A Primer on Multi-Neuron Relaxation-based Adversarial Robustness Certiﬁcation
Abstract
The existence of adversarial examples poses a real danger when deep neural networks are deployed in the real world.
The go-to strategy to quantify this vulnerability is to evaluate the model against speciﬁc attack algorithms.
This approach is however inherently limited, as it says little about the robustness of the model against more powerful attacks not included in the evaluation.
We develop a uniﬁed mathematical framework to describe relaxation-based robustness certiﬁcation methods, which go beyond adversary-speciﬁc robustness evaluation and instead provide provable robustness guarantees against attacks by any adversary.
We discuss the fundamental limitations posed by single-neuron relaxations and show how the recent “k-ReLU” multi-neuron relaxation framework of (Singh et al., 2019a) obtains tighter correlation-aware activation bounds by leveraging additional relational constraints among groups of neurons.
Speciﬁcally, we show how additional pre-activation bounds can be mapped to corresponding post-activation bounds and how they can in turn be used to obtain tighter robustness certiﬁcates.
We also present an intuitive way to visualize different relaxation-based certiﬁcation methods.
By approximating multiple non-linearities jointly instead of separately, the k-ReLU method is able to bypass the convex barrier imposed by single neuron relaxations. Full version: https: / arxiv .org/abs/2106.
1. Introduction
Adversarial Examples While deep neural networks have been used with great success for perceptual tasks such as image classiﬁcation or speech recognition, their performance can deteriorate dramatically in the face of so-called adver- Accepted by the ICML 2021 workshop on A Blessing in Disguise: The Prospects and Perils of Adversarial Machine Learning. Copyright 2021 by the author(s). sarial examples (Biggio et al., 2013; Szegedy et al., 2013;
Goodfellow et al., 2014), i.e. small speciﬁcally crafted perturbations of the input signal, often imperceptible to humans, that are sufﬁcient to induce large changes in the model output, cf.
Figure 1.
Ever since their discovery, there has been a huge interest in the machine learning community to try to understand their origin and to mitigate their consequences.
Robustness Certiﬁcation
The existence of adversarial examples poses a real danger when deep neural networks are deployed in the real world.
The go-to strategy to quantify this vulnerability is to evaluate the model against speciﬁc attack algorithms.
This approach is however inherently limited, as it says little about the robustness of the model against more powerful attacks not included in the evaluation (Carlini & Wagner, 2017; Athalye et al., 2018).
We therefore need to go beyond adversary-speciﬁc robustness evaluation and instead provide provable robustness guarantees against attacks by any adversary.
The idea of robustness certiﬁcation is to ﬁnd the largest neighborhood (typically norm-bounded) that guarantees that no perturbation inside it can change the network’s prediction, or equivalently to ﬁnd the minimum distortion required to induce a misprediction.
Unfortunately, exactly certifying the robustness of a network is an NP-complete problem (Katz et al., 2017; Weng et al., 2018).
Consider a ReLU network: to ﬁnd the exact mimimum distortion, two branches have to be considered for each ReLU activation where the input can take both positive and negative values.
This makes exact veriﬁcation methods computationally demanding even for small networks
Relaxation-based certiﬁcation While exact certiﬁcation is hard, providing a guaranteed certiﬁed lower bound for the minimum adversarial perturbation, resp.
an upper bound on the robust error (i.e. the probability of misprediction for a given uncertainty set), can be done efﬁciently with relaxation-based certiﬁcation methods (Hein & Andriushchenko, 2017; Wong & Kolter, 2018; Raghunathan et al., 2018; Dvijotham et al., 2018; Weng et al., 2018;
Zhang et al., 2018; Singh et al., 2018; Mirman et al., 2018;
Singh et al., 2019b; Qin et al., 2019; Salman et al., 2019).
Relaxation-based veriﬁers trade off precision (increased false negative rates) with efﬁciency and scalability by convexly relaxing the non-linearities in the network.
The resulting certiﬁcates are still sound: they may fail to verify robustness for a data point that is actually robust, but they never falsely certify a data point that is not robust.
Single-Neuron Relaxation Barrier
The effectiveness of existing single-neuron relaxation-based veriﬁers is inherently limited by the optimal convex relaxation obtainable by processing each non-linearity separately (Salman et al., 2019).
Relaxing the non-linearities separately comes at the cost of losing correlations between neurons: While existing frameworks do consider correlations between units to compute bounds for higher layers, the bounds for neurons in a given layer are computed individually, i.e. without interactions within the same layer (Salman et al., 2019).
Moreover, as the activation bounds are obtained recursively, there is a risk that the error ampliﬁes across layers, which is particularly problematic for deep neural networks.
Multi-Neuron Relaxation
The single-neuron relaxation barrier can be bypassed by considering multi-neuron relaxations, i.e. by approximating multiple non-linearities jointly instead of separately, as suggested in the recent LPsolver based “k-ReLU” relaxation framework of (Singh et al., 2019a).
The “k-ReLU” relaxation framework obtains tighter activation bounds by leveraging additional relational constraints among groups of neurons, enabling signiﬁcantly more precise certiﬁcation than existing state-of-the-art veriﬁers while still maintaining scalability (Singh et al., 2019a).
Finally, note that there is another conceptually different approach to bypass the single-neuron relaxation barrier: (Tjandraatmadja et al., 2020) obtain tightened single neuron relaxations by considering bounds in terms of the multivariate post-activations preceding the afﬁne layer.
