Timezone: »

 
Poster
Efficient Neural Network Robustness Certification with General Activation Functions
Huan Zhang · Tsui-Wei Weng · Pin-Yu Chen · Cho-Jui Hsieh · Luca Daniel

Wed Dec 05 07:45 AM -- 09:45 AM (PST) @ Room 517 AB #147
in Wed Poster Session A »

Finding minimum distortion of adversarial examples and thus certifying robustness in neural networks classifiers is known to be a challenging problem. Nevertheless, recently it has been shown to be possible to give a non-trivial certified lower bound of minimum distortion, and some recent progress has been made towards this direction by exploiting the piece-wise linear nature of ReLU activations. However, a generic robustness certification for \textit{general} activation functions still remains largely unexplored. To address this issue, in this paper we introduce CROWN, a general framework to certify robustness of neural networks with general activation functions. The novelty in our algorithm consists of bounding a given activation function with linear and quadratic functions, hence allowing it to tackle general activation functions including but not limited to the four popular choices: ReLU, tanh, sigmoid and arctan. In addition, we facilitate the search for a tighter certified lower bound by \textit{adaptively} selecting appropriate surrogates for each neuron activation. Experimental results show that CROWN on ReLU networks can notably improve the certified lower bounds compared to the current state-of-the-art algorithm Fast-Lin, while having comparable computational efficiency. Furthermore, CROWN also demonstrates its effectiveness and flexibility on networks with general activation functions, including tanh, sigmoid and arctan.

Keywords: Deep Learning · Privacy, Anonymity, and Security
[ Paper]  [ Poster] 

Author Information

Huan Zhang (UCLA)
Tsui-Wei Weng (MIT)
Pin-Yu Chen (IBM Research AI)
Cho-Jui Hsieh (UCLA, Google Research)
Luca Daniel (MIT)

More from the Same Authors