E FFICIENT B I -D IRECTIONAL V ERIFICATION OF R E LU N ETWORKS VIA Q UADRATIC P ROGRAMMING
Anonymous authors
Paper under double-blind review
A BSTRACT
Neural networks are known to be sensitive to adversarial perturbations.
To investigate this undesired behavior we consider the problem of computing the distance to the decision boundary (DtDB) from a given sample for a deep neural net classiﬁer.
In this work we present an iterative procedure where in each step we solve a convex quadratic programming (QP) task.
Solving the single initial QP already results in a lower bound on the DtDB and can be used as a robustness certiﬁcate of the classiﬁer around a given sample.
In contrast to currently known approaches our method also provides upper bounds used as a measure of quality for the certiﬁcate.
We show that our approach provides better or competitive results in comparison with a wide range of existing techniques.
I NTRODUTION
The high predictive power of neural network classiﬁers makes them the method of choice to tackle challenging classiﬁcation problems in many areas.
However, questions regarding the robustness of their performance under slight input perturbations still remain open, severely limiting the applicability of deep neural net classiﬁers to sensitive tasks that require certiﬁcation of the obtained results.
In recent years this issue gained a lot of attention, resulting in a large variety of methods tackling tasks ranging from adversarial attacks and defenses against these to robustness veriﬁcation and robust training.
In this work we focus on robustness veriﬁcation of deep classiﬁers.
That is, computing the distance from a given anchor point x 0 in the input space to its closest adversarial, i.e. a point that is assigned a different class label by the network.
This problem plays a fundamental role in understanding the behavior of deep classiﬁers and essentially provides the only reliable way to assess classiﬁer robustness.
Unfortunately, its complexity class does not allow a polynomial time algorithm.
For deep classiﬁers with ReLU activation the veriﬁcation problem can equivalently be reformulated as a mixed integer programming (MIP) task and was shown to be NP-complete by
Katz et al.
Even worse, Weng et al.
(2018) showed that an approximation of the minimum adversarial perturbation of a certain (high) quality cannot be found within polynomial time.
Related work There exist three streams of related work on robustness veriﬁcation of deep ReLU classiﬁers.
This categorization is based on whether they are solving the veriﬁcation problem exactly or verifying a bound on the distance to the decision boundary (DtDB).
The ﬁrst group of methods are exact veriﬁcation approaches.
As mentioned above, the veriﬁcation task can be modeled using MIP techniques.
Katz et al.
(2017) present a modiﬁcation of the simplex algorithm that can be used to solve the veriﬁcation task exactly for smaller ReLU networks based on satisﬁable modulo theory (SMT).
Other approaches (see Ehlers (2017)) rely on SMT solvers when solving the described task.
Bunel et al.
(2018) provide an overview and comparison of those.
Other exact methods (Dutta et al.
; Lomuscio and Maganti (2017); Tjeng et al.
(2017)) deploy
MIP solvers together with presolving to ﬁnd a tight formulation of the MIP problem or (Jordan et al.
(2018)) use an algorithm to ﬁnd the largest ball around the anchor point that touches the decision boundary.
The second popular class of methods for verifying classiﬁer robustness deals with veriﬁcation of an (cid:15) -neighborhood : given an anchor point x 0 and an (cid:15) > 0 , the task is to verify whether an adversarial point exists within the (cid:15) neighborhood of x 0 which is deﬁned with respect to a certain norm in the input space.
All existing methods relax the initial problem and require bounds on activation inputs in each layer.
These bounds should be as tight as possible to ensure good ﬁnal results.
Raghunathan et al.
(2018a;b); Dvijotham et al.
(2018; 2019) consider semideﬁnite (SDP) and linear (LP) problems as relaxations of the (cid:15) -veriﬁcation problem.
Wong and Kolter (2018) replace ReLU constraints by linear constraints and consider the dual formulation of the obtained LP relaxation.
Weng et al.
(2018) present an approach that also uses linear functions (later extended to quadratic functions by Zhang et al.
(2018)) to deal with nonlinear activation functions and propagate the layer-wise output bounds until the ﬁnal layer.
Finally Hein and Andriushchenko (2017); Tsuzuku et al.
(2018) use the Lipschitz constant of the transformations within classiﬁer’s architecture.
Our approach belongs to the third group of approaches dealing with constructing lower bounds on
DtDB without restricting admissible adversarial points to a given neighborhood.
The (cid:15) -veriﬁcation task is closely related to the problem of constructing lower bounds on DtDB: each (cid:15) -neighborhood that can be certiﬁed as adversarial-free immediately provides a lower bound on the minimal adversarial perturbation magnitude.
It is also a common strategy for the methods from the previous group to use a binary search or a Newton method on top of their algorithm to ﬁnd the largest (cid:15) such that the (cid:15) -neighborhood around x 0 can still be veriﬁed as robust.
Croce et al.
(2019) leverage the piecewise afﬁne nature of the outputs of a ReLU classiﬁer and compute lower bounds on DtDB by assuming that the classiﬁer behaves globally the same way it does in the linear region around the given anchor point.
