Zonotope Domains for Lagrangian Neural Network Veriﬁcation
Abstract
Neural network veriﬁcation aims to provide provable bounds for the output of a neural network for a given input range.
Notable prior works in this domain have either generated bounds using abstract domains, which preserve some dependency between intermediate neurons in the network; or framed veriﬁcation as an optimization problem and solved a relaxation using Lagrangian methods.
A key drawback of the latter technique is that each neuron is treated independently, thereby ignoring important neuron interactions.
We provide an approach that merges these two threads and uses zonotopes within a Lagrangian decomposition.
Crucially, we can decompose the problem of verifying a deep neural network into the veriﬁcation of many 2-layer neural networks.
While each of these problems is provably hard, we provide efﬁcient relaxation methods that are amenable to efﬁcient dual ascent procedures.
Our technique yields bounds that improve upon both linear programming and Lagrangian-based veriﬁcation techniques in both time and bound tightness.
Introduction
With the growing prevalence of machine learning in real-world applications the brittleness of deep learning systems poses an even greater threat.
It is well-known that deep neural networks are vulnerable to adversarial examples, where a minor change in the input to a network can cause a major change in the output [1].
There is a long history of defense techniques being proposed to improve the robustness of a network, only to be completely broken shortly thereafter [2].
This has inspired researchers to focus instead on neural network veriﬁcation , which, for a given network and a range of input, aims to verify whether a certain property is satisﬁed for every input in that range.
A typical adversarial attack seeks to minimize the output of a scalar-valued network subject to certain input constraints.
Veriﬁcation provides lower bounds on the minimum output value achievable by such an adversary.
Concretely, for a scalar-valued network f and input range X , veriﬁcation provides lower bounds to the problem min x ∈X f ( x ) .
As observed in [3], prior works in veriﬁcation can be broadly categorized into primal and dual views.
In the primal view, convex relaxations are applied to attain, for every intermediate layer of the network, a convex superset of the true attainable range.
For example, if f = f L ◦ · · · ◦ f 1 , convex sets Z k are obtained such that { f k ◦ · · · ◦ f 1 ( x ) | x ∈ X} ⊆
Z k for k ∈ { 1 , . . .
, L } .
[Table]
Under the dual lens, veriﬁcation is treated as a stagewise optimization problem and Lagrangian relaxation is applied to yield a dual function that always provides valid lower bounds.
Often, this dual function is decomposable into a sum of minimization problems which are efﬁciently computable.
One hallmark of all existing dual veriﬁcation techniques is that intermediate bounds Z k are required.
In this case, either an efﬁcient primal veriﬁcation algorithm must ﬁrst be applied or, for example, the dual veriﬁer can be run iteratively on each neuron to provide upper and lower bounds for each intermediate layer.
Our approach is an attempt to combine the primal and dual threads of veriﬁcation.
We ﬁrst apply a primal veriﬁcation algorithm that generates bounds on the attainable range of each intermediate layer.
To do this we leverage zonotopes, a more expressive class of polytopes than axis-aligned hyperboxes.
Notably, we offer an improvement to existing zonotope bounds when we are also provided with incomparable hyperbox bounds.
These zonotopic intermediate bounds are then applied to a dual veriﬁcation framework, for which dual ascent can be performed.
Our formulation may be viewed as taking the original nonconvex veriﬁcation problem and decomposing it into many subproblems, where each subproblem is a veriﬁcation problem for a 2-layer neural network.
However, as even verifying a 2-layer network is hard in general, we further develop efﬁcient relaxation techniques that allow for tractable dual ascent.
We introduce a novel algorithm, which we call ZonoDual, which i ) is highly scalable and amenable to GPU acceleration, ii ) provides tighter bounds than both the prior primal and dual techniques upon which our approach is built, iii ) is highly tunable and able to effectively balance the competing objectives of bound tightness and computation speed, and iv ) is applicable as an add-on to existing dual veriﬁcation frameworks to further boost their performance.
We apply ZonoDual to a variety of networks trained on MNIST and CIFAR-10 and demonstrate that ZonoDual outperforms the linear programming relaxation in both tightness and runtime, and yields a tighter bounding algorithm than the prior dual approaches.
We ﬁrst discuss prior works in the veriﬁcation domain.
Then, we examine the existing dual framework that serves as the backbone for our algorithm, paying particular attention to the areas in which this may be tightened.
Then, we discuss how we attain zonotope-based intermediate bounds and introduce the fundamental sub-problem required by our dual ascent algorithm.
Ultimately, we combine these components into our ﬁnal algorithm and demonstrate the scalability and tightness of our approach on networks trained on the MNIST and CIFAR-10 datasets.
Related Work
Neural network veriﬁcation is a well-studied problem and has been approached from several angles.
Exactly solving the veriﬁcation problem is known as complete veriﬁcation , and is known to be
NP-hard even for 2-layer ReLU networks [4].
Complete veriﬁcation approaches include mixedinteger programs, satisﬁability modulo theories (SMT), geometric procedures, and branch-and-bound techniques [5, 6, 7, 4, 8, 9, 10].
In particular, branch-and-bound procedures generate custom branching rules to decompose veriﬁcation into many smaller subproblems, which can be relaxed or further branched, allowing the algorithm to focus its efforts on the areas for greatest improvement [11, 12].
We stress that this current work focuses only on the ‘bound’ phase, and our approach may be applied to branched subproblems.
Often it is not necessary to exactly solve the veriﬁcation problem, and only providing a lower bound to the minimization problem can sufﬁce.
This is known as incomplete veriﬁcation .
We closely examine the primal and dual veriﬁcation threads, but ﬁrst mention a few lines of work that do not ﬁt neatly into this paradigm: notable approaches here include semideﬁnite programming relaxations [13, 14], or veriﬁcation via provable upper bounds of the Lipschitz constant [15, 16, 17, 18].
Primal veriﬁcation: A general theme in primal veriﬁcation techniques is to generate convex sets that bound the attainable range of each intermediate layer.
The simplest such approach is interval bound propagation (IBP) which computes a bounding hyperbox for each layer [19].
A more complex approach is to bound each intermediate layer with a polytope.
Several different polyhedral relaxations are available, with DeepPoly being on the lesser-complexity side, PLANET being the canonical triangle relaxation, and the formulation by Anderson et.
al being tightest albeit with exponential complexity [20, 21, 7].
Zonotopes provide a happy medium, being both highly expressive and computationally easy to work with [22, 23].
We will discuss zonotope relaxations more thoroughly in section 4.
Dual veriﬁcation: Orthogonal to the primal approaches exist several works which consider veriﬁcation by relaxations in a dual space [24, 25, 12, 26, 27].
Here, veriﬁcation is viewed as an optimization problem with constraints enforced by layers of the network.
The general scheme here is to introduce dual variables penalizing constraint violation, and then leverage weak duality to provide valid lower bounds.
The standard Lagrangian relaxation was ﬁrst proposed in [24], and then several improvements have been made to provide provably tighter bounds, faster convergence, or generalizations of the augmented lagrangian.
These techniques are highly scalable and notably, one recent work has been able to provide bounds tighter than even the standard LP relaxation [9].
Our approach will follow a similar scheme, but differs fundamentally from prior works in that we operate over a tighter primal domain and can therefore provide tighter bounds.
Lagrangian Decomposition
Problem Deﬁnition: In a canonical neural network veriﬁcation problem, we are given a scalarvalued feedforward neural network, f ( · ) , composed of L alternating compositions of afﬁne layers and elementwise ReLU layers.
We name the intermediate representations as z 0 . . .
z L , and are supplied with a subset, X , of the domain of f ( · ) , which we assume to be an axis-aligned hyperbox.
Veriﬁcation is then written as an optimization problem
[Equation]
where σ denotes the ReLU operator applied elementwise, and each W k is the weight of an afﬁne or convolutional layer.
Our formulation is also amenable to bias terms everywhere, though we omit these throughout for simplicity.
Dual veriﬁcation: While there are several veriﬁcation approaches leveraging Lagrangian duality, we consider the Lagrangian decomposition formulation introduced in [25].
