Fetching the paper…

Reading the bibliography…

2021

Increasing the Confidence of Deep Neural Networks by Coverage Analysis

Rossolini, Giulio, Biondi, Alessandro, Buttazzo, Giorgio

Original
PDF
Post on X

Understand

The great performance of machine learning algorithms and deep neural networks in several perception and control tasks is pushing the industry to adopt such technologies in safety-critical applications, as autonomous robots and self-driving vehicles.

At present, however, several issues need to be solved to make deep learning methods more trustworthy, predictable, safe, and secure against adversarial attacks.
Although several methods have been proposed to improve the trustworthiness of deep neural networks, most of them are tailored for specific classes of adversarial examples, hence failing to detect other corner cases or unsafe inputs that heavily deviate from the training samples.
This paper presents a lightweight monitoring architecture based on coverage paradigms to enhance the model robustness against different unsafe inputs.

Increasing the Confidence of Deep Neural Networks by Coverage Analysis · Around

Built on

A. Mustafa, S. H. Khan, M. Hayat, R. Goecke, J. Shen, and L. Shao, “Adversarial defense by restricting the hidden space of deep neural networks,” CoRR , vol. abs/1904.00887, 2019. [Online]. Available: http://arxiv.org/abs/1904.00887
Original
1904
Earlier work this paper cites.
X. Li, Y. Chen, Y. He, and H. Xue, “Advknn: Adversarial attacks on k-nearest neighbor classifiers with approximate gradients,” CoRR , vol. abs/1911.06591, 2019. [Online]. Available: http://arxiv.org/abs/1911.06591
Original
1911
Earlier work this paper cites.
H. Zhu, P. Hall, and J. May, “Software unit test coverage and adequacy,” ACM Computing Surveys (CSUR) , vol. 29, pp. 366 – 427, 1997
1997
Earlier work this paper cites.
H. Kelly J., V. Dan S., C. John J., and R. Leanna K., “A practical tutorial on modified condition/decision coverage,” Tech. Rep., 2001, nASA Langley Technical Report Server
2001
Earlier work this paper cites.
J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in 2009 IEEE conference on computer vision and pattern recognition . Ieee, 2009, pp. 248–255
2009
Earlier work this paper cites.
Y. LeCun and C. Cortes, “MNIST handwritten digit database,” 2010, http://yann.lecun.com/exdb/mnist/
2010
Earlier work this paper cites.
B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Machine Learning and Knowledge Discovery in Databases , H. Blockeel, K. Kersting, S. Nijssen, and F. Železný, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013, pp. 387–402
2013
Earlier work this paper cites.
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” 2013, cite arxiv:1312.6199. [Online]. Available: http://arxiv.org/abs/1312.6199
Original
2013
Earlier work this paper cites.
I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” 2014, cite arxiv:1412.6572. [Online]. Available: http://arxiv.org/abs/1412.6572
Original
2014
Earlier work this paper cites.
Y. Jia, E. Shelhamer, J. Donahue, S. Karayev, J. Long, R. Girshick, S. Guadarrama, and T. Darrell, “Caffe: Convolutional architecture for fast feature embedding,” in Proceedings of the 22nd ACM International Conference on Multimedia , ser. MM ’14. New York, NY, USA: Association for Computing Machinery, 2014, p. 675–678. [Online]. Available: https://doi.org/10.1145/2647868.2654889
2014
Earlier work this paper cites.
N. Papernot, P. D. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” CoRR , vol. abs/1511.07528, 2015. [Online]. Available: http://arxiv.org/abs/1511.07528
Original
2015
Earlier work this paper cites.
N. Papernot, P. D. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” CoRR , vol. abs/1511.04508, 2015. [Online]. Available: http://arxiv.org/abs/1511.04508
Original
2015
Earlier work this paper cites.
G. E. Hinton, O. Vinyals, and J. Dean, “Distilling the knowledge in a neural network.” CoRR , vol. abs/1503.02531, 2015. [Online]. Available: http://dblp.uni-trier.de/db/journals/corr/corr1503.html.HintonVD15
Original
2015
Earlier work this paper cites.
K. O’Shea and R. Nash, “An introduction to convolutional neural networks,” CoRR , vol. abs/1511.08458, 2015. [Online]. Available: http://arxiv.org/abs/1511.08458
Original
2015
Earlier work this paper cites.
D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” 2014, cite arxiv:1412. Published as a conference paper at the 3rd International Conference for Learning Representations, San Diego, 2015. [Online]. Available: http://arxiv.org/abs/1412.6980
Original
2015
Earlier work this paper cites.
K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” CoRR , vol. abs/1512.03385, 2015. [Online]. Available: http://arxiv.org/abs/1512.03385
Original
2015
Earlier work this paper cites.
C. Szegedy, V. Vanhoucke, S. Ioffe, J. Shlens, and Z. Wojna, “Rethinking the inception architecture for computer vision,” CoRR , vol. abs/1512.00567, 2015. [Online]. Available: http://arxiv.org/abs/1512.00567
Original
2015
Earlier work this paper cites.
A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” 2016, cite arxiv:1607.02533. [Online]. Available: http://arxiv.org/abs/1607.02533
Original
2016
Earlier work this paper cites.
N. Carlini and D. A. Wagner, “Towards evaluating the robustness of neural networks,” CoRR , vol. abs/1608.04644, 2016. [Online]. Available: http://arxiv.org/abs/1608.04644
Original
2016
Earlier work this paper cites.