Adversarial attacks Constructing misclassiﬁed examples that are close to the anchor point can be considered as a complementary research direction to robustness veriﬁcation since each adversarial example by deﬁnition provides an upper bound on the DtDB.
Many methods were proposed to construct such points (Szegedy et al.
; Goodfellow et al.
; Kurakin et al.
Papernot et al.
; Madry et al.
; Carlini and Wagner (2017).
Robust training The question of how to actually train a robust classiﬁer is closely related to robustness veriﬁcation since the latter might allow us to construct some type of robust loss based on the insights from the veriﬁcation procedure (see Hein and Andriushchenko (2017);
Madry et al.
Wong and Kolter (2018); Raghunathan et al. (2018a); Tsuzuku et al.
Wang et al.
(2018); Croce et al.
We leave this direction for future work.
Contributions
We propose a novel relaxation of the DtDB problem in form of a QP task allowing efﬁcient computation of high quality lower bounds on the DtDB in l 2 -norm with an extension to l ∞ -norm.
For networks with up to two hidden layers we reach state-of-the-art performance with an improvement of over 50% when compared to the bounds obtained from methods based on LP relaxations (CROWN by Zhang et al.
(2018) and ConvAdv by Wong and Kolter (2018)).
Furthermore, our method performs much faster than methods based on SDP relaxations (Raghunathan et al., 2018b), while providing smaller lower bounds.
This is a fundamental property due to the difference in computational complexity between SDP and QP tasks.
Unlike (cid:15) -veriﬁcation techniques, we provide a lower bound on DtDB without an initial guess and without computing bounds for the neuron activation values in each layer.
Such bounds have to be tight enough to verify non-trivial neighborhoods and play an important role in other relaxation techniques such as the SDP based approaches by Raghunathan et al.
(2018b)
; Dvijotham et al.
In addition to computing the lower bounds after solving a single QP, our approach allows to construct adversarial examples by repeatedly choosing
a new anchor on the boundary of the veriﬁed region and solving its associated QP.
One of the main limitations of competing inexact approaches is the fact that the situation around the given anchor point outside of the certiﬁed radius remains unclear.
Since these approaches rely on relaxations of the initial problem, failed certiﬁcation does not indicate the presence of an adversarial example.
Instead, when using these methods, one must rely on externally constructed adversarial examples to obtain an upper bound.
We present a bi-directional robustness veriﬁcation technique that uses the veriﬁcation mechanism itself to construct upper bounds and assess the quality of the lower bounds.
N OTATION AND IDEA
We consider a neural network consisting of L linear transformations representing dense, convolutional, skip or average pooling layers and L − 1 ReLU activations (no activation after the last hidden layer).
The number of neurons in layer l is denoted as n l for l = 0 , . . .
, L , meaning that the data has n 0 features and n L classes.
Furthermore, we present our analysis for the l 2 -norm as perturbation magnitude measure since only few available methods are applicable to this setting.
To make our method comparable with Raghunathan et al.
(2018b) a generalization to l ∞ -perturbations is addressed in Appendix A.
Given sample x 0 ∈ R n 0 , weight matrices W l ∈ R n l × n l − 1 , and bias vectors b l ∈ R n l , we deﬁne the output of the i -th neuron in the l -th layer after the ReLU activation as
[Equation]
where [ x ] + is the positive part of x and f ( x 0 )
=
x L denotes the output of the complete forward pass through the network.
We start with the observation that the ReLU activation function acts as one of two linear functions depending on its input’s sign.
That allows us to reformulate it (see Section 3.1) and obtain an optimization problem with so called linear complementarity constraints (also used by
Raghunathan et al.
(2018b)
; Dvijotham et al.
(2019) for (cid:15) -veriﬁcation).
Note that for each pair of scalars a and b the following holds.
[Equation]
O PTIMIZATION PROBLEM 3. F ORMULATION OF D T DB
For a given sample ˜ x 0 , pre-trained neural net f , predicted label ˜
y and target label y we aim to ﬁnd the closest point to ˜ x 0 in R n 0 that has a larger or equal probability of being classiﬁed as y compared to the initial label.
This can be done by solving the following optimization problem.
[Equation]
where e i is the i -th unit vector in R n L and (cid:107) x (cid:107) denotes the Euclidean norm of x .
Note that we explore the boundary between classes y and ˜ y around ˜ x 0 .
To compute the distance from ˜ x 0 to the (full) decision boundary, one needs t compute the solution for all target labels y
= 1 , . .
. , n L except ˜ y .
We can “unfold” the above optimization problem using (1), where x denotes a container with all variables x 0 , . . .
, x L .
[Equation]
We apply (2) to reformulate the problem and eliminate x L , such that from now on x contains only the remaining variables x 0 , . . .
, x L − 1 and n = n 0 + . . .
+ n L − 1 .
[Equation]
3. QP R ELAXATION
Next we consider a Lagrangian relaxation of DtDB without constraints (3).
We will refer to the resulting problem as QPRel( λ ), when the explicit dependency on the multipliers is required.
[Equation]
The obtained problem is indeed a QP with linear constraints.
We need to clarify two questions.
