arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 2102.08452cs.LGcs.CRstat.ML
收藏

全局鲁棒神经网络

Globally-Robust Neural Networks

Carnegie Mellon University(卡内基梅隆大学)

Klas Leino, Zifan Wang, Matt Fredrikson

摘要:

对抗性示例的威胁促使人们致力于训练可证明鲁棒性的神经网络,以便于在推理时有效地验证局部鲁棒性。我们正式的概念,全球的鲁棒性,它捕获的操作属性的在线本地鲁棒性认证,同时产生一个自然的学习目标,强大的训练。我们表明,广泛使用的架构可以很容易地适应这一目标,将有效的全球Lipschitz边界到网络中,通过建设,实现最先进的可验证的准确性,产生可证明的鲁棒模型。值得注意的是,这种方法需要显着更少的时间和内存比最近的可认证的培训方法,并导致在线认证点时,可以忽略不计的成本,例如,我们的评估表明,它是可能的训练一个大的强大的Tiny-Imagenet模型在几个小时内。我们的模型有效地利用廉价的全局Lipschitz边界进行实时认证,尽管之前的建议是需要更严格的局部边界才能获得良好的性能;我们认为这是可能的,因为我们的模型经过专门训练,可以实现更严格的全局边界。也就是说,我们证明了最大可实现的可验证的精度为一个给定的数据集是不提高使用本地绑定。

英文摘要:

The threat of adversarial examples has motivated work on training certifiably robust neural networks to facilitate efficient verification of local robustness at inference time. We formalize a notion of global robustness, which captures the operational properties of on-line local robustness certification while yielding a natural learning objective for robust training. We show that widely-used architectures can be easily adapted to this objective by incorporating efficient global Lipschitz bounds into the network, yielding certifiably-robust models by construction that achieve state-of-the-art verifiable accuracy. Notably, this approach requires significantly less time and memory than recent certifiable training methods, and leads to negligible costs when certifying points on-line; for example, our evaluation shows that it is possible to train a large robust Tiny-Imagenet model in a matter of hours. Our models effectively leverage inexpensive global Lipschitz bounds for real-time certification, despite prior suggestions that tighter local bounds are needed for good performance; we posit this is possible because our models are specifically trained to achieve tighter global bounds. Namely, we prove that the maximum achievable verifiable accuracy for a given dataset is not improved by using a local bound.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