General Cutting Planes for Bound-Propagation-Based Neural Network Verification
Abstract
Bound propagation methods, when combined with branch and bound, are among the most effective methods to formally verify properties of deep neural networks such as correctness, robustness, and safety.
However, existing works cannot handle the general form of cutting plane constraints widely accepted in traditional solvers, which are crucial for strengthening verifiers with tightened convex relaxations.
In this paper, we generalize the bound propagation procedure to allow the addition of arbitrary cutting plane constraints, including those involving relaxed integer variables that do not appear in existing bound propagation formulations.
Our generalized bound propagation method, GCP-CROWN, opens up the opportunity to apply g eneral c utting p lane methods for neural network verification while benefiting from the efficiency and GPU acceleration of bound propagation methods.
As a case study, we investigate the use of cutting planes generated by off-the-shelf mixed integer programming (MIP) solver.
We find that MIP solvers can generate high-quality cutting planes for strengthening bound-propagation-based verifiers using our new formulation.
Since the branching-focused bound propagation procedure and the cutting-plane-focused MIP solver can run in parallel utilizing different types of hardware (GPUs and CPUs), their combination can quickly explore a large number of branches with strong cutting planes, leading to strong verification performance.
Experiments demonstrate that our method is the first verifier that can completely solve the oval20 benchmark and verify twice as many instances on the oval
benchmark compared to the best tool in VNN-COMP 2021, and also noticeably outperforms state-of-the-art verifiers on a wide range of benchmarks.
GCP-CROWN is part of the α,β -CROWN verifier, the VNN-COMP 2022 winner .
Code is available at http://PaperCode.cc/GCP-CROWN .
Introduction
Neural network (NN) verification aims to formally prove or disprove certain properties (e.g., correctness and safety properties) of a NN under a certain set of inputs.
These methods can provide worst-case performance guarantees of a NN, and have been applied to mission-critical applications that involve neural networks, such as automatic aircraft control [31, 4], learning-enabled cyber-physical systems [54], and NN based algorithms in an operating system [51].
The NN verification problem is generally NP-complete [30].
For piece-wise linear networks, it can be encoded as a mixed integer programming (MIP) [53] problem with the non-linear ReLU neurons described by binary variables.
Thus, fundamentally, the NN verification problem can be solved using the branch and bound (BaB) [10] method similar to generic MIP solvers, by branching some binary variables and relaxing the rest into a convex problem such as linear programming (LP) to obtain bounds on the objective.
Although early neural network verifiers relied on off-the-shelf CPU-based
LP solvers [36, 9] for bounding in BaB, LP solvers do not scale well to large NNs.
Thus, many recent verifiers are instead based on efficient and GPU-accelerated algorithms customized to NN verification, such as bound propagation methods [60, 57], Lagrangian decomposition methods [8, 17] and others [16, 11].
Bound propagation methods, presented in a few different formulations [58, 18, 56, 61, 50, 25], empower state-of-the-art NN verifiers such as α,β -CROWN [61, 60, 57] and
VeriNet [3], and can achieve two to three orders of magnitudes speedup compared to solving the NN verification problem using an off-the-shelf solver directly [57], especially on large networks.
Despite the success of existing NN verifiers, we experimentally find that state-of-the-art NN verifiers may timeout on certain hard instances which a generic MIP solver can solve relatively quickly, sometimes even without branching.
Compared to an MIP solver, a crucial factor missing in most scalable NN verifiers is the ability to efficiently generate and solve general cutting planes (or “cuts”).
In generic MIP solvers, cutting planes are essential to strengthen the convex relaxation, so that much less branching is required.
Advanced cutting planes are among the most important factors in modern MIP solvers [6]; they can strengthen the convex relaxation without removing any valid integer solution from the MIP formulation.
In the setting of NN verification, cutting planes reflects complex intra-layer and inter-layer dependencies between multiple neurons, which cannot be easily captured by existing bound propagation methods with single neuron relaxations [45].
This motivates us to seek the combination of efficient bound propagation method with effective cutting planes to further increase the power of NN verifiers.
A few key factors make the inclusion of general cutting planes in NN verifiers quite challenging.
First, existing efficient bound propagation frameworks such as CROWN [61] and β -CROWN [57] cannot solve general cutting plane constraints that may involve variables across different layers in the MIP formulation.
Particularly, these frameworks do not explicitly include the integer variables in the MIP formulation that are crucial when encoding many classical strong cutting planes, such as Gomory cuts and mixed integer rounding (MIR) cuts.
Furthermore, although some existing works [47, 52, 40] enhanced the basic convex relaxation used in NN verification (such as the Planet relaxation [19]), these enhanced relaxations involve only one or a few neurons in a single layer or two adjacent layers, and are not general enough.
In addition, an LP solver is often required to handle these additional cutting plane constraints [40], for which the efficient and GPU-accelerated bound propagation cannot be used, so the use of these tighter relaxations may not always bring improvements.
In this paper, we achieve major progress in using general cutting planes in bound propagation based
NN verifiers.
To mitigate the challenge of efficiently solving general cuts, our first contribution is to generalize existing bound propagation methods to their most general form, enabling constraints involving variables from neurons of any layer as well as integer variables that encode the status of a
ReLU neuron.
This allows us to consider any cuts during bound propagation without relying on a slow
LP solver, and opens up the opportunity for using advanced cutting plane techniques efficiently for the NN verification problem.
Our second contribution involves combining a cutting-plane-focused, off-the-shelf MIP solver with our GPU-accelerated, branching-focused bound propagation method capable of handling general cuts.
We entirely disable branching in the MIP solver and use it only for generating high quality cutting planes not restricting to neurons within adjacent layers.
Although an
MIP solver often cannot verify large neural networks, we find that they can generate high quality cutting planes within a short time, significantly helping bound propagation to achieve better bounds.
Our experiments show that general cutting planes can bring significant improvements to NN verifiers: we are the first verifier that completely solves all instances in the oval20 benchmark, with an average time of less than 5 seconds per instance; on the even harder oval21 benchmark in VNNCOMP 2021 [3], we can verify twice as many instances compared to the competition winner.