How does the problem
QPRel help us with solving DtDB and how can this problem itself be solved efﬁciently?
QPRel vs. DtDB
First, we describe properties of the solution of QPRel providing information about DtDB.
To do so, we deﬁne for arbitrary vectors x 0 ∈ R n 0 , . . .
, x L − 1 ∈ R n L − 1 and λ ∈ R L − 1 +
[Equation]
[Equation]
as the corresponding propagation gap.
It follows directly from the deﬁnition that for arbitrary non-negative λ it holds that:
• if x is feasible for DtDB we have c ( x, λ ) = 0 , meaning that x equals the vector obtained by propagating x 0 through the neural net as deﬁned in (1), • if x is feasible for QPRel we have c ( x, λ ) ≥ 0 , meaning that there might be a slack between the true output of layer l when getting x 0 as an input and the value of x l obtained by QPRel.
In general the following holds for the relation between the solution of QPRel and DtDB (see also
Figure 1, every point in the hatched area is certiﬁed to be classiﬁed as belonging to the class ˜ y ).
Lemma 1.
Denote the solution of QPRel by x qp and the square root of its optimal objective value by d qp , let d be the square root of the optimal objective value of DtDB.
The following holds:
d qp ≤ d
and when c ( x qp , λ ) =
we have d qp = d and x qp is optimal for DtDB.
For two non-negative λ 1 , λ 2 with λ 1 ≤ λ 2 elementwise it holds that d qp ( λ 1 ) ≤ d qp ( λ 2 ) .
[Equation]
x 0adv d
The ﬁrst result from Lemma 1 ensures that d qp provides a radius of a certiﬁed neighborhood around the anchor point.
Whereas the second part indicates that we should choose λ as large as possible to get our lower bound closer to DtDB.
Unfortunately, as we show below, the problem QPRel becomes non-convex for large values of λ .
While one could try to tackle a non-convex QP with proper optimization methods, we will address necessary conditions such that QPRel is guaranteed to be convex and can be solved efﬁciently next.
Convexity of QPRel To look into the problem QPRel in more detail we introduce the Hessian M λ (which is a constant matrix) of its objective function.
Deﬁnition 1.
Let E l ∈ R n l × n l be the identity matrix of the corresponding dimension.
We deﬁne
M λ ∈ R n × n as the following symmetric block tridiagonal matrix
[Equation] [Equation]
[Equation]
  with M l := − 1 2 λ l W l , D l := λ l E l and λ 0 := 1 .
Using this matrix we can rewrite the objective function from QPRel as (see Appendix C, Lemma 2):
[Equation]
where ¯ b and ¯ c inﬂuence only the linear and constant terms and are therefore not relevant in this section.
From this reformulation we can clearly see that the matrix M λ determines the (non-)convexity of the objective function.
The following theorem provides sufﬁcient and necessary conditions on λ depending on the weights W l assuring that M λ is positive semi-deﬁnite.
This allows us to use off-the-shelf QP-solvers with excellent convergence properties.
Theorem 1.
Let W 1 , . . .
, W L − 1 be the weights of an arbitrary pre-trained neural net and (cid:107) W (cid:107) the spectral norm of an arbitrary matrix.
Then the following two conditions for λ provide correspondingly a sufﬁcient and a necessary criterion for the matrix M λ to be positive semi-deﬁnite.
[Equation]
Furthermore, we deﬁne ¯ λ and ¯ λ that correspondingly satisfy conditions (8) and (9) with equality:
[Equation]
In case with a single hidden layer choosing λ = ¯ λ from (9) guarantees M λ to be positive-semi deﬁnite.
We use (8), (9) and our previous results as guidelines for the choice of λ .
Since QPRel( λ ) is monotonous in the sense of Lemma 1 we perform a binary search between ¯ λ and ¯ λ from Theoremto ﬁnd the point closest to ¯ λ such that the QP remains convex.
This preprocessing step does not considerably affect the runtime since checking whether a matrix is positive semi-deﬁnite is done efﬁciently by Cholesky decomposition.
However, it improves the ﬁnal bounds by up to a factor two compared to the bounds obtained when using λ = ¯ λ without binary search.
Note that this procedure has to be done once for a given classiﬁer.
The obtained λ can subsequently be used to solve QPRel for all anchor points and target labels.
This is a signiﬁcant computational advantage compared to SDP based (cid:15) -veriﬁcation procedures.
For example, the method by Dvijotham et al.
(2019) includes the dual multipliers as variables in the SDP problem that has to be solved for each combination of the anchor point, target label and veriﬁed epsilon.
U PPER BOUNDS
Now we describe an iterative procedure generating a sequence of points in R n 0 that converges to a point on the decision boundary.
This procedure provides an upper bound on the distance to DtDB and thus allows for bi-directional veriﬁcation of a classiﬁer.
Algorithm 1: Algorithm to construct an adversarial example by iteratively solving QPRel.
Data
Result d ub , x begin
Solve
anchor
x qp , d qp ←− optimal solution and square root of the objective function value c ←−
Choose the next anchor point on the boundary of the
current certiﬁed region:
[Table]
>
tol then
[Table]
[Table]
Idea In each step we verify a certain neighborhood around the current anchor point x 0 and then expand the veriﬁed region further.
