C OMPLETE V ERIFICATION VIA M ULTI -N EURON R ELAXATION G UIDED B RANCH - AND -B OUND
A BSTRACT
State-of-the-art neural network veriﬁers are fundamentally based on one of two paradigms: either encoding the whole veriﬁcation problem via tight multi-neuron convex relaxations or applying a Branch-and-Bound (BaB) procedure leveraging imprecise but fast bounding methods on a large number of easier subproblems.
The former can capture complex multi-neuron dependencies but sacriﬁces completeness due to the inherent limitations of convex relaxations.
The latter enables complete veriﬁcation but becomes increasingly ineffective on larger and more challenging networks.
In this work, we present a novel complete veriﬁer which combines the strengths of both paradigms: it leverages multi-neuron relaxations to drastically reduce the number of subproblems generated during the BaB process and an efﬁcient GPU-based dual optimizer to solve the remaining ones.
An extensive evaluation demonstrates that our veriﬁer achieves a new stateof-the-art on both established benchmarks as well as networks with signiﬁcantly higher accuracy than previously considered.
The latter result (up to 28% certiﬁcation gains) indicates meaningful progress towards creating veriﬁers that can handle practically relevant networks.
I NTRODUCTION
Recent years have witnessed substantial interest in methods for certifying properties of neural networks, ranging from stochastic approaches (Cohen et al., 2019) which construct a robust model from an underlying base classiﬁer to deterministic ones (Gehr et al., 2018; Katz et al., 2017; Xu et al., 2020) that analyze a given network as is (the focus of our work).
Key Challenge: Scalable and Precise Non-Linearity Handling Deterministic veriﬁcation methods can be categorized as complete or incomplete.
Recent incomplete veriﬁcation methods based on propagating and reﬁning a single convex region (Müller et al., 2022; Dathathri et al., 2020; Tjandraatmadja et al., 2020) are limited in precision due to fundamental constraints imposed by convex relaxations.
Traditional complete veriﬁcation approaches based on SMT solvers (Ehlers, 2017) or a single mixed-integer linear programming encoding of a property (Tjeng et al., 2019; Katz et al., 2017) suffer from worst-case exponential complexity and are often unable to compute sound bounds in reasonable time-frames.
To address this issue, a Branch-and-Bound approach (Bunel et al., 2020) has been popularized recently: anytime-valid bounds are computed by recursively splitting the problem domain into easier subproblems and deriving bounds on each of these via cheap and less precise methods (Xu et al., 2021; Wang et al., 2021; Palma et al., 2021; Henriksen & Lomuscio, 2021).
This approach has proven effective on (smaller) networks where there are relatively few unstable activations and splitting a problem simpliﬁes it substantially.
However, for larger networks or those not regularized to be amenable to certiﬁcation this strategy becomes increasingly ineffective as the larger number of unstable activations makes individual splits less effective, which is exacerbated by the relatively loose underlying bounding methods.
This Work: Branch-and-Bound guided by Multi-Neuron Constraints In this work, we propose a novel certiﬁcation method and veriﬁer, called M ulti- N euron Constraint Guided BaB (MN-B A B), which aims to combine the best of both worlds: it leverages the tight multi-neuron constraints proposed by Müller et al.
within a BaB framework to yield an efﬁcient GPU-based dual method.
The key insight is that the signiﬁcantly increased precision of the underlying bounding method substantially reduces the number of domain splits (carrying exponential cost) required to certify a property.
This improvement is especially pronounced for larger and less regularized networks where additional splits of the problem domain yield diminishing returns.
We release all code and scripts to reproduce our experiments at https://github.com/eth-sri/mn-bab .
Main Contributions :
• We present a novel veriﬁcation framework, MN-B A B, which leverages tight multi-neuron constraints and a GPU-based dual solver in a BaB approach.
• We develop a novel branching heuristic, ACS, based on information obtained from analyzing our multi-neuron constraints.
• We propose a new class of branching heuristics, CAB, applicable to all BaB-based veriﬁers, that correct the expected bound improvement of a branching decision for the incurred computational cost.
