Towards Fast computation of certified robustness for ReLU networks
Name
1804.09699.pdf
Description
Accepted version
Size
1010.65 KB
Format
Adobe PDF
Checksum (MD5)
f1c8d0866d45c115f459cf1eb866cff4
Author(s)
Weng, Tsui-Wei
Zhang, Huan
Chen, Hongge
Song, Zhao
Hsieh, Cho-Jui
Boning, Duane
Dhillon, Inderjit S.
Daniel, Luca
Date Issued
2018
Citation
Weng, Tsui-Wei, Zhang, Huan, Chen, Hongge, Song, Zhao, Hsieh, Cho-Jui et al. 2018. "Towards Fast computation of certified robustness for ReLU networks."
Version
Author's final manuscript
Abstract
© 35th International Conference on Machine Learning, ICML 2018.All Rights Reserved. Verifying the robustness property of a general Rectified Linear Unit (ReLU) network is an NP-complete problem. Although finding the exact minimum adversarial distortion is hard, giving a certified lower bound of the minimum distortion is possible. Current available methods of computing such a bound are either time-consuming or deliver low quality bounds that are too loose to be useful. In this paper, we exploit the special structure of ReLU networks and provide two computationally efficient algorithms (Fast-Lin,Fast-Lip) that are able to certify non-trivial lower bounds of minimum adversarial distortions. Experiments show that (1) our methods deliver bounds close to (the gap is 2-3X) exact minimum distortions found by Reluplex in small networks while our algorithms are more than 10,000 times faster; (2) our methods deliver similar quality of bounds (the gap is within 35% and usually around 10%; sometimes our bounds are even better) for larger networks compared to the methods based on solving linear programming problems but our algorithms are 33-14,000 times faster; (3) our method is capable of solving large MNIST and CIFAR networks up to 7 layers with more than 10,000 neurons within tens of seconds on a single CPU core. In addition, we show that there is no polynomial time algorithm that can approximately find the minimum ℓ 1 adversarial distortion of a ReLU network with a 0.99 In n approximation ratio unless N P=P, where n is the number of neurons in the network.
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike
Persistent DSpace Link
DOI of Published Version
http://proceedings.mlr.press/v80/
