CNN-Cert: An Efficient Framework for Certifying Robustness of Convolutional Neural Networks

by   Akhilan Boopathy, et al.

Verifying robustness of neural network classifiers has attracted great interests and attention due to the success of deep neural networks and their unexpected vulnerability to adversarial perturbations. Although finding minimum adversarial distortion of neural networks (with ReLU activations) has been shown to be an NP-complete problem, obtaining a non-trivial lower bound of minimum distortion as a provable robustness guarantee is possible. However, most previous works only focused on simple fully-connected layers (multilayer perceptrons) and were limited to ReLU activations. This motivates us to propose a general and efficient framework, CNN-Cert, that is capable of certifying robustness on general convolutional neural networks. Our framework is general -- we can handle various architectures including convolutional layers, max-pooling layers, batch normalization layer, residual blocks, as well as general activation functions; our approach is efficient -- by exploiting the special structure of convolutional layers, we achieve up to 17 and 11 times of speed-up compared to the state-of-the-art certification algorithms (e.g. Fast-Lin, CROWN) and 366 times of speed-up compared to the dual-LP approach while our algorithm obtains similar or even better verification bounds. In addition, CNN-Cert generalizes state-of-the-art algorithms e.g. Fast-Lin and CROWN. We demonstrate by extensive experiments that our method outperforms state-of-the-art lower-bound-based certification algorithms in terms of both bound quality and speed.


page 1

page 2

page 3

page 4


Efficient Neural Network Robustness Certification with General Activation Functions

Finding minimum distortion of adversarial examples and thus certifying r...

Towards Fast Computation of Certified Robustness for ReLU Networks

Verifying the robustness property of a general Rectified Linear Unit (Re...

Understanding Adversarial Robustness from Feature Maps of Convolutional Layers

The adversarial robustness of a neural network mainly relies on two fact...

Restructuring Batch Normalization to Accelerate CNN Training

Because CNN models are compute-intensive, where billions of operations c...

Lipschitz Bound Analysis of Neural Networks

Lipschitz Bound Estimation is an effective method of regularizing deep n...

Arguments for the Unsuitability of Convolutional Neural Networks for Non–Local Tasks

Convolutional neural networks have established themselves over the past ...

Yedrouj-Net: An efficient CNN for spatial steganalysis

For about 10 years, detecting the presence of a secret message hidden in...

Please sign up or login with your details

Forgot password? Click here to reset