Finding minimum distortion of adversarial examples and thus certifying
robustness in neural network classifiers for given data points is known to be a
challenging problem. Nevertheless, recently it has been shown to be possible to
give a non-trivial certified lower bound of minimum adversarial distortion, and
some recent progress has been made towards this direction by exploiting the
piece-wise linear nature of ReLU activations. However, a generic robustness
certification for general activation functions still remains largely
unexplored. To address this issue, in this paper we introduce CROWN, a general
framework to certify robustness of neural networks with general activation
functions for given input data points. The novelty in our algorithm consists of
bounding a given activation function with linear and quadratic functions, hence
allowing it to tackle general activation functions including but not limited to
four popular choices: ReLU, tanh, sigmoid and arctan. In addition, we
facilitate the search for a tighter certified lower bound by adaptively
selecting appropriate surrogates for each neuron activation. Experimental
results show that CROWN on ReLU networks can notably improve the certified
lower bounds compared to the current state-of-the-art algorithm Fast-Lin, while
having comparable computational efficiency. Furthermore, CROWN also
demonstrates its effectiveness and flexibility on networks with general
activation functions, including tanh, sigmoid and arctan.

该论文介绍了一种名为 CROWN 的通用框架，可以证明具有一般激活函数的神经网络分类器对于给定的输入数据点是健壮的，通过绑定给定激活函数的线性和二次函数，从而可以处理包括但不限于 ReLU、tanh、sigmoid 和 arctan 在内的一般激活函数，同时在可比的计算效率下，在 ReLU 网络上 CROWN 可以显着提高认证下限，同时 CROWN 能够展示其对包括 tanh、sigmoid 和 arctan 在内的具有一般激活函数的网络的有效性和灵活性。