English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

In this paper, we study certifying the robustness of ReLU neural networksagainst adversarial input perturbations. To diminish the relaxation errorsuffered by the popular linear programming (LP) and semidefinite programming(SDP) certification methods, we take a branch-and-bound approach to proposepartitioning the input uncertainty set and solving the relaxations on each partseparately. We show that this approach reduces relaxation error, and that theerror is eliminated entirely upon performing an LP relaxation with a partitionintelligently designed to exploit the nature of the ReLU activations. To scalethis approach to large networks, we consider using a coarser partition wherebythe number of parts in the partition is reduced. We prove that computing such acoarse partition that directly minimizes the LP relaxation error is NP-hard. Byinstead minimizing the worst-case LP relaxation error, we develop a closed-formbranching scheme. We extend the analysis to the SDP, where the feasible setgeometry is exploited to design a branching scheme that minimizes theworst-case SDP relaxation error. Experiments on MNIST, CIFAR-10, and Wisconsinbreast cancer diagnosis classifiers demonstrate significant increases in thepercentages of test samples certified. By independently increasing the inputsize and the number of layers, we empirically illustrate under which regimesthe branched LP and branched SDP are best applied.

Towards Optimal Branching of Linear and Semidefinite Relaxations for Neural Network Robustness Certification