Beta-CROWN: Efﬁcient Bound Propagation with Per-neuron Split Constraints for Neural Network Robustness Veriﬁcation
Abstract
We develop β -CROWN, a new bound propagation based method that can fully encode neuron split constraints in branch-and-bound (BaB) based complete veriﬁcation via optimizable parameters β .
When jointly optimized in intermediate layers, β -CROWN generally produces better bounds than typical LP veriﬁers with neuron split constraints, while being as efﬁcient and parallelizable as existing bound propagation methods such as CROWN on GPUs.
Applied to complete robustness veriﬁcation benchmarks, β -CROWN with BaB is close to three orders of magnitude faster than LP-based
BaB methods, and is at least 3 times faster than winners of VNN-COMP 2020 competition while producing lower timeout rates.
By terminating
BaB early, our method can also be used for efﬁcient incomplete veriﬁcation.
We achieve higher veriﬁed accuracy in many settings over powerful incomplete veriﬁers, including those based on convex barrier breaking techniques.
Compared to the typically tightest but very costly semideﬁnite programming (SDP) based incomplete veriﬁers, we obtain higher veriﬁed accuracy with three orders of magnitudes less veriﬁcation time, and enable better certiﬁcation for veriﬁcation-agnostic (e.g., adversarially trained) networks.
1. Introduction
As neural networks (NNs) are being deployed in safetycritical applications, it becomes increasingly important to formally verify their behaviors under potentially malicious inputs.
Broadly speaking, the neural network veriﬁcation problem involves proving certain desired relationships between inputs and outputs (often referred to as speciﬁcations ), such as safety or robustness guarantees, for all inputs inside some domain.
This is a challenging problem due to the non-convexity and high dimensionality of neural networks.
We ﬁrst focus on complete veriﬁcation: the veriﬁer should give a deﬁnite “yes/no” answer given sufﬁcient time.
Many complete veriﬁers rely on branch and bound (BaB) (Bunel et al., 2018) involving (1) branching by recursively splitting the original veriﬁcation problem into subdomains (e.g., splitting a ReLU into positive/negative linear regions) and (2) bounding each subdomain with specialized incomplete veriﬁers.
Traditional BaB-based veriﬁers use expensive linear programming (LP) solvers (Ehlers, 2017; Lu & Kumar, 2020; Bunel et al., 2020b) as incomplete veriﬁers which can fully encode neuron split constraints for tight bounding.
Meanwhile, a recent work (Xu et al., 2021) shows that cheap incomplete veriﬁers can signiﬁcantly accelerate complete veriﬁers on GPUs over LP-based ones thanks to their efﬁciency.
We call these cheap incomplete veriﬁers bound propagation methods (Wong & Kolter, 2018; Dvijotham et al., 2018; Gehr et al., 2018; Singh et al., 2019b).
However, unlike LP solvers, these methods lack the power to handle neuron split constraints in BaB. Such a problem causes loose bounds and unnecessary branching, hurting the veriﬁcation efﬁciency.
Even worse, they fail to detect many infeasible subdomains in BaB, leading to incompleteness unless additional checking is performed (Xu et al., 2021).
In our work, we develop a new, fast bound propagation based incomplete veriﬁer, β -CROWN.
It solves an optimization problem equivalent to the expensive LP based methods with neuron split constraints while still enjoying the efﬁciency of bound propagation methods.
β -CROWN contains optimizable parameters α and β , and any valid settings of these parameters yield sound bounds for veriﬁcation.
These parameters are optimized using a few steps of (super)gradient ascent to achieve bounds as tight as possible.
Furthermore, we can jointly optimize α and β for intermediate layer bounds, allowing β -CROWN to tighten relaxations and outperform typical LP veriﬁers with ﬁxed intermediate layer bounds.
Unlike traditional LP-based BaB methods, β -CROWN can be efﬁciently implemented with an automatic differentiation framework on GPUs to fully exploit the power of modern accelerators.
The combination of β -CROWN and BaB ( β -CROWN BaB) produces a complete veriﬁer with GPU acceleration, reducing the veriﬁcation time of traditional LP based BaB veriﬁers (Bunel et al., 2018) by almost three orders of magnitudes on standard benchmarking models.
Compared to state-of-the-art veriﬁers like ERAN and OVAL (the leading methods in
VNN competition 2020 (Liu & Johnson)), our approach is 3 to 70 times faster with similar or lower timeout rates.
Finally, by terminating our complete veriﬁer β -CROWN
BaB early, our approach can also function as a more accurate incomplete veriﬁer by returning an incomplete but sound lower bound of all subdomains explored so far.
We achieve better veriﬁed accuracy on a few benchmarking models over powerful incomplete veriﬁers including those based on multi-neuron convex relaxations (Singh et al., 2019a; Tjandraatmadja et al., 2020; Müller et al., 2021) and semideﬁnite relaxations (Dathathri et al., 2020).
Compared to the typically tightest but very costly incomplete veriﬁer
SDP-FO (Dathathri et al., 2020)
based on tight semideﬁnite programming (SDP) relaxations (Raghunathan et al., 2018;
Dvijotham et al., 2020), our method obtains consistently higher veriﬁed accuracy while reducing veriﬁcation time by three orders of magnitudes, enabling better certiﬁcation on veriﬁcation-agnostic (e.g., adversarially trained) models.
2. Related Work
Early complete veriﬁers relied on existing solvers (Katz et al., 2017; Ehlers, 2017; Huang et al., 2017; Dutta et al., 2018; Tjeng et al., 2019) and were limited to very small problem instances.
BaB based method was proposed to better exploit the network structure using LP-based incomplete veriﬁer for bounding and ReLU splits for branching (Bunel et al., 2018;
Wang et al., 2018a; Lu & Kumar, 2020; Botoeva et al., 2020).
Input domain branching was also considered in (Wang et al., 2018b; Royo et al., 2019; Anderson et al., 2019) but limited by input dimensions (Bunel et al., 2018).
Traditional complete veriﬁers may need hours to verify one example on networks with a few thousand neurons.
Recently, a few approaches used efﬁcient iterative solvers or bound propagation methods on GPUs without relying on
LPs.
Bunel et al.
(2020a) decomposed the veriﬁcation problem layer by layer, solved each layer in a closed form on
GPUs, and used Lagrangian to enforce consistency between layers.
De Palma et al.
(2021a) used a dual-space veriﬁer with a tighter linear relaxation (Anderson et al., 2020; Tjandraatmadja et al., 2020) than LP at a cost of high complexity.
A concurrent work BaDNB (De Palma et al., 2021b) proposed a new branching strategy “ﬁltered smart branching” for better veriﬁcation performance.
Xu et al.
(2020) used
CROWN as an efﬁcient incomplete solver on GPUs for complete veriﬁcation, but it cannot handle neuron split constraints, leading to suboptimal efﬁciency and more timeouts.
For incomplete veriﬁcation, Salman et al.
(2019) showed the inherent limitation of using per-neuron convex relaxations.
Singh et al.
(2019a)
and Müller et al.
(2021) broke this barrier by relaxing multiple ReLU neurons; Tjandraatmadja et al.
(2020) considered relaxing a layer of neurons using a strong mixed-integer programming formulation (Anderson et al., 2019).
SDP based relaxations (Raghunathan et al., 2018; Fazlyab et al., 2020; Dvijotham et al., 2020; Dathathri et al., 2020) typically produce tight bounds but with signiﬁcantly higher cost.
We break this barrier using branch and bound, and outperform existing incomplete veriﬁers under many scenarios in both runtime and tightness.
3. β -CROWN for NN Veriﬁcation
Notations.
We deﬁne the input of a neural network as x ∈ R d 0 , and deﬁne the weights and biases of an Llayer neural network as W ( i ) ∈
R d i × d i − 1 and b ( i
) ∈
R d i ( i ∈ { 1 , · · · , L } ) respectively.
For simplicity we assume that d L = 1 so W ( L ) is a vector and b ( L ) is a scalar.
The neural network function f : R d 0 → R is deﬁned as f ( x ) =
z ( L ) ( x ) , where z ( i ) ( x ) =
W ( i )
ˆ z ( i − 1) ( x ) + b
( i ) , ˆ z ( i ) ( x ) =
σ ( z ( i ) ( x )) and ˆ z (0) ( x ) = x . σ is the activation function and we use ReLU throughout this paper.
When the context is clear, we omit · ( x ) and use z ( i ) j and ˆ z ( i ) j to represent the pre-activation and post-activation values of the j -th neuron in the i -th layer.
The set C deﬁnes the allowed input region.
We consider the canonical speciﬁcation f ( x ) >
: if we can prove that f ( x ) > 0 , ∀ x ∈ C , we say f ( x ) is veriﬁed.
Under x ∈ C , we deﬁne the intermediate layer bounds l ( i )
j ≤ z ( i ) j ≤ u ( i ) j .
When using branch-and-bound, we denote the Z
+( i ) and Z − ( i ) as the set of neuron indices with positive and negative split constraints in layer i .
We deﬁne the split constraints at layer i as Z ( i ) :
= { z ( i ) |
z ( i ) j 1 ≥ 0 , z
( i ) j 2 < 0 , ∀ j 1 ∈ Z
+( i ) , ∀
j 2 ∈ Z − ( i ) } .
