Towards certifying ℓ∞ robustness using neural networks with ℓ∞-dist neurons

Bohang Zhang, Tianle Cai, Zhou Lu, Di He, Liwei Wang

2021-01-01

Abstract:

What problem does this paper attempt to address?

Towards Certifying L Robustness Using Neural Networks with L-Dist Neurons

Bohang Zhang,Tianle Cai,Zhou Lu,Di He,Liwei Wang

2021-01-01

Abstract:It is well-known that standard neural networks, even with a high classification accuracy, are vulnerable to small l(infinity)-norm bounded adversarial perturbations. Although many attempts have been made, most previous works either can only provide empirical verification of the defense to a particular attack method, or can only develop a certified guarantee of the model robustness in limited scenarios. In this paper, we seek for a new approach to develop a theoretically principled neural network that inherently resists l(infinity) perturbations. In particular, we design a novel neuron that uses .e ms -distance as its basic operation (which we call l(infinity)-dist neuron), and show that any neural network constructed with l(infinity)-dist neurons (called l(infinity)-dist net) is naturally a 1-Lipschitz function with respect to l(infinity)-norm. This directly provides a rigorous guarantee of the certified robustness based on the margin of prediction outputs. We then prove that such networks have enough expressive power to approximate any 1-Lipschitz function with robust generalization guarantee. We further provide a holistic training strategy that can greatly alleviate optimization difficulties. Experimental results show that using l(infinity)-dist nets as basic building blocks, we consistently achieve state-of-the-art performance on commonly used datasets: 93.09% certified accuracy on MNIST (epsilon = 0.3), 35.42% on CIFAR-10 (epsilon = 8/255) and 16.31% on TinylmageNet (epsilon = 1/255).
Towards Certifying $\ell_\infty$ Robustness Using Neural Networks with $\Ell_\infty$-Dist Neurons

Bohang Zhang,Zhou Lu,Tianle Cai,Di He,Liwei Wang

2020-01-01

Abstract:It is well-known that standard neural networks, even with a high classification accuracy, are vulnerable to small $\ell_\infty$-norm bounded adversarial perturbations. Although many attempts have been made, most previous works either can only provide empirical verification of the defense to a particular attack method, or can only develop a certified guarantee of the model robustness in limited scenarios. In this paper, we seek for a new approach to develop a theoretically principled neural network that inherently resists $\ell_\infty$ perturbations. In particular, we design a novel neuron that uses $\ell_\infty$-distance as its basic operation (which we call $\ell_\infty$-dist neuron), and show that any neural network constructed with $\ell_\infty$-dist neurons (called $\ell_{\infty}$-dist net) is naturally a 1-Lipschitz function with respect to $\ell_\infty$-norm. This directly provides a rigorous guarantee of the certified robustness based on the margin of prediction outputs. We also prove that such networks have enough expressive power to approximate any 1-Lipschitz function with robust generalization guarantee. Our experimental results show that the proposed network is promising. Using $\ell_{\infty}$-dist nets as the basic building blocks, we consistently achieve state-of-the-art performance on commonly used datasets: 93.09% certified accuracy on MNIST ($\epsilon=0.3$), 79.23% on Fashion MNIST ($\epsilon=0.1$) and 35.10% on CIFAR-10 ($\epsilon=8/255$).
BOOSTING THE CERTIFIED ROBUSTNESS OF L-INFINITY DISTANCE NETS

Bohang Zhang1 Du Jiang Di He, Liwei Wang

2021-10-01

Abstract:Recently, Zhang et al.(2021) developed a new neural network architecture based on l∞-distance functions, which naturally possesses certified l∞ robustness by its construction. Despite rigorous theoretical guarantees, the model so far can only achieve comparable performance to conventional networks. In this paper, we make the following two contributions:(i) We demonstrate that l∞-distance nets enjoy a fundamental advantage in certified robustness over conventional networks (under typical certification approaches);(ii) With an improved training process we are able to significantly boost the certified accuracy of l∞-distance nets. Our training approach largely alleviates the optimization problem that arose in the previous training scheme, in particular, the unexpected large Lipschitz constant due to the use of a crucial trick called lp-relaxation. The core of our training approach is a novel objective function that combines scaled cross-entropy loss and clipped hinge loss with a decaying mixing coefficient. Experiments show that using the proposed training strategy, the certified accuracy of l∞-distance net can be dramatically improved from 33.30% to 40.06% on CIFAR-10 (ϵ= 8/255), meanwhile outperforming other approaches in this area by a large margin. Our results clearly demonstrate the effectiveness and potential of l∞-distance net for certified robustness. Codes are available at https://github. com/zbh2047/L inf-dist-net-v2.
Robust stability for delayed neural networks with nonlinear perturbation

