Paper reviews robustness in machine learning models and discusses training and certification methods.
problem Ensuring reliability of machine learning models in safety-critical systems.
method Reviews formalisms and discusses training and certification techniques.
result Identifies future research directions in robust machine learning.
New algorithms learn stability certificates from data, avoiding complex dynamics.
problem Synthesizing stability certificates from complex dynamical systems.
method Developed algorithms to learn certificate functions from trajectory data, establishing generalization error bounds.
result Efficiently learned certificates can be used for adaptive control.
Improves safety region certification for smoothed classifiers without changing smoothing scheme.
problem Certified safety regions for smoothed classifiers are often small compared to optimal.
method Generalizes certified radius calculation as nested optimization problem, uses 0th-1st order information, and designs efficient estimators.
result Certified safety regions are significantly larger than current methods, achieving significant improvements on various metrics.
Improved neural network robustness certification through tighter convex relaxations.
problem Certifying neural network robustness to perturbed and adversarial inputs.
method Exploiting ReLU network structure, novel partition-based certification procedure.
result Tightens existing linear programming relaxations to achieve zero relaxation error asymptotically.
Develops structured noise for more accurate graph classifier robustness certificates.
problem Isotropic noise limits robustness certificates for graph classifiers.
method Randomized smoothing with anisotropic noise distribution.
result Structured-aware robustness certificates provide more accurate predictions.
Deep-PrAE improves rare-event simulation for black-box systems.
problem Evaluating rare safety-critical events in learning-based systems.
method Combines deep neural networks with IS to create statistically guaranteed estimations.
result Deep-PrAE provides accurate bounds on safety-critical event probabilities.
Bayesian method synthesizes barrier certificates for unknown systems with latent states.
problem Certifying safety in systems with unknown dynamics and latent states.
method Bayesian inference with Metropolis-Hastings sampler and sum-of-squares program.
result Probabilistic validity of barrier certificates for unknown systems.
New method certifies neural network robustness under random input noise.
problem Certifying neural network robustness against random input noise.
method Chance-constrained optimization problem reformulated with input-output samples, convex conditions developed.
result Proposed method certifies robustness against various input noise regimes over larger uncertainty regions.
The paper certifies neural network-based control barrier functions efficiently.
problem Certifying neural network-based barrier functions for safety in autonomous systems.
method Combines NN reachability and hyperplane arrangement enumeration for efficient certification.
result Soundly finds regions where neural networks are certified as barrier functions.
Proposes new convex relaxations for certifying spatial robustness of neural networks.
problem Lack of provable guarantees for robustness against vector field transformations.
method Novel convex relaxations for certifying robustness against vector field transformations.
result First time providing a certificate of robustness against vector field transformations.
The paper provides tighter error bounds for GPR under bounded support noise.
problem Rigorous error quantification for safety-critical applications with bounded noise.
method Using concentration inequalities and low complexity assumptions in RKHS, the paper derives probabilistic and deterministic error bounds for GPR.
result The derived error bounds are substantially tighter than existing state-of-the-art bounds and are particularly well-suited for GPR with neural network kernels.
New method certifies risks of LLM outputs, improving accuracy and reliability.
problem Uncertain and incorrect outputs from large language models.
method Information-lift certificates using PAC-Bayes bounds and skeleton design.
result Achieves 77.0% coverage at 2% risk, outperforming baselines.
Two impossibility theorems show formal alignment certification is impossible for AI systems.
problem Formal certification of AI alignment over open-ended domains is impossible.
method Two independent impossibility theorems: Semantic and Statistical barriers.
result No procedure can simultaneously satisfy soundness, completeness, and tractability.
Develops probabilistic safety regions for scalable classifiers.
problem Minimizing misclassification errors in supervised classification.
method Introduces probabilistic safety regions and scalable classifiers.
result Probabilistic certifications for classifier performance.
BagCert efficiently certifies robustness against adversarial patches on image classifiers.
problem Adversarial patches pose a threat to autonomous systems' perception component.
method BagCert combines model architecture and certification procedure for efficient inference.
result BagCert certifies 10,000 examples in 43 seconds on a single GPU, achieving 86% clean and 60% certified accuracy against 5x5 patches.
