Neural Network Branching for Neural Network Verification 

1 INTRODUCTION . Despite their outstanding performances on various tasks , neural networks are found to be vulnerable to adversarial examples ( Goodfellow et al. , 2015 ; Szegedy et al. , 2013 ) . The brittleness of neural networks can have costly consequences in areas such as autonomous driving , finance and healthcare . When one requires robustness to adversarial examples , traditional model evaluation approaches , which test the trained model on a hold-out set , do not suffice . Instead , formal verification of properties such as adversarial robustness becomes necessary . For instance , to ensure self-driving cars make consistent correct decisions even when the input image is slightly perturbed , the required property to verify is that the underlying neural network outputs the same correct prediction for all points within a norm ball whose radius is determined by the maximum perturbation allowed . Several methods have been proposed for verifying properties on neural networks ( NN ) . Bunel et al . ( 2018 ) showed that many of the available methods can be viewed as instances of a unified BaB framework . A BaB algorithm consists of two key components : branching strategies and bounding methods . Branching strategies decide how the search space is recursively split into smaller spaces . Bounding methods compute bounds of each subspace to tighten the bounds of the final objective function over the whole search space . In this work , we focus on improving the branching strategies . By directly working with a general framework , our identified algorithmic improvements can be combined with any bounding method , leading to potential performance improvement for BaB based verification algorithms . Branching strategies have significant impacts on the overall problem-solving process , as it directly decides the total number of steps , and consequently the total time , required to solve the problem at hand . The quality of a branching strategy is even more important when NN verification problems are considered , which generally have a very large search space . Each input dimension or each activation unit can be a potential branching option and neural networks of interest often have high dimensional inputs and thousands of hidden activation units . With such a large search space , an effective branching strategy could mean a large reduction of the total number of branches required , and consequently of the time required to solve a problem . Developing an effective strategy is thus of significant importance to the success of BaB based NN verification . So far , to the best of our knowledge , branching rules adopted by BaB based verification methods are either random selection ( Katz et al. , 2017 ; Ehlers , 2017 ) or hand-designed heuristics ( Wang et al. , 2018b ; Bunel et al. , 2018 ; Royo et al. , 2019 ; Bunel et al. , 2019 ) . Random selection is generally inefficient as the distribution of the best branching decision is rarely uniform . In practice , this strategy often results in exhaustive search to make a verification decision . On the other hand , hand designed heuristics often involve a trade-off between effectiveness and computational cost . For instance , strong branching is generally one of the best performing heuristics for BaB methods in terms of the number of branches , but it is computationally prohibitive as each branching decision requires an expensive exhaustive search over all possible options . The heuristics that are currently used in practice are either inspired by the corresponding dual problem when verification is formulated as an optimization problem ( Bunel et al. , 2018 ; Royo et al. , 2019 ) or incorporating the gradient information of the neural network ( Wang et al. , 2018b ) . These heuristics normally have better computational efficiency . However , given the complex nature of the search space , it is unlikely that any hand-designed heuristic is able to fully exploit the structure of the problem and the data distribution encountered in practice . As mentioned earlier , for large size NN verification problems , a slight reduction in the quality of the branching strategy could lead to substantial increase in the total number of branches required to solve the problem . A computationally cheap but high quality branching strategy is thus much needed . In order to exploit the inherent structure of the problem and the data , we propose a novel machine learning framework for designing a branching strategy . Our framework is both computationally efficient and effective , giving branching decisions that are of a similar quality to that of strong branching . Specifically , we make the following contributions : • We use a graph neural network ( GNN ) to exploit the structure of the neural network we want to verify . The embedding vectors of the GNN are updated by a novel schedule , which is both computationally cheap and memory efficient . In detail , we mimic the forward and backward passes of the neural network to update the embedding vectors . In addition , the proposed GNN allows a customised schedule to update embedding vectors via shared parameters . That means , once training is done , the trained GNN model is applicable to various verification properties on different neural network structures . • We train GNNs via supervised learning . We provide ways to generate training data cheaply but inclusive enough to represent branching problems at different stages of a BaB process for various verification properties . With the ability to exploit the neural network structure and a comprehensive training data set , our GNN is easy to train and converges fast . • Our learned GNN also enjoys transferability both horizontally and vertically . Horizontally , although trained with easy properties , the learned GNN gives similar performance on medium and difficult level properties . More importantly , vertically , given that all other parts of BaB algorithms remain the same , the GNN trained on small networks performs well on large networks . Since the network size determines the total cost for generating training data and is positively correlated with the difficulty of learning , this vertical transferability allows our framework to be readily applicable to large scale problems . • We further enhance our framework via online learning . For a learned branching strategy , it is expected that the strategy can fail to output satisfactory branching decisions from time to time . To deal with this issue , we provide an online scheme for fine-tuning the GNN along the BaB process in order to best accommodate the verification property at hand . • Finally , we supply a dataset on convolutional NN verification problems , covering problems at different difficulty levels over neural networks of different sizes . We hope that by providing a large problem dataset it could allow easy comparisons among existing methods and additionally encourage the development of better methods . Since most verification methods available work on ReLU-based deep neural networks , we focus on neural networks with ReLU activation units in this paper . However , we point out that our framework is applicable to any neural network architecture . 