• Our extensive empirical evaluation demonstrates that we improve on the state of the art in terms of certiﬁed accuracy by as much as 28% on challenging networks.
B ACKGROUND
In this section, we review the necessary background for our method (discussed next).
2. N EURAL N ETWORK V ERIFICATION
The neural network veriﬁcation problem can be deﬁned as follows: given a network f : X → Y , an input region D ⊆ X , and a linear property P ⊆
Y over the output neurons y ∈ Y , prove f ( x ) ∈ P , ∀ x ∈ D .
We instantiate this problem with the challenging (cid:96) ∞ -norm bounded perturbations and set
D to the (cid:96) ∞ ball around an input point x 0 of radius (cid:15) : D (cid:15) ( x 0 ) = { x ∈ X | || x − x 0 || ∞ ≤ (cid:15) } .
For ease of presentation, we consider neural networks of L fully-connected layers with ReLU activation functions (we note that MN-B A B can handle a wide range of layers including convolutional, residual, batch-normalization, and average-pooling layers).
We focus on ReLU networks as the BaB framework only yields complete veriﬁers for piecewise linear activation functions but remark that our approach is applicable to a wide class of activations including ReLU, Sigmoid, Tanh, MaxPool, and others.
We denote the number of neurons in the i th layer as d i and the corresponding weights and biases as W ( i ) ∈
R d i × d i − 1 and b ( i
) ∈
R d i for i ∈ { 1 , ..., L } .
Further, the neural network is deﬁned as f ( x ) :
=
ˆ z ( L ) ( x ) where ˆ z ( i ) ( x ) :
= W ( i ) z
( i − 1) ( x ) + b ( i ) and z ( i ) ( x ) :
= max(0 , ˆ z ( i ) ( x )) .
For readability, we omit the dependency of intermediate activations on x .
Since we can encode any linear property over output neurons into an additional afﬁne layer, we can simplify the general formulation f ( x ) ∈ P to f ( x ) > 0 .
The property can now be veriﬁed by proving that a lower bound to the following optimization problem is greater 0 :
[Equation]
A method is called sound if every property it proves actually holds (no false positives).
A method is called complete if it can prove every property that actually holds (no false negatives).
2. B RANCH - AND -B OUND FOR V ERIFICATION
Bunel et al.
(2020) successfully applied the Branch-and-Bound (BaB) approach (lan, 1960) to neural network veriﬁcation.
It consists of a bounding method that computes sound upper and lower bounds on the optimization objective of Eq.
(1) and a branching method that recursively splits the problem into subproblems with added constraints, allowing for increasingly tighter bounds.
If an upper bound (primal solution) < 0 is found, this represents a counterexample and allows to terminate the procedure.
If a lower bound > 0 is obtained, the property is veriﬁed on the corresponding (sub-)domain.
If a lower bound > 0 is derived on all subdomains, the property is veriﬁed.
An ideal splitting procedure minimizes the total time required for bounding, which is often well approximated by the number of considered subproblems.
A simple approach is to split the input domain, however, this is inefﬁcient for high-dimensional input spaces.
Splitting a ReLU activation node into its positive and negative phases has been shown to be far more efﬁcient (Bunel et al., 2020) and ultimately yields a complete veriﬁer (Wang et al., 2021).
Hence, we focus solely on ReLU branching strategies.
2. L INEAR C ONSTRAINTS
[Figure]
bounds
The key challenge in neural network veriﬁcation Eq.
(1) is handling the non-linear activations.
Stable ReLUs, i.e., those which we can show to be always active ( ˆ z ≥ 0 ) or inactive ( ˆ z ≤ 0 ), can be replaced by linear functions.
Unstable ReLUs, i.e., those that can be either active or inactive depending on the exact x ∈ D , have to be approximated using a convex relaxation of their input-output set.
We build on the convex relaxation introduced in D EEP P OLY (Singh et al., 2019b) and shown in Fig.
Its key property is the single linear upper and lower bound, which allows for efﬁcient bound computation.
2. M ULTI -N EURON C ONSTRAINTS
[Figure]
neuron constraints projected into y 2 - x 1 - x 2 -space.