New method certifies neural network robustness to random input noise.
problem Certifying neural networks' robustness to random input noise.
method Chance-constrained optimization problem reformulated using input-output samples.
result Certifies a uniform infinity-norm uncertainty region with a radius 50 times larger.
Paper proposes a dataset quality process for ML systems.
problem Inadequate standards for ML datasets in safety-critical systems.
method Proposes a dataset specification and verification process.
result Demonstrates the process on a railway signal recognition system.
Certified calibration methods protect model confidence from adversarial attacks.
problem Adversarial attacks degrade model calibration, reducing confidence in predictions.
method Developed certified calibration methods to provide worst-case bounds on calibration under adversarial perturbations.
result Certified calibration methods produce analytic and approximate bounds for the Brier score and expected calibration error.
The rapid growth of deep learning applications in real life is accompanied by severe safety concerns. To mitigate this uneasy phenomenon, much research has been done providing reliable evaluations of the fragility level in different deep neural networks. Apart from devising adversarial attacks, quantifiers that certify…
Proposes a method to ensure accurate estimation of rare events in AI systems.
problem Lack of efficiency guarantees in black-box systems for rare-event simulation.
method Integrates deep learning with importance sampling to create a statistically guaranteed estimator.
result Demonstrates effective estimation of rare-event probabilities in AI systems.
Reinforcement learning is a powerful paradigm for learning optimal policies from experimental data. However, to find optimal policies, most reinforcement learning algorithms explore all possible actions, which may be harmful for real-world systems. As a consequence, learning algorithms are rarely applied on safety-crit…
Framework for safely updating machine learning models.
problem Continuous updates to machine learning models can lead to unintended consequences.
method Formalizes the problem as computing the largest locally invariant domain (LID), uses tractable primal-dual formulation.
result Matches or exceeds heuristic baselines for avoiding forgetting while providing formal safety guarantees.
The paper highlights AI brittleness and the need for robust testing out-of-distribution performance.
problem The brittleness of AI systems, especially Deep Neural Networks, limits their reliability and certification.
method Analysis of AI brittleness and OOD performance, emphasizing the need for resilience and improved evaluation methods.
result AI systems are more failure-prone than certified in critical systems, and OOD performance falls off gradually.
New method improves reliability of object detection models.
problem Lack of reliability in neural networks for safety-critical applications.
method Sequential Conformal Risk Control (SeqCRC) for object detection.
result Valid statistical guarantees for any dataset size without prior knowledge.
New method closes certification gap for adversarially trained models.
problem Certifying robustness of adversarially trained neural networks.
method Nonconvex low-rank SDP relaxation with polynomial-time optimization.
result Strong certifications comparable to SDP methods, but with fewer variables.
Develops first robustness verification for complex Transformers.
problem Certify prediction behavior of Transformers with complex self-attention layers.
method Resolves challenges of cross-nonlinearity and cross-position dependency in Transformers.
result Certified robustness bounds are significantly tighter than Interval Bound Propagation.
While neural networks have achieved high performance in different learning tasks, their accuracy drops significantly in the presence of small adversarial perturbations to inputs. Defenses based on regularization and adversarial training are often followed by new attacks to defeat them. In this paper, we propose attack-…
New framework improves adversarial robustness certification for various perturbations.
problem Certifying robustness against adversarial attacks in deep learning models.
method Unified functional optimization approach with non-Gaussian smoothing noise for multiple types of attacks.
result Achieves better certification results and identifies key trade-offs between accuracy and robustness.
CITE algorithm provides anytime-valid certification of model outputs.
problem Challenges in controlling error levels in LLM self-consistency.
method Certification by Intersection-union Testing with E-processes (CITE) algorithm.
result Provable control of false certification at any prescribed level under arbitrary stopping rules.
Paper develops tighter risk certificates for contrastive learning models.
problem Statistical theory for contrastive learning is lacking, especially for practical models like SimCLR.
method Develops non-vacuous PAC-Bayesian risk certificates considering practical SimCLR factors.
result Risk certificates for contrastive loss and downstream prediction are much tighter than previous results.
Develops local population-risk certificates for model updates
problem Model updates in machine learning
method Certify population-risk increments around a model
result Certified upper endpoint yields a risk-controlled update rule
The performance of a reinforcement learning algorithm can vary drastically during learning because of exploration. Existing algorithms provide little information about the quality of their current policy before executing it, and thus have limited use in high-stakes applications like healthcare. We address this lack of …
New method provides tighter robustness guarantees for adversarial attacks.
problem Ensuring robustness against adversarial attacks in machine learning models.
method Developed a Second-order Smoothing (SoS) robustness certificate using Gaussian random smoothing.
result SoS certificates are tighter and provide improved robustness on high-dimensional datasets.