We denote the vector of all pre-ReLU neurons as z , and we deﬁne a set Z to represent the split constraints on z : Z = Z (1)
∩ Z (2) ∩ · · · ∩ Z ( L − 1) .
For convenience, we also use the shorthand
˜ Z ( i ) :
= Z (1) ∩ · · · ∩ Z ( i ) and ˜ z ( i ) :
= { z (1) , z (2) , · · · , z ( i ) } .
Bound Propagation with Neuron Split Constraints
The NN veriﬁcation problem under neuron split constraints can be written as an optimization: min x ∈C ,z ∈Z f ( x ) .
Bound propagation methods such as CROWN (Zhang et al., 2018) can give a relatively tight lower bound for min x ∈C f ( x ) but they cannot handle the neuron split constraints z ∈ Z .
We now show the intuition on how to apply split constraints to the bound propagation process.
To encode the neuron splits, we deﬁne diagonal matrix
S ( i ) ∈
R
d i × d i where i ∈ [1 , · · · L − 1] , j ∈ [1 , · · · , d i ] :
S ( i ) j,j = − 1 ( z ( i ) j ≥ 0); S ( i ) j,j =1 ( z ( i ) j < 0); S ( i ) j,j =0 (no split)
We start from last layer and derive linear bounds for each intermediate layer z
( i ) and
ˆ z
( i ) for both x ∈ C and z ∈ Z .
We also assume that pre-ReLU bounds l ( i )
≤ z ( i ) ≤ u ( i ) for each layer i are available.
By deﬁnition of NN we have:
[Equation]
Since ˆ z ( L − 1) =
ReLU( z ( L − 1) ) , we can relax ReLU similarly as done in CROWN (see Lemma A.1) at layer L − 1 , and obtain a linear lower bound for f ( x ) w.r.t.
z ( L − 1) :
[Equation]
To enforce the split neurons at layer L − 1 , we use a Lagrange function with β ( L − 1) (cid:62) S ( L − 1) multiplied on z ( L − 1) :
[Equation]
The ﬁrst inequality is due to the deﬁnition of the Lagrange function: we remove the constraint z
( L − 1)
∈
Z ( L − 1) and use a multiplier to replace this constraint.
The second inequality is due to weak duality.
Due to the design of
S ( L − 1) , neuron split z ( L − 1) j ≥ 0 has a negative multiplier − β ( L − 1) j and split z ( L − 1)
j < 0 has a positive multiplier β ( L − 1) j .
Any β ( L − 1) ≥ 0 yields a lower bound for the constrained optimization.
Then we can substitute z ( L − 1) with
W ( L − 1)
ˆ z ( L − 2) +
b ( L − 1) into Eq.
9 for the next layer.
The above bound propagation process continues until reaching input layer, with each layer’s split constraints handled via optimizable β variables.
Following this procedure, we give a linear lower bound for f ( x ) under split constraints z ∈ Z :
Theorem 3.1 ( β - CROWN bound) .
Given an L -layer NN f ( x ) : R d 0 → R with weights W ( i ) , biases b ( i ) , pre-ReLU bounds l ( i )
≤ z ( i ) ≤ u ( i ) ( 1 ≤ i ≤ L ), input bounds C , split constraints Z .
We have:
[Equation]
where a ∈ R d 0 , P ∈ R d 0 × ( (cid:80) L − 1 i =1 d i ) , q ∈ R (cid:80) L − 1 i =
d i and c ∈ R are functions of W ( i ) , b ( i ) , l ( i ) , u ( i ) .
β := (cid:2) β (1) (cid:62) β (2) (cid:62) · · · β ( L − 1) (cid:62) (cid:3) (cid:62) concatenates all β ( i ) .
Detailed formulations for a , P , q and c are given in Appendix C. For (cid:96) p norm robustness ( C = { x | (cid:107) x − x 0 (cid:107) p ≤ (cid:15) } ), the inner minimization has a closed solution: min x ∈C
[Equation]
where 1 p + 1 q = 1 .
The maximization is concave in β ( q ≥ 1 ), so we can optimize it using projected (super)gradient ascent with gradients from automatic differentiation.
Since any β ≥ 0 yields a valid lower bound for min x ∈C ,z ∈Z f ( x ) , convergence is not necessary to guarantee soundness.
An additional optiomizable variable during bound propagation are the slopes of lower bound used for relaxing unstable
ReLU neurons (Xu et al., 2021).
We deﬁne α ( i ) ∈
R d i as the slopes of lower bounds for unstable ReLU (detailed in
Lemma A.1) for layer i and deﬁne all free variables α :=
{ α (1) · · · α ( L − 1) } .
Since any 0 ≤ α ( i ) j ≤ 1 yields a valid bound, we can optimize it to tighten the bound.
Formally, we rewrite the optimization problem with α explicitly:
[Equation]
g is a function of l ( i ) j and u ( i )
j
(intermediate layer bounds).
These bounds are also computed using β -CROWN using independent sets of α , β variables and are optimized jointly.
The joint optimization allows us to outperform typical LP veriﬁer with ﬁxed intermediate bounds (Xu et al., 2021).
Connections to the Dual Problem Many BaB based complete veriﬁers (Bunel et al., 2018; Lu & Kumar, 2020) use an LP formulation as the incomplete veriﬁer (detailed in
Section B.2).
We ﬁrst show that it is possible to derive Theorem B.1 from the dual of this LP, leading to Theorem B.2:
Theorem 3.2.
The objective d LP for the dual problem of the
LP in (Bunel et al., 2018) can be represented as
[Equation]
where a , P , q and c are deﬁned in the same way as in
Theorem B.1, and β ≥ 0 corresponds to the dual variables of neuron split constraints in the LP problem.
An immediate consequence is that β -CROWN can potentially solve the veriﬁcation problem with split constraints as well as using an LP solver with ﬁxed intermediate bounds:
Corollary 3.2.1.
When α and β are optimally set and intermediate bounds l , u are ﬁxed, β -CROWN produces p ∗ LP , the optimal objective of LP with split constraints in Eq.
[Equation]
β -CROWN with Branch and Bound ( β -CROWN BaB)
We perform complete veriﬁcation following BaB framework (Bunel et al., 2018) using β -CROWN as the incomplete solver, and we use simple branching heuristics like
BaBSR (Bunel et al., 2020b) or FSB (De Palma et al., 2021b).
To efﬁciently utilize GPU, we also use batch splits to evaluate multiple subdomains in the same batch as in (Xu et al., 2020; De Palma et al., 2021a).
We list our full algorithm β -CROWN BaB in Appendix D.
Theorem 3.3.
β -CROWN with Branch and Bound on splitting ReLUs is sound and complete.
[Table]
[Figure]
[Table]
[Figure]
[Table]
CROWN/DeepPoly are fast but loose bound propagation based methods, and they cannot be improved with more running time.
SDP-FO uses stronger semideﬁnite relaxations, which can be very slow and sometimes has convergence issues.
PRIMA is one of the best convex relaxation barrier breaking methods; we did not include kPoly and OptC2V because they are weaker than PRIMA (see Table 4) [Table]
[Table]
4. Experimental Results
Comparison to Complete Veriﬁers We evaluate our method and 10 baselines on complete veriﬁcation on dataset provided in (Lu & Kumar, 2020; De Palma et al., 2021a) and used in VNN competition 2020 (Liu & Johnson).
The dataset contains 3 CIFAR-10 models (Base, Wide, and
Deep) with 100 examples each.
Each data example is associated with an (cid:96) ∞ norm (cid:15) and a target label for veriﬁcation.
The details of each baseline and experimental setups can be found in
Appendix E. We report the average veriﬁcation time and branch numbers in Table 1 and plot the percentage of solved properties over time in Figure 1.
β -CROWN
FSB achieves the fastest average running time with minimal timeouts compared to all 10 baselines, and also clearly leads on the cactus plots.
Our beneﬁts are more clearly shown in Figure 1, where we solve 80% to 90% examples under 10 seconds and most other veriﬁers can only verify a small portion or none of the properties within 10 seconds.
Comparison to Incomplete Veriﬁers.
In Table 2 we compare against a state-of-the-art semideﬁnite programming (SDP)
based veriﬁer, SDP-FO (Dathathri et al., 2020), and a very recent strong multi-neuron linear relaxation method,
PRIMA (Müller et al., 2021), on 1 MNIST and 6 CIFAR10 models in (Dathathri et al., 2020).
The models were trained using adversarial training (veriﬁcation agnostic), which posed a challenge for veriﬁcation.
The SDP formulation can be tighter than linear relaxation based ones, but it takes 2 to 3 hours to converge on one GPU for verifying a single property, resulting 5,400 GPU hours to verify 200 testing images with 10 labels.
Due to resource limitations, we directly quote SDP-FO results from (Dathathri et al., 2020) on the same set of models, and evaluate veriﬁed accuracy on the same set of 200 test images for all other baselines.
Table 2 shows that overall we are three orders of magnitude faster than SDP-FO while still achieving consistently higher veriﬁed accuracy.
Additional results are in Appendix E.3.
