Provable Robustness of ReLU networks via Maximization of Linear Regions

By Francesco Croce, Maksym Andriushchenko, Matthias Hein. 2018

173 citations recorded by the source corpus.

It has been shown that neural network classifiers are not robust. This raises concerns about their usage in safety-critical systems. We propose in this paper a regularization scheme for ReLU networks which provably improves the robustness of the classifier by maximizing the linear regions of the classifier as well as the distance to the decision boundary. Using our regularization we can even find the minimal adversarial perturbation for a certain fraction of test points for large networks. In the experiments we show that our approach improves upon pure adversarial training both in terms of lower and upper bounds on the robustness and is comparable or better than the state of the art in terms of test error and robustness.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

Wasserstein Adversarial Examples via Projected Sinkhorn Iterations (2019, methodology): “These methods have subsequently inspired new heuristic training defenses, where the resulting models can be independently veriﬁed as robust (Croce et al., 2018; Xiao et al., 2019).”
Certified Adversarial Robustness via Randomized Smoothing (2019, background): “…have been proposed in the literature (Wong & Kolter, 2018; Wang et al., 2018a;b; Raghunathan et al., 2018a;b; Wong et al., 2018; Dvijotham et al., 2018b;a; Croce et al., 2018; Gehr et al., 2018; Mirman et al., 2018; Singh et al., 2018; Gowal et al., 2018; Weng et al., 2018a; Zhang et al., 2018).”
Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (2019, background): “On the bright side, these methods are more scalable and efficient which makes some of them useful for building certified defenses [38, 35, 36, 27, 28, 39, 10, 9, 7, 13, 26, 30, 15, 37, 40].”
Fast is better than free: Revisiting adversarial training (2020, methodology): “…algorithms (Metzen et al., 2017; Feinman et al., 2017; Carlini & Wagner, 2017a), veriﬁcation and provable defenses (Katz et al., 2017; Sinha et al., 2017; Wong & Kolter, 2017; Raghunathan et al., 2018), and various theoretically motivated heuristics (Xiao et al., 2018; Croce et al., 2018).”
Test-Time Training for Out-of-Distribution Generalization (2019, background): “Many popular algorithms formulate and solve this as a robust optimization problem (Goodfellow et al., 2014; Madry et al., 2017; Sinha et al., 2017; Raghunathan et al., 2018; Wong & Kolter, 2017; Croce et al., 2018), and the most well known technique is adversarial training.”
Provable Certificates for Adversarial Examples: Fitting a Ball in the Union of Polytopes (2019, background): “Finally, we note an approach by which polyhedral complices may be formed that will become useful when we discuss PLNN’s in the following section.”
Prototype-based Neural Network Layers: Incorporating Vector Quantization (2018, methodology): “This argumentation is underpinned by several recently published proofs for robustness of NNs, where approximations of the n -balls are used with the underlying assumption regarding the valid classiﬁcation decision homogeneity [8, 75].”
A systematic framework for natural perturbations from videos (2019, background): “Adversarial attacks in the `p model are powerful and difficult to defend against; for example, the state of the art defenses still achieve mediocre classification accuracies on adversarial inputs (below 97% accuracy on MNIST [5] and below 60% on CIFAR-10 [27]).”
Relating Adversarially Robust Generalization to Flat Minima (2021, background): “Besides certified and provable defenses [22, 138, 66, 147, 146, 130, 41, 39, 84, 113, 72, 23], adversarial training (AT) has become the de-facto standard, as discussed in the main paper.”
Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (2020, methodology): “Another line of work are provable defenses, either deterministic (Wong et al., 2018; Croce et al., 2019a; Mirman et al., 2018; Gowal et al., 2019a) or based on randomized smoothing (Li et al., 2019; Lecuyer et al., 2019; Cohen et al., 2019).”
Logit Pairing Methods Can Fool Gradient-Based Attacks (2018, background): “Thus, providing non-trivial lower bounds – with or without special training – is an important and active area of research [Wong et al., 2018, Zhang et al., 2018, Xiao et al., 2018, Croce et al., 2018].”
Overfitting in adversarially robust deep learning (2020, methodology): “Another approach is to use theoretically justified training heuristics (Croce et al., 2018; Xiao et al., 2018b) which result in models which are verifiable by an independent certification method.”
Test-Time Training with Self-Supervision for Generalization under Distribution Shifts (2019, background): “Many popular algorithms formulate and solve this as a robust optimization problem (Goodfellow et al., 2014; Madry et al., 2017; Sinha et al., 2017; Raghunathan et al., 2018; Wong & Kolter, 2017; Croce et al., 2018), and the most well known technique is adversarial training.”
Certifiable Robustness and Robust Training for Graph Convolutional Networks (2019, background): “As an alternative, recent works have considered certifiable robustness [3, 10, 18, 20] providing guarantees that no perturbation w.”
MMA Training: Direct Input Space Margin Maximization through Adversarial Training (2018, background): “Croce et al. (2018) aim to enlarge the linear region around a input example, such that the nearest point, to the input and on the decision boundary, is inside the linear region.”
Globally-Robust Neural Networks (2021, methodology): “KW and BCP have been found to achieve the best VRA on the datasets commonly used in the previous literature (Lee et al., 2020; Croce et al., 2019).”