Reproduced from Müller et al.
All convex relaxations that consider ReLU neurons individually are fundamentally limited in their precision by the so-called (single-neuron) convex relaxation barrier (Salman et al., 2019).
It can be overcome by considering multiple neurons jointly (Singh et al., 2019a; Tjandraatmadja et al., 2020; Müller et al., 2022; Palma et al., 2021), thereby capturing interactions between these neurons and obtaining tighter bounds, illustrated in Fig.
We leverage the multi-neuron constraints from Müller et al.
(2022), expressed as a conjunction of linear constraints over the joint input and output space of a ReLU layer.
2. C ONSTRAINED O PTIMIZATION VIA L AGRANGE M ULTIPLIERS
To express constraints as part of the optimization problem, we use the technique of Lagrange multipliers.
Given a constrained minimization problem min x f ( x ) , s.t. g ( x ) ≤ 0 , we can bound the objective function with:
[Equation]
If a constraint is satisﬁed, i.e., g ( x ) j ≤ 0 , λ j = 0 maximizes the (inner) objective, else, i.e., g ( x ) j > 0 , increasing λ j allows the objective to grow unboundedly, shifting the minimum over x until the constraint is satisﬁed.
Hence, if λ j > 0 after optimization, the constraint is active, i.e., it is actively enforced and currently satisﬁed with equality.
A M ULTI -N EURON R ELAXATION B ASED B A B F RAMEWORK
In this section, we describe the two key components of MN-B A B: (i) an efﬁcient bounding method leveraging multi-neuron constraints, as well as constrained optimization via lagrange multipliers (§3.1), and (ii) a branching method tailored to it (§3.2).
3. E FFICIENT M ULTI -N EURON B OUNDING
We build on the approach of Singh et al.
(2019b), extended by Wang et al.
(2021) of deriving a lower bound f as a function of the network inputs and a set of optimizable parameters.
Crucially, we tighten these relatively loose bounds signiﬁcantly by enforcing precise multi-neuron constraints via Lagrange multipliers.
To enable this, we develop a method capable of integrating any linear constraint over arbitrary neurons anywhere in the network into the optimization objective.
At a high level, we derive linear upper and lower bounds of the form z ( i ) ≶ − az
( i − 1)
+ c for every layer’s output in terms of its inputs z ( i − 1) .
Then, starting with a linear expression in the last layer’s outputs z ( L ) which we aim to bound, we use the linear bounds derived above, to replace z ( L ) with symbolic bounds depending only on the previous layer’s values z ( L − 1) .
We proceed in this manner recursively until we obtain an expression only in terms of the networks inputs.
Below, we describe this backsubstitution process for ReLU and afﬁne layers.
Afﬁne Layer Assume any afﬁne layer ˆ z ( i ) =
W ( i ) z
( i − 1)
+ b ( i ) and a lower bound f
=
ˆ a ( i )
ˆ z ( i ) + ˆ c ( i ) with respect to its outputs.
We then substitute the afﬁne expression for ˆ z ( i ) to obtain:
[Equation]
ReLU Layer Let f = a ( i ) z
( i ) +
c
( i ) be a lower bound with respect to the output of a ReLU layer
z ( i ) =
max(0 , ˆ z ( i ) ) and l ( i ) and u ( i ) bounds on its input s.t.
l ( i ) ≤ ˆ z
( i ) ≤ u ( i ) , obtained by recursively applying this bounding procedure or using a cheaper but less precise bounding method (Singh et al., 2018; Gowal et al., 2018).
The backsubstitution through a ReLU layer now consists of three distinct steps: 1) enforcing multi-neuron constraints, 2) enforcing single-neuron constraints to replace the dependence on z ( i ) by ˆ z ( i ) , and 3) enforcing split constraints, which we describe in detail below.
Enforcing Multi-Neuron Constraints We compute multi-neuron constraints as described in Müller et al.
(2022), although our approach is applicable to any linear constraints in the input-output space of ReLU activations, written as:
[Equation]
where ˆ z ( i ) are the pre- and z ( i ) the post-activation values and P ( i ) , ˆ P ( i ) , and − p ( i ) the constraint parameters.
