Truth Table Deep Convolutional Neural Network, A New SAT-Encodable Architecture - Application To Complete Robustness

1 INTRODUCTION . Deep Neural Network ( DNN ) systems offer exceptional performance in a variety of difficult domains ( Goodfellow et al. , 2016 ) and today these results far outstrip our ability to secure and analyze those DNNs . As DNNs are becoming widely integrated in a variety of applications , several concerns have emerged : lack of robustness emphasized by a lack of explainability , difficulty of integrating human knowledge in postprocessing and impossibility to formally verify their behavior due to their large complexity . Under these circumstances and especially when these systems are deployed in applications where safety and security are issues , the formal verification of DNN systems and the field of eXplainable AI ( XAI ) are under intense research efforts . For example , Tesla has recently filed a patent on the DNNs ’ portability on a platform incorporating a component dedicated to formal verification ( Driscoll , 2020 ) . Also , the European Union ’ s general data protection regulation includes a provision on the explainability of AIs ( Regulation , 2016 ) . DNNs formal verification methods are mainly based either on Satisfiability Modulo Theory ( SMT ) ( Katz et al. , 2017 ) or Mixed-Integer Programming ( MIP ) ( Xiao et al. , 2018 ) which are not yet scalable to real-valued DNNs . Some recent publications ( Jia & Rinard ( 2020 ) ; Narodytska et al . ( 2019b ) ; Narodytska et al . ( 2018 ) ) approach the problem of complete verification from the well-known boolean SATisfiability ( SAT ) ( Biere et al. , 2009 ) point of view where Binary Neural Networks ( BNNs , Hubara et al . ( 2016 ) ) are first converted into SAT formulas and then formally verified using SAT or MaxSAT solvers . This pipeline is computationally efficient ( Jia & Rinard , 2020 ) , enables security verifications ( Baluta et al. , 2019 ) and more generally can answer a vast range of question such as how many adversarial attacks exist for a given DNN , image and noise level ( Narodytska et al. , 2019a ) . Besides , this approach is faster than SMT or MIP robustness verification method ( Jia & Rinard , 2020 ) . However , to date , only BNNs can be transformed into a SAT formula and their strong binary constraints limit their natural accuracy . Moreover , the corresponding SAT conversion method intrinsically leads to formulas with a large number of variables and clauses , impeding interpretability as well as formal verification scalability . Finally , only few studies ( Ignatiev et al . ( 2019a ) ; Ignatiev et al . ( 2019b ) ) investigated the relationship between formal DNNs ’ verification and XAI . Our contributions . In this work , we offer three main contributions . ( 1 ) First , we define a new family of real-valued Deep Convolutional Neural Networks ( DCNN ) that can be encoded into SAT formulas : Truth Table Deep Convolutional Neural Network ( TT-DCNN ) . Our TT-DCNN leverages its model formulation in the form of a truth table to allow weights and certain intermediate values to be real . To the best of our knowledge , this is the first method to encode a real-valued DCNN into SAT . For the first time , we can extract all the logic classification rules from a subfamily of DCNNs which allows a bridge between XAI and formal verification , while achieving sufficient natural accuracy for practical use . Indeed , the nature of the SAT conversion between TT-DCNN and BNN is intrinsically different : our method relies upon giving one SAT expression per 2D-CNN filter instead of one SAT expression per neuron . This global interpretability method is in sharp contrast with the previous limited BNNs and local DNNs explainability . ( 2 ) TT-DCNNs offer two main valuable conversion properties over BNNs . ( 2-a : Post-tuning ) The first one allows us to integrate human knowledge in the post-processing : we can now interpret the model inference with simple concepts , which enables to manually modify the 2D-CNN filter activation towards a desired goal . For example , we decided to focus on reducing overfitting and , to this end , we characterize TT-DCNN logic rules resulting from overfitting and propose a filtering approach , which increases the verifiable accuracy without decreasing the natural accuracy ( cf . Appendix A.1 ) . ( 2-b : Tractability ) The second property is the possibility to compute all possible model inputs/outputs prior to deployment in production . In an adversarial setting , we can assess whether the input noise will propagate to the output . We can therefore disregard filters with no impact on the output . This leads to a lower number of clauses and variables in the SAT formulas compared to BNNs which allows using generic SAT solvers and exact model counting solvers . ( 3 ) We apply our model to complete robustness verification ( cf . Appendix A.1 ) . TT-DCNNs offer a good tradeoff between the state-of-the-art of BNN/SAT method ( Jia & Rinard , 2020 ) and of real-valued DNN/MILP complete robustness verification methods ( Xiao et al . ( 2018 ) ; Tjeng et al . ( 2017 ) ) . This is expected as our network is both real-weighted and SAT-convertible . Our TT-DCNN model improves the verifiable accuracy by more than 2.5 % for high noise MNIST and by 0.5 % for the high noise of CIFAR10 when compared to BNN/SAT method while decreasing the verification time by a factor of 9 for MNIST and 150 for CIFAR10 high noise when compared to DNN/MILP methods . Finally , our SAT formulas are 5 and 9 times more compact in term of number of clauses for high noise MNIST and CIFAR10 respectively compared to the BNN/SAT method . Outline . Section 2 introduces the notations and the related work . Section 3 presents our new TT-DCNN model and its two main properties . Section 4 details the complete robustness verification set-up and reports the evaluation results . Finally , we conclude this work in Section 5 . 