Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifiers

1 INTRODUCTION . Although neural networks ( NNs ) have achieved great success on various complicated tasks , they remain susceptible to adversarial examples ( Szegedy et al. , 2013 ) : imperceptible perturbations of test samples might unexpectedly change the NN predictions . Therefore , it is crucial to conduct formal verification for NNs such that they can be adopted in safety or security-critical settings . Formally , the neural network verification problem can be cast into the following decision problem : Given a neural network f ( · ) , an input domain C , and a property P . ∀x ∈ C , does f ( x ) satisfy P ? The property P is typically a set of desirable outputs of the NN conditioned on the inputs . Typically , consider a binary classifier f ( x ) and a positive example x0 ( f ( x0 ) ≥ 0 ) , we can set P to be nonnegative numbers R+ and x is bounded within an l∞ norm ball C = { x|‖x − x0‖∞ ≤ } . The success of verification guarantees that the label of x0 can not flip for any perturbed inputs within C. In this paper we study the complete verification setting , where given sufficient time , the verifier should give a definite “ yes/no ” answer for a property under verification . In the above setting , it must solve the non-convex optimization problem minx∈C f ( x ) to a global minimum . Complete NN verification is generally a challenging NP-Hard problem ( Katz et al. , 2017 ) which usually requires expensive formal verification methods such as SMT ( Katz et al. , 2017 ) or MILP solvers ( Tjeng et al. , 2019b ) . On the other hand , incomplete solvers such as convex relaxations of NNs ( Salman et al. , 2019 ) can only provide a sound analysis , i.e. , they can only approximate the lower bound of minx∈C f ( x ) as f and verify the property when f ≥ 0 . No conclusion can be drawn when f < 0 . Recently , a Branch and Bound ( BaB ) style framework ( Bunel et al. , 2018 ; 2020b ) has been adopted for efficient complete verification . BaB solves the optimization problem minx∈C f ( x ) to a global minimum by branching into multiple sub-domains recursively and bounding the solution for each sub-domain using incomplete verifiers . BaB typically uses a Linear Programming ( LP ) bounding procedure as an incomplete verifier to provide feasibility checking and relatively tight bounds for each sub-domain . However , the relatively high solving cost of LPs and incapability of parallelization ( especially on massively parallel hardware accelerators like GPUs or TPUs ) greatly limit the performance and scalability of the existing complete BaB based verifiers . In this paper , we aim to use fast and typically weak incomplete verifiers for complete verification . Specifically , we focus on a class of incomplete verifiers using efficient bound propagation operations , referred to as linear relaxation based perturbation analysis ( LiRPA ) algorithms ( Xu et al. , 2020 ) . Representative algorithms in this class include convex outer adversarial polytope ( Wong & Kolter , 2018 ) , CROWN ( Zhang et al. , 2018 ) and DeepPoly ( Singh et al. , 2019b ) . LiRPA algorithms exhibit high parallelism as the bound propagation process is similar to forward or backward propagation of NNs , which can fully exploit machine learning accelerators ( e.g. , GPUs and TPUs ) . Although LiRPA bounds are very efficient for incomplete verification , especially in training certified adversarial defenses ( Wong et al. , 2018 ; Mirman et al. , 2018 ; Wang et al. , 2018a ; Zhang et al. , 2020 ) , they are generally considered too loose to be useful compared to LPs in the complete verification settings with BaB . As we will demonstrate later , using LiRPA bounds naively in BaB can not even guarantee the completeness when splitting ReLU nodes , and thus we need additional measures to make them useful for complete verification . In fact , LiRPA methods have been used to get upper and lower bounds for each ReLU neuron in constructing tighter LPs ( Bunel et al. , 2018 ; Lu & Kumar , 2020 ) . It was also used in ( Wang et al. , 2018c ) for verifying small-scale