Truth Table Deep Convolutional Neural Network, A New SAT-Encodable Architecture - Application To Complete Robustness

1 INTRODUCTION . Deep Neural Network ( DNN ) systems offer exceptional performance in a variety of difficult domains ( Goodfellow et al. , 2016 ) and today these results far outstrip our ability to secure and analyze those DNNs . As DNNs are becoming widely integrated in a variety of applications , several concerns have emerged : lack of robustness emphasized by a lack of explainability , difficulty of integrating human knowledge in postprocessing and impossibility to formally verify their behavior due to their large complexity . Under these circumstances and especially when these systems are deployed in applications where safety and security are issues , the formal verification of DNN systems and the field of eXplainable AI ( XAI ) are under intense research efforts . For example , Tesla has recently filed a patent on the DNNs ’ portability on a platform incorporating a component dedicated to formal verification ( Driscoll , 2020 ) . Also , the European Union ’ s general data protection regulation includes a provision on the explainability of AIs ( Regulation , 2016 ) . DNNs formal verification methods are mainly based either on Satisfiability Modulo Theory ( SMT ) ( Katz et al. , 2017 ) or Mixed-Integer Programming ( MIP ) ( Xiao et al. , 2018 ) which are not yet scalable to real-valued DNNs . Some recent publications ( Jia & Rinard ( 2020 ) ; Narodytska et al . ( 2019b ) ; Narodytska et al . ( 2018 ) ) approach the problem of complete verification from the well-known boolean SATisfiability ( SAT ) ( Biere et al. , 2009 ) point of view where Binary Neural Networks ( BNNs , Hubara et al . ( 2016 ) ) are first converted into SAT formulas and then formally verified using SAT or MaxSAT solvers . This pipeline is computationally efficient ( Jia & Rinard , 2020 ) , enables security verifications ( Baluta et al. , 2019 ) and more generally can answer a vast range of question such as how many adversarial attacks exist for a given DNN , image and noise level ( Narodytska et al. , 2019a ) . Besides , this approach is faster than SMT or MIP robustness verification method ( Jia & Rinard , 2020 ) . However , to date , only BNNs can be transformed into a SAT formula and their strong binary constraints limit their natural accuracy . Moreover , the corresponding SAT conversion method intrinsically leads to formulas with a large number of variables and clauses , impeding interpretability as well as formal verification scalability . Finally , only few studies ( Ignatiev et al . ( 2019a ) ; Ignatiev et al . ( 2019b ) ) investigated the relationship between formal DNNs ’ verification and XAI . Our contributions . In this work , we offer three main contributions . ( 1 ) First , we define a new family of real-valued Deep Convolutional Neural Networks ( DCNN ) that can be encoded into SAT formulas : Truth Table Deep Convolutional Neural Network ( TT-DCNN ) . Our TT-DCNN leverages its model formulation in the form of a truth table to allow weights and certain intermediate values to be real . To the best of our knowledge , this is the first method to encode a real-valued DCNN into SAT . For the first time , we can extract all the logic classification rules from a subfamily of DCNNs which allows a bridge between XAI and formal verification , while achieving sufficient natural accuracy for practical use . Indeed , the nature of the SAT conversion between TT-DCNN and BNN is intrinsically different : our method relies upon giving one SAT expression per 2D-CNN filter instead of one SAT expression per neuron . This global interpretability method is in sharp contrast with the previous limited BNNs and local DNNs explainability . ( 2 ) TT-DCNNs offer two main valuable conversion properties over BNNs . ( 2-a : Post-tuning ) The first one allows us to integrate human knowledge in the post-processing : we can now interpret the model inference with simple concepts , which enables to manually modify the 2D-CNN filter activation towards a desired goal . For example , we decided to focus on reducing overfitting and , to this end , we characterize TT-DCNN logic rules resulting from overfitting and propose a filtering approach , which increases the verifiable accuracy without decreasing the natural accuracy ( cf . Appendix A.1 ) . ( 2-b : Tractability ) The second property is the possibility to compute all possible model inputs/outputs prior to deployment in production . In an adversarial setting , we can assess whether the input noise will propagate to the output . We can therefore disregard filters with no impact on the output . This leads to a lower number of clauses and variables in the SAT formulas compared to BNNs which allows using generic SAT solvers and exact model counting solvers . ( 3 ) We apply our model to complete robustness verification ( cf . Appendix A.1 ) . TT-DCNNs offer a good tradeoff between the state-of-the-art of BNN/SAT method ( Jia & Rinard , 2020 ) and of real-valued DNN/MILP complete robustness verification methods ( Xiao et al . ( 2018 ) ; Tjeng et al . ( 2017 ) ) . This is expected as our network is both real-weighted and SAT-convertible . Our TT-DCNN model improves the verifiable accuracy by more than 2.5 % for high noise MNIST and by 0.5 % for the high noise of CIFAR10 when compared to BNN/SAT method while decreasing the verification time by a factor of 9 for MNIST and 150 for CIFAR10 high noise when compared to DNN/MILP methods . Finally , our SAT formulas are 5 and 9 times more compact in term of number of clauses for high noise MNIST and CIFAR10 respectively compared to the BNN/SAT method . Outline . Section 2 introduces the notations and the related work . Section 3 presents our new TT-DCNN model and its two main properties . Section 4 details the complete robustness verification set-up and reports the evaluation results . Finally , we conclude this work in Section 5 . 