# On Certifying Non-uniform Bound against Adversarial Attacks

arXiv: https://arxiv.org/abs/1903.06603 · HTML: https://mlsanity.com/paper/1903.06603/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 15 Mar 2019.

## Built on by (most cited first, 6 of 6)

- [Adversarial Robustness with Non-uniform Perturbations](https://mlsanity.com/paper/2102.12002/) (2021)
- [Projected Randomized Smoothing for Certified Adversarial Robustness](https://mlsanity.com/paper/2309.13794/) (2023)
- [On the Minimal Adversarial Perturbation for Deep Neural Networks with Provable Estimation Error](https://mlsanity.com/paper/2201.01235/) (2022)
- [The Fundamental Limits of Interval Arithmetic for Neural Networks](https://mlsanity.com/paper/2112.05235/) (2021)
- [A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certification](https://mlsanity.com/paper/2106.03099/) (2021)
- [Localized Uncertainty Attacks](https://mlsanity.com/paper/2106.09222/) (2021)

## Abstract (arXiv)

This work studies the robustness certification problem of neural network models, which aims to find certified adversary-free regions as large as possible around data points. In contrast to the existing approaches that seek regions bounded uniformly along all input features, we consider non-uniform bounds and use it to study the decision boundary of neural network models. We formulate our target as an optimization problem with nonlinear constraints. Then, a framework applicable for general feedforward neural networks is proposed to bound the output logits so that the relaxed problem can be solved by the augmented Lagrangian method. Our experiments show the non-uniform bounds have larger volumes than uniform ones and the geometric similarity of the non-uniform bounds gives a quantitative, data-agnostic metric of input features' robustness. Further, compared with normal models, the robust models have even larger non-uniform bounds and better interpretability.