For that we choose the next anchor point as follows.
1) Choice of direction: we go from x 0 towards the solution of QPRel since, if the QP relaxation is tight, its solution should be close to an optimal solution of DtDB which is the closest adversarial point to x 0 .
2) Choice of step size: we know that there are no adversarial points within the ball of the veriﬁed radius d around the anchor, so every step size smaller than d would be unnecessary small.
On the other hand, if we proceed with a new anchor point that is strictly farther away than d , we might miss an adversarial point lying close to the boundary of the d -ball around x 0 .
Therefore, we choose the next anchor point to be on the boundary of the currently veriﬁed region, so that every (cid:15) -ball that we manage to verify around the new point would add to the overall robust set.
Algorithm 1 provides a pseudo-code for this procedure.
Termination
The algorithm terminates as soon as the propagation gap c ( x, λ ) (see (7)) becomes small enough or the anchor point gets misclassiﬁed.
Note that c ( x, λ ) =
means that the solution x provides the optimal objective function value of the DtDB problem (see Lemma 1) and, thus, an adversarial example.
However, the termination condition c ≤ c tol from Algorithm 1, line 3 cannot ensure that the optimal point x 0 qp from the last iteration belongs to a different class.
Therefore, if we stop with c ≤ c tol and the second termination condition is not satisﬁed, we take an additional step on the boundary of the ball of radius d qp (1 + δ ) , where d qp is the veriﬁed radius and δ is a tiny offset.
Additionally, we check in each step whether the next anchor point is already misclassiﬁed before the condition c ≤ c tol is reached (this can happen in a multi-class setting; and is indeed observed frequently).
We empirically veriﬁed that all points obtained this way are indeed true adversarials.
This means that the sequence of anchor points converges towards the boundary and then, if no adversarial point was found yet, makes a step across the boundary using a positive, small δ .
Note, while the most powerful attacks as proposed by Carlini and Wagner (2017) were empirically shown to succeed for every considered sample, their success in not guaranteed and might require tuning of hyper-parameters.
In contrast, we provide a formal proof of our method’s convergence below.
[Equation]
Figure 2 illustrates how the constructed sequence of anchor points and solutions of QPRel might look like for the setting of Figure 1.
Here only the ﬁrst three steps are shown assuming that we would reach either a small value for the propagation gap or an adversarial point in the last step.
Blue arrows show how we proceed from the solution of QPRel to the next anchor point in each iteration (compare to the update formula from
Algorithm 1, line 8).
Convergence The following result holds for the convergence rate of Algorithm 1 under the assumption that the propagation gap c ( x, λ ) is not too large with respect to the optimal objective function value for the QPRel problem solved in each step.
Theorem 2.
For k = 0 , 1 , . .
let c k be the propagation gap as deﬁned in (7) and d 2 k the optimal objective function value we obtain after solving QPRel in the k ’th iteration of Algorithm 1.
Assume that there exists α ∈ [0 , 1] such that for all k the following holds.
[Equation]
where x 0 is the anchor point and x qp is the optimal solution of QPRel in iteration k
(we omit the iteration index k on x ’s).
Then for all k
[Equation]
Furthermore, if α > 12 then the number of iterations ¯ k such that Algorithm 1 terminates with c ¯ k ≤ c tol is bounded by
[Equation]
First of all, this result ensures that Algorithm 1 terminates after a ﬁnal number of steps if (10) holds for some α ∈ ( 12 , 1] .
Moreover, it provides a hint about how many iterations we would have to do if we decreased the threshold c tol by a factor of 10 .
In this case the upper bound (12) on the number of iterations would increase by ∆ k α = − (log 2(1 − α ))
− 1 with ∆ k α → ∞ when α → 12 and ∆ k α → 0 when α → 1 .
Note that α being almost 1 means that c k is close to 0.
In this regime the relaxation is exact, as discussed in Lemma 1, part 1.
Therefore, considering α as a measure of tightness of the relaxation QPRel we can conclude that, when the relaxation is tight (i.e. α ≈ 1 ), decreasing c tol by an order of magnitude will not be as costly as when α is smaller.
Related work In relation to the methodology proposed in this section we consider the work on exact
DtDB computation by Jordan et al.
The proposed algorithm GeoCert iteratively computes the radius of the largest l p -ball that stays within a certain polyhedral complex.
The latter is incrementally updated in each step until the decision boundary is reached.
This way one get a sequence of lower bounds on DtDB until the true distance is found.
GeoCert is signiﬁcantly different to our method: 1.)
It does not employ a relaxation of (DtDB).
It does not change the anchor point, but rather expands the considered polyhedral complices by analyzing the linear regions of a ReLU classiﬁer.
While it can use an upper bound to speed up the algorithm, the complexity of computing its own exact distance is comparable to MIP-based approaches as shown in Jordan et al.
E XPERIMENTS 5. S ETUP
The values of the parameters we used as well as the runtime of the compared algorithms is shown in
Appendix B.1 and B.2.
