{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/automatic-perturbation-analysis-on-general","title":"Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond","arxiv_id":"2002.12920","date":"2020-02-28","proceeding":"NeurIPS 2020 12","authors":["Kaidi Xu","Zhouxing Shi","huan zhang","Yihan Wang","Kai-Wei Chang","Minlie Huang","Bhavya Kailkhura","Xue Lin","Cho-Jui Hsieh"],"abstract":"Linear relaxation based perturbation analysis (LiRPA) for neural networks, which computes provable linear bounds of output neurons given a certain amount of input perturbation, has become a core component in robustness verification and certified defense. The majority of LiRPA-based methods focus on simple feed-forward networks and need particular manual derivations and implementations when extended to other architectures. In this paper, we develop an automatic framework to enable perturbation analysis on any neural network structures, by generalizing existing LiRPA algorithms such as CROWN to operate on general computational graphs. The flexibility, differentiability and ease of use of our framework allow us to obtain state-of-the-art results on LiRPA based certified defense on fairly complicated networks like DenseNet, ResNeXt and Transformer that are not supported by prior works. Our framework also enables loss fusion, a technique that significantly reduces the computational complexity of LiRPA for certified defense. For the first time, we demonstrate LiRPA based certified defense on Tiny ImageNet and Downscaled ImageNet where previous approaches cannot scale to due to the relatively large number of classes. Our work also yields an open-source library for the community to apply LiRPA to areas beyond certified defense without much LiRPA expertise, e.g., we create a neural network with a probably flat optimization landscape by applying LiRPA to network parameters. Our opensource library is available at https://github.com/KaidiXu/auto_LiRPA.","url_abs":"https://arxiv.org/abs/2002.12920v3","url_pdf":"https://arxiv.org/pdf/2002.12920v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/KaidiXu/auto_LiRPA","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/Verified-Intelligence/alpha-beta-CROWN_vnncomp2024","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/avrahamraviv/formal-verification-of-object-detection","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/huanzhang12/CROWN-IBP","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"BSD-2-Clause"}},{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/huanzhang12/alpha-beta-CROWN","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}},{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/shizhouxing/Robustness-Verification-for-Transformers","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null},{"paper_slug":"automatic-perturbation-analysis-on-general","repo_url":"https://github.com/verified-intelligence/alpha-beta-crown","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"quantization","task_name":"Quantization"}],"methods":[{"method_slug":"1x1-convolution","method_name":"1x1 Convolution"},{"method_slug":"absolute-position-encodings","method_name":"Absolute Position Encodings"},{"method_slug":"adam","method_name":"Adam"},{"method_slug":"attention","method_name":"Attention"},{"method_slug":"average-pooling","method_name":"Average Pooling"},{"method_slug":"bpe","method_name":"BPE"},{"method_slug":"batch-normalization","method_name":"Batch Normalization"},{"method_slug":"concatenated-skip-connection","method_name":"Concatenated Skip Connection"},{"method_slug":"convolution","method_name":"Convolution"},{"method_slug":"dense-block","method_name":"Dense Block"},{"method_slug":"dense-connections","method_name":"Dense Connections"},{"method_slug":"dropout","method_name":"Dropout"},{"method_slug":"global-average-pooling","method_name":"Global Average Pooling"},{"method_slug":"grouped-convolution","method_name":"Grouped Convolution"},{"method_slug":"kaiming-initialization","method_name":"Kaiming Initialization"},{"method_slug":"label-smoothing","method_name":"Label Smoothing"},{"method_slug":"layer-normalization","method_name":"Layer Normalization"},{"method_slug":"linear-layer","method_name":"Linear Layer"},{"method_slug":"max-pooling","method_name":"Max Pooling"},{"method_slug":"multi-head-attention","method_name":"Multi-Head Attention"},{"method_slug":"position-wise-feed-forward-layer","method_name":"Position-Wise Feed-Forward Layer"},{"method_slug":"relu","method_name":"ReLU"},{"method_slug":"resnext","method_name":"ResNeXt"},{"method_slug":"resnext-block","method_name":"ResNeXt Block"},{"method_slug":"residual-connection","method_name":"Residual Connection"},{"method_slug":"softmax","method_name":"Softmax"},{"method_slug":"transformer","method_name":"Transformer"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2002.12920","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2002.12920"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/KaidiXu/auto_LiRPA","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/Verified-Intelligence/alpha-beta-CROWN_vnncomp2024","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/huanzhang12/CROWN-IBP","reach":{"status":"ok","spdx":"BSD-2-Clause"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/verified-intelligence/alpha-beta-crown","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/huanzhang12/alpha-beta-CROWN","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/avrahamraviv/formal-verification-of-object-detection","reach":null},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/shizhouxing/Robustness-Verification-for-Transformers","reach":null}],"summary":{"ran":2,"ran_draft_wrong":1,"ran_violates":2,"unverified":13},"by_repo_kind":{"listed":{"samples":18,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"62000ff4e804fe8d","entry":"argparser","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"argparser.