Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifiers

1 INTRODUCTION . Although neural networks ( NNs ) have achieved great success on various complicated tasks , they remain susceptible to adversarial examples ( Szegedy et al. , 2013 ) : imperceptible perturbations of test samples might unexpectedly change the NN predictions . Therefore , it is crucial to conduct formal verification for NNs such that they can be adopted in safety or security-critical settings . Formally , the neural network verification problem can be cast into the following decision problem : Given a neural network f ( · ) , an input domain C , and a property P . ∀x ∈ C , does f ( x ) satisfy P ? The property P is typically a set of desirable outputs of the NN conditioned on the inputs . Typically , consider a binary classifier f ( x ) and a positive example x0 ( f ( x0 ) ≥ 0 ) , we can set P to be nonnegative numbers R+ and x is bounded within an l∞ norm ball C = { x|‖x − x0‖∞ ≤ } . The success of verification guarantees that the label of x0 can not flip for any perturbed inputs within C. In this paper we study the complete verification setting , where given sufficient time , the verifier should give a definite “ yes/no ” answer for a property under verification . In the above setting , it must solve the non-convex optimization problem minx∈C f ( x ) to a global minimum . Complete NN verification is generally a challenging NP-Hard problem ( Katz et al. , 2017 ) which usually requires expensive formal verification methods such as SMT ( Katz et al. , 2017 ) or MILP solvers ( Tjeng et al. , 2019b ) . On the other hand , incomplete solvers such as convex relaxations of NNs ( Salman et al. , 2019 ) can only provide a sound analysis , i.e. , they can only approximate the lower bound of minx∈C f ( x ) as f and verify the property when f ≥ 0 . No conclusion can be drawn when f < 0 . Recently , a Branch and Bound ( BaB ) style framework ( Bunel et al. , 2018 ; 2020b ) has been adopted for efficient complete verification . BaB solves the optimization problem minx∈C f ( x ) to a global minimum by branching into multiple sub-domains recursively and bounding the solution for each sub-domain using incomplete verifiers . BaB typically uses a Linear Programming ( LP ) bounding procedure as an incomplete verifier to provide feasibility checking and relatively tight bounds for each sub-domain . However , the relatively high solving cost of LPs and incapability of parallelization ( especially on massively parallel hardware accelerators like GPUs or TPUs ) greatly limit the performance and scalability of the existing complete BaB based verifiers . In this paper , we aim to use fast and typically weak incomplete verifiers for complete verification . Specifically , we focus on a class of incomplete verifiers using efficient bound propagation operations , referred to as linear relaxation based perturbation analysis ( LiRPA ) algorithms ( Xu et al. , 2020 ) . Representative algorithms in this class include convex outer adversarial polytope ( Wong & Kolter , 2018 ) , CROWN ( Zhang et al. , 2018 ) and DeepPoly ( Singh et al. , 2019b ) . LiRPA algorithms exhibit high parallelism as the bound propagation process is similar to forward or backward propagation of NNs , which can fully exploit machine learning accelerators ( e.g. , GPUs and TPUs ) . Although LiRPA bounds are very efficient for incomplete verification , especially in training certified adversarial defenses ( Wong et al. , 2018 ; Mirman et al. , 2018 ; Wang et al. , 2018a ; Zhang et al. , 2020 ) , they are generally considered too loose to be useful compared to LPs in the complete verification settings with BaB . As we will demonstrate later , using LiRPA bounds naively in BaB can not even guarantee the completeness when splitting ReLU nodes , and thus we need additional measures to make them useful for complete verification . In fact , LiRPA methods have been used to get upper and lower bounds for each ReLU neuron in constructing tighter LPs ( Bunel et al. , 2018 ; Lu & Kumar , 2020 ) . It