To solve the QP tasks we use Gurobi Optimization (2018).
Datasets and classiﬁers The experiments are performed using the MNIST and Fashion-MNIST datasets scaled such that the feature values lie in [0 , 1] interval.
For each of the datasets we use the correctly classiﬁed samples from 1200 train points (label distribution preserved) to evaluate the veriﬁcation approaches.
The exact number of used samples is reported for each experiment in
Appendix D.
For classiﬁcation we take ReLU networks consisting of dense linear layers.
The architectures we used are named by the number of hidden layers and the number of neurons per hidden layer: L1N50 ,
L2N50 , L3N50 , L4N50 , L5N50 and L1N300 with the same number of neurons in each hidden layer.
For each architecture we use normally trained classiﬁers as well as robustly trained ones (indicated by sufﬁx R , e.g. L1N50R ) using the method by Wong and Kolter (2018) with (cid:15) = 1 . 58 in l 2 -setting.
The weights will be available in the project repository.
Competitors We compare our approach QPRel with the following (cid:15) -veriﬁcation methods: ConvAdv by Wong and Kolter (2018) based on the LP relaxation of ReLU constraints (we use its implementation supporting the l 2 -norm by Croce et al.
, CROWN by Zhang et al.
(2018) which is a layerwise bound propagation technique including performance boosting quadratic approximations and warm start (for each setting we report only the best result from these two competitors), and SDPRel by
Raghunathan et al.
(2018b)
based on a SDP relaxation solved by MOSEK.
Finally, we take the iterative PGD attack with 200 steps and a step size of 2 . 5 (cid:15)/ 200 (in accordance with Madry et al.
as a competitor for QPRel-UB.
We use the notation QPRel-LB or QPRel-UB, when we want to emphasize what bounds are meant.
5. R ESULTS
Results on MNIST in l 2 -setting are shown in Table 1.
We include the complete results in Appendix
D. We run all methods for each of the considered samples and report the following metrics.
AvgBound :
The average value of the bounds obtained from QPRel and the corresponding competitor.
Both lower and upper bounds are reported separately.
MedRelDiff to QPRel : The median of the relative difference between the bounds (e.g. QPRel-LB minus CROWN and then divided by CROWN).
Positive values for the lower bounds mean our bounds are better in average over the samples; negative values are better for the upper bounds.
(cid:15) to hit 50% LB-veriﬁed : The number of samples with an adversarial-free radius of (cid:15) is monotonically decreasing in (cid:15) .
Therefore, to assess the performance of a veriﬁcation procedure like QPRel-LB or
CROWN we report the smallest (cid:15) such that exactly 50% of the samples can be veriﬁed.
The larger this value, the better.
VerRatio worst : While the previous metric only considers the lower bound, we can consider both bounds (LB, UB) jointly by evaluation the veriﬁcation ratio : For a given (cid:15) , it corresponds to the fraction of samples for which we can either prove that the (cid:15) -neighborhood is adversarial-free or contains a misclassiﬁed point in it.
In short: either the lower bound is larger then (cid:15) or the upper bound is smaller then (cid:15) .
Note, that for very small (cid:15) values almost all samples will be veriﬁed as (cid:15) -robust by any algorithm providing non-trivial lower bounds.
On the other side, when (cid:15) is large, attacks will be able to ﬁnd an adversarial that is even closer to the anchor and verify almost every sample as (cid:15) -non-robust.
Between these two extremes, the veriﬁcation ratio drops to its minimum for a certain value of (cid:15) 0 .
In this setting, the considered algorithm is able to verify the smallest fraction of samples – that is, it corresponds to the worst case performance of the bi-directional veriﬁcation method.
We report this smallest fraction in the table, denoted with VerRatio worst .
The larger, the better.
MedRelDiff UB-LB : Lastly, we report the median of the relative difference between the different bounds for each approach (QPRel-UB vs. QPRel-LB or PGD vs. CROWN/ConvAdv).
It shows the tightness of the certiﬁcates when compared to the upper bounds.
The smaller, the better.
[Table]
3/50/R
QPRel 1.
3/50/R
ConvAdv+PGD 1.
QPRel 0.
ConvAdv+PGD 0.
4/50/R
QPRel 0.
142.5 4/50/R
ConvAdv+PGD 1.
QPRel 0.
ConvAdv+PGD 0.
5/50/R
QPRel 0.
357.0 5/50/R
ConvAdv+PGD 1.
QPRel 0.
CROWN+PGD 0.
+149.
1/300/R
QPRel 0.
[Table]
State-of-the-art bounds For the normally trained networks with a smaller number of hidden layers the lower bounds computed by QPRel are tighter in comparison to the competitors in average and for most individual images (see Table 1, AvgBound and MedRelDiff ).
This results in larger values of (cid:15) to hit 50% VerRatio as well.
It seems that the competitors tend to underestimate robustness of these networks.
For example, for 50% of the MNIST images classiﬁed with L1N300 we have improved the lower bound from CROWN by over 149%.
