Data-Driven Certification of Neural Networks with Random Input Noise

Anderson, Brendon G.; Sojoudi, Somayeh

doi:10.48550/arxiv.2010.01171

Cited by 2 publications

(3 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are a number of techniques that provide robustness certifications to existing neural networks [5,6,41]. Among these methods, "randomized smoothing" seeks to achieve certified robustness at test time [19,38,49].…”

Section: A Parallel Line Of Work Focuses On Certified Robustnessmentioning

confidence: 99%

Improving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing

Yatong¹,

Anderson²,

Kim³

et al. 2023

Preprint

View full text Add to dashboard Cite

While it is shown in the literature that simultaneously accurate and robust classifiers exist for common datasets, previous methods that improve the adversarial robustness of classifiers often manifest an accuracy-robustness trade-off. We build upon recent advancements in data-driven "locally biased smoothing" to develop classifiers that treat benign and adversarial test data differently. Specifically, we tailor the smoothing operation to the usage of a robust neural network as the source of robustness. We then extend the smoothing procedure to the multi-class setting and adapt an adversarial input detector into a policy network. The policy adaptively adjusts the mixture of the robust base classifier and a standard network, where the standard network is optimized for clean accuracy and is not robust in general. We provide theoretical analyses to motivate the use of the adaptive smoothing procedure, certify the robustness of the smoothed classifier under realistic assumptions, and justify the introduction of the policy network. We use various attack methods, including AutoAttack and adaptive attack, to empirically verify that the smoothed model noticeably improves the accuracy-robustness trade-off. On the CIFAR-100 dataset, our method simultaneously achieves an 80.09% clean accuracy and a 32.94% AutoAttacked accuracy. The code that implements adaptive smoothing is available at https://github.com/Bai-YT/AdaptiveSmoothing.

show abstract

Section: A Parallel Line Of Work Focuses On Certified Robustnessmentioning

confidence: 99%

Improving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing

Yatong¹,

Anderson²,

Kim³

et al. 2023

Preprint

View full text Add to dashboard Cite

show abstract

“…where 𝜖 and 𝜂 are the pre-defined error rate and the significance level, respectively, then with confidence at least 1 − 𝜂, the optimal 𝜸 * 𝐾 satisfies all the constraints in Ω but only at most a fraction of probability measure 𝜖, i.e., P(𝑓 𝝎 (𝜸 * 𝐾 ) > 0) ≤ 𝜖. In this work, we set P to be the uniform distribution on the Ω set in (3). It is worthy mentioning that Theorem 2.5 still holds even if the uniqueness of the optimal 𝜸 * 𝐾 is not required, since a unique optimal solution can always be obtained by using the Tie-break rule [9] if multiple optimal solutions exist.…”

Section: Scenario Optimizationmentioning

confidence: 99%

“…A number of formal verification techniques have been proposed for DNNs, including constraint-solving [8,16,19,22,24,32,39,47], abstract interpretation [21,37,59,60,84], layerby-layer exhaustive search [29], global optimisation [15,55,56], convex relaxation [31,49,50], functional approximation [76], reduction to two-player games [77,79], and star-set-based abstraction [66,67]. Sampling-based methods are adopted to probabilistic robustness verification in [2,3,12,45,74,75]. Most of them provide sound DNN robustness estimation in the form of a norm ball, but typically for very small networks or with pessimistic estimation of the norm ball radius.…”

Section: Related Workmentioning

confidence: 99%

Towards practical robustness analysis for DNNs based on PAC-model learning

Yang²,

Huang³

et al. 2022

Proceedings of the 44th International Conference on Software Engineering

View full text Add to dashboard Cite

To analyse local robustness properties of deep neural networks (DNNs), we present a practical framework from a model learning perspective. Based on black-box model learning with scenario optimisation, we abstract the local behaviour of a DNN via an affine model with the probably approximately correct (PAC) guarantee. From the learned model, we can infer the corresponding PAC-model robustness property. The innovation of our work is the integration of model learning into PAC robustness analysis: that is, we construct a PAC guarantee on the model level instead of sample distribution, which induces a more faithful and accurate robustness evaluation. This is in contrast to existing statistical methods without model learning. We implement our method in a prototypical tool named DeepPAC. As a black-box method, DeepPAC is scalable and efficient, especially when DNNs have complex structures or high-dimensional inputs. We extensively evaluate DeepPAC, with 4 baselines (using formal verification, statistical methods, testing and adversarial attack) and 20 DNN models across 3 datasets, including MNIST, CIFAR-10, and ImageNet. It is shown that DeepPAC outperforms the state-of-the-art statistical method PROVERO, and it achieves more practical robustness analysis than the formal verification tool ERAN. Also, its results are consistent with existing DNN testing work like DeepGini. CCS CONCEPTS• Security and privacy → Software and application security;• Computing methodologies → Artificial intelligence.

show abstract

Data-Driven Certification of Neural Networks with Random Input Noise

Cited by 2 publications

References 20 publications

Improving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing

Improving the Accuracy-Robustness Trade-off of Classifiers via Adaptive Smoothing

Towards practical robustness analysis for DNNs based on PAC-model learning

Contact Info

Product

Resources

About