Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification

1 Introduction . As neural networks ( NNs ) are being deployed in safety-critical applications , it becomes increasingly important to formally verify their behaviors under potentially malicious inputs . Broadly speaking , the neural network verification problem involves proving certain desired relationships between inputs and outputs ( often referred to as specifications ) , such as safety or robustness guarantees , for all inputs inside some domain . Canonically , the problem can be cast as finding the global minima of some functions on the network ’ s outputs ( e.g. , the difference between the predictions of the true label and another target label ) , within a bounded input set as constraints . This is a challenging problem due to the non-convexity and high dimensionality of neural networks . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . We first focus on complete verification : the verifier should give a definite “ yes/no ” answer given sufficient time . Many complete verifiers rely on the branch and bound ( BaB ) method [ 8 ] involving ( 1 ) branching by recursively splitting the original verification problem into subdomains ( e.g. , splitting a ReLU neuron into positive/negative linear regions by adding split constraints ) and ( 2 ) bounding each subdomain with specialized incomplete verifiers . Traditional BaB-based verifiers use expensive linear programming ( LP ) solvers [ 15 , 23 , 7 ] as incomplete verifiers which can fully encode neuron split constraints . Meanwhile , a recent verifier , Fast-and-Complete [ 45 ] , demonstrates that cheap incomplete verifiers can significantly accelerate complete verification on GPUs over LP-based ones thanks to their efficiency . Many cheap incomplete verifiers are based on bound propagation methods [ 46 , 42 , 41 , 13 , 17 , 36 , 44 ] , i.e. , maintaining and propagating tractable and sound bounds through networks , and CROWN [ 46 ] is a representative which propagates a linear or quadratic bound . However , unlike LP based verifiers , existing bound propagation methods lack the power to handle neuron split constraints introduced by BaB . For instance , given inputs x , y 2 [ 1 , 1 ] , they can bound a ReLU ’ s input x + y as [ 2 , 2 ] but they have no means to consider neuron split constraints such as x y 0 introduced by splitting another ReLU to the positive linear region . Such a problem causes looser bounds and unnecessary branching , hurting the verification efficiency . Even worse , without considering these split constraints , bound propagation methods can not detect many infeasible subdomains in BaB [ 45 ] , leading to incompleteness unless costly checking is performed . In our work , we develop a new , fast bound propagation based incomplete verifier , -CROWN . It solves an optimization problem equivalent to the expensive LP based methods with neuron split constraints while still enjoying the efficiency of bound propagation methods . -CROWN contains optimizable parameters which come from propagation of Lagrangian multipliers , and any valid settings of these parameters yield sound bounds for verification . These parameters are optimized using a few steps of ( super ) gradient ascent to achieve bounds as tight as possible . Optimizing can also eliminate many infeasible subdomains and avoid further useless branching . Furthermore , we can jointly optimize intermediate layer bounds similar to [ 44 ] but also with the additional parameters , allowing - CROWN to tighten relaxations and outperform typical LP verifiers with fixed intermediate layer bounds . Unlike traditional LP-based BaB methods , -CROWN can be efficiently implemented with an automatic differentiation framework on GPUs to fully exploit the power of modern accelerators . The combination of -CROWN and BaB ( -CROWN BaB ) produces a complete verifier with GPU acceleration , reducing the verification time of traditional LP based BaB verifiers [ 8 ] by up to three orders of magnitudes on