We also outperform existing state-of-the-art bound-propagation-based methods including those using multi-neuron relaxations [20] (a limited form of cutting planes).
Background
The NN verification problem We consider the verification problem for an L -layer ReLU-based
Neural Network (NN) with inputs ˆ x (0) :
= x ∈ R d 0 , weights W ( i ) ∈
R d i × d i − 1 , and biases b ( i )
∈
R d i ( i ∈ { 1 , · · · , L } ).
We can get the NN outputs f ( x ) = x ( L ) ∈ R d L by sequentially propagating the input x through affine layers with x ( i ) =
W ( i ) ˆ x
( i − 1)
+ b ( i ) and ReLU layer with ˆ x ( i ) =
ReLU( x ( i ) ) .
We also let scalars ˆ x ( i ) j and x ( i ) j denote the post-activation and pre-activation, respectively, of j -th ReLU neuron in i -th layer.
Throughout the paper, we use bold symbols to denote vectors (e.g., x ( i ) ) and regular symbols to denote scalars (e.g., x ( i )
j is the j -th element of x ( i ) ).
We use the shorthand [ N ] to denote { 1 , · · · , N } , and W ( i ) : ,j is the j -th column of W ( i ) .
Commonly, the input x is bounded within a perturbation set C (such as an ℓ p norm ball) and the verification specification defines a property of the output f ( x ) that should hold for any x ∈ C , e.g., whether the true label’s logit f y ( x ) will be always larger than another label’s logit f j ( x ) , (i.e., checking if f y ( x ) − f j ( x ) is always positive).
Since we can append the verification specification (such as a linear function on neural network output) as an additional layer of the network, canonically, the
NN verification problem requires one to solve the following one-dimensional ( d L = 1 ) optimization objective on f ( x ) :
[Equation] [Equation]
with the relevant property defined to be proven if the optimal solution f ∗ ≥ 0 .
Throughout this work, we consider the ℓ ∞ norm ball C :=
{ x : ∥ x − x 0 ∥ ∞ ≤ ϵ } where x 0 is a predefined constant (e.g., a clean input image), although it is possible to extend to other norms or specifications [43, 59].
The MIP and LP formulation for NN verification
The mixed integer programming (MIP) formulation is the root of many NN verification algorithms.
This formulation uses binary variables z to encode the non-linear ReLU neurons to make the non-convex optimization problem (1) tractable.
Additionally, we assume that we know sound pre-activation bounds l ( i ) ≤ x ( i ) ≤ u ( i ) for x ∈ C which can be obtained via cheap bound propagation methods such as IBP [23] or CROWN [61].
Then ReLU neurons for each layer i can be classified into three classes [58], namely “active” ( I +( i ) ), “inactive” ( I − ( i ) ) and “unstable” ( I ( i ) ) neurons, respectively:
[Equation]
Based on the definition of ReLU, activate and inactive neurons are linear functions, so only unstable neurons require binary encoding.
The MIP formulation of (1) is:
[Equation]
Since a MIP problem is slow or intractable to solve, it is commonly relaxed as a When the integer variables are relaxed to continuous ones, we obtain the LP relaxation of NN verification problem:
[Equation]
The ReLU constraints involving z is often projected out, leading to the well-known Planet relaxation used in many NN verifiers, replacing (6), (7) and (8) with a single constraint to get an equivalent LP:
[Equation]
Due to the relaxations, the objective of the LP formulation is always a lower bound of the MIP formulation: f ∗ LP ≤ f ∗ .
A verifier using this formulation is incomplete: if f ∗ LP ≥ 0 , then f ∗ ≥and the property is verified; otherwise, we cannot conclude the sign of f ∗ so the verifier must return “unknown”.
Branch and bound can be used to improve the lower bound and achieve completeness [10, 57].
However, in this paper, we work on an orthogonal direction of strengthening the LP formulation by adding cutting planes to obtain larger bounds.
Bound propagation methods Instead of solving the LP formulation directly using a LP solver, bound propagation methods aims to quickly give a lower bound for f ∗ LP .
For example, CROWN [61] and β -CROWN [57] propagate a sound linear lower bound backwards for f L ( x ) with respect to each intermediate layer.
For example, suppose we know
[Equation]
With i =
L − 1 the above is trivially hold with a ( L − 1) =
W ( L ) , c
( L − 1)
=
b ( L ) .
In bound propagation methods, a propagation rule propagates an inequality (13) through a previous layer ˆ x ( i ) :
=
ReLU( W ( i ) ˆ x ( i − 1)
+ b ( i ) ) to obtain a sound inequality with respect to ˆ x
( i − 1) :
[Equation]
Here a ( i − 1) , c ( i − 1) can be calculated in close-form via a ( i ) , c ( i ) , W ( i ) , b ( i ) , l ( i ) and u ( i ) such that the bound still holds (see Lemma 1 in [57]).
Applying the procedure repeatedly will eventually reach the input layer:
[Equation]
The minimization on linear layer can be solved easily when C is a ℓ p norm ball to obtain a valid lower bound of f ∗ .
Since the bounds propagate layer-by-layer, this process can be implemented efficiently on GPUs [59] without relying on a slow LP solver, which greatly improves the scalability and solving time.
Additionally, it is often used to obtain intermediate layer bounds l ( i ) and and u ( i ) required for the MIP formulation (6)(7), by treating each x ( i ) j as the output neuron.
The bound propagation rule can either be derived in primal space [61], dual space [58] or abstract interpretations [50].
In Sec.3.1, we will discuss the our bound propagation procedure with general cutting plane constraints.
Neural Network Verification with General Cutting Planes 3.1 GCP-CROWN: General Cutting Planes in Bound Propagation
In this section, we generalize existing bound propagation method to handle general cutting plane constraints.
Our goal is to derive a bound propagation rule similar to CROWN and β -CROWN discussed in Section 2, however considering additional constraints among any variables within the
LP relaxation.
