arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2006.06759math.OCcs.LGstat.ML
收藏

关于半定松弛证明对抗性样本鲁棒性的紧性

On the Tightness of Semidefinite Relaxations for Certifying Robustness to Adversarial Examples

University of Illinois at Urbana-Champaign(伊利诺伊大学厄巴纳-香槟分校)

Richard Y. Zhang

摘要:

神经网络对对抗性样本的鲁棒性可以通过求解凸松弛来证明。然而,如果松弛是松散的,那么产生的证书可能太保守而不能实际使用。最近,基于ReLU激活函数的半定规划(SDP)松弛,提出了一种不太保守的鲁棒性证书。在本文中,我们描述了一种几何技术,该技术确定该SDP证书是否准确,这意味着它是否提供了最小对抗扰动大小的下限,以及达到下限的全局最优扰动。具体地说,我们表明,通常的对抗性攻击问题的最小二乘限制,SDP松弛相当于一个点到一个双曲线的非凸投影。当且仅当点的投影位于双曲线的长轴上时,得到的SDP证书是精确的。使用这种几何技术,我们证明了证书是精确的一个单一的隐藏层在温和的假设下,并解释为什么它通常是保守的几个隐藏层。我们实验证实我们的理论见解,使用通用的邻域点方法和自定义秩2 Burer-Monteiro算法。

英文摘要:

The robustness of a neural network to adversarial examples can be provably certified by solving a convex relaxation. If the relaxation is loose, however, then the resulting certificate can be too conservative to be practically useful. Recently, a less conservative robustness certificate was proposed, based on a semidefinite programming (SDP) relaxation of the ReLU activation function. In this paper, we describe a geometric technique that determines whether this SDP certificate is exact, meaning whether it provides both a lower-bound on the size of the smallest adversarial perturbation, as well as a globally optimal perturbation that attains the lower-bound. Concretely, we show, for a least-squares restriction of the usual adversarial attack problem, that the SDP relaxation amounts to the nonconvex projection of a point onto a hyperbola. The resulting SDP certificate is exact if and only if the projection of the point lies on the major axis of the hyperbola. Using this geometric technique, we prove that the certificate is exact over a single hidden layer under mild assumptions, and explain why it is usually conservative for several hidden layers. We experimentally confirm our theoretical insights using a general-purpose interior-point method and a custom rank-2 Burer-Monteiro algorithm.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