A. Additional Background A.1. The NN Veriﬁcation Problem and the LP Veriﬁer.
Neural network veriﬁcation seeks the solution of the optimization problem in Eq. 5:
[Equation]
The set C deﬁnes the allowed input region and our aim is to ﬁnd the minimum of f ( x ) for x ∈ C , and throughout this paper we consider C as an (cid:96) ∞ ball around a data example x
0 : C = { x | (cid:107) x − x 0 (cid:107) ∞ ≤ (cid:15) } but other (cid:96) p norms can also be supported.
In practical settings, we typically have “speciﬁcations” to verify, which are (usually linear) functions of neural network outputs describing the desired behavior of neural networks.
For example, to guarantee robustness we typically investigate the margin between logits.
Because the speciﬁcation can also be seen as an output layer of NN and merged into f ( x ) under veriﬁcation, we do not discuss it in detail in this work.
We consider the canonical speciﬁcation f ( x ) >
: if we can prove that f ( x ) > 0 , ∀ x ∈ C , we say f ( x ) is veriﬁed.
A commonly used incomplete veriﬁcation technique is to relax non-convex ReLUs with linear constraints and turn the veriﬁcation problem into a linear programming (LP) problem, which can then be solved with linear solvers.
We refer to it as “LP veriﬁer” in this paper.
Speciﬁcally, given ReLU( z ( i ) j ) := max(0 , z ( i ) j ) and its intermediate layer bounds l ( i ) j ≤ z ( i ) j ≤ u ( i ) j , each ReLU can be categorized into three cases linearly relaxed differently: (1) if l ( i ) j ≥ 0 (ReLU in linear region)
then ˆ z ( i ) j
= z ( i ) j ; (2) if u ( i ) j ≤ 0 (ReLU in inactive region)
then ˆ z ( i ) j = 0 ; (3) if l ( i ) j ≤ 0 ≤ u ( i ) j (ReLU is unstable ) then three linear bounds are used:
ˆ z ( i ) j ≥ 0 , ˆ z ( i )
j ≥ z ( i ) j , and ˆ z ( i ) j ≤ u ( i ) j u ( i ) j − l ( i ) j (cid:16) z
( i ) j − l ( i ) j (cid:17) ; they are often referred to as the “triangle” relaxation (Ehlers, 2017; Wong & Kolter, 2018).
The intermediate layer bounds l ( i ) and u ( i ) are usually obtained from a cheaper bound propagation method (see next subsection).
LP veriﬁers can provide relatively tight bounds but linear solvers are still expensive especially when the network is large.
Also, unlike our β -CROWN, they have to use ﬁxed intermediate bounds and cannot use the joint optimization of intermediate layer bounds (Section B.3) to tighten relaxation.
A.2. CROWN: Efﬁcient Incomplete Veriﬁcation by Propagating Linear Bounds
Another cheaper way to give a lower bound for the veriﬁcation problem Eq.
5 is through sound bound propagation.
CROWN (Zhang et al., 2018) is a representative method that propagates a linear bound of f ( x ) w.r.t.
every intermediate layer in a backward manner until reaching the input x .
CROWN uses two linear constraints to relax unstable ReLU neurons: a linear upper bound ˆ z ( i ) j ≤ u ( i ) j u ( i ) j − l ( i ) j (cid:16) z ( i ) j − l ( i ) j (cid:17) and a linear lower bound ˆ z ( i ) j ≥ α
( i )
j z ( i ) j ( 0 ≤ α ( i ) j ≤ 1 ).
We can then bound the output of a ReLU layer:
Lemma A.1 (ReLU relaxation in CROWN) .
Given w, v ∈ R d , u ≤ v ≤ l (element-wise), we have
[Equation]
where D is a diagonal matrix containing free variables 0 ≤ α j ≤ 1 only when u j > 0 > l j and w j ≥ 0 , while its rest values as well as constant b (cid:48) are determined by l , u , w .
Detailed forms of each term are listed in Appendix C. Lemma A.1 can be repeatedly applied, resulting in an efﬁcient back-substitution procedure to derive a linear lower bound of NN output w.r.t.
x :
Lemma A.2 (CROWN bound (Zhang et al., 2018)) .
Given an L -layer ReLU NN f ( x ) : R d 0 → R with weights W ( i ) , biases b ( i ) , pre-ReLU bounds l ( i )
≤
z ( i ) ≤ u ( i ) ( 1 ≤ i ≤ L ) and input constraint x ∈ C .
We have
[Equation]
where a CROWN and c CROWN can be computed using W ( i ) , b ( i ) , l ( i ) , u ( i ) in polynomial time.
When C is an (cid:96) p norm ball, minimization over the linear function can be easily solved using Hölder’s inequality.
The main beneﬁt of CROWN is its efﬁciency: CROWN can be efﬁciently implemented on machine learning accelerators such as
GPUs (Xu et al., 2020) and TPUs (Zhang et al., 2020), and it can be a few magnitudes faster than an LP veriﬁer which is hard to parallelize on GPUs.
CROWN was generalized to general architectures (Xu et al., 2020; Shi et al., 2020) while we only demonstrate it for feedforward ReLU networks for simplicity.
A.3. Branch and Bound and Neuron Split Constraints
Branch and bound (BaB) method is widely adopted in complete veriﬁers (Bunel et al., 2018): we divide the domain of the veriﬁcation problem C into two subdomains C 1 = { x ∈ C , z
( i ) j ≥ 0 } and C 2 = { x ∈ C , z
( i ) j < 0 }
where z ( i ) j is an unstable
ReLU neuron in C but now becomes linear for each subdomain.
Incomplete veriﬁers can then estimate the lower bound of each subdomain with relaxations.
If the lower bound produced for subdomain C i (denoted by f C i ) is greater than 0,
C i is veriﬁed; otherwise, we further branch over domain C i by splitting another unstable ReLU neuron.
The process terminates when all subdomains are veriﬁed.
The completeness is guaranteed when all unstable ReLU neurons are split.
LP veriﬁer with neuron split constraints.
A popular incomplete veriﬁer used in BaB is LP veriﬁer.
Essentially, when we split the j -th ReLU in layer i , we can simply add z ( i ) j ≥ 0 or z ( i ) j < 0 to Eq.
5 and get a linearly relaxed lower bound to each subdomain.
We denote the Z
+( i ) and Z − ( i ) as the set of neuron indices with positive and negative split constraints in layer i .
We deﬁne the split constraints at layer i as Z ( i ) :
= { z ( i ) |
z ( i ) j 1 ≥ 0 , z
( i ) j 2 < 0 , ∀ j 1 ∈ Z
+( i ) , ∀ j 2 ∈
Z − ( i ) } .
We denote the vector of all pre-ReLU neurons as z , and we deﬁne a set Z to represent the split constraints on z : Z = Z (1)
∩ Z (2) ∩ · · · ∩ Z ( L − 1) .
For convenience, we also use the shorthand
˜ Z ( i ) :
= Z (1) ∩ · · · ∩ Z ( i ) and ˜ z ( i ) :
= { z (1) , z (2) , · · · , z ( i ) } .
LP veriﬁers can easily handle these neuron split constraints but are very expensive than bound propagation methods like CROWN and cannot be accelerated on GPUs.
Branching strategy.
Branching strategies (selecting which ReLU neuron to split) are generally agnostic to the incomplete veriﬁer used in BaB but do affect the overall BaB performance.
BaBSR (Bunel et al., 2020b) is a widely used strategy in complete veriﬁers, which is based on an fast estimates on objective improvements after splitting each neuron.
The neuron with highest estimated improvement is selected for branching.
Recently, Filtered Smart Branching (FSB) (De Palma et al., 2021b) improves BaBSR by mimicking strong branching - it utilizes bound propagation methods to evaluate the best a few candidates proposed by BaBSR and chooses the one with largest improvement.
Graph neural network (GNN) based branching was also proposed (Lu & Kumar, 2020).
Our β -CROWN BaB is a general complete veriﬁcation framework ﬁt for any potential branching strategy, and we evaluate both BaBSR and FSB in experiments.
B. Additional Technical Details
In main text we have given a brief overview of the our β -CROWN algorithm.
In this section, we will go over the details of the bound propagation processes with split constraints, derive the β -CROWN bounds from both primal space and dual space, and discuss how to tighten the bound using free parameters α and β .
Lastly, we describe β -CROWN BaB, a complete veriﬁer that also becomes a strong incomplete veriﬁer when stopped early.
B.1. β -CROWN: Linear Bound Propagation with Neuron Split Constraints
The NN veriﬁcation problem under neuron split constraints can be written as an optimization:
[Equation]
Bound propagation methods like CROWN can give a relatively tight lower bound for min x ∈C f ( x ) but they cannot handle the neuron split constraints z ∈ Z .
Before we present our main theorem, we ﬁrst show the intuition on how to apply split constraints to the bound propagation process.
To encode the neuron splits, we ﬁrst deﬁne diagonal matrix S ( i )
∈ R d i × d i in Eq.
7 where i ∈ [1 , · · · L − 1] , j ∈ [1 , · · · , d i ] :
[Equation]
We start from last layer and derive linear bounds for each intermediate layer z
( i ) and
ˆ z
( i ) for both x ∈ C and z ∈ Z .
