Deep Learning Robustness Verification for Few-Pixel Attacks
summary
Introduces Calzone, an L0 robustness verifier that gives sound and complete proofs by converting t-pixel neighborhoods into box (L-inf) queries and using covering designs to cover all t-sized subsets; k is chosen by dynamic programming plus sampling and non-robust K-sets are recursively refined. Evaluated on MNIST and CIFAR-10 for t≤5, Calzone verifies most cases in few minutes, handles the hardest t=5 instances in few hours, and outperforms an MILP baseline that already breaks at t=3.
AI-written summary · about
chapters (13)
- 0:00Few-pixel attacks motivation
- 1:25Box verifiers limitations for L0
- 2:50L0 neighborhoods as intervals
- 4:13Naive approach scalability issues
- 5:40Key insight with covering designs
- 7:26Covering designs solve coverage
- 9:10Refinement and dynamic programming
- 10:34KZone algorithm components
- 10:55Results on MNIST and CIFAR-10
- 13:46KZone performance summary
- 14:07Q&A: Visual imperceptibility
- 14:49Q&A: Other distance metrics
- 16:38Q&A: Geometric efficiency
related talks
01h 24mAdversarial Examples
16mVerification of Neural Networks' Global Robustness
11mExploiting Verified Neural Networks via Floating Point Numerical Error
17mMini-Batch Robustness Verification of Deep Neural Networks
01h 17mRobust Optimization and Generalization
59mVerification and Machine Learning
47m1Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers
42mTowards Verification of General Neural Networks: A Dual Approach