Provably Minimally-Distorted Adversarial Examples

By Nicholas Carlini, Guy Katz, Clark W. Barrett, David L. Dill. 2017

132 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Certified Adversarial Robustness via Randomized Smoothing (2019, methodology): “Exact methods are usually based on Satisfiability Modulo Theories (Katz et al., 2017; Carlini et al., 2017; Ehlers, 2017; Huang et al., 2017) or mixed integer linear programming (Cheng et al., 2017; Lomuscio & Maganti, 2017; Dutta et al., 2017; Fischetti & Jo, 2018; Bunel et al., 2018).”
Formal Security Analysis of Neural Networks using Symbolic Intervals (2018, methodology): “To tackle these challenges, all prior works on the formal security analysis of neural networks [6,12,21,25] rely on different types of Satisfiability Modulo Theories (SMT) solvers and are thus severely limited by the efficiency of the solvers.”
Adversarial Risk and the Dangers of Evaluating Against Weak Attacks (2018, methodology): “…conclusive, this adds to the picture of PGD as a near-optimal adversary for differentiable image classifiers: alongside evidence that random restarts of PGD converge to similar loss values (Madry et al., 2017) and that PGD is a near-optimal adversary in small neural networks (Carlini et al., 2017).”
A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks (2019, methodology): “, 2017, Carlini et al., 2017, Ehlers, 2017]. However, due to the NP-completeness for solving such a problem [Katz et al., 2017, Weng et al., 2018], it can be really challenging to scale these to large networks. It can take Reluplex [Katz et al., 2017] several hours to find the minimum distortion of ”
Adversarial Examples on Object Recognition (2020, methodology): “[22] extends Reluplex to verify p1 and p∞ norm adversarial examples by encoding absolute values using ReLUs.”
Provable Robustness of ReLU networks via Maximization of Linear Regions (2018, background): “Therefore recent research has focused on such provable guarantees of a classifier with respect to the l1-norm [4], l2-norm [13] and l∞-norm [3, 15, 25, 29, 32, 31].”
Efficient Neural Network Robustness Certification with General Activation Functions (2018, methodology): “Reluplex [15, 24] uses a satisfiable modulo theory (SMT) to encode ReLU activations into linear constraints.”
A randomized gradient-free attack on ReLU networks (2018, background): “Regarding adversarial attacks one can distinguish between exact methods which ﬁnd the optimal adversarial input with respect to diﬀerent l p - norms e.g. wrt to l 1 -norm [3], l ∞ -norm [10] and recently l p for p = 1 , 2 , ∞ in [24].”
Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagation (2019, methodology): “…methods that use MixedInteger Programming (MIP) (Bunel et al., 2017; Cheng et al., 2017) or Satisfiability Modulo Theory (SMT) (Katz et al., 2017; Carlini et al., 2017), and incomplete methods that solve a convex relaxation of the verification problem (Weng et al., 2018; Wong and Kolter, 2018;…”
The Marabou Framework for Verification and Analysis of Deep Neural Networks (2019, methodology): “The Marabou project builds upon our previous work on the Reluplex project [2,7,12,13,15,17], which focused on applying SMT-based techniques to the verification of DNNs.”
Adversarial Vision Challenge (2018, background): “Despite these advantages and many publications there has been little signiﬁcant progress towards more robust neural networks in complex visual tasks like object recognition, see also [1, 6].”
Understanding and Improving Fast Adversarial Training (2020, background): “It is now widely believed that models adversarially trained via the PGD attack [23, 50] are robust since small adversarially trained networks can be formally verified [5, 40, 47], and larger models could not be broken on public challenges [23, 50].”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, background): “As we mentioned in Section (3.1.8), the work (Carlini et al., 2017) was the first to introduce a Reluplex algorithm to seriously verify the robustness of DNN models: when the model F is given, the algorithm figures out the exact value of minimal perturbation distance r(x;F ).”
L2-Nonexpansive Neural Networks (2018, background): “It has been reported in Carlini et al. (2017) that, for a small network, adversarial training indeed increases the average minimum L 1 -norm and L ∞ -norm of noise needed to change its classiﬁcation.”