Boosting Verified Training for Robust Image Classifications via Abstraction
Not on the map. Why?
Abstract (arXiv)
This paper proposes a novel, abstraction-based, certified training method for robust image classifiers. Via abstraction, all perturbed images are mapped into intervals before feeding into neural networks for training. By training on intervals, all the perturbed images that are mapped to the same interval are classified as the same label, rendering the variance of training sets to be small and the loss landscape of the models to be smooth. Consequently, our approach significantly improves the robustness of trained models. For the abstraction, our training method also enables a sound and complete black-box verification approach, which is orthogonal and scalable to arbitrary types of neural networks regardless of their sizes and architectures. We evaluate our method on a wide range of benchmarks in different scales. The experimental results show that our method outperforms state of the art by (i) reducing the verified errors of trained models up to 95.64%; (ii) totally achieving up to 602.50x speedup; and (iii) scaling up to larger models with up to 138 million trainable parameters. The demo is available at https://github.com/zhangzhaodi233/ABSCERT.git.
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 41 of its 65 references that are in the map. First posted on arXiv 21 Mar 2023.
Builds on
41 of 65 references.
References · 41
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2014Going Deeper with Convolutionscited by 4,231
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2017Visualizing the Loss Landscape of Neural Netscited by 1,126
- 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
29 more
- 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
- 2017Countering Adversarial Images using Input Transformationscited by 517
- 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
- 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
- 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
- 2018Generating Adversarial Examples with Adversarial Networkscited by 256
- 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
- 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 224
- 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2018Formal Security Analysis of Neural Networks using Symbolic Intervalscited by 185
- 2018Robustness via curvature regularization, and vice versacited by 174
- 2018Efficient Formal Safety Analysis of Neural Networkscited by 165
- 2018Scaling provable adversarial defensescited by 141
- 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 124
- 2018Structured Adversarial Attack: Towards General Implementation and Better Interpretabilitycited by 63
- 2019The Limitations of Adversarial Training and the Blind-Spot Attackcited by 63
- 2016SqueezeDet: Unified, Small, Low Power Fully Convolutional Neural Networks for Real-Time Object Detection for Autonomous Drivingcited by 55
- 2018CNN-Cert: An Efficient Framework for Certifying Robustness of Convolutional Neural Networkscited by 50
- 2020The Convex Relaxation Barrier, Revisited: Tightened Single-Neuron Relaxations for Neural Network Verificationcited by 50
- 2018Characterizing Adversarial Examples Based on Spatial Consistency Information for Semantic Segmentationcited by 40
- 2020Abstraction based Output Range Analysis for Neural Networkscited by 34
- 2019Interpreting and Evaluating Neural Network Robustnesscited by 19
- 2021Towards Evaluating and Training Verifiably Robust Neural Networkscited by 15
- 2020Interval Neural Networks: Uncertainty Scorescited by 14
- 2020Adversarial Training and Provable Robustness: A Tale of Two Objectivescited by 12
- 2022Provably Tightest Linear Approximation for Robustness Verification of Sigmoid-like Neural Networkscited by 8
Built on by
Citing papers per year: 2023: 1.
1 paper.