Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Verification

1 Introduction . As neural networks ( NNs ) are being deployed in safety-critical applications , it becomes increasingly important to formally verify their behaviors under potentially malicious inputs . Broadly speaking , the neural network verification problem involves proving certain desired relationships between inputs and outputs ( often referred to as specifications ) , such as safety or robustness guarantees , for all inputs inside some domain . Canonically , the problem can be cast as finding the global minima of some functions on the network ’ s outputs ( e.g. , the difference between the predictions of the true label and another target label ) , within a bounded input set as constraints . This is a challenging problem due to the non-convexity and high dimensionality of neural networks . 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . We first focus on complete verification : the verifier should give a definite “ yes/no ” answer given sufficient time . Many complete verifiers rely on the branch and bound ( BaB ) method [ 8 ] involving ( 1 ) branching by recursively splitting the original verification problem into subdomains ( e.g. , splitting a ReLU neuron into positive/negative linear regions by adding split constraints ) and ( 2 ) bounding each subdomain with specialized incomplete verifiers . Traditional BaB-based verifiers use expensive linear programming ( LP ) solvers [ 15 , 23 , 7 ] as incomplete verifiers which can fully encode neuron split constraints . Meanwhile , a recent verifier , Fast-and-Complete [ 45 ] , demonstrates that cheap incomplete verifiers can significantly accelerate complete verification on GPUs over LP-based ones thanks to their efficiency . Many cheap incomplete verifiers are based on bound propagation methods [ 46 , 42 , 41 , 13 , 17 , 36 , 44 ] , i.e. , maintaining and propagating tractable and sound bounds through networks , and CROWN [ 46 ] is a representative which propagates a linear or quadratic bound . However , unlike LP based verifiers , existing bound propagation methods lack the power to handle neuron split constraints introduced by BaB . For instance , given inputs x , y 2 [ 1 , 1 ] , they can bound a ReLU ’ s input x + y as [ 2 , 2 ] but they have no means to consider neuron split constraints such as x y 0 introduced by splitting another ReLU to the positive linear region . Such a problem causes looser bounds and unnecessary branching , hurting the verification efficiency . Even worse , without considering these split constraints , bound propagation methods can not detect many infeasible subdomains in BaB [ 45 ] , leading to incompleteness unless costly checking is performed . In our work , we develop a new , fast bound propagation based incomplete verifier , -CROWN . It solves an optimization problem equivalent to the expensive LP based methods with neuron split constraints while still enjoying the efficiency of bound propagation methods . -CROWN contains optimizable parameters which come from propagation of Lagrangian multipliers , and any valid settings of these parameters yield sound bounds for verification . These parameters are optimized using a few steps of ( super ) gradient ascent to achieve bounds as tight as possible . Optimizing can also eliminate many infeasible subdomains and avoid further useless branching . Furthermore , we can jointly optimize intermediate layer bounds similar to [ 44 ] but also with the additional parameters , allowing - CROWN to tighten relaxations and outperform typical LP verifiers with fixed intermediate layer bounds . Unlike traditional LP-based BaB methods , -CROWN can be efficiently implemented with an automatic differentiation framework on GPUs to fully exploit the power of modern accelerators . The combination of -CROWN and BaB ( -CROWN BaB ) produces a complete verifier with GPU acceleration , reducing the verification time of traditional LP based