Certified Defense to Image Transformations via Randomized Smoothing (2020-02-27T00:00:00.000000Z)

TL;DR

This work extends randomized smoothing to cover parameterized transformations and certify robustness in the parameter space and shows how to efficiently compute the inverse of an image transformation, enabling individual guarantees in the online setting.

Abstract

We extend randomized smoothing to cover parameterized transformations (e.g., rotations, translations) and certify robustness in the parameter space (e.g., rotation angle). This is particularly challenging as interpolation and rounding effects mean that image transformations do not compose, in turn preventing direct certification of the perturbed image (unlike certification with $\ell^p$ norms). We address this challenge by introducing three different defenses, each with a different guarantee (heuristic, distributional and individual) stemming from the method used to bound the interpolation error. Importantly, in the individual case, we show how to efficiently compute the inverse of an image transformation, enabling us to provide individual guarantees in the online setting. We provide an implementation of all methods at https://github.com/eth-sri/transformation-smoothing.

Authors

Martin T. Vechev

4 papers

Marc Fischer

1 papers

Maximilian Baader

1 papers

TL;DR

Abstract

Authors

References40 items

Provable Robust Learning Based on Transformation-Specific Smoothing

MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radius

Towards Verifying Robustness of Neural Networks Against Semantic Perturbations

Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers

A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks

Certified Adversarial Robustness via Randomized Smoothing

An abstract domain for certifying neural networks

Semidefinite relaxations for certifying robustness to adversarial examples

Efficient Formal Safety Analysis of Neural Networks

Second-Order Adversarial Attack and Certifiable Robustness

Differentiable Abstract Interpretation for Provably Robust Neural Networks

Robustness May Be at Odds with Accuracy

AI2: Safety and Robustness Certification of Neural Networks with Abstract Interpretation

Towards Fast Computation of Certified Robustness for ReLU Networks

Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition

Certified Robustness to Adversarial Examples with Differential Privacy

A Rotation and a Translation Suffice: Fooling CNNs with Simple Transformations

Towards Practical Verification of Machine Learning: The Case of Computer Vision Systems

Towards Robust Neural Networks via Random Self-ensemble

Geometric Robustness of Deep Networks: Analysis and Improvement

Provable defenses against adversarial examples via the convex outer adversarial polytope

A Unified View of Piecewise Linear Neural Network Verification

Automatic differentiation in PyTorch

Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification

Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms

Formal Verification of Piece-Wise Linear Feed-Forward Neural Networks

Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks

Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shift

ImageNet Large Scale Visual Recognition Challenge

Intriguing properties of neural networks

Evasion Attacks against Machine Learning at Test Time

Man vs. computer: Benchmarking machine learning algorithms for traffic sign recognition

Theories of Interval Arithmetic: Mathematical Foundations and Applications

Robustness

Certifying Geometric Robustness of Neural Networks

Comparison of Parametric Representation for Monosyllabic Word Recognition in Continuously Spoken Sentences

Dropout: a simple way to prevent neural networks from overfitting

Learning Multiple Layers of Features from Tiny Images

Handwritten Digit Recognition with a Back-Propagation Network

We trained a ResNet-18 with data normalization. We trained for 90 epochs with SGD with an initial learning rate of 0 . 1 , lowering it by a factor of 10 every 30 epochs

Field of Study

Journal Information

Name

Venue Information

Name

Type

URL

Alternate Names