Here, each primal variable z k of the veriﬁcation problem is replaced by a pair of primal variables z Ak , z
Bk , along with accompanying equality constraints, yielding an equivalent optimization problem:
[Equation]
By introducing unconstrained dual variables ρ k for each constraint in Equation (2d) and maximizing over ρ k [Equation] we attain an optimization problem that is equivalent to the original.
To tractably solve this [Equation] two relaxations are performed.
First, weak duality is applied by swapping the max and min [Equation] which introduces the dual function g ( ρ ) [Equation]
for which every value of ρ provides a lower bound:
[Equation]
The goal now is to solve max ρ g ( ρ ) .
The dual function can be decomposed into L subproblems by substituting equality constraints and rearranging the objective function:
[Equation]
In its current state, it is unlikely that g ( ρ ) for nonzero ρ will lead to any ﬁnite lower bound as
each z
Bk is unconstrained.
In other words, only subproblem, (4a), has any information about the input constraint ( x 0 ∈ X ) .
To remedy this, one can tighten the dual optimization by imposing intermediate bounds on
z
Bk ’s, so long as those bounds include all feasible values.
Speciﬁcally, for each z
Bk , we can impose a bounding set Z k , as long as the following implication holds:
[Equation]
All prior dual approaches have chosen the sets Z k to be axis-aligned hyperboxes for two reasons.
First, it is extremely efﬁcient to attain hyperbox bounds at every layer.
Second, when Z k is a hyperbox, the dual function can be evaluated efﬁciently by further decomposing each component of the dual along its coordinates.
Equipped with intermediate bounds Z k , and noting that g ( ρ ) is a concave function of ρ , the standard procedure is to perform dual ascent on g ( ρ ) .
This requires gradients ∇ ρ g ( ρ ) , which can easily be computed as the primal residuals.
Letting z
A ∗ k and z B ∗ k be the argmin of the dual function, then ∇ ρ k g ( ρ ) =
z A ∗ k − z B ∗ k .
The key innovation in this work is to replace the intermediate bounds Z k with zonotopes everywhere.
In this case, intermediate bounds may easily be computed as we will see in the next section.
Zonotopes have a distinct advantage over hyperboxes in that every coordinate is no longer independent, and therefore neuron dependencies are encoded.
This further constrains the feasible set of the dual function and leads to larger dual values.
However, this comes with the cost that the dual function is more computationally difﬁcult to evaluate.
Zonotopes
We start with a review of zonotopes and how they may be used to attain intermediate bounds.
Then we introduce the problem of ReLU programming, tie it to the dual decomposition formulation, and discuss our relaxations for efﬁcient dual evaluation.
Proofs of all claims are contained in the appendix.
Zonotope Properties: Zonotopes are a class of polytopes, which we formally deﬁne using the notation Z ( c, E ) to refer to the set
[Equation]
, E ) : = { c + Ey | y ∈ [ − 1 , 1] m } where c ∈ R d is called the center , and E ∈ R d
× m is called the generator matrix .
Each column of the generator matrix is a line segment in R d , and Z ( c, E ) can be equivalently be viewed as the
Minkowski sum of each generator column offset by c ; or as the afﬁne map y → c + Ey applied to the (cid:96) ∞ ball in R m .
In particular, note that a hyperbox is a zonotope with a diagonal generator matrix.
Zonotopes have several convenient properties:
Efﬁcient Linear Programs: Linear programs can be solved in closed form over a zonotope:
[Equation]
Closure under afﬁne operators and Minkowski sums: given an afﬁne map x
→ Wx + b , the set { Wz + b | z ∈ Z ( c, E ) } is equivalent to the zonotope Z ( Wc + b, WE ) .
The Minkowski sum of two sets A, B is deﬁned as A ⊕ B := { x + y | x ∈ A, y ∈ B } .
Letting E 1 || E 2 denotes concatenation of columns, the Minkowski sum of two zonotopes Z ( c 1 , E 1 ) , Z ( c 2 , E 2 ) is also a zonotope:
[Equation]
Intermediate Bounds with Zonotopes: Prior work has developed efﬁcient techniques to generate intermediate layer bounds using zonotopes for feedforward neural networks.
The details are deferred to the appendix, and we can assume that we have access to a black box that, given a zonotope Z , is able to generate a zonotope Y such that { σ ( z ) | z ∈ Z} ⊆ Y .
Such an operation is called a sound pushforward operator .
One such pushforward operator is known as DeepZ and can be applied repeatedly to provide valid zonotopic bounds for every intermediate layer of the neural network [22].
We make two observations regarding these intermediate bounds here:
Proposition 4.1.
Let Z k be the k th zonotope bound provided by the DeepZ procedure, and let H k be the k th intermediate bound provided by the Kolter-Wong dual procedure [20].
Then the smallest hyperbox containing Z k is exactly H k .
Proposition 4.2.
Suppose Z is a zonotope and H is a hyperbox, such that Z (cid:54)⊆ H .
Then we can develop a sound pushforward operator for the ReLU operator that outputs a zonotope Z (cid:48) containing the ReLU of every element of Z ∩H , with the property that Z (cid:48) (cid:40)
DeepZ ( Z ) .
The ﬁrst proposition states that a common technique for generating intermediate hyperbox bounds is never any tighter than the procedure we use to generate intermediate zonotope bounds.
The second proposition describes an improved pushforward operator that offers improvements against DeepZ but requires extra information provided by a hyperbox.
ReLU Programming: We return our attention to the dual function introduced in equations Equations (4a) and (4b).
Note that the ﬁrst term of Equation 4a is a linear program of a zonotope which can be solved extremely efﬁciently, while all other terms adopt a form we refer to as a ReLU program
Deﬁnition 4.1.
Given a set Z ⊆ R d , and two objective vectors c 1 , c 2 ∈ R d , we say the ReLU
Program is the optimization problem
[Equation]
ReLU programming is nonconvex for general c 2 .
When Z is an interval, only the endpoints, or 0 if it is contained in the interval, are candidate optima.
In this case, the ReLU program may be solved by evaluating the objective at each candidate.
When Z is a hyperbox in R d , each coordinate can be considered independently, amounting to solving d ReLU programs over intervals.
The story quickly becomes more complicated if Z is a zonotope:
Theorem 4.1.
When Z is a zonotope, solving a ReLU program over Z is equivalent to a neural network veriﬁcation problem for a 2-layer network, which is known to be NP-hard.
Remarks: This theorem implies that solving ReLU programs over more complex sets, such as polytopes in general, is also NP-hard.
However it remains an open question whether solving ReLU programs over other simpler sets such as parallepipeds, i.e. zonotopes with an invertible generator matrix, is hard.
Note that ReLU programs can be solved exactly via a Mixed-Integer Program (MIP) using the standard form for encoding a ReLU [5].
We pause here to observe the current situation.
Lagrangian methods for veriﬁcation ﬁrst make a relaxation by applying weak duality.
When using zonotopes for the intermediate bounds, one is able to decompose the very large non-convex optimization problem of deep network veriﬁcation into many smaller subproblems which are equivalent to two-layer network veriﬁcation problems.
Unfortunately, each of these subproblems is also NP-hard, and thus must be further relaxed to attain tractability.
Zonotope Partitioning: The primary relaxation technique we consider comes from the following observation.
Consider a d -dimensional zonotope Z and ReLU programming objectives ( c 1 , c 2 ) .
Then, for any partition S 1 ∪ · · · ∪ S n of { 1 , . . .
, d } , the inequality
[Equation]
holds.
This approach has a nice geometric interpretation as well.
The decomposed minimization min z ∈Z (cid:80) i ∈ S j
[Equation] c 1 ,i z i + c 2 ,i σ ( z i ) (cid:1) can be viewed as optimization over Z when it has been projected onto the linear subspace spanned by the elements of S j .
Projection onto a linear subspace is an afﬁne operator, so each projection of Z is itself a zonotope.
Indeed, the projection onto the linear subspace spanned by S j is simply the center and generator rows indexed by S j .
Observe that if each S j were a singleton set, then decomposing the ReLU program according to these
S j ’s is equivalent to relaxing the ReLU program by casting Z to the smallest containing hyperbox.
If the partition were the trivial partition { 1 , . . .