Li Xie,Tianming Liu,Jilin Liu,Weikang Gu,Stephen Wong

DOI: https://doi.org/10.1007/11427391_31

2005-01-01

Abstract:The problem of analysis of robust stability for time-delayed neural networks with nonlinear perturbation has been investigated via Lyapunov stability theory. The sufficient conditions for robust stability of neural networks with time delays have been developed. The exponential stability criterion for neural networks is also derived. The result includes the information on the state convergence degree of the neural networks. The robust stable criterion in this paper is presented in terms of linear matrix inequalities.
Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspective

Bohang Zhang,Du Jiang,Di He,Liwei Wang

DOI: https://doi.org/10.48550/arXiv.2210.01787

2022-10-26

Abstract:Designing neural networks with bounded Lipschitz constant is a promising way to obtain certifiably robust classifiers against adversarial examples. However, the relevant progress for the important $\ell_\infty$ perturbation setting is rather limited, and a principled understanding of how to design expressive $\ell_\infty$ Lipschitz networks is still lacking. In this paper, we bridge the gap by studying certified $\ell_\infty$ robustness from a novel perspective of representing Boolean functions. We derive two fundamental impossibility results that hold for any standard Lipschitz network: one for robust classification on finite datasets, and the other for Lipschitz function approximation. These results identify that networks built upon norm-bounded affine layers and Lipschitz activations intrinsically lose expressive power even in the two-dimensional case, and shed light on how recently proposed Lipschitz networks (e.g., GroupSort and $\ell_\infty$-distance nets) bypass these impossibilities by leveraging order statistic functions. Finally, based on these insights, we develop a unified Lipschitz network that generalizes prior works, and design a practical version that can be efficiently trained (making certified robust training free). Extensive experiments show that our approach is scalable, efficient, and consistently yields better certified robustness across multiple datasets and perturbation radii than prior Lipschitz networks. Our code is available at <a class="link-external link-https" href="https://github.com/zbh2047/SortNet" rel="external noopener nofollow">this https URL</a>.

Machine Learning,Artificial Intelligence
Certifying Robustness of Convolutional Neural Networks with Tight Linear Approximation

Yuan Xiao,Tongtong Bai,Mingzheng Gu,Chunrong Fang,Zhenyu Chen

2022-01-01

Abstract: The robustness of neural network classifiers is becoming important in the safety-critical domain and can be quantified by robustness verification. However, at present, efficient and scalable verification techniques are always sound but incomplete. Therefore, the improvement of certified robustness bounds is the key criterion to evaluate the superiority of robustness verification approaches. In this paper, we present a Tight Linear approximation approach for robustness verification of Convolutional Neural Networks(Ti-Lin). For general CNNs, we first provide a new linear constraints for S-shaped activation functions, which is better than both existing Neuron-wise Tightest and Network-wise Tightest tools. We then propose Neuron-wise Tightest linear bounds for Maxpool function. We implement Ti-Lin, the resulting verification method. We evaluate it with 48 different CNNs trained on MNIST, CIFAR-10, and Tiny ImageNet datasets. Experimental results show that Ti-Lin significantly outperforms other five state-of-the-art methods(CNN-Cert, DeepPoly, DeepCert, VeriNet, Newise). Concretely, Ti-Lin certifies much more precise robustness bounds on pure CNNs with Sigmoid/Tanh/Arctan functions and CNNs with Maxpooling function with at most 63.70% and 253.54% improvement, respectively.
Tight Certified Robustness via Min-Max Representations of ReLU Neural Networks

Brendon G. Anderson,Samuel Pfrommer,Somayeh Sojoudi

2023-10-08

Abstract:The reliable deployment of neural networks in control systems requires rigorous robustness guarantees. In this paper, we obtain tight robustness certificates over convex attack sets for min-max representations of ReLU neural networks by developing a convex reformulation of the nonconvex certification problem. This is done by "lifting" the problem to an infinite-dimensional optimization over probability measures, leveraging recent results in distributionally robust optimization to solve for an optimal discrete distribution, and proving that solutions of the original nonconvex problem are generated by the discrete distribution under mild boundedness, nonredundancy, and Slater conditions. As a consequence, optimal (worst-case) attacks against the model may be solved for exactly. This contrasts prior state-of-the-art that either requires expensive branch-and-bound schemes or loose relaxation techniques. Experiments on robust control and MNIST image classification examples highlight the benefits of our approach.