We enforce these constraints using Lagrange multipliers (see §2.5), yielding sound lower bounds for all γ ( i ) ∈ ( R ≥ 0 )
e i , where e i denotes the number of multi-neuron constraints in layer i .
[Equation]
Note that this approach can be easily extended to linear constraints over any activations in arbitrary layers if applied in the last afﬁne layer at the very beginning of the backsubstitution process.
Enforcing Single-Neuron Constraints We now apply the single-neuron D EEP P OLY relaxation with parametrized slopes α collected in D (see below):
[Equation]
The intercept vector b and the diagonal slope matrix D are deﬁned as:
D j,j =   if l j ≥ 0 or node j is positively split if u j ≤ 0 or node j is negatively split α j if l j < 0 < u j and a j ≥
u j u j − l j if l j < 0 < u j and a j < [Equation]
if [Equation] and [Equation]
otherwise Where we drop the layer index i for readability and α j is the lower bound slope parameter illustrated in Fig.
Note how, depending on whether the sensitivity a ( i ) j of f w.r.t.
z ( i ) j has positive or negative sign, we substitute z ( i ) j for its lower or upper bound, respectively.
Enforcing Split Constraints We encode split constraints of the form ˆ z ( i ) j ≥ 0 or ˆ z ( i ) j ≤ 0 using the diagonal split matrix S as follows, again dropping the layer index i :
[Equation]
We again enforce these constraints using Lagrange multipliers:
[Equation]
Putting everything together [Equation] the backsubstitution operation through a ReLU layer is:
[Equation]
Full backsubstitution through all layers leads to an optimizable lower bound on f :
[Equation]
where the second inequality holds due to weak duality.
We denote all α ( i ) j from every layer of the backsubstitution process with α and deﬁne β and γ analogously.
The inner minimization over x has a closed form solution if D is an l p -ball of radius (cid:15) around x 0 , given by Hölder’s inequality:
[Equation]
[Equation]
where q is deﬁned s.t. 1 p + 1 q = 1 .
Since these bounds are sound for any 0 ≤ α ≤ 1 , and β , γ ≥ 0 , we tighten them by using (projected) gradient ascent to optimize these parameters.
We compute all intermediate bounds using the same bounding procedure, leading to two full parameter sets for every neuron in the network.
To reduce memory requirements, we share parameter sets between all neurons in the same layer, but keep separate sets for upper and lower bounds.
Upper Bounding the Minimum Objective Showing an upper bound on the minimum optimization objective precluding veriﬁcation
( f < 0 ) allows us to terminate the BaB process early.
Propagating any input x ∈ D through the network yields a valid upper bound, hence, we use the input that minimizes Eq.
[Equation]
3. M ULTI -N EURON C ONSTRAINT G UIDED B RANCHING
Generally, the BaB approach is based on recursively splitting an optimization problem into easier subproblems to derive increasingly tighter bounds.
However, the beneﬁt of different splits can vary widely, making an effective branching heuristic which chooses splits that minimize the total number of required subproblems a key component of any BaB framework (Bunel et al., 2020).
Typically, a score is assigned based on the expected bound improvement and the most promising split is chosen.
Consequently, the better this score captures the actual bound improvement, the better the resulting decision.
Both the commonly used B A BSR (Bunel et al., 2020) and the more recent FSB (De Palma et al., 2021) approximate improvements under a D EEP P OLY style backsubstitution procedure.
As neither considers the impact of multi-neuron constraints, the scores they compute might not be suitable proxies for the bound improvements obtained with our method.
To overcome this issue, we propose a novel branching heuristic, A ctive C onstraint S core Branching (ACS), considering multi-neuron constraints.
Further, we introduce a branching heuristic framework which corrects the expected bound improvement with the potentially signiﬁcantly varying expected computational cost.
Active Constraint Score Branching The value of a Lagrange parameter γ provides valuable information about the constraint it enforces.
Concretely, γ > 0 indicates that a constraint is active, i.e., the optimal solution fulﬁlls it with equality.
