PaperlayerView exact revision on arXiv

Source-linked AI summary

Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach

Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, Luca Daniel

arXiv:1801.10578v1stat.MLcs.CRcs.LG

TL;DR

Neural-network robustness is difficult to assess comprehensively because common evaluations depend on particular adversarial attacks, despite security concerns surrounding adversarial examples. The paper derives robustness guarantees through local Lipschitz analysis and uses extreme value theory to estimate them with CLEVER. CLEVER is attack-agnostic, applicable to arbitrary classifiers, computationally feasible for large networks, and aligned with attack-based robustness indications across natural and defended models.

  • Problem

    Adversarial examples threaten neural-network applications, while existing robustness evaluations often rely on attack-specific results and can miss vulnerability to unseen attacks.

  • Method

    The paper derives a universal lower bound on minimum adversarial distortion, reformulates estimation as a local Lipschitz problem, and uses extreme value theory to compute CLEVER.

  • Results

    CLEVER aligns with ℓ2 and ℓ∞ attack-based robustness indications across ResNet, Inception-v3, MobileNet, and defended networks.

  • Takeaways & Limitations

    CLEVER provides an attack-independent robustness score for arbitrary neural-network classifiers that is computationally feasible for large networks.

  • Takeaways & Limitations

    Adversarially trained networks can remain vulnerable to attacks not used during training.

Abstract

from arXiv · show

The robustness of neural networks to adversarial examples has received great attention due to security implications. Despite various attack approaches to crafting visually imperceptible adversarial examples, little has been developed towards a comprehensive measure of robustness. In this paper, we provide a theoretical justification for converting robustness analysis into a local Lipschitz constant estimation problem, and propose to use the Extreme Value Theory for efficient evaluation. Our analysis yields a novel robustness metric called CLEVER, which is short for Cross Lipschitz Extreme Value for nEtwork Robustness. The proposed CLEVER score is attack-agnostic and computationally feasible for large neural networks. Experimental results on various networks, including ResNet, Inception-v3 and MobileNet, show that (i) CLEVER is aligned with the robustness indication measured by the $\ell_2$ and $\ell_\infty$ norms of adversarial examples from powerful attacks, and (ii) defended networks using defensive distillation or bounded ReLU indeed achieve better CLEVER scores. To the best of our knowledge, CLEVER is the first attack-independent robustness metric that can be applied to any neural network classifier.

1 INTRODUCTION

Neural networks remain vulnerable to adversarial examples, creating safety concerns while robustness evaluation often depends on attack-specific results. The paper proposes CLEVER as an attack-agnostic, scalable robustness metric grounded in formal analysis and experiments.

  • Motivation: Adversarial examples can mislead neural networks with visually imperceptible perturbations, including in physical-world settings.This vulnerability raises concerns for safety-critical applications such as autonomous driving and malware detection.
  • Motivation: Existing robustness evaluations commonly use attack success rates and distortions, making intrinsic robustness assessment dependent on particular attacks.The paper distinguishes attack development from attack-independent robustness analysis.
  • Motivation: Adversarial training can improve robustness to its training attacks while leaving networks vulnerable to unseen attacks.This illustrates why attack-specific evaluation may provide a biased assessment of robustness.
  • Approach: The paper converts robustness analysis into local Lipschitz constant estimation and uses extreme value theory for efficient evaluation.The analysis derives a universal lower bound on minimum adversarial distortion for any attack and any ℓp norm with p ≥1.
  • Contributions: CLEVER is presented as an attack-independent robustness metric applicable to arbitrary neural network classifiers and scalable to large ImageNet networks.The paper also reports theoretical guarantees and experiments on natural and defended networks.

2 BACKGROUND AND RELATED WORK

Prior work formulates adversarial-example generation as norm-constrained optimization and studies both white-box and black-box attacks. Robustness measures based on attack distortions can be algorithm-dependent, whereas CLEVER estimates a lower bound and is designed to scale to large networks.