Optimization and Control,Machine Learning
Globally-Robust Neural Networks

Klas Leino,Zifan Wang,Matt Fredrikson

DOI: https://doi.org/10.48550/arXiv.2102.08452

2021-06-12

Abstract:The threat of adversarial examples has motivated work on training certifiably robust neural networks to facilitate efficient verification of local robustness at inference time. We formalize a notion of global robustness, which captures the operational properties of on-line local robustness certification while yielding a natural learning objective for robust training. We show that widely-used architectures can be easily adapted to this objective by incorporating efficient global Lipschitz bounds into the network, yielding certifiably-robust models by construction that achieve state-of-the-art verifiable accuracy. Notably, this approach requires significantly less time and memory than recent certifiable training methods, and leads to negligible costs when certifying points on-line; for example, our evaluation shows that it is possible to train a large robust Tiny-Imagenet model in a matter of hours. Our models effectively leverage inexpensive global Lipschitz bounds for real-time certification, despite prior suggestions that tighter local bounds are needed for good performance; we posit this is possible because our models are specifically trained to achieve tighter global bounds. Namely, we prove that the maximum achievable verifiable accuracy for a given dataset is not improved by using a local bound.

Machine Learning,Cryptography and Security
Provably Tightest Linear Approximation for Robustness Verification of Sigmoid-like Neural Networks.

Zhaodi Zhang,Yiting Wu,Si Liu,Jing Liu,Min Zhang

DOI: https://doi.org/10.1145/3551349.3556907

2022-01-01

Abstract:The robustness of deep neural networks is crucial to modern AI-enabled systems and should be formally verified. Sigmoid-like neural networks have been adopted in a wide range of applications. Due to their non-linearity, Sigmoid-like activation functions are usually over-approximated for efficient verification, which inevitably introduces imprecision. Considerable efforts have been devoted to finding the so-called tighter approximations to obtain more precise verification results. However, existing tightness definitions are heuristic and lack theoretical foundations. We conduct a thorough empirical analysis of existing neuron-wise characterizations of tightness and reveal that they are superior only on specific neural networks. We then introduce the notion of network-wise tightness as a unified tightness definition and show that computing network-wise tightness is a complex non-convex optimization problem. We bypass the complexity from different perspectives via two efficient, provably tightest approximations. The results demonstrate the promising performance achievement of our approaches over state of the art: (i) achieving up to 251.28% improvement to certified lower robustness bounds; and (ii) exhibiting notably more precise verification results on convolutional networks.
Towards Robust Neural Networks via Close-loop Control

Zhuotong Chen,Qianxiao Li,Zheng Zhang

DOI: https://doi.org/10.48550/arXiv.2102.01862

2021-04-28

Abstract:Despite their success in massive engineering applications, deep neural networks are vulnerable to various perturbations due to their black-box nature. Recent study has shown that a deep neural network can misclassify the data even if the input data is perturbed by an imperceptible amount. In this paper, we address the robustness issue of neural networks by a novel close-loop control method from the perspective of dynamic systems. Instead of modifying the parameters in a fixed neural network architecture, a close-loop control process is added to generate control signals adaptively for the perturbed or corrupted data. We connect the robustness of neural networks with optimal control using the geometrical information of underlying data to design the control objective. The detailed analysis shows how the embedding manifolds of state trajectory affect error estimation of the proposed method. Our approach can simultaneously maintain the performance on clean data and improve the robustness against many types of data perturbations. It can also further improve the performance of robustly trained neural networks against different perturbations. To the best of our knowledge, this is the first work that improves the robustness of neural networks with close-loop control.

Machine Learning,Artificial Intelligence
Certifying Global Robustness for Deep Neural Networks

You Li,Guannan Zhao,Shuyu Kong,Yunqi He,Hai Zhou

2024-05-31

Abstract:A globally robust deep neural network resists perturbations on all meaningful inputs. Current robustness certification methods emphasize local robustness, struggling to scale and generalize. This paper presents a systematic and efficient method to evaluate and verify global robustness for deep neural networks, leveraging the PAC verification framework for solid guarantees on verification results. We utilize probabilistic programs to characterize meaningful input regions, setting a realistic standard for global robustness. Additionally, we introduce the cumulative robustness curve as a criterion in evaluating global robustness. We design a statistical method that combines multi-level splitting and regression analysis for the estimation, significantly reducing the execution time. Experimental results demonstrate the efficiency and effectiveness of our verification method and its capability to find rare and diversified counterexamples for adversarial training.

