Boosting Robustness Certification of Neural Networks

1 INTRODUCTION . Neural networks are increasingly applied in critical domains such as autonomous driving ( Bojarski et al. , 2016 ) , medical diagnosis ( Amato et al. , 2013 ) , and speech recognition ( Hinton et al. , 2012 ) . However , it has been shown by Goodfellow et al . ( 2014 ) that neural networks can be vulnerable against adversarial attacks , i.e. , imperceptible input perturbations cause neural networks to misclassify . To address this challenge and prove that a network is free of adversarial examples ( usually , in a region around a given input ) , recent work has started investigating the use of certification techniques . Current verifiers can be broadly classified as either complete or incomplete . Complete verifiers are exact , i.e. , if the verifier fails to certify a network then the network is nonrobust ( and vice-versa ) . Existing complete verifiers are based on Mixed Integer Linear Programming ( MILP ) ( Lomuscio & Maganti , 2017 ; Fischetti & Jo , 2018 ; Dutta et al. , 2018 ; Cheng et al. , 2017 ) or SMT solvers ( Katz et al. , 2017 ; Ehlers , 2017 ) . Although precise , these can only handle networks with a small number of layers and neurons . To scale , incomplete verifiers usually employ overapproximation methods and hence they are sound but may fail to prove robustness even if it holds . Incomplete verifiers use methods such as duality ( Dvijotham et al. , 2018 ) , abstract interpretation ( Gehr et al. , 2018 ; Singh et al. , 2018 ; 2019 ) , linear approximations ( Weng et al. , 2018 ; Wong & Kolter , 2018 ; Zhang et al. , 2018 ) , semidefinite relaxations ( Raghunathan et al. , 2018 ) , combination of linear and non-linear approximation ( Xiang et al. , 2017 ) , or search space discretization ( Huang et al. , 2017 ) . Incomplete verifiers are more scalable than complete ones , but can suffer from precision loss for deeper networks . In principle , incomplete verifiers can be made asymptotically complete by iteratively refining the input space ( Wang et al. , 2018a ) or the neurons ( Wang et al. , 2018b ) ; however , in the worst case , this may eliminate any scalability gains and thus defeat the purpose of using overapproximation in the first place . This work : boosting complete and incomplete verifiers . A key challenge then is to design a verifier which improves the precision of incomplete methods and the scalability of complete ones . In this work , we make a step towards addressing this challenge based on two key ideas : ( i ) a combination of state-of-the-art overapproximation techniques used by incomplete methods , including LP relaxations , together with MILP solvers , often employed in complete verifiers ; ( ii ) a novel heuristic , which points to neurons whose approximated bounds should be refined . We implemented these ideas in a system called RefineZono , and showed that is is faster than state-of-the-art complete verifiers on small networks while improving precision of existing incomplete verifiers on larger networks . The recent works of ( Wang et al. , 2018b ) and Tjeng et al . ( 2019 ) have also explored the combination of linear programming with overapproximation . However , both use simpler and coarser overapproximations than ours . Our evaluation shows that RefineZono is faster than both for complete verification . For example , RefineZono is faster than the work of Tjeng et al . ( 2019 ) for the complete verification of a 3 × 50 network , while for the larger 9 × 200 network their method does not finish within multiple days on images which RefineZono verifies in ≈ 14 minutes . Main contributions . Our main contributions are : • A refinement-based approach for certifying neural network robustness that combines the strengths of fast overapproximation methods with MILP solvers and LP relaxations . • A novel heuristic for selecting neurons whose bounds should be further refined . • A complete end-to-end implementation of our approach in a system called RefineZono , publicly available at https : //github.com/eth-sri/eran . • An evaluation , showing that RefineZono is more precise than existing state-of-the-art incomplete verifiers on larger networks and faster ( while being complete ) than complete verifiers on smaller networks . 