, d } , then Z remains unchanged.
Finally, notice that the
Minkowski sum of every projection of Z is itself a zonotope.
In this sense, by choosing any partitioning of coordinates, we are able to relax Z into a zonotope that is simultaneously a superset of Z and a subset of the hyperbox-relaxation of Z .
This is optimistic for our dual ascent procedure, as any partitioning restricts the primal feasible space for the dual function evaluation.
It is in this way that we are able to interpolate the coarseness of our relaxation, which is directly controlled by the coarseness of our partitioning.
Because we expect the complexity of solving a ReLU program over a zonotope to be superlinear in the dimension, shattering a zonotope in this fashion can drastically improve the complexity of solving a relaxation of a ReLU program.
Two-dimensional Zonotopes: A special case we consider is when we partition a zonotope into 2-dimensional groups.
This is because a 2-dimensional zonotope can be signiﬁcantly more descriptive than a 2-dimensional rectangle, but the solution of a ReLU program can still be computed efﬁciently.
Observe that the argmin of a ReLU program over a 2-dimensional zonotope must occur at either i) a vertex of the zonotope, ii) a point where the zonotope crosses a coordinate-axis, iii) the origin.
This follows from the fact that a ReLU program over 2-dimensions may be viewed as 4 independent linear programs over the intersection of the zonotope and each orthant.
For the purposes of ReLU programs, it sufﬁces to enumerate all vertices of the zonotope and compute any axis crossings or origin-containments.
It turns out that this may be done in nearly linear time:
Theorem 4.2.
If Z ( c, E ) is a 2-dimensional zonotope with m generators, Z has 2 m vertices and the set of all vertices, axis crossings, and the containment of the origin can all be computed in
O ( m log m ) time.
The ZonoDual Algorithm
With both preliminaries of dual veriﬁcation techniques and zonotopic primal veriﬁcation techniques in hand, we can now fully describe the algorithm we employ in practice.
We ﬁrst describe the algorithm as it is used to bound a single neuron’s value, i.e. the output neuron.
After we describe how we adapt our approach to the stagewise setting where our algorithm is applied to each intermediate neuron to yield tighter box bounds.
Our algorithm can be described in three main phases: an initialization phase , where primal bounds are generated to deﬁne the feasible set for each subproblem in the dual function; an iteration phase , where the argmin of the dual function is computed many times to provide informative gradients for updates to the dual variables; and an evaluation phase , where the primal bounds are tightened to yield a more computationally intensive dual function, which only needs to be evaluated a single time.
Initialization phase: Naively, we can apply the DeepZ procedure here to attain a zonotope bounding the output range of the network at every layer.
Both this procedure and our box-improved variant can be done extremely efﬁciently.
We adapt two techniques from [25] in the initialization phase.
First we notice that some very minor improvements to DeepZ can be made using an application of Proposition 4.2 when provided with the boxes from interval bound propagation.
Second, we initialize the dual variables to the KW dual variables from [20], which by 4.1 are equivalent to the scale factors applied internally in the zonotope pushforward operators.
Iteration Phase:
In the iteration phase, each intermediate zonotope Z k is partitioned into components that are amenable to repeated evaluations of the dual function.
We always initially partition each zonotope into 2-d chunks for which the dual function may be evaluated on a GPU without requiring any MIP calls.
Recall that for a d -dimensional zonotope with m generators, after the initial
O ( dm log m ) candidate optima computation, each ReLU program can be evaluated in O ( dm ) time.
These initial 2-d partitions are computed using one of several simple heuristics, described in the appendix, with the aim to generate 2-d zonotopes which are as ‘un-box-like’ as possible.
Optionally, after an initial 2-d iteration phase, these partitions may be combined and dual ascent can be applied, where each subproblem now requires several calls to a MIP solver.
At any point during this phase, the dual function evaluations still provide valid lower bounds to the veriﬁcation problem.
Evaluation Phase:
In this phase, we can presume that effective dual variables have been found during the previous phase.
The objective here is to tighten the feasible range of each subproblem, which will necessarily improve the value of the dual function.
Because we only need to evaluate a bound on the dual function once here, we ﬁnd that it is often worth it to spend more time solving each subproblem.
We do this by simply merging several partition elements together, converting our 2-dimensional zonotopes into higher-dimensional ones that require calls to a MIP solver to compute.
Despite the theoretical intractibility of MIPs, we ﬁnd that this procedure is remarkably efﬁcient.
In practice, it is often sufﬁcient to only merge zonotopes at the later layers in a network where the dual function subproblems are the most negative.
Finally, we note that as only a bound upon the dual function is required here, and each subproblem is itself a 2-layer veriﬁcation problem, the MIPs may be terminated early.
Any other incomplete veriﬁcation approach can be applied here as well.
Guarantees: Ultimately, our algorithm will always provide a valid lower bound to the veriﬁcation problem so long as the dual function is evaluated appropriately.
The provable correctness of our algorithm stems from i) the fact that weak duality always holds and any evaluation of the dual function with feasible dual variables provides a valid lower bound tot the primal problem; and ii) by leveraging zonotopes and a sound relaxation of them, we only ever provide lower bounds to the evaluation of the dual function.
Further, we can also guarantee that, for any ﬁxed set of dual variables ρ , the bounds we provide will be tighter than those provided by the approach in [25].
This follows because we have reduced the feasible set within each dual subproblem, relative to the hyperbox approaches in prior works.
Similarly, because ρ = 0 is always a valid choice, when the dual variables are optimized appropriately, we will provide tighter bounds than whichever primal veriﬁcation method is applied at the initialization phase.
Stagewise computation: When the network of interest is of sufﬁciently small size, any veriﬁcation algorithm may be applied stagewise, where the algorithm computes upper and lower bounds to each neuron, starting from those in the ﬁrst layer.
This is often effective for generating tighter intermediate box bounds, which in turn yields much tighter output bounds.
However this comes the cost of running many calls to the veriﬁcation algorithm.
This can be parallellized for veriﬁcation procedures amenable to GPU acceleration, but demands a large memory footprint.
At ﬁrst glance, it may seem that such a stagewise procedure obviates the improvements we attain by leveraging zonotopes: indeed, each stagewise bound is a box bound .
However, we show that we can apply this stagewise trick to our approach to generate tighter box bounds, which can then be employed by Proposition 4.2 to yield tighter zonotopic bounds.
Additionally, in the case that these box bounds are incomparable to the improved zonotope bounds, these can be employed in imposing further constraints upon each subproblem.
Instead of solving each ReLU program over a zonotope, we can instead solve each ReLU program over the intersection of a zonotope and a hyperbox.
In the higher-dimensional case, it is trivial to apply elementwise constraints to each variable in the MIP — in fact, this often improves the running time of each MIP.
In the 2-d case, we observe that we are able to solve ReLU programs over the intersection of a 2-d zonotope and rectangle as efﬁciently as solving over a 2-d zonotope alone.
This is the content of the following corollary to Theorem 4.2.
Corollary 5.1.
Given a 2-d zonotope with m generators, the set of candidate optimal points to a
ReLU program has cardinality no greater than (2 m + 9) and is computable in time
O ( m log m ) .
Ablation study: To clarify the bound improvements and their corresponding runtime cost imposed by each step of our approach, we perform an ablation study on an MNIST fully connected network (MNIST FFNet).
We report the bounds relative to the bound attained by the LP relaxation in Table 1.
We consider three initialization settings separately: the standard DeepZ zonotopes, the DeepZ zonotopes augmented with IBP bounds, and zonotopes informed by the the box bounds from BDD+ [25].
Then we perform dual ascent over 2-d zonotopes, before merging the zonotopes of the ﬁnal layer only and evaluating the MIP.
We report these numbers in Table 1.
Here we see that a tight initialization does indeed help, but this gap shrinks after our dual ascent procedure.
We also see a substantial gain in bound improvement by using MIPs, even in the last layer’s zonotopes alone.
[Table]
Experiments
We evaluate the effectiveness of our approach on several networks trained on the MNIST and CIFAR10 datasets.
While many recent veriﬁcation techniques employ a branch-and-bound strategy, we only provide innovations on the bounding component of this pipeline.
