Reference implementations for RecurJac, CROWN, FastLin and FastLip (Neural Network verification and robustness certification algorithms) [Do not use this repo, use https://github.com/Verified-Intelligence/auto_LiRPA instead]
base) root@dda65b730206:/home/RecurJac-and-CROWN-master# python3 main.py --task robustness --numimage 10 --targettype random --norm i --modelfile ../models/mnist_3layer_relu_1024_adv_retrain --layerbndalg crown-adaptive --jacbndalg recurjac --eps 0.2
Loading model ../models/mnist_3layer_relu_1024_adv_retrain
2021-07-26 08:37:45.812888: I tensorflow/core/platform/cpu_feature_guard.cc:142] This TensorFlow binary is optimized with oneAPI Deep Neural Network Library (oneDNN) to use the following CPU instructions in performance-critical operations: SSE4.1 SSE4.2 AVX AVX2 FMA
To enable them in other operations, rebuild TensorFlow with the appropriate compiler flags.
WARNING:tensorflow:No training configuration found in the save file, so the model was not compiled. Compile it manually.
Model imported using keras
Traceback (most recent call last):
File "/home/RecurJac-and-CROWN-master/main.py", line 145, in
if input_dim[2] == 28 or input_dim[2] == "28":
IndexError: list index out of range
I would also like to ask if the “crown-interval" in this code can support CROWN-IBP type of robustness boundary calculation?
And in "boundary_base.py line 188", when determining "layerbndalg == "crown-interval"", is it only for ReLU activation function? Why do I need to call crown_adaptive_bound after interval_bound?is this a CROWN-IBP-like boundary calculation?
With this repo, is there an easy way to get the local Lipschitz constant of a customized Pytorch CNN on a given image, using the RecurJac method? Thanks.
I'm interested in running your certifiable robustness code on a small network (MobileNetV2) that I've trained on CIFAR10. I noticed you have instructions on how to train a network to then certify, but what code should I modify to use my own network?
Why should back propagate to the first layer to calculate Global bounds by Λ(0) and Ω(0)?will the Global bounds obtained this way be more accurate(tighter)?