Neural Network Branching for Neural Network Verification 

1 INTRODUCTION . Despite their outstanding performances on various tasks , neural networks are found to be vulnerable to adversarial examples ( Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) . The brittleness of neural networks can have costly consequences in areas such as autonomous driving , finance and healthcare . When one requires robustness to adversarial examples , traditional model evaluation approaches , which test the trained model on a hold-out set , do not suffice . Instead , formal verification of properties such as adversarial robustness becomes necessary . For instance , to ensure self-driving cars make consistent correct decisions even when the input image is slightly perturbed , the required property to verify is that the underlying neural network outputs the same correct prediction for all points within a norm ball whose radius is determined by the maximum perturbation allowed . Several methods have been proposed for verifying properties on neural networks ( NN ) . Bunel et al . ( 2018 ) showed that many of the available methods can be viewed as instances of a unified BaB framework . A BaB algorithm consists of two key components : branching strategies and bounding methods . Branching strategies decide how the search space is recursively split into smaller spaces . Bounding methods compute bounds of each subspace to tighten the bounds of the final objective function over the whole search space . In this work , we focus on improving the branching strategies . By directly working with a general framework , our identified algorithmic improvements can be combined with any bounding method , leading to potential performance improvement for BaB based verification algorithms . Branching strategies have significant impacts on the overall problem-solving process , as it directly decides the total number of steps , and consequently the total time , required to solve the problem at hand . The quality of a branching strategy is even more important when NN verification problems are considered , which generally have a very large search space . Each input dimension or each activation unit can be a potential branching option and neural networks of interest often have high dimensional inputs and thousands of hidden activation units . With such a large search space , an effective branching strategy could mean a large reduction of the total number of branches required , and consequently of the time required to solve a problem . Developing an effective strategy is thus of significant importance to the success of BaB based NN verification . So far , to the best of our knowledge , branching rules adopted by BaB based verification methods are either random selection ( Katz et al. , 2017 ; Ehlers , 2017 ) or hand-designed heuristics ( Wang et al. , 2018b ; Bunel et al. , 2018 ; Royo et al. , 2019 ; Bunel et al. , 2019 ) . Random selection is generally inefficient as the distribution of the best branching decision is rarely uniform . In practice , this strategy often results in exhaustive search to make a verification decision . On the other hand , hand designed heuristics often involve a trade-off between effectiveness and computational cost . For instance , strong branching is generally one of the best performing heuristics for BaB methods in terms of the number of branches , but it is computationally prohibitive as each branching decision requires an expensive exhaustive search over all possible options . The heuristics that are currently used in practice are either inspired by the corresponding dual problem when verification is formulated as an optimization problem ( Bunel et al. , 2018 ; Royo et al. , 2019 ) or incorporating the gradient information of the neural network ( Wang et al. , 2018b ) . These heuristics normally have better computational efficiency . However , given the complex nature of the search space , it is unlikely that any hand-designed heuristic is able to fully exploit the structure of the problem and the data distribution encountered in practice . As mentioned earlier , for large size NN verification problems , a slight reduction in the quality of the branching strategy could lead to substantial increase in the total number of branches required to solve the problem . A computationally cheap but high quality branching strategy is thus much needed . In order to exploit the inherent structure of the problem and the data , we propose a novel machine learning framework for designing a branching strategy . Our framework is both computationally efficient and effective , giving branching decisions that are of a similar quality to that of strong branching . Specifically , we make the following contributions : • We use a graph neural network ( GNN ) to exploit the structure of the neural network we want to verify . The embedding vectors of the GNN are updated by a novel schedule , which is both computationally cheap and memory efficient . In detail , we mimic the forward and backward passes of the neural network to update the embedding vectors . In addition , the proposed GNN allows a customised schedule to update embedding vectors via shared parameters . That means , once training is done , the trained GNN model is applicable to various verification properties on different neural network structures . • We train GNNs via supervised learning . We provide ways to generate training data cheaply but inclusive enough to represent branching problems at different stages of a BaB process for various verification properties . With the ability to exploit the neural network structure and a comprehensive training data set , our GNN is easy to train and converges fast . • Our learned GNN also enjoys transferability both horizontally and vertically . Horizontally , although trained with easy properties , the learned GNN gives similar performance on medium and difficult level properties . More importantly , vertically , given that all other parts of BaB algorithms remain the same , the GNN trained on small networks performs well on large networks . Since the network size determines the total cost for generating training data and is positively correlated with the difficulty of learning , this vertical transferability allows our framework to be readily applicable to large scale problems . • We further enhance our framework via online learning . For a learned branching strategy , it is expected that the strategy can fail to output satisfactory branching decisions from time to time . To deal with this issue , we provide an online scheme for fine-tuning the GNN along the BaB process in order to best accommodate the verification property at hand . • Finally , we supply a dataset on convolutional NN verification problems , covering problems at different difficulty levels over neural networks of different sizes . We hope that by providing a large problem dataset it could allow easy comparisons among existing methods and additionally encourage the development of better methods . Since most verification methods available work on ReLU-based deep neural networks , we focus on neural networks with ReLU activation units in this paper . However , we point out that our framework is applicable to any neural network architecture . 