Strong veriﬁers should employ both effective bounding algorithms and clever branching strategies, which are both necessary but fairly independent components.
Like other dual-based veriﬁcation techniques, our approach can be applied using any of a number of branching strategies.
We focus our efforts primarily on the improvements in the bound provided by a single run of each considered method.
We argue this is a reasonable choice of metric because most prior benchmarks focus on (cid:15) -values far lower than typically used in adversarial attack scenarios.
This artiﬁcally decreases the depth to which branching strategies must search, skewing the results.
By focusing on the bound of the veriﬁcation, we directly measure the metric that bounding algorithms such as ours seek to optimize.
However, for the sake of completeness, we do also evaluate veriﬁed robustness percentage upon several benchmark MNIST networks.
For
[Figure]
bound evaluations, we separate our experiments into two cases: we ﬁrst examine the setting where only the output neuron is optimized, which we denote the ‘single-stage’ setting; and the case where every neuron is optimized to provide tighter intermediate box bounds, denoted the ‘stagewise’ setting.
We compare the bound and running time against the following approaches: BDD+ , the Lagrangian
Decomposition procedure proposed in [25], where the optimization is performed using optimal proximal step sizes; LP , the original linear programming relaxation using the PLANET relaxation on each ReLU neuron [20]; Anderson , the linear programming relaxation, where 1-cut is applied per neuron as in [7]; AS , a recent Lagrangian technique which iteratively chooses cuts to employ from the Anderson relaxation [9].
Alg\Net
MNIST Deep
CIFAR SGD
BDD+ 2 .
5 ± 0 .1 .
5 ± 0 .
[Table]
All baselines are run implemented using the code and hyperparameter choices from prior works, and network weights are taken from existing works where applicable.
Architecture descriptions are contained in the supplementary.
We follow [ 25 ] to construct scalar-valued veriﬁcation problems: for examples with label i , we compare the difference between the i th and ( i + 1) th logit of a network.
We can extend this procedure to a multi-class task by applying the veriﬁcation n − 1 times for each incorrect logit.
Single-stage bound evaluation: In the single-stage setting we make the following hyperparameter choices for our approach.
We initialize the intermediate bounds using zonotopes informed by the boxes attained by the best of the DeepZ bounds and the IBP bounds.
We then decompose each zonotope into 2-dimensional partitions, using the ‘similarity’ heuristic for fully-connected networks, and the ‘spatial’ heuristic for convolutional networks.
Then we perform 1000 iterations of the Adam optimizer during the dual ascent procedure.
We report the value at the last iteration as ZD-2D .
Then we merge the partitions of only the last layer of each network into 20-dimensional zonotopes, and evaluate the dual function under this new partitioning.
We report these values as ZD-MIP .
We present results of our approach on the MNIST-Deep network, which has 5196 neurons andlayers, evaluating over a domain of (cid:96) ∞ boxes with (cid:15) = 0 .
Speciﬁcally we present cumulative density function plots: a point ( x, y ) on any curve in these plots indicates that that particular algorithm attains a bound tighter than x for (1 − y )% of the examples.
Curves further to the right indicate tighter bounds in aggregate.
Figure 1 (left) contains the distribution of reported bounds over every correctly-classiﬁed example in the MNIST validation set.
In Figure 1 (right), we present a similar
CDF plot for a CIFAR-10 network with 6244 ReLU neurons and 4 layers.
For this CIFAR network, we set (cid:15) = 5 / 255 , as in [9].
The average and standard deviation runtimes for these networks is provided in Table 2.
Stagewise bound evaluation: Now we turn our attention to the setting where enough computation time is allowed to perform the optimization procedure on every neuron in turn, which is able to
[Figure]
Model (cid:15)
ZD
BDD+
CROWN*
PRIMA* β -CROWN*
MLP 5x 0.
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
[Table]
159s
[Table]
MLP 8x
[Table]
[Table] [Table] [Table] [Table]
MLP 5x 0.
41.8% (28s)
[Table]
[Table]
[Table] [Table] [Table] [Table]
224s)
[Table]
MLP 8x 0.
[Table] [Table] [Table] [Table]
[Table]
[Table]
ConvSmall 0.
52.6% (38s) 16.6% (6s) 15.8% (3s) 59.8% (
[Table]
generate tighter box bounds.
Here we notice an interesting observation: our method can be improved by leveraging tighter intermediate box bounds, but is agnostic as to where these bounds come from.
Indeed, our approach can take as input any collection of tighter box bounds and generate tighter zonotopes via Proposition 4.2.
However, our current implementation of this tighter primal bound is not vectorized to be amenable, in the way that others are, to stagewise bounding procedures.
This is purely an implementation detail, and we instead use existing primal bounding techniques.
As baselines here, we compare against the LP approach, BDD+, and the active set approach withand 512 iterations, denoted AS256, AS512.
We leverage box bounds provided by each of these dual approaches to inform our zonotope bounds from which we can run our method, denoted by a → ZD.
Note that BDD+ can never surpass bounds provided by the LP approach, whereas ours and the active set procedure can both improved even further with a longer runtime.
Hence it is not sufﬁcient to provide a better bound, but to also do so more efﬁciently.
In this case, our approach performsiterations of Adam on 2-D zonotopes and increases the partition size of the ﬁnal two layers of each network to sizes of 16 and 20 respectively.
[Table]
We present our results on the MNIST-FFNet and MNIST-Deep network which haveand 5196 neurons, and 5 and 6 layers respectively, again using an (cid:15) = 0 .
CDF plots of bounds for these two networks are provided in 2, with timing data in 3.
We observe that the BDD+ bound completes very quickly, but attains a bound only slightly worse than LP.
Our approach, when initialized with the BDD+ bounds runs more efﬁciently than AS256, providing bounds that are comparable or better than the slower AS512 approach.
%-Veriﬁed Robustness: Finally we evaluate our approach comparing against all incorrect logits on MNIST trained networks, mirroring the setup of [28].
We report numbers from an unbranched version of ZD and BDD+ alongside several other veriﬁcation techniques [29, 30, 31].
Compared to other efﬁcient, branch-friendly procedures such as BDD+ and CROWN, our approach provides tighter bounds at a fair cost to efﬁciency.
Our approach provides weaker bounds than PRIMA, but is signiﬁcantly faster.
β -CROWN, in particular, leverages a dual-based branching strategy which could be applied to our method.
However due to its extremely efﬁcient bounding procedure and the need to solve millions of subproblems for veriﬁcation, it is unclear if our approach can surpass this method.
Conclusion
In this work, we demonstrated how primal and dual veriﬁcation techniques can be combined to yield efﬁcient bounds that are tighter than either of them alone.
Primal methods capture complex neuron dependencies, but do not optimize for a veriﬁcation instance; while dual methods are highly scalable, but rely on unnecessarily loose primal bounds.
This work is a ﬁrst step in combining these two approaches.
We believe that this combination of approaches is a necessary direction for providing scalable and tight robustness guarantees for safety-critical applications of machine learning.
Acknowledgements: This work is supported in part by NSF grants CNS-2002664, DMS-2134012,
CCF-2019844 as a part of NSF Institute for Foundations of Machine Learning (IFML), CNSas a part of NSF AI Institute for Future Edge Networks and Distributed Intelligence (AI-EDGE),
CCF-1763702, AF-1901292, CNS-2148141, Tripods CCF-1934932, and research gifts by Western
Digital, WNCG IAP, UT Austin Machine Learning Lab (MLL), Cisco and the Archie Straiton
Endowed Faculty Fellowship.
Checklist
The checklist follows the references.
Please read the checklist guidelines carefully for information on how to answer these questions.
For each question, change the default [TODO] to [Yes] , [No] or [N/A] .
You are strongly encouraged to include a justiﬁcation to your answer , either by referencing the appropriate section of your paper or providing a brief inline description.
For example:
• Did you include the license to the code and datasets?
[Yes] See Section ?? .
• Did you include the license to the code and datasets?
[No] The code and the data are proprietary.
• Did you include the license to the code and datasets?
[N/A]
Please do not modify the questions and only use the provided macros for your answers.
Note that the
Checklist section does not count towards the page limit.