  • Attacking Neural Networks Using Adversarial Examples: Adversarial-example attacks optimize a perturbation δ while balancing attack success against a chosen norm-based similarity constraint.Objectives may use cross-entropy loss or model predictions, with norm constraints implemented by clipping or penalties.
  • Attacking Neural Networks Using Adversarial Examples: The ℓ∞, ℓ2, and ℓ1 norms measure maximum coordinate variation, Euclidean magnitude, and total perturbation variation, respectively.I-FGSM, CW, and EAD are identified as state-of-the-art attacks for these norms in the cited discussion.
  • Attacking Neural Networks Using Adversarial Examples: Black-box adversarial examples can be generated through ensembles, substitute models, or zeroth-order optimization without transparent access to the target model.These approaches differ from white-box attacks, which assume the network is transparent.
  • Defenses: Defense methods aim to increase resilience to perturbations while preserving test accuracy comparable to the undefended model.Defensive distillation is cited as one proposed defense technique.
  • Theoretical Robustness Guarantees: Global layerwise Lipschitz bounds can be loose, while prior local bounds were limited to particular differentiable architectures or difficult closed-form derivations.The cited prior work includes an MLP with a single hidden layer and softplus activation.
  • Theoretical Robustness Guarantees: Attack-found distortions are upper bounds on true minimum distortion and depend on the attack algorithm used.CLEVER instead estimates a lower bound independently of attacks and is computationally feasible for large networks such as Inception-v3.

3 ANALYSIS OF FORMAL ROBUSTNESS GUARANTEES FOR A CLASSIFIER

The analysis defines adversarial distortion and derives instance-specific lower bounds on the perturbation required to change a classifier’s prediction. These guarantees use cross-Lipschitz behavior and extend to ReLU networks through directional derivatives.

  • Definitions: An adversarial example is a perturbed input that changes the classifier’s prediction, with distortion defined as ∥δ∥p.Targeted attacks seek a specified target class, whereas untargeted attacks seek any changed class.
  • Definitions: The minimum adversarial distortion is the smallest ℓp perturbation that produces an adversarial example.The formal framework distinguishes this minimum from lower and upper bounds estimated by analysis or attacks.
  • Formal Guarantees: The lower bound βL is instance-specific and certifies robustness against every perturbation satisfying ∥δ∥p ≤βL.An attack can readily provide an upper bound βU by finding an adversarial example, whereas βL is harder to obtain.
  • Formal Guarantees: For differentiable functions, a Lipschitz constant can be bounded by the maximum dual-norm gradient over a convex bounded set.The relevant norms satisfy 1/p + 1/q = 1.
  • Formal Guarantees: Theorem 3.2 derives a formal lower bound for untargeted attacks under Lipschitz continuity of the classifier components.The proof is presented as a direct Lipschitz-continuity argument rather than relying on the previously cited proof route.
  • Formal Guarantees: The cross-Lipschitz constant is the Lipschitz constant of the class-score difference fc(x) − fj(x).Theorem 3.2 uses this score difference to characterize how close a perturbation is to changing the prediction.
  • ReLU Networks: The same robustness analysis extends to ReLU networks by replacing the Lipschitz constant with a maximum norm of directional derivatives.The resulting guarantees apply on a convex bounded closed set and retain the theorem’s lower-bound structure.

4 THE CLEVER ROBUSTNESS METRIC VIA EXTREME VALUE THEORY

CLEVER estimates a local cross Lipschitz bound by sampling gradient norms in a perturbation ball and fitting an extreme-value distribution to batch maxima. The resulting score supports targeted and untargeted robustness evaluation without relying on attack results.

