Towards verifying robustness of neural networks against a family of semantic perturbations
Verifying robustness of neural networks given a specified threat model is a fundamental yet challenging task. While current verification methods mainly focus on the p-norm threat model of the input instances, robustness verification against semantic adversarial attacks inducing large p-norm perturba...
| Main Authors: | , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021
|
| Online Access: | https://hdl.handle.net/1721.1/130001 |
| _version_ | 1826210657716928512 |
|---|---|
| author | Mohapatra, Jeet Weng, Tsui-Wei Chen, Pin-Yu Liu, Sijia Daniel, Luca |
| author2 | Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science |
| author_facet | Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Mohapatra, Jeet Weng, Tsui-Wei Chen, Pin-Yu Liu, Sijia Daniel, Luca |
| author_sort | Mohapatra, Jeet |
| collection | MIT |
| description | Verifying robustness of neural networks given a specified threat model is a fundamental yet challenging task. While current verification methods mainly focus on the p-norm threat model of the input instances, robustness verification against semantic adversarial attacks inducing large p-norm perturbations, such as color shifting and lighting adjustment, are beyond their capacity. To bridge this gap, we propose Semantify-NN, a model-agnostic and generic robustness verification approach against semantic perturbations for neural networks. By simply inserting our proposed semantic perturbation layers (SP-layers) to the input layer of any given model, Semantify-NN is model-agnostic, and any p-norm based verification tools can be used to verify the model robustness against semantic perturbations. We illustrate the principles of designing the SP-layers and provide examples including semantic perturbations to image classification in the space of hue, saturation, lightness, brightness, contrast and rotation, respectively. In addition, an efficient refinement technique is proposed to further significantly improve the semantic certificate. Experiments on various network architectures and different datasets demonstrate the superior verification performance of Semantify-NN over p-norm-based verification frameworks that naively convert semantic perturbation to p-norm. The results show that Semantify-NN can support robustness verification against a wide range of semantic perturbations. |
| first_indexed | 2024-09-23T14:53:25Z |
| format | Article |
| id | mit-1721.1/130001 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T14:53:25Z |
| publishDate | 2021 |
| publisher | IEEE |
| record_format | dspace |
| spelling | mit-1721.1/1300012022-10-01T23:11:41Z Towards verifying robustness of neural networks against a family of semantic perturbations Mohapatra, Jeet Weng, Tsui-Wei Chen, Pin-Yu Liu, Sijia Daniel, Luca Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Verifying robustness of neural networks given a specified threat model is a fundamental yet challenging task. While current verification methods mainly focus on the p-norm threat model of the input instances, robustness verification against semantic adversarial attacks inducing large p-norm perturbations, such as color shifting and lighting adjustment, are beyond their capacity. To bridge this gap, we propose Semantify-NN, a model-agnostic and generic robustness verification approach against semantic perturbations for neural networks. By simply inserting our proposed semantic perturbation layers (SP-layers) to the input layer of any given model, Semantify-NN is model-agnostic, and any p-norm based verification tools can be used to verify the model robustness against semantic perturbations. We illustrate the principles of designing the SP-layers and provide examples including semantic perturbations to image classification in the space of hue, saturation, lightness, brightness, contrast and rotation, respectively. In addition, an efficient refinement technique is proposed to further significantly improve the semantic certificate. Experiments on various network architectures and different datasets demonstrate the superior verification performance of Semantify-NN over p-norm-based verification frameworks that naively convert semantic perturbation to p-norm. The results show that Semantify-NN can support robustness verification against a wide range of semantic perturbations. 2021-02-25T15:17:24Z 2021-02-25T15:17:24Z 2020-06 2020-12-07T17:31:25Z Article http://purl.org/eprint/type/ConferencePaper 9781728171685 1063-6919 https://hdl.handle.net/1721.1/130001 Mohapatra, Jeet et al. “Towards verifying robustness of neural networks against a family of semantic perturbations.” Paper in the Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition, June 2020, 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Seattle, WA, 13-19 June 2020, IEEE © 2020 The Author(s) en 10.1109/CVPR42600.2020.00032 Proceedings of the IEEE Computer Society Conference on Computer Vision and Pattern Recognition Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf IEEE arXiv |
| spellingShingle | Mohapatra, Jeet Weng, Tsui-Wei Chen, Pin-Yu Liu, Sijia Daniel, Luca Towards verifying robustness of neural networks against a family of semantic perturbations |
| title | Towards verifying robustness of neural networks against a family of semantic perturbations |
| title_full | Towards verifying robustness of neural networks against a family of semantic perturbations |
| title_fullStr | Towards verifying robustness of neural networks against a family of semantic perturbations |
| title_full_unstemmed | Towards verifying robustness of neural networks against a family of semantic perturbations |
| title_short | Towards verifying robustness of neural networks against a family of semantic perturbations |
| title_sort | towards verifying robustness of neural networks against a family of semantic perturbations |
| url | https://hdl.handle.net/1721.1/130001 |
| work_keys_str_mv | AT mohapatrajeet towardsverifyingrobustnessofneuralnetworksagainstafamilyofsemanticperturbations AT wengtsuiwei towardsverifyingrobustnessofneuralnetworksagainstafamilyofsemanticperturbations AT chenpinyu towardsverifyingrobustnessofneuralnetworksagainstafamilyofsemanticperturbations AT liusijia towardsverifyingrobustnessofneuralnetworksagainstafamilyofsemanticperturbations AT danielluca towardsverifyingrobustnessofneuralnetworksagainstafamilyofsemanticperturbations |