This discrepancy in the quality of the lower bounds decreases with network’s depth and if it was trained using the robust training approach by Wong and Kolter (2018) so that the competitors outperform QPRel’s lower bound for robustly trained deep networks.
Noteworthy, the upper bounds derived via QPRel always outperform the one computed by the competing methods – independent of the neural network architecture and the training procedure.
That is, the 200-step PGD attack was not able to construct adversarial examples that are closer to the anchor point then those found by QPRel-UB as described in Section 4 in all settings (see Table 1, columns AvgBound/UB and MedRelDiff to QPRel/UB ).
Therefore, in the settings where the bounds from QPRel-LB are also tighter as the competitors’ we get a much higher VerRatio worst value and smaller MedRelDiff UB-LB that ensure the good quality of QPRel-LB bounds without computing the
DtDB exactly.
For example, for L2N50 the gap between QPRel-LB and QPRel-UB vanishes resulting in VerRatio worst of over 99%.
That means the computed lower bound is almost the exact DtDB for the majority of the samples.
Note that no exact method computing DtDB via MIP techniques is used to achieve that.
For larger networks we observe a decay of VerRatio worst and looser MedRelDiff
UB-LB .
Comparison with SDP-relaxations in l ∞ -setting
In order to compare our method with Raghunathan et al.
(2018b) we generalize QPRel to the l ∞ -setting as described in Appendix A. Note, that the resulting relaxation is looser then the initial QPRel for the l
-setting since we introduce an additional penalty term to make the problem convex.
That leads to worse results shown in Tables 9 and 10.
To compute the largest (cid:15) such that the SDP veriﬁcation succeeds we perform a binary search between the lower bounds d qp computed by QPRel-LB and d max = 1 . 0 which is the maximal perturbation for the l ∞ -norm on images.
Since this approach takes longer to run we test it only on the L1N50R net trained with (cid:15) = 0 .
1 (MNIST test data).
Further, we speed up this approach by modifying MOSEK parameters (see Table 6 for details) such that the optimization procedure terminates earlier (approximately after a half of the usual number of iterations).
We can still rely on the obtained results since we are not interested in the exact value of the SDP objective, but only whether it is positive or negative which was observed to be determined far sooner during the solution process then when the solver would reach a true optimum.
While QPRel-LB in this setting is able to provide tighter bounds then the LP-based approaches for larger computational cost, our bounds are about 1.54 times larger then the ones of SDPRel (see Table 10) – though computed three orders of magnitude faster (see Appendix B.2).
This shows that the QP relaxation is less suited then SDPRel for obtaining tight bounds in l ∞ -setting as already indicated by the arguments above and in Appendix A but trades this off by much better efﬁciency.
C ONCLUSION
In this work we present a novel approach to solve the problem of approximating the minimal adversarial perturbations for ReLU networks based in a convex QP relaxation of DtDB.
We show that the lower bounds computed with QPRel improve the results of the available LP based methods and allow certiﬁcation of larger neighborhoods.
Since convexity of the underlying QP determines computational efﬁciency of our approach we derive the necessary and sufﬁcient conditions on the
Lagrangian multipliers for it.
Additionally, a method that constructs a sequence of points converging to the point on the decision boundary provides us upper bounds on DtDB.
Quality of the obtained bounds in the l 2 -setting is shown to be good enough to verify consistently over 80% of the considered samples for MNIST and FashionMNIST data and simple networks for all values of the perturbation magnitude, while competitors’ veriﬁcation ratio might drop below 20%.
With our contribution we make a step towards robustness veriﬁcation of deep ReLU-based classiﬁers.
To be able to apply the approach on a wider class of networks it should be generalized to popular architectures beyond ReLU activations and linear layers.
Moreover, for deeper networks the proposed relaxation was shown to provide looser bounds than the other methods indicating an important direction of the future work.
Furthermore, there are several points about Theorem 2 that will be addressed in our future work.
It is an open question how to verify (10) a priori.
Experiments show that for the current choice of λ (see the discussion after Theorem 1) this condition does hold for small networks, but not for the larger ones.
A G ENERALIZATION TO l ∞
For comparison with Raghunathan et al.
(2018b) we show how our method can be applied to compute bounds on the distance to the closest adversarial measured using the l ∞ norm.
A straight forward way would be to modify the objective function accordingly.
By introducing a new variable m representing (cid:107)
[Equation]
−
[Equation]
i | 2 and n 0 new quadratic constraints we get the following versions of QPRel.
Note that the quadratic constraints do not harm the complexity since they describe a convex cone and can be handled by the QP-solvers including gurobi .
[Equation]
While this formulation is of a similar structure as the QPRel (quadratic objective and linear plus quadratic constraints), the Hessian of the objective function is not positive semi-deﬁnite for any value of λ .
Since c ( x, λ ) is the only source of quadratic terms now (squared distance to the anchor point is now replaced by m ), the new M λ is of the same form as in Lemma 2, but with λ 0 = 0 .
To see that we cannot affect the convexity of the objective function by the parameter λ anymore consider vector x with an arbitrary x 0 ∈ R n 0 , x 1 = αW 1 x 0 with 0 < α < 1 and x l = 0 for l > 1 .
