piece-wise linear structure of ReLU networks and use the fact that in a polyhedron around a given sample, the prediction function is linear. In particular, the proposed simplex certificate has a closed-form, is differentiable and is an order of magnitude faster to compute than the existing methods even for deep networks. In addition to theoretical bounds, we provide numerical results for our certificates over MNIST and compare them with some existing upper bounds.
Code (0)
등록된 구현이 없습니다.
Tasks
General ClassificationMulti-Label ClassificationMUlTI-LABEL-ClASSIFICATIONMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification
The existence of adversarial examples poses a real danger when deep neural networks are deployed in the real world. The go-to strategy to quantify this vulnerability is to evaluate the model against specific attack algor…
Adversarial RobustnessIs ReLU Adversarially Robust?
The efficacy of deep learning models has been called into question by the presence of adversarial examples. Addressing the vulnerability of deep learning models to adversarial examples is crucial for ensuring their conti…
Deep LearningCurvature-based Robustness Certificates against Adversarial Examples
A robustness certificate against adversarial examples is the minimum distance of a given input to the decision boundary of the classifier (or its lower bound). For {\it any} perturbation of the input with a magnitude sma…
(De)Randomized Smoothing for Certifiable Defense against Patch Attacks
Patch adversarial attacks on images, in which the attacker can distort pixels within a region of bounded size, are an important threat model since they provide a quantitative model for physical adversarial attacks. In th…
Robustness against Adversarial Attacks in Neural Networks using Incremental Dissipativity
Adversarial examples can easily degrade the classification performance in neural networks. Empirical methods for promoting robustness to such examples have been proposed, but often lack both analytical insights and forma…