On Certifying Non-Uniform Bounds against Adversarial Attacks

Chen Liu, Ryota Tomioka, Volkan Cevher
Proceedings of the 36th International Conference on Machine Learning, PMLR 97:4072-4081, 2019.

Abstract

This work studies the robustness certification problem of neural network models, which aims to find certified adversary-free regions as large as possible around data points. In contrast to the existing approaches that seek regions bounded uniformly along all input features, we consider non-uniform bounds and use it to study the decision boundary of neural network models. We formulate our target as an optimization problem with nonlinear constraints. Then, a framework applicable for general feedforward neural networks is proposed to bound the output logits so that the relaxed problem can be solved by the augmented Lagrangian method. Our experiments show the non-uniform bounds have larger volumes than uniform ones. Compared with normal models, the robust models have even larger non-uniform bounds and better interpretability. Further, the geometric similarity of the non-uniform bounds gives a quantitative, data-agnostic metric of input features’ robustness.

Cite this Paper

BibTeX
@InProceedings{pmlr-v97-liu19h, title = {On Certifying Non-Uniform Bounds against Adversarial Attacks}, author = {Liu, Chen and Tomioka, Ryota and Cevher, Volkan}, booktitle = {Proceedings of the 36th International Conference on Machine Learning}, pages = {4072--4081}, year = {2019}, editor = {Chaudhuri, Kamalika and Salakhutdinov, Ruslan}, volume = {97}, series = {Proceedings of Machine Learning Research}, month = {09--15 Jun}, publisher = {PMLR}, pdf = {http://proceedings.mlr.press/v97/liu19h/liu19h.pdf}, url = {https://proceedings.mlr.press/v97/liu19h.html}, abstract = {This work studies the robustness certification problem of neural network models, which aims to find certified adversary-free regions as large as possible around data points. In contrast to the existing approaches that seek regions bounded uniformly along all input features, we consider non-uniform bounds and use it to study the decision boundary of neural network models. We formulate our target as an optimization problem with nonlinear constraints. Then, a framework applicable for general feedforward neural networks is proposed to bound the output logits so that the relaxed problem can be solved by the augmented Lagrangian method. Our experiments show the non-uniform bounds have larger volumes than uniform ones. Compared with normal models, the robust models have even larger non-uniform bounds and better interpretability. Further, the geometric similarity of the non-uniform bounds gives a quantitative, data-agnostic metric of input features’ robustness.} }
Endnote
%0 Conference Paper %T On Certifying Non-Uniform Bounds against Adversarial Attacks %A Chen Liu %A Ryota Tomioka %A Volkan Cevher %B Proceedings of the 36th International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2019 %E Kamalika Chaudhuri %E Ruslan Salakhutdinov %F pmlr-v97-liu19h %I PMLR %P 4072--4081 %U https://proceedings.mlr.press/v97/liu19h.html %V 97 %X This work studies the robustness certification problem of neural network models, which aims to find certified adversary-free regions as large as possible around data points. In contrast to the existing approaches that seek regions bounded uniformly along all input features, we consider non-uniform bounds and use it to study the decision boundary of neural network models. We formulate our target as an optimization problem with nonlinear constraints. Then, a framework applicable for general feedforward neural networks is proposed to bound the output logits so that the relaxed problem can be solved by the augmented Lagrangian method. Our experiments show the non-uniform bounds have larger volumes than uniform ones. Compared with normal models, the robust models have even larger non-uniform bounds and better interpretability. Further, the geometric similarity of the non-uniform bounds gives a quantitative, data-agnostic metric of input features’ robustness.
APA
Liu, C., Tomioka, R. & Cevher, V.. (2019). On Certifying Non-Uniform Bounds against Adversarial Attacks. Proceedings of the 36th International Conference on Machine Learning, in Proceedings of Machine Learning Research 97:4072-4081 Available from https://proceedings.mlr.press/v97/liu19h.html.

Related Material