was also used in ( Wang et al. , 2018c ) for verifying small-scale problems with relatively low dimensional input domains using input splits , but splitting the input space can be quite ineffective ( Bunel et al. , 2018 ) and is unable to scale to high dimensional input case like CIFAR-10 . Except one concurrent work ( Bunel et al. , 2020a ) , most complete verifiers are based on relatively expensive solvers like LP and can not fully take benefit from massively parallel hardware ( e.g. , GPUs ) to obtain tight bounds for accelerating large-scale complete verification problems . Our main contributions are : • We show that LiRPA bounds , when improved with fast gradient optimizers , can potentially outperform bounds obtained by LP verifiers . This is because LiRPA allows joint optimization of both intermediate layer bounds of ReLU neurons ( which determine the tightness of relaxation ) and output bounds , while LP can only optimize output bounds with fixed relaxations on ReLU neurons . • We show that BaB purely using LiRPA bounds is insufficient for complete verification due to the lack of feasibility checking for ReLU node splits . To address this issue , we design our algorithm to only invoke LP when absolutely necessary and exploits hardware parallelism when possible . • To fully exploit the hardware parallelism on the machine learning accelerators , we use a batch splitting approach that splits on multiple neurons simultaneously , further improving our efficiency . • On a few standard and representative benchmarks , our proposed NN verification framework can outperform previous baselines significantly , with a speedup of around 30X compared to basic BaB+LP baselines , and up to 3X compared to recent state-of-the-art complete verifiers . 2 BACKGROUND . 2.1 FORMAL DEFINITION OF NEURAL NETWORK ( NN ) VERIFICATION . Notations of NN . For illustration , we define an L-layer feedforward NN f : R|x| → R with L weights W ( i ) ( i ∈ { 1 , · · · , L } ) recursively as h ( i ) ( x ) = W ( i ) g ( i−1 ) ( x ) , hidden layer g ( i ) ( x ) = ReLU ( h ( i ) ( x ) ) , input layer g ( 0 ) ( x ) = x , and final output f ( x ) = h ( L ) ( x ) . For simplicity we ignore biases . We sometimes omit x and use h ( i ) j to represent the pre-activation of the j-th ReLU neuron in i-th layer for x ∈ C , and we use g ( i ) j to represent the post-activation value . We focus on verifying ReLU based NNs , but our method is generalizable to other activation functions supported by LiRPA . NN Verification Problem . Given an input x , its bounded input domain C , and a feedforward NN f ( · ) , the aim of formal verification is to prove or disprove certain properties P of NN outputs . Since most properties studied in previous works can be expressed as a Boolean expression over a linear equation of network output , where the linear property can be merged into the last layer weights of a NN , the ultimate goal of complete verification reduces to prove or disprove : ∀x ∈ C , f ( x ) ≥ 0 ( 1 ) One way to prove Eq . 1 is to solve minx∈C f ( x ) . Due to the non-convexity of NNs , finding the exact minimum of f ( x ) over x ∈ C is challenging as the optimization process is generally NPcomplete ( Katz et al. , 2017 ) . However , in practice , a sound approximation of the lower bound for f ( x ) , denoted as f , can be more easily obtained and is sufficient to verify the property . Thus , a good verification strategy to get a tight approximation f can save significant time cost . Note that f must be sound , i.e. , ∀x ∈ C , f ≤ f ( x ) , proving f ≥ 0 is sufficient to prove the property f ( x ) ≥ 0 . 