2 RELATED WORKS . Learning has already been used in solving combinatorial optimization problems ( Bello et al. , 2016 ; Dai et al. , 2017 ) and mixed integer linear programs ( MILP ) ( Khalil et al. , 2016 ; Alvarez et al. , 2017 ; Hansknecht et al. , 2018 ; Gasse et al. , 2019 ) . In these areas , instances of the same underlying structure are solved multiple times with different data values , which opens the door for learning . Among them , Khalil et al . ( 2016 ) , Alvarez et al . ( 2017 ) , Hansknecht et al . ( 2018 ) , and Gasse et al . ( 2019 ) proposed learned branching strategies for solving MILP with BaB algorithms . These meth- ods imitate the strong branching strategy . Specifically , Khalil et al . ( 2016 ) and Hansknecht et al . ( 2018 ) learn a ranking function to rank potential branching decisions while Alvarez et al . ( 2017 ) uses regression to assign a branching score to each potential branching choice . Apart from imitation , Anderson et al . ( 2019 ) proposed utilizing Bayesian optimization to learn verification policies . There are two main issues with these methods . Firstly , they rely heavily on hand-designed features or priors and secondly , they use a generic learning structure which is unable to exploit the neural network architecture . The approach most relevant to ours is the concurrent work by Gasse et al . ( 2019 ) . They managed to reduce feature reliance by exploiting the bipartite structure of an MILP through a GNN . The bipartite graph is capable of capturing the network architecture , but can not exploit it effectively . Specifically , it treats all the constraints the same and updates them simultaneously using the same set of parameters . This limited expressiveness can result in a difficulty in learning and hence in a high generalization error for NN verification problems . Our proposed framework is specifically designed for NN verification problems . By exploiting the neural network structure , and designing a customized schedule for embedding updates , our framework is able to scale elegantly both in terms of computation and memory . Finally , we mention that the recently proposed verification methods ( Katz et al. , 2019 ; Singh et al. , 2018 ; Anderson et al. , 2019 ) are not explicitly formulated as BaBs . Since our focus is on branching , we mainly use the methods in Bunel et al . ( 2019 ) for comparison . 3 BACKGROUND . Formal verification of neural networks refers to the problem of proving or disproving a property over a bounded input domain . Properties are functions of neural network outputs . When a property can be expressed as a Boolean expression over linear forms , we can modify the neural network in a suitable way so that the property can be simplified to checking the sign of the neural network output ( Bunel et al. , 2018 ) . Note that all the properties studied in previous works satisfy this form , thereby allowing us to use the aforementioned simplification . Mathematically , given the modified neural network f , a bounded input domain C , formal verification examines the truthfulness of the following statement : ∀x ∈ C , f ( x ) ≥ 0 . ( 1 ) If the above statement is true , the property holds . Otherwise , the property does not hold . 3.1 BRANCH AND BOUND . Verification tasks are often treated as a global optimization problem . We want to find the minimum of f ( x ) over C in order to compare it with the threshold 0 . Specifically , we consider an L layer feedforward neural network , f : R|x| → R , with ReLU activation units such that for any x0 ∈ C ⊂ R|x| , f ( x0 ) = x̂L ∈ R where x̂i+1 =W i+1xi + b i+1 , for i = 0 , . . . , L− 1 , ( 2a ) xi = max ( x̂i , 0 ) , for i = 1 , . . . , L− 1 . ( 2b ) The termsW i and bi refer to the weights and biases of the i-th layer of the neural network f. Domain C can be an ` p norm ball with radius . Finding the minimum of f is a challenging task , as the optimization problem is generally NP hard ( Katz et al. , 2017 ) . To deal with the inherent difficulty of the optimization problem itself , BaB ( Bunel et al. , 2018 ) is generally adopted . In detail , BaB based methods divide C into sub-domains , each of which defines a new sub-problem ( branching ) . They then compute a relaxed lower bound of the minimum on each sub-problem ( bounding ) . The minimum of the lower bounds of all the generated sub-domains constitutes a valid global lower bound of the global minimum over C. As a recursive process , BaB keeps partitioning the subdomains to tighten the global lower bound . The process terminates when the computed global lower bound is above zero ( property is true ) or when an input with a negative output is found ( property is false ) . A detailed description of the BaB is provided in the appendices . In what follows , we provide a brief description of the two components , bounding methods and branching strategies , that is necessary for the understanding of our novel learning framework .

Summary: This paper deals with complete formal verification of Neural Network, based on the Branch and Bound framework. The authors focus on branching strategies, which have been shown to be a critical design decision in order to obtain good performance. The tactic employed here is to learn a Graph Neural Network (which allows to transfer the heuristic from small networks to large networks), using supervised training to imitate strong branching. The authors also discuss fallback mechanism to prevent bad failures case, as well as an online fine-tuning strategy that provide better performance.