Further, for a constraint g ( x ) ≤ 0 , a larger ∂ x γg ( x ) indicates a larger sensitivity of the ﬁnal bound to violations of this constraint.
We compute this sensitivity for our multi-neuron constraints with respect to both ReLU outputs and inputs as γ (cid:62) P and γ (cid:62) ˆ P , respectively, where P and ˆ P are the multi-neuron constraint parameters.
We then deﬁne our branching score for a neuron j in layer i as the sum over all sensitivities with respect to its input or output:
[Equation]
Intuitively, splitting the node with the highest cumulative sensitivity makes its encoding exact and effectively tightens all of these high sensitivity constraints.
We can efﬁciently compute those scores without an additional backsubstitution pass.
Cost Adjusted Branching Any complete method will decide every property eventually.
Hence, its runtime is a key performance metric.
Existing branching heuristics ignore this aspect and only consider the expected improvement in bound-tightness, but not the sometimes considerable differences in computational cost.
We propose C ost A djusted B ranching (CAB), scaling the expected bound improvement (approximated with the branching score) with the inverse of the cost expected for the split, and then picking the branching decision yielding the highest expected bound improvement per cost.
The true cost of a split consists of the direct cost of the next branching step and the change of cumulative cost for all consecutive steps.
We ﬁnd a local approximation considering just the former component, similar to only considering the one-step bound improvement, to be a good proxy.
We approximate this direct cost by the number of ﬂoating-point operations required to compute the new bounds, refer to App.
B for a more detailed description.
Note that any approximation of the expected cost can be used to instantiate CAB.
Enforcing Splits Once the ReLU node to split on has been determined, two subproblems are generated.
One where a non-negative ˆ z ≥ 0 and one where non-positive ˆ z ≤ 0 pre-activation value has to be enforced.
This is accomplished by setting the corresponding entries in the split matrix S , used during the bounding process, to − 1 and 1 , respectively.
As the intermediate bounds for all layers up to and including the one that was split remain unchanged, we do not recompute them.
3. S OUNDNESS AND C OMPLETENESS
The soundness of the BaB approach follows directly from the soundness of the underlying bounding method discussed in Section 3.1.
To show completeness, it is sufﬁcient to consider the limit case where all ReLU nodes are split and the network becomes linear, making D EEP P OLY relaxations exact.
To also obtain exact bounds, all split constraints have to be enforced.
This can be done by computing optimal β for the now convex optimization problem (Wang et al., 2021).
It follows that a property holds if and only if the exact bounds thus obtained are positive on all subproblems.
We conclude that MN-B A B is a complete veriﬁer.
[Table]
E XPERIMENTAL E VALUATION
We now present an extensive evaluation of our method.
First, and perhaps surprisingly, we ﬁnd that existing MILP-based veriﬁcation tools (Singh et al., 2019c; Müller et al., 2022) are more effective in verifying robustness on many established benchmark networks than what is considered state-of-theart.
This highlights that next-generation veriﬁers should focus on and be benchmarked using less regularized and more accurate networks.
We take a step in this direction by proposing and comparing on such networks, before analyzing the effectiveness of the different components of MN-B A B in an extensive ablation study.
Experimental Setup We implement a GPU-based version of MN-B A B in PyTorch (Paszke et al., 2019) and evaluate all benchmarks using a single NVIDIA RTX 2080Ti, 64 GB of memory, and 16 CPU cores.
We attempt to falsify every property with an adversarial attack, before beginning certiﬁcation.
For every subproblem, we ﬁrst lower-bound the objective using D EEP P OLY and then compute reﬁned bounds using the method described in §3.
Benchmarks We benchmark MN-B A B on a wide range of networks (see Table 3 in App.
A) on the MNIST (Deng, 2012) and CIFAR10 datasets (Krizhevsky et al., 2009).
We also consider three new residual networks, ResNet6-A , ResNet6-B , and ResNet8-A .
ResNet6-A and ResNet6-B have the same architecture but differ in regularization strength while ResNet8-A has an additional residual block.