Machine Learning,Artificial Intelligence
Towards Certifying the Asymmetric Robustness for Neural Networks: Quantification and Applications

Changjiang Li,Shouling Ji,Haiqin Weng,Bo Li,Jie Shi,Raheem Beyah,Shanqing Guo,Zonghui Wang,Ting Wang

DOI: https://doi.org/10.1109/tdsc.2021.3116105

2021-01-01

IEEE Transactions on Dependable and Secure Computing

Abstract:One intriguing property of deep neural networks (DNNs) is their vulnerability to adversarial examples – those maliciously crafted inputs that deceive target DNNs. While a plethora of defenses have been proposed to mitigate the threats of adversarial examples, they are often penetrated or circumvented by even stronger attacks. To end the constant arms race between attackers and defenders, significant efforts have been devoted to providing certifiable robustness bounds for DNNs, which ensures that for a given input its vicinity does not admit any adversarial instances. Yet, most prior works focus on the case of symmetric vicinities (e.g., a hyperrectangle centered at a given input), while ignoring the inherent heterogeneity of perturbation direction (e.g., the input is more vulnerable along a particular perturbation direction). To bridge the gap, in this article, we propose the concept of asymmetric robustness to account for the inherent heterogeneity of perturbation directions, and present Amoeba1, an efficient certification framework for asymmetric robustness. Through extensive empirical evaluation on state-of-the-art DNNs and benchmark datasets, we show that compared with its symmetric counterpart, the asymmetric robustness bound of a given input describes its local geometric properties in a more precise manner, which enables use cases including (i) modeling stronger adversarial threats, (ii) interpreting DNN predictions, and makes it a more practical definition of certifiable robustness for security-sensitive domains.
Towards Certified Probabilistic Robustness with High Accuracy

Ruihan Zhang,Peixin Zhang,Jun Sun

DOI: https://doi.org/10.48550/arXiv.2309.00879

2023-09-02

Abstract:Adversarial examples pose a security threat to many critical systems built on neural networks (such as face recognition systems, and self-driving cars). While many methods have been proposed to build robust models, how to build certifiably robust yet accurate neural network models remains an open problem. For example, adversarial training improves empirical robustness, but they do not provide certification of the model's robustness. On the other hand, certified training provides certified robustness but at the cost of a significant accuracy drop. In this work, we propose a novel approach that aims to achieve both high accuracy and certified probabilistic robustness. Our method has two parts, i.e., a probabilistic robust training method with an additional goal of minimizing variance in terms of divergence and a runtime inference method for certified probabilistic robustness of the prediction. The latter enables efficient certification of the model's probabilistic robustness at runtime with statistical guarantees. This is supported by our training objective, which minimizes the variance of the model's predictions in a given vicinity, derived from a general definition of model robustness. Our approach works for a variety of perturbations and is reasonably efficient. Our experiments on multiple models trained on different datasets demonstrate that our approach significantly outperforms existing approaches in terms of both certification rate and accuracy.

Machine Learning
Robustness Verification of Classification Deep Neural Networks Via Linear Programming.

Wang Lin,Zhengfeng Yang,Xin Chen,Qingye Zhao,Xiangkun Li,Zhiming Liu,Jifeng He

DOI: https://doi.org/10.1109/cvpr.2019.01168

2019-01-01

Computer Vision and Pattern Recognition

Abstract:There is a pressing need to verify robustness of classification deep neural networks (CDNNs) as they are embedded in many safety-critical applications. Existing robustness verification approaches rely on computing the over-approximation of the output set, and can hardly scale up to practical CDNNs, as the result of error accumulation accompanied with approximation. In this paper, we develop a novel method for robustness verification of CDNNs with sigmoid activation functions. It converts the robustness verification problem into an equivalent problem of inspecting the most suspected point in the input region which constitutes a nonlinear optimization problem. To make it amenable, by relaxing the nonlinear constraints into the linear inclusions, it is further refined as a linear programming problem. We conduct comparison experiments on a few CDNNs trained for classifying images in some state-of-the-art benchmarks, showing our advantages of precision and scalability that enable effective verification of practical CDNNs.
A Recipe for Improved Certifiable Robustness

