F AST AND C OMPLETE : E NABLING C OMPLETE N EURAL N ETWORK V ERIFICATION WITH R APID AND M ASSIVELY P ARALLEL I NCOMPLETE V ERIFIERS
A BSTRACT
Formal veriﬁcation of neural networks (NNs) is a challenging and important problem.
Existing efﬁcient complete solvers typically require the branch-and-bound (BaB) process, which splits the problem domain into sub-domains and solves each sub-domain using faster but weaker incomplete veriﬁers, such as Linear Programming (LP) on linearly relaxed sub-domains.
In this paper, we propose to use the backward mode linear relaxation based perturbation analysis (LiRPA) to replace
LP during the BaB process, which can be efﬁciently implemented on the typical machine learning accelerators such as GPUs and TPUs.
However, unlike LP,
LiRPA when applied naively can produce much weaker bounds and even cannot check certain conﬂicts of sub-domains during splitting, making the entire procedure incomplete after BaB. To address these challenges, we apply a fast gradient based bound tightening procedure combined with batch splits and the design of minimal usage of LP bound procedure, enabling us to effectively use LiRPA on the accelerator hardware for the challenging complete NN veriﬁcation problem and signiﬁcantly outperform LP-based approaches.
On a single GPU, we demonstrate an order of magnitude speedup compared to existing LP-based approaches.
I NTRODUCTION
Although neural networks (NNs) have achieved great success on various complicated tasks, they remain susceptible to adversarial examples (Szegedy et al., 2013): imperceptible perturbations of test samples might unexpectedly change the NN predictions.
Therefore, it is crucial to conduct formal veriﬁcation for NNs such that they can be adopted in safety or security-critical settings.
Formally, the neural network veriﬁcation problem can be cast into the following decision problem:
Given a neural network f ( · ) , an input domain C , and a property P .
∀ x ∈ C , does f ( x ) satisfy P ?
The property P is typically a set of desirable outputs of the NN conditioned on the inputs.
Typically, consider a binary classiﬁer f ( x ) and a positive example x 0 ( f ( x 0 ) ≥ 0 ), we can set P to be nonnegative numbers R + and x is bounded within an l ∞ norm ball C
= { x |(cid:107) x − x 0 (cid:107) ∞ ≤ (cid:15) } .
The success of veriﬁcation guarantees that the label of x 0 cannot ﬂip for any perturbed inputs within C .
In this paper we study the complete veriﬁcation setting, where given sufﬁcient time, the veriﬁer should give a deﬁnite “yes/no” answer for a property under veriﬁcation.
In the above setting, it must solve the non-convex optimization problem min x ∈C f ( x ) to a global minimum.
Complete NN veriﬁcation is generally a challenging NP-Hard problem (Katz et al., 2017) which usually requires expensive formal veriﬁcation methods such as SMT (Katz et al., 2017) or MILP solvers (Tjeng et al., 2019b).
On the other hand, incomplete solvers such as convex relaxations of NNs (Salman et al., 2019) can only provide a sound analysis, i.e., they can only approximate the lower bound of min x ∈ C
f
( x ) as f and verify the property when f ≥ 0 .
No conclusion can be drawn when f < 0 .
Recently, a Branch and Bound (BaB) style framework (Bunel et al., 2018; 2020b) has been adopted for efﬁcient complete veriﬁcation.
BaB solves the optimization problem min x ∈C f ( x ) to a global minimum by branching into multiple sub-domains recursively and bounding the solution for each sub-domain using incomplete veriﬁers.
BaB typically uses a Linear Programming (LP) bounding procedure as an incomplete veriﬁer to provide feasibility checking and relatively tight bounds for each sub-domain.
However, the relatively high solving cost of LPs and incapability of parallelization (especially on massively parallel hardware accelerators like GPUs or TPUs) greatly limit the performance and scalability of the existing complete BaB based veriﬁers.
In this paper, we aim to use fast and typically weak incomplete veriﬁers for complete veriﬁcation.
Speciﬁcally, we focus on a class of incomplete veriﬁers using efﬁcient bound propagation operations, referred to as linear relaxation based perturbation analysis (LiRPA) algorithms (Xu et al., 2020).
Representative algorithms in this class include convex outer adversarial polytope (Wong & Kolter, 2018), CROWN (Zhang et al., 2018) and DeepPoly (Singh et al., 2019b).
LiRPA algorithms exhibit high parallelism as the bound propagation process is similar to forward or backward propagation of NNs, which can fully exploit machine learning accelerators (e.g., GPUs and TPUs).
Although LiRPA bounds are very efﬁcient for incomplete veriﬁcation, especially in training certiﬁed adversarial defenses (Wong et al., 2018; Mirman et al., 2018; Wang et al., 2018a; Zhang et al., 2020), they are generally considered too loose to be useful compared to LPs in the complete veriﬁcation settings with BaB. As we will demonstrate later, using LiRPA bounds naively in BaB cannot even guarantee the completeness when splitting ReLU nodes, and thus we need additional measures to make them useful for complete veriﬁcation.
In fact, LiRPA methods have been used to get upper and lower bounds for each ReLU neuron in constructing tighter LPs (Bunel et al., 2018; Lu & Kumar, 2020).
It was also used in (Wang et al., 2018c) for verifying small-scale problems with relatively low dimensional input domains using input splits, but splitting the input space can be quite ineffective (Bunel et al., 2018) and is unable to scale to high dimensional input case like CIFAR-10.
Except one concurrent work (Bunel et al., 2020a), most complete veriﬁers are based on relatively expensive solvers like LP and cannot fully take beneﬁt from massively parallel hardware (e.g., GPUs) to obtain tight bounds for accelerating large-scale complete veriﬁcation problems.