BaB verifiers [ 8 ] by up to three orders of magnitudes on a commonly used benchmark suite on CIFAR-10 [ 6 , 10 ] . Compared to all state-of-the-art GPU-based complete verifiers [ 7 , 45 , 10 , 23 , 6 , 11 ] , our approach is noticeably faster with lower timeout rates . Our algorithm empowered the tool ↵ , -CROWN ( alpha-beta-CROWN ) , which won the 2nd International Verification of Neural Networks Competition [ 3 ] ( VNN-COMP 2021 ) with the highest total score and verified the most number of problem instances in 8 benchmarks . Finally , by terminating our complete verifier -CROWN BaB early , our approach can also function as a more accurate incomplete verifier by returning an incomplete but sound lower bound of all subdomains explored so far . We achieve better verified accuracy on a few benchmarking models over powerful incomplete verifiers including those based on tight linear relaxations [ 35 , 37 , 26 ] and semidefinite relaxations [ 9 ] . Compared to the typically tightest but very costly incomplete verifier SDP-FO [ 9 ] based on the semidefinite programming ( SDP ) relaxations [ 28 , 14 ] , our method obtains consistently higher verified accuracy while reducing verification time by three orders of magnitudes . 2 Background . 2.1 The neural network verification problem and its LP relaxation . We define the input of a neural network as x 2 Rd0 , and define the weights and biases of an L-layer neural network as W ( i ) 2 Rdi⇥di 1 and b ( i ) 2 Rdi ( i 2 { 1 , · · · , L } ) respectively . For simplicity we assume that dL = 1 so W ( L ) is a vector and b ( L ) is a scalar . The neural network function f : Rd0 ! R is defined as f ( x ) = z ( L ) ( x ) , where z ( i ) ( x ) = W ( i ) ẑ ( i 1 ) ( x ) + b ( i ) , ẑ ( i ) ( x ) = ( z ( i ) ( x ) ) and ẑ ( 0 ) ( x ) = x. is the activation function and we use ReLU throughout this paper . When the context is clear , we omit · ( x ) and use z ( i ) j and ẑ ( i ) j to represent the pre-activation and post-activation values of the j-th neuron in the i-th layer . Neural network verification seeks the solution of the optimization problem in Eq . 1 : min f ( x ) : = z ( L ) ( x ) s.t . z ( i ) = W ( i ) ẑ ( i 1 ) +b ( i ) , ẑ ( i ) = ( z ( i ) ) , x 2 C , i 2 { 1 , · · · , L 1 } ( 1 ) The set C defines the allowed input region and our aim is to find the minimum of f ( x ) for x 2 C , and throughout this paper we consider C as an ` 1 ball around a data example x0 : C = { x | kx x0k1 ✏ } but other ` p norms can also be supported . In practical settings , we typically have “ specifications ” to verify , which are ( usually linear ) functions of neural network outputs describing the desired behavior of neural networks . For example , to guarantee robustness we typically investigate the margin between logits . Because the specification can also be seen as an output layer of NN and merged into f ( x ) under verification , we do not discuss it in detail in this work . We consider the canonical specification f ( x ) > 0 : if we can prove that f ( x ) > 0 , 8x 2 C , we say f ( x ) is verified . When C is a convex set , Eq . 1 is still a non-convex problem because the constraints ẑ ( i ) = ( z ( i ) ) are non-convex . Given unlimited time , complete verifiers can solve Eq . 1 exactly : f⇤ = min f ( x ) , 8x 2 C , so we can always conclude if the specification holds or not for any problem instance . On the other hand , incomplete verifiers usually relax the non-convexity of neural networks to obtain a tractable lower bound of the solution f f⇤ . If f 0 , then f⇤ > 0 so f ( x ) can be verified ; when f < 0 , we are not able to infer the sign of f⇤ so can not conclude if the specification holds or not . A commonly used incomplete verification technique is to relax non-convex ReLU constraints with linear constraints and turn the verification problem into a linear programming ( LP ) problem , which can then be solved with linear solvers . We refer to it as the “ LP verifier ” in this paper . Specifically , given ReLU ( z ( i ) j ) : = max ( 0 , z ( i ) j ) and its intermediate layer bounds l ( i ) j z ( i ) j u ( i ) j , each ReLU can be categorized into three cases : ( 1 ) if l ( i ) j 0 ( ReLU in linear region ) then ẑ ( i ) j = z ( i ) j ; ( 2 ) if u ( i ) j 0 ( ReLU in inactive region ) then ẑ ( i ) j = 0 ; ( 3 ) if l ( i ) j 0 u ( i ) j ( ReLU is unstable ) then three linear bounds are used : ẑ ( i ) j 0 , ẑ ( i ) j z ( i ) j , and ẑ ( i ) j u ( i ) j u ( i ) j l ( i ) j ⇣ z ( i ) j l ( i ) j ⌘ ; they are often referred to as the “ triangle ” relaxation [ 15 , 42 ] . The intermediate layer bounds l ( i ) and u ( i ) are usually obtained from a cheaper bound propagation method ( see next subsection ) . LP verifiers can provide relatively tight bounds but linear solvers are still expensive especially when the network is large . Also , unlike our -CROWN , they have to use fixed intermediate bounds and can not use the joint optimization of intermediate layer bounds ( Section 3.3 ) to tighten relaxation . 2.2 CROWN : efficient incomplete verification by propagating linear bounds . Another cheaper way to give a lower bound for the objective in Eq . 1 is through sound bound propagation . CROWN [ 46 ] is a representative method that propagates a linear bound of f ( x ) w.r.t . every intermediate layer in a backward manner until reaching the input x . CROWN uses two linear constraints to relax unstable ReLU neurons : a linear upper bound ẑ ( i ) j u ( i ) j u ( i ) j l ( i ) j ⇣ z ( i ) j l ( i ) j ⌘ and a linear lower bound ẑ ( i ) j ↵ ( i ) j z ( i ) j ( 0 ↵ ( i ) j 1 ) . We can then bound the output of a ReLU layer : Lemma 2.1 ( ReLU relaxation in CROWN ) . Given w , v 2 Rd , l v u ( element-wise ) , we have w > ReLU ( v ) w > Dv + b0 , where D is a diagonal matrix containing free variables 0 ↵j 1 only when uj > 0 > lj and wj 0 , while its rest values as well as constant b0 are determined by l , u , w. Detailed forms of each term are listed in Appendix A. Lemma 2.1 can be repeatedly applied , resulting in an efficient back-substitution procedure to derive a linear lower bound of NN output w.r.t . x : Lemma 2.2 ( CROWN bound [ 46 ] ) . Given an L-layer ReLU NN f ( x ) : Rd0 ! R with weights W ( i ) , biases b ( i ) , pre-ReLU bounds l ( i ) z ( i ) u ( i ) ( 1 i L ) and input constraint x 2 C. We have min x2C f ( x ) min x2C a > CROWN x+ cCROWN where aCROWN and cCROWN can be computed using W ( i ) , b ( i ) , l ( i ) , u ( i ) in polynomial time . When C is an ` p norm ball , minimization over the linear function can be easily solved using Hölder ’ s inequality . The main benefit of CROWN is its efficiency : CROWN can be efficiently implemented on machine learning accelerators such as GPUs [ 44 ] and TPUs [ 47 ] , and it can be a few magnitudes faster than an LP verifier which is hard to parallelize on GPUs . CROWN was generalized to general architectures [ 44 , 31 ] while we only demonstrate it for feedforward ReLU networks for simplicity . Additionally , Xu et al . [ 45 ] showed that it is possible to optimize the slope of the lower bound , ↵ , using gradient ascent , to further tighten the bound ( sometimes referred to as ↵-CROWN ) .

Summary: The paper deals with efficiently incorporating CROWN into the branch-and-bound framework for complete verification. The authors propose to relax the split constraints using Lagrangian relaxation, and show how this can be done within the bound propagation framework. They also jointly optimise the intermediate bounds to tighter verification.  The technical contribution is fairly simple.  The method gives good improvements over existing complete verification methods. Authors have done a very good experimental evaluation, on different datasets and compared with many baselines.  The writing is good overall. Sections 2 and 3 are very well written. I have some comments which I have added in the main review.  The related work section and conclusion section need some work.