Kai Hu,Klas Leino,Zifan Wang,Matt Fredrikson

2024-06-23

Abstract:Recent studies have highlighted the potential of Lipschitz-based methods for training certifiably robust neural networks against adversarial attacks. A key challenge, supported both theoretically and empirically, is that robustness demands greater network capacity and more data than standard training. However, effectively adding capacity under stringent Lipschitz constraints has proven more difficult than it may seem, evident by the fact that state-of-the-art approach tend more towards \emph{underfitting} than overfitting. Moreover, we posit that a lack of careful exploration of the design space for Lipshitz-based approaches has left potential performance gains on the table. In this work, we provide a more comprehensive evaluation to better uncover the potential of Lipschitz-based certification methods. Using a combination of novel techniques, design optimizations, and synthesis of prior work, we are able to significantly improve the state-of-the-art VRA for deterministic certification on a variety of benchmark datasets, and over a range of perturbation sizes. Of particular note, we discover that the addition of large ``Cholesky-orthogonalized residual dense'' layers to the end of existing state-of-the-art Lipschitz-controlled ResNet architectures is especially effective for increasing network capacity and performance. Combined with filtered generative data augmentation, our final results further the state of the art deterministic VRA by up to 8.5 percentage points\footnote{Code is available at \url{<a class="link-external link-https" href="https://github.com/hukkai/liresnet" rel="external noopener nofollow">this https URL</a>}}.

Machine Learning
SoK: Certified Robustness for Deep Neural Networks

Linyi Li,Tao Xie,Bo Li

DOI: https://doi.org/10.1109/SP46215.2023.10179303

2023-01-01

Abstract: Great advances in deep neural networks (DNNs) have led to state-of-the-art performance on a wide range of tasks. However, recent studies have shown that DNNs are vulnerable to adversarial attacks, which have brought great concerns when deploying these models to safety-critical applications such as autonomous driving. Different defense approaches have been proposed against adversarial attacks, including: a) empirical defenses, which can usually be adaptively attacked again without providing robustness certification; and b) certifiably robust approaches, which consist of robustness verification providing the lower bound of robust accuracy against any attacks under certain conditions and corresponding robust training approaches. In this paper, we systematize certifiably robust approaches and related practical and theoretical implications and findings. We also provide the first comprehensive benchmark on existing robustness verification and training approaches on different datasets. In particular, we 1) provide a taxonomy for the robustness verification and training approaches, as well as summarize the methodologies for representative algorithms, 2) reveal the characteristics, strengths, limitations, and fundamental connections among these approaches, 3) discuss current research progresses, theoretical barriers, main challenges, and future directions for certifiably robust approaches for DNNs, and 4) provide an open-sourced unified platform to evaluate 20+ representative certifiably robust approaches.
Theoretical Analysis of Norm Selection for Robustness Verification of Neural Networks.

Saharat Saengsawang,Guoqiang Li

DOI: https://doi.org/10.1016/j.phycom.2023.102019

IF: 2.379

2023-01-01

Physical Communication

Abstract:In the robustness verification of neural network, L p-norm is generally used to measure the distance between two different data. However, different kinds of L p-norm examine the specific differences between each dimension of the data. Some L p-norm computational methods magnify specific differences between datasets. To verify the robustness of the network, the usual method is to calculate the different robustness radii of the L ∞-norm. But which L p norm performs best under a given network is rarely considered. To better reflect the nature of the network, this paper proposes a theoretical analysis of the robustness of the network that can be verified by choosing any norm type, and the relationship between the size of L p-ball corresponding to different robust radii is proved. We conducted experiments on different classification networks and obtained a general norm selection method. As a result, a specific norm can be considered first for network robustness without computing all the different L p-norm.
Efficient Global Robustness Certification of Neural Networks via Interleaving Twin-Network Encoding