Our main contributions are:
• We show that LiRPA bounds, when improved with fast gradient optimizers, can potentially outperform bounds obtained by LP veriﬁers.
This is because LiRPA allows joint optimization of both intermediate layer bounds of ReLU neurons (which determine the tightness of relaxation) and output bounds, while LP can only optimize output bounds with ﬁxed relaxations on ReLU neurons.
• We show that BaB purely using LiRPA bounds is insufﬁcient for complete veriﬁcation due to the lack of feasibility checking for ReLU node splits.
To address this issue, we design our algorithm to only invoke LP when absolutely necessary and exploits hardware parallelism when possible.
• To fully exploit the hardware parallelism on the machine learning accelerators, we use a batch splitting approach that splits on multiple neurons simultaneously, further improving our efﬁciency.
• On a few standard and representative benchmarks, our proposed NN veriﬁcation framework can outperform previous baselines signiﬁcantly, with a speedup of around 30X compared to basic BaB+LP baselines, and up to 3X compared to recent state-of-the-art complete veriﬁers.
B ACKGROUND 2. F ORMAL DEFINITION OF N EURAL NETWORK (NN) VERIFICATION
Notations of NN.
For illustration, we deﬁne an L -layer feedforward NN f : R | x | → R with L weights W ( i ) ( i ∈ { 1 , · · · , L } ) recursively as h ( i ) ( x ) =
W ( i ) g
( i − 1) ( x ) , hidden layer g ( i ) ( x ) =
ReLU ( h ( i ) ( x )) , input layer g (0) ( x ) = x , and ﬁnal output f ( x ) =
h ( L ) ( x ) .
For simplicity we ignore biases.
We sometimes omit x and use h ( i ) j to represent the pre-activation of the j -th ReLU neuron in i -th layer for x ∈ C , and we use g ( i ) j to represent the post-activation value.
We focus on verifying ReLU based NNs, but our method is generalizable to other activation functions supported by LiRPA.
NN Veriﬁcation Problem.
Given an input x , its bounded input domain C , and a feedforward NN f ( · ) , the aim of formal veriﬁcation is to prove or disprove certain properties P of NN outputs.
Since most properties studied in previous works can be expressed as a Boolean expression over a linear equation of network output, where the linear property can be merged into the last layer weights of a
NN, the ultimate goal of complete veriﬁcation reduces to prove or disprove:
[Equation]
One way to prove Eq.
1 is to solve min x ∈C f ( x ) .
Due to the non-convexity of NNs, ﬁnding the exact minimum of f ( x ) over x ∈ C is challenging as the optimization process is generally NPcomplete (Katz et al., 2017).
However, in practice, a sound approximation of the lower bound for f ( x ) , denoted as f , can be more easily obtained and is sufﬁcient to verify the property.
Thus, a good veriﬁcation strategy to get a tight approximation f can save signiﬁcant time cost.
Note that f must be sound, i.e., ∀ x ∈ C , f ≤ f ( x ) , proving f ≥ 0 is sufﬁcient to prove the property f ( x ) ≥ [-
 given x ∈ C-]0 .
2. T HE B RANCH AND B OUND (B A B) FRAMEWORK FOR N EURAL N ETWORK V ERIFICATION
Branch and Bound (BaB), an effective strategy in solving traditional combinatorial optimization problems, has been customized and widely adopted for NN veriﬁcation (Bunel et al., 2018; 2020b).
Speciﬁcally, BaB based veriﬁcation framework is a recursive process, consisting of two main steps: branching and bounding.
For branching , BaB based methods will divide the bounded input domain
C into sub-domains {C i
|C
=
(cid:83) i C i } , each deﬁned as a new independent veriﬁcation problem.
For instance, it can split a ReLU unit g ( k ) j = ReLU ( h ( k ) j ) to be negative and positive cases as C [-
-]0 =
C ∩ (cid:16) h ( k ) j ≥ 0 (cid:17) and C 1 = C ∩ (cid:16) h ( k ) j < 0 (cid:17) for a ReLU-based network; for each sub-domain C i , BaB based methods perform bounding to obtain a relaxed but sound lower bound f C i .
A tightened global lower bound over C can then be obtained by taking the minimum values of the sub-domain lower bounds from all the sub-domains: f = min i f C i .
Branching and bounding will be performed recursively to tighten the approximated global lower bound over C until either (1) the global lower bound f becomes larger than 0 and prove the property or (2) a violation (e.g., adversarial example) is located in a sub-domain to disprove the property.
Essentially, we build a search tree where each leaf is a sub-domain, and the property P can be proven only when it is valid on all leaves.
Soundness of BaB We say the veriﬁcation process is sound if we can always trust the “yes” ( P is veriﬁed) answer given by the veriﬁer.
It is straightforward to see that the whole BaB based veriﬁcation process is sound as long as the bounding method used for each sub-domain C i is sound.
Completeness of BaB The completeness of the BaB-based NN veriﬁcation process, which was usually assumed true in some previous works (Bunel et al., 2020b; 2018), in fact, is not always true even if all possible sub-domains are considered with a sound bounding method.
Additional requirements for the bounding method are required - we point out that a key factor for completeness involves feasibility checking in the bounding method which we will discuss in Section 3.2.
Branching in BaB Since branching step determines the shape of the search tree, the main challenge is to efﬁciently choose a good leaf to split, which can signiﬁcantly reduce the total number of branches and running time.
In this work we focus on branching on activation (ReLU) nodes.
BaBSR (Bunel et al., 2018) includes a simple branching heuristic which assigns each ReLU node a score to estimate the improvement for tightening f by splitting it, and splits the node with the highest score.
