8 research outputs found
Probabilistic Safety for Bayesian Neural Networks
We study probabilistic safety for Bayesian Neural Networks (BNNs) under
adversarial input perturbations. Given a compact set of input points, , we study the probability w.r.t. the BNN posterior that
all the points in are mapped to the same region in the output space. In
particular, this can be used to evaluate the probability that a network sampled
from the BNN is vulnerable to adversarial attacks. We rely on relaxation
techniques from non-convex optimization to develop a method for computing a
lower bound on probabilistic safety for BNNs, deriving explicit procedures for
the case of interval and linear function propagation techniques. We apply our
methods to BNNs trained on a regression task, airborne collision avoidance, and
MNIST, empirically showing that our approach allows one to certify
probabilistic safety of BNNs with millions of parameters.Comment: UAI 2020; 13 pages, 5 figures, 1 tabl
On the Robustness of Bayesian Neural Networks to Adversarial Attacks
Vulnerability to adversarial attacks is one of the principal hurdles to the
adoption of deep learning in safety-critical applications. Despite significant
efforts, both practical and theoretical, training deep learning models robust
to adversarial attacks is still an open problem. In this paper, we analyse the
geometry of adversarial attacks in the large-data, overparameterized limit for
Bayesian Neural Networks (BNNs). We show that, in the limit, vulnerability to
gradient-based attacks arises as a result of degeneracy in the data
distribution, i.e., when the data lies on a lower-dimensional submanifold of
the ambient space. As a direct consequence, we demonstrate that in this limit
BNN posteriors are robust to gradient-based adversarial attacks. Crucially, we
prove that the expected gradient of the loss with respect to the BNN posterior
distribution is vanishing, even when each neural network sampled from the
posterior is vulnerable to gradient-based attacks. Experimental results on the
MNIST, Fashion MNIST, and half moons datasets, representing the finite data
regime, with BNNs trained with Hamiltonian Monte Carlo and Variational
Inference, support this line of arguments, showing that BNNs can display both
high accuracy on clean data and robustness to both gradient-based and
gradient-free based adversarial attacks.Comment: arXiv admin note: text overlap with arXiv:2002.0435
Probabilistic safety for bayesian neural networks
We study probabilistic safety for Bayesian
Neural Networks (BNNs) under adversarial input perturbations. Given a compact set of input points, T ⊆ R
m, we study the probability w.r.t. the BNN posterior that all the points
in T are mapped to the same region S in the
output space. In particular, this can be used
to evaluate the probability that a network sampled from the BNN is vulnerable to adversarial
attacks. We rely on relaxation techniques from
non-convex optimization to develop a method
for computing a lower bound on probabilistic safety for BNNs, deriving explicit procedures for the case of interval and linear function propagation techniques. We apply our
methods to BNNs trained on a regression task,
airborne collision avoidance, and MNIST, empirically showing that our approach allows one
to certify probabilistic safety of BNNs with
millions of parameters