2. Single-Neuron Relaxation
Notation.
Let f : X Ă R n 0 Ñ R n L be an L -layer deep feedforward neural network, given by the equations
[Equation]
with input x p 0 q “ x and output x p L q ” f p x q , where
W p i q , b p i q denote the layer-wise weight matrix and bias vector, and where σ p¨q denotes the non-linear activation function, with the convention that σ p x p 0 q q “ x is the identity activation.
We use n i : “ dim p x p i q q to denote the number of neurons in layer i , and x (cid:74) L 0 ,L 1 (cid:75) : “ t x p L 0 q , . . .
, x p L 1 q u to denote the collection of all x p i q for i P (cid:74) L 0 , L 1 (cid:75) , where (cid:74) L 0 , L 1 (cid:75) denotes the set of indices (cid:74)
L 0 , L 1 (cid:75) : “ t L 0 , . .
, L 1 u , with the shorthand notation (cid:74) L
[Equation]
” (cid:74) 1 , L (cid:75) .
Note that in our notation the pre-activations x p
i q have the same index as the weight matrix W p i q and bias vector b p i q on which they directly depend.
Together, the above equations 1 deﬁne the mapping f p¨q “
[Equation]
Robustness Certiﬁcation.
The network is considered certiﬁably robust with respect to input x and uncertainty set
B p x q if there is no perturbation within B p x q that can change the network’s prediction, i.e. if the largest logit f ˆ k p x q remains larger than any other logit f k within the entire uncertainty set B p x q .
Formally, the network is certiﬁably robust at x with respect to B p x q if
[Equation]
where ˆ k p x q “ arg max j f j p x q .
Typical choices for B p x q are the (cid:96) p -norm balls B p p x ; (cid:15) q : “ t x ˚ : ||
x ˚ ´ x
|| p ď (cid:15) u or the non-uniform box domain
B p [Equation] (cid:15)
[Equation]
u with (cid:15) ´ j , (cid:15) ` j P R ` 0 .
The optimization domain in the above certiﬁcation problem can be narrowed down signiﬁcantly if we are given lowerand upper- pre-activation bounds , (cid:96) p i q ď x p i q ď u p i q , for i P (cid:74)
L ´ 1 (cid:75) .
We will see below how (approximate) preactivation bounds can be computed.
The corresponding optimization problem, subsequently referred to via the shorthand notation O p c , c 0 , L, (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) q , reads min
[Equation]
where the vector-inequalities are considered to hold elementwise
, i.e. (cid:96) p i q j ď x p i q j ď u p i q j , @
j P (cid:74) n i (cid:75) .
For c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q , c 0 “ 0 and (cid:96) p
i q j
[Equation]
this formulation is equivalent to Equation 2.
We denote the optimal value of O p c , c 0 , L, (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) q by p ˚ O .
If p ˚ O ą 0 for all c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q , with c 0 “ 0 and valid pre-activation bounds (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) , the network is certiﬁably robust with respect to x and B p x q .
Exact pre-activation bounds (cid:96) p i q j and u p i q j are given by the minimization ( ` e j ) resp.
maximization ( ´ e j ) problems
O p˘ e j , 0 , i, (cid:96) (cid:74) i ´ 1 (cid:75) , u (cid:74)
i ´ 1 (cid:75) q for all neurons j P (cid:74) n i (cid:75) and
layers i P (cid:74) L ´ 1 (cid:75) .
Unfortunately, computing exact bounds is as NP-hard as solving the exact certiﬁcation problem.
Most of the existing robustness certiﬁcation methods in use today are based on a variant of one of two (pre)-activation bound computation paradigms: (i) Interval Bound Propagation or (ii) Relaxation-based Bound Computation.
The preactivation bounds play a crucial role in these certiﬁcation methods: the tighter they are, the lower the false-negative rate of the method.
Relaxation-based Certiﬁcation Exactly certifying the robustness of a network via Equation 3 is an NP-complete problem (Katz et al., 2017; Weng et al., 2018), due to the non-convex constraints imposed by the non-linearities.
Relaxation-based veriﬁers trade off precision with efﬁciency and scalability by convexly relaxing (over-approximating) the non-linearities in the network.
The convex relaxation-based certiﬁcation problem, subsequently referred to via the short-hand notation
C p c , c 0 , L, (cid:96) (cid:74)
[Equation]
(cid:75) ,
u (cid:74) L ´ 1 (cid:75) q , reads min
[Equation]
s
[Equation]
i P (cid:74) L (cid:75) σ p x p i q q ď z p i q ď σ p x p i q q for i P (cid:74) L ´ 1 (cid:75) x p 0 q P B
p x q , (cid:96) p i q ď x p i q ď u p i q for i P (cid:74) L ´ 1 (cid:75) where σ p x p i q q resp.
σ p x p i q q are convex resp.
concave bounding functions satisfying σ p x p i q q ď σ p x p i q q ď σ p x p i q q for all (cid:96) p i q ď x p i q ď u p i q , and where z p i q are the post-activation variables with the convention that z p 0 q “ x p 0 q .
We denote the optimal value of C p c , c 0 , L, (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) q by p ˚ C .
Naturally, we have that p ˚ C ď p ˚ O .
Thus, if p ˚ C ą 0 for all c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q , with c 0 “ 0 and valid preactivation bounds (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) , the network is certiﬁably robust w.r.t.
x and B p x q .