Bounding with Linear Programming (LP)
A typical bounding method used in BaB based veriﬁcation is the Linear Programming bounding procedure (sometimes simply referred to as “LP” or “LP veriﬁer” in our paper).
Speciﬁcally, we transform the original veriﬁcation problem into a linear programming problem by relaxing every activation unit as a convex (linear) domain (Ehlers, 2017) and then get the lower bound f C i with a linear solver given domain C i .
For instance, as shown in Figure 1a, g ( i ) j = ReLU ( h ( i ) j ) can be linearly relaxed with the following 3 constraints: (1) g ( i ) j ≥ h ( i ) j ; (2) g ( i ) j ≥ 0 ; (3) g ( i ) j ≤ u ( i ) j u ( i ) j − l ( i )
j ( h ( i ) j − l ( i ) j ) .
Note that the lower bound l ( i ) j and upper bound u ( i ) j for each activation node h ( i ) j are required in the LP construction given C i .
They are typically computed by the existing cheap bounding methods like LiRPA variants (Wong & Kolter, 2018) with low cost.
The tighter the intermediate bounds ( l ( i ) j , u ( i ) j ) are, the tighter f approximated by LP is.
2. L INEAR R ELAXATION BASED P ERTURBATION A NALYSIS (LiRPA)
Bound propagation in LiRPA We used Linear Relaxation based Perturbation Analysis (LiRPA)as bound procedure in BaB to get linear upper and lower bounds of NN output w.r.t input x ∈ C :
[Equation]
l ( i ) j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j h ( i ) j l ( i )
j u ( i )
j h ( i ) j l ( i )
j u ( i )
j h ( i ) j l ( i )
j u ( i )
j h ( i ) j
(a) (b) (c) (d)
A lower bound f can then be simply obtained by taking the lower bound of the linear equation
A x + b w.r.t input x ∈ C , which can be obtained via H¨older’s inequality when C is a (cid:96) p norm ball.
To get the coefﬁcients A , A , b , b , LiRPA propagates bounds of f ( x ) as a linear function to the output of each layer, in a backward manner.
At the output layer h ( L ) ( x ) we simply have:
[Equation]
∈ C [Equation] Then, the next step is to backward propagate the identity linear relationship through a linear layer
h ( L ) ( x ) =
W ( L ) g ( L − 1) ( x ) to get the linear bounds of f ( x ) w.r.t g ( L − 1) :
[Equation]
To get the linear relationship of h ( L − 1) w.r.t f
( x ) , we need to backward propagate through ReLU layer
g ( L − 1) ( x ) = ReLU ( h ( L − 1) ( x )) .
Since it is nonlinear, we perform linear relaxations.
For illustration, considering the j -th ReLU neuron at i -th layer, g ( i ) j ( x ) =
ReLU ( h ( i ) j
( x )) , we can linearly upper and lower bound it by a ( i )
j h ( i ) j ( x ) + b ( i ) j ≤ g ( i ) j
( x ) ≤ a ( i ) j h ( i ) j
( x ) + b ( i ) j , where a ( i ) j , a ( i ) j , b ( i ) j , b ( i ) j are:
[Equation]
Here l ( i ) j ≤ h ( i ) j ( x ) ≤ u ( i ) j are intermediate pre-activation bounds for x ∈ C , and α ( i ) j is an arbitrary value between 0 and 1.
The pre-activation bounds l ( i ) j and u ( i ) j can be computed by treating h ( i ) j ( x ) as the output neuron with LiRPA.
Figure 1(b,c,d) illustrate the relaxation for each state of ReLU neuron.
With these linear relaxations, we can get the linear equation of h ( L − 1) w.r.t output f ( x ) :
[Equation]
b ( L ) ≤ f ( x ) ≤ W ( L ) D ( L − 1)
α h ( L − 1) ( x ) + b ( L ) , x ∈ C D ( L ) α, ( j,j ) = (cid:40) a ( L ) j , W ( L ) j ≥a ( L ) j , W ( L ) j < 0 , b ( L ) =
b (cid:48)
( L ) (cid:62) W ( L ) , where b (cid:48)
( L ) j = (cid:40) b
( L ) j , W ( L ) j ≥b ( L ) j , W ( L )
j <(6)
The diagonal matrices D ( L − 1) α , D
( L − 1) α and biases reﬂects the linear relaxations and also considers the signs in W ( L ) to maintain the lower and upper bounds.
The deﬁnitions for j -th diagonal element
D ( L ) α, ( j,j ) and bias b ( L ) are similar, with the conditions for checking the signs of W ( L ) j swapped.
Importantly, D ( L − 1) α has free variables α ( i ) j ∈ [0 , 1] which do not affect correctness of the bounds.
We can continue backward propagating these bounds layer by layer (e.g., g ( L − 2) ( x ) , h ( L − 2) ( x ) , etc) until reaching g (0) ( x ) = x , getting the eventual linear equations of f ( x ) in terms of input x : L [Equation] x,
[Equation]
U
[Equation]
[Equation]
C , where
[Equation]
Here α denotes α ( i ) j for all unstable ReLU neurons in NN.
The obtained bounds ( L ( x, α ) , U ( x, α ) ) of f ( x ) are linear functions in terms of x .
Beyond the simple feedforward NN presented here, LiRPA can support more complicated NN architectures like DenseNet and Transformers by computing L and U automatically and efﬁciently on general computational graphs (Xu et al., 2020).
Soundness of LiRPA
The above backward bound propagation process guarantees that L ( x, α ) and
U ( x, α ) soundly bound f ( x ) for all x ∈ C .
Detailed proofs can be found in (Zhang et al., 2018;
Singh et al., 2019b) for feedforward NNs and (Xu et al., 2020) for general networks. [Figure]
P ROPOSED A LGORITHM
Overview In this section, we will ﬁrst introduce our proposed efﬁcient optimization of LiRPA bounds on GPUs that can allow us to achieve tight approximation on par with LP or even tighter for some cases but in a much faster manner.
