Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
A method for training neural networks that are provably robust to adversarial attacks.
| Date | Stars |
|---|---|
| 2026-07-31 | 392 |
| 2026-08-06 | 392 |
| 2026-08-07 | 392 |
| 2026-08-14 | 392 |
| 2026-08-15 | 392 |
| 2026-08-18 | 392 |
| 2026-09-20 | 392 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# Provably robust neural networks
*A repository for training provably robust neural networks by optimizing convex outer bounds on the adversarial polytope. Created by [Eric Wong](https://riceric22.github.io) and [Zico Kolter](http://zicokolter.com). [Link to the original arXiv paper][paper]. The method has been further extended to be fully modular, scalable, and use cascades to improve robust error. Check out our new paper on arXiv: [Scaling provable adversarial defenses][scalable_paper].*
[paper]: https://arxiv.org/abs/1711.00851
[scalable_paper]: https://arxiv.org/abs/1805.12514
## News
+ 10/30/2018 - Version 0.4 released to reflect the NIPS final copy. Added
model weights for all models described in the paper.
+ 7/26/2018 - Version 0.3.3 code refactor
+ 6/2/2018 - Version 0.3.1 released to reflect the new paper.
+ 5/31/2018 - New paper on a scalable version for models with skip connections
and a fully modular implementation for simple extension. Code base with these
improvements with a port to PyTorch 0.4 will be released shortly.
+ 4/26/2018 - Added robust models from the paper to the `models/` folder in the
repository.
+ 3/4/2018 - Updated paper with more experiments. Code migrated to work with
PyTorch 0.3.0+. Real mini-batching implemented, with a 5x speedup over the
old codebase, and several NaN bugfixes.
+ 12/8/2017 - Best defense paper at the NIPS 2017 ML & Security Workshop
+ 11/2/2017 - Initial preprint and release of codebase.
## Installation & Usage
You can install this repository with
`pip install convex_adversarial`
If you wish to have the version of code that reflects the first paper, use
`pip install convex_adversal=0.2`, or clone the [0.2 release on Github](https://github.com/locuslab/convex_adversarial/tree/v0.2).
The package contains the following functions:
+ `robust_loss(net, epsilon, X, y, l1_proj=None,
l1_type='exact', bounded_input=False, size_average=True)`
computes a robust loss function for a given ReLU network `net` and l1
radius `epsilon` for examples `X` and their labels `y`. You can use
this as a drop in replacement for, say, `nn.CrossEntropyLoss()`, and is
equivalent to the objective of Equation 14 in the original paper.
To use the scalable version, specify a projection dimension with `l1_proj`
and set `l1_type` to `median`.
+ `robust_loss_parallel` computes the same objective as `robust_loss`, but
only for a *single* example and using
data parallelism. This is useful for exact evaluation if a single
example doesn't fit in memory.
+ `dual_net = DualNetwork(net, X, epsilon, l1_proj=None, l1_type='exact', bounded_input=False)`
is a PyTorch module that computes the layer-wise upper and lower bounds for
all activations in the network. This is useful if you are only interested
in the bounds and not the robust loss, and corresponds to Algorithm
1 in the paper.
+ `dual_net(c)` is the module's forward pass which computes the lower
bound on the primal problem described in the paper for a given
objective vector c. This corresponds to computing objective of Theorem 1 in
the paper (Equation 5).
## Why do we need robust networks?
While networks are capable of representing highly complex functions. For
example, with today's networks it is an easy task to achieve 99% accuracy on
the MNIST digit recognition dataset, and we can quickly train a small network
that can accurately predict that the following image is a 7.
<img src="https://github.com/locuslab/convex_adversarial.release/blob/master/images/seven.png" width="100">
However, the versatility of neural networks comes at a cost: these networks
are highly susceptible to small perturbations, or adversarial attacks (e.g. the [fast gradient sign method](https://arxiv.org/abs/1412.6572) and [projected gradient descent](https://arxiv.org/abs/1706.06083))! While
most of us can recognize that the following image is still a 7, the same
network thatExcerpt of 12,893 characters
Read on GitHubWould you bet a product on this? Bounded 0–100 and slow moving.
matched fp:a1764533df3229c5, llm:description: 'A method for training neural networks that are provably robust to adversarial attacks.'
matched fp:a1764533df3229c5, llm:description: 'A method for training neural networks that are provably robust to adversarial attacks.'