In your paper, please delete this instructions block and only keep the Checklist section heading above along with the questions/answers below.
For all authors... (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes] See Appendix (c) Did you discuss any potential negative societal impacts of your work?
[Yes] See Appendix (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
[Yes] 2.
If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
[Yes] (b) Did you include complete proofs of all theoretical results?
[Yes] See Appendices 3.
If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
[Yes] Zipped in appendix (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
[Yes] Described in Appendix (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[No] Standard deviations for times, but n/a for CDF plots (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
[Yes] Compute environment delineated in appendix 4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
[Yes] Models and choices of (cid:15) given proper credit (b) Did you mention the license of the assets?
[No] (c) Did you include any new assets either in the supplemental material or as a URL?
[No] (d) Did you discuss whether
and how consent was obtained from people whose data you’re using/curating?
[N/A] (e) Did you discuss whether the data you are using/curating contains personally identiﬁable information or offensive content?
[No] MNIST/CIFAR only
If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
[N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
[N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
[N/A]
A Broader Impacts
Our work focuses on proving robustness and security for machine learning applications.
While any new technology may be used maliciously, we believe the technical advances proposed in this work are as benign as possible and will only serve to offer certiﬁcation of existing technologies.
B Limitations and Future Work
While ZonoDual has some beneﬁts over prior works, it is not without limitations.
We enumerate these here, as well as potential ways to overcome these:
• Reliance on ReLU nonlinearities: ZonoDual relies on the ability to solve ReLU programs over zonotopes using MIPs.
Unfortunately, this approach cannot generalize to nonlinearites that are not piecewise linear, such as the sigmoid activation.
While it might be possible to solve ‘sigmoid programs’ over 2-dimensional zonotopes, the formulation becomes signiﬁcantly more complicated.
• MIPs are not conducive to GPU acceleration: A crucial component of our procedure is to evaluate the dual using a tighter relaxation during the ﬁnal phase of ZonoDual.
Prior works that leverage box bounds do not include such a tightening step, but we note that MIPs can not beneﬁt from GPU computations.
In practice, small MIPs can solve very quickly, but for extremely large nets, such as SOTA image models, it is unlikely that this approach can scale as nicely as other techniques.
This presents a need for fast and tight lower bounds for the reduced veriﬁcation problem when the network is known to only have one hidden layer.
Unfortunately, such methods, such as SDP’s cannot currently scale to the case where this would be helpful for us.
• Intermediate zonotopes may have very large order: One drawback of using zonotopic intermediate bounds is that the number of generators can grow to be quite large for deeper layers in the network.
This can slow down the dual computation procedure, even in the 2-dimensional case for which dual evaluation time is linear in the number of generators.
There is room for improvement here in what is known as ’order reduction’ techniques for zonotopes, which soundly compresses the number of generators of a zonotope.
Naive approaches are very quick and can allow for a 2x compression factor with only marginal degradations to dual function values, but signiﬁcantly tighter compressions require much more work.
We have not included any of these accelerations in our presentation for the sake of simplicity.
• Exact evaluations of the dual seem to be necessary for informative gradients:
One might hope that the dual need not be evaluated exactly during the iteration phase of ZonoDual.
Such a procedure could allow for much faster and tighter dual ascent iterations when only informative gradients are required.
Unfortunately the approaches we have tried in this domain (including Frank-Wolfe, L-BFGBS and a modiﬁed simplex algorithm) do not provide gradients that are informative enough to yield good dual values for the ﬁnal evaluation phase.
It is possible there are techniques here that could work, but we have not found them.
C Zonotope Pushforward Operators
Here we describe the sound zonotope pushforward operators we use to generate intermediate bounds.
Since zonotopes are closed under afﬁne transformation, all that’s required is to describe the pushforward operator for the ReLU operator.
Speciﬁcally, given a zonotope Z ( c, E ) , we seek to generate a zonotope Z ( c (cid:48) , E (cid:48) )
such that { σ ( z ) | z ∈ Z ( c, E ) } ⊆
Z ( c (cid:48) , E (cid:48) ) .
First we describe the approach when no extra information is known.
This was ﬁrst presented in [32], but we adapt the analysis of [33].
Next we consider the case when we also have the extra information in the form of a hyperbox H ( l, u ) :
= { x | l ≤ x ≤ u } , where the goal is to construct Z ( c (cid:48) , E (cid:48) )
such that { σ ( z ) | z ∈ Z ( c, E ) ∩ H ( l, u ) }
⊆
Z ( c (cid:48) , E (cid:48) ) .
DeepZ : The primary strategy is to compress each coordinate of Z ( c, E ) by a scale factor λ i ∈ [0 , 1] , which will in general, incur some error along each coordinate, b i .
These errors are accumulated into a hyperbox, which will then be incorporated into Z ( c (cid:48) , E (cid:48) ) in the form of a Minkowski sum.
The goal is to minimize the amount of error that is accumulated.
In other words, each coordinate can be considered independently, where we wish to solve the minmax procedure
[Equation]
where the choice of the compression factor λ i is chosen to minimize the error that needs to be added in at the end between σ ( z i ) and λ i z i over all feasible points in the zonotope.
Noticing that projecting
Z ( c, E ) only onto the i th coordinate necessarily yields an interval, so the max is performed over an interval, [ l i , u i ] .
In the case that l i ≥ 0 , the ReLU is always on, and λ i can be chosen to be 1, with b i = 0 .
In the case that u i ≤ 0 , then the ReLU is always off, and λ i can be chosen to be 0, again with b i = 0 .
In the case that l i < 0 < u i , it is not difﬁcult to see that the optimum value is attained when λ i is chosen to be u i u
i − l i , such that the optimal value is − l i u
i u i − l i .
Hence we can accumulate λ
i for each coordinate i into a diagonal matrix Λ .
The optimal offsets, ( b 1 , . . .
, b d ) , can be divided by 2, and accumulated into a diagonal matrix B whose columns may be appended to the compressed zonotope.
Put concisely,
[Equation]
where Λ i
[Equation]
otherwise
[Equation] otherwise Improvements using Hyperboxes: Now we restate our proposition that allows for an improvement upon this pushforward operator when we have an incomparable hyperbox bound.
Proposition 4.2.
Suppose Z is a zonotope and H is a hyperbox, such that Z (cid:54)⊆ H .
Then we can develop a sound pushforward operator for the ReLU operator that outputs a zonotope Z (cid:48) containing the ReLU of every element of Z ∩H , with the property that Z (cid:48) (cid:40)
DeepZ ( Z ) .
Proof.
Let Z ( c, E ) be the zonotope Z , and let H ( l h , u h ) be the hyperbox H .
Similar to DeepZ , the strategy we employ to develop a sound pushforward operator is to scale each coordinate independently, and Minkwoski sum the errors, accumulated as a hyperbox.
Again, this decomposes into a minmax procedure as
[Equation]
In a single dimension, both a zonotope and hyperbox are intervals, so their intersection is also an interval.
Letting ( l zi , u zi ) be the i th coordinates lower and upper bounds for Z , then the intersection between the i th coordinate projection of H and Z is the interval [ l i , u i ] :=
[max( { l zi , l hi } , min( { u zi , u hi } )] .
From here the choice of Λ and B is exactly the same as in DeepZ , where the tightened coordinate-wise bounds are used.
This is guaranteed to be as tighter as long as at least one coordinate exists for which the interval is reduced, because both the compression factor λ i and error b i are reduced by tightening the interval.
By our assumption that Z (cid:54)⊆ H , at least one coordinate interval must be tightened, so the inclusion Z (cid:48) ⊂
DeepZ ( Z ) is strict.
Kolter-Wong Bounds
Here we present a geometric proof of Proposition 4.1.
We will only brieﬂy discuss the derivation of this bound in the context of this proof.
For a more thorough discussion on the exact structure and derivation of the Kolter/Wong dual relaxation, we point to the original paper [20] and a self-contained derivation in the appendix of [25].
Proposition 4.1.
Let Z k be the k th zonotope bound provided by the DeepZ procedure, and let H k be the k th intermediate bound provided by the Kolter-Wong dual procedure [20].
Then the smallest hyperbox containing Z k is exactly H k .
