CROWN certifies robustness of neural networks with general activation functions.
problem Certifying robustness of neural networks with general activation functions.
method Bounding activation functions with linear and quadratic surrogates, adaptively selecting surrogates for each neuron.
result Significantly improves certified lower bounds on ReLU networks compared to Fast-Lin.
New method certifies neural network function space norms from point evaluations.
problem Certifying neural network function space norms from point evaluations alone.
method Combining interval arithmetic enclosures, adaptive marking/refinement, and quadrature-based aggregation.
result Certified computation of Lp, W1,p, and W2,p norms. This paper assesses Gaussian and Exponential mechanisms for certifying adversarial robustness.
problem Certifying adversarial robustness using randomized smoothing mechanisms.
method Proposes a generic framework to assess the appropriateness of randomized smoothing mechanisms.
result Gaussian mechanism is an appropriate option for certifying both ℓ2-norm and ℓ∞-norm robustness. Paper proposes efficient algorithms to certify robustness of ReLU networks.
problem NP-complete problem of verifying robustness for ReLU networks.
method Two computationally efficient algorithms Fast-Lin and Fast-Lip.
result Delivers bounds close to exact minimum distortion with significant speedup.
PROWL uses robust reward estimates to improve ITR selection.
problem Reward uncertainty in ITR estimation leads to inflated performance.
method PAC-Bayesian framework with reward uncertainty certificates.
result PROWL achieves better robust treatment regime estimation.
Certified algorithms optimize functions with varying costs, providing error bounds.
problem Optimizing functions with varying evaluation costs and error bounds.
method Formalized as a min-max game, proposed certified MFDOO algorithm with cost complexity bound.
result Proposed certified MFDOO algorithm has near-optimal cost complexity for Lipschitz functions.
RobBoost optimizes a deep model ensemble for certified robustness.
problem Improving the robustness of deep models.
method Optimizes a neural network's robustness certificate through model selection and weighting.
result RobBoost forms a more robust ensemble with better certified robustness and clean accuracy.
Defense against adversarial examples using k-NN on neural network activations.
problem Adversarial examples that fool machine learning models.
method k-Nearest Neighbor (kNN) on intermediate activations of neural networks.
result Significantly outperforms state-of-the-art defenses on MNIST and CIFAR-10.
New framework solves low-rank optimization problems to certifiable optimality.
problem Low-rank optimization problems with certifiable solutions.
method Mixed-Projection Conic Optimization framework using symmetric projection matrices and outer-approximation algorithms.
result Solves low-rank problems to certifiable optimality, outperforming existing methods.
Enhances robustness for time series classification using self-ensemble method.
problem Limited adversarial robustness in time series classification.
method Proposes a self-ensemble method to improve Randomized Smoothing's robustness certification.
result Demonstrates superior robustness compared to baseline approaches.
This paper provides a comprehensive benchmark and taxonomy for certifiably robust DNN defenses.
problem Certifiably robust defenses against adversarial attacks for deep neural networks.
method Taxonomy and benchmark of certifiably robust approaches.
result First comprehensive benchmark of certifiably robust approaches on different datasets.
Paper certifies intersection of minimum-volume confidence sets for multinomial outcomes.
problem Certifying intersection of minimum-volume confidence sets for multinomial outcomes.
method Exploits likelihood ordering to induce halfspace constraints, enabling adaptive geometric partitioning and computable bounds on p-values.
result Efficient and provably sound algorithm for certifying intersection, disjointness, or indeterminate result.
New regularizers tighten convex relaxation bounds for neural networks.
problem Large gap between certifiable and empirical robustness in neural networks.
method Two regularizers to train neural networks yielding tighter convex relaxation bounds.
result Higher certified accuracy with proposed regularizers.
Paper provides efficient robustness certificates for neural networks.
problem Ensuring neural networks are robust against adversarial attacks.
method Two-step approach: 1) Efficient convex optimization for robustness certificates with bounded Hessian eigenvalues, 2) Curvature-based regularization during training.
result Significantly higher certified robust accuracy achieved compared to existing methods.
CNN-Cert efficiently certifies robustness of CNNs, achieving significant speed-ups.
problem Verifying robustness of neural networks, especially convolutional neural networks, against adversarial perturbations.
method General and efficient framework that handles various architectures and activation functions, achieving up to 17 and 11 times speed-up compared to state-of-the-art algorithms.
result Achieves similar or better verification bounds compared to state-of-the-art algorithms while being significantly faster.
PROVEN extends neural network robustness verification to probabilistic settings.
problem Quantifying robustness of neural networks under probabilistic noise distributions.
method PROVEN: Probabilistic Verification of Neural Networks (PROVEN) with statistical guarantees.
result PROVEN achieves up to 75% improvement in robustness certification compared to worst-case methods.
