Probably Approximately Global Robustness Certification

TL;DR

This paper introduces a probabilistic certification method for neural network robustness that is scalable, dimension-independent, and provides formal guarantees, outperforming existing sampling and formal verification techniques.

Contribution

It presents a novel probabilistic certification approach that efficiently certifies robustness with guarantees independent of input dimension and network complexity.

Findings

Scales better than formal verification methods.

Provides probabilistic robustness guarantees.

Outperforms state-of-the-art sampling approaches.

Abstract

We propose and investigate probabilistic guarantees for the adversarial robustness of classification algorithms. While traditional formal verification approaches for robustness are intractable and sampling-based approaches do not provide formal guarantees, our approach is able to efficiently certify a probabilistic relaxation of robustness. The key idea is to sample an $\epsilon$-net and invoke a local robustness oracle on the sample. Remarkably, the size of the sample needed to achieve probably approximately global robustness guarantees is independent of the input dimensionality, the number of classes, and the learning algorithm itself. Our approach can, therefore, be applied even to large neural networks that are beyond the scope of traditional formal verification. Experiments empirically confirm that it characterizes robustness better than state-of-the-art sampling-based approaches and scales better than formal methods.