In Fig.
2, we provide a two-layer NN example to illustrate how our optimized LiRPA can improve the performance of BaB veriﬁcation.
In Section 3.2, we then show that feasibility checking is important to guarantee the completeness of BaB, and BaB using LiRPA without feasibility checking will end up to be incomplete.
To ensure completeness, we design our algorithm with minimal usage of LP for checking feasibility of splits.
Finally, we propose a batch split design by solving a batch of sub-domains in a massively parallel manner on
GPUs to fully leverage the beneﬁts of cheap and parallelizable LiRPA.
We further improve BaBSR in a parallel fashion for branching and we summarize the detailed proposed algorithm in Section 3.4.
3. O PTIMIZED LiRPA FOR C OMPLETE V ERIFICATION
Concrete outer bounds with optimizable parameters We propose to use LiRPA as the bounding step in BaB. A pair of sound and concrete lower bound and upper bound ( f, f ) to f ( x ) can be obtained according to Eq.
7 given ﬁxed α
= α 0 :
[Equation]
Because L , U are linear functions w.r.t x when α 0 is ﬁxed, it is easy to solve Eq.
8 using H¨older’s inequality when C is a (cid:96) p norm ball (Xu et al., 2020).
In incomplete veriﬁcation settings, α can be set via certain heuristics (Zhang et al., 2018).
Salman et al.
(2019) showed that, the variable α is equivalent to dual variables in the LP relaxed veriﬁcation problem (Wong & Kolter, 2018).
Thus, an optimal selection of α given the same pre-activation bounds l ( i ) j and u ( i )
j can in fact, lead to the the same optimal solution for f and f as in LP.
Previous complete veriﬁers typically use LiRPA variants to obtain intermediate layer bounds to construct an LP problem (Bunel et al.
; Lu & Kumar (2020)) and solve the LP to obtain bounds at output layer.
The main reason for using LP is that it typically produces much tighter bounds than LiRPA when α is not optimized.
We use optimized LiRPA, which is fast, acceleratorfriendly, and can produce tighter bounds, well outperforming LP for complete veriﬁcation:
[Equation]
The inner minimization or maximization has closed form solutions (Xu et al., 2020) based on
H¨older’s inequality, so we only need to optimize on α .
Since we use a differentiable framework (Xu et al., 2020) to compute the LiRPA bound functions L and U , the gradients ∂ L ∂ α and ∂ U ∂ α can be obtained easily.
Optimization over α can be done via projected gradient descent (each coordinate of α is constrained in [0 , 1] ).
Since the gradient computation and optimization are done on GPUs, the bounding process is still very fast and can be one or two magnitudes faster than solving an LP.
Optimized LiRPA bounds can be tighter than LP Solving Eq.
9 using gradient descent cannot guarantee to converge to the global optima, so it seems the bounds must be looser than LP.
Counterintuitively, by optimizing α , we can potentially obtain tighter bounds than LP.
When a “triangle” relaxation is constructed for LP, intermediate pre-activation bounds l ( i ) j , u ( i ) j must be ﬁxed for the j -th ReLU in layer i .
During the LP optimization process, only the output bounds are optimized; intermediate bounds stay unchanged.
However, in the LiRPA formulation, L ( x, α ) and U ( x, α ) are complex functions of α : since intermediate bounds are also computed by LiRPA, they depend on all α ( i (cid:48) )
j (cid:48) (0 < i (cid:48) < i ) in previous layers.
Thus, the gradients ∂ L ∂ α and ∂ U ∂ α can tighten output layer bounds f and f indirectly by tightening intermediate layer bounds, forming a tighter convex relaxation for the next iteration.
An LP solver cannot achieve this because adding l ( i ) j and u ( i ) j as optimization variables makes the problem non-linear.
This is the key to our success of applying LiRPA based bounds for the complete veriﬁcation setting, where tighter bounds are essential.
[Figure]
In Figure 3, we illustrate our optimized LiRPA bounds and the LP solution.
Initially, we use LiRPA with α set via a fast heuristic to compute intermediate layer bounds l ( i ) j and u ( i ) j , and then use them to build a relaxed LP problem.
The solution to this initial LP problem (red line) is much tighter than the
LiRPA solution with the heuristically set α (the left-most point of the blue line).
Then, we optimize α with gradient decent, and LiRPA quickly outperforms this initial LP solution due to optimized tighter intermediate layer bounds.
We can create a new LP with optimized intermediate bounds (light blue line), producing a slightly tighter bound than LiRPA with optimized α .
The LP bounds in most existing complete veriﬁers all use intermediate layer bounds obtained from unoptimized LiRPA bounds or even weaker methods like interval arithmetic, ending up to the solution close to or lower than the red line in Figure 3. Instead, our optimized LiRPA bounds can produce tight bounds, and also exploit parallel acceleration from machine learning accelerators, leading to huge improvements in veriﬁcation time compared to existing baselines.
ReLU Split Constraints In the BaB process, when a ReLU h ( i ) j is split into two sub-domains ( h ( i ) j ≥ 0 and h ( i ) j < 0 ), we simply set l ( i ) j ≥ 0 and u ( i ) j < 0 in bounding step.
It tighten the LiRPA bounds by forcing the split ReLU linear, reducing relaxation errors.
However, when splits are added, LiRPA and LP are not equivalent even under ﬁxed l ( i ) j , u ( i ) j and optimal α .
After splits, LiRPA cannot check certain constraints where LP is capable to, as we will discuss in the next section.
