Optimising Network Architectures for Provable Adversarial Robustness

Existing Lipschitz-based provable defences to adversarial examples only cover the L
₂
threat model. We introduce the first bound that makes use of Lipschitz continuity to provide a more general guarantee for threat models based on any L
_p
norm. Additionally, a new strategy is proposed for designing network architectures that exhibit superior provable adversarial robustness over conventional convolutional neural networks. Experiments are conducted to validate our theoretical contributions, show that the assumptions made during the design of our novel architecture hold in practice, and quantify the empirical robustness of several Lipschitz-based adversarial defence methods.