Similar

A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” CoRR , vol. abs/1611.01236, 2016. [Online]. Available: http://arxiv.org/abs/1611.01236
Original
2016
Cited alongside, same era.
K. Pei, Y. Cao, J. Yang, and S. Jana, “Deepxplore: Automated whitebox testing of deep learning systems,” CoRR , vol. abs/1705.06640, 2017. [Online]. Available: http://arxiv.org/abs/1705.06640
Original
2017
Cited alongside, same era.
A. Sinha, H. Namkoong, R. Volpi, and J. Duchi, “Certifying some distributional robustness with principled adversarial training,” 2017
2017
Cited alongside, same era.
F. Tramèr, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “Ensemble adversarial training: Attacks and defenses,” 2017
2017
Cited alongside, same era.

Then

P. Samangouei, M. Kabkab, and R. Chellappa, “Defense-gan: Protecting classifiers against adversarial attacks using generative models,” CoRR , vol. abs/1805.06605, 2018. [Online]. Available: http://arxiv.org/abs/1805.06605
Original
2018
Later among the works it cites.
N. Papernot and P. D. McDaniel, “Deep k-nearest neighbors: Towards confident, interpretable and robust deep learning,” CoRR , vol. abs/1803.04765, 2018. [Online]. Available: http://arxiv.org/abs/1803.04765
Original
2018
Later among the works it cites.
M. Sensoy, M. Kandemir, and L. M. Kaplan, “Evidential deep learning to quantify classification uncertainty,” CoRR , vol. abs/1806.01768, 2018. [Online]. Available: http://arxiv.org/abs/1806.01768
Original
2018
Later among the works it cites.
U. Ozbulak, W. D. Neve, and A. V. Messem, “How the softmax output is misleading for evaluating the strength of adversarial examples,” CoRR , vol. abs/1811.08577, 2018. [Online]. Available: http://arxiv.org/abs/1811.08577
Original
2018
Later among the works it cites.

Beyond the bibliography

alphaXiv searches the wider corpus for related work and actual follow-ups.

Open on alphaXiv

alphaXiv is searching for related work…

N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , ser. AISec ’17. New York, NY, USA: Association for Computing Machinery, 2017, p. 3–14. [Online]. Available: https://doi.org/10.1145/3128572.3140444

2017

Cited alongside, same era.

W. Xu, D. Evans, and Y. Qi, “Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks,” arXiv e-prints , p. arXiv:1704.01155, Apr. 2017

2017

Cited alongside, same era.

D. Meng and H. Chen, “Magnet: a two-pronged defense against adversarial examples,” pp. 135–147, 2017

2017

Cited alongside, same era.

T. B. Brown, D. Mané, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” CoRR , vol. abs/1712.09665, 2017. [Online]. Available: http://arxiv.org/abs/1712.09665

2017

Cited alongside, same era.

N. Carlini and D. A. Wagner, “Magnet and ”efficient defenses against adversarial attacks” are not robust to adversarial examples,” CoRR , vol. abs/1711.08478, 2017. [Online]. Available: http://arxiv.org/abs/1711.08478

2017

Cited alongside, same era.

J. Z. Kolter and E. Wong, “Provable defenses against adversarial examples via the convex outer adversarial polytope,” CoRR , vol. abs/1711.00851, 2017. [Online]. Available: http://arxiv.org/abs/1711.00851

2017

Cited alongside, same era.

M. Hein and M. Andriushchenko, “Formal guarantees on the robustness of a classifier against adversarial manipulation,” CoRR , vol. abs/1705.08475, 2017. [Online]. Available: http://arxiv.org/abs/1705.08475

2017

Cited alongside, same era.

A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” 2017, cite arxiv:1706.06083. [Online]. Available: http://arxiv.org/abs/1706.06083

2017

Cited alongside, same era.

T.-W. Weng, H. Zhang, P.-Y. Chen, J. Yi, D. Su, Y. Gao, C.-J. Hsieh, and L. Daniel, “Evaluating the robustness of neural networks: An extreme value theory approach.” CoRR , vol. abs/1801.10578, 2018. [Online]. Available: http://dblp.uni-trier.de/db/journals/corr/corr1801.html.abs-1801-10578

2018

Later among the works it cites.

