Fast and Effective Robustness Certification

By Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, Martin T. Vechev. 2018

541 citations recorded by the source corpus.

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

Certified Adversarial Robustness via Randomized Smoothing (2019, background): “…have been proposed in the literature (Wong & Kolter, 2018; Wang et al., 2018a;b; Raghunathan et al., 2018a;b; Wong et al., 2018; Dvijotham et al., 2018b;a; Croce et al., 2018; Gehr et al., 2018; Mirman et al., 2018; Singh et al., 2018; Gowal et al., 2018; Weng et al., 2018a; Zhang et al., 2018).”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, background): “On the bright side, these methods are more scalable and efficient which makes some of them useful for building certified defenses [38, 35, 36, 27, 28, 39, 10, 9, 7, 13, 26, 30, 15, 37, 40].”
Exactly Computing the Local Lipschitz Constant of ReLU Networks (2020, background): “1, and networks of size [10, 20, 30, 20, 2] trained on synthetic datasets evaluated over the unit hypercube.”
Learning to Give Checkable Answers with Prover-Verifier Games (2021, unknown): “consistent models [28, 36, 23, 7] and those that formally verify adherence to specifications [17, 7, 30].”
Efficient and Accurate Estimation of Lipschitz Constants for Deep Neural Networks (2019, background): “This can be done either locally around a specific input [7, 35, 15, 33, 12, 29, 30, 13, 40, 21, 41, 42], or globally by bounding the sensitivity of the function to input perturbations, i.”
Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond (2020, background): “Many other works have independently discovered similar algorithms [7, 30, 37, 46, 53, 39, 45] in either primal or dual space which we refer to as linear relaxation based perturbation analysis (LiRPA).”
Relating Adversarially Robust Generalization to Flat Minima (2021, background): “Besides certified and provable defenses [22, 138, 66, 147, 146, 130, 41, 39, 84, 113, 72, 23], adversarial training (AT) has become the de-facto standard, as discussed in the main paper.”
An abstract domain for certifying neural networks (2019, methodology): “The analyzer is written in Python and the abstract transformers of our domain are implemented on top of the ELINA library [Singh et al. 2017, 2018b] for numerical abstractions.”
Overfitting in adversarially robust deep learning (2020, background): “, 2017), abstract interpretations (Gehr et al., 2018; Mirman et al., 2018; Singh et al., 2018), and interval bound propagation (Gowal et al.”
Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification (2021, methodology): “We compare against multiple baselines for complete verification: (1) BaBSR [7], a basic BaB and LP based verifier; (2) MIPplanet [15], a customized MIP solver for NN verification where unstable ReLU neurons are randomly selected for splitting; (3) ERAN [35, 33, 36, 34], an abstract interpretation ba”
Towards Stable and Efficient Training of Verifiably Robust Neural Networks (2019, background): “, 2018), DeepZ (Singh et al., 2018) and Neurify (Wang et al.”
Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observations (2020, background): “Convex relaxation of non-linear units in neural networks enables an efficient analysis of the outer bounds for a neural network [79, 86, 66, 13, 78, 76, 57, 67].”
Algorithms for Verifying Deep Neural Networks (2019, background): “• robustness of the verification algorithm under floating point arithmetic [33].”
On the Sample Complexity of Adversarial Multi-Source PAC Learning (2020, background): “…time has recently received a lot of attention, in particular with work on the detection of out-of-distribution conditions (Hendrycks & Gimpel, 2017; Liang et al., 2018; Lee et al., 2018) and protection against adversarial examples (Raghunathan et al., 2018; Singh et al., 2018; Cohen et al., 2019).”
A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks (2019, methodology): “For example, DeepPoly (Singh et al., 2019b) and DeepZ (Singh et al., 2018) carefully consider ﬂoating-point rounding during the computation; Weng et al. (2018) gives a theoretical hardness proof based on a reduction from the set-cover problem; Neurify (Wang et al., 2018b) combines the relaxed bound…”
Lipschitz-Certifiable Training with a Tight Outer Bound (2020, background): “In contrast, the layer-wise bound propagation approach calculates the upper bounds on the worst case error through relaxation on the layer-wise operations and forward propagation for the perturbation set that can be made of `∞- or `2-balls [13, 44, 36, 25, 32, 37].”
A Closer Look at Accuracy vs. Robustness (2020, methodology): “Future progress that ensures both robustness and accuracy may come from redesigning other aspects of the training process, such as customized optimization methods [3, 15, 25, 34, 43, 50, 52, 51] or better network architectures [13, 47, 69] in combination with loss functions that encourage adversaria”
Convergence of Adversarial Training in Overparametrized Neural Networks (2019, unknown): “Certified Defense and Robustness Verification In contrast to attack algorithms, neural network verification methods [48, 47, 54, 42, 14, 38] tries to find upper bounds of the robust loss and provide certified robustness measurements.”