2 BACKGROUND & RELATED WORK . Boolean SATisfiability ( SAT ) . The boolean SATisfiability problem ( SAT ) ( Biere et al. , 2009 ) is the problem of deciding whether there exists a variable assignment to satisfy a given boolean expression Φ . We can consider a boolean expression in a Conjunctive Normal Form ( CNF ) or in a Disjunctive Normal Form ( DNF ) . They are both defined over a set of boolean variables ( x1 , · · · , xn ) . A literal li is defined as a variable xi or its complement xi . A CNF is a conjunction of a set of clauses : Φ = ( c1 ∧ · · · ∧ cm ) , where each clause cj is a disjunction of some literals cj = lj1∨· · ·∨ljr . A DNF is a disjunction of a set of clauses : Φ = ( c1∨· · ·∨cm ) , where each clause cj is a conjunction of some literals cj = lj1 ∧ · · · ∧ ljr . A pseudo-boolean constraint is a constraint of the form : N∑ p=1 aplp ◦ b , where ap ∈ Z , b ∈ Z and ◦ ∈ { ≤ , = , ≥ } , which can be mapped to a SAT formula ( Roussel & Manquinho , 2009 ) . However , the output SAT formula contains a tremendous number of clauses and literals compared to the number of variables in the pseudo-boolean constraint making it very hard to understand ( cf . example in Appendix A.2 ) . A boolean function has the form { 0 , 1 } n → { 0 , 1 } and its corresponding truth table gives outputs for all possible inputs combinations . Two-dimensional Convolutional Neural Networks ( 2D-CNNs ) . We consider the 2D-CNN as a function Φf , which , for a given filter f , takes n = k2c inputs at position ( i , j ) with k the kernel size and c the number of input channels . The outputs can be written y ( i , j ) f = Φf ( x ( i , j ) 1 , · · · , x ( i , j ) n ) . Note that in the binary case , a truth table between inputs and outputs for 2n entries can be easily set up ( if n is not too large ) . If we now consider a multi-layers network with s convolution layers : a similar truth table can be constructed , except now the kernel size k needs to be replaced by a patch function P ( s ) ( also referred to as the size of a receptive field in the literature ) . We have P ( 1 ) = k and P ( s+ 1 ) = P ( s ) if and only if the kernel size of the layer is 1 . We denote by P ( s , i , j ) , the receptive field after the sth layer at position ( i , j ) . We denote the vector obtained after the flatten operation and before the final classifier layer as the vector of features V . If there are a total of L layers in the DNN , each element of V is a non-linear function over a patch ( P ( L ) , P ( L ) ) on the input . SAT encoding of neural networks . The sole published method converting a DNN into a SAT formula is limited to BNNs ( Narodytska et al . ( 2018 ) ; Cheng et al . ( 2018 ) ) and involves recomposing a block formed of a 2D-CNN layer , a batch normalization layer and a step function into an inequality in order to apply the pseudo-boolean constraint ( Roussel & Manquinho , 2009 ) . This approach has been further refined using a different training method and a specific SAT solver resulting in a significantly reduced verification resolution time ( Jia & Rinard , 2020 ) . Although the proposed inequality rewriting is elegant , the corresponding SAT formula contains a tremendous number of clauses and literals compared to the number of variables in the pseudo-boolean constraint ( cf . example Appendix A.2 ) . This prevents both the interpretability and the tractability of those SAT/BNNs formulas . Hence , our goal is to find a real-valued DCNN with good performance and coincidentally convertible to SAT with fully interpretive inference . Interpretability by global rule extraction . Machine learning interpretability analysis fall into four main categories : either local ( input dependant ) or global methods , either exact or non-exact methods . The most famous techniques for local non-exact interpretability are LIME and the ANCHOR explainers ( Ribeiro et al . ( 2016 ) ; Ribeiro et al . ( 2018 ) ) . PI-explanations ( Shih et al. , 2018 ) and SHAP ( Lundberg & Lee , 2017 ) are also popular techniques for local exact method and global non-exact method respectively . The only scalable method for global exact interpretability was proposed in ( Granmo et al. , 2019 ) . Our work aims to extend the studies of the latter strategy with the use of truth tables in order to obtain the equivalent conjectures . Using truth tables in machine learning has been documented for hardware optimisation ( Soga & Nakahara ( 2020 ) , Wang et al . ( 2019 ) ) and recently in an attempt for global non-exact interpretation of BNNs ( Burkhardt et al. , 2021 ) . Our work is pioneer in the use of truth table to create a new architecture enabling the extraction of all the global exact logic rules as well as the increase of model robustness for formal verification .

Summary: This article proposes a novel convolutional architecture, dubbed Truth Table DCNs (TT-DCNs). Compared to Binary Neural Networks (BNNs), the proposed architecture admits a much more compact propositional logic encoding while improving their accuracy.   To the best of my understanding, the core idea is using real-weighted convolutions and aggregations that are then binarized with step-functions. These convolutions can be fully represented with truth tables, as long as the number of inputs in the filter is low-dimensional.  Furthermore, the authors claim that the proposed architecture is intrinsically more interpretable than BNNs and that it can be post-tuned by integrating human knowledge in the truth tables.  Experiments show that TT-DCNs are more easily verified while retaining practical predictive performance.