Abstract Domains for Machine Learning Verification
summary
Advocates abstract domains that actually compute things: encodes semantic perturbations as extra network inputs and checks robustness of explanations (saliency maps) by exploring ReLU activation patterns, finding explanation stability breaks at ~0.25 brightness vs classification at ~0.5. Builds a geometric boundary under-approximation because full activation-space exploration fails past ~10k neurons. Proposes reduced affine forms (zonotope-like) to produce fast, effect-based feature importance for linear and RBF SVMs (polynomial kernels need better abstractions). Crafts hybrid certified+adversarial training that cuts training cost and improves empirical robustness over PGD-5 in some cases.
AI-written summary · about
chapters (16)
- 0:00Workshop introduction
- 1:06Why abstract domains matter
- 3:14Verifying deployed ML models
- 6:04Robustness verification with interpretability
- 11:15Limitations of exact robustness analysis
- 23:56Alternative explanation techniques
- 24:19Abstractions for model explainability
- 25:46SVMs as explanation case study
- 31:47Abstract feature importance for SVMs
- 42:48Evaluating feature importance baselines
- 44:58Training phase and robustness
- 47:47Certified versus adversarial training
- 50:17Hybrid training for fairness and robustness
- 51:40Hybrid training for adversarial robustness
- 52:44Summary and future directions
- 53:07Q&A
related talks
31mAbstract Neural Networks
15mReduced Products of Abstract Domains for Fairness Certification of Neural Networks
55mTowards Verified Deep Learning
58mBuilding Trust and Safety in Artificial Intelligence with Abstract Interpretation
28mReduced Products of Abstract Domains for Fairness Certification of Neural Networks
31mARENA: Enhancing Abstract Refinement for Neural Network Verification
19mAbstract Neural Networks
59mDifferential Verification of Deep Neural Networks