Provable Defense Against Geometric Transformations
Provable Defense Against Geometric Transformations
复制标题
DOI：
--
复制
发表时间：
2022-07
期刊：
影响因子：
--
通讯作者：
Rem Yang;Jacob S. Laurel;Sasa Misailovic;Gagandeep Singh
中科院分区：
文献类型：
--
作者：
Rem Yang;Jacob S. Laurel;Sasa Misailovic;Gagandeep Singh
现实世界中出现的几何图像变换（例如缩放和旋转）已被证明很容易欺骗深度神经网络（DNN）。因此，训练 DNN 使其对这些扰动具有鲁棒性至关重要。然而，之前的工作还没有能够将针对几何变换的确定性认证鲁棒性的目标纳入训练过程，因为现有的验证器速度非常慢。为了应对这些挑战，我们提出了第一个可证明的确定性认证几何稳健性防御。我们的框架利用一种新颖的 GPU 优化验证器，可以比现有的几何鲁棒性验证器快 60$\times$ 到 42,600$\times$ 之间的图像验证速度，因此与现有的工作不同，它足够快用于训练。在多个数据集中，我们的结果表明，通过我们的框架训练的网络始终实现最先进的确定性认证的几何鲁棒性和干净的准确性。此外，我们首次验证了神经网络在具有挑战性的自动驾驶现实环境中的几何鲁棒性。
Geometric image transformations that arise in the real world, such as scaling and rotation, have been shown to easily deceive deep neural networks (DNNs). Hence, training DNNs to be certifiably robust to these perturbations is critical. However, no prior work has been able to incorporate the objective of deterministic certified robustness against geometric transformations into the training procedure, as existing verifiers are exceedingly slow. To address these challenges, we propose the first provable defense for deterministic certified geometric robustness. Our framework leverages a novel GPU-optimized verifier that can certify images between 60$\times$ to 42,600$\times$ faster than existing geometric robustness verifiers, and thus unlike existing works, is fast enough for use in training. Across multiple datasets, our results show that networks trained via our framework consistently achieve state-of-the-art deterministic certified geometric robustness and clean accuracy. Furthermore, for the first time, we verify the geometric robustness of a neural network for the challenging, real-world setting of autonomous driving.