F AST AND C OMPLETE : E NABLING C OMPLETE N EURAL N ETWORK V ERIFICATION WITH R APID AND M ASSIVELY P ARALLEL I NCOMPLETE V ERIFIERS
Anonymous authors
Paper under double-blind review
A BSTRACT
Formal veriﬁcation of neural networks (NNs) is a challenging and important problem.
Existing efﬁcient complete solvers typically require the branch-and-bound (BaB) process, which splits the problem domain into sub-domains and solves each sub-domain using faster but weaker incomplete veriﬁers, such as Linear Programming (LP) on linearly relaxed sub-domains.
In this paper, we propose to use the backward mode linear relaxation based perturbation analysis (LiRPA) to replace
LP during the BaB process, which can be efﬁciently implemented on the typical machine learning accelerators such as GPUs and TPUs.
However, unlike LP,
LiRPA when applied naively can produce much weaker bounds and even cannot check certain conﬂicts of sub-domains during splitting, making the entire procedure incomplete after BaB. To address these challenges, we apply a fast gradient based bound tightening procedure combined with batch splits and the design of minimal usage of LP bound procedure, enabling us to effectively use LiRPA on the accelerator hardware for the challenging complete NN veriﬁcation problem and signiﬁcantly outperform LP-based approaches.
On a single GPU, we demonstrate an order of magnitude speedup compared to existing LP-based approaches.
I NTRODUCTION
Although neural networks (NNs) have achieved great success on various complicated tasks, they remain susceptible to adversarial examples (Szegedy et al., 2013): imperceptible perturbations of test samples might unexpectedly change the NN predictions.
Therefore, it is crucial to conduct formal veriﬁcation for NNs such that they can be adopted in safety or security-critical settings.
Formally, the neural network veriﬁcation problem can be cast into the following decision problem:
Given a neural network f ( · ) , an input domain C , and a property P .
∀ x ∈ C , does f ( x ) satisfy P ?
The property P is typically a desirable outputs of the NN conditioned on the inputs.
Typically, consider is a binary classiﬁer f ( x ) and is a positive example x 0 , we can set P to be f ( x ) ≥where x is bounded within an l ∞ norm ball C
= { x |(cid:107) x − x 0 (cid:107) ∞ ≤ (cid:15) } .
The success of veriﬁcation guarantees that the label of x 0 cannot ﬂip for any perturbed inputs bounded within C .
In this paper we study the complete veriﬁcation setting, where given sufﬁcient time, the veriﬁer should give a deﬁnite “yes/no” answer for a property under veriﬁcation.
In the above setting, it must solve the non-convex optimization problem min x ∈C f ( x ) to a global minimum.
Complete NN veriﬁcation is generally a challenging NP-Hard problem (Katz et al., 2017) which usually requires expensive formal veriﬁcation methods such as SMT (Katz et al., 2017) or MILP solvers (Tjeng et al., 2019b).
On the other hand, incomplete solvers such as convex relaxations of NNs (Salman et al., 2019) can only provide a sound analysis, i.e., they can only approximate the lower bound of min x ∈ C
f
( x ) as f and verify the property when f ≥ 0 .
No conclusion can be drawn when f < 0 .
Recently, a Branch and Bound (BaB) style framework (Bunel et al., 2018; 2020b) has been adopted for efﬁcient complete veriﬁcation.
BaB solves the optimization problem min x ∈C f ( x ) to a global minimum by branching into multiple sub-domains recursively and bounding the solution for each sub-domain using incomplete veriﬁers.
BaB typically uses a Linear Programming (LP) bounding procedure as an incomplete veriﬁer to provide feasibility checking and relatively tight bounds for each sub-domain.
However, the relatively high solving cost of LPs and incapability of parallelization (especially on massively parallel hardware accelerators like GPUs or TPUs) greatly limit the performance and scalability of the existing complete BaB based veriﬁers.
In this paper, we aim to use fast and typically weak incomplete veriﬁers for complete veriﬁcation.
Speciﬁcally, we focus on a class of incomplete veriﬁers using efﬁcient bound propagation operations, referred to as linear relaxation based perturbation analysis (LiRPA) algorithms (Xu et al., 2020).
Representative algorithms in this class include convex outer adversarial polytope (Wong & Kolter, 2018), CROWN (Zhang et al., 2018) and DeepPoly (Singh et al., 2019b).
LiRPA algorithms exhibit high parallelism as the bound propagation process is similar to forward or backward propagation of NNs, which can fully exploit machine learning accelerators (e.g., GPUs and TPUs).
Although LiRPA bounds are very efﬁcient for incomplete veriﬁcation, especially in training certiﬁed adversarial defenses (Wong et al., 2018; Mirman et al., 2018; Wang et al., 2018a; Zhang et al., 2020), they are generally considered too loose to be useful in the complete veriﬁcation setting with BaB compared to LPs.
As we will demonstrate later, using LiRPA bounds naively in BaB cannot even guarantee the completeness when splitting ReLU nodes, and thus we need additional measures to make them useful for complete veriﬁcation.
In fact, LiRPA methods have been used to get upper and lower bounds for each ReLU neuron in constructing tighter LPs (Bunel et al., 2018;
Lu &
Kumar, 2020).
It was also used in (Wang et al., 2018c) for verifying small-scale problems with a relatively small input domain with input splits.
Except one concurrent work (Bunel et al., 2020a), most complete veriﬁers are based on relatively expensive solvers like LP and cannot fully take beneﬁt from massively parallel hardware to obtain tight bounds for accelerating large-scale complete veriﬁcation.
Our main contributions are:
• We show that LiRPA bounds, when improved with fast gradient optimizers, can potentially outperform bounds obtained by LP veriﬁers.