To achieve this, we first derive the dual problem of the LP; inspired by the dual formulation, we derive the bound prorogation rule in a layer by layer manner that takes all cutting plane constraints into consideration.
The derivation process is inspired by [58, 45] and [57].
LP relaxation with cutting planes.
In this section, we derive the bound propagation procedure under the presence of general cutting plane constraints.
A cutting plane is a constraint involving any variables x
( i ) (pre-activation), ˆ x ( i ) (post-activation), z ( i ) (ReLU indicators) from any layer i :
[Equation]
Here h ( i ) , g ( i ) and q ( i ) are coefficients for this cut constraint.
The difference between a valid cutting plane and an arbitrary constraint is that a valid cutting plane should not remove any valid integer solution from the MIP formulation.
Our new bound propagation procedure can work for any constraints, although in this work we focus on studying the impacts of cutting planes.
When there are
N cutting planes, we write them in a matrix form:
[Equation]
where H ( i ) , G ( i ) , Q ( i ) ∈ R N × d i .
The LP relaxation with all cutting planes is:
[Equation]
Since an additional constraint is added
[Equation]
f ∗ LP-cut ≥ f ∗ LP
and we get closer to f ∗ .
Unlike the original LP where each constraint only contains variables from two consecutive layers, our general cutting plane constraint may involve any variable from any layer in a single constraint
[Equation]
The dual problem with cutting planes We first show the dual problem for the above LP.
The dual problem we consider here is different from existing works in two ways: first, we have constraints with integer variables to support potential cutting planes on z .
Additionally, we have cutting planes constraints that may involve variables in any layer, so the dual in previous works such as [58] cannot be directly reused.
Our dual problem is given below (derivation details in Appendix A):
[Equation]
s.t.
[Equation]
) = − 1; and for each i ∈
[ L − 1] :
[Equation]
ν ( i )
[Equation]
− β ⊤ H
[Equation]
i ) : ,
[Equation]
; j ∈ I
[Equation]
i
[Equation]
and for each j ∈ I ( i ) the two equalities below hold:
[Equation]
Instead of solving the dual problem exactly, we use it to obtain a lower bound of f ∗ LP-cut .
Intuitively, due to the definition of due problem, any valid setting of dual variables leads to a lower bound of f ∗ LP-cut .
Informally, starting from ν ( L ) = − 1 , by applying the constraints in this dual formulation, we can compute ν
( L − 1) , ν ( L − 2) , · · · until ν (1) .
The final objective is a function of ν ( i ) , i ∈
[ N ] and other dual variables.
Precisely, our GCP-CROWN bound propagation procedure with general cutting plane constraint is presented in the theorem below (proof in Appendix A):
Theorem 3.1 (Bound propagation with general cutting planes) .
Given any optimizable parameters 0 ≤ α ( i ) j ≤ 1 and β ≥ 0 , f ∗ LP-cut is lower bounded by the following objective function:
[Equation]
where variables ν
( i ) are obtained by propagating ν ( L ) =
− 1 throughout all i ∈
[ L − 1] : ν ( i ) j = ν ( i +1)
⊤ W
( i +1) : ,j − β ⊤ ( H ( i ) : ,j + G ( i ) : ,j ) ,
j ∈
I +( i ) ν
( i )
j
= − β ⊤ H ( i ) : ,j , j ∈ I − ( i ) ν
( i ) j
= π ( i ) j ∗ − α ( i ) j
[ˆ ν ( i ) j ] − − β ⊤ H ( i ) : ,j , j ∈ I ( i )
Here ˆ ν
( i ) j , π ( i ) j ∗ and h ( i ) j
( β ) are defined for each unstable neuron j ∈
I ( i ) as: ˆ ν ( i ) j :=
ν ( i +1)
⊤ W
( i +1) : ,j − β ⊤ G ( i ) : ,j π ( i ) j ∗ = max (cid:32) min (cid:32) u
( i )
j
[ˆ ν ( i ) j ] + + β ⊤ Q ( i ) : ,j u ( i ) j − l ( i ) j , [ˆ ν ( i ) j ] + (cid:33) ,(cid:33) h
[Equation]
i )
j
[Equation]
=  
[Equation]
if
[Equation]
if
[Equation]
β
[Equation]
Q
[Equation]
if
[Equation]
Q
[Equation]
ν
[Equation]
] +
Based on Theorem 3.1, to obtain an lower bound of f ∗ LP-cut , we start with any valid setting of 0 ≤ α ≤ 1 and β ≥ 0 and ν ( L ) = − 1 .
According to the bound propagation rule, we can compute each ν ( i ) , i ∈
[ L − 1] , in a layer by layer manner.
Then objective g ( α , β ) can be evaluated based on all ν ( i ) to give an lower bound of f ∗ LP-cut .
Since any valid setting of α and β lead to a valid lower bound, we can optimize α and β using gradient ascent in a similar manner as in [60, 57] to tighten this lower bound.
The entire procedure can also run on GPU for great acceleration.
Connection to Convex Outer Adversarial Polytope In convex outer adversarial polytope [58],
a bound propagation rule was developed in a similar manner in the dual space without considering cutting plane constraints, and is a special case of ours.
We denote their bound propagation objective function as g WK which also contains optimizable parameters α WK .
Proposition 3.2.
Given the same input x , perturbation set C , network weights, and N cutting plane constraints,
[Equation]
Proof.
In Theorem 3.1, when all β are set to 0, then π ( i ) j ∗ =
u ( i ) j
[ˆ ν ( i ) j ] + u ( i ) j − l
[Equation]
i ) j and h ( i )
j
[Equation]
β
[Equation]
=
π ( i )
[Equation]
l
[Equation]
i ) j , we recover exactly the same bound propagation equations as in [58].
However, since we allow the addition of cutting plane methods and we can maximize over the additional parameter β , the objective given by our bound propagation is always at least as good as g WK .