2 RELATED WORKS . Learning has already been used in solving combinatorial optimization problems ( Bello et al. , 2016 ; Dai et al. , 2017 ) and mixed integer linear programs ( MILP ) ( Khalil et al. , 2016 ; Alvarez et al. , 2017 ; Hansknecht et al. , 2018 ; Gasse et al. , 2019 ) . In these areas , instances of the same underlying structure are solved multiple times with different data values , which opens the door for learning . Among them , Khalil et al . ( 2016 ) , Alvarez et al . ( 2017 ) , Hansknecht et al . ( 2018 ) , and Gasse et al . ( 2019 ) proposed learned branching strategies for solving MILP with BaB algorithms . These meth- ods imitate the strong branching strategy . Specifically , Khalil et al . ( 2016 ) and Hansknecht et al . ( 2018 ) learn a ranking function to rank potential branching decisions while Alvarez et al . ( 2017 ) uses regression to assign a branching score to each potential branching choice . Apart from imitation , Anderson et al . ( 2019 ) proposed utilizing Bayesian optimization to learn verification policies . There are two main issues with these methods . Firstly , they rely heavily on hand-designed features or priors and secondly , they use a generic learning structure which is unable to exploit the neural network architecture . The approach most relevant to ours is the concurrent work by Gasse et al . ( 2019 ) . They managed to reduce feature reliance by exploiting the bipartite structure of an MILP through a GNN . The bipartite graph is capable of capturing the network architecture , but can not exploit it effectively . Specifically , it treats all the constraints the same and updates them simultaneously using the same set of parameters . This limited expressiveness can result in a difficulty in learning and hence in a high generalization error for NN verification problems . Our proposed framework is specifically designed for NN verification problems . By exploiting the neural network structure , and designing a customized schedule for embedding updates , our framework is able to scale elegantly both in terms of computation and memory . Finally , we mention that the recently proposed verification methods ( Katz et al. , 2019 ; Singh et al. , 2018 ; Anderson et al. , 2019 ) are not explicitly formulated as BaBs . Since our focus is on branching , we mainly use the methods in Bunel et al . ( 2019 ) for comparison . 3 BACKGROUND . Formal verification of neural networks refers to the problem of proving or disproving a property over a bounded input domain . Properties are functions of neural network outputs . When a property can be expressed as a Boolean expression over linear forms , we can modify the neural network in a suitable way so that the property can be simplified to checking the sign of the neural network output ( Bunel et al. , 2018 ) . Note that all the properties studied in previous works satisfy this form , thereby allowing us to use the aforementioned simplification . Mathematically , given the modified neural network f , a bounded input domain C , formal verification examines the truthfulness of the following statement : ∀x ∈ C , f ( x ) ≥ 0 . ( 1 ) If the above statement is true , the property holds . Otherwise , the property does not hold . 3.1 BRANCH AND BOUND . Verification tasks are often treated as a global optimization problem . We want to find the minimum of f ( x ) over C in order to compare it with the threshold 0 . Specifically , we consider an L layer feedforward neural network , f : R|x| → R , with ReLU activation units such that for any x0 ∈ C ⊂ R|x| , f ( x0 ) = x̂L ∈ R where x̂i+1 =W i+1xi + b i+1 , for i = 0 , . . . , L− 1 , ( 2a ) xi = max ( x̂i , 0 ) , for i = 1 , . . . , L− 1 . ( 2b ) The termsW i and bi refer to the weights and biases of the i-th layer of the neural network f. Domain C can be an ` p norm ball with radius . Finding the minimum of f is a challenging task , as the optimization problem is generally NP hard ( Katz et al. , 2017 ) . To deal with the inherent difficulty of the optimization problem itself , BaB ( Bunel et al. , 2018 ) is generally adopted . In detail , BaB based methods divide C into sub-domains , each of which defines a new sub-problem ( branching ) . They then compute a relaxed lower bound of the minimum on each sub-problem ( bounding ) . The minimum of the lower bounds of all the generated sub-domains constitutes a valid global lower bound of the global minimum over C. As a recursive process , BaB keeps partitioning the subdomains to tighten the global lower bound . The process terminates when the computed global lower bound is above zero ( property is true ) or when an input with a negative output is found ( property is false ) . A detailed description of the BaB is provided in the appendices . In what follows , we provide a brief description of the two components , bounding methods and branching strategies , that is necessary for the understanding of our novel learning framework .

Summary: The paper proposes learning a branching heuristic to be used inside a branch-and-bound algorithm used for solving integer programming problems corresponding to neural network verification. The heuristic is parameterized as a neural network and trained to imitate an existing heuristic called Strong Branching which is computationally expensive but produces smaller branch-and-bound trees than other heuristics. A graph neural network architecture is used to take the neural network being verified as input, and a message passing schedule that follows a forward pass and a backward pass along the network being verified is used. An online learning variant is also considered that fine tunes the learned heuristic at test time as a problem instance is being solved. Results for verifying large convolutional neural networks on CIFAR-10 show approximately 2x improvement in average running time of the branch-and-bound algorithm.