3. C OMPLETENESS WITH M INIMAL U SAGE OF LP B OUNDING P ROCEDURE
Even though our optimized LiRPA can bring us huge speed improvement over LP for BaB based veriﬁcation, we observe that it may end up to be incomplete due to the lack of feasibility checking: it cannot detect some conﬂicting settings of ReLU splits.
We state such an observation in Theorem 3.1:
Theorem 3.1 (Incompleteness without feasibility checking)
When using LiRPA variants described in Section 2.3 as the bounding procedure, BaB based veriﬁcation is incomplete.
We prove the theorem by giving a counter-example in Appendix A.1 where all ReLU neurons are split and thus LiRPA runs on a linear network for each sub-domain.
As a result, LiRPA can still be indecisive for the veriﬁcation problem.
The main reason is that LiRPA variants will lose the feasibility information encoded by the sub-domain constraints.
For illustration, consider a subdomain C
i = C ∩ ( h ( [Equation] [Equation] 1 < 0) ∩ (
[Equation]
[Equation] [Equation] 2 ≥ 0) , LiRPA will force g ( i 1 )
j 1 ( x ) =
(inactive ReLU, a zero function) and g ( i 2 )
j 2 ( x ) =
h ( i 2 )
j 2 ( x ) (active ReLU, an identity function) respectively and propagate these bounds to get the approximated lower bound f C i .
However, the split feasibility constraint ( h ( i 1 )
j 1 < 0) ∩ ( h ( i 2 )
j 2 ≥ 0) is ignored, so two conﬂict splits may be conducted (e.g., when h ( i 1 ) j 1 < 0 , h ( i 2 )
j 2 cannot be ≥ 0 ).
On the contrary, LP can fully preserve such feasibility information due to the linear solver involved and detect the infeasible sub-domains.
Then, in Theorem 3.2 we show that the minimal usage of feasibility checking with LP can guarantee the completeness of BaB with LiRPA.
[Table]
Theorem 3.2 (Minimal feasibility checking for completeness) When using LiRPA variants described in Section 2.3 as the bounding procedure, BaB based veriﬁcation is complete if all infeasible leaf sub-domains (i.e., sub-domains cannot be further split) are detected by linear programming.
We prove the theorem in Appendix A.2, where we show that by checking the feasibility of splits with LP, we can eliminate the cases where incompatible splits are chosen in the LiRPA BaB process.
Since LP is slow while LiRPA is highly efﬁcient, we propose to only use LP when the LiRPA based bounding process is stuck, either (1) when partitioning and bounding new sub-domains with LiRPA cannot further improve the bounds, or (2) when all unstable neurons have been split.
In this way, the infeasible sub-domains can be eventually detected by occasional usage of LP while the advantage of massive parallel LiRPA on GPUs is fully enjoyed.
We will describe our full algorithm in Sec. 3.4.
3. B ATCH S PLITS
SOTA BaB methods (Bunel et al., 2020b; Lu & Kumar, 2020) only split one sub-domain during each branching step.
Since we use cheap and GPU-friendly LiRPA bounds, we can select a batch of sub-domains to split and propagate their LiRPA bounds in a batch.
Such a batch splitting design can greatly improve hardware efﬁciency on GPUs.
Given a batch size n that allows us to fully use the GPU memory available, we can obtain n bounds simultaneously.
It grows the search tree on a single leaf by a depth of log 2 n , or split n/ 2 leaf nodes at the same time, accelerating by up to n times.
3. O UR C OMPLETE V ERIFICATION F RAMEWORK
Our LiRPA based complete veriﬁcation framework is presented in Alg. 1.
The algorithm takes a target NN function f and a domain C as inputs.
We run optimized LiRPA to get initial bounds ( f, f ) for x ∈ C (Line 2).
Then we utilize the power of GPUs to split in parallel and maintain a global set P storing all the sub-domains which cannot be veriﬁed with optimized LiRPA (Line 5-10).
Speciﬁcally, batch pick out improves BaBSR (Bunel et al., 2018) in a parallel manner to select n sub-domains in P and determine the corresponding ReLU neuron to split for each of them.
If the length of P is less than n , then we reduce n to the length of P .
batch split splits each selected
C i to two sub-domains C li and C ui by forcing the selected unstable ReLU neuron to be positive and negative, respectively.
optimize LiRPA runs optimized LiRPA in parallel as a batch and returns the lower and upper bounds for n selected sub-domains simultaneously.
Domain Filter ﬁlters out veriﬁed sub-domains (proved with f C i ≥ 0 ) and we insert the remaining ones to P .
The loop breaks if the property is proved ( f ≥ 0 ) or a counter-example is found in any sub-domain ( f < 0 ).
To avoid excessive splits, we set the maximum length of the sub-domains to η (Line 12).
Once the length of P reaches this threshold, compute bound LP will be called.
It solves these η sub-domains by LP (one by one in a loop, or in parallel if using multiple CPUs is allowed) with optimized LiRPA computed intermediate layer bounds.
If a sub-domain C i ∈ P (which previously cannot be veriﬁed by LiRPA) is proved or detected to be infeasible by LP, as an effective heuristic, we will backtrack and prioritize to check its parent node with LP.
If the parent sub-domain is also proved or infeasible, we can prune all its child nodes to greatly reduce the size of the search tree.
Completeness of our framework Our algorithm is complete , because we follow Theorem 3.2 and check feasibility of all split sub-domains that have deep BaB search tree depth (length of P reaches threshold η ), forming a superset of the worst case where all ReLU neurons are split.
E XPERIMENTS
In this section, we compare our veriﬁer against the state-of-the-art ones to illustrate the effectiveness of our proposed framework.
