DeepAI AI Chat
Log In Sign Up

Partition-Based Convex Relaxations for Certifying the Robustness of ReLU Neural Networks

by   Brendon G. Anderson, et al.

In this paper, we study certifying the robustness of ReLU neural networks against adversarial input perturbations. To diminish the relaxation error suffered by the popular linear programming (LP) and semidefinite programming (SDP) certification methods, we propose partitioning the input uncertainty set and solving the relaxations on each part separately. We show that this approach reduces relaxation error, and that the error is eliminated entirely upon performing an LP relaxation with an intelligently designed partition. To scale this approach to large networks, we consider courser partitions that take the same form as this motivating partition. We prove that computing such a partition that directly minimizes the LP relaxation error is NP-hard. By instead minimizing the worst-case LP relaxation error, we develop a computationally tractable scheme with a closed-form optimal two-part partition. We extend the analysis to the SDP, where the feasible set geometry is exploited to design a two-part partition that minimizes the worst-case SDP relaxation error. Experiments on IRIS classifiers demonstrate significant reduction in relaxation error, offering certificates that are otherwise void without partitioning. By independently increasing the input size and the number of layers, we empirically illustrate under which regimes the partitioned LP and SDP are best applied.


page 1

page 2

page 3

page 4


Tightened Convex Relaxations for Neural Network Robustness Certification

In this paper, we consider the problem of certifying the robustness of n...

On a Partition LP Relaxation for Min-Cost 2-Node Connected Spanning Subgraphs

Our motivation is to improve on the best approximation guarantee known f...

Partition-based formulations for mixed-integer optimization of trained ReLU neural networks

This paper introduces a class of mixed-integer formulations for trained ...

Recursive McCormick Linearization of Multilinear Programs

Linear programming (LP) relaxations are widely employed in exact solutio...

Optimal Partitioning of Non-Convex Environments for Minimum Turn Coverage Planning

In this paper, we tackle the problem of generating a turn-minimizing cov...

A new Hybrid Lattice Attack on Galbraith's Binary LWE Cryptosystem

LWE-based cryptosystems are an attractive alternative to traditional one...