  • CLEVER overview: CLEVER is an attack-agnostic robustness score and an efficient estimator of the lower bound βL for arbitrary neural-network classifiers.The method is designed to scale to large networks, including ImageNet classifiers.
  • Local Lipschitz formulation: The lower bound depends on the classifier output margin g(x0) and its local cross Lipschitz constant Lj_q,x0.Here, g(x0) is the difference between the predicted-class and target-class outputs, while Lj_q,x0 is the maximum gradient norm within a perturbation ball.
  • Estimation challenge: Directly maximizing ∥∇g(x)∥q over the ball is difficult in high dimensions, including d = 784, 3072, and 150528 for MNIST, CIFAR, and ImageNet.Exhaustive search is infeasible, and ordinary sampling may require many points without indicating estimate quality.
  • CLEVER computation: The estimator uniformly samples points in a fixed perturbation ball, records each batch maximum, and fits reverse Weibull parameters by maximum likelihood.The estimated location parameter âW serves as the estimate of Lj_q,x0.
  • Extreme-value modeling: Extreme Value Theory models the maxima of sampled gradient norms using one of three limiting families: Gumbel, Fréchet, or reverse Weibull.Because bounded Lipschitz constants imply bounded gradient norms, the reverse Weibull family is used for its finite right endpoint.
  • Targeted and untargeted scores: Targeted CLEVER uses g(x0) and Lj_q,x0 for a specified target class, while untargeted scores are computed analogously through dedicated procedures.Algorithms 1 and 2 summarize the targeted and untargeted computation flows.

5 EXPERIMENTAL RESULTS

Experiments evaluate CLEVER across smaller CIFAR and MNIST networks and large ImageNet architectures, using reverse-Weibull fitting and comparisons with adversarial attacks. CLEVER generally provides a lower-bound robustness estimate, aligns closely with attack distortions, and remains computationally feasible for large networks.

  • Experimental setup: Experiments cover CIFAR, MNIST, and ImageNet, including ResNet-50, Inception-v3, and MobileNet.Smaller datasets use MLP, AlexNet-like CNN, defensive distillation, and bounded-ReLU networks; ImageNet uses three distinct deep architectures.
  • Reverse-Weibull fitting: Reverse-Weibull fitting is validated with maximum-likelihood parameter estimation and Kolmogorov-Smirnov goodness-of-fit testing.The fitted location parameter is used as an estimate of the local cross Lipschitz constant for CLEVER.
  • Attack comparisons: CLEVER is generally smaller than distortions found by targeted and untargeted CW and I-FGSM attacks, consistent with its role as an estimated lower bound.The comparisons include average ℓ2 and ℓ∞ distortions across the evaluated networks.
  • Per-example validation: For MobileNet and ResNet-50, CLEVER is a strict lower bound for more than 96% of tested ImageNet examples.For Inception-v3, the strict-lower-bound rate is still above 75%, and discrepant attack distortions differ only fairly slightly from CLEVER.
  • Per-example validation: Most images show a small positive gap between CLEVER and CW ℓ2 distortion, indicating near-optimality of CW attack distortion in this evaluation.A positive gap means the CLEVER estimated lower bound is below the CW attack’s adversarial distortion.
  • Time versus estimation accuracy: 50 or 100 samples are usually sufficient for reasonably accurate robustness estimation, with per-sample costs of 2.9–8.9 seconds on a GTX 1080 Ti.The reported costs are 2.9 seconds for MobileNet, 5.0 seconds for ResNet-50, and 8.9 seconds for Inception-v3.

6 CONCLUSION

The paper proposes CLEVER as a generic robustness metric for neural classifiers, combining attack independence, broad applicability, theoretical guarantees, and scalability. Experiments show that CLEVER matches practical robustness indications across natural and defended networks.

  • CLEVER is a novel, generic metric for evaluating neural-network robustness to adversarial examples.
  • CLEVER is attack-agnostic, applicable to arbitrary neural-network classifiers, theoretically supported, and computationally feasible for large networks.
  • Extensive experiments show that CLEVER matches practical robustness indications across a wide range of natural and defended networks.

A PROOF OF THEOREM 3.2

The proof derives a lower bound on perturbations needed to change a classifier decision by applying Lipschitz continuity to class-score differences. Taking the minimum bound over competing classes yields a condition under which attacks cannot succeed.