We also assume that pre-ReLU bounds l ( i )
≤ z ( i ) ≤ u ( i ) for each layer i are available.
We initially have:
[Equation]
Since ˆ z ( L − 1) =
ReLU( z ( L − 1) ) , we can apply Lemma A.1 to relax the ReLU neuron at layer L − 1 , and obtain a linear lower bound for f ( x ) w.r.t.
z ( L − 1) :
[Equation]
To enforce the split neurons at layer L − 1 , we use a Lagrange function with β ( L − 1) (cid:62) S ( L − 1) multiplied on z ( L − 1) :
[Equation]
The ﬁrst inequality is due to the deﬁnition of the Lagrange function: we remove the constraint z
( L − 1)
∈
Z ( L − 1) and use a multiplier to replace this constraint.
The second inequality is due to weak duality.
Due to the design of S ( L − 1) , neuron split z ( L − 1) j ≥ 0 has a negative multiplier − β ( L − 1) j and split z ( L − 1)
j < 0 has a positive multiplier β ( L − 1) j .
Any β ( L − 1) ≥yields a lower bound for the constrained optimization.
Then we substitute z ( L − 1) with W ( L − 1)
ˆ z ( L − 2) +
b ( L − 1) for next layer:
[Equation]
We deﬁne a matrix A ( i ) to represent the linear relationship between f ( x ) and ˆ z ( i ) , where A ( L − 1)
=
W ( L ) according to Eq.
8 and A ( L − 2) =
( A ( L − 1) D ( L − 1)
+ β ( L − 1) (cid:62) S
( L − 1) )
W ( L − 1) by Eq.
Considering 1-dimension output f ( x ) ,
A ( i ) has only 1 row.
With A ( L − 2) , Eq. 10 becomes:
[Equation]
which is in a form similar to Eq.
8 except for the outer maximization over β ( L − 1) .
This allows the back-substitution process (Eq. 8, Eq. 9, and Eq. 10) to continue.
In each step, we swap max and min as in Eq.
9, so every maximization over β ( i ) is outside of min x ∈C .
Eventually, we have:
[Equation]
where β := (cid:2) β (1) (cid:62) β (2) (cid:62) · · · β ( L − 1) (cid:62) (cid:3) (cid:62) concatenates all β ( i ) vectors.
Following the above idea, we present the main theorem in Theorem B.1 (proof is given in Appendix C).
Theorem B.1 ( β -CROWN bound) .
Given an L -layer NN f ( x ) : R d 0 → R with weights W ( i ) , biases b ( i ) , pre-ReLU bounds l ( i )
≤ z ( i ) ≤ u ( i ) ( 1 ≤ i ≤ L ), input bounds C , split constraints Z .
We have:
[Equation]
where a ∈ R d 0 , P ∈ R d 0 × ( (cid:80) L − 1 i =1 d i ) , q ∈ R (cid:80) L − 1 i =
d i and c ∈ R are functions of W ( i ) , b ( i ) , l ( i ) , u ( i ) .
Detailed formulations for a , P , q and c are given in Appendix C. Theorem B.1 shows that when neuron split constraints exist, f ( x ) can still be bounded by a linear equation containing optimizable multipliers β .
Observing Eq.
9, the main difference between CROWN and β -CROWN lies in the relaxation of each ReLU layer, where we need an extra term β
( i ) (cid:62) S ( i ) in the linear relationship matrix (for example, W ( L ) D
( L − 1) in Eq. 9) between f ( x ) and z ( i ) to enforce neuron split constraints.
This extra term in every ReLU layer yields P and q in Eq.
11 after bound propagations.
To solve the optimization problem in Eq.
11, we note that in the (cid:96) p norm robustness setting ( C = { x | (cid:107) x − x 0 (cid:107) p ≤ (cid:15) } ), the inner minimization has a closed solution:
[Equation]
(12) where 1 p + 1 q = 1 .
The maximization is concave in β ( q ≥ 1 ), so we can simply optimize it using projected (super)gradient ascent with gradients from an automatic differentiation library.
Since any β ≥ 0 yields a valid lower bound for min x ∈C ,z ∈Z f ( x ) , convergence is not necessary to guarantee soundness.
β -CROWN is efﬁcient - it has the same asymptotic complexity as CROWN when β is ﬁxed.
When β = 0 , β -CROWN yields the same results as CROWN; however the additional optimizable β allows us to maximize and tighten the lower bound due to neuron split constraints.
We deﬁne α ( i ) ∈
R d i for free variables associated with unstable ReLU neurons in Lemma A.1 for layer i and deﬁne all free variables
α
= { α (1) · · · α ( L − 1) } .
Since any 0 ≤ α ( i ) j ≤ 1 yields a valid bound, we can optimize it to tighten the bound.
Formally, we rewrite Eq.
12 with α explicitly:
[Equation]
B.2. Connections to the Dual Problem
In this subsection, we show that β -CROWN can also be derived from a dual LP problem.
Based on Eq.
5 and linear relaxations in Section A.1, we ﬁrst construct an LP problem for (cid:96) ∞ robustness veriﬁcation in Eq.
14 where i ∈ { 1 , · · · , L − 1 } .
[Equation]
[Table]
=
W ( i )
[Table]
i −
[Equation]
[Table]
( i ) ;
[Table]
z (0) ≥ x
[Table]
[Equation]
[Table] [Table]
x 0 +
[Table]
Stable:
[Table]
i )
[Table]
( i )
[Table]
( if
[Table]
i )
[Table] [Table]
i )
[Table] [Table]
i )
[Table]
Unstable:
[Table]
i )
[Table] [Table]
i
[Table]
i )
[Table] [Table]
i
[Table]
≤ u ( i
[Equation]
j u ( i ) j − l ( i ) j (cid:16) z ( i ) j − l ( i ) j (cid:17) ( if l ( i ) j < 0 < u ( i ) j ,
[Equation]
Compared to the formulation in (Wong & Kolter, 2018), we have neuron split constraints.
Many BaB based complete veriﬁers (Bunel et al., 2018; Lu & Kumar, 2020) use an LP solver for Eq.
14 as the incomplete veriﬁer.
We ﬁrst show that it is possible to derive Theorem B.1 from the dual of this LP, leading to Theorem B.2:
Theorem B.2.
The objective d LP for the dual problem of Eq.
14 can be represented as
[Equation]
where a , P , q and c are deﬁned in the same way as in Theorem B.1, and β ≥ 0 corresponds to the dual variables of neuron split constraints in Eq.
A similar connection between CROWN and dual LP based veriﬁer (Wong & Kolter, 2018) was shown in (Salman et al., 2019), and their results can be seen as a special case of ours when β
=
(none of the split constraints are active).
An immediate consequence is that β -CROWN can potentially solve Eq.
14 as well as using an LP solver:
Corollary B.2.1.
When α and β are optimally set and intermediate bounds l , u are ﬁxed, β -CROWN produces p ∗ LP , the optimal objective of LP with split constraints in Eq.
[Equation]
In Appendix C, we give detailed formulations for conversions between the variables α , β in β -CROWN and their corresponding dual variables in the LP problem.
B.3. Joint Optimization of Free Variables in β -CROWN In
Eq. 13, g is also a function of l ( i ) j and u ( i ) j , the intermediate layer bounds for each neuron z ( i ) j .
They are also computed using β -CROWN.
To obtain l ( i ) j , we set f ( x ) :
= z ( i ) j ( x ) and apply Theorem B.1:
[Equation]
15) and for u ( i ) j we set f ( x ) := − z ( i ) j ( x ) .
Importantly, during solving these intermediate layer bounds, the α (cid:48) and β (cid:48) are independent sets of variables , not the same ones for the objective f ( x ) :
= z ( L ) .
Since g is a function of l ( i ) j , it is also a function of α (cid:48) and β (cid:48) .
In fact, there are a total of (cid:80) L − 1 i =
1 d i intermediate layer neurons, and each neuron is associated with a set of independent α (cid:48) and β (cid:48) variables.
Optimizing these variables allowing us to tighten the relaxations on unstable ReLU neurons (which depend on l ( i ) j and u ( i ) j ) and produce tight ﬁnal bounds, which is impossible in LP.
In other words, we need to optimize ˆ α and ˆ β , which are two vectors concatenating α , β as well as a large number of α (cid:48) and β (cid:48) used to compute each intermediate layer bound:
[Equation]
This formulation is non-convex and has a large number of variables.
Since any 0 ≤ ˆ α ≤ 1 , ˆ β ≥ 0 leads to a valid lower bound, the non-convexity does not affect soundness.
When intermediate layer bounds are also allowed to be tightened during optimization, we can outperform the LP veriﬁer for Eq.
14 using ﬁxed intermediate layer bounds.
Typically, when Eq.
14 is formed, intermediate layer bounds are pre-computed with bound propagation procedures (Bunel et al., 2018;
Lu & Kumar, 2020), which are far from optimal.
To estimate the dimension of this problem, we denote the number of unstable neurons at layer i as s i :=
Tr( | S ( i ) | ) .
Each neuron in layer i is associated with 2 × (cid:80) i − 1 k =1 s k variables α (cid:48) .