This is because LiRPA allows joint optimization of both intermediate layer bounds of ReLU neurons (which determine the tightness of relaxation) and output bounds, while LP can only optimize output bounds with ﬁxed relaxations on ReLU neurons.
• We show that BaB purely using LiRPA bounds is insufﬁcient for complete veriﬁcation due to the lack of feasibility checking for sub-domains.
To address this issue, we design our algorithm to only invoke LP when absolutely necessary and exploits hardware parallelism when possible.
• To fully exploit the hardware parallelism on the machine learning accelerators, we use a batch splitting approach that splits on multiple neurons simultaneously, further improving our efﬁciency.
• On a few standard and representative benchmarks, our proposed NN veriﬁcation framework can outperform previous baselines signiﬁcantly, with a speedup of around 30X compared to basic BaB baselines, and up to 5X compared to recent state-of-the-art complete veriﬁers.
B ACKGROUND 2. F ORMAL DEFINITION OF N EURAL NETWORK (NN) VERIFICATION
Notations of NN.
For illustration, we deﬁne an L -layer feedforward NN f : R | x | → R with L weights W ( i ) ( i ∈ { 1 , · · · , L } ) recursively as f ( i ) ( x ) =
W ( i ) h
( i − 1) ( x ) ,
hidden layer h
( i ) ( x ) =
ReLU ( f ( i ) ( x )) , input layer h (0) ( x ) = x , and ﬁnal output f ( x ) = f
( L ) ( x ) .
For simplicity we ignore biases.
We use h ( i ) j to represent the j -th neuron in i -th layer.
We focus on verifying ReLU based
NNs, but our method can also be generalized to other activation functions supported by LiRPA.
NN Veriﬁcation Problem.
Given an input x , its bounded input domain C , and a feedforward NN f ( · ) , the aim of formal veriﬁcation is to prove or disprove certain properties P of NN outputs.
Since most properties studied in previous works can be expressed as a Boolean expression over a linear equation of network output, where the linear property can be merged into the last layer weights of a
NN, the ultimate goal of complete veriﬁcation reduces to prove or disprove:
[Equation]
Due to the non-linearity and non-convexity of NNs, ﬁnding the exact minimum of f ( x ) over the bounded input domain C is challenging as the optimization process is generally an NP-hard problem (Katz et al., 2017).
However, in practice, a sound approximation of the lower bound for f ( x ) , denoted as f , can be more easily obtained and is sufﬁcient to verify the property.
Thus, a good veriﬁcation strategy to obtain a tight approximation f can save several magnitudes of time cost.
Note that the approximation must be sound, i.e., ∀ x ∈ C , f ≤ f ( x ) such that proving f ≥ 0 is sufﬁcient to prove the desired property f ( x ) ≥
given x ∈ C .
2. B RANCH AND B OUND (B A B) FRAMEWORK FOR N EURAL N ETWORK V ERIFICATION
Branch and Bound (BaB), an effective strategy in solving traditional combinatorial optimization problems, has been customized and widely adopted for NN veriﬁcation (Bunel et al., 2018; 2020b).
Speciﬁcally, BaB based veriﬁcation framework is a recursive process, consisting of two main steps: branching and bounding.
For branching , BaB based methods will divide the bounded input domain
C into sub-domains {C i
|C
=
(cid:83) i C i } , each deﬁned as a new independent veriﬁcation problem.
For instance, it can split a ReLU unit h to be negative and positive cases as C
= C ∩ ( h ≥ 0) and
C 1 = C ∩ ( h < 0) for a ReLU-based network; For each sub-domain C i , BaB based methods will perform bounding to obtain a relaxed but sound lower bound f C i .
A tightened global lower bound over C can then be obtained by taking the minimum values of generated lower bounds from all the sub-domains as f = min
i f C i .
Branching and bounding will be performed recursively to tighten the approximated global lower bound over C until either (1) the approximated lower bound f becomes larger than 0 and prove the property or (2) a violation is located and disprove it.
Soundness of BaB We say the veriﬁcation process is sound if we can always trust the “yes” ( P veriﬁed) answer given by the veriﬁer.
It is straightforward to see that the whole BaB based veriﬁcation process is sound as long as the bounding methods used for each sub-domain C i are sound.
Completeness of BaB The completeness of the BaB-based NN veriﬁcation process, which was assumed in the previous work (Bunel et al., 2020b; 2018), is not always true even if all possible sub-domains are considered with a sound bounding method.
Taking ReLU-based NN veriﬁcation as an example, contrary to intuition, we may still be unable to verify certain properties when all ReLU units are split into positive/negative cases.
We point out that a key factor for completeness involves feasibility checking in the bounding method and we prove its completeness in Section 3.2.
Branching in BaB In BaB, we build a search tree where each leaf is a sub-domain, and the property can be proven only when it is valid on all leaves.
The branching step determines the shape of the tree, and when good leaves are chosen for further split the total number of branches and running time can be signiﬁcantly reduced.
BaBSR is a simple branching heuristic proposed by Bunel et al.
(2018), which assigns each activation node a score to estimate the potential improvement for tightening f by splitting it, and it then selects the node with the largest score to split for each branching step.
The score of each activation (ReLU) node could be roughly estimated by its upper and lower bounds obtained from the sound approximation methods during each bounding step.
Bounding with Linear Programming (LP)
A typical bounding method used in BaB based veriﬁcation is the Linear Programming bounding procedure (sometimes simply referred to as “LP” or “LP veriﬁer” in our paper).
Speciﬁcally, we transform the original veriﬁcation problem into a linear programming problem by relaxing every activation unit as a convex (linear) domain (Ehlers, 2017) and then get the lower bound f C i with a linear solver given domain C i .
