CLEVER (Cross-Lipschitz Extreme Value for nEtwork Robustness) is an Extreme Value Theory (EVT) based robustness score for large-scale deep neural networks (DNNs). In this paper, we propose two extensions on this robustness score. First, we provide a new formal robustness guarantee for classifier functions that are twice differentiable. We apply extreme value theory on the new formal robustness guarantee and the estimated robustness is called second-order CLEVER score. Second, we discuss how to handle gradient masking, a common defensive technique, using CLEVER with Backward Pass Differentiable Approximation (BPDA). With BPDA applied, CLEVER can evaluate the intrinsic robustness of neural networks of a broader class -- networks with non-differentiable input transformations. We demonstrate the effectiveness of CLEVER with BPDA in experiments on a 121-layer Densenet model trained on the ImageNet dataset.
@article{arxiv.1810.08640,
title = {On Extensions of CLEVER: A Neural Network Robustness Evaluation Algorithm},
author = {Tsui-Wei Weng and Huan Zhang and Pin-Yu Chen and Aurelie Lozano and Cho-Jui Hsieh and Luca Daniel},
journal= {arXiv preprint arXiv:1810.08640},
year = {2018}
}
Comments
Accepted by GlobalSIP 2018. Tsui-Wei Weng and Huan Zhang contributed equally