Suppose each hidden layer has d neurons ( s i
= O ( d ) ), then ˆ α has 2 × (cid:80) L − 1 i =
1 d i (cid:80) i − 1 k =1 s k
= O ( L 2 d 2 ) variables in total.
This can be too large for efﬁcient optimization, so we share α (cid:48) and β (cid:48) among the intermediate neurons of the same layer, leading to a total number of O
( L 2 d ) variables to optimize.
Note that a weaker form of joint optimization was also discussed in (Xu et al., 2021) without β , and a detailed analysis can be found in Appendix D.2.
B.4. β -CROWN with Branch and Bound ( β -CROWN BaB)
We perform complete veriﬁcation following BaB framework (Bunel et al., 2018) using β -CROWN as the incomplete solver, and we use simple branching heuristics like BaBSR (Bunel et al., 2020b) or FSB (De Palma et al., 2021b).
To efﬁciently utilize GPU, we also use batch splits to evaluate multiple subdomains in the same batch as in (Xu et al., 2020; De Palma et al., 2021a).
We list our full algorithm β -CROWN BaB in Appendix D and we show it is sound and complete here:
Theorem B.3.
β -CROWN with Branch and Bound on splitting ReLUs is sound and complete.
Soundness is trivial because β -CROWN is a sound veriﬁer.
For completeness, it sufﬁces to show that when all unstable
ReLU neurons are split, β -CROWN gives the global minimum for Eq. 14.
In contrast, combining CROWN (Zhang et al., 2018) with BaB does not yield a complete veriﬁer, as it cannot detect infeasible splits and a slow LP solver is still needed to guarantee completeness (Xu et al., 2021).
Instead, β -CROWN can detect infeasible subdomains - according to duality theory, an infeasible primal problem leads to an unbounded dual objective, which can be detected (see Sec.
D.3 for more details).
Additionally, we show the potential of early stopping a complete veriﬁer as an incomplete veriﬁer .
BaB approaches the exact solution of Eq.
5 by splitting the problem into multiple subdomains, and more subdomains give a tighter lower bound for Eq.
Unlike traditional complete veriﬁers, β -CROWN is efﬁcient to explore a large number of subdomains during a very short time, making β -CROWN BaB an attractive solution for efﬁcient incomplete veriﬁcation.
C. Proofs for β -CROWN C.1. Proofs for deriving β -CROWN using bound propagation
Lemma A.1 is from part of the proof of the main theorem in Zhang et al.
Here we present it separately to use it as an useful subprocedure for our later proofs.
Lemma A.1 (Relaxation of a ReLU layer in CROWN) .
Given two vectors w, v ∈ R d , u ≤ v ≤ l (element-wise), we have
[Equation]
where D is a diagonal matrix deﬁned as:
[Equation] [Equation]
0 ≤ α j ≤ 1 are free variables, b (cid:48)
= w (cid:62) b and each element in b is
[Equation]
Proof.
For the j -th ReLU neuron, if l j ≥ 0 , then ReLU( v j ) =
v j ; if u j < 0 , then ReLU( v j ) = 0 .
For the case of l j < 0 < u j , the ReLU function can be linearly upper and lower bounded within this range:
[Equation]
where 0 ≤ α j ≤ 1 is a free variable - any value between 0 and 1 produces a valid lower bound.
To lower bound w (cid:62) ReLU( v ) = (cid:80) j w j ReLU( v j ) , for each term in this summation, we take the lower bound of ReLU( v j ) if w j is positive and take the upper bound of ReLU( v j ) if w j is negative (reﬂected in the deﬁnitions of D and b ).
This conservative choice allows us to always obtain a lower bound ∀ l ≤ v ≤ u :
[Equation]
where D j,j and b j are deﬁned in Eq.
17 and Eq.
18 representing the lower or upper bounds of ReLU.
Before proving our main theorem (Theorem B.1), we ﬁrst deﬁne matrix Ω , which is the product of a series of model weights
W and “weights” for relaxed ReLU layers D :
Deﬁnition C.1.
Given a set of matrices W (2) , · · · , W ( L ) and D (1) , · · · , D ( L − 1) , we deﬁne a recursive function Ω ( k, i ) for 1 ≤ i ≤ k ≤ L as
[Equation]
For example, Ω
[Equation]
3 , 1) =
[Equation]
4) D
[Equation]
3) W (3) D (2) .
Now we present our main theorem with each term explicitly written:
Theorem B.1 ( β -CROWN bound) .
Given a L -layer neural network f ( x ) : R d 0 → R with weights W ( i ) , biases b ( i ) , pre-ReLU bounds l ( i ) ≤
z ( i ) ≤ u ( i ) ( 1 ≤ i ≤ L ), input constraint C and split constraint Z .
We have
[Equation]
19) where P ∈ R d 0 × ( (cid:80) L − 1 i =1 d i ) is a matrix containing blocks P := (cid:104) P 1 (cid:62) P 2 (cid:62) · · · P L − 1 (cid:62) (cid:105) , q ∈ R (cid:80)
L − 1 i =
d i is a vector q := (cid:2) q 1 (cid:62) · · · q L − 1 (cid:62) (cid:3) (cid:62) , and each term is deﬁned as:
[Equation] [Equation]
[Equation]
23) diagonal matrices D ( i ) and vector b ( i ) are determined by the relaxation of ReLU neurons, and A ( i ) ∈ R 1 × d
i represents the linear relationship between f ( x ) and ˆ z ( i ) .
D ( i ) and b ( i ) depend on A ( i ) , l ( i ) and u ( i ) :
[Equation]
0 , if u
[Equation]
i )
[Equation]
j ∈ Z − ( i ) α j , if u ( i ) j > 0 > l ( i ) j and j / ∈ Z
+( i ) ∪ Z − ( i ) and A ( i ) 1 ,j ≥u j u j − l j , if u ( i ) j > 0 > l ( i ) j and j / ∈
Z
+( i ) ∪ Z − ( i ) and A ( i ) 1 ,j <(24)
[Equation]
j
[Equation]
∈
[Equation] [Equation]
Z − ( i ) and A (
[Equation] [Equation]
u (
[Equation]
( i
[Equation]
−
[Equation]
i
[Equation]
( i
[Equation]
l ( i
[Equation]
and
[Equation]
∈
Z
[Equation]
( i
[Equation]
− (
[Equation]
and A
[Equation]
i )
[Equation]
Proof.
We prove this theorem by induction: assuming we know the bounds with respect to layer ˆ z ( m ) , we derive bounds for ˆ z ( m − 1) until we reach m = 0 and by deﬁnition ˆ z (0)
=
x .
We ﬁrst deﬁne a set of matrices and vectors a ( m ) , P ( m ) , q ( m ) , c ( m ) , where P ( m ) ∈ R d m × ( (cid:80) L − 1 i
= m
+1 d i ) is a matrix containing blocks P := (cid:20) P ( m ) m +1 (cid:62) · · · P ( m )
L − 1 (cid:62) (cid:21) , q ∈ R (cid:80)
L − 1 i
= m +
d i is a vector q := (cid:104) q
( m ) m +
(cid:62) · · · q ( m )
L − 1 (cid:62) (cid:105)
[Equation]
, and each term is deﬁned as:
[Equation]
and we claim that
[Equation]
where ˜ β ( m +1) :
= (cid:2) β ( m +1) (cid:62) · · · β ( L − 1) (cid:62) (cid:3) (cid:62) concatenating all β ( i ) variables up to layer m
+ 1 .
For the base case m =
L − 1 , we simply have
[Equation]
No maximization is needed and a ( m ) = (cid:2)
[Equation]
L,
[Equation]
m )
= (cid:80) L i =
L Ω ( L, i ) b ( i ) =
b ( L ) .
Other terms are zero.
In Section B.1 we have shown the intuition of the proof by demonstrating how to derive the bounds from layer ˆ z
( L − 1) to ˆ z ( L − 2) .
The case for m =
L − 2 is presented in Eq.
Now we show the induction from ˆ z ( m ) to ˆ z ( m − 1) .
Starting from Eq.
31, since ˆ z ( m ) =
ReLU( z ( m ) )
we apply Lemma A. by setting w = (cid:104) a ( m ) + P ( m )
˜ β
( m +1) (cid:105) (cid:62) :
= A ( m ) .
It is easy to show that A ( m ) can also be equivalently and recursively deﬁned in Eq.
26 (see Lemma C.2).
Based on Lemma A.1 we have D ( m ) and b ( m ) deﬁned as in Eq.
24 and Eq.
so Eq.becomes
[Equation] [Equation]
Note that when we apply Lemma A.1, for j ∈ Z +( i ) (positive split) we simply treat the neuron j as if l ( i ) j ≥
[Equation]
and for j ∈ Z − ( i ) (negative split) we simply treat the neuron j as if u ( i ) j ≤ 0 .
Now we add the multiplier β ( m ) to z ( m ) to enforce per-neuron split constraints:
[Equation]
Similar to what we did in Eq.
9, we swap the min and max in the second inequality due to weak duality, such that every maximization on β ( i ) is before min .
Then
[Equation]
we substitute ˆ z ( m ) =
W ( m ) ˆ z ( m − 1) + b ( m ) and obtain:
[Equation]
Now we evaluate each term a (cid:48) , P (cid:48) , q (cid:48) and c (cid:48) and show the induction holds.
