改进区间传播方法，让神经网络鲁棒性验证更准确
Make Interval Bound Propagation great again
- 用区间传播替代传统方法，缓解包裹效应带来的误差
- 对线性激活网络，结果逼近理论最优边界
- 适合需要高精度鲁棒性验证的医疗、自动驾驶场景
在医疗数据分析、自动驾驶和对抗训练等实际场景中，我们关注神经网络的鲁棒性——即输入微小扰动不会导致输出剧烈变化（如分类错误）。这属于神经网络认证（Neural Network Certification, NNC）范畴。NNC两大核心问题为：如何计算已有预训练网络的鲁棒性，以及如何构建鲁棒网络。当前主流方法是区间传播（Interval Bound Propagation, IBP），但本文揭示其在存在包裹效应时表现不佳，即使对于线性激活函数也给出显著次优的界。为此，本文引入两种经典严格计算技术——Dubleton Arithmetic 和 Affine Arithmetic，以抑制包裹效应。实验表明，该方法在具有线性激活的网络上能获得接近最优的鲁棒性边界，显著优于传统IBP。
原文摘要 · Abstract (English)
In various scenarios motivated by real life, such as medical data analysis, autonomous driving, and adversarial training, we are interested in robust deep networks. A network is robust when a relatively small perturbation of the input cannot lead to drastic changes in output (like change of class, etc.). This falls under the broader scope field of Neural Network Certification (NNC). Two crucial problems in NNC are of profound interest to the scientific community: how to calculate the robustness of a given pre-trained network and how to construct robust networks. The common approach to constructing robust networks is Interval Bound Propagation (IBP). This paper demonstrates that IBP is sub-optimal in the first case due to its susceptibility to the wrapping effect. Even for linear activation, IBP gives strongly sub-optimal bounds. Consequently, one should use strategies immune to the wrapping effect to obtain bounds close to optimal ones. We adapt two classical approaches dedicated to strict computations -- Dubleton Arithmetic and Affine Arithmetic -- to mitigate the wrapping effect in neural networks. These techniques yield precise results for networks with linear activation functions, thus resisting the wrapping effect. As a result, we achieve bounds significantly closer to the optimal level than IBPs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。