Efficient Bi-Directional Verification of ReLU Networks via Quadratic Programming

1 INTRODUTION . The high predictive power of neural network classifiers makes them the method of choice to tackle challenging classification problems in many areas . However , questions regarding the robustness of their performance under slight input perturbations still remain open , severely limiting the applicability of deep neural net classifiers to sensitive tasks that require certification of the obtained results . In recent years this issue gained a lot of attention , resulting in a large variety of methods tackling tasks ranging from adversarial attacks and defenses against these to robustness verification and robust training . In this work we focus on robustness verification of deep classifiers . That is , computing the distance from a given anchor point x0 in the input space to its closest adversarial , i.e . a point that is assigned a different class label by the network . This problem plays a fundamental role in understanding the behavior of deep classifiers and essentially provides the only reliable way to assess classifier robustness . Unfortunately , its complexity class does not allow a polynomial time algorithm . For deep classifiers with ReLU activation the verification problem can equivalently be reformulated as a mixed integer programming ( MIP ) task and was shown to be NP-complete by Katz et al . ( 2017 ) . Even worse , Weng et al . ( 2018 ) showed that an approximation of the minimum adversarial perturbation of a certain ( high ) quality can not be found within polynomial time . Related work There exist three streams of related work on robustness verification of deep ReLU classifiers . This categorization is based on whether they are solving the verification problem exactly or verifying a bound on the distance to the decision boundary ( DtDB ) . The first group of methods are exact verification approaches . As mentioned above , the verification task can be modeled using MIP techniques . Katz et al . ( 2017 ) present a modification of the simplex algorithm that can be used to solve the verification task exactly for smaller ReLU networks based on satisfiable modulo theory ( SMT ) . Other approaches ( see Ehlers ( 2017 ) ) rely on SMT solvers when solving the described task . Bunel et al . ( 2018 ) provide an overview and comparison of those . Other exact methods ( Dutta et al . ( 2018 ) ; Lomuscio and Maganti ( 2017 ) ; Tjeng et al . ( 2017 ) ) deploy MIP solvers together with presolving to find a tight formulation of the MIP problem or ( Jordan et al . ( 2018 ) ) use an algorithm to find the largest ball around the anchor point that touches the decision boundary . The second popular class of methods for verifying classifier robustness deals with verification of an -neighborhood : given an anchor point x0 and an > 0 , the task is to verify whether an adversarial point exists within the neighborhood of x0 which is defined with respect to a certain norm in the input space . All existing methods relax the initial problem and require bounds on activation inputs in each layer . These bounds should be as tight as possible to ensure good final results . Raghunathan et al . ( 2018a ; b ) ; Dvijotham et al . ( 2018 ; 2019 ) consider semidefinite ( SDP ) and linear ( LP ) problems as relaxations of the -verification problem . Wong and Kolter ( 2018 ) replace ReLU constraints by linear constraints and consider the dual formulation of the obtained LP relaxation . Weng et al . ( 2018 ) present an approach that also uses linear functions ( later extended to quadratic functions by Zhang et al . ( 2018 ) ) to deal with nonlinear activation functions and propagate the layer-wise output bounds until the final layer . Finally Hein and Andriushchenko ( 2017 ) ; Tsuzuku et al . ( 2018 ) use the Lipschitz constant of the transformations within classifier ’ s architecture . Our approach belongs to the third group of approaches dealing with constructing lower bounds on DtDB without restricting admissible adversarial points to a given neighborhood . The -verification task is closely related to the problem of constructing lower bounds on DtDB : each -neighborhood that can be certified as adversarial-free immediately provides a lower bound on the minimal adversarial perturbation magnitude . It is also a common strategy for the methods from the previous group to use a binary search or a Newton method on top of their algorithm to find the largest such that the -neighborhood around x0 can still be verified as robust . Croce et al . ( 2019 ) leverage the piecewise affine nature of the outputs of a ReLU classifier and compute lower bounds on DtDB by assuming that the classifier behaves globally the same way it does in the linear region around the given anchor point . Adversarial attacks Constructing misclassified examples that are close to the anchor point can be considered as a complementary research direction to robustness verification since each adversarial example by definition provides an upper bound on the DtDB . Many methods were proposed to construct such points ( Szegedy et al . ( 2014 ) ; Goodfellow et al . ( 2015 ) ; Kurakin et al . ( 2016 ) ; Papernot et al . ( 2016 ) ; Madry et al . ( 2017 ) ; Carlini and Wagner ( 2017 ) . Robust training The question of how to actually train a robust classifier is closely related to robustness verification since the latter might allow us to construct some type of robust loss based on the insights from the verification procedure ( see Hein and Andriushchenko ( 2017 ) ; Madry et al . ( 2017 ) ; Wong and Kolter ( 2018 ) ; Raghunathan et al . ( 2018a ) ; Tsuzuku et al . ( 2018 ) ; Wang et al . ( 2018 ) ; Croce et al . ( 2019 ) ) . We leave this direction for future work . Contributions 1 . We propose a novel relaxation of the DtDB problem in form of a QP task allowing efficient computation of high quality lower bounds on the DtDB in l2-norm with an extension to l∞-norm . For networks with up to two hidden layers we reach state-of-the-art performance with an improvement of over 50 % when compared to the bounds obtained from methods based on LP relaxations ( CROWN by Zhang et al . ( 2018 ) and ConvAdv by Wong and Kolter ( 2018 ) ) . Furthermore , our method performs much faster than methods based on SDP relaxations ( Raghunathan et al. , 2018b ) , while providing smaller lower bounds . This is a fundamental property due to the difference in computational complexity between SDP and QP tasks . 2 . Unlike -verification techniques , we provide a lower bound on DtDB without an initial guess and without computing bounds for the neuron activation values in each layer . Such bounds have to be tight enough to verify non-trivial neighborhoods and play an important role in other relaxation techniques such as the SDP based approaches by Raghunathan et al . ( 2018b ) ; Dvijotham et al . ( 2019 ) . 3 . In addition to computing the lower bounds after solving a single QP , our approach allows to construct adversarial examples by repeatedly choosing a new anchor on the boundary of the verified region and solving its associated QP . One of the main limitations of competing inexact approaches is the fact that the situation around the given anchor point outside of the certified radius remains unclear . Since these approaches rely on relaxations of the initial problem , failed certification does not indicate the presence of an adversarial example . Instead , when using these methods , one must rely on externally constructed adversarial examples to obtain an upper bound . We present a bi-directional robustness verification technique that uses the verification mechanism itself to construct upper bounds and assess the quality of the lower bounds . 2 NOTATION AND IDEA . We consider a neural network consisting of L linear transformations representing dense , convolutional , skip or average pooling layers and L− 1 ReLU activations ( no activation after the last hidden layer ) . The number of neurons in layer l is denoted as nl for l = 0 , . . . , L , meaning that the data has n0 features and nL classes . Furthermore , we present our analysis for the l2-norm as perturbation magnitude measure since only few available methods are applicable to this setting . To make our method comparable with Raghunathan et al . ( 2018b ) a generalization to l∞-perturbations is addressed in Appendix A . Given sample x0 ∈ Rn0 , weight matrices W l ∈ Rnl×nl−1 , and bias vectors bl ∈ Rnl , we define the output of the i-th neuron in the l-th layer after the ReLU activation as xli = [ W lix l−1 + bli ] + and ( 1 ) fi ( x 0 ) = xLi = W L i x L−1 + bLi where [ x ] + is the positive part of x and f ( x 0 ) = xL denotes the output of the complete forward pass through the network . We start with the observation that the ReLU activation function acts as one of two linear functions depending on its input ’ s sign . That allows us to reformulate it ( see Section 3.1 ) and obtain an optimization problem with so called linear complementarity constraints ( also used by Raghunathan et al . ( 2018b ) ; Dvijotham et al . ( 2019 ) for -verification ) . Note that for each pair of scalars a and b the following holds . b = [ a ] + ⇐⇒ b ≥ 0 , b− a ≥ 0 , b ( b− a ) = 0 ( 2 ) 3 OPTIMIZATION PROBLEM . 3.1 FORMULATION OF DTDB . For a given sample x̃0 , pre-trained neural net f , predicted label ỹ and target label y we aim to find the closest point to x̃0 in Rn0 that has a larger or equal probability of being classified as y compared to the initial label . This can be done by solving the following optimization problem . min x0∈Rn0 ‖x0 − x̃0‖2 , s.t . ( eỹ − ey ) T f ( x0 ) ≤ 0 , ( DtDB ) where ei is the i-th unit vector in RnL and ‖x‖ denotes the Euclidean norm of x . Note that we explore the boundary between classes y and ỹ around x̃0 . To compute the distance from x̃0 to the ( full ) decision boundary , one needs t compute the solution for all target labels y = 1 , . . . , nL except ỹ . We can “ unfold ” the above optimization problem using ( 1 ) , where x denotes a container with all variables x0 , . . . , xL . min x∈Rn ‖x0 − x̃0‖2 , s.t . ( eỹ − ey ) TxL ≤ 0 , xL = WLxL−1 + bL xl = ReLU ( W lxl−1 + bl ) for l = 1 , . . . , L− 1 We apply ( 2 ) to reformulate the problem and eliminate xL , such that from now on x contains only the remaining variables x0 , . . . , xL−1 and n = n0 + . . .+ nL−1 . min x∈Rn ‖x0 − x̃0‖2 , s.t . ( eỹ − ey ) T ( WLxL−1 + bL ) ≤ 0 ( DtDB ) ( xl ) T ( xl − ( W lxl−1 + bl ) ) = 0 for l = 1 , . . . , L− 1 ( 3 ) xl − ( W lxl−1 + bl ) ≥ 0 , xl ≥ 0 for l = 1 , . . . , L− 1 ( 4 )

Summary: This paper proposes a method to compute the distance to the decision boundary for a given network, where the network is composed of linear layers followed by a RELU activation. The authors provide a lower bound and an upper bound for the distance of a sample from the decision boundary. The lower bound is obtained as the solution to a quadratic program, which in turn is obtained by relaxing the original optimization problem. The relaxation is obtained by decomposing the RELU condition to a set of 3 constraints (eqn 2). The authors also provide conditions under which the quadratic program stays convex.