Connection to CROWN-like bound propagation methods CROWN [61] and α -CROWN [60] use the same bound propagation rule as [58] so Proposition 3.2 also applies, although they were derived from primal space without explicitly formulating the problem as a LP.
Salman et al.
[45] showed that many other bound propagation methods [50, 55] are equivalent to or weaker than [58].
Recently, Wang et al.
[57] extends CROWN to β -CROWN to handle split constraints (e.g., x ( i ) j ≥ 0 ).
It can be seen a special case as GCP-CROWN where all H , G and Q matrices are zeros except:
H
[Equation]
i ) j,
[Equation]
1 ,j
[Equation]
In addition, [20] encodes multi-neuron relaxations using sparse H ( i ) and G ( i ) and each cut contains a small number of neurons involving x ( i ) and ˆ x ( i ) for the same layer i .
Wang et al.
[57] derived bound propagation rules from both the dual LP and the primal space with a Lagrangian without LP.
However, in our case, it is not intuitive to derive bound propagation without LP due to the potential cutting planes on relaxed integer variables z , which do not appear without the explicit LP formulation.
Furthermore, although we derived cutting planes for bound propagation methods, it is technically also possible to derive them using other bounding frameworks such as Lagrangian decomposition [8].
3.2 Branch-and-bound with GCP-CROWN and MIP Solver Generated Cuts
To build a complete NN verifier, we follow the popular branch-and-bound (BaB) procedure [10, 9] in state-of-the-art NN verifiers with GPU accelerated bound propagation method [8, 60, 16, 57], and our GCP-CROWN is used as the bounding procedure in BaB. We refer the readers to Appendix B for a more detailed background on branch-and-bound.
Having the efficient bound propagation procedure with general cutting plane constraints, we now need to find a good set of general cutting planes
H ( i ) , G ( i ) , Q ( i ) to accelerate NN verification.
Since GCP-CROWN can adopt any cutting planes, to fully exploit its power, we propose to use off-the-shelf MIP solvers to generate cutting planes and create an NN verifier combining GPU-accelerated bound propagation with strong cuts generated by a MIP solver.
We make the bound propagation on GPU and the MIP solver on CPU run in parallel with cuts added on-the-fly, so the original strong performance of bound-propagation-based
NN verifier will never be affected by a potentially slow MIP solver.
This allows us to make full use of available computing resource (GPU + CPU).
The architecture of our verifier is shown in Fig 1.
[Figure]
MIP solvers such as cplex [28] and gurobi [24] also apply a branch-and-bound strategy, conceptually similar to state-of-the-art NN verifiers.
They often tend to be slower than specialized NN verifiers because
MIP solvers rely on slower bounding procedures (e.g., Simplex or barrier method) and cannot apply an GPU-accelerated method such as bound propagation or Lagrangian decomposition.
However, we still find that MIP solvers are a strong baseline when combined with tight intermediate layer bounds .
For example, in the oval21 benchmark in Table 2, αCROWN+MIP (MIP solver combined with tight intermediate layer bound computed by α -CROWN) is able to solve 4 more instances compared to all other tools in the competition.
Our investigation found that α -CROWN+MIP explores much less branches than other state-of-the-art branch-and-bound based
NN verifiers, however before branching starts, the
MIP solver produces very effective cutting planes that can often verify an instance with little branching.
MIP solvers is able to discover sophisticated cutting planes involving several NN layers reflecting complex correlations among neurons, while existing
NN verifiers only exploit specific forms of constraints within same layer or between adjacent layers [52, 47, 40].
This motivates us to combine the strong cutting planes generated by MIP solvers with GPU-accelerated bound-propagation-based BaB.
In this work, we use cplex as the MIP solver for cutting plane generation since gurobi cannot export cuts.
We entirely disable all branching features in cplex and make it focus on finding cutting planes only.
These cutting planes are generated only for the root node of the BaB search tree so they are sound for any subdomains with neuron splits in BaB. We conduct branching using our generalized bound propagation procedure in Section (3.1) with the cutting planes generated by cplex .
Fully-parallelized NN verifier design We design our verifier as shown in Figure 1.
After parsing the NN under verification, we launch a separate process to encode the NN verification problem as
MIP problem and start multiple MIP solvers, one for each target label to be verified.
At the same time, the main NN verifier process executes branch-and-bound without waiting for the MIP solver process.
In each iteration of branch and bound, we query the MIP solving processes and fetch any newly generated cutting planes.
If any cutting planes are produced, they are added as H ( i ) , G ( i ) , Q ( i ) in
GCP-CROWN and tighten the bounds for subsequent branching and bounding.
If no cutting planes are produced, GCP-CROWN reduces to β -CROWN [57].
Since our verifier is based on strengthening the bounds in β -CROWN with sound cutting planes, it is also sound and complete.
Adjustments to existing branch and bound method.
We implement GCP-CROWN into the α,β -CROWN verifier [61, 59, 57], the winning verifier in VNN-COMP 2021 [3], as the backbone for BaB with bound propagation.
To better exploit the power of cutting planes under a fully parallel and asynchronous design, we made a key changes to the BaB procedure.
When the number of
BaB subdomains are greater than batch size, we rank the subdomains by their lower bounds and choose the easiest domains with largest lower bounds first to verify with GCP-CROWN, unlike most existing verifiers which solve the worst domains first.
We use such a order because the MIP solver generates cutting planes incrementally.
Solving these easier subdomains tend to require no or fewer cutting planes, so we solve them at earlier stages where cutting planes have not been generated or are relatively weak.
On the other hand, if we split worst subdomains first, the number of subdomains will grow quickly, and it can take a long time to verify these domains when stronger cuts become available later.
Under a similar rationale, when verifying a multi-class model and BaB needs to verify each target class label one by one, we start BaB from the easiest label first ( α -CROWN bound closest to 0), allowing the MIP solver to run longer for harder labels, generating stronger cuts for harder labels.
[Table]
[Figure]
[Table]
[Figure]
Experiments
We now evaluate our verifier, GCP-CROWN with MIP cuts, on a few popular verification benchmarks.