Then
[Equation]
meaning that M λ cannot be positive semi-deﬁnite.
To overcome this issue we utilize the new quadratic constraints.
We return back to a convex QP by considering the following problem with a positive µ .
[Equation]
Clearly, for 0 < µ ≤ n − 1 0 the solution of this problem is a ﬁnite lower bound on DtDB with the l ∞ -norm.
On the other side we are back in the setting of Theorem 1 with λ 0 =
µ allowing us to use the same framework as before.
Results in the l ∞ -setting were obtained by solving this problem with µ = (2 n 0 ) − 1 .
B E XPERIMENTS S ETUP AND R UNTIME B. S ETUP
λ is chosen for each classiﬁer according to Theorem 1 and the discussion afterwards such that an accuracy level of 10 − 4 is achieved during the binary search in each λ l .
For the values of other parameters in Algorithm 1 we choose for all tests c tol = 10 − 4 and δ = 10 − 4 .
Other methods are tested with the default settings as provided in the corresponding repositories.
B. R UNTIME AND N UMBER OF I TERATIONS
Tables 2, 3, 4 and 5 show the average runtime and its standard deviation for networks L1N50R,
L1N100, L1N300 and L2N100 as well as the number of iterations Algorithm 1 needs to terminate.
During the binary search procedure we apply with SDPRel we always make 10 bisection steps.
All tasks necessary for the computation of bounds on DtDB for one sample are run on a single CPU (including the solution of QPs and SDPs with Gurobi Optimization (2018) and MOSEK respectively).
Here, we do not consider ConvAdv as CROWN performs always faster.
From the comparison of the time for the computation of our lower bounds (column Runtime-LB (s) ) and the overall runtime (column Runtime (s) )
we conclude that obtaining the upper bounds takes n − 1 times longer than solving the initial QP where n is approximately the overall number of the iterations in Algorithm 1.
While in almost all considered settings n remains smaller than 4 it might become a limiting factor when applying QPRel-UB on larger networks.
That means further investigation of the convergence properties of Algorithm 1 is necessary for generalizing the described method.
From the comparison of QPRel-LB and CROWN we see the clear advantage of the latter since it doesn’t involve any optimization task.
However, this advantage comes in cost of the veriﬁcation properties as discussed above.
On the other hand, SDPRel with a binary search provides better bounds, but is abouttimes slower then QPRel-LB (see the last line in the MNIST section in Table 5)
[Table] [Table]
QPRel 0.
CROWN 0.
F - M
N I S
T 1/
QPRel 1.
CROWN 0.
QPRel 0.
CROWN 0.
QPRel 5.
[Table]
CROWN 0.
[Table] [Table]
CROWN
[Table] [Table]
QPRel 0.
[Table] [Table]
[Table] [Table]
[Table]
CROWN 0.
QPRel 5.
CROWN 0.
QPRel 0.
CROWN 0.
F - M
N I S
T 1/
QPRel 1.
CROWN 0.
QPRel 0.
CROWN 0.
QPRel 5.
CROWN 0.
[Table] [Table]
M N I
S T 1/
[Table]
QPRel
[Table] [Table]
CROWN
[Table] [Table]
QPRel
[Table] [Table]
CROWN
[Table] [Table]
[Table]
QPRel 10.
[Table] [Table]
[Table] [Table]
CROWN 0.
QPRel
[Table] [Table]
[Table] [Table]
CROWN 0.
[Table]
SDPRel 4338.
F - M
N I S
T 1/
QPRel 5.
CROWN 0.
QPRel
[Table] [Table]
CROWN 0.
QPRel 10.
CROWN 0.
C P ROOFS
Lemma 1.
Denote the solution of QPRel by x qp and the square root of its optimal objective value by d qp , let d be the square root of the optimal objective value of DtDB.
The following holds:
d qp ≤ d
and when c ( x, λ ) =
we have d qp = d and x is optimal for DtDB.
For two non-negative λ 1 , λ 2 with λ 1 ≤ λ 2 elementwise it holds that d qp ( λ 1 ) ≤ d qp ( λ 2 ) .
Proof.
Assume x
adv is the optimal solution of DtDB.
Then it is an admissible point of QPRel as well and c ( x adv , λ ) =
since x l adv =
W l x l − 1 adv for l = 1 , . . .
, L − 1 .
Since x qp is optimal for QPRel and x adv is just its admissible point we get that
[Equation]
proving the ﬁrst claim.
The second one follows from the fact that c ( x, λ ) for a given x is a linear function of λ :
[Equation]
 where each c ( x, e l ) =
[Equation]
+ b l (cid:1)(cid:1) is non-negative for admissible x because of the non-negativity constraints (4).
Therefore the claim follows immediately from the assumption that λ 1 l ≤ λ 2 l for all l
[Equation]
Lemma 2.
Objective function of QPRel can be reformulated as
[Equation]
where terms ¯ b and ¯ c don’t depend on x .
Proof.
The proof is done by sorting the quadratic, linear and constant terms in the objective function of the initial formulation.
