Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper addresses the challenge of adversarial examples in neural networks by introducing the apothem measure for computing robustness certifications, which determine the maximum allowable distortion of inputs without misclassification. Unlike traditional methods that focus on maximizing certification volume, the proposed approach allows for apothem-optimal certifications to be computed efficiently with a linear number of calls to a neural network verifier. The authors demonstrate that their method, implemented in the ParallelepipedoNN system, achieves at least a two-fold improvement in minimum edge length on standard benchmarks compared to existing techniques.
Apothem-optimal robustness certifications can be computed efficiently, yielding significant improvements over traditional volume-maximizing approaches.
A primary challenge in AI safety is the existence of adversarial examples -- slightly distorted inputs that cause a neural network (NN) to misclassify. To mitigate this problem, recent research focuses on the computation of robustness certifications, which, for a given input, determine the largest distortion the input may receive without breaking the network's prediction. Robustness certifications can be interpreted as an axis-aligned hyper-rectangle (multi-dimensional intervals). Most existing approaches focus on maximizing the certification's volume, but recent intractability results prohibit the computation of volume-optimal certifications in reasonable time. We introduce the apothem measure and show how to compute apothem-optimal certifications in a linear number of calls to a NN verifier (oracle) w.r.t. the input domain's diameter. Moreover, we prove that we cannot have a volume-optimal, oracle-based algorithm, even if we discard the oracle costs. Also, we introduce dual certifications -- an interval including all instances of a class -- thus providing apothem-minimum upper bounds to a robustness certification. Further, we present the ParallelepipedoNN system, which we evaluate on the standard MNIST and Fashion MNIST benchmarks. A preliminary comparison with existing work on the same datasets reveals at least two-fold improvement w.r.t. the minimum edge length.