For a (cid:48) and q (cid:48)
we have:
[Equation]
For P (cid:48) :
= (cid:2) P (cid:48) m (cid:62) · · · P (cid:48)
L − 1 (cid:62) (cid:3) , we have a new block P (cid:48)
m where
[Equation]
for other blocks where m
+ 1 ≤ i ≤ L − 1 ,
[Equation]
For q (cid:48) :
= (cid:2) q (cid:48) m (cid:62) · · · q (cid:48)
L − 1 (cid:62) (cid:3) , we have a new block q (cid:48)
m where
[Equation]
for other blocks where m
+ 1 ≤ i ≤ L − 1 , q
[Equation]
i
[Equation]
Thus, a (cid:48) = a ( m − 1) , P (cid:48)
=
P ( m − 1) , q (cid:48)
=
q ( m − 1) and c (cid:48)
=
c ( m − 1) so the induction holds for layer ˆ z ( m − 1) :
[Equation]
Finally, Theorem B.1 becomes the special case where m = 0 in Eq.
27, Eq.
28, Eq. 29 and Eq.
The next Lemma unveils the connection with CROWN (Zhang et al., 2018) and is also useful for drawing connections to the dual problem.
Lemma C.2.
With D , b and A deﬁned in Eq.
24, Eq. 25 and Eq.
26, we can rewrite Eq.
19 in Theorem B.1 as:
[Equation] [Equation]
where A ( i ) , 0 ≤ i ≤ L − 1 contains variables β .
Proof.
To prove this lemma, we simply follow the deﬁnition of A ( i ) and check the resulting terms are the same as Eq.
For example,
[Equation]
Other terms can be shown similarly.
With this deﬁnition of A , we can see Eq.
19 as a modiﬁed form of CROWN, with an extra term β
( i +1)
(cid:62) S ( i +1) added when computing A ( i ) .
When we set β = 0 , we obtain the same bound propagation rule for A as in CROWN.
Thus, only a small change is needed to implement β -CROWN given an existing CROWN implementation: we add β ( i +1) (cid:62) S ( i +1) after the linear bound propagates backwards through a ReLU layer.
We also have the same observation in the dual space, as we will show this connection in the next subsection.
C.2. Proofs for the connection to the dual space
Theorem B.2.
The objective d LP for the dual problem of Eq.
14 can be represented as
[Equation]
where a , P , q and c are deﬁned in the same way as in Theorem B.1, and β ≥ 0 corresponds to the dual variables of neuron split constraints in Eq.
Proof.
To prove the Theorem B.2, we demonstrate the detailed dual objective d LP for Eq.
14, following a construction similar to the one in Wong & Kolter (2018).
We ﬁrst associate a dual variable for each constraint involved in Eq.including dual variables β for the per-neuron split constraints introduced by BaB. Although it is possible to directly write the dual LP for Eq.
14, for easier understanding, we ﬁrst rewrite the original primal veriﬁcation problem into its Lagrangian dual form as Eq. 35, with dual variables ν , ξ + , ξ − µ , γ , λ , β :
[Equation]

Subject to:
[Equation]
The original minimization problem then becomes:
[Equation]
Given ﬁxed intermediate bounds l , u , the inner minimization is a linear optimization problem and we can simply transfer it to the dual form.
To further simplify the formula, we introduce notations similar to those in (Wong & Kolter, 2018), where ˆ ν ( i − 1)
=
W ( i ) (cid:62) ν
( i ) and α ( i )
j = γ ( i ) j µ ( i ) j
+ γ ( i ) j .
Then the dual form can be written as Eq.
[Equation]
g ( α , β ) , where
[Equation]
Subject to: ν
( L ) = − 1 , ˆ ν
( i
[Equation]
=
W ( i ) (cid:62) ν
( i ) , i ∈ { 1 , . . .
, L } ν ( i ) j
= 0 , when u ( i ) j ≤ 0 , i ∈ { 1 , . . .
, L − 1 } ν
( i ) j
= ˆ ν ( i ) j , when l ( i ) j ≥ 0 , i ∈ { 1 , . . .
, L − 1 } [ ν ( i ) j ] + = u ( i )
j
[ ˆ ν ( i ) j ] + u ( i ) j − l ( i ) j , [ ν ( i ) j ]
[Equation] [Equation]
λ ( i )
[Equation]
=
[Equation]
  when l ( i ) j < 0 < u
( i ) j ,
j / ∈ Z
+( i )
[Equation]
Z − ( i ) , i ∈ { 1 , . . .
, L − 1 }
[Equation]
i )
[Equation]
i
[Equation]
Similar to the dual form in (Wong & Kolter, 2018)
(our differences are highlighted in blue), the dual problem can be viewed in the form of another deep network by backward propagating ν ( L ) to ˆ ν (0) following the rules in Eq.
If we look closely at the conditions and coefﬁcients when backward propagating ν ( i ) j for j -th ReLU at layer i in Eq.
36, we can observe that they match exactly to the propagation of diagonal matrices D ( i ) , S ( i ) , and vector b ( i ) deﬁned in Eq.
24 and Eq. 25.
Therefore, using notations in Eq.
24 and Eq.
25 we can essentially simplify the dual LP problem in Eq.
36 to:
[Equation]
Then we prove the key claim for this proof with induction where a ( m ) and P ( m ) are deﬁned in Eq.
27 and Eq. 28:
[Equation]
When m = L − 1 , we can have ˆ ν
( L − 1)
= − a
( L − 1) − P
( L − 1)
˜ β
( L ) =
− (cid:2) Ω ( L, L ) W
( L ) (cid:3) (cid:62) − 0 =
− W
( L ) (cid:62) which is true according to Eq.
Now we assume that ˆ ν ( m ) = − a ( m ) − P ( m )
˜ β
( m +1) holds, and we show that ˆ ν ( m − 1)
=
− a ( m − 1) − P ( m − 1)
˜ β ( m ) will hold as well:
[Equation]
Therefore
[Equation]
the claim Eq.
38 is proved with induction.
Lastly
[Equation]
we prove the following claim where q ( m ) and c ( m ) are deﬁned in Eq.
29 and Eq. 30.
[Equation]
This claim can be proved by applying Eq.
37 and Eq. 38.
[Equation]
Finally, we apply claims Eq. 38 and Eq. 39 into the dual form solution Eq.
and prove the Theorem B.2.
[Equation]
A more intuitive proof.
Here we provide another intuitive proof showing why the dual form solution of veriﬁcation objective in Eq.
36 is the same as the primal one in Thereom B.1.
d LP = g ( α , β ) is the dual objective for Eq.
14 with free variables α and β .
We want to show that the dual problem can be viewed in the form of backward propagating ν ( L ) to ˆ ν (0) following the same rules in β -CROWN.
Salman et al.
(2019) showed that CROWN computes the same solution as the dual form in Wong & Kolter (2018): ˆ ν ( i ) is corresponding to − A ( i ) in CROWN (deﬁned in the same way as in Eq.
but with β ( i +1)
= 0 )
and ν ( i ) is corresponding to − A
( i +1) D
( i +1) .
When the split constraints are introduced, extra terms for the dual variable β modify ν ( i ) (highlighted in blue in Eq. 36).
The way β -CROWN modiﬁes
A ( i +1) D ( i +1) is exactly the same as the way β
( i ) affects ν ( i ) : when we split z ( i ) j ≥ 0 , we add β ( i ) j to the ν ( i ) j in Wong & Kolter (2018); when we split z ( i ) j ≥ 0 , we add − β ( i ) j to the ν ( i ) j in Wong & Kolter (2018)
( ν ( i ) j is 0 in this case because it is set to be inactive).
To make this relationship more clear, we deﬁne a new variable ν (cid:48) , and rewrite relevant terms involving ν , ˆ ν below:
[Equation]
; ν
[Equation]
i )
j is deﬁned in the same way as in Eq.
36 for other cases
[Equation]
otherwise ˆ
[Equation] [Equation]
It is clear that ν (cid:48) corresponds to the term − ( A ( i +1)
D ( i +1)
+ β ( i +1) (cid:62) S
( i +1) )
in Eq.
26, by noting that ν ( i ) in (Wong &
Kolter, 2018) is equivalent to − A
( i +1) D
( i +1) in CROWN and the choice of signs in S ( i +1) reﬂects neuron split constraints.
Thus, the dual formulation will produce the same results as Eq. 34, and thus also equivalent to Eq. 19.
Corollary B.2.1.
When α and β are optimally set, β -CROWN produces the same solution as LP with split constraints when intermediate bounds l , u are ﬁxed.
Formally,
[Equation]
where p ∗ LP is the optimal objective of Eq.
Proof.
Given ﬁxed intermediate layer bounds l and u , the dual form of the veriﬁcation problem in Eq.
14 is a linear programming problem with dual variables deﬁned in Eq. 35.
Suppose we use an LP solver to obtain the optimal dual solution ν ∗ , ξ ∗ , µ ∗ , γ ∗ , λ ∗ , β ∗ .
Then we can set α ( i ) j
= γ ( i ) j ∗ µ ( i ) j ∗ + γ ( i ) j ∗ , β = β ∗ and plug them into Eq.
