{"type":"ScholarlyArticle","title":"Robustra: Training Provable Robust Neural Networks over Reference Adversarial Space","authors":[{"name":"Linyi Li","slug":"linyi-li","given":"Linyi","family":"Li","affiliation":"University of Illinois at Urbana-Champaign"},{"name":"Zexuan Zhong","slug":"zexuan-zhong","given":"Zexuan","family":"Zhong","affiliation":"University of Illinois at Urbana-Champaign"},{"name":"Bo Li","slug":"bo-li","given":"Bo","family":"Li","affiliation":"University of Illinois at Urbana-Champaign"},{"name":"Tao Xie","slug":"tao-xie","given":"Tao","family":"Xie","affiliation":"University of Illinois at Urbana-Champaign"}],"abstract":"Machine learning techniques, especially deep neural networks (DNNs), have been widely adopted in various applications. However, DNNs are recently found to be vulnerable against adversarial examples, i.e., maliciously perturbed inputs that can mislead the models to make arbitrary prediction errors.\r\nEmpirical defenses have been studied, but many of them can be adaptively attacked again. \r\nProvable defenses provide provable error bound of DNNs, while such bound so far is far from satisfaction. \r\nTo address this issue, in this paper, we present our approach named Robustra for effectively improving the provable error bound of DNNs. \r\nWe leverage the adversarial space of a reference model as the feasible region to solve the min-max game between the attackers and defenders. \r\nWe solve its dual problem by linearly approximating the attackers' best strategy and utilizing the monotonicity of the slack variables introduced by the reference model.\r\nThe evaluation results show that our approach can provide significantly better provable adversarial error bounds on MNIST and CIFAR10 datasets, compared to the state-of-the-art results. In particular, bounded by L^infty, with epsilon = 0.1, on MNIST we reduce the error bound from 2.74% to 2.09%; with epsilon = 0.3, we reduce the error bound from 24.19% to 16.91%.","doi":"10.24963/ijcai.2019/654","url":"https://ijcai.org/proceedings/2019/654","pdf":"https://ijcai.org/proceedings/2019/0654.pdf","markdown":"https://ijcai.org/proceedings/2019/654.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/654","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Multidisciplinary Topics and Applications","track":"Main track","number":654,"pages":{"first":4711,"last":4717},"keywords":["Machine Learning: Adversarial Machine Learning","Multidisciplinary Topics and Applications: Security and Privacy"],"videos":[],"references":[{"position":1,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning, pages 274-283, 2018.","title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Carlini and Wagner, 2017a] Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: By- passing ten detection methods. In ACM Workshop on Ar- tificial Intelligence and Security, pages 3-14, 2017.","title":"Adversarial examples are not easily detected: Bypassing ten detection methods","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"ACM Workshop on Artificial Intelligence and Security","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Carlini and Wagner, 2017b] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural net- works. In IEEE Symposium on Security and Privacy, pages 39-57, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini, 2019] Nicholas Carlini. Is AmI (attacks meet inter- pretability) robust to adversarial examples? arXiv preprint arXiv:1902.02322, 2019.","title":"Is AmI (attacks meet interpretability) robust to adversarial examples","authors":"Nicholas Carlini","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Fazlyab et al., 2019] Mahyar Fazlyab, Manfred Morari, and George J. Pappas. Safety verification and robust- ness analysis of neural networks via quadratic con- straints and semidefinite programming. arXiv preprint arXiv:1903.01287, 2019.","title":"Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite programming","authors":"Mahyar Fazlyab, Manfred Morari, George J Pappas","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Goodfellow et al., 2015] Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2015","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Katz et al., 2017] Guy Katz, Clark Barrett, David Dill, Kyle Julian, and Mykel Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In In- ternational Conference on Computer Aided Verification, pages 97-117, 2017.","title":"Reluplex: An efficient SMT solver for verifying deep neural networks","authors":"Guy Katz, Clark Barrett, David Dill, Kyle Julian, Mykel Kochenderfer","year":"2017","venue":"International Conference on Computer Aided Verification","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Krizhevsky and Hinton, 2009] Alex Krizhevsky and Geof- frey Hinton. Learning multiple layers of features from tiny images. Technical report, Citeseer, 2009.","title":"Learning multiple layers of features from tiny images","authors":"Alex Krizhevsky, Geoffrey Hinton","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[LeCun et al., 1998] Yann LeCun, Léon Bottou, Yoshua Bengio, Patrick Haffner, et al. Gradient-based learning ap- plied to document recognition. Proceedings of the IEEE, 86(11):2278-2324, 1998.","title":"Gradient-based learning applied to document recognition","authors":"Yann Lecun, Léon Bottou, Yoshua Bengio, Patrick Haffner","year":"1998","venue":"Proceedings