Training for Faster Adversarial Robustness Verification via Inducing ReLU Stability

By Kai Y. Xiao, Vincent Tjeng, Nur Muhammad (Mahi) Shafiullah, Aleksander Madry. 2018

211 citations recorded by the source corpus.

We explore the concept of co-design in the context of neural network verification. Specifically, we aim to train deep neural networks that not only are robust to adversarial perturbations but also whose robustness can be verified more easily. To this end, we identify two properties of network models - weight sparsity and so-called ReLU stability - that turn out to significantly impact the complexity of the corresponding verification task. We demonstrate that improving weight sparsity alone already enables us to turn computationally intractable verification problems into tractable ones. Then, improving ReLU stability leads to an additional 4-13x speedup in verification times. An important feature of our methodology is its "universality," in the sense that it can be used with a broad range of training procedures and verification approaches.

Subfields: Artificial Intelligence, Control and Systems Engineering, Software, Safety, Robustness & Interpretability, Program Analysis & Verification

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Control and Systems Engineering

In Software

In Safety, Robustness & Interpretability

In Program Analysis & Verification

Citations in the corpus

Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, methodology): “These methods have subsequently inspired new heuristic training defenses, where the resulting models can be independently veriﬁed as robust (Croce et al., 2018; Xiao et al., 2019).”
Robustness May Be at Odds with Accuracy (2018, background): “…has there been progress towards models that achieve robustness that can be demonstrated empirically and, in some cases, even formally veriﬁed (Madry et al., 2017; Kolter & Wong, 2017; Sinha et al., 2017; Tjeng & Tedrake, 2017; Raghunathan et al., 2018; Dvijotham et al., 2018a; Xiao et al., 2018b).”
On Evaluating Adversarial Robustness (2019, background): “While work in this space does exist (Katz et al., 2017; Tjeng et al., 2019; Xiao et al., 2019; Gowal et al., 2018), it is often computationally intractable to verify even modestly sized neural networks.”
Adversarial examples from computational constraints (2018, background): “Perhaps the most significant developments have been related to training models with provable robustness guarantees (Dvijotham et al., 2018; Wong and Kolter, 2018; Weng et al., 2018; Xiao et al., 2018), however, currently all the methods for such training are either extremely slow or the certified bo”
Fast is better than free: Revisiting adversarial training (2020, methodology): “, 2018), and various theoretically motivated heuristics (Xiao et al., 2018; Croce et al., 2018).”
High-Frequency Component Helps Explain the Generalization of Convolutional Neural Networks (2019, background): “, 2018), yet shall be aware that newer works are introduced proliferatively (e.g., Ilyas et al., 2018; Yan et al., 2018; Guo et al., 2018b; Alaifari et al., 2019; Xiao et al., 2019; Song et al., 2019; Farnia et al., 2019; Wong et al., 2019).”
Adversarial Attacks and Defenses in Images, Graphs and Text: A Review (2019, methodology): “In (Xiao et al., 2018a), a semi-white box attack framework is introduced.”
Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples (2020, methodology): “, 2017), and also include the definition of new regularizers (Moosavi-Dezfooli et al., 2018; Xiao et al., 2018; Qin et al., 2019).”
Towards Stable and Efficient Training of Verifiably Robust Neural Networks (2019, background): “, 2018), ReLU stability regularization (Xiao et al., 2019), and semidefinite relaxations (Raghunathan et al.”
Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes (2019, background): “As noted in (Xiao et al., 2018; Goodfellow et al., 2014), `1-regularization on the weights of the fully connected layers of a neural net improves ReLU stability.”
Benchmarking Adversarial Robustness on Image Classification (2020, background): “Certified Defenses: There are a lot of works [42, 49, 56, 57, 43, 59] on training certified defenses, which are provably guaranteed to be robust against adversarial perturbations under some threat models.”
Advances in adversarial attacks and defenses in computer vision: A survey (2021, background): “There are also other methods that aim to both enhance network robustness and produce models that are more amenable to robustness verification techniques [411], [412].”
A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks (2019, methodology): “A concurrent work by Xiao et al. (2019) trains networks with the objective of speeding up the MILP veriﬁcation problem, but this compromises on the performance of the network.”
Logit Pairing Methods Can Fool Gradient-Based Attacks (2018, background): “Thus, providing non-trivial lower bounds – with or without special training – is an important and active area of research [Wong et al., 2018, Zhang et al., 2018, Xiao et al., 2018, Croce et al., 2018].”
Strong mixed-integer programming formulations for trained neural networks (2018, methodology): “In recent years a number of authors have used MIP formulations to model trained neural networks [19,22,24,29,40,47,54,64,66,67,70,80,81], mostly applying big-M formulation techniques to ReLU-based networks.”