High-dimensional smoothing techniques struggle with robustness guarantees against various attacks.
problem Challenges in extending randomized smoothing to other attack models in high-dimensional space.
method Analysis of isotropic and generalized Gaussian smoothing distributions, proving bounds on certified robustness radii.
result Certifiable robustness radii decrease as $O(1/d^{ rac{1}{2} - rac{1}{p}})$ with dimension d for p>2. Deep Partition Aggregation defends against poisoning attacks with provable certificates.
problem Adversarial poisoning attacks corrupt classifier test-time behavior.
method Deep Partition Aggregation (DPA) is an ensemble method using hash partitions and base models trained on these partitions.
result DPA can certify >= 50% of test images against over 500 poison image insertions on MNIST, and nine insertions on CIFAR-10.
Efficient local Lipschitz bounds improve neural network robustness.
problem Certifying robustness of neural networks is challenging and often leads to over-regularization.
method Proposes an efficient trainable local Lipschitz upper bound by considering activation functions and weight matrices.
result Consistently outperforms state-of-the-art methods in clean and certified accuracy on various datasets.
Paper proposes faster certified robust training methods with short warmup.
problem Certified robust training methods require long warmup schedules, making training costly.
method Proposes three improvements: new weight initialization, BN, and regularization.
result Achieves 65.03% verified error on CIFAR-10 and 82.36% on TinyImageNet with short warmup.
Study certifies missed relevant items in candidate generation with audit labels.
problem Certify missed relevant items in candidate generation with audit labels.
method Characterizes label complexity, develops exact finite-sample toolkit.
result Excluded-pool auditing is minimax rate-optimal for missed-mass certification.
New method certifies neural network robustness under random input noise.
problem Certifying neural network robustness against random input noise.
method Chance-constrained optimization problem reformulated with input-output samples, convex conditions developed.
result Proposed method certifies robustness against various input noise regimes over larger uncertainty regions.
Paper aims to ensure reliable detection of out-of-distribution data with certifiable worst-case guarantees.
problem Deep neural networks are overconfident with OOD inputs, posing safety risks.
method Enforces low confidence and bounds in an l∞-ball around OOD points using interval bound propagation (IBP). result Certifiable worst-case guarantees for OOD detection are possible without significant loss in accuracy.
Proposes POPQORN to quantify robustness of RNNs, including LSTMs and GRUs.
problem Vulnerability to adversarial attacks in recurrent neural networks.
method Develops POPQORN, a general algorithm to quantify robustness of RNNs.
result Demonstrates effectiveness on different network architectures and shows insights from robustness quantification on individual steps.
New work shows limits of certifying neural network robustness.
problem Certified training improves robustness but decreases accuracy.
method Bayes error analysis to investigate robustness limits.
result Upper bound for certified robust accuracy established.
Proves the existence of accurate, certifiably robust neural networks.
problem Training neural networks to be robust against adversarial attacks.
method Proves the existence of networks that approximate continuous functions and ensure robustness through interval-bound propagation.
result Proves the existence of accurate, interval-certified ReLU networks.
This work improves certifiably robust models by distilling knowledge from adversarially robust teachers.
problem Certifiably robust models suffer from poor standard performance.
method Knowledge distillation from adversarially robust teachers to improve standard performance.
result Distillation from adversarially robust teachers consistently improves certified training performance.
Paper certifies k-means clustering optimality efficiently.
problem Detecting k-means optimality in suboptimal partitions. method Sub-linear Monte Carlo algorithm based on semidefinite relaxation.
result 3-approximation certificate with 99% confidence for mixtures of Gaussians.
New attack tricks certifiably robust models into mislabeling images.
problem Defeating certified defenses against adversarial examples.
method Spoofed robustness certificates and large perturbations.
result Certifiably robust models can be fooled by large perturbations.
New method speeds up k-means clustering using sketch-and-solve.
problem Efficiently solving k-means clustering for large datasets.
method Sketch-and-solve approach with Peng-Wei semidefinite relaxation.
result Provides high-confidence lower bounds on k-means optimal value.
New method certifies global robustness of neural networks efficiently.
problem Adversarial examples threaten certifiably robust neural networks.
method Formalized global robustness, adapted widely-used architectures with efficient global Lipschitz bounds.
result Certifiable robust models achieve state-of-the-art verifiable accuracy with negligible costs.
Paper proposes robust generative models using VAEs.
problem Lack of robustness in generative models.
method Formally defined robust lower bound, optimized during training.
result Generative models become more robust to adversarial attacks.