2 OVERVIEW . We now demonstrate how our method improves the precision of a state-of-the-art incomplete verifier . The main objective here is to provide an intuitive understanding of our approach ; full formal details are provided in the next section . Consider the simple fully connected feedforward neural network with ReLU activations shown in Fig . 1 . There are two inputs to the network , both in the range [ 0 , 1 ] . The network consists of an input layer , two hidden layers , and one output layer . Each layer consist of two neurons each . For our explanation , we separate each neuron into two parts : one represents the output of the affine transformation while the other captures the output of the ReLU activation . The weights for the affine transformation are represented by weights on the edges . The bias for each node is shown above or below it . Our goal is to verify that for any input in [ 0 , 1 ] × [ 0 , 1 ] , the output at neuron x13 is greater than the output at x14 . We now demonstrate how our verifier operates on this network . We assume that the analysis results after the second affine transformation are refined using a MILP formulation of the network whereas the results after the third affine transformation are refined by an LP formulation of the network . In the next section , we will explain our heuristic for selecting MILP or LP formulations of different neurons in the network . Our analysis leverages the Zonotope domain ( Ghorbal et al. , 2009 ) together with the abstract Zonotope transformers specialized to neural network activations as used in DeepZ ( Singh et al. , 2018 ) , a state of the art verifier for neural network robustness . The Zonotope domain associates an affine form x̂ with each neuron x in the network : x̂ : = c0 + p∑ i=1 ci · ηi Here , c0 , ci ∈ R are real coefficients and ηi ∈ [ si , ti ] ⊆ [ −1 , 1 ] are the noise symbols , which are shared between the affine forms for different neurons . This sharing makes the domain relational and thus more precise than non-relational domains such as Interval ( Box ) . An abstract element in our analysis is an intersection between a Zonotope ( given as a list of affine forms ) and a bounding box . Thus , for each neuron x , we keep the affine form x̂ and an interval [ lx , ux ] . First layer . Our analysis starts by setting x̂1 = 0.5 + 0.5 · η1 , l1 = 0 , u1 = 1 and x̂2 = 0.5 + 0.5 · η2 , l2 = 0 , u2 = 1 , representing the input [ 0 , 1 ] at x1 and [ 0 , 1 ] at x2 in our domain , respectively . Next , an affine transformation is applied on the inputs resulting in the output x̂3 = x̂1 + x̂2 = 1 + 0.5 · η1 + 0.5 · η2 , l3 = 0 , u3 = 2 and x̂4 = x̂1 − x̂2 = 0.5 · η1 − 0.5 · η2 , l4 = −1 , u4 = 1 . Note that the Zonotope affine transformer is exact for this transformation . Next , the Zonotope ReLU transformer is applied . We note that as l3 ≥ 0 , the neuron x3 provably takes only non-negative values . Thus , the ReLU Zonotope transformer outputs x̂5 = x̂3 and we set l5 = l3 , u5 = l3 which is the exact result . For x4 , l4 < 0 and u4 > 0 and thus neuron x4 can take both positive and negative values . The corresponding output does not have a closed affine form and hence the approximation in blue shown in Fig . 2 is used to compute the result . This approximation minimizes the area of the result in the input-output plane and introduces a new noise symbol η3 ∈ [ −1 , 1 ] . The result is x̂6 = 0.25 + 0.25 · η1 − 0.25 · η2 + 0.25 · η3 , l6 = −0.5 , u6 = 1 . Note that the Zonotope approximation for x6 from Fig . 2 permits negative values whereas x6 can only take non-negative values in the concrete . This overapproximation typically accumulates as the analysis progresses deeper into the network , resulting in overall imprecision and failure to prove properties that actually hold . MILP-based refinement at second layer . Next , the analysis handles the second affine transformation and computes x̂7 = x̂5 − x̂6 + 1 = 1.75 + 0.25 · η1 + 0.75 · η2 − 0.25 · η3 , l7 = 0.5 , u7 = 3 and x̂8 = x̂5 − x̂6 − 1 = −0.25 + 0.25 · η1 + 0.75 · η2 − 0.25 · η3 , l8 = −1.5 , u8 = 1 . Here , x7 is provably positive , whereas x8 can take both positive and negative values . Due to the approximation for x6 , the bounds for x7 and x8 are imprecise . Note that the DeepZ ReLU transformer for x8 applied next will introduce more imprecision and although the ReLU transformer for provably positive inputs such as x7 does not lose precision