Boosting Robustness Verification of Semantic Feature Neighborhoods

Deep neural networks have been shown to be vulnerable adversarial attacks that perturb inputs based on semantic features. Existing robustness analyzers can reason about feature neighborhoods increase the networks’ reliability. However, despite significant progress in these techniques, they still struggle scale deep and large neighborhoods. In this work, we introduce VeeP, an active learning approach splits verification process into a series of smaller steps, each is submitted existing analyzer. The key idea build prior steps predict next optimal step. step predicted by estimating analyzer’s velocity sensitivity via parametric regression. We evaluate VeeP MNIST, Fashion-MNIST, CIFAR-10 ImageNet show it analyze various features: brightness, contrast, hue, saturation, lightness. that, average, given 90 minute timeout, verifies 96% maximally certifiable within 29 minutes, while splitting approaches verify, 73% 58 minutes.