TUV Austria proposes certification for ML applications to ensure reliability.
problem Ensuring trust in AI applications to meet societal reliance requirements.
method Holistic approach analyzing security, functionality, data quality, ethics, and criticality levels.
result Certification process for low-risk ML applications in supervised learning.
Valid certifies LLMs' domain adherence, bounding out-of-domain behavior.
problem Adversarial susceptibility of LLMs to generate out-of-domain outputs.
method VALID approach providing adversarial bounds as a certificate.
result Validates LLMs' domain adherence with meaningful certificates.
It has recently been shown that ReLU networks produce arbitrarily over-confident predictions far away from the training data. Thus, ReLU networks do not know when they don't know. However, this is a highly important property in safety critical applications. In the context of out-of-distribution detection (OOD) there ha…
Paper provides efficient robustness certificates for neural networks.
problem Ensuring neural networks are robust against adversarial attacks.
method Two-step approach: 1) Efficient convex optimization for robustness certificates with bounded Hessian eigenvalues, 2) Curvature-based regularization during training.
result Significantly higher certified robust accuracy achieved compared to existing methods.
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
Conformal Candidate Certification advances offline MBO by certifying candidate designs with statistical guarantees.
problem Offline model-based optimization
method Conformal Candidate Certification (CCC)
result CCC certifies 16.7% of an aggressive proposal pool with 0.990 empirical coverage at nominal 0.90.
New robustness certificates for streaming models with a sliding window.
problem Applying robustness certificates to streaming data with correlated inputs.
method Deriving robustness certificates for models using a sliding window over a sequence of potentially correlated inputs.
result Guarantees hold for the average model performance across the entire stream, independent of stream size.
Survey examines challenges of ML in avionic systems certification.
problem Challenges in current certification standards for ML in avionic systems.
method Literature review focusing on robustness and explainability of ML results.
result Current certification standards do not support ML in avionic systems.
Geometric technique determines exactness of SDP robustness certificate.
problem Certifying robustness of neural networks to adversarial examples.
method Geometric projection onto hyperbola, SDP relaxation of ReLU activation.
result SDP certificate is exact for a single hidden layer under mild assumptions.
This work improves deep reinforcement learning robustness to adversarial state uncertainty.
problem Robustness of deep reinforcement learning to adversarial state uncertainty.
method Certified adversarial robustness techniques are applied to deep reinforcement learning algorithms to compute guaranteed lower bounds on state-action values.
result The approach increases robustness to noise and adversaries in pedestrian collision avoidance and classic control tasks.
The paper improves risk certificate tightness for neural networks using PAC-Bayes bounds.
problem Improving the usability of risk certificates for neural networks based on PAC-Bayes bounds.
method Theoretical contributions including KL divergence bounds, efficient methodology for optimization, and methods for optimizing non-differentiable objectives.
result First non-vacuous generalization bounds on CIFAR-10 for neural networks.
Study adversarial perturbations in classification, analyzing learning and certification.
problem Formal study of classification under adversarial perturbations from both learner and third-party perspectives.
method PAC-type semi-supervised learning framework, black-box certification under limited query budget, adversary analysis.
result Existence of a polynomial query complexity adversary implies the existence of a sample efficient robust learner.
New method improves robustness of smoothed classifiers against adversarial attacks.
problem Improving robustness of smoothed classifiers against adversarial attacks.
method Proposes worst-case adversarial loss over input distributions as a robustness certificate, and uses duality and smoothness properties to provide an easy-to-compute upper bound.
result Shows superior robustness performance over state-of-the-art certified or heuristic methods.
New framework certifies robustness for regression models.
problem Certifying robustness for regression models is challenging.
method Derives a prediction-centered certificate that exploits local geometry.
result Gradient information yields tighter robustness certificates.
SREC markets are a relatively novel market-based system to incentivize the production of energy from solar means. A regulator imposes a floor on the amount of energy each regulated firm must generate from solar power in a given period and provides them with certificates for each generated MWh. Firms offset these certif…