36 to get the optimal dual solution d ∗ LP .
Theorem B.2 shows that, β -CROWN can compute the same objective d ∗ LP given the same α ( i ) j
= γ ( i ) j ∗ µ ( i ) j ∗ + γ ( i ) j ∗ , β = β ∗ , thus max 0 ≤ α ≤ 1 , β ≥
g ( α , β ) ≥ d ∗ LP .
On the other hand, for any setting of α and β , β -CROWN produces the same solution g ( α , β ) as the rewritten dual LP in Eq.
36, so g ( α , β ) ≤ d ∗ LP .
Thus, we have max 0 ≤ α ≤ 1 , β ≥
g ( α , β ) =
d ∗ LP .
Finally, due to the strong duality in linear programming, p ∗ LP = d ∗ LP = max 0 ≤ α ≤ 1 , β ≥ 0 g ( α , β ) .
The variables α in β -CROWN can be translated to dual variables in LP as well.
Given α ∗ in β -CROWN, we can get the corresponding dual LP variables µ , γ given α by setting µ ( i )
j = (1 − α ( i ) j )
[ ˆ ν ( i ) j ] − and γ ( i ) j
= α ( i ) j
[ ˆ ν ( i ) j ] − .
C.3. Proof for soundness and completeness
Theorem B.3.
β -CROWN with branch and bound on splitting ReLU neurons is sound and complete.
Proof.
Soundness.
Branch and bound (BaB) with β -CROWN is sound because for each subdomain C i :=
{ x ∈ C , z ∈
Z i } , we apply Theorem B.1 to obtain a sound lower bound f C i (the bound is valid for any β ≥ 0 ).
The ﬁnal bound returned by
BaB is min i f C i which represents the worst case over all subdomains, and is a sound lower bound for x ∈ C :
= ∪ i C i .
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
Outputs
[Table] [Table]
Completeness.
To show completeness, we need to solve Eq.
5 to its global minimum.
When there are N unstable neurons, we have up to 2 N subdomains, and in each subdomain we have all unstable ReLU neurons split into one of the z ( i ) j ≥ 0 or z ( i ) j < 0 case.
The ﬁnal solution obtained by BaB is the min over these 2 N subdomains.
To obtain the global minimum, we must ensure that in every of these 2 N subdomain we can solve Eq.
14 exactly.
When all unstable neurons are split in a subdomain C i , the network becomes a linear network and neuron split constraints become linear constraints w.r.t.
inputs.
Under this case, an LP with Eq.
14 can solve the veriﬁcation problem in C i exactly.
In β -CROWN, we solve the subdomain using the usually non-concave formulation Eq.
16; however, in this case, it becomes concave in ˆ β because no intermediate layer bounds are used (no α (cid:48) and β (cid:48) ) and no ReLU neuron is relaxed (no α ), thus the only optimizable variable is β (Eq.
16 becomes Eq. 12).
Eq.
12 is concave in β so (super)gradient ascent guarantees to converge to the global optimal β ∗ .
To ensure convergence without relying on a preset learning rate, a line search can be performed in this case.
Then, according to Corollary B.2.1, this optimal β ∗ corresponds to the optimal dual variable for the
LP in Eq.
14 and the objective is a global minimum of Eq.
D. More details on β -CROWN with branch and bound (BaB) D.1. β -CROWN with branch and bound for complete veriﬁcation
We list our β -CROWN with branch and bound based complete veriﬁer ( β -CROWN B A B) in Algorithm 1.
The algorithm takes a target NN function f and a domain C as inputs.
The subprocedure optimized _ beta _ CROWN optimizes ˆ α and ˆ β (free variables for computing intermediate layer bounds and last layer bounds) as Eq.
16 in Section B.3.
It operates in a batch and returns the lower and upper bounds for n selected subdomains simultaneously: a lower bound is obtained by optimizing Eq.
16 using β -CROWN and an upper bound can be the network prediction given the x ∗ that minimizes Eq.
Initially, we don’t have any splits, so we only need to optimize ˆ α to obtain f for x ∈ C (Line 2).
Then we utilize the power of GPUs to split in parallel and maintain a global set P storing all the sub-domains which does not satisfy f C i <
(Line 5-10).
Speciﬁcally, batch _ pick _ out extends branching strategy BaBSR (Bunel et al., 2018) or FSB (De Palma et al., 2021b) in a parallel manner to select n (batch size) sub-domains in P and determine the corresponding ReLU neuron to split for each of them.
If the length of P is less than n , then we reduce n to the length of P .
batch _ split splits each selected
C i to two sub-domains C li and C ui by forcing the selected unstable ReLU neuron to be positive and negative, respectively.
Domain _ Filter ﬁlters out veriﬁed sub-domains (proved with f C i ≥ 0 ) and we insert the remaining ones to P .
The loop breaks if the property is proved ( f ≥ 0 ), or a counter-example is found in any sub-domain ( f < 0 ), or the lower bound f and upper bound f are sufﬁciently close, or the length of sub-domains P reaches a desired threshold η (maximum memory limit).
D.2. Comparisons to other GPU based complete veriﬁers
Bunel et al.
(2020a) proposed to reformulate the linear programming problem in Eq.
14 through Lagrangian decomposition.
Eq.
14 is decomposed layer by layer, and each layer is solved with simple closed form solutions on GPUs.
A Lagrangian is used to enforce the equality between the output of a previous layer and the input of a later layer.
This optimization formulation has the same power as a LP (Eq. 14) under convergence.
The main drawback of this approach is that it converges relatively slowly (we ﬁnd that it typically requires hundreds of iterations to converge to a solution similar to the solution of a LP), and it also cannot easily jointly optimize intermediate layer bounds.
In Table 1 (P ROX B A BSR) and Figure(BDD+ B A BSR, which refers to the same method) we can see that this approach is relatively slow and has high timeout rates compared to other GPU accelerated complete veriﬁers.
Recently, De Palma et al.
(2021b) proposed a better branching strategy, ﬁltered smart branching (FSB), to further improved veriﬁcation performance of (Bunel et al., 2020a), but the
Lagrangian Decomposition based incomplete veriﬁer and the branch and bound procedure stay the same.
De Palma et al.
(2021a) used a tighter convex relaxation (Anderson et al., 2020) than the typical LP formulation in Eq.
14 for the incomplete veriﬁer.
This tighter relaxation contains exponentially many constraints, and De Palma et al.
(2021a) proposed to solve the veriﬁcation problem in its dual form where each constraint becomes a dual variable.
A small active set of dual variables is maintained during dual optimization to ensure efﬁciency.
This tighter relaxation allows it to outperform (Bunel et al., 2020a), but it also comes with extra computational costs and difﬁculties for an efﬁcient implementation (e.g. a “masked” forward/backward pass is needed which requires a customised lower-level convolution implementation).
Additionally,
De Palma et al.
(2021a) did not optimize intermediate layer bounds jointly.
Xu et al.
(2021) used CROWN (Zhang et al., 2018)
(categorized as a linear relaxation based perturbation analysis (LiRPA) algorithm) as the incomplete solver in BaB. Since CROWN cannot encode neural split constraints, Xu et al.
(2021) essentially solve Eq.
14 without neuron split constraints ( z ( i ) j ≥ 0 , i ∈ { 1 , · · · , L − 1 } , j ∈ Z
+( i ) and z ( i )
j < 0 , i ∈ { 1 , · · · , L − 1 } , j ∈
Z − ( i ) ) in Eq.
The missing constraints lead to looser bounds and more branches - this can be seen in Table 1, where their number of branches and timeout rates are higher than ours.
Additionally, using CROWN as the incomplete solver leads to incompleteness - even when all unstable ReLU neurons are split, Xu et al.
(2021) still cannot solve Eq.
5 to a global minimum, so a LP solver has to be used to check inconsistent splits and guarantee completeness.
Our β -CROWN BaBSR and β -CROWN
FSB overcome these drawbacks: we consider per-neuron split constraints in β -CROWN which reduces the number of branches and solving time (Table 1).
Most importantly, β -CROWN with branch and bound is sound and complete (Theorem B.3) and we do not rely on any LP solvers.
Another difference between Xu et al.
and our method is the joint optimization of intermediate layer bounds (Section B.3).
Although (Xu et al., 2021) also optimized intermediate layer bounds, they only optimize α and do not have β , and they share the same variable α for all intermediate layer bounds and ﬁnal bounds, with a total of O ( Ld ) variables to optimize.
Our analysis in Section B.3 shows that there are in fact, O ( L 2 d 2 ) free variables to optimize, and we share less variables as in Xu et al.
This allows us to achieve tighter bounds and improve overall performance.
D.3. Detection of Infeasibility
Maximizing Eq.
12 with infeasible constraints leads to unbounded dual objective, which can be detected by checking if this optimized lower bound becomes greater than the upper bound (which is also maintained in BaB, see Alg.1 in Sec.
B.1).
Due to insufﬁcient convergence, this cannot always detect infeasibility, but it does not affect soundness , as this infeasible subdomain only leads to worse overall lower bound in BaB. To guarantee completeness , we show that when all unstable neurons are split the problem is concave (see Section C.3); in this case, we can use line search to guarantee convergence when feasible, and detect infeasibility if the objective exceeds the upper bound (line search guarantees the objective can eventually exceed upper bound).