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/argparser.py","link_basis":"plan_row","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"62000ff4e804fe8d"}},{"code_sha256_prefix":"778274b3fb463e7e","entry":"batch","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"convex_adversarial/dual_layers.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/convex_adversarial/dual_layers.py","link_basis":"plan_row","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"778274b3fb463e7e"}},{"code_sha256_prefix":"2f8e524a282482b9","entry":"isfloat","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"argparser.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/argparser.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"2f8e524a282482b9"}},{"code_sha256_prefix":"10119e52ad9b6cf6","entry":"isint","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"argparser.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/argparser.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"10119e52ad9b6cf6"}},{"code_sha256_prefix":"9efb427bc4cdf3df","entry":"unbatch","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"convex_adversarial/dual_layers.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/convex_adversarial/dual_layers.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"9efb427bc4cdf3df"}},{"code_sha256_prefix":"c41b33e06e9006fb","entry":"cifar_loaders","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"datasets.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/datasets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"c41b33e06e9006fb"}},{"code_sha256_prefix":"03ba17f5b2a279b2","entry":"get_file_close","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"config.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/config.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"03ba17f5b2a279b2"}},{"code_sha256_prefix":"368ba58e4dcc5a2a","entry":"get_model_meta","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"converter/mnist_cifar_models.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/converter/mnist_cifar_models.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"368ba58e4dcc5a2a"}},{"code_sha256_prefix":"63f0738b7f84b19d","entry":"get_model_meta_real","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"converter/mnist_cifar_models.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/converter/mnist_cifar_models.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"63f0738b7f84b19d"}},{"code_sha256_prefix":"1692f72216960bf3","entry":"get_stats","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"datasets.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/datasets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"1692f72216960bf3"}},{"code_sha256_prefix":"6fd34470e7a5aa5d","entry":"load_config","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"config.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/config.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"6fd34470e7a5aa5d"}},{"code_sha256_prefix":"5a918baac3f47e20","entry":"mnist_loaders","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"datasets.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/datasets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"5a918baac3f47e20"}},{"code_sha256_prefix":"c04566214aef8894","entry":"model_cnn_1layer","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"model_defs.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/model_defs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"c04566214aef8894"}},{"code_sha256_prefix":"536b44e648824359","entry":"model_mlp_any","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"model_defs.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/model_defs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"536b44e648824359"}},{"code_sha256_prefix":"1d4d589798bf1c33","entry":"model_mlp_uniform","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"model_defs.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/model_defs.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"1d4d589798bf1c33"}},{"code_sha256_prefix":"23b6aa5bec1fc235","entry":"robust_loss","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"convex_adversarial/dual_network.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/convex_adversarial/dual_network.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"23b6aa5bec1fc235"}},{"code_sha256_prefix":"1cc8bc10c156fe29","entry":"robust_loss_parallel","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"convex_adversarial/dual_network.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/convex_adversarial/dual_network.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"1cc8bc10c156fe29"}},{"code_sha256_prefix":"346b1abd4961b091","entry":"update_dict","repo":"huanzhang12/CROWN-IBP","repo_kind":"listed","path":"config.py","file_url":"https://github.com/huanzhang12/CROWN-IBP/blob/HEAD/config.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"BSD-2-Clause","inline_ok":true,"mcp_get_code":{"code_sha256":"346b1abd4961b091"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}