M. Borg, C. Englund, K. Wnuk, B. Durán, C. Levandowski, S. Gao, Y. Tan, H. Kaijser, H. Lönn, and J. Törnqvist, “Safely entering the deep: A review of verification and validation for machine learning and a challenge elicitation in the automotive industry,” CoRR , vol. abs/1812.05389, 2018. [Online]. Available: http://arxiv.org/abs/1812.05389

2018

Later among the works it cites.

L. Ma, F. Juefei-Xu, J. Sun, C. Chen, T. Su, F. Zhang, M. Xue, B. Li, L. Li, Y. Liu, J. Zhao, and Y. Wang, “Deepgauge: Comprehensive and multi-granularity testing criteria for gauging the robustness of deep learning systems,” CoRR , vol. abs/1803.07519, 2018. [Online]. Available: http://arxiv.org/abs/1803.07519

2018

Later among the works it cites.

Y. Sun, X. Huang, and D. Kroening, “Testing deep neural networks,” CoRR , vol. abs/1803.04792, 2018. [Online]. Available: http://arxiv.org/abs/1803.04792

2018

Later among the works it cites.

L. Sun, Y. Wang, and L. Dai, “Convolutional neural network protection method of lenet-5-like structure,” in Proceedings of the 2018 2nd International Conference on Computer Science and Artificial Intelligence , ser. CSAI ’18. New York, NY, USA: Association for Computing Machinery, 2018, p. 77–80. [Online]. Available: https://doi.org/10.1145/3297156.3297224

2018

Later among the works it cites.

J. Wang, G. Dong, J. Sun, X. Wang, and P. Zhang, “Adversarial sample detection for deep neural network through model mutation testing,” in 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE) . IEEE, 2019, pp. 1245–1256

2019

Later among the works it cites.

F. Carrara, R. Becarelli, R. Caldelli, F. Falchi, and G. Amato, “Adversarial examples detection in features distance spaces,” in Computer Vision – ECCV 2018 Workshops , L. Leal-Taixé and S. Roth, Eds. Cham: Springer International Publishing, 2019, pp. 313–327

2019

Later among the works it cites.

A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, “Pytorch: An imperative style, high-performance deep learning library,” in Advances in Neural Information Processing Systems 32 , H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, Eds. Curran Associates, Inc., 2019, pp. 8024–8035. [Online]. Available: http://papers.neurips.cc/paper/9015-pytorch-an-imperative-style-high-performance-deep-learning-library.pdf

2019

Later among the works it cites.

Y. Kantaros, T. Carpenter, S. Park, R. Ivanov, S. Jang, I. Lee, and J. Weimer, “VisionGuard: Runtime Detection of Adversarial Inputs to Perception Systems,” arXiv e-prints , p. arXiv:2002.09792, Feb. 2020

2020

Later among the works it cites.

X. Huang, D. Kroening, W. Ruan, J. Sharp, Y. Sun, E. Thamo, M. Wu, and X. Yi, “A survey of safety and trustworthiness of deep neural networks: Verification, testing, adversarial attack and defence, and interpretability,” vol. 37, 2020, p. 100270. [Online]. Available: http://www.sciencedirect.com/science/article/pii/

2020

Later among the works it cites.

A. Sotgiu, A. Demontis, M. Melis, B. Biggio, G. Fumera, X. Feng, and F. Roli, “Deep neural rejection against adversarial examples.” EURASIP J. Inf. Secur. , vol. 2020, p. 5, 2020. [Online]. Available: http://dblp.uni-trier.de/db/journals/ejisec/ejisec2020.html.SotgiuDMBFFR20

2020

Later among the works it cites.

F. Harel-Canada, L. Wang, M. A. Gulzar, Q. Gu, and M. Kim, “Is neuron coverage a meaningful measure for testing deep neural networks?” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ser. ESEC/FSE 2020. New York, NY, USA: Association for Computing Machinery, 2020, p. 851–862. [Online]. Available: https://doi.org/10.1145/3368089.3409754

2020

Later among the works it cites.

S. Yan, G. Tao, X. Liu, J. Zhai, S. Ma, L. Xu, and X. Zhang, “Correlations between deep neural network model coverage criteria and model quality,” in Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ser. ESEC/FSE 2020. New York, NY, USA: Association for Computing Machinery, 2020, p. 775–787. [Online]. Available: https://doi.org/10.1145/3368089.3409671

2020

Later among the works it cites.

F. Nesti, A. Biondi, and G. Buttazzo, “Detecting adversarial examples by input transformations, defense perturbations, and voting,” IEEE Transactions on Neural Networks and Learning Systems , pp. 1–13, 2021

2021

Closest in time.