Provable Defenses against Adversarial Examples via the Convex Outer Adversarial Polytope

J Zico Kolter, Eric Wong

arXiv · PDF · Open in the Atlas

Code that ran

We lifted 44 functions out of this paper's own repositories and ran 21 of them in a sandbox. "Ran" means the function executed on a synthesized input and returned a value. It is not a reproduction of the paper's results.

Repositories linked to this paper

• locuslab/convex_adversarial — marked official in Papers with Code; named in the paper
• Hadisalman/robust-verify-benchmark
• UnofficialJuliaMirrorSnapshots/MIPVerify.jl-e5e5f8be-2a6a-5994-adbb-5afbd0e30425
• ermongroup/generative_adversary
• fra31/mmr-universal
• huanzhang12/CROWN-Robustness-Certification
• rtoth11/NNAdversary-MIPVerify
• vtjeng/MIPVerify.jl

Some links come from the archived Papers with Code dataset (CC BY-SA 4.0): attribution and licence.

Abstract

We propose a method to learn deep ReLU-based classifiers that are provably robust against normbounded adversarial perturbations on the training data. For previously unseen examples, the approach is guaranteed to detect all adversarial examples, though it may flag some non-adversarial examples as well. The basic idea is to consider a convex outer approximation of the set of activations reachable through a norm-bounded perturbation, and we develop a robust optimization procedure that minimizes the worst case loss over this outer region (via a linear program). Crucially, we show that the dual problem to this linear program can be represented itself as a deep network similar to the backpropagation network, leading to very efficient optimization approaches that produce guaranteed bounds on the robust loss. The end result is that by executing a few more forward and backward passes through a slightly modified version of the original network (though possibly with much larger batch sizes), we can learn a classifier that is provably robust to any norm-bounded adversarial attack. We illustrate the approach on a number of tasks to train classifiers with robust adversarial guarantees (e.g. for MNIST, we produce a convolutional classifier that provably has less than 5.8% test error for any adversarial attack with bounded ∞ norm less than = 0.1), and code for all experiments is available at http://github.com/ locuslab/convex_adversarial.

For agents

The same record, over MCP at https://syntology.ai/mcp:

get_harvested_code_for_paper("1711.00851")
get_code_for_paper("1711.00851")
have("1711.00851")

Connect an agent — have() is free.