[Equation]
[Table]
[Equation]
x
[Equation]
(cid:124) (cid:123)(cid:122) (cid:125)
[Table]
From the quadratic term we can identify now the blocks of M λ diagonal: M
[Equation]
l
[Equation]
λ l
[Equation]
sub-diagonal:
[Equation]
λl
[Equation] [Equation]
Theorem 1.
Let W 1 , . . .
, W L − 1 be the weights of an arbitrary pre-trained neural net and (cid:107) W (cid:107) the spectral norm of an arbitrary matrix.
Then the following two conditions for λ provide correspondingly a sufﬁcient and a necessary criterion for the matrix M λ to be positive semi-deﬁnite.
[Equation]
Further, we deﬁne ¯ λ and ¯ λ that correspondingly satisfy conditions (8) and (9) with equality:
[Equation]
In case with a single hidden layer M λ with λ = ¯ λ from (9) is guaranteed to be positive-semi deﬁnite.
Proof.
Let the assumptions hold and x be an arbitrary vector from R n .
First we prove the sufﬁcient condition by deriving a lower bound on x T M λ x that is non-negative if (8) holds.
[Equation]
where we applied the sub-multiplicativity property of the spectral norm, i.e. (cid:107) W l x l − 1 (cid:107) ≤
[Equation]
W l
[Equation]
x l − 1 (cid:107) , to obtain the last inequality.
We see that under the assumption (8) on λ and W ’s it holds that
[Equation]
To prove the necessary condition consider for each l = 1 , . .
, L − 1 a special vector ˜ x
(we don’t explicitly label it as dependent on l to avoid overloaded notation) which is everywhere zero except
[Equation]
For M λ in order to be positive semi-deﬁnite it has to satisfy
[Equation]
which results in the necessary condition (9) as stated above.
It remains to prove the sufﬁciency of (9) if the considered network contains one hidden layer.
For that we can reuse the last computation and obtain now for an arbitrary x ∈ R n that
[Equation]
Theorem 2.
For k = 0 , 1 , . .
let c k be the propagation gap as deﬁned in (7) and d 2 k the optimal objective function value we obtain after solving QPRel in the k ’th iteration of Algorithm 1.
Assume that there exists α ∈ [0 , 1] such that for all k the following holds.
[Equation]
where x 0 is the anchor point and x qp is the optimal solution of QPRel in k ’s iteration (we omit the iteration index k on x ’s).
Then for all k
[Equation]
Furthermore, if α > 1 2 then the number of iterations ¯ k such that Algorithm 1 terminates with c ¯ k ≤ c tol is bounded by
[Equation] [Equation]
Proof.
First, we prove that given (10) it holds that d 2 k +1 ≤ 2(1 − α )
d 2 k .
We denote the anchor point in iteration k as x 0 and the optimal solution for QPRel with that anchor point as x qp .
The corresponding objects in the next iteration k + 1 are denoted by y 0 and y qp .
Then according to the choice of the next anchor point (see Algorithm 1, line 8)
[Equation] [Equation]
and it follows that
[Equation]
Now, applying this relation on every two subsequent iterations up to the k
’s we obtain (here we use 1 − α
=
(1 + α )(1 − α ) ≤ 2(1 − α ) to get the last inequality)
[Equation]
It remains to prove the last inequality (12).
Note that for 1 ≥ α > 12 the derived upper bound on c k is monotonically decreasing and converges to 0 as k → ∞ since 0 ≤ 2(1 − α ) < 1 .
Therefore, to ﬁnd the ﬁrst k such that the upper bound on c k becomes smaller or equal c tol we have to solve the equation
c tol =
(2(1 − α ))
k +
d 20 for k resulting in the upper bound on k as claimed in (12).
D T ABLES
[Table] [Table]
Setting
MedRelDiff (cid:15) to [Table]
VerRatio
MedRelDiff
Data
L/N
NrPts
Method to [Table] [Table] LB
[Table] worst [Table]
[Table]
UB-LB (%
[Table]
M N I
S T 1/
QPRel-LB – 0.
CROWN+FGSM +84.
QPRel-LB – 1.
ConvAdv+FGSM +30.
QPRel-LB – 0.
CROWN+FGSM +154.
QPRel-LB – 0.
CROWN+FGSM +68.
F - M
N I S
T 1/
QPRel-LB – 0.
CROWN+FGSM +50.
QPRel-LB – 0.
ConvAdv+FGSM +71.
QPRel-LB – 0.
CROWN+FGSM +59.
[Table]
[Table]
[Table]
[Table]
[Table]
Data
[Table]
M N I
S T 1/
QPRel-LB – 0.
[Table]
[Table]
[Table]
CROWN+FGSM +33.
QPRel-LB – 0.
ConvAdv+FGSM +16.
QPRel-LB – 0.
CROWN+FGSM +105.
QPRel-LB – 0.
CROWN+FGSM +2.
SDPRel+FGSM -54.
F - M
N I S
T 1/
QPRel-LB – 0.
CROWN+FGSM +5.
QPRel-LB – 0.
ConvAdv+FGSM +18.
QPRel-LB – 0.
CROWN+FGSM +12.