For instance, as shown in Figure 1a, h ( i ) j = ReLU ( x ( i ) j ) can be linearly relaxed with the following 3 constraints: (1) h ( i ) j ≥ x ( i ) j ; (2) h
( i ) j ≥ 0 ; (3) h ( i )
j ≤ u ( i ) j u ( i ) j − l ( i ) j ( x ( i ) j − l ( i ) j ) .
Note that the lower bound l ( i ) j and upper bound u ( i ) j for each activation node h ( i ) j are required in the LP construction given x ∈ C .
They are typically computed by the existing cheap bounding methods like LiRPA variants (Wong & Kolter, 2018) with low cost.
The tighter the intermediate bounds ( l ( i ) j , u ( i ) j ) are, the tighter f approximated by LP is.
2. L INEAR R ELAXATION BASED P ERTURBATION A NALYSIS (LiRPA)
Bound propagation in LiRPA Linear relaxation based perturbation analysis (LiRPA) 1 aims to ﬁnd linear upper and lower equations of NN output w.r.t input x ∈ C :
[Equation]
A tight and sound approximation to the lower bound f can then be simply obtained by taking the lower bound of linear equation A x + b w.r.t input x ∈ C .
l ( i ) j u
( i ) j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j
(a) (b) (c) (d)
To get the coefﬁcients A , A , b , b , LiRPA propagates bounds of f ( x ) as a linear function to the output of each layer, in a backward manner.
At the output layer we simply have:
[Equation]
Then, the next step is to backward propagate the identity linear relationship through a linear layer f ( L ) =
W ( L ) h
( L − 1) to get the linear bounds of f ( x ) w.r.t h ( L − 1) :
[Equation]
To get the linear relationship of f ( L − 1) w.r.t f
( x ) , we need to backward propagate through ReLU layer
h
( L − 1) ( x ) = ReLU ( f ( L − 1) ( x )) .
Since it is nonlinear, linear relaxation will be performed.
For illustration, consider j th ReLU neuron at i th layer, h ( i )
j
( x ) = ReLU ( f ( i ) j
( x )) , we can linearly upper and lower bound it by a ( i )
j x + b ( i ) j ≤ h ( i )
j ( x ) ≤ a ( i )
j x + b ( i ) j , where a ( i ) j , a ( i ) j , b ( i ) j , b ( i ) j are deﬁned as:
[Equation]
Here l ( i ) j ≤ f ( i ) j ( x ) ≤ u ( i ) j are intermediate pre-activation bounds for x ∈ C , and α ( i ) j is an arbitrary value between 0 and 1.
The pre-activation bounds l ( i ) j and u ( i ) j can be computed by treating f ( i ) j ( x ) as the output neuron with LiRPA.
Figure 1(b,c,d) illustrate the relaxation for each state of ReLU neuron.
With these linear relaxations, we can get the linear equation of f ( L − 1) w.r.t output f ( x ) :
[Equation]
=
b (cid:48)
( L ) (cid:62) W ( L ) , where b (cid:48)
( L ) j = (cid:40) b
( L ) j , W ( L ) j ≥b ( L ) j , W ( L )
j <(6)
The deﬁnitions for j -th diagonal element D ( L ) α, ( j,j ) and bias b ( L ) are similar, with the conditions for checking the signs of W ( L ) j swapped.
The diagonal matrices D ( L − 1) α , D
( L − 1) α and biases reﬂects the linear relaxations and also considers the signs in W ( L ) to maintain the lower and upper bound.
Importantly, D ( L − 1) α has free variables α ( i ) ∈
[0 , 1] which do not affect correctness of the bounds.
We can continue backward propagating these bounds layer by layer (e.g., f ( L − 2) ( x ) , h ( L − 2) ( x ) , etc) until reaching h (0) ( x ) = x , getting the eventual linear equations of f ( x ) in terms of input x :
L
[Equation]
x,
[Equation]
( x
[Equation]
U ( x
[Equation] [Equation]
where
[Equation]
Here α denotes α ( i ) j for all neurons in NN.
The obtained bounds ( L ( x, α ) , U ( x, α ) ) of f ( x ) are linear functions in terms of α and x .
Beyond the simple feedforward NN presented here, LiRPA can support more complicated NN architectures like DenseNet and Transformers by computing L and
U automatically and efﬁciently on general computational graphs (Xu et al., 2020).
Soundness of LiRPA
The above backward bound propagation process guarantees that L ( x, α ) and
U ( x, α ) soundly bound f ( x ) for all x ∈ C .
Detailed proofs can be found in (Zhang et al., 2018;
Singh et al., 2019b) for feedforward NNs and (Xu et al., 2020) for general networks.
P ROPOSED A LGORITHM
Overview In this section, we will ﬁrst introduce our proposed efﬁcient optimization of LiRPA bounds on GPUs that can allow us to achieve tight approximation on par with LP or even tighter for 𝑥𝑥Σ Σ Σ
Always Active: 𝐥 𝑗(𝑖) ≥
Always Inactive: 𝐮 𝑗(𝑖) ≤
Linear relaxed Unstable neuron: 𝐥 𝑗(𝑖) < 0 , 𝐮 𝑗(𝑖) >Σ Σ Σ 𝑓(𝑥) ℎ 1(1) ℎ 2(1) ℎ 3(1)
ReLU
Lower bound by Optimized
LiRPA
Example: Optimized LiRPA for ℎ 1(2) 𝑥𝑥Σ Σ Σ Σ Σ Σ 𝑓(𝑥)
Unoptimized LiRPA: 𝑓 = −1.
Optimized LiRPA: 𝑓 = −0.