Overall, our veriﬁer is about 10X, 4X and 20X faster than the best
LP-based veriﬁer (Lu & Kumar, 2020) on the Base, Wide and Deep models, respectively.
Setup We follow the most challenging experimental setup used in the state-of-the-art veriﬁers
GNN- ONLINE (Lu & Kumar, 2020) and B A BSR (Bunel et al., 2020b).
Speciﬁcally, we evaluate on CIFAR10 dataset on three NNs: Base, Wide and Deep.
The dataset is categorized into three difﬁculty levels: Easy, Medium, and Hard, which is generated according to the performance of BaBSR.
The veriﬁcation task is deﬁned as given a l ∞ norm perturbation less than (cid:15) , the classiﬁer will not predict a speciﬁc (predeﬁned) wrong label for each image x
(see Appendix B).
We set batch size n = 400 , 200 , 200 for Base, Wide and Deep model respectively and threshold η = 12000 .
More details on experimental setup are provided in Appendix B.
Our code is available at https://github.com/kaidixu/LiRPA_Verify . Comparisons against state-of-the-art veriﬁers We include ﬁve different methods for comparison: (1) B A BSR (Bunel et al., 2020b), a BaB and LP based veriﬁer using a simple ReLU split heuristic; (2) MIPP LANET (Ehlers, 2017), a customized MIP solver for NN veriﬁcation where unstable ReLU neurons are randomly selected for split; (3) GNN (Lu & Kumar, 2020) and (4) GNN-O NLINE (Lu & Kumar, 2020) are BaB and LP based veriﬁers using a learned graph neural network (GNN) to guide the ReLU split.
(5) P ROXIMAL B A BSR (Bunel et al., 2020a) is a very recently proposed veriﬁcation framework based on Lagrangian decomposition which also supports GPU acceleration without solving LPs.
All methods use 1 CPU with 1 GPU.
The timeout threshold is 3,600 seconds.
For the Base model in different difﬁculty levels, Easy, Medium and Hard, Table 1 shows that we are around 5 ∼ 40X faster than baseline BaBSR and around 2 ∼ 20X faster than GNN split baselines.
The accumulative solved properties with increasing runtime are shown in Figure 4.
In all our experiments, we use the basic heuristic in BaBSR for branching and do not use GNNs, so our speedup comes purely from the faster LiRPA based bounding procedure.
We are also competitive against Lagrangian decomposition on GPUs.
[Table]
[Figure]
[Figure]
Performance on Larger Models In Table 1, we show that our veriﬁer is more scalable on larger (wider or deeper) NNs compared to other state-of-the-art veriﬁers.
Our method enjoys efﬁcient GPU acceleration particularly on Deep model and can achieve 30X speedup compared to B A BSR, and we are also signiﬁcantly faster than Lagrangian decomposition based GPU veriﬁer (P ROXIMAL B A BSR).
When compared to the state-of-the-art LP based BaB, GNN-O NLINE , our method can save 20X running time on Deep model.
In Appendix C, we analyze the effectiveness of optimized LiRPA and batch splits separately, and ﬁnd that optimized LiRPA is crucial for NN veriﬁcation.
Performance comparisons of our proposed framework on CPU cores without GPU acceleration are included in Appendix D.
R ELATED W ORK
Complete veriﬁers Early complete veriﬁers rely on satisﬁability modulo theory (SMT)
(Katz et al., 2017; Huang et al., 2017; Ehlers, 2017) and mixed integer linear programming (MILP) (Tjeng et al., 2019a; Dutta et al., 2018), and they typically do not scale well.
Higher order logic provers such as proof assistant (Bentkamp et al., 2018) can also be potentially used for NN veriﬁcation, but their scalability to the NN setting has not been demonstrated.
Recently, Bunel et al.
uniﬁed many approaches used in various complete veriﬁers into a BaB framework.
An LP based bounding procedure is used in most of the existing BaB framework (Bunel et al., 2018;
Wang et al., 2018c;
Royo et al., 2019; Lu & Kumar, 2020).
For branching, two categories of branching strategies were proposed: (1) input node branching (Wang et al., 2018c; Bunel et al., 2020b; Royo et al., 2019;
Anderson et al., 2019) where input features are divided into sub-domains, and (2) activation node (especially, ReLU) branching (Katz et al., 2017; Bunel et al., 2018; Wang et al., 2018b; Ehlers, 2017;
Lu & Kumar, 2020) where hidden layer activations are split into sub-domains.
Bunel et al.
(2018) found that input node branching cost is exponential to input dimension.
Thus, many state-of-the-art veriﬁers use activation node branching instead, focusing on heuristics to select good nodes to split.
BaBSR (Bunel et al., 2018) prioritizes ReLUs for splitting based on their pre-activation bounds; Lu & Kumar (2020) used a graph neural network (GNN) to learn good splitting heuristics.
Our work focuses on improving bounding and can use better branching heuristics to achieve further speedup.
Two mostly relevant concurrent works using GPUs for accelerating NN veriﬁcation are: (1)
GPUPoly (M¨uller et al., 2020), an extension of DeepPoly on CUDA, is still an incomplete veriﬁer .
Also, it is implemented in CUDA C++, requiring manual effort for customization and gradient computation, so it is not easy to get the gradients for optimizing bounds as we have done in Section 3.1.
(2) Lagrangian Decomposition (Bunel et al., 2020a) is a GPU-accelerated BaB based complete veriﬁer that iteratively tightens the bounds based on a Lagrangian decomposition optimization formulation and does not reply on LP.
However, it solves a much more complicated optimization problem than LiRPA, and typically requires hundreds of iterations to converge for a single sub-domain.
