Probably Approximately Global Robustness Certification
This addresses the challenge of providing formal robustness guarantees for large neural networks, which is crucial for security-critical applications, though it is incremental by relaxing guarantees to probabilistic ones.
The paper tackles the problem of certifying adversarial robustness for classification algorithms by proposing a probabilistic guarantee approach that efficiently certifies a relaxation of robustness, with experiments showing it outperforms state-of-the-art sampling-based methods and scales better than formal methods.
We propose and investigate probabilistic guarantees for the adversarial robustness of classification algorithms. While traditional formal verification approaches for robustness are intractable and sampling-based approaches do not provide formal guarantees, our approach is able to efficiently certify a probabilistic relaxation of robustness. The key idea is to sample an $ε$-net and invoke a local robustness oracle on the sample. Remarkably, the size of the sample needed to achieve probably approximately global robustness guarantees is independent of the input dimensionality, the number of classes, and the learning algorithm itself. Our approach can, therefore, be applied even to large neural networks that are beyond the scope of traditional formal verification. Experiments empirically confirm that it characterizes robustness better than state-of-the-art sampling-based approaches and scales better than formal methods.