Certified Invertibility in Neural Networks via Mixed-Integer Programming
Not on the map. Why?
Abstract (arXiv)
Neural networks are known to be vulnerable to adversarial attacks, which are small, imperceptible perturbations that can significantly alter the network's output. Conversely, there may exist large, meaningful perturbations that do not affect the network's decision (excessive invariance). In our research, we investigate this latter phenomenon in two contexts: (a) discrete-time dynamical system identification, and (b) the calibration of a neural network's output to that of another network. We examine noninvertibility through the lens of mathematical optimization, where the global solution measures the ``safety" of the network predictions by their distance from the non-invertibility boundary. We formulate mixed-integer programs (MIPs) for ReLU networks and Lp norms (p=1,2,∞) that apply to neural network approximators of dynamical systems. We also discuss how our findings can be useful for invertibility certification in transformations between neural networks, e.g. between different levels of network pruning.
Key facts. Cited by 3 papers in the map (data through 14 Oct 2026). Builds on 32 of its 46 references that are in the map. First posted on arXiv 27 Jan 2023.
Builds on
32 of 46 references.
References · 32
- 2015Deep Residual Learning for Image Recognitioncited by 52,096
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
- 2013Intriguing properties of neural networkscited by 5,155
- 2018Neural Ordinary Differential Equationscited by 3,779
- 2016Density estimation using Real NVPcited by 2,042
- 2014NICE: Non-linear Independent Components Estimationcited by 1,058
- 2015Automatic differentiation in machine learning: a surveycited by 855
- 2017To prune, or not to prune: exploring the efficacy of pruning for model compressioncited by 603
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
- 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
- 2018Invertible Residual Networkscited by 365
- 2019Residual Flows for Invertible Generative Modelingcited by 257
20 more
- 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 255
- 2018Analyzing Inverse Problems with Invertible Neural Networkscited by 242
- 2019Large Scale Adversarial Representation Learningcited by 239
- 2017The Reversible Residual Network: Backpropagation Without Storing Activationscited by 217
- 2016FractalNet: Ultra-Deep Neural Networks without Residualscited by 216
- 2017Beyond Finite Layer Neural Networks: Bridging Deep Architectures and Numerical Differential Equationscited by 203
- 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 185
- 2017Searching for Activation Functionscited by 169
- 2018Efficient Formal Safety Analysis of Neural Networkscited by 165
- 2020BayesFlow: Learning complex stochastic models with invertible neural networkscited by 144
- 2020Coupling-based Invertible Neural Networks Are Universal Diffeomorphism Approximatorscited by 85
- 2020Understanding and Mitigating Exploding Inverses in Invertible Neural Networkscited by 71
- 2017Reversible Architectures for Arbitrarily Deep Residual Neural Networkscited by 70
- 2018Excessive Invariance Causes Adversarial Vulnerabilitycited by 66
- 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
- 2016PolyNet: A Pursuit of Structural Diversity in Very Deep Networkscited by 39
- 2019MintNet: Building Invertible Neural Networks with Masked Convolutionscited by 35
- 2018Reversible Recurrent Neural Networkscited by 23
- 2014Controlling Recurrent Neural Networks by Conceptorscited by 16
- 2018Analysis of Invariance and Robustness via Invertibility of ReLU-Networkscited by 5
Built on by
Citing papers per year: 2024: 1; 2025: 1; 2026: 1.
3 papers.