All three were trained with adversarial training (Madry et al., 2018) using PGD, the GAMA loss (Sriramanan et al., 2020) and MixUp data augmentation (Zhang et al., 2021).
ResNet6-A and
ResNet8-A were trained using 8 -steps and (cid:15) = 4 / 255 , whereas 20 -steps and (cid:15) = 8 / 255 were used for ResNet6-B .We compare against β -C ROWN (Wang et al., 2021), a BaB-based state-of-the-art complete veriﬁer, OVAL (Palma et al., 2021; De Palma et al., 2021; Bunel et al., 2020), a BaB framework based on a different class of multi-neuron constraints, and ERAN Singh et al. (2019c); Müller et al.
(2022) combining the incomplete veriﬁer PRIMA, whose tight multi-neuron constraints we leverage in our method, and a (partial) MILP encoding.
Comparison to State-of-the-Art Methods In Table 1, we compare the veriﬁed accuracy and runtime of MN-B A B with that of state-of-the-art tools ERAN, β -C ROWN , and OVAL .
Perhaps surprisingly, we ﬁnd that both MNIST and the smallest CIFAR10 benchmark network established over the last years (Singh et al., 2019b) can be veriﬁed completely or almost completely in less than 50 s per sample using ERAN, making them less relevant as benchmarks for new veriﬁcation tools.
On these networks, all three BaB methods (including ours) are outperformed to a similar degree, with the reservation that we could not evaluate OVAL on MNIST ConvBig due to runtime errors.
On the remaining unsolved networks where complete veriﬁcation via a MILP encoding does not scale,
MN-B A B consistently obtains the highest certiﬁed accuracy and for all but one also the lowest runtime.
On ConvSuper we were not able to ﬁnd conﬁgurations for OVAL and β -C ROWN that did not run out of memory.
Comparing the BaB methods, we observe an overall trend that more precise but also expensive underlying bounding methods are most effective on larger networks, where additional splits are less efﬁcient, and complex inter-neuron interactions can be captured by the precise multi-neuron constraints.
On these networks, the more complex interactions also lead to more active
Multi-Neuron Constraints (MNCs) and hence more informative ACS scores.
[Figure]
[Figure]
[Figure]
[Figure]
[Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure] [Table] [Figure] [Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
[Figure]
[Table]
yes 37. Ablation Study To analyze the individual components of MN-BaB, we consider the weakly and heavily regularized ResNet6-A and ResNet6-B , respectively, with identical architecture.
Concretely, we show the effect different bounding procedures and branching approaches have in the two settings in Table 2.
As veriﬁed accuracy and mean runtime are very coarse performance metrics, we also analyze the ratio of runtimes and number of subproblems required for veriﬁcation on a per-property level, ﬁltering out those where both methods verify before any branching occurred (Figs. 3–5).
Overall, we observe that the number of visited subproblems required for certiﬁcation can be reduced by two to three orders of magnitude by leveraging precise multineuron constraints and then again by another one to two orders of magnitude by our novel branching heuristic, ACS.
Our cost-adjusted branching yields an additional speed up of around 50% .
[Figure]
The trend of MN-B A B succeeding on more challenging networks is conﬁrmed here.
Leveraging MNCs enables us to verify 20 % more samples while being around 22 % faster (see Table 2) on ResNet6-A while on the more heavily regularized ResNet6-B we only verify 6 % more samples.
When analyzing on a per-property level, shown in Fig.
6, the trend is even more pronounced.
For easy problems, leveraging MNCs and ACS has little impact (points in the lower left-hand corner). However, it completely dominates on the harder properties where only using single-neuron constraints and B A BSR takes up to 33 times longer
Effectiveness of Multi-Neuron Constraints In Fig.
3, we show the ratio between the number of subproblems required to prove the same lower bound on the ﬁnal objective (either 0 , if both methods certify, or the smaller of the two lower bounds at termination) with and without MNCs over the quantile of properties for ResNet6-A (blue) and ResNet6-B (orange).
We observe that using MNCs reduces the number of subproblems for both networks by between two and three orders of magnitude.
Despite the higher per bounding-step cost, this leads to the use of MNCs increasing the number of veriﬁed samples by up to 12% while reducing average certiﬁcation times (see Table 2).