of the IEEE","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Madry et al., 2018] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2018","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Mirman et al., 2018] Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for provably robust neural networks. In International Confer- ence on Machine Learning, pages 3578-3586, 2018.","title":"Differentiable abstract interpretation for provably robust neural networks","authors":"Matthew Mirman, Timon Gehr, Martin Vechev","year":"2018","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Papernot et al., 2016] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neu- ral networks. In IEEE Symposium on Security and Privacy, pages 582-597, 2016.","title":"Distillation as a defense to adversarial perturbations against deep neural networks","authors":"Nicolas Papernot, Patrick Mcdaniel, Xi Wu, Somesh Jha, Ananthram Swami","year":"2016","venue":"IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Raghunathan et al., 2018] Aditi Raghunathan, Jacob Stein- hardt, and Percy Liang. Certified defenses against adver- sarial examples. In International Conference on Learning Representations, 2018.","title":"Certified defenses against adver-sarial examples","authors":"Aditi Raghunathan, Jacob Steinhardt, Percy Liang","year":"2018","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Salman et al., 2019] Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang. A convex relax- ation barrier to tight robust verification of neural networks. arXiv preprint arXiv:1902.08722, 2019.","title":"A convex relaxation barrier to tight robust verification of neural networks","authors":"Greg Hadi Salman, Huan Yang, Cho-Jui Zhang, Pengchuan Hsieh, Zhang","year":"2019","venue":null,"doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Samangouei et al., 2018] Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial attacks using generative models. In International Conference on Learning Representations, 2018.","title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","authors":"Pouya Samangouei, Maya Kabkab, Rama Chellappa","year":"2018","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Singh et al., 2018] Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, and Martin Vechev. Fast and effective robustness certification. In Ad- vances in Neural Information Processing Systems, pages 10802-10813, 2018.","title":"Fast and effective robustness certification","authors":"Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, Martin Vechev","year":"2018","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Singh et al., 2019] Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin Vechev. An abstract domain for certifying neural networks. In ACM SIGPLAN Sympo- sium on Principles of Programming Languages, volume 3, page 41, 2019.","title":"An abstract domain for certifying neural networks","authors":"Gagandeep Singh, Timon Gehr, Markus Püschel, Martin Vechev","year":"2019","venue":"ACM SIGPLAN Symposium on Principles of Programming Languages","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Szegedy et al., 2014] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2014","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Tjeng et al., 2019] Vincent Tjeng, Kai Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixed integer programming. In International Conference on Learning Representations, 2019.","title":"Evaluating robustness of neural networks with mixed integer programming","authors":"Vincent Tjeng, Kai Xiao, Russ Tedrake","year":"2019","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Weng et al., 2018] Tsui-Wei Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Duane Boning, Inder- jit S Dhillon, and Luca Daniel. Towards fast computa- tion of certified robustness for ReLU networks. In Inter- national Conference on Machine Learning, pages 5273- 5282, 2018.","title":"Towards fast computation of certified robustness for ReLU networks","authors":"Huan Tsui-Wei Weng, Hongge Zhang, Zhao Chen, Cho-Jui Song, Duane Hsieh, Boning, Luca Inderjit S Dhillon, Daniel","year":"2018","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Wong and Kolter, 2018] Eric Wong and J. Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Con- ference on Machine Learning, pages 5283-5292, 2018.","title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","authors":"Eric Wong, J Zico Kolter","year":"2018","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Wong et al., 2018] Eric Wong, Frank Schmidt, Jan Hendrik Metzen, and J. Zico Kolter. Scaling provable adversarial defenses. In Advances in Neural Information Processing Systems, pages 8400-8409, 2018.","title":"Scaling provable adversarial defenses","authors":"Eric Wong, Frank Schmidt, Jan Hendrik Metzen, J Zico Kolter","year":"2018","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Xiao et al., 2019] Kai Xiao, Vincent Tjeng, Nur Muham- mad Shafiullah, and Aleksander Madry. Training for faster adversarial robustness verification via inducing ReLU sta- bility. In International Conference on Learning Represen- tations, 2019.","title":"Training for faster adversarial robustness verification via inducing ReLU stability","authors":"Kai Xiao, Vincent Tjeng, Nur Muhammad Shafiullah, Aleksander Madry","year":"2019","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}