[Paper Review] POPQORN: Quantifying Robustness of Recurrent Neural Networks

Ching-Yun Ko, Zhaoyang Lyu+4 more|arXiv (Cornell University)|May 17, 2019

Adversarial Robustness in Machine LearningComputer Science42 citations

TL;DR

POPQORN provides a general framework to quantify robustness guarantees for RNNs (vanilla RNNs, LSTMs, GRUs) by propagating linear bounds from outputs back to inputs under adversarial perturbations.

ABSTRACT

The vulnerability to adversarial attacks has been a critical issue for deep neural networks. Addressing this issue requires a reliable way to evaluate the robustness of a network. Recently, several methods have been developed to compute $ extit{robustness quantification}$ for neural networks, namely, certified lower bounds of the minimum adversarial perturbation. Such methods, however, were devised for feed-forward networks, e.g. multi-layer perceptron or convolutional networks. It remains an open problem to quantify robustness for recurrent networks, especially LSTM and GRU. For such networks, there exist additional challenges in computing the robustness quantification, such as handling the inputs at multiple steps and the interaction between gates and states. In this work, we propose $ extit{POPQORN}$ ($ extbf{P}$ropagated-$ extbf{o}$ut$ extbf{p}$ut $ extbf{Q}$uantified R$ extbf{o}$bustness for $ extbf{RN}$Ns), a general algorithm to quantify robustness of RNNs, including vanilla RNNs, LSTMs, and GRUs. We demonstrate its effectiveness on different network architectures and show that the robustness quantification on individual steps can lead to new insights.

Motivation & Objective

• Motivate robust evaluation of RNN classifiers against adversarial perturbations.
• Extend verification-based robustness quantification from feed-forward nets to recurrent architectures.
• Develop a general, transferable bounding framework that supports vanilla RNNs, LSTMs, and GRUs.
• Provide closed-form bounds and practical algorithms to compute robustness guarantees under l_p perturbations.

Proposed method

• Bound nonlinear activations with linear functions using per-layer bounds and propagate them backward from the output to the input.
• Handle cross-nonlinearity in gates by bounding cross terms with planes for LSTMs.
• Derive explicit upper and lower bound formulas for vanilla RNNs, LSTMs, and GRUs (Theorems A.2, A.3–A.7 in appendix).
• Compute global robustness bounds by maximizing/minimizing the bound expressions and applying Holder’s inequality.
• Formulate a binary-search based procedure to find the largest perturbation radius epsilon yielding robustness guarantees.
• Provide a comparative analysis framework against prior robustness quantification methods (certified bounds and CLEVER-RNN).

Experimental results

Research questions

• RQ1 How can robustness bounds be computed for RNNs under norm-bounded adversarial perturbations?
• RQ2 Can a unified framework provide guaranteed lower/upper bounds for vanilla RNNs, LSTMs, and GRUs, including cross-nonlinearity?
• RQ3 How does step-wise robustness insight emerge when evaluating bounds at individual time steps?
• RQ4 What is the relationship between perturbation radius and certified robustness guarantees for sequential inputs in RNNs?

Key findings

• POPQORN delivers explicit linear upper and lower bounds for RNN outputs under epsilon-bounded input perturbations.
• The framework accommodates vanilla RNNs, LSTMs, and GRUs with guarantees, including handling cross-nonlinearity in gates.
• Bounding lines (for activations) and bounding planes (for cross terms in LSTMs) enable recursive propagation of bounds from output to input.
• Global bounds gamma^L_j and gamma^U_j can be computed for each output dimension j, enabling robustness certification.
• A binary search procedure is proposed to compute the maximum epsilon that preserves classification robustness (untargeted or targeted).