Tightened Convex Relaxations for Neural Network Robustness Certification

Anderson, Brendon G.; Ma, Ziye; Li, Jingqi; Sojoudi, Somayeh

doi:10.48550/arxiv.2004.00570

Cited by 3 publications

(4 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…If the deterministic robustness level is nonnegative, then Y ⊆ S, which implies that the random output Y = f (X) is safe with probability one. This notion of robustness coincides with that used when considering adversarial inputs [19], [10], [11].…”

Section: B Various Notions Of Robustnesssupporting

confidence: 60%

“…However, this approach has two problems: 1) the output set is generally intractable to compute [6], and 2) certification typically amounts to solving an NPhard, nonconvex optimization over the output set [7]. As a result, these assessment methods have largely been treated separately in the settings of output set estimation (see also, reachability analysis) [6], [8], and robustness certification [9], [10], [11], and these remain active areas of research.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Data-Driven Certification of Neural Networks with Random Input Noise

Anderson¹,

Sojoudi²

2020

Preprint

Self Cite

View full text Add to dashboard Cite

When using deep neural networks to operate safety-critical systems, assessing the sensitivity of the network outputs when subject to uncertain inputs is of paramount importance. Such assessment is commonly done using reachability analysis or robustness certification. However, certification techniques typically ignore localization information, while reachable set methods can fail to issue robustness guarantees. Furthermore, many advanced methods are either computationally intractable in practice or restricted to very specific models. In this paper, we develop a data-driven optimizationbased method capable of simultaneously certifying the safety of network outputs and localizing them. The proposed method provides a unified assessment framework, as it subsumes stateof-the-art reachability analysis and robustness certification. The method applies to deep neural networks of all sizes and structures, and to random input uncertainty with a general distribution. We develop sufficient conditions for the convexity of the underlying optimization, and for the number of data samples to certify and localize the outputs with overwhelming probability. We experimentally demonstrate the efficacy and tractability of the method on a deep ReLU network.

show abstract

Section: B Various Notions Of Robustnesssupporting

confidence: 60%

Section: Introductionmentioning

confidence: 99%

Data-Driven Certification of Neural Networks with Random Input Noise

Anderson¹,

Sojoudi²

2020

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…The key difference between partitioning approaches is the strategy for how to split the input set. Some works make one bisection of the input set [15], [16]; [13] splits the input set into a uniform grid. The current state-of-art partitioner, a Simulation-Guided approach (SG) [14], uses a partitioning strategy where Monte Carlo samples of the exact NN output are used as guidance for efficient partitioning of the input set, reducing the amount of computation required for the same level of bound tightness.…”

Section: B Partitionersmentioning

confidence: 99%

Robustness Analysis of Neural Networks via Efficient Partitioning with Applications in Control Systems

Everett¹,

Habibi²,

How³

2020

Preprint

View full text Add to dashboard Cite

Neural networks (NNs) are now routinely implemented on systems that must operate in uncertain environments, but the tools for formally analyzing how this uncertainty propagates to NN outputs are not yet commonplace. Computing tight bounds on NN output sets (given an input set) provides a measure of confidence associated with the NN decisions and is essential to deploy NNs on safety-critical systems. Recent works approximate the propagation of sets through nonlinear activations or partition the uncertainty set to provide a guaranteed outer bound on the set of possible NN outputs. However, the bound looseness causes excessive conservatism and/or the computation is too slow for online analysis. This paper unifies propagation and partition approaches to provide a family of robustness analysis algorithms that give tighter bounds than existing works for the same amount of computation time (or reduced computational effort for a desired accuracy level). Moreover, we provide new partitioning techniques that are aware of their current bound estimates and desired boundary shape (e.g., lower bounds, weighted ∞-ball, convex hull), leading to further improvements in the computationtightness tradeoff. The paper demonstrates the tighter bounds and reduced conservatism of the proposed robustness analysis framework with examples from model-free RL and forward kinematics learning.

show abstract

“…Much of the literature on robustness certification has revolved around adversarial inputs, i.e., inputs that are designed to cause a worst-case prediction (Wong and Kolter, 2017;Raghunathan et al, 2018;Anderson et al, 2020). However, as argued in Webb et al (2018) and Mangal et al (2019), random input uncertainty better models reality in many cases.…”

Section: Introductionmentioning

confidence: 99%

Certifying Neural Network Robustness to Random Input Noise from Samples

Anderson¹,

Sojoudi²

2020

Preprint

Self Cite

View full text Add to dashboard Cite

Methods to certify the robustness of neural networks in the presence of input uncertainty are vital in safety-critical settings. Most certification methods in the literature are designed for adversarial input uncertainty, but researchers have recently shown a need for methods that consider random uncertainty. In this paper, we propose a novel robustness certification method that upper bounds the probability of misclassification when the input noise follows an arbitrary probability distribution. This bound is cast as a chanceconstrained optimization problem, which is then reformulated using input-output samples to replace the optimization constraints. The resulting optimization reduces to a linear program with an analytical solution. Furthermore, we develop a sufficient condition on the number of samples needed to make the misclassification bound hold with overwhelming probability. Our case studies on MNIST classifiers show that this method is able to certify a uniform infinity-norm uncertainty region with a radius of nearly 50 times larger than what the current state-of-the-art method can certify.

show abstract

Tightened Convex Relaxations for Neural Network Robustness Certification

Cited by 3 publications

References 18 publications

Data-Driven Certification of Neural Networks with Random Input Noise

Data-Driven Certification of Neural Networks with Random Input Noise

Robustness Analysis of Neural Networks via Efficient Partitioning with Applications in Control Systems

Certifying Neural Network Robustness to Random Input Noise from Samples

Contact Info

Product

Resources

About