High sensitivity of neural networks against malicious perturbations on inputs
causes security concerns. To take a steady step towards robust classifiers, we
aim to create neural network models provably defended from perturbations. Prior
certification work requires strong assumptions on network structures and
massive computational costs, and thus the range of their applications was
limited. From the relationship between the Lipschitz constants and prediction
margins, we present a computationally efficient calculation technique to
lower-bound the size of adversarial perturbations that can deceive networks,
and that is widely applicable to various complicated networks. Moreover, we
propose an efficient training procedure that robustifies networks and
significantly improves the provably guarded areas around data points. In
experimental evaluations, our method showed its ability to provide a
non-trivial guarantee and enhance robustness for even large networks.

针对神经网络模型在输入数据遭到恶意篡改时的高敏感度，提出一种能够证明防御网络免受攻击的模型的构建方法，通过计算 Lipschitz 常数与预测边界之间的关系，提出一种计算有效的对不同的复杂网络广泛适用的鉴别器大小的方法，并提出一种有效的训练程序，提高数据点周围可证明的保护区域和网络的鲁棒性。