2 BACKGROUND & RELATED WORK . Boolean SATisfiability ( SAT ) . The boolean SATisfiability problem ( SAT ) ( Biere et al. , 2009 ) is the problem of deciding whether there exists a variable assignment to satisfy a given boolean expression Φ . We can consider a boolean expression in a Conjunctive Normal Form ( CNF ) or in a Disjunctive Normal Form ( DNF ) . They are both defined over a set of boolean variables ( x1 , · · · , xn ) . A literal li is defined as a variable xi or its complement xi . A CNF is a conjunction of a set of clauses : Φ = ( c1 ∧ · · · ∧ cm ) , where each clause cj is a disjunction of some literals cj = lj1∨· · ·∨ljr . A DNF is a disjunction of a set of clauses : Φ = ( c1∨· · ·∨cm ) , where each clause cj is a conjunction of some literals cj = lj1 ∧ · · · ∧ ljr . A pseudo-boolean constraint is a constraint of the form : N∑ p=1 aplp ◦ b , where ap ∈ Z , b ∈ Z and ◦ ∈ { ≤ , = , ≥ } , which can be mapped to a SAT formula ( Roussel & Manquinho , 2009 ) . However , the output SAT formula contains a tremendous number of clauses and literals compared to the number of variables in the pseudo-boolean constraint making it very hard to understand ( cf . example in Appendix A.2 ) . A boolean function has the form { 0 , 1 } n → { 0 , 1 } and its corresponding truth table gives outputs for all possible inputs combinations . Two-dimensional Convolutional Neural Networks ( 2D-CNNs ) . We consider the 2D-CNN as a function Φf , which , for a given filter f , takes n = k2c inputs at position ( i , j ) with k the kernel size and c the number of input channels . The outputs can be written y ( i , j ) f = Φf ( x ( i , j ) 1 , · · · , x ( i , j ) n ) . Note that in the binary case , a truth table between inputs and outputs for 2n entries can be easily set up ( if n is not too large ) . If we now consider a multi-layers network with s convolution layers : a similar truth table can be constructed , except now the kernel size k needs to be replaced by a patch function P ( s ) ( also referred to as the size of a receptive field in the literature ) . We have P ( 1 ) = k and P ( s+ 1 ) = P ( s ) if and only if the kernel size of the layer is 1 . We denote by P ( s , i , j ) , the receptive field after the sth layer at position ( i , j ) . We denote the vector obtained after the flatten operation and before the final classifier layer as the vector of features V . If there are a total of L layers in the DNN , each element of V is a non-linear function over a patch ( P ( L ) , P ( L ) ) on the input . SAT encoding of neural networks . The sole published method converting a DNN into a SAT formula is limited to BNNs ( Narodytska et al . ( 2018 ) ; Cheng et al . ( 2018 ) ) and involves recomposing a block formed of a 2D-CNN layer , a batch normalization layer and a step function into an inequality in order to apply the pseudo-boolean constraint ( Roussel & Manquinho , 2009 ) . This approach has been further refined using a different training method and a specific SAT solver resulting in a significantly reduced verification resolution time ( Jia & Rinard , 2020 ) . Although the proposed inequality rewriting is elegant , the corresponding SAT formula contains a tremendous number of clauses and literals compared to the number of variables in the pseudo-boolean constraint ( cf . example Appendix A.2 ) . This prevents both the interpretability and the tractability of those SAT/BNNs formulas . Hence , our goal is to find a real-valued DCNN with good performance and coincidentally convertible to SAT with fully interpretive inference . Interpretability by global rule extraction . Machine learning interpretability analysis fall into four main categories : either local ( input dependant ) or global methods , either exact or non-exact methods . The most famous techniques for local non-exact interpretability are LIME and the ANCHOR explainers ( Ribeiro et al . ( 2016 ) ; Ribeiro et al . ( 2018 ) ) . PI-explanations ( Shih et al. , 2018 ) and SHAP ( Lundberg & Lee , 2017 ) are also popular techniques for local exact method and global non-exact method respectively . The only scalable method for global exact interpretability was proposed in ( Granmo et al. , 2019 ) . Our work aims to extend the studies of the latter strategy with the use of truth tables in order to obtain the equivalent conjectures . Using truth tables in machine learning has been documented for hardware optimisation ( Soga & Nakahara ( 2020 ) , Wang et al . ( 2019 ) ) and recently in an attempt for global non-exact interpretation of BNNs ( Burkhardt et al. , 2021 ) . Our work is pioneer in the use of truth table to create a new architecture enabling the extraction of all the global exact logic rules as well as the increase of model robustness for formal verification .

Summary: This paper proposes a new kind of SAT-encodable Neural Network which has real-valued weights and binary activations. Since the activations are binary, this work constructs a truth table to map the inputs of a CNN block to its outputs. This helps to deduce the output of the CNN block as a boolean function of the input variables while allowing intermediate values to be real. This formula also gives a set of masks that identify the conditions for which a given neuron is active. Tuning this set of masks post training helps increase the generalisability of the network - sec 4.1. Furthermore, this causes the encoded formula to be relatively simpler than the other existing methods for verifying BNNs and thus helps in keeping things scalable for the sat solver. The authors have conducted experiments to show that this method achieves a better performance in terms of verifiable accuracy and runtime than the existing methods (Table 1).