BaB :
Prove: 𝑓 𝑥 ≥ 0,∀𝑥
∈
𝒞 ℎ 1(2) ℎ 2(2) ℎ 3(2) ℎ 1(1) ℎ 2(1) ℎ 3(1) ℎ 1(2) ℎ 2(2) ℎ 3(2)
Split ℎ 2(2)
Pick ℎ 1(2)
Split ℎ 1(2)
Pick ℎ 2(2)
𝑓 = −0.
𝑓 = 0.17 ✓ 𝑓 = 0.25 ✓ 𝑓 = 0.31 ✓ tigher l 1(2) and 𝑢 1(2) make tighter relaxation some cases but in a much faster manner.
In Fig.
2, we provide a two-layer NN example to illustrate how our optimized LiRPA can improve the performance of BaB veriﬁcation.
In Section 3.2, we then show that feasibility checking is important to guarantee the completeness of BaB, and BaB using LiRPA without feasibility checking will end up to be incomplete.
To ensure completeness, we design our algorithm with minimal usage of LP for checking feasibility of splits.
Finally, we propose a batch split design by solving a batch of sub-domains in a massively parallel manner on
GPUs to fully leverage the beneﬁts of cheap and parallelizable LiRPA.
We further improve BaBSR in a parallel fashion for branching and we summarize the detailed proposed algorithm in Section 3.4.
3. O PTIMIZED LiRPA FOR C OMPLETE V ERIFICATION
Concrete outer bounds with optimizable parameters We propose to use LiRPA as the bounding step in BaB. A pair of sound and concrete lower bound and upper bound ( f, f ) to f ( x ) can be obtained according to Eq.
7 given ﬁxed α
= α 0 :
[Equation]
Because L , U are linear functions w.r.t x when α 0 is ﬁxed, it is easy to solve Eq.
8 using H ¨ older’s inequality when C is a (cid:96) p norm ball (Xu et al., 2020).
In incomplete veriﬁcation settings, α can be set via certain heuristics (Zhang et al., 2018).
Salman et al.
(2019) showed that, the variable α is equivalent to dual variables in the LP relaxed veriﬁcation problem (Wong & Kolter, 2018).
Thus, an optimal selection of α given the same pre-activation bounds l ( i ) j and u ( i )
j can in fact, lead to the the same optimal solution for f and f as in LP.
Previous complete veriﬁers typically use LiRPA variants to obtain intermediate layer bounds l ( i ) j and u ( i ) j to construct a LP problem (e.g., Bunel et al.
; Lu & Kumar (2020) used convex outer adversarial polytope (Wong & Kolter, 2018)), and solve the LP to obtain bounds at output layer.
The main reason for using LP is that it typically produces much tighter bounds than LiRPA when α is not optimized.
To replace LP with fast and accelerator-friendly LiRPA algorithms in the complete veriﬁcation setting, we use optimized LiRPA to produce tighter bounds:
[Equation]
The inner minimization or maximization has closed form solutions (Xu et al., 2020) based on
H¨older’s inequality, so we only need to optimize on α .
Since we use a differentiable framework (Xu et al., 2020) to compute the LiRPA bound functions L and U , the gradients ∂ L ∂ α and ∂ U ∂ α can be obtained easily.
Optimization over α can be done via projected gradient descent (each coordinate of α is constrained in [0 , 1] ).
Since the gradient computation and optimization are done on GPUs, the bounding process is still very fast and can be one or two magnitudes faster than solving an LP.
Optimized LiRPA bounds can be tighter than LP Solving Eq.
9 using gradient descent with a small number of iterations cannot guarantee to converge to the global optima, so it seems the bounds must be looser than LP.
Counter-intuitively, by optimizing α , we can potentially obtain tighter bounds than LP.
When a LP relaxation is constructed, preactivation bounds l ( i ) j , u ( i )
j must be ﬁxed to construct the “triangle” relaxation for the j -th ReLU neuron in layer i .
During the LP optimizatin process, only the output bounds are optimized; l ( i ) j and u ( i ) j stay unchanged.
However, in the LiRPA formulation, L ( x, α ) and U ( x, α ) are complex functions of α : since pre-activation bounds l ( i ) j and u ( i )
j are also computed by LiRPA, they depend on all α ( i (cid:48) )
j (cid:48) (0 < i (cid:48) < i ) in previous layers.
Thus, the gradients ∂ L ∂ α and ∂ U ∂ α can tighten output layer bounds f and f indirectly by tightening intermediate layer bounds l ( i ) j and u ( i ) j , forming a tighter convex relaxation for the next iteration.
An LP solver cannot achieve this because adding l ( i ) j and u ( i ) j as optimization variables makes the problem non-linear.
This is the key to our success of applying LiRPA based bounds for the complete veriﬁcation setting, where tighter bounds are essential.
[Figure]
In Figure 3, we illustrate our optimized LiRPA bounds and the LP solution.
Initially, we use LiRPA with α set via a fast heuristic to compute intermediate layer bounds l
j and u ( i ) j
and then use them to build a relaxed LP problem.
The solution to this initial LP problem is the red line.
This LP solution is much tighter than the LiRPA solution with a heuristically set α , shown as the left-most point of the blue line.
Then, we optimize α with gradient decent, and LiRPA quickly outperforms this initial LP solution.
The optimized α also produces tighter intermediate layer bounds, l (cid:48)
( i ) j and u (cid:48)
( i ) j .
We can create a new
LP with optimized intermediate layer bounds l (cid:48)
( i ) j and u (cid:48)
( i ) j , whose solution is the light blue line.
This new LP only produces a slightly tighter bound than LiRPA with optimized α .
