Dual Neural Network Verification for Adversarial Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Neural network classifiers are vulnerable to norm-bounded adversarial perturbations, which can lead to incorrect classifications, and existing solutions either increase training time, do not guarantee robustness, or fail to scale well with complex neural networks.
Innovation Solution
A method is proposed to determine if a neural network is provably robust against perturbations by using a dual neural network architecture and objective functions to assess modifications within a given magnitude, ensuring the network maintains the correct output value under adversarial perturbations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If norm-bounded perturbations are applied to training data to improve robustness, then classification accuracy under adversarial conditions is improved, but training time increases significantly
Solution Approach 1:
The patent applies preliminary action by performing robustness verification and adversarial defense training before the neural network is deployed for actual classification tasks. The system pre-computes robustness certificates and trains against worst-case perturbations in advance, so that when the network encounters adversarial inputs during operation, it is already prepared and can maintain accurate classifications without requiring additional real-time computation or retraining.
2Reliability
If formal verification methods are used to prove robustness, then reliability against perturbations is improved, but the method does not scale well to complex deep convolutional neural networks
Solution Approach 1:
The patent applies segmentation by dividing the verification and training process into modular components that can be applied layer-by-layer or module-by-module through the neural network. The robustness verification is performed in a staged manner, breaking down the complex DeepPoly verification into manageable steps that process different layers and perturbation bounds separately. This modular approach allows the formal verification to scale to deeper networks by processing them in segments rather than attempting to verify the entire network simultaneously.
Solution Approach 2:
The patent transitions from verifying robustness at the input-output level to verifying robustness at the intermediate layer level. By introducing robustness certificates that track perturbation bounds through intermediate layers and using layer-wise verification, the system adds a dimensional aspect to the verification process. This allows the complexity to be managed by working through the network's dimensional structure (layers and activations) rather than treating it as a monolithic black box.
3Reliability
If existing adversarial defense techniques are applied, then some perturbations are reduced, but they do not guarantee that all perturbations within a predetermined norm-bound will be correctly classified
Solution Approach 1:
The patent applies preliminary anti-action by training the neural network against worst-case adversarial perturbations before deployment. The system uses robustness verification to identify potential vulnerability points and then applies adversarial defense techniques to counter these specific threats in advance. By performing this anti-action training with formal verification guarantees, the system ensures that all perturbations within the predetermined norm-bound are addressed, not just some of them, providing comprehensive coverage against adversarial attacks.
Data Source
AI summary
A method for training an automated learning system includes processing training input with a first neural network and processing the output of the first neural network with a second neural network. The input layer of the second neural network corresponding to the output layer of the first neural network. The output layer of the second neural network corresponding to the input layer of the first neural network. An objective function is determined using the output of the second neural network and a predetermined modification magnitude. The objective function is approximated using random Cauchy projections which are propagated through the second neural network.