More on single-neuron relaxation can be found in Section 5.3 in the Appendix .
Single-Neuron Relaxation Barrier
The effectiveness of existing single-neuron relaxation-based veriﬁers is inherently limited by the tightness of the optimal single-neuron relaxation, deﬁned in Section 5.3 in the Appendix.
In a series of highly compute-intense experiments, (Salman et al., 2019) found that optimal single-neuron relaxation based veriﬁcation, i.e. solving the certiﬁcation problems
C opt p˘ e j , 0 , i, (cid:96) (cid:74)
i ´ 1 (cid:75) , u (cid:74) i ´ 1 (cid:75) q for all neurons j P (cid:74) n i (cid:75) and layers i , does not signiﬁcantly improve upon the gap between veriﬁers that greedily compute approximate pre- activation bounds and only solve the relaxed (primal or dual) certiﬁcation problem C opt p c , 0 , L, (cid:96) (cid:
) L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) q with c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q for the logit layer, and the exact mixed integer linear programming (MILP) veriﬁer from (Tjeng et al., 2018), suggesting that there is an inherent barrier to tight veriﬁcation for single neuron relaxations.
To improve the tightness of relaxation-based certiﬁcation methods we therefore have to go beyond single-neuron relaxations.
3. Multi-Neuron Relaxation
The single-neuron relaxation barrier can be bypassed by considering multi-neuron relaxations, i.e. by approximating multiple non-linearities jointly instead of separately, as suggested in the recent LP-solver based “k-ReLU” relaxation framework of (Singh et al., 2019a).
Singh et al.’s
multineuron relaxation framework is speciﬁc to networks with
ReLU non-linearities but can otherwise be incorporated into any certiﬁcation method (primal or dual) that operates with pre-activation bounds, including (Weng et al., 2018; Zhang et al., 2018; Wong & Kolter, 2018).
In this Section, we show how the “k-ReLU” relaxation framework obtains tighter activation bounds by leveraging additional relational constraints among groups of neurons.
In particular, we show how additional pre-activation bounds can be mapped to corresponding post-activation bounds and how they can in turn be used to obtain tighter bounds in higher layers, as illustrated in Figure 2.
By capturing interactions between neurons, the k-ReLU method is able to overcome the convex barrier imposed by the single neuron relaxation (Salman et al., 2019).
Singh et al.
’s
experimental results indicate that k-ReLU enables signiﬁcantly more precise certiﬁcation than existing state-of-the-art veriﬁers while maintaining scalability.
To illustrate the precision gain, Singh et al.
measure the volume of the output bounding box computed after propagating an (cid:96) 8 -ball of radius (cid:15) “ 0 . 015 through a fully connected network with 9 layers containing 200 neurons each.
They ﬁnd that the volume of the output from 2-ReLU resp.
3-ReLU relaxation is 7 resp.
9 orders of magnitude smaller than from single-neuron relaxation-based DeepPoly veriﬁer (Singh et al., 2019a).
Similarly, on the 9 ˆ 200 fully-connected network resp.
a convolutional network, k-ReLU certiﬁes 506 resp.
347 adversarial regions whereas the single-neuron relaxation based ReﬁneZono veriﬁer certiﬁes 316 resp.adversarial regions (Singh et al., 2019a).
ReLU branch polytopes
Following (Singh et al., 2019a), we consider the pre-activations x p i q and the post-activations z p i q as separate neurons.
Let S p (cid:96) q be a convex set computed via some relaxation based certiﬁcation method approximating the set of values that neurons p x (cid:74) 0 ,(cid:96) (cid:75) , z (cid:74) 0 ,(cid:96) ´ 1 (cid:75) q , including the pre-activations x p (cid:96) q
but excluding the postactivations z p (cid:96) q , can take with respect to B p x q ,
S p (cid:96) q : “ !
[Equation]
[Equation]
(cid:75)
q : (5) x p
[Equation]
“ W p
[Equation]
z
[Equation]
´
[Equation] ` b p [Equation] q for i P (cid:74) (cid:96) (cid:75) σ p x p
[Equation]
q q ď z p [Equation] q ď σ p x p i q q for i P (cid:74) (cid:96) ´ 1 (cid:75) x p 0 q P B p x q , (cid:96) p i q ď x p i q ď u p i q for i P (cid:74)
[Equation] Note that, variables p x (cid:74) (cid:96) [Equation] 1 ,L (cid:75) , z (cid:74) (cid:96),L
[Equation]
1 (cid:75) q that don’t appear in the constraints, are considered to be unconstrained , i.e. they take values in the entire real number line.
In general, pre-activations x p (cid:96) q j can take both positive and negative values in S p (cid:96) q .
For each ReLU activation where the input,
i
[Equation]
e. the corresponding pre-activation, can take both positive and negative values, two branches have to be considered.
Deﬁne the convex polytopes induced by the two branches of the j -th ReLU unit at layer (cid:96) as
[Equation]
which can be written more concisely as
[Equation]
Next, we introduce some notation to describe the polytopes representing the possible ways of selecting one ReLU branch per neuron.
Let J Ď (cid:74) n (cid:96) (cid:75) be some index set over neurons, with cardinality | J | .
For a speciﬁc conﬁguration p s j 1 , . . .
, s j | J | q P t` , ´u | J | of individual ReLU branches, out of all 2 | J | possible conﬁgurations, let
[Equation]
be the convex polytope deﬁned as the intersection of the | J | individual ReLU branch polytopes t C p (cid:96)
q j s j u j P J .