  • Assuming g(x) = f_c(x) − f_j(x) is Lipschitz continuous with constant L_j, the proof bounds changes in the class-score difference.
  • When g(x_0 + δ) = 0, an adversarial example is found, while the Lipschitz bound lower-bounds g(x_0 + δ) using g(x_0) and L_j.
  • The perturbation bound is minimized over every competing class j ≠ c to preserve the classifier’s decision as class c.
  • If the resulting condition holds, the classifier decision can never change and the attack will never succeed.

B PROOF OF COROLLARY 3.2.1

The corollary proof identifies the local Lipschitz constant of a class-score difference with the maximum norm of its gradient over an ℓp ball. This recovers the corresponding robustness bound from prior work.

  • For g = f_c − f_j, the local Lipschitz constant is given by the maximum q-norm of ∇f_j(y) − ∇f_c(y) over B_p(x_0,R).
  • Substituting this gradient-based Lipschitz expression yields the bound in Theorem 2.1 of Hein and Andriushchenko (2017).

C PROOF OF LEMMA 3.3

The lemma extends Lipschitz reasoning to ReLU networks by partitioning a line segment at finitely many nondifferentiable activation points. Applying the fundamental theorem of calculus on each interval establishes the distance-based bound.

  • For points x and y, the proof reduces h(y) − h(x) to a univariate function along the line segment joining them.
  • Directional derivatives along that segment are bounded by L_q when the relevant one-sided derivatives agree.
  • A ReLU network has finitely many points along the segment where g′(z) does not exist, allowing the segment to be partitioned into differentiable intervals.
  • Applying the fundamental theorem of calculus separately on those intervals establishes the bound L_q∥x − y∥_p.

D THEOREM D.1 AND ITS PROOF

Theorem D.1 characterizes gradient norms of a one-hidden-layer ReLU network under uniform sampling in a ball. ReLU hyperplanes partition the input space into regions where gradient norms are constant, yielding a discrete distribution with a piece-wise constant CDF.

  • Theorem D.1 states that the CDF of ||∇g(x)||q under uniform sampling in Bp(x0, R) is piece-wise linear with at most M regions.Here g(x) = fc(x) − fj(x), and M bounds the number of distinct gradient-norm values.
  • The network output difference g(x) is formed from the two selected outputs through the hidden-layer ReLU activations.The proof uses the first- and second-layer weight matrices and an indicator for whether each ReLU is active.
  • ReLU hyperplanes wrx + br = 0 partition Rd into regions defined by activation-sign constraints.A point’s region is identified by checking the signs of wrx + br for every hidden neuron.
  • All points in the same activation region have the same gradient norm ||∇g(x)||q.Thus, the gradient norm is determined by the region’s active and inactive ReLU units.
  • Uniform sampling makes Y = ||∇g(x)||q a discrete random variable with at most M distinct values and a piece-wise constant CDF.The CDF increases according to the volume of each gradient-norm region intersected with the sampling ball.

E.1 PERCENTAGE OF EXAMPLES HAVING P VALUE > 0.05

The paper evaluates whether maximum gradient-norm samples fit the reverse Weibull distribution and examines how CLEVER changes with sample count. The reported tests support the distributional fit, while scores are generally stable across tested sample sizes except for MNIST-BReLU.

  • Table 5 reports that maximum gradient norm samples fit the reverse Weibull distribution well according to K-S tests.The table gives the percentage of examples for which the null hypothesis cannot be rejected at significance level 0.05.
  • CLEVER scores change only slightly when sample counts increase from Nb = 50, 100, 250, to 500 for most models except MNIST-BReLU.Figure 9 compares these sample counts on MNIST and CIFAR models with CW attack distortion.
  • For MNIST-BReLU, increasing the number of samples improves the estimated lower bound, favoring a larger Nb.The paper recommends trying progressively larger sample counts when CLEVER scores may change significantly.
Loading 1801.10578v1…