Proof.
In [20], the authors derive the original linear programming relaxation and dual procedure for verifying ReLU networks.
This technique can be interpreted in the primal sense as maintaining a polyhedral primal bound for every intermediate layer.
Assuming a polyhedral input range, such a hyperbox, this procedure works by incrementally lifting the dimensionality of the polytope.
In other words, an H-polytope is maintained, where new dimensions/variables are introduced through equality constraints deﬁned by each layer.
For afﬁne layers, this lifting procedure is exact.
For ReLU layers,
[Figure]
−
[Figure]
−
[Figure]
−−−   3 −
[Figure]
−−
DeepZRelaxationBoxInformedZonotopeReLUBoxInformation
[Figure]
this lifting procedure introduces some error.
This follows because the graph of the ReLU function, viewed as a 2-d set, is not convex.
In this case the canonical triangle relaxation is applied, which is simply the convex hull of the graph of the ReLU function.
This triangle relaxation, applied over an interval [ l, u ] with l < 0 < u , has as its upper convex hull, a line with slope uu − l and intercept − ul u − l .
This lifting procedure is iterated over all layers, ultimately yielding a polytope of dimension dim ( X ) + (cid:80) Li
=1 2 n i , where n i refers to the number of neurons of the i th layer.
Optimization over this lifted polytope was framed as a linear program, where the objective was set to minimize the variable corresponding to the ﬁnal output neuron.
In the original KW formulation, the dual of this linear program, a dual variable was introduced that geometrically corresponds to a lower-bounding linear functional on the triangle relaxation.
This is similar to the observation made in α − β − CROWN [28].
In the original linear programming paper, an initial choice of α = uu − l was chosen, which in this case may be interpreted as lower bounding the triangle relaxation by a line that is parallel to the upper convex hull, essentially providing an initial relaxation as a parallelogram with vertical sides.
On the other hand, the zonotope propagation procedure may also be viewed as a polyhedral lifting procedure.
Recall in the DeepZ formulation, the sound pushforward operator for the ReLU operator works by scaling the i th coordinate by the factor u
i u i − l i and incorporating the error in terms of a
Minkowski sum.
This may equivalently be viewed as lifting a d -dimensional zonotope, to a ( d + 1) - dimensional zonotope where the newly added dimension has range that is a function of only the i th coordinate.
In particular, it is constrained to lie inside the vertical parallelogram deﬁned on the vertical edges by l, u , with the slanted edge having slope u i u
i − l i .
The upper edge is exactly the convex upper hull of the graph of the ReLU function.
In practice, because it is convenient and efﬁcient to project zonotopes onto lower dimensional subspaces, when mapping a d -dimensional through a ReLU layer, instead of lifting to a 2 d -dimensional zonotope, the original dimensions are simply dropped to retain a d -dimensional zonotope.
It is in this sense that the convex outer adversarial polytope described by Kolter and Wong, with the choice of α = uu − l is exactly equivalent to the zonotope attained by DeepZ if no dimensions were dropped in the zonotope.
Hence, each coordinate-wise upper and lower bound attained by each is exactly equivalent.
D Proof of Hardness of ReLU Programming
Theorem 4.1.
When Z is a zonotope, solving a ReLU program over Z is equivalent to a neural network veriﬁcation problem for a 2-layer network, which is known to be NP-hard.
Proof.
Let Z
= Z ( c, E ) be a zonotope in R d with m columns in the generator matrix.
Then we can construct an equivalent scalar-valued ReLU network, f ( y ) =
w (cid:62) 2 σ ( W 1 y + b ) .
We deﬁne w 2 , W 1 , b as follows:
[Equation]
such that f ( y [Equation]
=
[Equation] ( − c − Ey ))
T , where the ReLU programming objective is recovered by x = σ ( x ) − σ ( − x ) .
Then we can set the input domain to [ − 1 , 1] m to equate this veriﬁcation problem to ReLU programming over Z .
The hardness result comes directly from
Katz et al [4].
E 2-Dimensional Zonotopes
Now we turn our attention to 2-dimensional zonotopes, ultimately, we will arrive at a proof of
Theorem 4.2 and Corollary 5.1.
Throughout, we consider a 2-dimensional zonotope Z ( c, E ) , where
E is assumed to have m generators.
Further we will assume that the generators are in general position, i.e. two generators are colinear.
If this is the case they can be combined into a single generator without changing the set represented by the zonotope.
The strategy of this proof will follow in several parts.
First we start with a preliminary theorem that holds for zonotopes of all dimension, which describes a relationship between the vertices of the zonotope and the faces of the generating hypercube.
Then we show how every two-dimensional zonotope has 2 m vertices and therefore 2 m edges.
Next we prove that each edge corresponds to exactly one generator, and conversely, every generator corresponds to exactly 2 edges.
Finally we describe the procedure we use to enumerate these vertices in a sorted fashion, and compute axis-crossings, origin-containment, and extend this to the intersection of a zonotope and rectangle.
We will commonly make use of the notion of the upper and lower convex hulls of a 2-dimensional shape.
The upper hull of a convex set is the smallest concave function that is larger than the convex hull, and the lower convex hull of a convex set is the largest convex function that is smaller than the convex hull; it is helpful to think of this as the ‘upper half‘ and ‘lower half’ of the convex hull.
Lemma E.1.
Every vertex v of a zonotope with m generators has a corresponding face of the m -dimensional (cid:96) ∞ ball that maps to that vertex.
Proof.
Consider any zonotope Z = Z ( c, E ) , which can be equivalently viewed as the afﬁne mapping y
→ c + Ey applied to every element in the set { y | y ∈ [ − 1 , 1 } m } .
Consider any vertex v of Z , which by deﬁnition must have some vector a (in the polar cone of that vertex), such that a (cid:62) v < a (cid:62) z for all z (cid:54) = v in Z .
In other words, v is the argmin of some linear program with feasible set Z .
Equivalently, the set of y such that c
+
Ey = v are the argmin of some linear program over the (cid:96) ∞ ball in R m .
This implies that the set { y | c + Ey = v } is a face of the (cid:96) ∞ ball.
Note that face here includes 0-faces such as vertices of the (cid:96) ∞ ball, as well as higher dimensional faces.
Lemma E.2.
A 2-dimensional zonotope with m generators in general position has exactly 2 m vertices and
Proof.
We proceed by induction.
First note that a zonotope with a two generators is a parallelogram in 2 d and has 4 vertices and edges.
Now assume we have a zonotope Z k with k generators, and by the induction hypothesis, 2 k vertices.
Now assume without loss of generality that we add the k + 1 th generator which is the vector g :=
[0 , 1] : we are always able to rotate and scale the zonotope such that this is the case, and invert this operation afterwards.
If V k = { v 1 , . .
. , v 2 k } is the set of vertices of Z k , then Z k can be equivalently represented as conv( V k ) .
Because adding a generator to a zonotope is the minkowski sum of a segment, Z k +1 can equivalently be written as conv( ˜ V k +1 ) , where
˜ V k +1 is the set of points { v 1 + g, v 1 − g, . . .
v 2 k + g, v 2 k − g } .
We now show that only 2 k +of these 4 k points are vertices.
To see this, consider just the vertices of the convex upper hull of Z k .
Because zonotopes are centrally symmetric, there are exactly k + 1 of these points.
By choosing g to be [0 , 1] , we see that for every v i in the convex upper hull, v i + g is a vertex of Z k +1 .
We also see that unless v i is also a point of the convex lower hull of Z k , v i − g is not a vertex of Z k +1 , because by deﬁnition there is an interval vertically beneath v i such that the entire interval, with g subtracted, is also in Z k +1 .
Hence for k − 1 points of the convex upper hull, we can eliminate v i − g from the candidate vertex set.
We can repeat a similar procedure for the convex lower hull.
Hence we are able to eliminate 2 k − 2 points from the 4 k candidate vertices, leaving exactly 2 k + 2 vertices in Z k as desired.
Finally notice that every 2-d polytope with 2 k + 2 vertices has exactly 2 k + 2 edges.
Lemma E.3.
If Z is a 2-dimensional zonotope in general position, then every edge corresponds to exactly one generator.
