A Tool for Neural Network Global Robustness Certification and Training

Wang, Zhilu; Wang, Yixuan; Feisi, Fu,; Jiao, Ruochen; Huang, Chao; Li, Wenchao; Zhu, Quanxin

doi:10.48550/arxiv.2208.07289

Cited by 3 publications

(4 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Verification properties can be broadly classified into two distinct categories: local and global. A local property must be valid for specific predefined inputs, while a global property [48] is established across the entire input space R n f ×t s of the network model, holding true for all inputs without exceptions.…”

Section: Robustness Verification Propertiesmentioning

confidence: 99%

See 1 more Smart Citation

Formal Verification of Long Short-Term Memory based Audio Classifiers: A Star based Approach

Pal,

Johnson

2023

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Formally verifying audio classification systems is essential to ensure accurate signal classification across real-world applications like surveillance, automotive voice commands, and multimedia content management, preventing potential errors with serious consequences. Drawing from recent research, this study advances the utilization of star-set-based formal verification, extended through reachability analysis, tailored explicitly for Long Short-Term Memory architectures and their Convolutional variations within the audio classification domain. By conceptualizing the classification process as a sequence of set operations, the star set-based reachability approach streamlines the exploration of potential operational states attainable by the system. The paper serves as an encompassing case study, validating and verifying sequence audio classification analytics within real-world contexts. It accentuates the necessity for robustness verification to ensure precise and dependable predictions, particularly in light of the impact of noise on the accuracy of output classifications.

show abstract

Section: Robustness Verification Propertiesmentioning

confidence: 99%

“…where N robust represents the total number of robust sequences, and N total is the overall count of sequences in the test dataset. Percentage robustness can be used as an indicator of global robustness [48] with respect to various types of perturbations.…”

Section: Robustness Verification Propertiesmentioning

confidence: 99%

Formal Verification of Long Short-Term Memory based Audio Classifiers: A Star based Approach

Pal,

Johnson

2023

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

show abstract

“…When compared with ( 8), the modified definition targets neural networks, especially when these compute real-valued outputs. A number of works adopt this definition of global robustness [15,64,65], but [15] imposes no constraint on x and v. It should be noted that this definition is not without problems. For ML classifiers, e.g.…”

Section: Related Workmentioning

confidence: 99%

“…percentage of samples failed/succeeded in the local robustness test. Besides, works reported in [38,64,65] adopt global robustness property to certify whether or not the analyzed model is robust. Furthermore, some works [15,64] use local and global robustness techniques to measure lower and upper bounds for robustness.…”

Section: Related Workmentioning

confidence: 99%

On Explaining Random Forests with SAT

Izza

Marques-Silva

2021

Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence

View full text Add to dashboard Cite

Random Forest (RFs) are among the most widely used Machine Learning (ML) classifiers. Even though RFs are not interpretable, there are no dedicated non-heuristic approaches for computing explanations of RFs. Moreover, there is recent work on polynomial algorithms for explaining ML models, including naive Bayes classifiers. Hence, one question is whether finding explanations of RFs can be solved in polynomial time. This paper answers this question negatively, by proving that computing one PI-explanation of an RF is D^P-hard. Furthermore, the paper proposes a propositional encoding for computing explanations of RFs, thus enabling finding PI-explanations with a SAT solver. This contrasts with earlier work on explaining boosted trees (BTs) and neural networks (NNs), which requires encodings based on SMT/MILP. Experimental results, obtained on a wide range of publicly available datasets, demonstrate that the proposed SAT-based approach scales to RFs of sizes common in practical applications. Perhaps more importantly, the experimental results demonstrate that, for the vast majority of examples considered, the SAT-based approach proposed in this paper significantly outperforms existing heuristic approaches.

show abstract

Verification of Neural Networks’ Global Robustness

Kabaha,

Cohen

2024

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Neural networks are successful in various applications but are also susceptible to adversarial attacks. To show the safety of network classifiers, many verifiers have been introduced to reason about the local robustness of a given input to a given perturbation. While successful, local robustness cannot generalize to unseen inputs. Several works analyze global robustness properties, however, neither can provide a precise guarantee about the cases where a network classifier does not change its classification. In this work, we propose a new global robustness property for classifiers aiming at finding the minimal globally robust bound, which naturally extends the popular local robustness property for classifiers. We introduce VHAGaR, an anytime verifier for computing this bound. VHAGaR relies on three main ideas: encoding the problem as a mixed-integer programming and pruning the search space by identifying dependencies stemming from the perturbation or the network's computation and generalizing adversarial attacks to unknown inputs. We evaluate VHAGaR on several datasets and classifiers and show that, given a three hour timeout, the average gap between the lower and upper bound on the minimal globally robust bound computed by VHAGaR is 1.9, while the gap of an existing global robustness verifier is 154.7. Moreover, VHAGaR is 130.6x faster than this verifier. Our results further indicate that leveraging dependencies and adversarial attacks makes VHAGaR 78.6x faster.

show abstract

A Tool for Neural Network Global Robustness Certification and Training

Cited by 3 publications

References 0 publications

Formal Verification of Long Short-Term Memory based Audio Classifiers: A Star based Approach

Formal Verification of Long Short-Term Memory based Audio Classifiers: A Star based Approach

On Explaining Random Forests with SAT

Verification of Neural Networks’ Global Robustness

Contact Info

Product

Resources

About