Incomplete veriﬁers Many incomplete veriﬁcation methods rely on convex relaxations of NN, replacing nonlinear activations like ReLUs with linear constraints (Wong & Kolter, 2018;
Wang et al., 2018b; Zhang et al., 2018; Weng et al., 2018; Gehr et al., 2018; Singh et al., 2018a;b; 2019b;a) or semideﬁnite constraints (Raghunathan et al., 2018; Dvijotham et al., 2020; Dathathri et al., 2020). Tightening the relaxation for incomplete veriﬁcation was discussed in (Dvijotham et al., 2018; Singh et al., 2019a; Lyu et al., 2019; Tjandraatmadja et al., 2020).
Typically, tight relaxations require more computation and memory in general.
We refer the readers to (Salman et al., 2019) for a comprehensive survey.
Recently, Xu et al.
(2020) categorized the family of linear relaxation based incomplete veriﬁers into LiRPA framework, allowing efﬁcient implementation on machine learning accelerators.
Our work uses LiRPA as the bounding procedure for complete veriﬁcation and exploits its computational efﬁciency to accelerate, and our main contribution is to show that we can use fast but weak incomplete veriﬁers as the main driver for complete veriﬁcation when strategically applied.
C ONCLUSION
We use a LiRPA based incomplete NN veriﬁer to accelerate the bounding procedure in branch and bound (BaB) for complete NN veriﬁcation on massively parallel accelerators.
We use a fast gradient based procedure to tighten LiRPA bounds.
We study the completeness of BaB with LiRPA, and show up to 5X speedup compared to state-of-the-art veriﬁers across multiple models and properties. A CKNOWLEDGMENTS
This work is supported by NSF grant CNS18-01426; an ARL Young Investigator (YIP) award; an
NSF CAREER award; a Google Faculty Fellowship; a Capital One Research Grant; and a J.P. Mor- gan Faculty Award; Air Force Research Laboratory under FA8750-18-2-0058; NSF IISand NSF IIS-2008173.
A P ROOFS A. P ROOF OF T HEOREM 3.
We prove Theorem 3.1 by providing a simple counterexample, and we illustrate the necessity of feasibility checking for the completeness of BaB based veriﬁcation.
Consider an NN with only two [-hidden nodes h 
-]ReLU units g (2) =
ReLU ( h (2)1 ) and g (2) = ReLU ( h (2)2 ) where they share the same one dimension input h (2)
= h (2) = x . The ﬁnal output function of NN is deﬁned as f = g (2) − g
As a veriﬁcation problem, we want to verify the property f ≥ 0 where x = [ − 1 , 1] .
Since hidden nodes h 1 and h 2 are exactly the same, the ground-truth output range is f ∗ ( x ) ∈ [0 , 0] .
A complete BaB based veriﬁer is expected to obtain that optimal bound and prove the property after splitting h 1 and h 2 together while BaB with only LiPRA cannot guarantee that completeness.
Speciﬁcally, BaB with only LiRPA will split the original domain x ∈ [ − 1 , 1] into four sub-domains and approximate the bound with LiRPA respectively:
(1) (feasible) sub-domain x ∈ [ − 1 , 1] , h (2)1 ≥ 0 , h (2)2 ≥ 0 with output f =
[ x, x ] − [ x, x ] ∈ [0 , 0] (2) (feasible) sub-domain x ∈ [ − 1 , 1] , h (2)1 < 0 , h (2)2 < 0 with output f = [0 , 0] − [0 , 0] ∈ [0 , 0] (3) (infeasible) sub-domain x ∈ [ − 1 , 1] , h (2)1 < 0 , h (2)2 ≥ 0 with output f = [0 , 0] − [ x, x ] ∈ [ − 1 , 1] (4) (infeasible) sub-domain x ∈ [ − 1 , 1] , h (2)1 ≥ 0 , h (2)2 < 0 with output f = [ x, x ] − [0 , 0] ∈ [ − 1 , 1]
Only the ﬁrst two split sub-domains are feasible and therefore the ground-truth lower bound 0 can be obtained by taking the minimum of the estimated bounds from sub-domains (1) and (2).
However, pure LiRPA is not able to tell the infeasibility of sub-domains (3) and (4) and thus BaB with pure
LiRPA will report the minimum − 1 got from all these four sub-domains as the global lower bound for the original input domain, ending up not being able to verify the property, i.e., incomplete.
A. P ROOF OF T HEOREM 3.
We prove Theorem 3.2 by considering the worst case where all unstable ReLU neurons are split.
Given a neural network function f with input domain C , assume there are N unstable ReLU neurons { g i = ReLU ( h i ) | i = 1 , · · · , N } in total.
In the worst case, we have 2 N leaf sub-domains S =
{C i | i = 1 , · · · , 2 N } , where each C i corresponds to one assignment of unstable ReLU neuron splits.
For example, we can have
[Equation]
Note that by deﬁnition the original input domain C = ∪ C (cid:48) ∈S C (cid:48) ; in other words, all the 2 N split sub-domains combined will be the same as the original input domain.
Not all of the sub-domains are actually feasible, due to the consistency requirements between neurons.
For example, in our proof in Section A.1, h (2) and h (2) cannot be both ≥ 0 or both < 0 .
We can divide the sub-domains S into two mutually exclusive sub-sets, S feas for all the feasible sub-domains, and S infeas for all the infeasible sub-domains.
We have C = ∪ C (cid:48) ∈S feas C (cid:48) since these infeasible sub-domains are empty sets.
We ﬁrst show that linear programming (LP) can be used to effectively detect these infeasible subdomains.
For some C (cid:48) ∈ S infeas , because all the ReLU neurons are ﬁxed to be positive or negative, no relaxation is needed and the network is essentially linear; thus, the input value of every hidden neuron h i can be written as a linear equation w.r.t.
input x .