a commonly used benchmark suite on CIFAR-10 [ 6 , 10 ] . Compared to all state-of-the-art GPU-based complete verifiers [ 7 , 45 , 10 , 23 , 6 , 11 ] , our approach is noticeably faster with lower timeout rates . Our algorithm empowered the tool ↵ , -CROWN ( alpha-beta-CROWN ) , which won the 2nd International Verification of Neural Networks Competition [ 3 ] ( VNN-COMP 2021 ) with the highest total score and verified the most number of problem instances in 8 benchmarks . Finally , by terminating our complete verifier -CROWN BaB early , our approach can also function as a more accurate incomplete verifier by returning an incomplete but sound lower bound of all subdomains explored so far . We achieve better verified accuracy on a few benchmarking models over powerful incomplete verifiers including those based on tight linear relaxations [ 35 , 37 , 26 ] and semidefinite relaxations [ 9 ] . Compared to the typically tightest but very costly incomplete verifier SDP-FO [ 9 ] based on the semidefinite programming ( SDP ) relaxations [ 28 , 14 ] , our method obtains consistently higher verified accuracy while reducing verification time by three orders of magnitudes . 2 Background . 2.1 The neural network verification problem and its LP relaxation . We define the input of a neural network as x 2 Rd0 , and define the weights and biases of an L-layer neural network as W ( i ) 2 Rdi⇥di 1 and b ( i ) 2 Rdi ( i 2 { 1 , · · · , L } ) respectively . For simplicity we assume that dL = 1 so W ( L ) is a vector and b ( L ) is a scalar . The neural network function f : Rd0 ! R is defined as f ( x ) = z ( L ) ( x ) , where z ( i ) ( x ) = W ( i ) ẑ ( i 1 ) ( x ) + b ( i ) , ẑ ( i ) ( x ) = ( z ( i ) ( x ) ) and ẑ ( 0 ) ( x ) = x. is the activation function and we use ReLU throughout this paper . When the context is clear , we omit · ( x ) and use z ( i ) j and ẑ ( i ) j to represent the pre-activation and post-activation values of the j-th neuron in the i-th layer . Neural network verification seeks the solution of the optimization problem in Eq . 1 : min f ( x ) : = z ( L ) ( x ) s.t . z ( i ) = W ( i ) ẑ ( i 1 ) +b ( i ) , ẑ ( i ) = ( z ( i ) ) , x 2 C , i 2 { 1 , · · · , L 1 } ( 1 ) The set C defines the allowed input region and our aim is to find the minimum of f ( x ) for x 2 C , and throughout this paper we consider C as an ` 1 ball around a data example x0 : C = { x | kx x0k1 ✏ } but other ` p norms can also be supported . In practical settings , we typically have “ specifications ” to verify , which are ( usually linear ) functions of neural network outputs describing the desired behavior of neural networks . For example , to guarantee robustness we typically investigate the margin between logits . Because the specification can also be seen as an output layer of NN and merged into f ( x ) under verification , we do not discuss it in detail in this work . We consider the canonical specification f ( x ) > 0 : if we can prove that f ( x ) > 0 , 8x 2 C , we say f ( x ) is verified . When C is a convex set , Eq . 1 is still a non-convex problem because the constraints ẑ ( i ) = ( z ( i ) ) are non-convex . Given unlimited time , complete verifiers can solve Eq . 1 exactly : f⇤ = min f ( x ) , 8x 2 C , so we can always conclude if the specification holds or not for any problem instance . On the other hand , incomplete verifiers usually relax the non-convexity of neural networks to obtain a tractable lower bound of the solution f f⇤ . If f 0 , then f⇤ > 0 so f ( x ) can be verified ; when f < 0 , we are not able to infer the sign of f⇤ so can not conclude if the specification holds or not . A commonly used incomplete verification technique is to relax non-convex ReLU constraints with linear constraints and turn the verification problem into a linear programming ( LP ) problem , which can then be solved with linear solvers . We refer to it as the “ LP verifier ” in this paper . Specifically , given ReLU ( z ( i ) j ) : = max ( 0 , z ( i ) j ) and its intermediate layer bounds l ( i ) j z ( i ) j u ( i ) j , each ReLU can be categorized into three cases : ( 1 ) if l ( i ) j 0 ( ReLU in linear region ) then ẑ ( i ) j = z ( i ) j ; ( 2 ) if u ( i ) j 0 ( ReLU in inactive region ) then ẑ ( i ) j = 0 ; ( 3 ) if l ( i ) j 0 u ( i ) j ( ReLU is unstable ) then three linear bounds are used : ẑ ( i ) j 0 , ẑ ( i ) j z ( i ) j , and ẑ ( i ) j u ( i ) j u ( i ) j l ( i ) j ⇣ z ( i ) j l ( i ) j ⌘ ; they are often referred to as the “ triangle ” relaxation [ 15 , 42 ] . The intermediate layer bounds l ( i ) and u ( i ) are usually obtained from a cheaper bound propagation method ( see next subsection ) . LP verifiers can provide relatively tight bounds but linear solvers are still expensive especially when the network is large . Also , unlike our -CROWN , they have to use fixed intermediate bounds and can not use the joint optimization of intermediate layer bounds ( Section 3.3 ) to tighten relaxation . 2.2 CROWN : efficient incomplete verification by propagating linear bounds . Another cheaper way to give a lower bound for the objective in Eq . 1 is through sound bound propagation . CROWN [ 46 ] is a representative method that propagates a linear bound of f ( x ) w.r.t . every intermediate layer in a backward manner until reaching the input x . CROWN uses two linear constraints to relax unstable ReLU neurons : a linear upper bound ẑ ( i ) j u ( i ) j u ( i ) j l ( i ) j ⇣ z ( i ) j l ( i ) j ⌘ and a linear lower bound ẑ ( i ) j ↵ ( i ) j z ( i ) j ( 0 ↵ ( i ) j 1 ) . We can then bound the output of a ReLU layer : Lemma 2.1 ( ReLU relaxation in CROWN ) . Given w , v 2 Rd , l v u ( element-wise ) , we have w > ReLU ( v ) w > Dv + b0 , where D is a diagonal matrix containing free variables 0 ↵j 1 only when uj > 0 > lj and wj 0 , while its rest values as well as constant b0 are determined by l , u , w. Detailed forms of each term are listed in Appendix A. Lemma 2.1 can be repeatedly applied , resulting in an efficient back-substitution procedure to derive a linear lower bound of NN output w.r.t . x : Lemma 2.2 ( CROWN bound [ 46 ] ) . Given an L-layer ReLU NN f ( x ) : Rd0 ! R with weights W ( i ) , biases b ( i ) , pre-ReLU bounds l ( i ) z ( i ) u ( i ) ( 1 i L ) and input constraint x 2 C. We have min x2C f ( x ) min x2C a > CROWN x+ cCROWN where aCROWN and cCROWN can be computed using W ( i ) , b ( i ) , l ( i ) , u ( i ) in polynomial time . When C is an ` p norm ball , minimization over the linear function can be easily solved using Hölder ’ s inequality . The main benefit of CROWN is its efficiency : CROWN can be efficiently implemented on machine learning accelerators such as GPUs [ 44 ] and TPUs [ 47 ] , and it can be a few magnitudes faster than an LP verifier which is hard to parallelize on GPUs . CROWN was generalized to general architectures [ 44 , 31 ] while we only demonstrate it for feedforward ReLU networks for simplicity . Additionally , Xu et al . [ 45 ] showed that it is possible to optimize the slope of the lower bound , ↵ , using gradient ascent , to further tighten the bound ( sometimes referred to as ↵-CROWN ) .

Summary: The paper presents Beta-CROWN, a novel algorithm to compute bounds on the output of neural network activations. Beta-CROWN is designed to be employed within recent branch-and-bound frameworks [6, 10], resulting in an effective complete (or incomplete, when returning early) verification algorithm.  The authors build on the bounding algorithm presented in [43] ("alpha-CROWN"), which (with fixed intermediate bounds) is an effective solver for the popular triangle LP relaxation (Planet [14]) of ReLU neural networks. The main contributions of the paper are the following: - differently from alpha-CROWN, beta-CROWN can represent the effect that a ReLU split at the i-th layer has on the activations preceding it, leading to tighter bounds within branch and bound; - when jointly optimizing over intermediate bounds and output bounds, beta-CROWN shares fewer parameters between the various sub-problems, resulting in tighter final bounds.