problems with relatively low dimensional input domains using input splits , but splitting the input space can be quite ineffective ( Bunel et al. , 2018 ) and is unable to scale to high dimensional input case like CIFAR-10 . Except one concurrent work ( Bunel et al. , 2020a ) , most complete verifiers are based on relatively expensive solvers like LP and can not fully take benefit from massively parallel hardware ( e.g. , GPUs ) to obtain tight bounds for accelerating large-scale complete verification problems . Our main contributions are : • We show that LiRPA bounds , when improved with fast gradient optimizers , can potentially outperform bounds obtained by LP verifiers . This is because LiRPA allows joint optimization of both intermediate layer bounds of ReLU neurons ( which determine the tightness of relaxation ) and output bounds , while LP can only optimize output bounds with fixed relaxations on ReLU neurons . • We show that BaB purely using LiRPA bounds is insufficient for complete verification due to the lack of feasibility checking for ReLU node splits . To address this issue , we design our algorithm to only invoke LP when absolutely necessary and exploits hardware parallelism when possible . • To fully exploit the hardware parallelism on the machine learning accelerators , we use a batch splitting approach that splits on multiple neurons simultaneously , further improving our efficiency . • On a few standard and representative benchmarks , our proposed NN verification framework can outperform previous baselines significantly , with a speedup of around 30X compared to basic BaB+LP baselines , and up to 3X compared to recent state-of-the-art complete verifiers . 2 BACKGROUND . 2.1 FORMAL DEFINITION OF NEURAL NETWORK ( NN ) VERIFICATION . Notations of NN . For illustration , we define an L-layer feedforward NN f : R|x| → R with L weights W ( i ) ( i ∈ { 1 , · · · , L } ) recursively as h ( i ) ( x ) = W ( i ) g ( i−1 ) ( x ) , hidden layer g ( i ) ( x ) = ReLU ( h ( i ) ( x ) ) , input layer g ( 0 ) ( x ) = x , and final output f ( x ) = h ( L ) ( x ) . For simplicity we ignore biases . We sometimes omit x and use h ( i ) j to represent the pre-activation of the j-th ReLU neuron in i-th layer for x ∈ C , and we use g ( i ) j to represent the post-activation value . We focus on verifying ReLU based NNs , but our method is generalizable to other activation functions supported by LiRPA . NN Verification Problem . Given an input x , its bounded input domain C , and a feedforward NN f ( · ) , the aim of formal verification is to prove or disprove certain properties P of NN outputs . Since most properties studied in previous works can be expressed as a Boolean expression over a linear equation of network output , where the linear property can be merged into the last layer weights of a NN , the ultimate goal of complete verification reduces to prove or disprove : ∀x ∈ C , f ( x ) ≥ 0 ( 1 ) One way to prove Eq . 1 is to solve minx∈C f ( x ) . Due to the non-convexity of NNs , finding the exact minimum of f ( x ) over x ∈ C is challenging as the optimization process is generally NPcomplete ( Katz et al. , 2017 ) . However , in practice , a sound approximation of the lower bound for f ( x ) , denoted as f , can be more easily obtained and is sufficient to verify the property . Thus , a good verification strategy to get a tight approximation f can save significant time cost . Note that f must be sound , i.e. , ∀x ∈ C , f ≤ f ( x ) , proving f ≥ 0 is sufficient to prove the property f ( x ) ≥ 0 . 