In most previous works on complete veriﬁcation, l ( i ) j and u ( i ) j are obtained from unoptimized LiRPA bounds or even weaker methods such as interval arithmetic, so the corresponding LP is similar to the red line in Figure 3; instead, our optimized LiRPA bounds can produce quite competitive bounds, and also exploit parallel acceleration from machine learning accelerators.
The tightness and efﬁciency of our optimized LiRPA procedure lead to huge improvements in veriﬁcation time compared to existing baselines.
ReLU Split Constraints In the BaB process, when a ReLU neuron h ( i ) j is split into two subdomains ( h ( i ) j ≥ 0 and h ( i ) j < 0 ), we simply set l ( i ) j ≥ 0 and u ( i ) j < 0 in the bound propagation process.
This allows LiRPA to achieve tightened bound because a split ReLU neuron essentially becomes linear, reducing relaxation errors.
However, When splits are added, LiRPA and LP are not equivalent even under ﬁxed l ( i ) j , u ( i ) j and optimal α .
After splits, LiRPA cannot check certain constraints where LP is capable to, as we will discuss in the next section.
3. C OMPLETENESS WITH M INIMAL U SAGE OF LP B OUNDING P ROCEDURE
Even though our optimized LiRPA can bring us huge speed improvement over LP for BaB based veriﬁcation, we observe that it may end up to be incomplete due to the lack of feasibility checking.
We state such an observation in Theorem 3.1:
Theorem 3.1 (Incompleteness without feasibility checking)
When using LiRPA variants described in Section 2.3 as the bounding procedure, BaB based veriﬁcation is incomplete.
We prove the theorem by giving a counter-example in Appendix A.1 where all ReLU neurons are split and thus the LiRPA runs on a linear network for each sub-domain.
As a result, LiRPA can still be indecisive for the veriﬁcation problem.
The main reason is that LiRPA variants will lose the feasibility information encoded by the sub-domain constraints.
For illustration, consider a subdomain C
i = C ∩ ( h ( i 1 ) j 1 < 0) ∩
( h ( i 2 ) j 2 ≥ 0) , LiRPA will force h ( i 1 ) j 1 and h ( i 2 )
j 2 to be bounded within [0 , 0] (always output 0) and [ f ( i 2 ) j 2 , f
( i 2 ) j 2 ] (simply pass through f ( i 2 ) j) respectively and propagate these bounds to get the approximated lower bound f C i .
However, the split feasibility constraint ( h ( i 1 )
j 1 < 0) ∩ ( h ( i 2 )
j 2 ≥ 0) is ignored, so two conﬂict splits may be conducted.
On the contrary, LP can fully preserve such feasibility information due to the linear solver involved and easily detect the infeasible sub-domains.
We then state Theorem 3.2, saying that the minimal usage of LP/feasibility checking with linear solver can guarantee the completeness of BaB with LiRPA.
Theorem 3.2 (Minimal feasibility checking for completeness) When using LiRPA variants described in Section 2.3 as the bounding procedure, BaB based veriﬁcation is complete if all infeasible leaf sub-domains (i.e., sub-domains cannot be further split) are detected by feasibility checking.
We prove the theorem in Appendix A.2, where we show that by checking the feasibility of splits with
LP, we can eliminate the cases where incompatible splits are chosen in the LiRPA BaB process.
Since LP is slow while LiRPA can be massively parallelized, we propose to only use LP when the
LiRPA based veriﬁcation process is stuck, either (1) when partitioning new sub-domains and then bounding them with LiRPA cannot further improve the bounds, or (2) when all unstable neurons have been split.
This way, we make sure that the infeasible sub-domains can be eventually detected by occasional usage of LP while the advantage of massive parallel LiRPA on GPU is fully enjoyed.
We will describe our full algorithm in Section 3.4.
[Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
[Table] [Table]
un
[Table]
LiRPA (
[Table] [Table]
[Table] [Table]
[Table]
ln , C un
[Table]
Insert Filter (cid:104) [
[Table]
l 1 ,
[Table]
[Table] [Table]
u 1 ,
[Table]
u 1 ,
[Table] [Table]
[Table]
ln ,
[Table] [Table]
ln ] , [
[Table]
un ,
[Table]
un ,
[Table]
un ] (cid:105) to P 9:
[Table]
←
[Table] [Table]
| (
[Table] [Table]
[Table] [Table]
[Table]
ui and C li 10:
[Table]
[Table] [Table]
11: if length ( P ) >
η then 12:
[Table]
Insert Filter (cid:104)
[Table]
[Table] [Table]
to
[Table]
14: Output f , f
3. B ATCH S PLITS
For state-of-the-art BaB methods (Bunel et al., 2020b; Lu & Kumar, 2020), only one sub-domain can be selected to split during each branching step.
Beneﬁting from our design of using cheap and
GPU-friendly LiRPA bounds
, we can select a batch of sub-domains to split and propagate LiRPA bounds for them in a batch.
Such a batching splitting design can greatly improve hardware efﬁciency on GPUs.
Given a batch size n that allows us to fully use the memory of one GPU device, we can obtain n bounds simultaneously.
This can help us grow the search tree on a single leaf by a depth of log 2 ( n ) , or split n/ 2 leaf nodes at the same time, accelerating by up to n times.
3. O UR C OMPLETE V ERIFICATION F RAMEWORK
Our LiRPA based complete veriﬁcation framework is presented in Alg. 1.
The algorithm takes a target NN function f and input x with domain C as inputs.
We run optimized LiRPA to get initial bounds ( f, f ) for x ∈ C (Line 2).
Then we utilize the power of GPUs to split in parallel and maintain a global set P storing all the sub-domains which cannot be veriﬁed with optimized LiRPA (Line 510).
