Towards Verifying Robustness of Neural Networks Against Semantic Perturbations

2019/12/19 by Jeet Mohapatra, Mohapatra, Jeet, Tsui-Wei +8
Computer Science · Mathematics · #Adversarial Robustness in Machine Learning #FOS: Computer and information sciences #Machine Learning (cs.LG) #Machine Learning (stat.ML) #Physical Unclonable Functions (PUFs) and Hardware Security #Security and Verification in Computing #cs.LG #stat.ML

paper · pdf · doi:10.48550/arxiv.1912.09533

CVPR 2020

openalex publication_date 2019/12/19 · arxiv created 2020/06/15 · arxiv updated 2020/06/16 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Verifying robustness of neural networks given a specified threat model is a fundamental yet challenging task. While current verification methods mainly focus on the ℓ_p-norm threat model of the input instances, robustness verification against semantic adversarial attacks inducing large ℓ_p-norm perturbations, such as color shifting and lighting adjustment, are beyond their capacity. To bridge this gap, we propose Semantify-NN, a model-agnostic and generic robustness verification approach against semantic perturbations for neural networks. By simply inserting our proposed semantic perturbation layers (SP-layers) to the input layer of any given model, Semantify-NN is model-agnostic, and any ℓ_p-norm based verification tools can be used to verify the model robustness against semantic perturbations. We illustrate the principles of designing the SP-layers and provide examples including semantic perturbations to image classification in the space of hue, saturation, lightness, brightness, contrast and rotation, respectively. In addition, an efficient refinement technique is proposed to further significantly improve the semantic certificate. Experiments on various network architectures and different datasets demonstrate the superior verification performance of Semantify-NN over ℓ_p-norm-based verification frameworks that naively convert semantic perturbation to ℓ_p-norm. The results show that Semantify-NN can support robustness verification against a wide range of semantic perturbations. Code available https://github.com/JeetMo/Semantify-NN

Citations

• Gradient-based learning applied to document recognition
• Efficient Formal Safety Analysis of Neural Networks
• Semidefinite relaxations for certifying robustness to adversarial examples
• Provable defenses against adversarial examples via the convex outer adversarial polytope
• Unrestricted Adversarial Examples via Semantic Manipulation

Related

• Precise and Generalized Robustness Certification for Neural Networks
• Boosting Robustness Verification of Semantic Feature Neighborhoods
• Benchmarking Neural Network Robustness to Common Corruptions and Perturbations
• DeepCert: Verification of Contextually Relevant Robustness for Neural Network Image Classifiers
• OccRob: Efficient SMT-Based Occlusion Robustness Verification of Deep Neural Networks