2.2 THE BRANCH AND BOUND ( BAB ) FRAMEWORK FOR NEURAL NETWORK VERIFICATION . Branch and Bound ( BaB ) , an effective strategy in solving traditional combinatorial optimization problems , has been customized and widely adopted for NN verification ( Bunel et al. , 2018 ; 2020b ) . Specifically , BaB based verification framework is a recursive process , consisting of two main steps : branching and bounding . For branching , BaB based methods will divide the bounded input domain C into sub-domains { Ci|C = ⋃ i Ci } , each defined as a new independent verification problem . For instance , it can split a ReLU unit g ( k ) j = ReLU ( h ( k ) j ) to be negative and positive cases as C0 = C ∩ ( h ( k ) j ≥ 0 ) and C1 = C ∩ ( h ( k ) j < 0 ) for a ReLU-based network ; for each sub-domain Ci , BaB based methods perform bounding to obtain a relaxed but sound lower bound fCi . A tightened global lower bound over C can then be obtained by taking the minimum values of the sub-domain lower bounds from all the sub-domains : f = mini fCi . Branching and bounding will be performed recursively to tighten the approximated global lower bound over C until either ( 1 ) the global lower bound f becomes larger than 0 and prove the property or ( 2 ) a violation ( e.g. , adversarial example ) is located in a sub-domain to disprove the property . Essentially , we build a search tree where each leaf is a sub-domain , and the property P can be proven only when it is valid on all leaves . Soundness of BaB We say the verification process is sound if we can always trust the “ yes ” ( P is verified ) answer given by the verifier . It is straightforward to see that the whole BaB based verification process is sound as long as the bounding method used for each sub-domain Ci is sound . Completeness of BaB The completeness of the BaB-based NN verification process , which was usually assumed true in some previous works ( Bunel et al. , 2020b ; 2018 ) , in fact , is not always true even if all possible sub-domains are considered with a sound bounding method . Additional requirements for the bounding method are required - we point out that a key factor for completeness involves feasibility checking in the bounding method which we will discuss in Section 3.2 . Branching in BaB Since branching step determines the shape of the search tree , the main challenge is to efficiently choose a good leaf to split , which can significantly reduce the total number of branches and running time . In this work we focus on branching on activation ( ReLU ) nodes . BaBSR ( Bunel et al. , 2018 ) includes a simple branching heuristic which assigns each ReLU node a score to estimate the improvement for tightening f by splitting it , and splits the node with the highest score . Bounding with Linear Programming ( LP ) A typical bounding method used in BaB based verification is the Linear Programming bounding procedure ( sometimes simply referred to as “ LP ” or “ LP verifier ” in our paper ) . Specifically , we transform the original verification problem into a linear programming problem by relaxing every activation unit as a convex ( linear ) domain ( Ehlers , 2017 ) and then get the lower bound fCi with a linear solver given domain Ci . For instance , as shown in Figure 1a , g ( i ) j = ReLU ( h ( i ) j ) can be linearly relaxed with the following 3 constraints : ( 1 ) g ( i ) j ≥ h ( i ) j ; ( 2 ) g ( i ) j ≥ 0 ; ( 3 ) g ( i ) j ≤ u ( i ) j u ( i ) j −l ( i ) j ( h ( i ) j − l ( i ) j ) . Note that the lower bound l ( i ) j and upper bound u ( i ) j for each activation node h ( i ) j are required in the LP construction given Ci . They are typically computed by the existing cheap bounding methods like LiRPA variants ( Wong & Kolter , 2018 ) with low cost . The tighter the intermediate bounds ( l ( i ) j , u ( i ) j ) are , the tighter f approximated by LP is . 2.3 LINEAR RELAXATION BASED PERTURBATION ANALYSIS ( LiRPA ) Bound propagation in LiRPA We used Linear Relaxation based Perturbation Analysis ( LiRPA ) 1 as bound procedure in BaB to get linear upper and lower bounds of NN output w.r.t input x ∈ C : Ax+ b ≤ f ( x ) ≤ Ax+ b , x ∈ C ( 2 ) 1We only use the backward mode LiRPA bounds ( e.g. , CROWN and DeepPoly ) in this paper . l ( i ) j u ( i ) j x ( i ) j h ( i ) j A lower bound f can then be simply obtained by taking the lower bound of the linear equation Ax+ b w.r.t input x ∈ C , which can be obtained via Hölder ’ s inequality when C is a ` p norm ball . To get the coefficients A , A , b , b , LiRPA propagates bounds of f ( x ) as a linear function to the output of each layer , in a backward manner . At the output layer h ( L ) ( x ) we simply have : Ih ( L ) ( x ) ≤ f ( x ) ≤ Ih ( L ) ( x ) , x ∈ C ( 3 ) Then , the next step is to backward propagate the identity linear relationship through a linear layer h ( L ) ( x ) = W ( L ) g ( L−1 ) ( x ) to get the linear bounds of f ( x ) w.r.t g ( L−1 ) : W ( L ) g ( L−1 ) ( x ) ≤ f ( x ) ≤W ( L ) g ( L−1 ) ( x ) , x ∈ C ( 4 ) To get the linear relationship of h ( L−1 ) w.r.t f ( x ) , we need to backward propagate through ReLU layer g ( L−1 ) ( x ) = ReLU ( h ( L−1 ) ( x ) ) . Since it is nonlinear , we perform linear relaxations . For illustration , considering the j-th ReLU neuron at i-th layer , g ( i ) j ( x ) = ReLU ( h ( i ) j ( x ) ) , we can linearly upper and lower bound it by a ( i ) j h ( i ) j ( x ) + b ( i ) j ≤ g ( i ) j ( x ) ≤ a ( i ) j h ( i ) j ( x ) + b ( i ) j , where a ( i ) j , a ( i ) j , b ( i ) j , b ( i ) j are : a ( i ) j = a ( i ) j = 0 , b ( i ) j = b ( i ) j = 0 u ( i ) j ≤ 0 ( always inactive for x ∈ C ) a ( i ) j = a ( i ) j = 1 , b ( i ) j = b ( i ) j = 0 l ( i ) j ≥ 0 ( always active for x ∈ C ) a ( i ) j = α ( i ) j , a ( i ) j = u ( i ) j u ( i ) j −l ( i ) j , b ( i ) j = 0 , b ( i ) j = − u ( i ) j l ( i ) j u ( i ) j −l ( i ) j l ( i ) j < 0 , u ( i ) j > 0 ( unstable for x ∈ C ) ( 5 ) Here l ( i ) j ≤ h ( i ) j ( x ) ≤ u ( i ) j are intermediate pre-activation bounds for x ∈ C , and α ( i ) j is an arbitrary value between 0 and 1 . The pre-activation bounds l ( i ) j and u ( i ) j can be computed by treating h ( i ) j ( x ) as the output neuron with LiRPA . Figure 1 ( b , c , d ) illustrate the relaxation for each state of ReLU neuron . With these linear relaxations , we can get the linear equation of h ( L−1 ) w.r.t output f ( x ) : W ( L ) D ( L−1 ) α h ( L−1 ) ( x ) + b ( L ) ≤ f ( x ) ≤W ( L ) D ( L−1 ) α h ( L−1 ) ( x ) + b ( L ) , x ∈ C D ( L ) α , ( j , j ) = { a ( L ) j , W ( L ) j ≥ 0 a ( L ) j , W ( L ) j < 0 , b ( L ) = b′ ( L ) > W ( L ) , where b′ ( L ) j = { b ( L ) j , W ( L ) j ≥ 0 b ( L ) j , W ( L ) j < 0 ( 6 ) The diagonal matrices D ( L−1 ) α , D ( L−1 ) α and biases reflects the linear relaxations and also considers the signs in W ( L ) to maintain the lower and upper bounds . The definitions for j-th diagonal element D ( L ) α , ( j , j ) and bias b ( L ) are similar , with the conditions for checking the signs of W ( L ) j swapped . Importantly , D ( L−1 ) α has free variables α ( i ) j ∈ [ 0 , 1 ] which do not affect correctness of the bounds . We can continue backward propagating these bounds layer by layer ( e.g. , g ( L−2 ) ( x ) , h ( L−2 ) ( x ) , etc ) until reaching g ( 0 ) ( x ) = x , getting the eventual linear equations of f ( x ) in terms of input x : L ( x , α ) ≤ f ( x ) ≤ U ( x , α ) , ∀x ∈ C , where L ( x , α ) = W ( L ) D ( L−1 ) α · · ·D ( 1 ) α W ( 1 ) x+ b , U ( x , α ) = W ( L ) D ( L−1 ) α · · ·D ( 1 ) α W ( 1 ) x+ b ( 7 ) Hereα denotes α ( i ) j for all unstable ReLU neurons in NN . The obtained bounds ( L ( x , α ) , U ( x , α ) ) of f ( x ) are linear functions in terms of x . Beyond the simple feedforward NN presented here , LiRPA can support more complicated NN architectures like DenseNet and Transformers by computing L and U automatically and efficiently on general computational graphs ( Xu et al. , 2020 ) . Soundness of LiRPA The above backward bound propagation process guarantees that L ( x , α ) and U ( x , α ) soundly bound f ( x ) for all x ∈ C. Detailed proofs can be found in ( Zhang et al. , 2018 ; Singh et al. , 2019b ) for feedforward NNs and ( Xu et al. , 2020 ) for general networks .

Summary: This paper describes a branch-and-bound (BaB) process for neural network verification that uses linear relaxation based perturbation analysis (LiRPA). It gives a way to tighten the bounds obtained via LiRPA. Overall, this results is a complete verification procedure, which is an order of magnitude faster than existing linear programming (LP) procedures.