Conformal Candidate Certification advances offline MBO by certifying candidate designs with statistical guarantees.
problem Offline model-based optimization
method Conformal Candidate Certification (CCC)
result CCC certifies 16.7% of an aggressive proposal pool with 0.990 empirical coverage at nominal 0.90.
This work improves deep reinforcement learning robustness to adversarial state uncertainty.
problem Robustness of deep reinforcement learning to adversarial state uncertainty.
method Certified adversarial robustness techniques are applied to deep reinforcement learning algorithms to compute guaranteed lower bounds on state-action values.
result The approach increases robustness to noise and adversaries in pedestrian collision avoidance and classic control tasks.
New method certifies neural network robustness to random input noise.
problem Certifying neural networks' robustness to random input noise.
method Chance-constrained optimization problem reformulated using input-output samples.
result Certifies a uniform infinity-norm uncertainty region with a radius 50 times larger.
Geometric technique determines exactness of SDP robustness certificate.
problem Certifying robustness of neural networks to adversarial examples.
method Geometric projection onto hyperbola, SDP relaxation of ReLU activation.
result SDP certificate is exact for a single hidden layer under mild assumptions.
Enhances scenario approach for certifying design properties post-design.
problem Certifying additional useful properties in designs not considered during the design phase.
method Two-level framework of appropriateness: baseline and post-design. Distribution-free upper bounds on risk derived.
result Distribution-free upper bounds on the risk of failing to meet post-design appropriateness.
This study tightens bounds on how GD and SGD generalize in smooth convex optimization problems.
problem Understanding how GD and SGD generalize in smooth stochastic convex optimization problems.
method Provided tight excess risk lower bounds for GD and SGD under different conditions.
result Lower bounds suggest overfitting occurs and gaps remain in some cases.
CIVET method provides robustness guarantees for VAEs under adversarial attacks.
problem Certified probabilistic guarantees for VAEs in safety-critical applications.
method Bounding worst-case VAE error by error on support sets at the latent layer.
result CIVET outperforms state-of-the-art methods in robustness and standard performance.
New method for certified unlearning reduces noise injection.
problem Achieving formal unlearning guarantees with adaptive noise calibration.
method Adaptive per-instance noise calibration based on individual data point sensitivities.
result Derivation of high-probability per-instance sensitivity bounds for ridge regression.
Certifiable defense method improves robustness of deep learning interpretation.
problem Vulnerability of gradient-based saliency maps to adversarial attacks.
method Sparsified SmoothGrad method, extending certifiably robust smooth classifier bounds.
result Sparsified SmoothGrad method is certifiably robust against adversarial perturbations.
New findings show some designs can't be robustly recovered in linear regression.
problem Robust linear regression with adversarial corruption.
method Investigated well-spreadness of design matrices for robust recovery.
result Certified well-spreadness of random matrices efficiently, but hardness for small observations.
Certifiably robust VAEs are trained with bounds on input perturbations.
problem Ensuring VAEs are robust to adversarial attacks.
method Derive bounds on minimal perturbation size, control parameters, and train VAEs to meet criteria.
result Certifiably robust VAEs are more robust to attacks than standard VAEs.
Study growth patterns in random networks using i.i.d. perturbations.
problem Understanding the growth of affine regions in random piecewise-linear networks.
method Analyzes a random compositional model with i.i.d. perturbations of the tent map, proving submultiplicative pressure and using finite-state defect process for upper-tail lower bounds.
result Proves the existence of a submultiplicative pressure for \(N_n\) and gives exponential upper bounds for \(n^{-1}\log N_n\).
New approach to certifiably robust neural networks using Boolean function perspective.
problem Lack of principled understanding and certified robustness for ℓ∞ perturbations. method New perspective on Boolean functions, deriving impossibility results, and developing a unified Lipschitz network.
result Unified Lipschitz network that bypasses expressive power limitations and achieves better certified robustness.
We certify federated learning model performance under meta-distribution shifts.
problem Certifying model performance on unseen networks with heterogeneous distributions.
method Derive worst-case uniform guarantees for federated learning model's average loss and risk CDF.
result Asymptotically minimax optimal and privacy-preserving certification.
New method certifies images against transformations like rotations and translations.
problem Certifying robustness of images against transformations like rotations and translations.
method Randomized smoothing with three different kinds of defenses.
result Individual certificates can be obtained via statistical error bounds or efficient online inverse computation.
New method solves matrix completion problems to certifiable optimality.
problem Certifying optimality in low-rank matrix completion.
method Disjunctive branch-and-bound scheme for convex relaxation.
result Decreases optimality gap by two orders of magnitude.