Next, deﬁne Q p (cid:96) q J as the collection of all 2 | J | convex polytopes Q p (cid:96) q J, p s j 1 ,...,s j | J | q , indexed by all possible ReLU branch conﬁgurations p s j 1 , . . . , s j | J | q P t
[Equation]
[Equation]
| ,
[Equation]
Additional Relational Constraints
The k-ReLU relaxation framework bypasses the single-neuron convex barrier by leveraging additional relational constraints among groups of neurons.
Speciﬁcally, the k-ReLU framework computes bounds on additional relational constraints of the form ř j P J a j x p (cid:96) q j .
These additional relational constraints, together with the usual interval bounds, are captured by the convex polytope P p (cid:96) q J, A .
Formally, let P p (cid:96) q J, A Ě S p (cid:96) q be a convex polytope containing interval constraints (for p a j 1 , . .
. , a j | J | q with a j P t´ 1 , 0 , 1 u , ř j P J | a j [Equation] 1 ) and relational constraints (for general p a j 1 , . . .
, a j | J | q , with a j P R ) over neurons x p (cid:96) q j , j P J , deﬁned as
[Equation]
where the set A contains the coefﬁcient-tuples of all the constraints deﬁning P p (cid:96) q J, A .
In practice, the corresponding bounds c p (cid:96) q p a j 1 , . .
. , a j | J | q on interval and relational constraints over neurons x p (cid:96) q j , j P J , can be computed using any of the existing bound computation algorithms, e.g. (Zhang et al., 2018), Algorithm 1 in (Wong & Kolter, 2018) or DeepPoly (Singh et al., 2019a).
Using the notation for the relaxation-based certiﬁcation problem in Equation 4, the bounds are given as
[Equation]
11) with a “ ř j P J a j e j , where e j denotes the j -th canonical basis vector.
Ideally, one would like P p (cid:96) q J, A to be the projection of S p (cid:96) q onto the variables x p (cid:96) q j indexed by J .
However, computing this projection is prohibitively expensive.
Singh et al.
(2019a) heuristically found A “ tp a j 1 , . .
, a j | J | q P t´ 1 , 0 , 1 u | J | zp 0 , . . .
, 0 qu , containing 3 | J | ´ 1 constraints ( 2 | J | interval and 3 | J | ´ 2 | J | ´ 1 relational), to work well in practice.
It remains an open problem of whether there exists a theoretically optimal arrangement of a given number of additional relational constraints.
Geometrically, P p (cid:96) q J, A is an over-approximation of the projection of S p (cid:96) q onto the variables x p (cid:96) q j indexed by J .
Optimal Convex Multi-Neuron Relaxation
The optimal convex relaxation of the n (cid:96) ReLU assignments considers all n (cid:96) neurons jointly
[Equation]
where Q p (cid:96) q (cid:74) n
[Equation]
(cid:75) is the collection of the 2 n [Equation] convex polytopes
[Equation]
indexed by all possible ReLU branch conﬁgurations across neurons at layer (cid:96) , and where
CH denotes the Convex-Hull.
k-ReLU Relaxation
The k-ReLU framework partitions the n (cid:96) neurons into n (cid:96) { k disjoint sub-groups of size k , then jointly relaxes the neurons within each sub-group, as a compromise between the practically infeasible joint relaxation of all n (cid:96) neurons and the single-neuron relaxation barrier arising when relaxing each neuron individually.
Suppose that n (cid:96) is divisible by k .
Let J “ t J i u n (cid:96) { k i “ 1 be a partition of the set of neurons (cid:74) n (cid:96) (cid:75) such that each group
J i P J contains exactly | J i | “ k indices.
(Singh et al., 2019a) k-ReLU framework computes the following convex relaxation
[Equation]
Conceptually, each convex polytope P p (cid:96)
q J i , A i (containing interval and relational constraints on neurons x p (cid:96) q j , j P J i ) is intersected with convex ReLU branch polytopes Q from the set Q p (cid:96) q J i , producing 2 k convex polytopes t P p (cid:96)
q J i , A i X
Q u Q P Q p (cid:96) q Ji , one for each possible branch Q P Q p (cid:96) q J i .
The union Ť Q P Q p (cid:96) q Ji t P p (cid:96)
q J i , A i X Q u of all 2 k convex polytopes captures 2 the uncertainty set over post-activations z p (cid:96) q j indexed by j P J i .
As the different groups of neurons are disjoint J
i X J j “ H , we can combine those group-speciﬁc post-activation uncertainty sets by intersecting their convex hulls K
i “ CH
[Equation]
˘ .
From this,
S p (cid:96) q k-ReLU is obtained by intersection with the convex set S p (cid:96) q .
(Singh et al., 2019a) heuristically chose the partition J “ t J i u n (cid:96) { k i “ 1 such that neurons j P (cid:74) n (cid:96) (cid:75) are grouped according to the area of their triangle relaxation (i.e. neurons with similar triangle relaxation areas are grouped together).
It remains an open problem whether there exists a theoretically optimal partitioning of the groups of neurons.
Convex Hull Computation Singh et al.
use the cdd library to compute convex hulls (cdd, 2021).
cdd is an implementation of the double description method by Motzkin, that allows to compute all vertices (i.e. extreme points) of a general convex polytope given as a system of linear inequalities.
cdd also implements the reverse operation, allowing to compute the convex hull from a set of vertices.