2.2 THE BRANCH AND BOUND ( BAB ) FRAMEWORK FOR NEURAL NETWORK VERIFICATION . Branch and Bound ( BaB ) , an effective strategy in solving traditional combinatorial optimization problems , has been customized and widely adopted for NN verification ( Bunel et al. , 2018 ; 2020b ) . Specifically , BaB based verification framework is a recursive process , consisting of two main steps : branching and bounding . For branching , BaB based methods will divide the bounded input domain C into sub-domains { Ci|C = ⋃ i Ci } , each defined as a new independent verification problem . For instance , it can split a ReLU unit g ( k ) j = ReLU ( h ( k ) j ) to be negative and positive cases as C0 = C ∩ ( h ( k ) j ≥ 0 ) and C1 = C ∩ ( h ( k ) j < 0 ) for a ReLU-based network ; for each sub-domain Ci , BaB based methods perform bounding to obtain a relaxed but sound lower bound fCi . A tightened global lower bound over C can then be obtained by taking the minimum values of the sub-domain lower bounds from all the sub-domains : f = mini fCi . Branching and bounding will be performed recursively to tighten the approximated global lower bound over C until either ( 1 ) the global lower bound f becomes larger than 0 and prove the property or ( 2 ) a violation ( e.g. , adversarial example ) is located in a sub-domain to disprove the property . Essentially , we build a search tree where each leaf is a sub-domain , and the property P can be proven only when it is valid on all leaves . Soundness of BaB We say the verification process is sound if we can always trust the “ yes ” ( P is verified ) answer given by the verifier . It is straightforward to see that the whole BaB based verification process is sound as long as the bounding method used for each sub-domain Ci is sound . Completeness of BaB The completeness of the BaB-based NN verification process , which was usually assumed true in some previous works ( Bunel et al. , 2020b ; 2018 ) , in fact , is not always true even if all possible sub-domains are considered with a sound bounding method . Additional requirements for the bounding method are required - we point out that a key factor for completeness involves feasibility checking in the bounding method which we will discuss in Section 3.2 . Branching in BaB Since branching step determines the shape of the search tree , the main challenge is to efficiently choose a good leaf to split , which can significantly reduce the total number of branches and running time . In this work we focus on branching on activation ( ReLU ) nodes . BaBSR ( Bunel et al. , 2018 ) includes a simple branching heuristic which assigns each ReLU node a score to estimate the improvement for tightening f by splitting it , and splits the node with the highest score . Bounding with Linear Programming ( LP ) A typical bounding method used in BaB based verification is the Linear Programming bounding procedure ( sometimes simply referred to as “ LP ” or “ LP verifier ” in our paper ) . Specifically , we transform the original verification problem into a linear programming problem by relaxing every activation unit as a convex ( linear ) domain ( Ehlers , 2017 ) and then get the lower bound fCi with a linear solver given domain Ci . For instance , as shown in Figure 1a , g ( i ) j = ReLU ( h ( i ) j ) can be linearly relaxed with the following 3 constraints : ( 1 ) g ( i ) j ≥ h ( i ) j ; ( 2 ) g ( i ) j ≥ 0 ; ( 3 ) g ( i ) j ≤ u ( i ) j u ( i ) j −l ( i ) j ( h ( i ) j − l ( i ) j ) . Note that the lower bound l ( i ) j and upper bound u ( i ) j for each activation node h ( i ) j are required in the LP construction given Ci . They are typically computed by the existing cheap bounding methods like LiRPA variants ( Wong & Kolter , 2018 ) with low cost . The tighter the intermediate bounds ( l ( i ) j , u ( i ) j ) are , the tighter f approximated by LP is . 2.3 LINEAR RELAXATION BASED PERTURBATION ANALYSIS ( LiRPA ) Bound propagation in LiRPA We used Linear Relaxation based Perturbation Analysis ( LiRPA ) 1 as bound procedure in BaB to get linear upper and lower bounds of NN output w.r.t input x ∈ C : Ax+ b ≤ f ( x ) ≤ Ax+ b , x ∈ C ( 2 ) 1We only use the backward mode LiRPA bounds ( e.g. , CROWN and DeepPoly ) in this paper . l ( i ) j u ( i ) j x ( i ) j h ( i ) j A lower bound f can then be simply obtained by taking the lower bound of the linear equation Ax+ b w.r.t input x ∈ C , which can be obtained via Hölder ’ s inequality when C is a ` p norm ball . To get the coefficients A , A , b , b , LiRPA propagates bounds of f ( x ) as a linear function to the output of each layer , in a backward manner . At the output layer h ( L ) ( x ) we simply have : Ih ( L ) ( x ) ≤ f ( x ) ≤ Ih ( L ) ( x ) , x ∈ C ( 3 ) Then , the next step is to backward propagate the identity linear relationship through a linear layer h ( L ) ( x ) = W ( L ) g ( L−1 ) ( x ) to get the linear bounds of f ( x ) w.r.t g ( L−1 ) : W ( L ) g ( L−1 ) ( x ) ≤ f ( x ) ≤W ( L ) g ( L−1 ) ( x ) , x ∈ C ( 4 ) To get the linear relationship of h ( L−1 ) w.r.t f ( x ) , we need to backward propagate through ReLU layer g ( L−1 ) ( x ) = ReLU ( h ( L−1 ) ( x ) ) . Since it is nonlinear , we perform linear relaxations . For illustration , considering the j-th ReLU neuron at i-th layer , g ( i ) j ( x ) = ReLU ( h ( i ) j ( x ) ) , we can linearly upper and lower bound it by a ( i ) j h ( i ) j ( x ) + b ( i ) j ≤ g ( i ) j ( x ) ≤ a ( i ) j h ( i ) j ( x ) + b ( i ) j , where a ( i ) j , a ( i ) j , b ( i ) j , b ( i ) j are : a ( i ) j = a ( i ) j = 0 , b ( i ) j = b ( i ) j = 0 u ( i ) j ≤ 0 ( always inactive for x ∈ C ) a ( i ) j = a ( i ) j = 1 , b ( i ) j = b ( i ) j = 0 l ( i ) j ≥ 0 ( always active for x ∈ C ) a ( i ) j = α ( i ) j , a ( i ) j = u ( i ) j u ( i ) j −l ( i ) j , b ( i ) j = 0 , b ( i ) j = − u ( i ) j l ( i ) j u ( i ) j −l ( i ) j l ( i ) j < 0 , u ( i ) j > 0 ( unstable for x ∈ C ) ( 5 ) Here l ( i ) j ≤ h ( i ) j ( x ) ≤ u ( i ) j are intermediate pre-activation bounds for x ∈ C , and α ( i ) j is an arbitrary value between 0 and 1 . The pre-activation bounds l ( i ) j and u ( i ) j can be computed by treating h ( i ) j ( x ) as the output neuron with LiRPA . Figure 1 ( b , c , d ) illustrate the relaxation for each state of ReLU neuron . With these linear relaxations , we can get the linear equation of h ( L−1 ) w.r.t output f ( x ) : W ( L ) D ( L−1 ) α h ( L−1 ) ( x ) + b ( L ) ≤ f ( x ) ≤W ( L ) D ( L−1 ) α h ( L−1 ) ( x ) + b ( L ) , x ∈ C D ( L ) α , ( j , j ) = { a ( L ) j , W ( L ) j ≥ 0 a ( L ) j , W ( L ) j < 0 , b ( L ) = b′ ( L ) > W ( L ) , where b′ ( L ) j = { b ( L ) j , W ( L ) j ≥ 0 b ( L ) j , W ( L ) j < 0 ( 6 ) The diagonal matrices D ( L−1 ) α , D ( L−1 ) α and biases reflects the linear relaxations and also considers the signs in W ( L ) to maintain the lower and upper bounds . The definitions for j-th diagonal element D ( L ) α , ( j , j ) and bias b ( L ) are similar , with the conditions for checking the signs of W ( L ) j swapped . Importantly , D ( L−1 ) α has free variables α ( i ) j ∈ [ 0 , 1 ] which do not affect correctness of the bounds . We can continue backward propagating these bounds layer by layer ( e.g. , g ( L−2 ) ( x ) , h ( L−2 ) ( x ) , etc ) until reaching g ( 0 ) ( x ) = x , getting the eventual linear equations of f ( x ) in terms of input x : L ( x , α ) ≤ f ( x ) ≤ U ( x , α ) , ∀x ∈ C , where L ( x , α ) = W ( L ) D ( L−1 ) α · · ·D ( 1 ) α W ( 1 ) x+ b , U ( x , α ) = W ( L ) D ( L−1 ) α · · ·D ( 1 ) α W ( 1 ) x+ b ( 7 ) Hereα denotes α ( i ) j for all unstable ReLU neurons in NN . The obtained bounds ( L ( x , α ) , U ( x , α ) ) of f ( x ) are linear functions in terms of x . Beyond the simple feedforward NN presented here , LiRPA can support more complicated NN architectures like DenseNet and Transformers by computing L and U automatically and efficiently on general computational graphs ( Xu et al. , 2020 ) . Soundness of LiRPA The above backward bound propagation process guarantees that L ( x , α ) and U ( x , α ) soundly bound f ( x ) for all x ∈ C. Detailed proofs can be found in ( Zhang et al. , 2018 ; Singh et al. , 2019b ) for feedforward NNs and ( Xu et al. , 2020 ) for general networks .

Summary: The authors demonstrate that using a modification of the LiRPA method during the branch-and-bound process for solving the neural network verification problem can lead to significant speed-ups. The experimental results are strong. The authors convincingly show that the their method outperforms the existing state-of-the-art method by Lu & Kumar (2020) on an experimental setup similar to that work. The application of LiRPA to branch-and-bound is straightforward (since any incomplete verifier can be used), as is the use of gradient descent to improve the bound given by LiRPA (a standard technique applied to improve the bounds of certain verifiers).