Effectiveness of ACS Branching In Fig.
4, we show the ratio between the number of subproblems considered when using B A BSR vs. ACS over the quantile of properties.
We observe that
ACS yields signiﬁcantly fewer subproblems on most ( 75% ) or all properties on ResNet6-A and
ResNet6-B , respectively, leading to an additional reduction by between one and two orders of magnitude and showing the effectiveness of our novel ACS branching heuristic.
Average veriﬁcation times are reduced by 12% and 21% on ResNet6-A and ResNet6-B , respectively.
Note that the relatively small improvements in timings are due to timeouts for both methods yielding equally high runtimes which dominate the mean.
FSB is consistently outperformed by ACS, certifying 12 % less samples on ResNet6-A .
Effectiveness of Cost Adjusted Branching In Fig.
5, we show the per property veriﬁcation times with ACS + CAB over those with ACS.
Using CAB is faster (points below the dashed line) for all properties, sometimes signiﬁcantly so, leading to an average speedup of around 50% .
Analyzing the results in Table 2, we observe that CAB is particularly effective in combination with the ACS scores and multi-neuron constraints, where bounding costs vary more signiﬁcantly.
R ELATED W ORK
Neural Network Veriﬁcation Beyond the Single Neuron Convex Barrier After the so-called (Single Neuron) Convex Barrier has been described by Salman et al.
for incomplete relaxation-based methods, a range of approaches has been proposed that consider multiple neurons jointly to obtain tighter relaxations.
Singh et al.
(2019a)
and Müller et al.
(2022) derive joint constraints over the input-output space of groups of neurons and reﬁne their relaxation using the intersection of these constraints.
Tjandraatmadja et al.
(2020) merge the ReLU and preceding afﬁne layer to consider multiple inputs but only one output at a time.
While the two approaches are theoretically incomparable, the former yields empirically better results (Müller et al., 2022).
Early complete veriﬁcation methods relied on off-the-shelf SMT (Katz et al., 2017; Ehlers, 2017) or MILP solvers (Dutta et al., 2018; Tjeng et al., 2019).
However, these methods do not scale beyond small networks.
In order to overcome these limitations, Bunel et al.
(2020) formulated a
BaB style framework for complete veriﬁcation and showed it contains many previous methods as special cases.
The basic idea is to recursively split the veriﬁcation problem into easier subproblems on which cheap incomplete methods can show robustness.
Since then, a range of partially (Xu et al., 2021) or fully (Wang et al., 2021; Palma et al., 2021) GPU-based BaB frameworks have been proposed.
The most closely related, Palma et al.
(2021), leverages the multi-neuron constraints from
Tjandraatmadja et al.
but yields an optimization problem of different structure, as constraints only ever include single output neurons.
Branching Most ReLU branching methods proposed to date use the bound improvement of the two child subproblems as the metric to decide which node to branch on next.
Full strong branching (Applegate et al., 1995) exhaustively evaluates this for all possible branching decisions.
However, this is intractable for all but the smallest networks.
Lu & Kumar (2020) train a GNN to imitate the behavior of full strong branching at a fraction of the cost, but transferability remains an open question and collecting training data to imitate is costly.
Bunel et al.
(2020) proposed an efﬁciently computable heuristic score, locally approximating the bound improvement of a branching decision using the method of Wong & Kolter (2018).
Henriksen & Lomuscio (2021) reﬁne this approach by additionally approximating the indirect effect of the branching decision, however, this requires using two different bounding procedures.
De Palma et al.
introduced ﬁltered-smart-branching (FSB), using BaBSR to select branching candidates and then computing a more accurate heuristic score only for the selected candidates.
Instead of targeting the largest bound improvement, Kouvaros & Lomuscio (2021) aim to minimize the number of unstable neurons by splitting the ReLU node with the most other ReLU nodes depending on it.
C ONCLUSION
We propose the complete neural network veriﬁer MN-B A B. Building on the Branch-and-Bound methodology, MN-B A B leverages tight multi
-neuron constraints, a novel branching heuristic and an efﬁcient dual solver, able to utilize massively parallel hardware accelerators, to enable the veriﬁcation of particularly challenging networks.