In practice, cdd is used ﬁrst to compute the vertices of the convex polytopes t P p
[Equation]
q J i , A i X Q u Q P Q p (cid:96) q Ji and second to compute the convex hull of the union of the vertices of all these polytopes.
Tighter bounds in higher layers Finally, we show how the k-ReLU relaxation S p (cid:96) q k-ReLU can be used to obtain tighter bounds in higher layers.
The k-ReLU method computes reﬁned pre-activation bounds (cid:96) p
i ` 1 q j , u p i ` 1 q j for neurons at layer (cid:96) ` 1 , by maximizing and minimizing x p i ` 1 q j “ W
[Equation]
w
[Equation]
q subject to z p [Equation] P S [Equation]
q k
[Equation]
ReLU , [Equation] [Equation] Since all the constraints in S p (cid:96) q k-ReLU are linear, we can use an
LP-solver for the maximization and minimization.
Singh et al.
use the gurobi solver (Gurobi, 2021).
Interpretation Computing bounds on the additional relational constraints corresponds to solving a bounding problem on a widened network, that is equal to the original network up to layer (cid:96) ´
1 but with a “modiﬁed” (cid:96) -th layer which includes additional neurons representing linear combinations of rows of the (cid:96) -th layer weight matrix with coefﬁcients determined by p a j 1 , . .
. , a j | J | q .
See Figure 2.
4. Discussion
We have shown how the recent “k-ReLU” framework of (Singh et al., 2019a) obtains tighter correlation-aware activation bounds by leveraging additional relational constraints among groups of neurons.
In particular, we have shown how additional pre-activation constraints can be mapped to corresponding post-activation constraints and how they can in turn be used to obtain tighter pre-activation bounds in higher layers.
The k-ReLU framework is speciﬁc to ReLU networks but can otherwise be incorporated into any certiﬁcation method that operates with pre-activation bounds.
The main degrees of freedom in k-ReLU are the partitioning of the neurons into sub-groups and the choice of coefﬁcients a j in the additional relational constraints.
We consider it to be an interesting avenue of research to investigate whether there is a theoretically optimal partitioning as well as choice for the coefﬁcients of the additiona relational constraints.
5. Appendix 5.1. Visualization of Relaxation Methods 5.2. Notation
We introduce the following additional notation:
Deﬁnition 1.
(Row / column indexing).
Let A P R m ˆ n be an arbitrary real-valued matrix.
We use A i ¨¨ to denote the i -th row and A : j to denote the j -th column of A , for i P (cid:74) m (cid:75) and j P (cid:74) n (cid:75) .
Deﬁnition 2.
(Positive / negative entries).
Let A P R m ˆ n be an arbitrary real-valued matrix.
Deﬁne
[Equation]
16) where the max p¨ , ¨q and min p¨ , ¨q are taken entrywise .
Note that by deﬁnition, A “ A ` ` A ´ .
Deﬁnition 3.
(Row-wise q -norm).
Let A P R m ˆ n be an arbitrary real-valued matrix.
Deﬁne the row-wise q -norm
||
¨ || q ¨¨ as the following column vector in p R ` 0 q m :
[Equation]
5.3. Single-Neuron Relaxation Continued
Optimal Single-Neuron Relaxation Under mild assumptions (non-interactivity, see below), the optimal convex relaxation of a single non-linearity, i.e. its convex hull, is given by σ opt p x q ď σ p x q ď σ opt p x q (Salman et al., 2019), where σ opt p x q is the greatest convex function majored by σ σ opt p x q is the smallest concave function majoring σ (18)
In general, for vector-valued non-linearities σ : R n Ñ R m , the optimal convex relaxation may not have a simple analytic form.
However, if there is no interaction among the outputs σ i for i P (cid:74) m (cid:75) , the optimal convex relaxation does admit a simple analytic form (Salman et al., 2019):
Deﬁnition 4.
Salman et al.’s
Deﬁnition B.2 ( non-interactivity ) Let σ : R n Ñ R m be a vector-valued non-linearity with input x P r (cid:96) , u s Ă R n and output σ p x q P R m .
For each output σ j p x q , let I j Ă (cid:74) n (cid:75) be the set of x ’s entries that affect σ j p x q .
We call the vector-valued non-linearity non-interactive if the sets I j for j P (cid:74) m (cid:75) are mutually disjoint I
j X
I k
“ H for all j ‰ k P (cid:74) m (cid:75) .
All element-wise non-linearities such as (leaky)-ReLU, sigmoid and tanh are non-interactive.
MaxPooling is also noninteractive if the stride is no smaller than the kernel size, i.e. if the receptive regions are non-overlapping.
For the ReLU non-linearity σ p x q “ max p x, 0 q , the optimal convex relaxation with respect to pre-activation bounds (cid:96), u , is given by the triangle relaxation (Ehlers, 2017),
[Equation]
19) see Figure 4 (middle) for an illustration.
We denote the optimal relaxation-based certiﬁcation problem as C opt and the corresponding optimal value of the objective as p ˚ C opt .
Optimal LP-relaxed Veriﬁcation For piece-wise linear networks, including (leaky)-ReLU networks, the optimal singleneuron relaxation-based certiﬁcation problem C opt p c , c 0 , L, (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) q is a linear programming problem and can thus be solved exactly with off-the-shelf LP solvers.
