Finding minimum distortion of adversarial examples and thus certifying robustness in neural networks classifiers is known to be a challenging problem. Nevertheless, recently it has been shown to be possible to give a non-trivial certified lower bound of minimum distortion, and some recent progress has been made towards this direction by exploiting the piece-wise linear nature of ReLU activations. However, a generic robustness certification for \textit{general} activation functions still remains largely unexplored. To address this issue, in this paper we introduce CROWN, a general framework to certify robustness of neural networks with general activation functions. The novelty in our algorithm consists of bounding a given activation function with linear and quadratic functions, hence allowing it to tackle general activation functions including but not limited to the four popular choices: ReLU, tanh, sigmoid and arctan. In addition, we facilitate the search for a tighter certified lower bound by \textit{adaptively} selecting appropriate surrogates for each neuron activation. Experimental results show that CROWN on ReLU networks can notably improve the certified lower bounds compared to the current state-of-the-art algorithm Fast-Lin, while having comparable computational efficiency. Furthermore, CROWN also demonstrates its effectiveness and flexibility on networks with general activation functions, including tanh, sigmoid and arctan.

We introduce a probability distribution, combined with an efficient sampling algorithm, for weights and biases of fully-connected neural networks.

Consequently, these methods can hardly be deployed on resource-limited mobile devices.

Neural Information Processing Systems http://nips.cc/

SNR = 10 log10 2 Figure 1: AWGNchannelwithnoisyfeedback (left). Figure 5: Noiseinfirstphasevs. firstparitybit (left) andsecondparitybit (right).

In the preliminary "Res3D+ConvLSTM+MobileNet" architecture, the blocks 1-4 of Res3D [16] are used first to learn the local short-term spatiotemporal feature maps which have a relativelylargespatialsize.