Speciﬁcally, batch pick out improves BaBSR (Bunel et al., 2018) in a parallel manner to select n sub-domains in P and determine the corresponding ReLU neuron to split for each of them.
If the length of P is less than n , then we reduce n to the length of P .
batch split splits each selected C i to two sub-domains C li and C ui by forcing the selected unstable ReLU neuron to be positive and negative, respectively.
optimize LiRPA runs optimized LiRPA in parallel and returns the lower and upper bounds for n selected sub-domains simultaneously.
Insert Filter ﬁlters out veriﬁed sub-domains (proved with f C i ≥ 0 ) and inserts the remaining ones to P .
The while loop will break if the property is proved ( f ≥ 0 ) or a counter-example is found in some sub-domain ( f < 0 ).
To avoid excessive splits, we set the maximum length of the sub-domains to η (Line 12).
Once the length of P reaches this threshold, compute bound LP will be called.
It solves these η sub- domains by LP (one by one, in a for loop, omitted) with optimized LiRPA computed intermediate layer bounds.
If a sub-domain C i ∈ P (which previously cannot be veriﬁed by LiRPA) is proved or detected to be infeasible by LP, as an effective heuristic, we will backtrack and prioritize to check its parent node with LP.
If the parent sub-domain is also proved or infeasible, we can prune all its child nodes to greatly reduce the size of the search tree.
Completeness of our framework Our algorithm is complete , because we follow Theorem 3.2 and check feasibility of all split sub-domains that have deep BaB search tree depth (length of P reaches threshold η ), forming a superset of the worst case where all ReLU neurons are split.
E XPERIMENTS
In this section, we compare our veriﬁer against the state-of-the-art ones to illustrate the effectiveness of our proposed framework.
Overall, our veriﬁer is around 4X faster on Base model, 7X faster on the Wide model, and 20X faster on the Deep model than the best LP-based veriﬁer so far.
Setup We follow the most challenging experimental setup used in the state-of-the-art veriﬁer GNNONLINE (Lu & Kumar, 2020) and B A BSR (Bunel et al., 2020b).
Speciﬁcally, we evaluate on CIFAR10 dataset on three NNs, Base, Wide and Deep.
The dataset is categorized into three difﬁculty levels: Easy, Medium, and Hard, which is generated according to the performance of BaBSR.
Brieﬂy, we want to verify that for a given l ∞ norm perturbation less than (cid:15) , the classiﬁer will not predict a speciﬁc wrong label for image x .
The parallel batch size n is set to 64 and the η is set to 12,000 due to memory constraint.
More details on experimental setup are provided in Appendix B.
Comparisons against state-of-the-art veriﬁers In Table 1, we compare against the following four different methods on the same NNs: (1) BaBSR (Bunel et al., 2020b), a BaB and LP based veriﬁer using a simple ReLU split heuristic; (2) MIPP LANET (Ehlers, 2017), a customized MIP solver for
NN veriﬁcation where unstable ReLU neurons are randomly selected for split; (3) GNN (Lu &
Kumar, 2020) and (4) GNN-O NLINE (Lu & Kumar, 2020) are BaB and LP based veriﬁers using a learned graph neural network (GNN) to guide the ReLU split.
(5) P ROXIMAL B A BSR (Bunel et al., 2020a) is a very recently proposed veriﬁcation framework based on Lagrangian decomposition which also supports GPU acceleration without solving LPs.
The timeout threshold is 3,600 seconds.
For the Base model, Table 1 shows that we can be around 10X faster than baseline BaBSR and around 4X faster than GNN split baselines.
The accumulative solved properties with runtime is shown in Figure 4.
In all our experiments, we use the basic heuristic in BaBSR for branching and do not use GNNs, so our speedup comes purely from the faster LiRPA based bounding procedure.
[Table]
[Figure]
[Table]
Performance comparisons on Wide and Deep model architectures The performance of NN veriﬁers heavily depends on the size of the NN architectures.
In Table 2, we show that our veriﬁer is affected much less on wide and deep NNs compared to other state-of-the-art veriﬁers.
Our method enjoys GPU acceleration particularly on deep models and can achieve 30X speedup compared to
B A BSR.
When compared to the state-of-the-art LP based BaB, GNN-O NLINE , our method can save 20X running time.
In addition, we conduct an ablation study in Appendix C, analyzing the efﬁciency of optimized LiRPA and batch splits separately.
Performance comparisons of our proposed framework on CPU cores without GPU acceleration are investigated in Appendix D.
R ELATED W ORK
Complete veriﬁers Early complete veriﬁers rely on satisﬁability modulo theory (SMT)
(Katz et al., 2017; Huang et al., 2017; Ehlers, 2017) and mixed integer linear programming (MILP) (Tjeng et al., 2019a; Dutta et al., 2018), but they typically do not scale well.
Higher order logic provers such as proof assistant (Bentkamp et al., 2018) can also be potentially used for NN veriﬁcation, but their scalability to the NN setting has not been demonstrated.
Recently, Bunel et al.
(2018) uniﬁed these approaches into a BaB framework, extended and used in various complete veriﬁers.
LP bounding procedure is used in most of the existing BaB framework (Bunel et al., 2018;
Wang et al., 2018c;
Royo et al., 2019; Lu & Kumar, 2020).
For branching, there are two categories of branching strategies: (1) input node branching (Wang et al., 2018c;
Bunel et al., 2020b; Royo et al., 2019; Anderson et al., 2019) where input features are divided into sub-domains, and (2) activation node (especially,
ReLU) branching (Katz et al., 2017; Bunel et al., 2018; Wang et al., 2018b; Ehlers, 2017; Lu & Kumar, 2020) where hidden layer activations are split into sub-domains.
Bunel et al.
(2018) found that input node branching cost is exponential to input dimension.