Conversely, every generator corresponds to exactly two edges.
Proof.
Pick any edge of Z and without loss of generality, assume that zonotope is oriented such that the left endpoint of this edge, v l , is the left-most point of the zonotope, neither edge connected to that endpoint is vertical, and the right endpoint of this edge, v r is above v l .
Note that this can always be done and then undone later.
Next assume that all generators are oriented such that the x -coordinate of each generator is nonnegative.
This follows because any generator can be negated without changing the zonotope.
From the previous lemma, it can be shown that for zonotope Z = Z ( c, E ) , the vector y = − (cid:126) 1 satisﬁes c
+ Ey = v l .
Then, by moving in y -space by swapping any coordinate of y from − 1 to +1 , we may end up at a new vertex.
We can now sort the generators by slope, in terms of g (2) g (1) , where g ( i ) refers to the i th coordinate of generator g .
Suppose g ( j ) is the generator with the largest slope.
Then by interpolating from y to y + 2 e j we traverse along an edge of the zonotope.
Indeed, there exists no other direction in y -space in which we could move that corresponds to a larger slope-increase in z -space.
This is essentially a gift-wrapping procedure.
Thus, the edge spanned by v l , v r corresponds exactly to g ( j ) .
To show that every generator corresponds to at least two edges, this follows easily from the fact that zonotopes are centrally symmetric.
To show that every generator corresponds to exactly two edges, we can apply Lemma E.2 to show by the pigeonhole principle, no generator can correspond to more than two edges.
Now with these lemmas in hand, we are prepared to solve the main 2-d vertex enumeration theorem.
Theorem 4.2.
If Z ( c, E ) is a 2-dimensional zonotope with m generators, Z has 2 m vertices and the set of all vertices, axis crossings, and the containment of the origin can all be computed in
O ( m log m ) time.
Proof.
First we describe how to enumerate all vertices of Z ( c, E ) in O ( m log m ) time.
This procedure is a simple extension of Lemma E.3.
Recall, in that lemma, we were able to ﬁnd the left-most vertex by solving a linear program minimizing the e (cid:62) 1 z over Z ( c, E ) .
Then we were able to ﬁnd the next vertex, starting from the left and going clockwise, by ﬁnding the generator with the largest slope, once generators had been appropriately sign-normalized.
We can simply continue this procedure, and from the right-endpoint of the edge enumerated in Lemma E.3, the next clockwise vertex is attained by traversing the generator with the next highest slope.
In this way, we can sort the entire set of m generators by their slope in decreasing order and iteratively enumerate the vertices, where the ( i + 1) th vertex v i +1 is simply v i + 2 g i , where v i is the i th vertex and g i is the i th generator, in the sorted order.
This process generates the m + 1 vertices of the entire convex upper hull of Z ( c, E ) in left-right order.
To attain the vertices of the lower convex hull, we rely on the centrally symmetric property of zonotopes: negate each vertex, add 2 · c , and reverse the order of this list to generate the m + 1 vertices of the lower convex hull in right-left order.
By concatenating these two lists, and removing duplicates at the endpoints of each convex hull, we are able to generate all 2 m vertices of the zonotope in clockwise order.
The runtime of this algorithm is the time to compute the ﬁrst vertex and then the slope of each generator, each of which is O ( m ) time.
Then the generator slopes must be sorted in O ( m log m ) time.
Iterating through this list and adding each generator to the current vertex requires O ( m ) constant time steps.
Computing the lower convex hull only requires O ( m ) time as well, so the whole procedure requires O ( m log m ) time, dominated by the cost of sorting the generators by their slopes.
Now we demonstrate how it takes an additional O ( m ) time to compute the points on the zonotope where either x = 0 or y = 0 .
We consider only the x = 0 case, without loss of generality.
Since we are given the vertices in clockwise order, it is trivial to walk through the vertex list and report any pair of vertices for which v i (1) · v i +1 (1) < 0 .
If this is the case, then the edge between v i and v i + crosses the y -axis.
Since we have both endpoints on this edge, it requires constant time to compute the point along that line segment for which x = 0 .
A similar procedure can be applied for the x =case.
Finally, notice that the zonotope only contains the origin if it crosses both the x -axis
and y -axis in two places.
From this procedure, it is now trivial to consider the intersection of a 2-d zonotope and a rectangle.
Corollary 5.1.
Given a 2-d zonotope with m generators, the set of candidate optimal points to a
ReLU program has cardinality no greater than (2 m + 9) and is computable in time
O ( m log m ) .
Proof.
First we provide a bound on the cardinality of the set of vertices of the intersection of a 2-d zonotope and a rectangle.
The set of candidate vertices is exactly: the vertices of the zonotope, the vertices of the rectangle, and any intersections of edges of the rectangle and zonotope.
Here it is easiest to refer the pictorial aid in Fig.
For any rectangle vertex contained in the zonotope, there is necessarily a zonotope vertex not contained in their intersection.
For any rectangle vertex not contained in the zonotope, it is possible that up to two new vertices are introduced in the intersection.
This means that each vertex of the rectangle can add a net +1 to the number of vertices of their intersection.
In general, the number of vertices of the intersection of two 2-d polygons is bounded by the sum of the number of vertices of each.
Then the candidate optima for a ReLU program over this set is exactly this set of vertices, with cardinality at most 2 m + 4 , and any extra axis crossings, and the origin.
This brings the set of candidate optima to no more than 2 m + 9 .
Next, we describe how to compute this set of candidate optima.
We assume that we have obtained the 2 m vertices of the zonotope in O ( m log m ) time.
We now check containment of each of the candidate vertices.
It requires constant time to compute point-containment within a rectangle, so we can eliminate any zonotope vertices not contained in the box in O (2 m ) time.
It is more complicated to compute point-containment within a zonotope.
In general this requires a linear program, but since we already have the vertex list oriented clockwise, we are able to leverage this to compute the set of rectangle vertices contained in the zonotope as well as any edge-edge crossings in O ( m ) time.
The idea is similar to the idea used to compute axis crossings in Theorem 4.2.
The general procedure is to ﬁx an axis and value and shoot a line through that value.
For example, we consider the x = a line and compute the intersection of the set { ( x, y ) | x = a } with Z ( c, E ) .
We can do this by ﬁnding the y -coordinates of the edges of Z ( c, E ) that cross this vertical line.
This amounts to a single scan through the oriented vertex list of the zonotope, and yields an interval [ l z , u z ] or None .
We perform this line-shooting procedure at most 6 times.
Once for the left-bound, right-bound, top-bound, and bottom-bound of the rectangle, and if the rectangle itself crosses the x or y axis, we line-shoot the x = 0 line or y = 0 lines accordingly.
For each line-shoot, we are able to compare the interval deﬁned by the box [ l b , u b ] and the line-shoot interval [ l z , u z ] .
The intersection of this interval can be used to determine which box vertices and edge-edge intersections are contained within the intersection of the zonotope and rectangle.
Overall this requires a constant number of calls to a subroutine running in O ( m ) time, so the overall runtime of this procedure is still dominated by the sort time from the zonotope vertex enumeration, i.e. O ( m log m ) .
E.1 Partitioning Heuristics
Here we describe the heuristics used to fragment a higher dimensional zonotope into two-dimnesional pieces.
We certainly could do this randomly, but we have found some minor performance gains can be achieved by cleverly choosing this partitioning.
The key idea for each of these is to choose pairs of dimensions yielding zonotopes that would suffer greatly from being relaxed into a rectangle.
Recall that for a two-dimensional zonotope, a rectangle is attained when each generator is colinear with an elementary basis vector.
Our two partitioning styles are as follows:
• Similarity heuristic:
Here we assign each pair of dimensions a scalar-valued score that roughly resembles how far each generator column is from an elementary basis vector.
These pairwise scores are encoded in a d × d matrix.
Each row of this matrix is sorted in descending
order, and the partitions are formed by looping over the rows of the matrix and choosing the ﬁrst available index, that has not already been chosen by a prior pair.
The scoring function here, for dimensions i, j is the dot product of the absolute values of the rows of the generator matrix.
Hence the scoring matrix can be computed by the matrix-matrix multiplication | E | · | E | (cid:62) .
