# A Formalization of Robustness for Deep Neural Networks

arXiv: https://arxiv.org/abs/1903.10033 · HTML: https://mlsanity.com/paper/1903.10033/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 Mar 2019.

## Built on by (most cited first, 8 of 8)

- [Taxonomy of Machine Learning Safety: A Survey and Primer](https://mlsanity.com/paper/2106.04823/) (2021)
- [Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifiers](https://mlsanity.com/paper/2406.18451/) (2024)
- [Sample Complexity Bounds for Robustly Learning Decision Lists against Evasion Attacks](https://mlsanity.com/paper/2205.06127/) (2022)
- [Computational Asymmetries in Robust Classification](https://mlsanity.com/paper/2306.14326/) (2023)
- [When are Local Queries Useful for Robust Learning?](https://mlsanity.com/paper/2210.06089/) (2022)
- [Testing Autonomous Systems with Believed Equivalence Refinement](https://mlsanity.com/paper/2103.04578/) (2021)
- [Safe AI -- How is this Possible?](https://mlsanity.com/paper/2201.10436/) (2022)
- [Robustness Verifcation in Neural Networks](https://mlsanity.com/paper/2403.13441/) (2024)

## Abstract (arXiv)

Deep neural networks have been shown to lack robustness to small input perturbations. The process of generating the perturbations that expose the lack of robustness of neural networks is known as adversarial input generation. This process depends on the goals and capabilities of the adversary, In this paper, we propose a unifying formalization of the adversarial input generation process from a formal methods perspective. We provide a definition of robustness that is general enough to capture different formulations. The expressiveness of our formalization is shown by modeling and comparing a variety of adversarial attack techniques.