Since our verifier uses a MIP solver in our pipeline, we also include a new baseline, α -CROWN+MIP, which uses gurobi as the MIP solver with the tightest possible intermediate layer bounds from α -CROWN [59].
We use the same branch and bound algorithm as in β -CROWN
and we use filtered smart branching (FSB) [16] as the branching heuristic in all experiments.
Without cutting planes,
GCP-CROWN becomes vanilla β -CROWN as we share the same code base as β -CROWN.
We include model information and detailed setup for our experiments in Appendix C. GCP-CROWN has been integrated into the α,β -CROWN (alpha-beta-CROWN) verifier, and the instructions to reproduce results in this paper are available at http://PaperCode.cc/GCP-CROWN .
Results on the oval20 benchmark in VNN-COMP 2020.
oval20 is a popular benchmark consistently used in huge amount of NN verifiers and it perfectly reflects the progress of NN verifiers.
We include literature results for many baselines in Table 1.
We are the only verifier that can completely solve all three models without any timeout.
Our average runtime is significantly lower compared to the time of baselines because we have no timeout (counted as 3600s), and our slowest instance only takes about a few minutes while easy ones only take a few seconds, as shown in Figure 2.
Additionally, we often use less number of branches compared to the state-of-the-art verifier, β -CROWN, since our strong cutting planes help us to eliminate many hard to solve subdomains in BaB. Furthermore, we highlight that α -CROWN+MIP also achieves a low timeout rate, although it is much slower than our bound propagation based approach combined with cuts from a MIP solver.
Results on VNN-COMP 2021 benchmarks.
Among the eight scoring benchmarks in VNN-COMP 2021 [3], only two ( oval21 and cifar10-resnet ) are most suitable for the evaluation of this work.
Among other benchmarks, acasxu and nn4sys have low input dimensionality and require input space branching rather than ReLU branching; verivital , mnistfc , and eran benchmarks consist of small MLP networks that can be solved directly by MIP solvers; marabou contains mostly adversarial examples, making it a good benchmark for falsifiers rather than verifiers.
We present our results in Table 2.
Besides results from 6 VNN-COMP 2021 participants, we also include two additional
[Table] [Table]
baselines, α -CROWN+MIP (same as in Table 1), and MN-BaB [20], a recently proposed branch and bound framework with multi-neuron relaxations [39], which can be viewed as a restricted form of cutting planes.
On the oval21 benchmark, OVAL, VeriNet and α,β -CROWN are the best performing tools, verified 11 out of 27 instances, while we can verify twice more instances (22 out of 27) on this benchmark.
On the cifar10-resnet benchmark, our verifier also solves the most number of instances and achieves the lowest average time.
In fact, α -CROWN+MIP is also a strong baseline, solving 4 more instances than all competition participants, showing the importance of strong cutting planes.
Our GCP-CROWN with MIP cuts combines the benefits of fast bound propagation on GPU with the strong cutting planes generated by a MIP solver and achieves the best performance.
We present a more detailed analysis on the cutting planes used in this benchmark in Appendix C.2.
The oval21 benchmark was also included as part of VNN-COMP 2022, concluded in July 2022, with a different sample of 30 instances.
GCP-CROWN is part of the winning tool in VNN-COMP 2022, α,β -CROWN, which verified 25 out of 30 instances in this benchmark, outperforming the second place tool (MN-BaB [20] with multi-neuron relaxations) with 19 verified instances by a large margin.
More results on VNN-COMP 2022 can be found in these slides 1 .
Results on SDP-FO benchmarks.
We further evaluate our method on the SDP-FO benchmarks in [15, 57].
This benchmark contains 7 mostly adversarially trained MNIST and CIFAR models with 200 instances each, which are hard for many existing verifiers.
Beyond the baselines reported in [57], we also include two additional baselines, α -CROWN+MIP (same as in Table 1) and MN-BaB [20] (same as in Table 2).
Table 3 shows that our method improves the percentage of verified images (“verified accuracy”) on all models compared to state-of-the-art verifiers, further closing the gap between verified accuracy and empirical robust accuracy obtained by PGD attack (reported as “upper bound” in Table 3).
Related Work
Cutting plane method is a classic technique to strengthen the convex relaxation of an integer programming problem.
Generic cutting planes such as Gomory’s cut [21, 22], Chvátal–Gomory cut [12], implied bound cut [27], lift-and-project [35], reformulation-linearization techniques [46] and mixed integer rounding cuts [41, 37] can be applied to almost any LP relaxed problems, and problem specific cutting planes such as Knapsack cut [14], Flow-cover cut [42] and Clique cut [29] require specific problem structures.
Modern MIP solvers typically uses a branch-and-cut strategy, which tends to generate a large number of cuts before starting the next iteration of branching, and solve the LP relaxation of the MIP problem with cutting planes with an exact method such as the Simplex method.
Our GCP-CROWN is a specialized solver for the NN verification problem, which can quickly obtain a lower bound of the LP relaxation with cutting planes specially for the NN verification problem.
The verification of piece-wise linear NNs can be formulated as a MIP problem, so early works [30, 31, 53] solve an integer or combinatorial formulation directly.
For efficiency reasons, most recent works use a convex relaxation such as linear relaxation [19, 58] or semidefinite relaxation [44, 15].
Salman et al.
[45] discussed the limitation of many convex relaxation based NN verification algorithms and coined the term “convex relaxation barrier”, specifically for the popular single-neuron “Planet” relaxation [19].
Several works developed novel techniques to break this barrier.
[47] added constraints that depends on the aggregation of multiple neurons, and these constraints were passed to a LP solver.
[40] enhanced the multi-neuron formulation of [47] to obtain tighter relaxations.
[1] studied stronger convex relaxations for a ReLU neuron after an affine layer, and [52] constructed efficient algorithms based on this relaxation for incomplete verification.
[16] extended the formulation in [1] to a dual form and combined it with branch and bound to achieve completeness.