with respect to the input , it still propagates the imprecision in the computation of the abstract values for x7 . Thus , to reduce precision loss , in our method we refine the bounds for both x7 and x8 by formulating the network up to ( and including ) the second affine transformation as a MILP instance based on a formulation from Tjeng et al . ( 2019 ) and compute bounds for x7 and x8 , respectively . The MILP solver improves the lower bounds for x7 and x8 to 1 and −1 , respectively , which then updates the corresponding lower bounds in our abstraction , i.e. , l7 = 1 and l8 = −1 . Next , the ReLU transformer is applied . Since x7 is provably positive , we get x̂9 = x̂7 , l9 = l7 , and u9 = u7 . We note that x8 can take both positive and negative values and is therefore approximated . However , the ReLU transformer now uses the refined bounds instead of the original bounds and thus the approximation shown in green from Fig . 2 is used . This approximation has smaller area in the input-output plane compared to the blue one and thus reduces the approximation error . The result is x̂10 = 0.125 + 0.125 · η1 + 0.375 · η2 − 0.125 · η3 + 0.25 · η4 , l8 = −0.5 , u8 = 1 . LP-based refinement at final layer . Continuing with the analysis , we now process the final affine transformation , which yields x̂11 = 4.875 + 0.625 · η1 + 1.875 · η2 − 0.625 · η3 + 0.25 · η4 , l11 = 1.75 , u11 = 8.25 and x̂12 = 2.625 + 0.125 · η1 + 0.375 · η2 − 0.125 · η3 − 0.25 · η4 , l12 = 1.75 , u12 = 3.5 . Due to the approximations from previous layers , the computed values can be imprecise . We note that , as the analysis proceeds deeper into the network , refining bounds with MILP becomes expensive . Thus , we refine the bounds by encoding the network up to ( and including ) the third affine transformation using the faster LP relaxation of the network based on Ehlers ( 2017 ) and compute the bounds for x11 and x12 , respectively . This leads to better results for l11 = 3.25 , l12 = 2 , and u12 = 3 . As both x11 and x12 are provably positive , the subsequent ReLU transformations set x̂13 = x̂11 , l13 = l11 , u13 = u11 and x̂14 = x̂12 , l14 = l12 , u14 = u12 . Proving robustness . Since the lower bound l13 for x13 is greater than the upper bound u14 for x14 , our analysis can prove that the given neural network provides the same label for all inputs in [ 0 , 1 ] × [ 0 , 1 ] and is thus robust . In contrast , DeepZ without our refinement would compute x̂13 = 4.95 + 0.6 · η1 + 1.8 · η2 − 0.6 · η3 + 0.3 · η4 , l13 = 1.65 , u13 = 8.25 and x̂14 = 2.55 + 0.15 · η1 + 0.45 · η2 − 0.15 · η3 − 0.3 · η4 , l14 = 1.5 , u14 = 3.6 . As a result , DeepZ fails to prove that x13 is greater than x14 , and thus fails to prove robustness . Generalization to other abstractions . We note that our refinement-based approach is not restricted to the Zonotope domain . It can be extended for refining the results computed by other abstractions such as Polyhedra ( Singh et al. , 2017 ) or the abstraction used in DeepPoly ( Singh et al. , 2019 ) . For example , the ReLU transformer in Singh et al . ( 2019 ) also depends on the bounds of input neurons and thus it will benefit from the precise bounds computed using our refinement . Since DeepPoly often produces more precise results than DeepZ , we believe a combination of this work with DeepPoly will further improve verification results .

Summary: In the paper, the authors provide a new approach for verifying the robustness of deep neural networks that combines complete yet expensive methods based on mixed integer-linear programming (MILP) and incomplete yet cheap methods based on abstract interpretation or linear-programming relaxation. Roughly speaking, the approach is to run an abstract interpreter but to refine its results at early layers of a neural network using mixed integer-linear programming and some of later layers using linear programming. The unrefined results of the abstract interpreter help these refinement steps. They help prioritize or prune the refinement of the abstract-interpretation results at neurons at a layer. Using neural networks with 3, 5, 6, 9 layers and the MNIST dataset, the authors compared their approach with AI^2, which uses only abstract interpretation. This experimental comparison shows that the approach can prove the robustness of more examples for all of these networks.