For zonotopes of very large dimension, this method requires the multiplication of two ( d × m ) matrices, and then the sort-and-choose method takes O ( d 2 ) time in the worst case.
However since we only have to do this one time, it is often worth it to apply this heuristic on networks with intermediate networks with moderate dimension, or those without spatial information imbued by convolutional layers.
• Spatial or depthwise heuristic:
For convolutional networks, the structure of convolutional operators can be applied to choose partitionings.
In the spatial partitioning heuristic, we assign each coordinate its pair by choosing a coordinate adjacent to it in the feature map.
In the depthwise partitioning heuristic, we assign each coordinate its pair by choosing a coordinate in the same location on the feature map but in a different channel.
The intuition here is that random partitioning here would often choose coordinates that have disjoint receptive ﬁelds and would yield zonotopes that are rectangles.
These heuristics much more quickly than the similarity heuristic and are amenable to larger convolutional nets.
F Experimental Details F.1 Computation Environment
Computations for this paper were performed using the idle resource queue of computing cluster.
The cluster uses Intel Xeon Gold 6230R and 6230R CPUs and mixture of NVIDIA
Ti, Quadro RTX 6000, and Telsa A40 GPUs.
Due to our usage of the idle resource queue, we ran on a variety of different CPUs and GPUs depending on which resources were being underutilized on the cluster.
Our job requirements were 5 CPU cores, 20 GB of RAM, and 1 GPU of any kind per job.
Despite our timing information not being representative of a single hardware conﬁguration, we believe we can still make valid comparisons using it, as we ensured that we ran all methods for a particular image on the same node.
F.2 Network Architectures F.2.1 MNIST Networks:
We consider three different architectures trained on the MNIST dataset.
Each is randomly initialized, and trained adversarially for 25 epochs using the Adam optimizer and standard hyperparameters to update network weights [34].
The adversarial training was perfromed using 10 iterations of
PGD with an (cid:96) ∞ adversarial radius of (cid:15) = 0 .
The architectures are as follows, where
Conv2D ( in, out, k, s, p ) refers to a convolutional layer with in input channels, out output channels, a square kernel of size k , a stride of s , and padding p .
The Wide and Deep network architecture choices were taken from [11], though the FFNet was our choice for a fully connected network.
We trained these networks ourselves.
• MNIST FFNet: (960 ReLU neurons) 1.
Linear (784 , 512) → ReLU 2.
Linear (512 , 256) → ReLU 3.
Linear (256 , 128) → ReLU 4.
Linear (128 , 64) → ReLU 5.
Linear (64 , 10) •
MNIST Wide: (4804 ReLU neurons) 1.
Conv2D (1 , 16 , 4 , 2 , 1) → ReLU 2.
Conv2D (16 , 32 , 4 , 2 , 1) → ReLU → Flatten 3.
Linear (1568 , 100) → ReLU 4.
Linear (100 , 10) • MNIST Deep: (5196 ReLU neurons) 1.
Conv2D (1 , 8 , 4 , 2 , 1) → ReLU 2.
Conv2D (8 , 8 , 3 , 1 , 1) → ReLU
Conv2D (8 , 8 , 3 , 1 , 1) → ReLU 4.
Conv2D (8 , 8 , 4 , 2 , 1) → ReLU → Flatten 5.
Linear (392 , 100) → ReLU 6.
Linear (100 , 10)
F.2.2 CIFAR-10 Networks
For the CIFAR-10 networks, we directly utilized the models and weights from prior work [9] † .
Speciﬁcally, we considered the models trained both using SGD and adversarially using PGD with the architecture:
• CIFAR WIDE: (6244 ReLU neurons) 1.
Conv2D (3 , 16 , 4 , 2 , 1) → ReLU 2.
Conv2D (16 , 32 , 4 , 2 , 1) → ReLU → Flatten 3.
Linear (2048 , 100) → ReLU 4.
Linear (100 , 10)
F.3 Hyperparameter Choices
Here we describe the hyperparameter choices for both our model and competing methods.
Wherever possible, code from prior works was utilized, with minimal tuning applied.
We found the codebase associated with the Active Set paper to be immensely helpful here [9].
Because we changed our partitioning hyperparameters slightly between networks, we describe each hyperparameter choice explicitly.
Scripts to run each experiment are contained with the attached codebase.
For all experiments, we employ Gurobi as MIP-solver [36].
Single-stage setting: • BDD+ : For the optimal proximal method, we apply the default parameters whereiterations were applied with 2 inner steps and η ranging from 1 to 5.
• AS : 1000 iterations of AS were increased to 1000 to match our approach, where all other hyperparameters were kept at their default values.
• ZD (MNIST) :
For the MNIST networks, we initialized with the KW dual variables, used the ’similarity’ partitioning heuristic for the 2-d zonotopes, and used 1000 iterations of Adam with default β parameters.
The learning rate was initialized at η = 0 .
01 , and decayed by a multiplicative 0 .
75 factor every 100 iterations.
• ZD (CIFAR) :
For the CIFAR networks, we initialized with the KW dual variables, used the ’spatial’ partitioning heuristic for the 2-d zonotopes, and used 1000 iterations of Adam with default β parameters.
The learning rate was initialized at η = 0 . 0025 and decayed by a multiplicative 0 .
5 factor every 200 iterations.
• ZD-MIP : For all single stage experiments, for every network, we ran the exact same setting as ZD, but merged partitions of the ﬁnal layer only into zonotopes of dimension 20 and evaluated the dual function.
The only exception here is in MNIST FFNET, where only the ﬁnal layer was merged to zonotopes of dimension 16.
Stagewise Setting:
In this setting, we kept most hyperparameters the same as in the single-stage setting.
The notable exception is a change in the number of iterations in the AS method.
We found that 1000 iterations would frequently cause CUDA memory errors, and to the best of our understanding, these methods weren’t run in a stagewise setting in [9].
Because these methods are allowed to run for a longer time, we increased the number of iterations dual ascent was performed for, as well as the partitioning at the end.
Essentially, these were tuned slightly in order to reliably prove tighter bounds such that AS256-ZD was both faster and tighter than AS512.
We summarize the iteration and partitioning changes here :
• MNIST FFNET :
We initialize as before, using the speciﬁed box bounds, and then runiterations of gradient ascent, with an initial learning rate of 0.0025, decaying by a factor of 0.75 every 400 epochs.
Because this method is relatively smaller, we increase the ﬁnal
[Figure]
layer partition size to 32 and run 20 iterations of dual ascent.
Finally, we expand all other 2-dimensional partitions to zonotopes of dimensin 16 and evaluate the dual.
• MNIST WIDE /DEEP :
We initialize and run dual ascent over the 2-d zonotopes as in
MNIST FFNet.
We then increase partition sizes to 16 for the penultimate layer and 20 for the ﬁnal layer and evaluate the dual function once.
Ablation Study Details: For the ablation study, we only evaluate on the MNIST FFNet.
We initialize either with the DeepZ bounds, the DeepZ bounds augmented via IBP, or the zonotopes augmented by the stagewise BDD+ bounds.
Then we partition the zonotopes using the ‘similarity’ heuristic and run 1000 iterations of gradient ascent with an initial learning rate of 0.01, decaying by a factor of 0.
every 100 iterations.
We increase the partition size to 32 on the ﬁnal layer only and evaluate the dual.
We give results complete with error bars in Table 5.
[Table]
G Additional experimental results
Here we have included data from experiments that did not ﬁt in the main paper.
Unless otherwise stated, the setup and hyperparameters are chosen as in the main paper and in Appendix F.3.
We present two styles of plots in Figs.
8 to 11.
The cumulative distribution plots present the quantity of examples considered that yield a bound less than a speciﬁed
We also report numerical timing results in Tables 6 and 7 and bound statistics in Tables 8 and
[Figure]
[Figure] [Figure]
Alg\Net
MNIST FFNet
MNIST Deep
MNIST Wide
CIFAR SGD
BDD+ 1 . 7 ± 0 .2 .
5 ± 0 .1 . 5 ± 0 .1 .
5 ± 0 .
LP 6 .
[Table] [Table]
[Table] [Table]