[7] proposed specialized cuts by considering neuron dependencies and solve them using a MIP solver.
[20] combined the multi-neuron relaxation [40] with branch and bound.
Although these works can be seen as a special form of cutting planes, they mostly focused on enhancing the relaxation for several neurons within a single layer or two adjacent layers.
GCP-CROWN can efficiently handle general cutting plane constraints with neurons from any layers in a bound propagation manner, and the cutting planes we find from a MIP solver can be seen as tighter convex relaxations encoding multi-neuron and multi-layer correlations.
Conclusion
In this paper, we propose GCP-CROWN, an efficient and GPU-accelerated bound propagation method for NN verification capable of handling any cutting plane constraints.
We combine GCP-CROWN with branch and bound and high quality cutting planes generated by a MIP solver to tighten the convex relaxation for NN verification.
The combination of fast bound propagation and strong cutting planes lead to state-of-the-art verification performance on multiple benchmarks.
Our work opens up a great opportunity for studying more efficient and powerful cutting planes for NN verification.
Limitations of this work Our work generalizes existing bound propagation methods that can handle only simple constraints (such as neuron split constraints in β -CROWN [57]) to general constraints, and we share a few common limitations as in previous works [10, 60, 16]: the branch-and-bound procces and bound propagation procedure are developed on ReLU networks, and it can be non-trivial to extend it to neural networks with non-piecewise-linear operations.
In addition, we currently directly use cutting planes generated by a generic MIP solver, and there might exist stronger and faster cutting plane methods that can exploit the structure of the neural network verification problem.
We hope these limitations can be addressed in future works.
Potential Negative Societal Impact
Our work focuses on formally proving desired properties of a neural network under investigation such as safety and robustness, which is an important direction of trustworthy machine learning and has overall positive societal impact.
Since our verifier is a complete verifier, it might be possible to use it to find weakness of a neural network and guide adversarial attacks.
However, we believe that formally characterizing a model’s behavior and potenti al weakness is important for building robust models and preventing real-world malicious attack.
Funding Disclosure This work is partially supported by the NSF grant No.1910100, NSF CNS
No.2046726, NSF IIS No.2008173, NSF IIS No.2048280 and the Alfred P. Sloan Foundation.
Huan Zhang is supported by a grant from the Bosch Center for Artificial Intelligence.
Suman Jana acknowledges the NSF CAREER award.
Checklist
For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes] (c) Did you discuss any potential negative societal impacts of your work?
[Yes] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2. If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results? [Yes] (b) Did you include complete proofs of all theoretical results? [Yes] 3.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[Yes] (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[N/A] Not applicable, our verification results typically do not change after running multi times.
(d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] 4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] (b) Did you mention the license of the assets?
[Yes] (c) Did you include any new assets either in the supplemental material or as a URL?
[Yes] (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
[N/A] We use only public data.
(e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
[N/A] We use only public data.
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]
Appendix
In Section A we derive the bound propagation procedure of GCP-CROWN and give a proof for
Theorem 3.1 (GCP-CROWN bound propagation).
In Section B we give additional background on branch and bound.
In section C we give more details of experiments, more results as well as a case study for cutting planes used in GCP-CROWN with MIP cuts.
A The dual problem with cutting planes
In this section we derive the dual formulation for neural network verification problem with general cutting planes (or arbitrarily added linear constraints across any layers).
Our derivation is based on the linearly relaxed MIP formulation with original binary variables z intact, to allow us to add cuts also to the integer variable (the mostly commonly used triangle relaxation does not have z ).
We first write the full LP relaxation with arbitrary cutting planes, as well as their corresponding dual variables:
[Equation] [Equation]
[Equation] [Equation] [Equation]
[Equation]
The Lagrangian function can be constructed as:
[Equation]
Here µ [Equation] τ , γ , π are shorthands for all dual variables in each layer and each neuron.
Note that for some constraints, their dual variables are not created because they are trivial to handle in the step steps.
Rearrange the equation and swap the min and max (strong duality) gives us:
[Equation]
Here W ( i +1) : ,j denotes the j -th column of W ( i +1) .
Note that for the term involving j ∈
I +( i ) we have replaced ˆ x ( i ) with x ( i ) to obtain the above equation.
For the the term x ( i ) j , j ∈ I +( i ) it is always 0 so does not appear.
Solving the inner minimization gives us the dual formulation:
[Equation] [Equation]
i
[Equation] [Equation]
∈
[Equation] [Equation]
[Equation]
The ∥·∥ 1 comes from minimizing over x 0 with the constraint x 0 − ϵ ≤ x ≤ x 0 + ϵ , and the ReLU( · ) term comes from minimizing over z ( i ) j with the constraint
≤ z ( i ) j ≤ 1 .
Before we give the bound propagation procedure, we first give a technical lemma:
Lemma A.1.
Given u ≥ 0 , l ≤ 0 , π ≥ 0 , γ ≥ 0 , and π + γ = C , and define the function:
[Equation]
Then
[Equation]
where the optimal values for π and γ are:
[Equation]
Proof.
Case 1: when uγ + lπ + q ≥ 0 , the objective becomes:
[Equation]
Since q is a constant and the object only involves a non-negative variable γ with non-positive coefficient − u , γ needs to be as smaller as possible as long as the constraint is satisfied.
Substitute π = C − γ into the constraint uγ + lπ + q ≥
[Equation]
Considering γ is within [0 , C ] , the optimal γ and π are:
[Equation]
Case 2: when uγ + lπ + q ≤ 0 , the objective becomes:
[Equation]
Since q is a constant and the object only involves a non-negative variable π with non-positive coefficient l , π needs to be as smaller as possible as long as the constraint is satisfied.
Substitute γ = C − π into the constraint uγ + lπ + q ≤ 0 ,
[Equation]
The optimal π ∗ and γ ∗ are the same as in case 1.
The optimal objective can be obtained by substitute π ∗ and γ ∗ into g ( π, γ ) .
