2018

Provable Robustness of ReLU networks via Maximization of Linear Regions

Croce, Francesco, Andriushchenko, Maksym, Hein, Matthias

Understand

It has been shown that neural network classifiers are not robust.

This raises concerns about their usage in safety-critical systems.
We propose in this paper a regularization scheme for ReLU networks which provably improves the robustness of the classifier by maximizing the linear regions of the classifier as well as the distance to the decision boundary.
Our techniques allow even to find the minimal adversarial perturbation for a fraction of test points for large networks.

Built on

Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition
J. Stallkamp, M. Schlipsing, J. Salmen, and C. Igel · 2012
Earlier work this paper cites.
Adam: A method for stochastic optimization
Original
D. P. Kingma and J. Ba · 2014
Earlier work this paper cites.
Intriguing properties of neural networks
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus · 2014
Earlier work this paper cites.
Explaining and harnessing adversarial examples
I. J. Goodfellow, J. Shlens, and C. Szegedy · 2015
Earlier work this paper cites.
Towards deep neural network architectures robust to adversarial examples
S. Gu and L. Rigazio · 2015
Earlier work this paper cites.
Measuring neural net robustness with constraints
O. Bastani, Y. Ioannou, L. Lampropoulos, D. Vytiniotis, A. Nori, and A. Criminisi · 2016
Earlier work this paper cites.
Learning with a strong adversary
R. Huang, B. Xu, D. Schuurmans, and C. Szepesvari · 2016
Earlier work this paper cites.
Deepfool: a simple and accurate method to fool deep neural networks
S.-M. Moosavi-Dezfooli, A. Fawzi, and P. Frossard · 2016
Earlier work this paper cites.
Distillation as a defense to adversarial perturbations against deep networks
N. Papernot, P. McDonald, X. Wu, S. Jha, and A. Swami · 2016
Earlier work this paper cites.
Improving the robustness of deep neural networks via stability training
S. Zheng, Y. Song, T. Leung, and I. J. Goodfellow · 2016
Earlier work this paper cites.
Provably minimally-distorted adversarial examples
Original
N. Carlini, G. Katz, C. Barrett, and D. L. Dill · 2017
Earlier work this paper cites.
Adversarial examples are not easily detected: Bypassing ten detection methods
N. Carlini and D. Wagner · 2017
Earlier work this paper cites.

Similar

Towards evaluating the robustness of neural networks
N. Carlini and D. Wagner · 2017
Cited alongside, same era.
Parseval networks: Improving robustness to adversarial examples
M. Cisse, P. Bojanowksi, E. Grave, Y. Dauphin, and N. Usunier · 2017
Cited alongside, same era.
Formal guarantees on the robustness of a classifier against adversarial manipulation
M. Hein and M. Andriushchenko · 2017
Cited alongside, same era.
Reluplex: An efficient smt solver for verifying deep neural networks
G. Katz, C. Barrett, D. Dill, K. Julian, and M. Kochenderfer · 2017
Cited alongside, same era.
Adversarial examples in the physical world
A. Kurakin, I. J. Goodfellow, and S. Bengio · 2017
Cited alongside, same era.
Delving into transferable adversarial examples and black-box attacks
Y. Liu, X. Chen, C. Liu, and D. Song · 2017
Cited alongside, same era.
cleverhans v2.0.0: an adversarial machine learning library
Original
N. Papernot, N. Carlini, I. Goodfellow, R. Feinman, F. Faghri, A. Matyasko, K. Hambardzumyan, Y.-L. Juang, A. Kurakin, R. Sheatsley, A. Garg, and Y.-C. Lin · 2017
Cited alongside, same era.
Robust large margin deep neural networks
J. Sokolic, R. Giryes, G. Sapiro, and M. R. D. Rodrigues · 2017
Cited alongside, same era.
Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms
Original
H. Xiao, K. Rasul, and R. Vollgraf · 2017
Cited alongside, same era.
Understanding deep neural networks with rectified linear unit
R. Arora, A. Basuy, P. Mianjyz, and A. Mukherjee · 2018
Cited alongside, same era.
Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples
Original
A. Athalye, N. Carlini, and D. Wagner · 2018
Cited alongside, same era.
A randomized gradient-free attack on relu networks
F. Croce and M. Hein · 2018
Cited alongside, same era.

Then

Large margin deep networks for classification
Original
G. F. Elsayed, D. Krishnan, H. Mobahi, K. Regan, and S. Bengio · 2018
Closest in time.
Towards deep learning models resistant to adversarial attacks
A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Valdu · 2018
Closest in time.
Differentiable abstract interpretation for provably robust neural networks
M. Mirman, T. Gehr, and M. Vechev · 2018
Closest in time.
Logit pairing methods can fool gradient-based attacks
M. Mosbach, M. Andriushchenko, T. Trost, M. Hein, and D. Klakow · 2018
Closest in time.
Certified defenses against adversarial examples
A. Raghunathan, J. Steinhardt, and P. Liang · 2018
Closest in time.
Robustness may be at odds with accuracy
Original
D. Tsipras, S. Santurkar, L. Engstrom, A. Turner, and A. Madry · 2018
Closest in time.
Towards fast computation of certified robustness for relu networks
T. Weng, H. Zhang, H. Chen, Z. Song, C. Hsieh, L. Daniel, D. S. Boning, and I. S. Dhillon · 2018
Closest in time.
Provable defenses against adversarial examples via the convex outer adversarial polytope
E. Wong and J. Z. Kolter · 2018
Closest in time.
Scaling provable adversarial defenses
E. Wong, F. Schmidt, J. H. Metzen, and J. Z. Kolter · 2018
Closest in time.
Training for faster adversarial robustness verification via inducing relu stability
Original
K. Y. Xiao, V. Tjeng, N. M. Shafiullah, and A. Madry · 2018
Closest in time.
Scaling up the randomized gradient-free adversarial attack reveals overestimation of robustness using established attacks
F. Croce, J. Rauber, and M. Hein · 2019
Closest in time.
Evaluating robustness of neural networks with mixed integer programming
Original
V. Tjeng, K. Xiao, and R. Tedrake · 2019
Closest in time.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

Reading the bibliography…