Zhilu Wang,Chao Huang,Qi Zhu

DOI: https://doi.org/10.48550/arXiv.2203.14141

2022-03-27

Abstract:The robustness of deep neural networks has received significant interest recently, especially when being deployed in safety-critical systems, as it is important to analyze how sensitive the model output is under input perturbations. While most previous works focused on the local robustness property around an input sample, the studies of the global robustness property, which bounds the maximum output change under perturbations over the entire input space, are still lacking. In this work, we formulate the global robustness certification for neural networks with ReLU activation functions as a mixed-integer linear programming (MILP) problem, and present an efficient approach to address it. Our approach includes a novel interleaving twin-network encoding scheme, where two copies of the neural network are encoded side-by-side with extra interleaving dependencies added between them, and an over-approximation algorithm leveraging relaxation and refinement techniques to reduce complexity. Experiments demonstrate the timing efficiency of our work when compared with previous global robustness certification methods and the tightness of our over-approximation. A case study of closed-loop control safety verification is conducted, and demonstrates the importance and practicality of our approach for certifying the global robustness of neural networks in safety-critical systems.

Machine Learning,Robotics,Systems and Control
Cert-RNN - Towards Certifying the Robustness of Recurrent Neural Networks.

Tianyu Du,Shouling Ji,Lujia Shen,Yao Zhang,Jinfeng Li,Jie Shi,Chengfang Fang,Jianwei Yin,Raheem Beyah,Ting Wang

DOI: https://doi.org/10.1145/3460120.3484538

2021-01-01

Abstract:Certifiable robustness, the functionality of verifying whether the given region surrounding a data point admits any adversarial example, provides guaranteed security for neural networks deployed in adversarial environments. A plethora of work has been proposed to certify the robustness of feed-forward networks, e.g., FCNs and CNNs. Yet, most existing methods cannot be directly applied to recurrent neural networks (RNNs), due to their sequential inputs and unique operations. In this paper, we present Cert-RNN, a general framework for certifying the robustness of RNNs. Specifically, through detailed analysis for the intrinsic property of the unique function in different ranges, we exhaustively discuss different cases for the exact formula of bounding planes, based on which we design several precise and efficient abstract transformers for the unique calculations in RNNs. Cert-RNN significantly outperforms the state-of-the-art methods (e.g., POPQORN) in terms of (i) effectiveness -- it provides much tighter robustness bounds, and (ii) efficiency -- it scales to much more complex models. Through extensive evaluation, we validate Cert-RNN's superior performance across various network architectures (e.g., vanilla RNN and LSTM) and applications (e.g., image classification, sentiment analysis, toxic comment detection, and malicious URL detection). For instance, for the RNN-2-32 model on the MNIST sequence dataset, the robustness bound certified by Cert-RNN is on average 1.86 times larger than that by POPQORN. Besides certifying the robustness of given RNNs, Cert-RNN also enables a range of practical applications including evaluating the provable effectiveness for various defenses (i.e., the defense with a larger robustness region is considered to be more robust), improving the robustness of RNNs (i.e., incorporating Cert-RNN with verified robust training) and identifying sensitive words (i.e., the word with the smallest certified robustness bound is considered to be the most sensitive word in a sentence), which helps build more robust and interpretable deep learning systems. We will open-source Cert-RNN for facilitating the DNN security research.

Towards certifying ℓ∞ robustness using neural networks with ℓ∞-dist neurons

Towards Certifying L Robustness Using Neural Networks with L-Dist Neurons

Towards Certifying $\ell_\infty$ Robustness Using Neural Networks with $\Ell_\infty$-Dist Neurons

BOOSTING THE CERTIFIED ROBUSTNESS OF L-INFINITY DISTANCE NETS

Robust stability for delayed neural networks with nonlinear perturbation

Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspective

Certifying Robustness of Convolutional Neural Networks with Tight Linear Approximation

Tight Certified Robustness via Min-Max Representations of ReLU Neural Networks

Globally-Robust Neural Networks

Provably Tightest Linear Approximation for Robustness Verification of Sigmoid-like Neural Networks.

Towards Robust Neural Networks via Close-loop Control

Certifying Global Robustness for Deep Neural Networks

Towards Certifying the Asymmetric Robustness for Neural Networks: Quantification and Applications

Towards Certified Probabilistic Robustness with High Accuracy

Robustness Verification of Classification Deep Neural Networks Via Linear Programming.

A Recipe for Improved Certifiable Robustness

SoK: Certified Robustness for Deep Neural Networks

Theoretical Analysis of Norm Selection for Robustness Verification of Neural Networks.

Efficient Global Robustness Certification of Neural Networks via Interleaving Twin-Network Encoding

Cert-RNN - Towards Certifying the Robustness of Recurrent Neural Networks.