The objective depends on q because when q is too large ( q ≥ − lC ) or too small ( q ≤ − uC ) , π ∗ and γ ∗ are fixed at either 0 or C .
With this lemma, we are now ready to prove Theorem 3.1, the bound propagation rule with general cutting planes (GCP-CROWN):
Theorem 3.1 (Bound propagation with general cutting planes) .
Given the following bound propagation rule on ν with optimizable parameter 0 ≤ α ( i ) j ≤ 1 and β ≥ 0 : ν
[Equation]
ν
[Equation]
j
[Equation]
i
[Equation] [Equation]
] ν ( i
[Equation]
H
[Equation]
i
[Equation]
j
[Equation]
i
[Equation]
i
[Equation]
1] ˆ ν ( i
[Equation]
ν ( i +1)
⊤ W
( i +1) :
[Equation]
j
[Equation]
i
[Equation]
j ∈
[Equation]
i
[Equation]
i ∈
[ L [Equation] 1] ν ( i
[Equation]
max
[Equation]
min
[Equation]
u
[Equation]
i
[Equation]
−
[Equation]
i
[Equation]
j
[Equation] [Equation]
ν [Equation] i ) j ] +
[Equation]
[Equation] − α ( i ) j
[Equation]
ν ( i ) j ] − − β [Equation] H ( i ) : ,j j ∈ I ( i
[Equation]
, i ∈
[ L − 1]
Then f ∗ LP-cut is lower bounded by the following objective with any valid 0 ≤ α ≤ 1 and β ≥ 0 :
[Equation]
where h ( i ) j
( β ) is defined as:
[Equation]
Proof.
Given (22), for j ∈ I ( i ) , observing that the upper and lower bounds of ReLU relaxations for a single neuron cannot be tight simultaneously [58], π ( i ) j + γ ( i ) j and µ ( i ) j
+ τ ( i ) j cannot be both non-zero 2 .
Thus, we have
[Equation] [Equation]
To avoid clutter, we define ˆ ν ( i ) j :=
ν ( i +1)
⊤ W
( i +1) : ,j − β ⊤ G ( i ) : ,j , and we define [ · ] + := max(0 , · ) and [ · ] − := min(0 , · ) .
To derived the proposed bound propagation rule, in (17), we must eliminate variable γ ( i ) j and π ( i ) j .
Ignoring terms related to ν , we observe that we can optimize the term π ( i ) j l ( i ) j − ReLU( u ( i ) j γ ( i )
j + l ( i )
j π ( i ) j − β ⊤ Q
( i ) : ,j ) for each j for I ( i ) individually.
We seek the optimal solution for the follow optimization problem on function h :
[Equation]
Note that we optimize over π ( i ) j and γ ( i ) j here and treat β as a constant.
Applying Lemma A.1 with π = π
( i ) j , γ = γ ( i ) j , u = u
( i ) j , l = l ( i ) j , q = − β ⊤ Q
( i ) : ,j , C =
[ˆ ν ( i ) j ]
+ we obtain the optimal objective for (25):
[Equation]
j ] + if
[Equation]
if β ⊤ Q ( i
[Equation]
l ( i
[Equation]
j [
[Equation]
ν
[Equation]
u
[Equation]
u
[Equation]
i
[Equation]
C
[Equation]
(cid:33) Substitute this solution of π ( i ) j into (21), and also observe that due to (24), τ ( i ) j is a variable between 0 and (cid:104)
ˆ ν
( i ) j (cid:105) − , so we can rewrite (21) as:
[Equation]
=
= or
This situation may happen when u ( to
All subproblems verified!
B r an c h and
B ound i m p r
o
v e s t he l o w e r bound
Lower bound = -3.
Bounds can be computed by bound propagation methods
Lower bound = min (-2.0, 0.5) = -2.
Lower bound = min (-1.0, -0.5)
=
Lower bound = -0.
Lower bound = 0.
B ound
B ranch B ranch
B ound
B ranch B ranch
B ound
B ound 𝑥 3 ≥𝑥 3 ≤𝑥 4 ≥𝑥 7 ≥ 𝑥 6 ≥ 𝑥 4 ≤𝑥 7 ≤ 𝑥 7 ≥ 𝑥 7 ≤ 𝑥 6 ≤ 𝑥 𝑖 unstable neuron 𝑥 2 𝑥𝑥𝑥𝑥 5 𝑥𝑥𝑥𝑥always active always inactive
Here 0 ≤ α ( i ) j ≤ 1 is an optimizable parameter that can be updated via its gradient during bound propagation, and any 0 ≤ α ( i )
j ≤ 1 produces valid lower bounds.
All above substitutions replace each dual variable π , γ and µ to a valid setting in the dual formulation, so the final objective g ( α , β ) is always a sound lower bound of f ∗ LP-cut .
This theorem establishes the soundness of GCP-CROWN.
Note that an optimal setting of α and β do not necessarily lead to the optimal primal value f ∗ LP-cut .
The main reason is that (25) gives a closed-form solution for π and γ to eliminate these variables without considering other dual variables like ν to simplify the bound propagation process.
To achieve theoretical optimality, π and γ can also be optimized.
B More technical details and background of GCP-CROWN with MIP cuts
Branch-and-bound Our work is based on branch-and-bound (BaB), a powerful framework for neural network verification [10] which many state-of-the-art verifiers are based on [57, 16, 26, 20].
Here we give a brief introduction for the concept of branch-and-bound for readers who are not familiar with this field.
We illustrate the branch-and-bound process in Figure 3.
Neural network verification seeks to minimize the objective (1): f ∗ = min x f ( x ) , ∀ x ∈ C , where f ( x ) is a ReLU network under our setting.
A positive f ∗ indicates that the network can be verified.
However, since ReLU neurons are non-linear, this optimization problem is non-convex, and it usually requires us to relax ReLU neurons with linear constraints (e.g., the LP relaxation in (11)) to obtain a lower bound for objective f ∗ .
This lower bound ( − 3 .
at the root node in Figure 3) might become negative, even if f ∗ (the unknown ground-truth) is positive.