Our thorough empirical evaluation shows how MN-B A B is particularly effective in verifying challenging networks with high natural accuracy and practical relevance, reaching a new state-of-the-art in several settings.
E THICS S TATEMENT
Most machine learning based systems can be both employed with ethical as well as malicious purposes.
Methods such as ours that enable the certiﬁcation of robustness properties of neural networks are a step towards more safe and trustworthy AI systems and can hence amplify any such usage.
Further, malicious actors might aim to convince regulators that the proposed approach is sufﬁcient to show robustness to perturbations encountered during real world application, which could lead to insufﬁcient regulation in safety critical domains.
R EPRODUCIBILITY S TATEMENT
We will make all code and trained networks required to reproduce our experiments available during the review process as supplementary material and provide instructions on how to run them.
Upon publication, we will also release them publicly.
We explain the basic experimental setup in Sectionand provide more details in Section A.
All datasets used in the experiments are publicly available.
Random seeds are ﬁxed where possible and provided in the supplementary material.
A E XPERIMENT D ETAILS
In Table 3 we show the per-sample timeout and the batch sizes that were used in the experiments.
The timeouts for the ﬁrst 4 networks were chosen to approximately match the average runtimes reported by Wang et al.
[Table] to facilitate comparability.
Since we keep intermediate bounds of neurons before the split layer ﬁxed, as described in Section 3.
[Table]
the memory requirements for splitting at different layers can vary.
We exploit this fact and choose batch sizes for our bounding procedure depending on the layer where the split occurred
[Table]
In order to falsify properties more quickly
[Table]
we run a strong adversarial attack with the following parameters before attempting certiﬁcation: We apply two targeted versions (towards all classes) of
PGD (Madry et al., 2018) using margin loss (Gowal et al., 2018) and GAMA loss (Sriramanan et al., 2020), both with 5 restarts, 50 steps, and 10 step output diversiﬁcation ( ? )
[Table]
A. A RCHITECTURES
In this section
[Table]
we provide an overview of all the architectures evaluated in Section 4.
The architectures of the convolutional networks for MNIST and CIFAR10 are detailed in Table 4.
The architectures of both ResNet6-A and ResNet6-B are given in Table
[Table]
B S PLIT -C OST C OMPUTATION FOR CAB
Recall that for CAB
[Table]
we normalize the branching score obtained with an arbitrary branching heuristic with the (approximate) cost of the corresponding split.
The true cost of a split consists of the direct cost of the next branching step and the change of cumulative cost for all consecutive steps.
As a local approximation, we just consider the former component.
We approximate this direct cost by the number of ﬂoating-point operations required to compute the new bounds.
This is computed as the sum of ﬂoating-point operations required for bounding all intermediate bounds that are recomputed.
Our bounding approach only enforces constraints
[Table]
on neurons preceding the neurons included in the bounding objective.
Hence, we only recompute intermediate bounds for layers after the layer where the split occurs, as discussed in §3.2.
To compute the cost of recomputing the lower (or upper) bound of one intermediate node, we add up all ﬂoating point operations needed to perform the backsubstitution described in §3.1.
As backsubstitution is just a series of matrix multiplications, the number of required ﬂoating point operations can be deduced from the sizes of the multiplied matrices.
Thus if we split on layer k of an L layer network and the cost of backsubstituion from layer i is C i and the number of nodes is d i , the ﬁnal cost of the split is:
[Equation]
Where the factor 2 comes from the fact that for intermediate bounds we need to recompute both lower and upper bounds.
The cost C i of a full backsubstitution from layer i can be computed as the sum over the cost of backsubstituting through all preceding layers C i
=
(cid:80) i − 1 j =
c j , where the cost for a single layer can be computed as follows:
• ReLU layer:
c j = d j + p j , where p j is the number of multi-neuron constraints.
• Linear layer:
c j = # W j , where # W j is the number of elements in the weight matrix.
• Conv layer:
c j = d j k 2 j , where k j is the kernel size.