[Paper Review] Data-Driven Assessment of Deep Neural Networks with Random Input Uncertainty.

Brendon G. Anderson, Somayeh Sojoudi|arXiv (Cornell University)|Oct 2, 2020

Adversarial Robustness in Machine Learning25 references4 citations

TL;DR

This paper proposes a data-driven, optimization-based method for assessing deep neural network safety under random input uncertainty, simultaneously certifying output robustness and localizing uncertainty. It provides a unified framework that subsumes reachability and certification methods, works for all network architectures, and guarantees high-probability certification with provable convexity and sample complexity.

ABSTRACT

When using deep neural networks to operate safety-critical systems, assessing the sensitivity of the network outputs when subject to uncertain inputs is of paramount importance. Such assessment is commonly done using reachability analysis or robustness certification. However, certification techniques typically ignore localization information, while reachable set methods can fail to issue robustness guarantees. Furthermore, many advanced methods are either computationally intractable in practice or restricted to very specific models. In this paper, we develop a data-driven optimization-based method capable of simultaneously certifying the safety of network outputs and localizing them. The proposed method provides a unified assessment framework, as it subsumes state-of-the-art reachability analysis and robustness certification. The method applies to deep neural networks of all sizes and structures, and to random input uncertainty with a general distribution. We develop sufficient conditions for the convexity of the underlying optimization, and for the number of data samples to certify and localize the outputs with overwhelming probability. We experimentally demonstrate the efficacy and tractability of the method on a deep ReLU network.

Motivation & Objective

• To address the limitations of existing reachability and robustness certification methods in handling general input distributions and localization.
• To develop a unified framework that combines robustness certification and spatial localization of network outputs under uncertainty.
• To ensure computational tractability and high-probability guarantees for deep neural networks of any size or structure.
• To establish sufficient conditions for convexity in the underlying optimization problem and derive sample complexity bounds for reliable certification.

Proposed method

• The method formulates a data-driven optimization problem to assess the worst-case output deviation under random input uncertainty.
• It leverages convex relaxation techniques to ensure the optimization problem remains tractable and convex under sufficient conditions.
• The approach incorporates localization by identifying regions in the output space where predictions remain robust.
• It uses Monte Carlo sampling of input uncertainty to estimate reachable sets and validate robustness with high probability.
• The framework is general and applies to any deep neural network with ReLU or similar activation functions and arbitrary input distributions.
• Sample complexity bounds are derived to ensure certification and localization with overwhelming probability using finite data.

Experimental results

Research questions

• RQ1 Can a unified framework be developed that simultaneously certifies robustness and localizes outputs in deep neural networks under general input uncertainty?
• RQ2 How can convexity be ensured in the optimization problem used for robustness assessment across diverse network architectures?
• RQ3 What is the minimum number of input samples required to achieve high-probability certification and localization?
• RQ4 How does the method compare in tractability and accuracy to existing reachability and certification techniques?

Key findings

• The proposed method achieves robustness certification and output localization in a single unified framework, subsuming prior reachability and certification approaches.
• Sufficient conditions for convexity of the underlying optimization problem are derived, ensuring computational tractability.
• The method guarantees high-probability certification with a finite number of input samples, as quantified by sample complexity bounds.
• Experimental results on a deep ReLU network demonstrate the method's efficacy, tractability, and scalability across varying uncertainty distributions.