Lipschitz-Based Robustness Certification for Recurrent Neural Networks via Convex Relaxation
This work addresses safety-critical control applications where RNNs are deployed, though it is incremental as it builds on existing relaxation-based certification methods.
The paper tackled robustness certification for recurrent neural networks (RNNs) against input noise by developing RNN-SDP, a method that computes certified Lipschitz constant bounds via convex relaxation, producing reasonably tight bounds even with increasing sequence lengths, though input constraints yielded only modest improvements.
Robustness certification against bounded input noise or adversarial perturbations is increasingly important for deployment recurrent neural networks (RNNs) in safety-critical control applications. To address this challenge, we present RNN-SDP, a relaxation based method that models the RNN's layer interactions as a convex problem and computes a certified upper bound on the Lipschitz constant via semidefinite programming (SDP). We also explore an extension that incorporates known input constraints to further tighten the resulting Lipschitz bounds. RNN-SDP is evaluated on a synthetic multi-tank system, with upper bounds compared to empirical estimates. While incorporating input constraints yields only modest improvements, the general method produces reasonably tight and certifiable bounds, even as sequence length increases. The results also underscore the often underestimated impact of initialization errors, an important consideration for applications where models are frequently re-initialized, such as model predictive control (MPC).