Locally Linear Attributes of ReLU Neural Networks

Sattelberg, Ben; Cavalieri, Renzo; Kirby, Michael; Peterson, Chris; Beveridge, Ross

doi:10.48550/arxiv.2012.01940

Cited by 3 publications

(4 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Our main idea is to harness the locally simple piecewise linear structure of NNs with piecewise linear activation functions, such as ReLU or Leaky ReLU NNs (cf. e.g., Hanin and Rolnick 2019;Sattelberg et al 2020). Note that our method is still generally applicable, since any activation function can be approximated by piecewise linear functions (Hu et al 2020;Liao et al 2023).…”

Section: How Can Pds Representing Aleatoric Uncertainty In Input Data...mentioning

confidence: 99%

“…Without loss of generality, we exclusively focus on NNs of such structure for the remainder of this paper. Following Sattelberg et al (2020), we recall definitions of the necessary mathematical concepts of polytopes and piecewise linear functions. The piecewise linear structure of NNs has been recognized in literature and is key in the discussion of expressiveness and complexity of NNs (e.g., Hanin and Rolnick 2019).…”

Section: Uncertainty Propagation Via Piecewise Linear Transformationmentioning

confidence: 99%

See 1 more Smart Citation

Piecewise Linear Transformation – Propagating Aleatoric Uncertainty in Neural Networks

Krapf,

Hagn,

Miethaner

et al. 2024

AAAI

View full text Add to dashboard Cite

Real-world data typically exhibit aleatoric uncertainty which has to be considered during data-driven decision-making to assess the confidence of the decision provided by machine learning models. To propagate aleatoric uncertainty represented by probability distributions (PDs) through neural networks (NNs), both sampling-based and function approximation-based methods have been proposed. However, these methods suffer from significant approximation errors and are not able to accurately represent predictive uncertainty in the NN output. In this paper, we present a novel method, Piecewise Linear Transformation (PLT), for propagating PDs through NNs with piecewise linear activation functions (e.g., ReLU NNs). PLT does not require sampling or specific assumptions about the PDs. Instead, it harnesses the piecewise linear structure of such NNs to determine the propagated PD in the output space. In this way, PLT supports the accurate quantification of predictive uncertainty based on the criterion exactness of the propagated PD. We assess this exactness in theory by showing error bounds for our propagated PD. Further, our experimental evaluation validates that PLT outperforms competing methods on publicly available real-world classification and regression datasets regarding exactness. Thus, the PDs propagated by PLT allow to assess the uncertainty of the provided decisions, offering valuable support.

show abstract

Section: How Can Pds Representing Aleatoric Uncertainty In Input Data...mentioning

confidence: 99%

Section: Uncertainty Propagation Via Piecewise Linear Transformationmentioning

confidence: 99%

Piecewise Linear Transformation – Propagating Aleatoric Uncertainty in Neural Networks

Krapf,

Hagn,

Miethaner

et al. 2024

AAAI

View full text Add to dashboard Cite

show abstract

“…cross-entropy loss, mean squared loss, etc. Moreover, we further assume that training samples in S belong to the same class, which is a reasonable assumption to make for ReLU networks [47].…”

Section: Validity Of the Attack Model For Relu Networkmentioning

confidence: 99%

Reverse Engineering $\ell_p$ attacks: A block-sparse optimization approach with recovery guarantees

Thaker¹,

Giampouras²,

Vidal³

2022

Preprint

View full text Add to dashboard Cite

Deep neural network-based classifiers have been shown to be vulnerable to imperceptible perturbations to their input, such as p-bounded norm adversarial attacks. This has motivated the development of many defense methods, which are then broken by new attacks, and so on. This paper focuses on a different but related problem of reverse engineering adversarial attacks. Specifically, given an attacked signal, we study conditions under which one can determine the type of attack ( 1, 2 or ∞) and recover the clean signal. We pose this problem as a block-sparse recovery problem, where both the signal and the attack are assumed to lie in a union of subspaces that includes one subspace per class and one subspace per attack type. We derive geometric conditions on the subspaces under which any attacked signal can be decomposed as the sum of a clean signal plus an attack. In addition, by determining the subspaces that contain the signal and the attack, we can also classify the signal and determine the attack type. Experiments on digit and face classification demonstrate the effectiveness of the proposed approach.

show abstract

“…which means the student model trust the teacher and can perfectly learn the knowledge defined by the distillation objective. The second is the local linearity assumption, which assumes that neural networks with piece-wise linear activation functions are locally linear (Sattelberg et al (2020); Croce et al (2019); ) and the certified robust area falls into these piece-wise linear regions. These two assumptions collaboratively build an ideal situation of knowledge distillation in which we can derive a strong property of KDIGA that the certified robustness of the student model can be as good as or even better than that of the teacher model.…”

Section: Preservation Of Certified Robustnessmentioning

confidence: 99%

How and When Adversarial Robustness Transfers in Knowledge Distillation?

Shao¹,

Yi²,

Chen³

et al. 2021

Preprint

View full text Add to dashboard Cite

Knowledge distillation (KD) has been widely used in teacher-student training, with applications to model compression in resource-constrained deep learning. Current works mainly focus on preserving the accuracy of the teacher model. However, other important model properties, such as adversarial robustness, can be lost during distillation. This paper studies how and when the adversarial robustness can be transferred from a teacher model to a student model in KD. We show that standard KD training fails to preserve adversarial robustness, and we propose KD with input gradient alignment (KDIGA) for remedy. Under certain assumptions, we prove that the student model using our proposed KDIGA can achieve at least the same certified robustness as the teacher model. Our experiments of KD contain a diverse set of teacher and student models with varying network architectures and sizes evaluated on ImageNet and CIFAR-10 datasets, including residual neural networks (ResNets) and vision transformers (ViTs). Our comprehensive analysis shows several novel insights that (1) With KDIGA, students can preserve or even exceed the adversarial robustness of the teacher model, even when their models have fundamentally different architectures; (2) KDIGA enables robustness to transfer to pre-trained students, such as KD from an adversarially trained ResNet to a pre-trained ViT, without loss of clean accuracy; and(3) Our derived local linearity bounds for characterizing adversarial robustness in KD are consistent with the empirical results.

show abstract

Locally Linear Attributes of ReLU Neural Networks

Cited by 3 publications

References 16 publications

Piecewise Linear Transformation – Propagating Aleatoric Uncertainty in Neural Networks

Piecewise Linear Transformation – Propagating Aleatoric Uncertainty in Neural Networks

Reverse Engineering $\ell_p$ attacks: A block-sparse optimization approach with recovery guarantees

How and When Adversarial Robustness Transfers in Knowledge Distillation?

Contact Info

Product

Resources

About