Towards Stable and Efficient Training of Verifiably Robust Neural Networks

Zhang, Huan; Chen, Hongge; Xiao, Chaowei; Gowal, Sven; Stanforth, Robert; Li, Bo; Boning, Duane S.; Hsieh, Cho‐Jui

doi:10.48550/arxiv.1906.06316

Cited by 51 publications

(51 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We show that although AuditAI considers perturbations in the latent space that allows a large range of semantic variations in the pixel-space, it retains the theoretical guarantees of provable verification analogous to IBP-based adversarial robustness [25,24,37] that consider pixel-perturbations.…”

Section: Theoretical Resultsmentioning

confidence: 99%

“…Second, our model should be verifiable, where the latent space is learned such that the corresponding S i,in is as large as possible given a specification function F . In this case, AuditAI can be seen as doing certified training [25] to improve the verifiability of the model. Finally, the latent space should be able to perform well on the downstream task through f d .…”

Section: Certified Training Through Latent Representationmentioning

confidence: 99%

“…Then, we can define L spec as L spec = CE(ẑ K , y true ). In practice, we do not use IBP, but an improved approach CROWN-IBP [25] that provides tigher bounds and more stable training, based on the AutoLiRPA library [37]. We mention details about the specifics of this in the Appendix.…”

Section: Certified Training Through Latent Representationmentioning

confidence: 99%

“…be invariant to pixel perturbations within an -ball of L p norm [24,25]. While these approaches are much more scalable to modern DL architectures, they are not directly applicable to perform our semantically meaningful unit tests for auditing DL models.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Auditing AI models for Verified Deployment under Semantic Specifications

Bharadhwaj¹,

Huang²,

Xiao³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

Auditing trained deep learning (DL) models prior to deployment is vital in preventing unintended consequences. One of the biggest challenges in auditing is in understanding how we can obtain human-interpretable specifications that are directly useful to the end-user. We address this challenge through a sequence of semantically-aligned unit tests, where each unit test verifies whether a predefined specification (e.g., accuracy over 95%) is satisfied with respect to controlled and semantically aligned variations in the input space (e.g., in face recognition, the angle relative to the camera). We perform these unit tests by directly verifying the semantically aligned variations in an interpretable latent space of a generative model. Our framework, AuditAI, bridges the gap between interpretable formal verification and scalability. With evaluations on four different datasets, covering images of towers, chest X-rays, human faces, and ImageNet classes, we show how AuditAI allows us to obtain controlled variations for verification and certified training while addressing the limitations of verifying using only pixel-space perturbations. A blog post accompanying the paper is at this link auditai.github.io

show abstract

Section: Theoretical Resultsmentioning

confidence: 99%

Section: Certified Training Through Latent Representationmentioning

confidence: 99%

Section: Certified Training Through Latent Representationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Auditing AI models for Verified Deployment under Semantic Specifications

Bharadhwaj¹,

Huang²,

Xiao³

et al. 2021

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…An upper bound on the adversarial loss is also computed in Raghunathan et al (2018a) by solving instead a semidefinite program. Other more scalable and effective methods based on minimizing an upper bound of the adversarial loss have been introduced Balunovic and Vechev, 2019;Dvijotham et al, 2018a;Zhang et al, 2019).…”

Section: Introductionmentioning

confidence: 99%

A Robust Optimization Approach to Deep Learning

Bertsimas¹,

Boix²,

Carballo³

et al. 2021

Preprint

View full text Add to dashboard Cite

Many state-of-the-art adversarial training methods leverage upper bounds of the adversarial loss to provide security guarantees. Yet, these methods require computations at each training step that can not be incorporated in the gradient for backpropagation. We introduce a new, more principled approach to adversarial training based on a closed form solution of an upper bound of the adversarial loss, which can be effectively trained with backpropagation. This bound is facilitated by state-ofthe-art tools from robust optimization. We derive two new methods with our approach. The first method (Approximated Robust Upper Bound or aRUB) uses the first order approximation of the network as well as basic tools from linear robust optimization to obtain an approximate upper bound of the adversarial loss that can be easily implemented. The second method (Robust Upper Bound or RUB), computes an exact upper bound of the adversarial loss. Across a variety of tabular and vision data sets we demonstrate the effectiveness of our more principled approach -RUB is substantially more robust than state-of-the-art methods for larger perturbations, while aRUB matches the performance of state-of-the-art methods for small perturbations. Also, both RUB and aRUB run faster than standard adversarial training (at the expense of an increase in memory). All the code to reproduce the results can be found at https://github.com/kimvc7/Robustness.

show abstract

AdvDO: Realistic Adversarial Attacks for Trajectory Prediction

Cao

Xiao

Anandkumar

et al. 2022

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Trajectory prediction is essential for autonomous vehicles (AVs) to plan correct and safe driving behaviors. While many prior works aim to achieve higher prediction accuracy, few study the adversarial robustness of their methods. To bridge this gap, we propose to study the adversarial robustness of data-driven trajectory prediction systems. We devise an optimization-based adversarial attack framework that leverages a carefully-designed differentiable dynamic model to generate realistic adversarial trajectories. Empirically, we benchmark the adversarial robustness of state-of-the-art prediction models and show that our attack increases the prediction error for both general metrics and planningaware metrics by more than 50% and 37%. We also show that our attack can lead an AV to drive off road or collide into other vehicles in simulation. Finally, we demonstrate how to mitigate the adversarial attacks using an adversarial training scheme 1 .

show abstract

Towards Stable and Efficient Training of Verifiably Robust Neural Networks

Cited by 51 publications

References 27 publications

Auditing AI models for Verified Deployment under Semantic Specifications

Auditing AI models for Verified Deployment under Semantic Specifications

A Robust Optimization Approach to Deep Learning

AdvDO: Realistic Adversarial Attacks for Trajectory Prediction

Contact Info

Product

Resources

About