In most real scenarios, the veriﬁer either ﬁnishes or times out before all unstable neurons are split.
E. Details on Experimental Setup and Results E.1. Baselines
We compare against multiple baselines for complete veriﬁcation: (1) BaBSR (Bunel et al., 2020b), a basic BaB and LP based veriﬁer; (2) MIPplanet (Ehlers, 2017), a customized MIP solver for NN veriﬁcation where unstable ReLU neurons are randomly selected for splitting; (3) ERAN (Singh et al., 2019a; 2018a; 2019b; 2018b), an abstract interpretation based veriﬁer which is one of VNN competition 2020 winners with lowest timeout rate; (4) GNN-Online (Lu & Kumar, 2020), a BaB and LP based veriﬁers using a learned Graph Neural Network (GNN) to guide the ReLU splits; (5) BDD+
BaBSR (Bunel et al., 2020a), a veriﬁcation framework based on Lagrangian decomposition on GPUs (BDD+) with BaBSR branching strategy; (6) OVAL (BDD+ GNN) (Bunel et al., 2020a; Lu & Kumar, 2020), one of VNN competitionwinners, using BDD+ with GNN guiding the ReLU splits; (7) A.set BaBSR and (8) Big-M+A.set
BaBSR (De Palma et al., 2021a), very recent dual-space veriﬁers on GPUs with a tighter linear relaxation than LP; (9) Fast-and-Complete (Xu et al., 2021), which uses CROWN on GPUs as the incomplete veriﬁer in BaB without neuron split constraints; (10) BaDNB (BDD+ FSB)
(De Palma et al., 2021b), a concurrent state-of-the-art complete veriﬁer, using BDD+ on GPUs with FSB branching strategy.
β -CROWN BaB can use either BaBSR or FSB branching heuristic, and we include both in evaluation.
All methods use 1 CPU + 1 GPU (if GPU is supported) with a 1 hour timeout threshold.
E.2. Experimental Setup
We run our experiments on a single NVIDIA GTX 1080 Ti GPU (11GB GPU memory) and a Intel i7-7700K CPU (4.2 GHz).
We set the CPU memory limit for all methods to 32GB.
We use the Adam optimizer (Kingma & Ba, 2015) to solve both ˆ α and ˆ β in Eq.
16 with 20 iterations.
The learning rates are set as 0.1 and 0.05 for optimizing ˆ α and ˆ β respectively.
We decay the learning rates with a factor of 0.98 per iteration.
To maximize the beneﬁts of parallel computing on GPU, we use batch sizes n = 400 for Base (CIFAR-10), ConvSmall (MNIST), ConvSmall (CIFAR-10), CNN-A-Adv (MNIST), CNN-A-Adv (CIFAR-10), CNN-A-Adv-4 (CIFAR-10), CNN-A-Mix (CIFAR-10) and CNN-A-Mix-4 (CIFAR-10); n = 200 for Wide (CIFAR-10) and Deep (CIFAR-10), n = 64 for CNN-B-Adv (CIFAR-10) and CNN-B-Adv-4 (CIFAR-10), n = 10 for
ConvBig (MNIST) and ConvBig (CIFAR-10); n = 2 for ResNet (CIFAR-10) respectively.
The CNN-A-Adv, CNN-A-Adv-4,
CNN-A-Mix, CNN-A-Mix-4, CNN-B-Adv and CNN-B-Adv-4 models are obtained from the authors or (Dathathri et al., 2020) and are the same as the models used in their paper.
We summarize the model structures in both incomplete veriﬁcation and complete veriﬁcation (Base, Wide and Deep) experiments in Table 3.
[Table]
E.3. Additional Experiments
Comparison to Multi-neuron Convex Relaxation based Incomplete veriﬁers.
In Table 4, we compare against a few representative and strong incomplete veriﬁers on 5 convolutional networks for MNIST and CIFAR-10 under the same set of 1000 images and perturbation (cid:15) as reported in (Singh et al., 2019b; Tjandraatmadja et al., 2020; Müller et al., 2021).
Among the baselines, kPoly (Singh et al., 2019a), OptC2V (Tjandraatmadja et al., 2020) and PRIMA (Müller et al., 2021) utilize state-of-the-art multi-neuron linear relaxation for ReLUs and can bypass the single-neuron convex relaxation barrier (Salman et al., 2019), and are among the strongest incomplete veriﬁers.
β -CROWN
FSB achieves better veriﬁed accuracy on all ﬁve models using a similar amount of time.
Some models, such as MNIST ConvBig and CIFAR ResNet, are quite challengingthe veriﬁed accuracy obtained by β -CROWN
FSB is close to the upper bound found via PGD attack.
Tightness of veriﬁcation.
In Figure 2, we compare the tightness of veriﬁcation bounds against SDP-FO on two adversarially trained networks from (Dathathri et al., 2020).
Speciﬁcally, we use the veriﬁcation objective f ( x ) :
= z ( L ) y
( x ) − z ( L ) y (cid:48)
( x ) , where z ( L ) is the logit layer output, y and y (cid:48) are the true label and the runner-up label.
For each test image, PGD at-
[Table]
tack (Madry et al., 2018) can provide an adversarial upper bound f of the optimal objective: f ∗ ≤ f .
Veriﬁers, on the other hand, can provide a veriﬁed lower bound f ≤ f ∗ .
Bounds from tighter veriﬁcation methods lie closer to line y =
x in Figure 2.
Figure 2 shows that on both PGD adversarially trained networks, β -CROWN
FSB consistently outperforms
SDP-FO for all 100 random test images.
Importantly, for each point on the plots, β -CROWN
FSB needs only 3 minutes while SDP-FO needs 178 minutes on average.
LP veriﬁer produces much looser bounds than β -CROWN
FSB and SDP-FO.
[Figure]
Comparison to LPs with different intermediate layer bounds.
In Figure 3, we compare our β -CROWN
FSB (3 minutes as the timeout threshold per veriﬁcation instance) against incomplete LP veriﬁers constructed using different intermediate layer bounds obtained from Wong & Kolter (2018) (WK), CROWN (Zhang et al., 2018), and the joint optimization procedure (optimizing Eq.
16 with no ˆ β as done in (Xu et al., 2021), denoted as OPT).
Our β -CROWN
FSB always outperforms these three LP veriﬁers using different intermediate bounds.
Also, we show that tighter intermediate layer bounds obtained by CROWN can greatly improve the performance of the LP veriﬁer compared to those using looser ones obtained by Wong & Kolter (2018).
Furthermore, using intermediate layer bounds computed by joint optimization can achieve noticeable improvements.
The corresponding veriﬁed accuracy for each method on PGD trained CNN-A-Adv (MNIST) and CNN-B-Adv (CIFAR-10) networks can be found in Table 5.
The results match the observations in Figure 3: tighter intermediate bounds are helpful for LPs, but branch and bound with β -CROWN can signiﬁcantly outperform these
LP veriﬁers.
This shows that BaB is an effective approach for incomplete veriﬁcation, outperforming the bounds produced by a single LP.
More results on incomplete veriﬁcation using complete veriﬁers with early stop In our experiments in Table 1, we noticed that B IG M+A.S ET B A BSR (De Palma et al., 2021a) is also very competitive among existing state-of-the-art complete veriﬁers 2 - it runs fast in many cases with low timeout rates.
Therefore, we also evaluate B IG M+A.S ET B A BSR with an early stop of 3 minutes for the incomplete veriﬁcation setting as an extension of Section 4.
The corresponding veriﬁed accuracy number for each method are reported in Table 5.
As we can see B IG M+A.S ET B A BSR usually produces better bounds than SDP-FO, however β -CROWN
FSB consistently outperforms B IG M+A.S ET B A BSR under the same 3min timeout.
[Figure] [Figure]
[Table]
Lower bound improvements over time In Figure 4, we plot lower bound values vs. time for β -CROWN B A BSR and
B IG M+A. SET B A BSR (one of the most competitive methods in Table 1) on the CNN-A-Adv (MNIST) model.
Figureshows that branch and bound can indeed quickly improve the lower bound, and our β -CROWN B A BSR is consistently faster than B IG M+A. SET B A BSR.
In contrast, SDP-FO (Dathathri et al., 2020), which typically requires 2 to 3 hours to converge, can only provide very loose bounds during the ﬁrst 3 minutes of optimization (out of the range on these ﬁgures).
Complete veriﬁcation performance with averaged metrics
In Section 4 we presented the median of veriﬁcation time in Table 1.
We include mean veriﬁcation time and number of branches in Table 1.
The average veriﬁcation time is heavily affected by timed out examples.
For example, on the Deep model, our β -CROWN with BaBSR signiﬁcantly outperforms other baselines by over 10X because we have no timeout.
This comparison can be misleading because two factors are mixed: the efﬁciency of the veriﬁer (reﬂected in veriﬁcation time for most examples) and the capability of the veriﬁer (reﬂected in the capability of verifying hard examples and producing less timeouts).
Instead, median runtime (with timeout rates also in consideration) and the cactus plots in Figure 1 are more appropriate means to gauge the performance of each complete veriﬁer.
[Figure]
[Figure]