Branch-and-bound is a systematic method to tighten this lower bound.
First, we split an unstable ReLU neuron, such as x 3 , into two cases: x 3 ≥ 0 and x 3 ≤ 0 (the branching step ), producing two subproblems each with an additional constraint x 3 ≥ 0 or x 3 ≤ 0 .
In each subproblem, neuron x 3 does not need to be relaxed anymore, so the lower bound of f ∗ becomes tighter in each of the two subdomains in the subsequent bounding step ( − 3 . 0 becomes − 2 . 0 and 0 . 5 ) in Figure 3.
Any subproblem with a positive lower bound is successfully verified and no further split is needed.
Then, we repeat the branching and bounding steps on subproblems that still have a negative lower bound.
We terminate when all unstable neurons are split or all subproblems are verified.
In Figure 3, all leaf subproblems have positive lower bounds so the network is verified.
On the other hand, if we have split all unstable neurons and there still exist domains with negative bounds, a counter-example can be constructed.
The contribution of this work is to improve the bounding step using cutting planes.
As one can observe in Figure 3, if we can make the bounds tighter, they approach to zero faster and less branching is needed.
Since the number of the subproblems may be exponential to the number of unstable neurons in the worst case, it is crucial to improve the bounds quickly.
Informally, cutting planes are additional valid constraints for the relaxed subproblems, and adding these additional constraints as in (16) makes the lower bounds tighter.
We refer the readers to integer programming literature [5, 13] for more details on cutting plane methods.
Existing neural network verifiers mostly use bound propagation method [61, 50, 60, 57, 16] for the bounding step thanks to their efficiency and scalability, but none of them can handle general cutting planes.
Our GCP-CROWN is the first bound propagation method that supports general cutting planes, and we demonstrated its effectiveness in Section 4 when combined with cutting planes generated by a MIP solver.
Soundness and Completeness GCP-CROWN is sound because Theorem 3.1 guarantees that we always obtain a sound lower bound of the verification problem as long as valid cutting planes (generated by a MIP solver in our case) are added.
Our method, when combined with branch-andbound, is also complete because we provide a strict improvement in the bounding step over existing methods such as [57], and the arguments for completeness in existing verifiers using branch-andbound on splitting ReLU neurons such as [9, 57] are still valid for this work.
C More details on experiments C.1 Experimental Setup
Our experiments are conducted on a desktop with an AMD Ryzen 9 5950X CPU, one NVIDIA RTX 3090 GPU (24GB GPU memory), and 64GB CPU memory.
Our implementation is based on the open-source α,β -CROWN verifier 3 with cutting plane related code added.
Both α -CROWN+MIP and
GCP-CROWN with MIP cuts use all 16 CPU cores and 1 GPU.
gurobi is used as the MIP solver in α -CROWN+MIP.
Although gurobi usually outperforms other MIP solvers for NN verification problems, it cannot export cutting planes, so our cutting planes are acquired by the cplex [28] solver (version 22.1.0.0).
We use the Adam optimizer [32] to solve both α and β with 20 iterations.
The learning rates are set as 0.1 and 0.02 (0.01 for oval20 ) for optimizing α and β respectively.
We decay the learning rates with a factor of 0.9 (0.8 for oval20 ) per iteration.
Timeout for properties in oval20 are set as 1 hour follow the original benchmark.
Timeout for oval21 and cifar10-resnet are set as 720s and 300s respectively, the same as in VNN-COMP 2021.
Timeout for SDP-FO models are set as 600s for α -CROWN+MIP and MN-BaB, and a shorter 200s timeout is used for
GCP-CROWN with MIP cuts.
We summarize the model structures and batch size used in our experiments in Table 4.
The CIFARBase, Wide and Deep models are used in oval20 and oval21 benchmarks.
[Table]
C.2 A case study on cutting planes
The effectiveness of GCP-CROWN with MIP cuts motivates us to take a more careful look at the cutting planes generated by off-the-shelf MIP solvers
[Table]
and understand how well it can contribute to
[Table]
tighten the lower bounds and strengthen verification performance.
We use the oval21 as a sample case study because GCP-CROWN with MIP cuts is very effective on this benchmark.
The oval21 benchmark has 30 instances, each with 9 target labels (properties) to verify.
Among the total of 270 properties, we filter out the easy cases where fast incomplete verifiers like α -CROWN can verify directly, and 39 hard properties remain which must be solved using branch and bound and/or cutting planes.
Cutting planes are generated on these hard properties and they greatly help
GCP-CROWN.
Number of cuts used to verify each property.
The maximal number of cuts applied per property is 4,162 and the minimal number is 318.
On average, we have 1,683 cuts applied to our GCP-CROWN to solve these hard properties.
Improvements on lower bounds.
In branch-and-bound, we lower bound the objective of Eq.with ReLU split constraints [57].
A tighter lower bound can reduce the number of branches used and usually leads to stronger verification.
We measure how well the cuts generated by off-the-shelf solvers in improving the tightness of the lower bound for verification.
Without branching and cutting planes, the average α -CROWN lower bound is -2.54.
With generated cutting planes, we can improve the lower bound by 0.51 on average and can directly verify 4 out of 39 hard properties without branching.
The lower bound without branching can be maximally improved by 1.54 and minimally improved by 0.04.
Structure of Generated Cuts.
Finally, we investigate the variables involved in each generated cutting plane.
In total, the MIP solver generates 65,647 cutting planes in total for the 39 hard properties.
65,301 of the cuts involve variables across multiple layers.
It indicates that single layer cutting planes (e.g., constraints involving pre- and post-activation variables of a single ReLU layer only) commonly used in previous works [47, 40] are not optimal in general.
Additionally, all of 65,647 cuts have at least one ReLU integer variable z ( i ) used, which was not supported in existing bound propagation methods.
65,197 of all cuts involve at least one variable of input neurons.
23, of all cuts have at least one pre-ReLU variables and 51,617 of them have at least one post-ReLU variables.