Two steps are required (Salman et al., 2019): (a) We ﬁrst need to obtain optimal single-neuron relaxation-based pre-activation bounds for all neurons in the network except those in the logit layer.
(b) We then solve the LP-relaxed (primal or dual) certiﬁcation problem exactly for the logit layer of the network.
(a) Obtaining optimal single-neuron relaxation-based pre-activation bounds.
The optimal single-neuron relaxation-based pre-activation bounds are obtained by recursively solving the minimization ( ` e j ) resp.
maximization ( ´ e j ) problems C opt
p˘ e j , 0 , i, (cid:96) (cid:74) i ´ 1 (cid:75) , u (cid:74)
i ´ 1 (cid:75) q for all neurons j P (cid:74) n i (cid:75) at increasingly higher layers i P (cid:74)
L ´ 1 (cid:75) .
(b) Solving the LP-relaxed (primal or dual) certiﬁcation problem for the logit layer.
We then solve the linear program C opt p c , 0 , L, (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) q for all c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q with the above pre-activation bounds.
If the solutions of all linear programs are postive, i e. if p ˚ C opt ą 0 (primal) or d ˚ C opt ą [-
-]0 (dual) for all c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q , the network is certiﬁably robust w.r
t. x and B p x q .
Note that the number of optimization sub-problems that need to be solved scales linearly with the number of neurons, which can easily be in the millions for deep neural networks (Salman et al., 2019).
For this reason, much of the literature on certiﬁcation for deep neural networks has focused on efﬁciently computing approximate pre-activation bounds.
An efﬁcient and scalable alternative to solving the optimal LP-relaxed veriﬁcation problem exactly is to only solve (b) exactly and instead of (a) to greedily compute approximate but sound pre-activation bounds.
As we will see shortly, tighter pre-activation bounds also yield tighter relaxations when over-approximating the nonlinearities.
Most of the existing relaxation-based certiﬁcation methods in use today are based on a variant of one of two greedy (pre)-activation bound computation paradigms: (i) interval bound propagation (Algorithm 1) or (ii) relaxation-based backsubstitution (Algorithm 2).
The pre-activation bounds play a crucial role in these certiﬁcation methods: the tighter they are, the lower the false-negative rate of the method.
Interval Bound Propagation.
The simplest possible method to obtain approximate but sound pre-activation bounds is given by the Interval Bound Propagation (IBP)
algorithm
(Dvijotham et al., 2018), which is based on the idea that valid layer-wise pre-activation bounds can be obtained by considering a separate worst-case previous-layer perturbation ξ for each row W p
i q j ¨¨ , satisfying the constraint that ξ is within the previous-layer lower- and upper- pre-activation bounds (cid:96) p
i ´ 1 q jď [Equation] 1 ď u p
[Equation]
j 1 P (cid:74) n i ´ 1 (cid:75) .
The j 1 -th perturbation entry of the greedy solution is uniquely determined by the sign of the j 1 -th entry of the vector W p
i q j ¨¨ .
The corresponding bounds are
[Equation]
The computational complexity of the Interval Bound Propagation algorithm is linear in the number of layers L .
The complete algorithm is shown in Algorithm 1.
input: Parameters t W
[Equation]
input x
[Equation]
p
[Equation] norm [Equation] perturbation size
[Equation]
(cid:96)
[Table]
[Equation]
“ W
[Table]
q x ´ (cid:15) || W p [Equation] p
[Equation]
b
[Table] [Equation] u [Table]
[Equation] “ W [Table] q x ` (cid:15) || W
[Table]
||
[Table] ` [Table] for i “ 2 , . . .
, L do (cid:96)
[Table] “ W [Table]
W [Table] q´ [Table]
u [Table]
[Equation]
[Table] [Equation] [Table] [Equation]
[Table] [Equation] [Table]
[Equation] [Table] [Equation]
[Table]
end for output: [Table] [Equation] [Table]
[Equation]
A more sophisticated class of approximate but sound pre-activation bounds can be obtained by greedy relaxation-based backsubstitution.
Linear bounding functions Of particular interest is the case where each non-linear layer is bounded by exactly one linear lower relaxation function Φ p i q p¨q and one linear upper relaxation function Φ p i q p¨q , as the corresponding relaxation-based veriﬁcation problem can be solved greedily in this case (Salman et al., 2019).
For ReLU non-linearities we have the following expressions for the linear bounding functions:
Proposition 1.
(Linear ReLU relaxation functions (Weng et al., 2018)).
Each ReLU layer can be bounded as follows
[Equation]
(cid:96) p i q ď x p i q ď u p i q , with Φ p i q p x p i q q : “ Σ p i q x p i q ` β p i q , Φ p i q p x p i q q : “ Σ p i q x p i q ` β p i q , where the (diagonal) relaxation slope matrices Σ p i q , Σ p i q and lower- and upper- offset vectors β p i q , β p i q are given by
[Equation] [Equation]
j
[Equation]
if
[Equation]
P
[Equation]
i q [Equation] [Equation] with 0 ď α p i q j ď 1 , and where I p i q´ , I p i q` , and I p i q denote the sets of activations j P (cid:74) n i (cid:75) in layer i where the lower and upper pre-activation bounds (cid:96) p i
q j , u p i q j are both negative, both positive, or span zero respectively.
See Figure 4 (right) for an illustration.
Proofs can be found in (Weng et al., 2018;
Zhang et al., 2018;
Salman et al., 2019).
