Robust-by-Design Classification via Unitary-Gradient Neural Networks

TL;DR

This paper introduces Signed Distance Classifiers and Unitary-Gradient Neural Networks, enabling fast, certifiable robustness assessments in neural networks for safety-critical applications by directly estimating the distance to decision boundaries.

Contribution

The paper proposes a new neural network architecture that directly outputs the distance to the decision boundary, improving robustness certification efficiency.

Findings

The architecture approximates signed distance classifiers effectively.

It enables online certifiable classification with a single inference.

Experimental results validate the approach's accuracy and efficiency.

Abstract

The use of neural networks in safety-critical systems requires safe and robust models, due to the existence of adversarial attacks. Knowing the minimal adversarial perturbation of any input x, or, equivalently, knowing the distance of x from the classification boundary, allows evaluating the classification robustness, providing certifiable predictions. Unfortunately, state-of-the-art techniques for computing such a distance are computationally expensive and hence not suited for online applications. This work proposes a novel family of classifiers, namely Signed Distance Classifiers (SDCs), that, from a theoretical perspective, directly output the exact distance of x from the classification boundary, rather than a probability score (e.g., SoftMax). SDCs represent a family of robust-by-design classifiers. To practically address the theoretical requirements of a SDC, a novel network architecture named Unitary-Gradient Neural Network is presented. Experimental results show that the proposed architecture approximates a signed distance classifier, hence allowing an online certifiable classification of x at the cost of a single inference.