Therefore, many state-of-the-art veriﬁers use activation node branching instead, focusing on heuristics to select good activation to split.
BaBSR (Bunel et al., 2018) prioritizes ReLUs for splitting based on their pre-activation bounds; Lu & Kumar (2020) used graph neural network (GNN) to learn good splitting heuristics.
Note that our work can use better branching heuristics like GNN split to achieve further speedup.
Two mostly relevant concurrent works using GPUs for accelerating veriﬁcation are: (1) GPUPoly
(M ¨ uller et al., 2020), an extension of DeepPoly on CUDA, is still an incomplete veriﬁer .
Also, it is implemented in CUDA C++, requiring manual effort for customization and gradient computation, so it is not easy to get the gradients for optimizing bounds as we have done in Section 3.1.
Lagrangian Decomposition (Bunel et al., 2020a) is a GPU-accelerated BaB based complete veriﬁer that iteratively tightens the bounds based on a new Lagrangian decomposition optimization formulation; LP is not required.
However, it solves a much more complicated optimization problem than
LiRPA, and typically requires hundreds of iterations to converge for a single sub-domain.
Incomplete veriﬁers Many incomplete veriﬁcation methods rely on convex relaxations of NN, replacing nonlinear activations like ReLUs with linear constraints (Wong & Kolter, 2018;
Zhang et al., 2018; Weng et al., 2018;
Wang et al., 2018b; Gehr et al., 2018; Singh et al., 2018a;b; 2019b;a) or semideﬁnite constraints (Raghunathan et al., 2018; Dvijotham et al., 2020; Dathathri et al., 2020).
Tighter relaxations require more computation and memory in general.
We refer the readers to (Salman et al., 2019) for a comprehensive survey.
Recently, Xu et al.
(2020) categorized the family of linear relaxation based incomplete veriﬁers into LiRPA framework, allowing efﬁcient implementation on machine learning accelerators.
Our work uses LiRPA as the bounding procedure for complete veriﬁcation and exploits its computational efﬁciency to accelerate complete veriﬁcation.
C ONCLUSION
We use a LiRPA based incomplete NN veriﬁer to accelerate the bounding procedure in branch and bound (BaB) for complete NN veriﬁcation on massively parallel accelerators.
We use a fast gradient based procedure to tighten LiRPA bounds.
We study the completeness of BaB with LiRPA, and show up to 5X speedup compared to state-of-the-art veriﬁers across multiple models and properties.
A P ROOFS A. P ROOF OF T HEOREM 3.
We prove Theorem 3.1 by providing a simple counterexample, and we illustrate the necessity of feasibility checking for the completeness of BaB based veriﬁcation.
Consider an NN with only two hidden nodes {+h 
+} = h 2 = ReLU ( x ) and one dimension input x , and its output function is deﬁned as f ( x ) =
h 1 − h 2 = ReLU ( x ) − ReLU ( x ) .
As a veriﬁcation problem, we want to verify the property f ( x ) ≥ 0 where x = [ − 1 , 1] .
Since hidden nodes h 1 and h 2 are exactly the same, the ground-truth output range is f ∗ ( x ) =
A complete BaB based veriﬁer is expected to obtain that optimal bound and prove the property after split h 1 and h 2 together while BaB with only LiPRA cannot guarantee that completeness.
Speciﬁcally, BaB with only LiRPA will split the original domain x = [ − 1 , 1] into four sub-domains and approximate the bound with LiRPA respectively:
) (feasible) sub-domain x = [ − 1 , 1] , h 1 > 0 , h 2 > 0 with output f = [ x, x ] − [ x, x ] = [0 , 0] (2) (feasible) sub-domain x = [ − 1 ,
h
1 ≤ 0 , h 2 ≤ 0 with output f = [0 , 0] − [0 , 0] = (3) (infeasible) sub-domain x =
− ] , h 1 ≤ 0 , h
2 >
with output f = [0 , 0] − [ x, x ] = [ − 1 , 1] (4) (infeasible) sub-domain x = [ − h 1 > 0 , h 2 ≤ 0 with output f =
x
x ] − [0 , 0] = − Only the ﬁrst two split sub-domains are feasible and therefore the ground-truth lower bound 0 can be obtained by taking the minimum of the estimated bounds from sub-domains (1) and (2).
However, pure LiRPA is not able to tell the infeasibility of sub-domains (3) and (4) and thus BaB with pure
LiRPA will report the minimum − 1 got from all these four sub-domains as the global lower bound for the original input domain, ending up not being able to verify the property, i.e., incomplete.
A. P ROOF OF T HEOREM 3.
We prove Theorem 3.2 by considering the worst case where all unstable ReLU neurons are split.
Given a neural network function f with input domain C , assume there are N unstable ReLU neurons { h i | i = 1 , · · · , N } .
In the worst case, we have 2 N leaf sub-domains S =
{C i | i = 1 , · · · , 2 N } , where each C i corresponds to one assignment of unstable ReLU neuron splits. For example, we can have [Equation] Note that by deﬁnition C = ∪ C (cid:48) ∈S C (cid:48) ; in other words, all the 2 N split sub-domains combined will be the same as the original input domain.
Not all of the sub-domains are actually feasible, due to the consistency requirements between neurons. For example, in our proof in Section A.1, h 1 and h 2 cannot be both ≥ 0 or < 0 . We can divide the sub-domains S into two mutually exclusive sub-sets, S feas for all the feasible sub-domains, and S infeas for all the infeasible sub-domains.