See (Zhang et al., 2018) or (Liu et al., 2019) for how to [Table]
Note that the linear upper bound is the optimal convex relaxation for the ReLU non-linearity, cf.
Equation 19.
For the lower bound, the optimal convex relaxation is not achievable as one linear function, however, and we can use any “sub-gradient” relaxation σ j p x p
i q q “ α p i q j x p i q j with 0 ď α p i q j ď 1 , cf.
Equation 19.
Choosing the same slope for the lower- and upper- relaxation functions, i.e. Σ p i q “ Σ p i q , recovers Fast-Lin (Weng et al., 2018) and is equivalent to DeepZ (Singh et al., 2018).
The same procedure is also used to compute pre-activation bounds in (Wong et al., 2018)
(Algorithm 1).
The case where the slopes Σ p i q ‰ Σ p
i q of the lower relaxation function Φ p i q p¨q are selected adaptively, α p i q j P t 0 , 1 u , depending on which relaxation has the smaller volume, recovers CROWN (Zhang et al., 2018) and is equivalent to DeepPoly (Singh et al., 2019b).
Greedy Backsubstitution
The relaxation-based certiﬁcation problem with linear bounding functions can be solved greedily in a layer-by-layer fashion (Wong & Kolter, 2018; Weng et al., 2018; Zhang et al., 2018;
Salman et al., 2019).
For instance, to obtain bounds on x p i ` 1 q j “ [Equation] i ` 1 q
[Equation]
, we greedily replace the non-linearities σ p x p i q q with their lower and upper relaxation functions, Φ p i q p x p i q q resp.
Φ p i q p x p i q q , in such a way that we under-estimate the lower bounds (cid:96) p i ` 1 q j and over-estimate the upper bounds
u p i ` 1 q j .
Speciﬁcally, the bounding functions for σ p x p i q q are chosen based on the signs of the elements of the j -th row of the weight matrix, W p
i ` 1 q j ¨¨ , i.e.
[Equation]
Similarly, in the expression for x p i q “ W p i q σ p x p
i ´
1 q q` b p i q in the bounds above, we can greedily replace the non-linearities σ p x p
i ´ 1 q q with their relaxation functions Φ p
i ´ 1 q p x p
i ´
1 q q resp.
Φ p
i ´ 1 q p x p
i ´ 1 q q depending on the signs of ´“
[Equation]
¨¨
[Equation]
` “ W p
i ` 1 q j ¨¨ ‰ ´ Σ p
i q ¯ W p
i q and ´“
[Equation]
W p i q , thus obtaining linear bounds for x p i ` 1 q j in terms of x p i ´ 1 q .
By the same argument we can continue this backsubstitution process until we reach the input x p 0 q , thus getting bounds on x p i ` 1 q j in terms of x p 0 q of the following form, which holds for all x p 0 q P B p x q ,
[Equation]
where Λ p i ` 1 q j ¨¨ , Λ p i ` 1 q j ¨¨ capture the products of weight matrices and relaxation slope matrices, while γ p i ` 1 q j , γ p i ` 1 q j collect products of weight matrices, relaxation matrices and bias terms. Explicit expressions for Λ p i ` 1 q j ¨¨ , Λ p i
[Equation] 1 q j [Equation] , γ p i ` 1 q j , γ p i ` 1 q j can be found in (Weng et al., 2018; Zhang et al., 2018).
The above recursion is quite remarkable, as it allows to linearly bound the output of the non-linear mapping x p
i ` 1 q ” x p i ` 1 q p x p 0 q q for all x p 0 q P B p x q .
With the above expressions for the linear functions bounding x p
i ` 1 q j in terms of x p 0 q , we can compute lower and upper bounds (cid:96) p
i ` 1 q j , u p i ` 1 q j by considering the worst-case x p 0 q P B p x q .
For instance, when the uncertainty set is an (cid:96) p -norm ball
B p p x ; (cid:15) q : “ t x ˚ : || x ˚ ´ x || p ď (cid:15) u , the bounds are given as
[Equation]
In practice, in order to be able to replace all the non-linearities with their bounding functions from layer i all the way down to the input layer, we need pre-activation bounds for all layers
i 1 ă
i , since the expressions for the relaxation slope matrices Σ p i 1 q , Σ p i 1 q and offset vectors β p i 1 q , β p i 1 q depend on those pre-activation bounds.
The full greedy solution thus proceeds in a layer-by-layer fashion, starting from the ﬁrst layer up to the last layer, where for each layer the backsubstitution to the input is computed based on the pre-activation bounds of previous layers (computed with the same greedy approach).
Hence, the computational complexity of the full greedy solution of the relaxation-based certiﬁcation problem is quadratic in the number of layers L of the network.
The complete algorithm is shown in Section 5.4 in the Appendix.
Finally, note that while the activation over-approximation introduces looseness, relaxation-based bounds admit cancellations between positive and negative entries in weight matrices that are otherwise missed when considering the positive and negative parts of the weight matrices separately as in the Interval Bound Propagation algorithm. Dual formulations Instead of solving the certiﬁcation problem O p c , c 0 , L, [Equation] [Equation]
, u [Equation] [Equation] q in Equation 3 or the corresponding relaxation C p c , c 0 , L, (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L [Equation] 1 (cid:75) q in Equation 4 in their primal forms, we can also solve the corresponding dual formulations.
