mlsanityData to 7 Oct 2026

RNN-Guard: Certified Robustness Against Multi-frame Attacks for Recurrent Neural Networks

arXiv 2304.07980 ↗First posted 17 Apr 2023cs.LG cs.CRcited by 1

Not on the map. Why?

Abstract (arXiv)

It is well-known that recurrent neural networks (RNNs), although widely used, are vulnerable to adversarial attacks including one-frame attacks and multi-frame attacks. Though a few certified defenses exist to provide guaranteed robustness against one-frame attacks, we prove that defending against multi-frame attacks remains a challenging problem due to their enormous perturbation space. In this paper, we propose the first certified defense against multi-frame attacks for RNNs called RNN-Guard. To address the above challenge, we adopt the perturb-all-frame strategy to construct perturbation spaces consistent with those in multi-frame attacks. However, the perturb-all-frame strategy causes a precision issue in linear relaxations. To address this issue, we introduce a novel abstract domain called InterZono and design tighter relaxations. We prove that InterZono is more precise than Zonotope yet carries the same time complexity. Experimental evaluations across various datasets and model structures show that the certified robust accuracy calculated by RNN-Guard with InterZono is up to 2.18 times higher than that with Zonotope. In addition, we extend RNN-Guard as the first certified training method against multi-frame attacks to directly enhance RNNs' robustness. The results show that the certified robust accuracy of models trained with RNN-Guard against multi-frame attacks is 15.47 to 67.65 percentage points higher than those with other training methods.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 40 of its 59 references that are in the map. First posted on arXiv 17 Apr 2023.

Builds on

40 of 59 references.

References · 40

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2020Language Models are Few-Shot Learnerscited by 32,199
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  7. 2015Character-level Convolutional Networks for Text Classificationcited by 2,293
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2014On the Properties of Neural Machine Translation: Encoder-Decoder Approachescited by 1,303
  10. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  11. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  12. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
28 more
  1. 2013Speech Recognition with Deep Recurrent Neural Networkscited by 666
  2. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  3. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  4. 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
  5. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  6. 2018Generating Natural Language Adversarial Examplescited by 422
  7. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
  8. 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
  9. 2018Certified Defenses against Adversarial Examplescited by 305
  10. 2016Learning from Simulated and Unsupervised Images through Adversarial Trainingcited by 287
  11. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  12. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 241
  13. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  14. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
  15. 2018Scaling provable adversarial defensescited by 141
  16. 2017An approach to reachability analysis for feed-forward ReLU neural networkscited by 126
  17. 2018A Dual Approach to Scalable Verification of Deep Networkscited by 125
  18. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 124
  19. 2016Crafting Adversarial Input Sequences for Recurrent Neural Networkscited by 102
  20. 2017Maximum Resilience of Artificial Neural Networkscited by 97
  21. 2021Bad Characters: Imperceptible NLP Attackscited by 69
  22. 2018Interpretable Adversarial Perturbation in Input Embedding Space for Textcited by 67
  23. 2017Simple Recurrent Units for Highly Parallelizable Recurrencecited by 60
  24. 2018CNN-Cert: An Efficient Framework for Certifying Robustness of Convolutional Neural Networkscited by 50
  25. 2020The Convex Relaxation Barrier, Revisited: Tightened Single-Neuron Relaxations for Neural Network Verificationcited by 50
  26. 2019POPQORN: Quantifying Robustness of Recurrent Neural Networkscited by 36
  27. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 28
  28. 2021Automated Discovery of Adaptive Attacks on Adversarial Defensescited by 22

Built on by

Cited by year

Citing papers per year: 2024: 1.

1 paper.

  1. 2024Neural Network Verification with Branch-and-Bound for General Nonlinearitiescited by 47