We have C = ∪ C (cid:48) ∈S feas C (cid:48) since these infeasible subdomains are empty sets. We ﬁrst show that linear programming can be used to effective detect these infeasible sub-domains. For some C (cid:48) ∈ S infeas , because all the ReLU neurons are ﬁxed to be positive or negative, no relaxation is needed and the network is essentially linear; thus, the value of every hidden neural h i can be written as a linear equation w.r.t. input x .
We add all the Boolean predicates on h i to a LP problem as linear constraints w.r.t x . If this LP is feasible, then we can ﬁnd some input x 0 that assigns correct values to all h i ; otherwise, the LP is infeasible. Due to the lack of feasibility checking in LiRPA, the computed global lower (or upper) bounds from LiRPA is f LiRPA = min C (cid:48) ∈S f C (cid:48)
=
min (cid:16) min C (cid:48) ∈S feas f C (cid:48) , min C (cid:48) ∈S infeas f C (cid:48) (cid:17) . With feasibility checking from LP, we can remove all infeasible sub-domains from this min such that they do not contribute to the global lower bound: f = min C (cid:48) ∈S feas f C (cid:48) .
To prove the whole BaB veriﬁcation is complete, it is sufﬁcient to prove this lower bound f is the exact minimum of f bounded in C .
Since any sub-domain C (cid:48) ∈ S feas is a leaf sub-domain with no unstable ReLU neurons, the neural network bounded within C (cid:48) is a linear function.
LiRPA can give an exact minimum of f within sub-domain C (cid:48) .
Since C = ∪ C (cid:48) ∈S feas C (cid:48) (in other words, S feas covers all the feasible sub-domains within C ), the minimal value for all of them f = min C (cid:48) ∈S feas f C (cid:48) forms the exact minimum of f within the input domain C .
Thus, BaB with LiRPA based bounding procedure is complete when feasibility checking is applied.
B E XPERIMENTAL S ETUP
We follow the most challenging experimental setup used in the state-of-the-art veriﬁer GNNONLINE (Lu & Kumar, 2020) and B A BSR (Bunel et al., 2020b).
Speciﬁcally, we evaluate on CIFAR10 dataset with the same standard robustly trained convolutional neural networks, Base, Wide, and Deep structures, used in (Lu & Kumar, 2020).
The Base model contains 2 convolution layers with 8 and 16 ﬁlters as well as two linear layers with 100 and 10 hidden units.
In total, the Base model has 3,172 ReLU activation units.
The Wide model contains 2 convolution layers with 16 and 32 ﬁlters and two linear layers with 100 and 10 hidden units, which has 6,244 ReLU activation units in total.
The Deep model contains 4 convolution layers and all of them have 8 ﬁlters and two linear layers with 100 and 10 hidden units, which has 3,756 ReLU activation units in total.
The property is deﬁned as given a image x which the model predicted its label y c correctly.
Given another wrong label y c (cid:48) and (cid:15) , we prove:
[Equation]
where f ( · ) is a multi-class classiﬁer, e ( c ) and
e ( c (cid:48) ) are one-hot encoding vectors for labels y c and y c (cid:48) .
We want to verify that for a given (cid:15) , the trained classiﬁer will not predict wrong label y c (cid:48) for image x .
All properties including x , (cid:15) , and c (cid:48) are provided by (Lu & Kumar, 2020).
Speciﬁcally, they categorize veriﬁcation properties solved within 800s as easy, between 800s and 2400s as medium and more than 2400s as hard by B A BSR.
Our experiments are conducted on one Intel E5 CPU and one Nvidia RTX 1080TI GPU.
The parallel batch size n is set to 64 and the η is set to 12,000 due to the memory constraint.
To make a fair comparison, we use one CPU core for all methods since the LP based method can only utilize one
CPU core.
Also, we use one GPU for GNN, GNN-O NLINE , and our methods.
In Optimized LiRPA, we apply 200 steps gradient decent at the initial bounds solving.
After that during splits, we usesteps gradient decent and early stop once f > 0 or no improvement.
C A BLATION STUDY
Our efﬁcient framework leverages two powerful components: (1) Optimized LiRPA and (2) Batch
Splits.
In this section, we conduct breakdown experiments to show how the individual technique can help with complete veriﬁcation.
As we can see from Table 3, only using Batch Splits cannot help with the problems.
We observe that, without Optimized LiRPA and LP in the Batch Splits stage, the
LiRPA bounds we obtained are very loose, making the global lower bound improvement slow.
In contrast, only using Optimized LiRPA even split single node at one time can still save around 70% computational time beneﬁted from the tighter LiRPA bounds.
Finally, combining Batch Splits and
Optimized LiRPA allows us to rarely use LP and save up to 96.82% computational time
[Table]
[Table]
D C OMPLETE VERIFICATION WITH L I RPA ON CPU VS GPU
In this section, we investigate the performance of our algorithm for the cases where one/multiple
CPU cores are available without GPU acceleration.
Note that existing baselines such as B A BSR and
MIP PLANET can only utilize one CPU core subject to the Gurobi solver.
GNN and GNN-O NLINE need one GPU to forward GNN during branching while the rest of the veriﬁcation processes all perform on CPU cores.
In contrast, our method is much more ﬂexible, we are not limited by the number of CPU cores or GPUs and for a fair comparison, we only use one CPU core and one GPU (same with GNN and GNN-O NLINE ) in our paper’s experimental results.
In Figure 5, results of various computational environments are shown.
As we can see, the running time decreases by the number of CPU cores increasing.
However, the descent rate seems not constant.
It may be caused by the CPU dispatcher or memory cache, and we leave the problem for future work.
Also, there is a huge gap between 8 CPU cores with one CPU core + one GPU and the performance gap is more obvious on Wide and Deep models.
Surprisingly, even by using one CPU core, we still get very competitive performance even compare with GNN-O NLINE which needs one GPU additionally.
[Figure]