论文标题
对抗性鲁棒性的分层验证
Hierarchical Verification for Adversarial Robustness
论文作者
论文摘要
我们为确切的点$ \ ell_p $ robustness验证问题引入了一个新框架，该问题利用了具有整流的线性激活（relu网络）的深度进料向前向网络的层几何结构。网络分区的激活区域输入空间，并且可以通过检查所需半径内的所有激活区域来验证$ \ ell_p $ ronustness。 Geocert算法（Jordan等人，Neurips 2019）将该分区视为一种通用的多面体复合物，以检测下一个要检查哪个区域。相反，我们的LayerCert框架考虑了由Relu网络层引起的\ Emph {嵌套的超平面}结构，并以层次结构方式探索区域。我们表明，在算法参数的某些条件下，LayerCert证明可以减少与GeoCert相比，需要解决的凸程序的数量和大小。此外，我们的LayerCert框架允许基于凸松弛的下限例程合并，以进一步提高性能。实验结果表明，LayerCert可以显着减少解决方案的数量和最先进的运行时间。
We introduce a new framework for the exact point-wise $\ell_p$ robustness verification problem that exploits the layer-wise geometric structure of deep feed-forward networks with rectified linear activations (ReLU networks). The activation regions of the network partition the input space, and one can verify the $\ell_p$ robustness around a point by checking all the activation regions within the desired radius. The GeoCert algorithm (Jordan et al., NeurIPS 2019) treats this partition as a generic polyhedral complex in order to detect which region to check next. In contrast, our LayerCert framework considers the \emph{nested hyperplane arrangement} structure induced by the layers of the ReLU network and explores regions in a hierarchical manner. We show that, under certain conditions on the algorithm parameters, LayerCert provably reduces the number and size of the convex programs that one needs to solve compared to GeoCert. Furthermore, our LayerCert framework allows the incorporation of lower bounding routines based on convex relaxations to further improve performance. Experimental results demonstrate that LayerCert can significantly reduce both the number of convex programs solved and the running time over the state-of-the-art.