The Lagrangian dual of the certiﬁcation problem in Equation 3 is given by (Dvijotham et al., 2018;
Salman et al., 2019)
[Equation] [Equation]
The Lagrangian dual of the relaxation-based certiﬁcation problem in Equation 4 is given by (Wong & Kolter, 2018;
Salman et al., 2019)
[Equation]
where z p i q represent the post-activation variables.
By weak duality (Boyd et al., 2004), we have for the original dual
[Equation]
(28) respectively for the convex-relaxation based dual
[Equation]
´ 1 (cid:75) ě 0 g C p µ (cid:74)
L (cid:75) , λ (cid:74) 0 ,L ´ 1 (cid:75) , λ (cid:74) 0 ,L ´ 1 (cid:75) q ď p ˚ C (29)
Hence, if d ˚ O ą 0 resp.
d ˚ C ą 0 for all c P t e ˆ k p x q ´ e k u k ‰ ˆ k p x q , with c 0 “ 0 and valid pre-activation bounds (cid:96) (cid:74)
L ´ 1 (cid:75) ,
u (cid:74) L ´ 1 (cid:75) , the network is certiﬁably robust with respect to x and B p x q .
In fact, for the convex-relaxation based certiﬁcation problem, one can show that strong duality ( d ˚ C “ p ˚ C ) holds under relatively mild conditions (ﬁnite Lipschitz constant for the bounding functions σ p¨q , σ p¨q ), see Theorem 4.1 in (Salman et al., 2019).
Moreover, one can even show that the dual of the optimal single-neuron convex relaxation based certiﬁcation problem is equivalent to the dual of the original certiﬁcation problem, i.e. d ˚ C opt “ d ˚ O , see Theorem 4.2 in (Salman et al., 2019).
Despite these equivalences, there are still good reasons to solve the dual instead of the primal problem.
(Salman et al., 2019) recommend solving the dual problem because (i) the dual problem can be formulated as an unconstrained optimization problem, whereas the primal is a constrained optimization problem and (ii) the dual optimization process can be stopped anytime to give a valid lower bound on p ˚ O (thanks to weak duality).
5.4. Single-Neuron Relaxation-based Bound Computation in the Special Case Σ p i q “ Σ p i q ” Σ p i q
When each non-linear layer is bounded by exactly one linear lower relaxation function and one linear upper relaxation function, the relaxed veriﬁcation problem can be solved greedily (Salman et al., 2019).
In the special case Σ p i q “ Σ p i q ” Σ p i q , we can derive concise closed-form expressions for the lower- and upper pre-activation bounds.
To this end, we replace the activations with their enveloping relaxation functions Φ p i q p x p
i q q “ Σ p i q x p i q ` β p i q resp.
Φ p i q p x p
i q q “ Σ p i q x p i q ` β p i q where the offsets β p i q j 1 , β p i q j 1 are for each layer i and unit j 1 chosen such that we under-estimate lower bounds (cid:96) p i
q j and over-estimate upper bounds
u p i q j ,
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
[Equation]
[Table]
Note that the j 1 span different ranges for the different variables.
For the sake of simplicity, we introduce special notation for products over decreasing index sequences, where the index is counted down from the product-superscript to the product-subscript
Deﬁnition 5.
(Products over decreasing index sequences).
Let A p k q , k P r m, . . .
, n s be an arbitrary sequence of (realvalued) matrices with matching inner dimensions.
For ease of notation, deﬁne
[Equation]
where n ě m (31)
We use the usual convention that the empty product equals one, i.e. ś k PH p¨q “ 1 .
Thus, ś nk “ m p¨q “ 1 and ś k “ n m p¨q “whenever n ă m .
We also introduce the following closed-form expressions for the layer-wise activation-relaxation
Deﬁnition 6.
(Closed-form expressions for layer-wise activation-relaxation).
[Equation]
Rewriting the above equations using the explicit expressions for the concatenation of layers,
[Equation]
we can see that the different minimizations and maximizations over optimal perturbations, lower- and upper- offset vectors decouple, hence we can resolve them separately, e.g. for B (cid:15)p p 0 q :
[Equation]
35) where p ˚ is the Hölder conjugate 1 { p ` 1 { p ˚ “ 1 and where ||
¨ || p ˚ ¨¨ denotes the row-wise p ˚ -norm.
Choosing the same slope for the lower- and upper- relaxation functions α p i
q j “ u p i
q j {p u p i q j ´ (cid:96) p i q j q , i.e. Σ p i q “ Σ p i q , recovers
Fast-Lin (Weng et al., 2018), while adaptively setting α p i q j to its boundary values depending on which relaxation has the smaller volume recovers CROWN (Zhang et al., 2018).
” Σ p i q , β p i q ” 0 ) input: Parameters t W p i q , b p i q u Li “ 1 , input x , p -norm, perturbation size (cid:15) [Equation] (cid:96)
[Equation]
“ φ p
[Equation] ´ (cid:15) | [Equation]
Λ p
[Equation]
p
[Equation]
u
[Equation]
` (cid:15) || Λ p
[Equation] || p [Equation] for i “ 2 , . . .
, L do
Compute Σ p i ´ 1 q , β p
i ´ 1 q from (cid:96) p i ´ 1 q , u p
i ´ 1 q Λ p j q “ W p i
q Σ p
i ´ 1 q Λ p j q for j “ 1 , . . .
, i ´Λ p
i q “ W p i q φ
[Equation]
u
[Equation]
´
[Equation]
¯ end for output: bounds t (cid:96) p i q , u p
i q u Li “