We add all the Boolean predicates on h i to a LP problem as linear constraints w.r.t x .
If this LP is feasible, then we can ﬁnd some input xthat assigns compatible values to all h i ; otherwise, the LP is infeasible.
Due to the lack of feasibility checking in LiRPA, the computed global lower (or upper) bounds from LiRPA is f LiRPA =
min C (cid:48) ∈S f C
[Equation]
= min (cid:16) min C
[Equation]
∈S feas f C (cid:48) , min C (cid:48) ∈S infeas f C (cid:48) (cid:17) . With feasibility checking from LP, we can remove all infeasible sub-domains from this min such that they do not contribute to the global lower bound: f = min C (cid:48) ∈S feas f C (cid:48) .
To prove the whole BaB veriﬁcation is complete, it is sufﬁcient to prove this lower bound f is the exact minimum of f bounded in C .
Since any sub-domain C (cid:48) ∈ S feas is a leaf sub-domain with no unstable ReLU neurons, the neural network bounded within C (cid:48) is a linear function.
LiRPA can give an exact minimum of f within sub-domain C (cid:48) .
Since C = ∪ C (cid:48) ∈S feas C (cid:48) (in other words, S feas covers all the feasible sub-domains within C ), the minimal value for all of them f = min C (cid:48) ∈S feas f C (cid:48) forms the exact minimum of f within the input domain C .
Thus, BaB with LiRPA based bounding procedure is complete when feasibility checking is applied.
B E XPERIMENTAL S ETUP
We use the same set of models and benchmark examples used in the state-of-the-art veriﬁers GNNONLINE (Lu & Kumar, 2020) and B A BSR (Bunel et al., 2020b).
Speciﬁcally, we evaluate on the most challenging CIFAR-10 dataset with the same standard robustly trained convolutional neural networks: Base, Wide, and Deep.
These model structures are also used in (Lu & Kumar, 2020;
Bunel et al., 2020a).
The Base model contains 2 convolution layers with 8 and 16 ﬁlters as well as two linear layers with 100 and 10 hidden units, respectively.
In total, the Base model has 3,
ReLU activation units.
The Wide model contains 2 convolution layers with 16 and 32 ﬁlters and two linear layers with 100 and 10 hidden units, respectively, which contains 6,244 ReLU activation units in total.
The Deep model contains 4 convolution layers and all of them have 8 ﬁlters and two linear layers with 100 and 10 hidden units, respectively, with 3,756 ReLU activation units in total.
The source code of B A BSR, MIP PLANET , GNN and GNN-O NLINE are available at https: //github.com/oval-group/GNN_branching .
The source code of P ROXIMAL B A BSR is available at https://github.com/verivital/vnn-comp by replacing the dataset to the same one we used here.
Given an correctly classiﬁed image x with label y c , and another wrong label y c (cid:48) (cid:54) =
y c (pre-deﬁned in this benchmark) and (cid:15) , the veriﬁer needs to prove:
[Equation]
where f ( · ) is the logit-layer output of a multi-class classiﬁer, e ( c ) and
e ( c (cid:48) ) are one-hot encoding vectors for labels y c and y c (cid:48) .
We want to verify that for a given (cid:15) , the trained classiﬁer will not predict wrong label y c (cid:48) for image x .
All properties including x , (cid:15) , and c (cid:48) are provided by (Lu &
Kumar, 2020).
Speciﬁcally, they categorize veriﬁcation properties solved by B A BSR within 800s as easy, between 800s and 2400s as medium and more than 2400s as hard.
Our experiments are conducted on one Intel I7-7700K CPU and one Nvidia GTX 1080 Ti GPU.
The parallel batch size n is set to 400, 200 and 200 for base, wide and deep model respectively and the η is set to 12,000 due to GPU memory constraint.
To make a fair comparison, we use one CPU core for all methods.
Also, we use one GPU for GNN, GNN-O NLINE , P ROXIMAL -B
A BSR and our method.
When optimizing the LiRPA bounds, we apply 100 steps gradient decent for obtaining the initial f (Line 2 in Algorithm 1).
After that, we use 10 steps gradient decent (Line 7) and early stop once f > 0 or f has no improvement.
C A BLATION STUDY
Our efﬁcient framework leverages two powerful components: (1) optimized LiRPA bounds and (2) batch splits on GPUs.
In this section, we conduct breakdown experiments to show how each individual technique can help with complete veriﬁcation.
As we can see in Table 2, using batched split with unoptimized LiRPA is not very successful and cannot beat B A BSR.
We observe that, without optimized LiRPA, the bounds are very loose and cannot quickly improve the global lower bound.
In contrast, using optimized LiRPA bounds without batch splits (splitting a single node at a time and running a batch size of 1 on GPU) can still signiﬁcantly speed up complete veriﬁcation, around 2 ∼ 10X compared to B A BSR.
Finally, combining batch splits and optimized LiRPA allows us to gain up to 44X speedup compared to B A BSR.
[Table]
D C OMPLETE VERIFICATION WITH LiRPA ON CPU VS GPU
For a fair comparison, we only use one CPU core and one GPU (the same as GNN and GNNO NLINE ) in our experimental results in Section 4.
In this section, we investigate the performance of our algorithm for the cases where one or multiple CPU cores are available without GPU acceleration.
Note that existing baselines such as B A BSR and MIP PLANET can only effectively utilize one
CPU core subject to the Gurobi solver.
GNN and GNN-O NLINE can utilize one GPU to run the
GNN during branching while the rest of the veriﬁcation processes all perform on one CPU core.
In contrast, our method is much more ﬂexible, and we are not limited by the number of CPU cores or
GPUs.
When running on multi-core CPUs, LiRPA can be automatically accelerated by the underlying linear algebra library (e.g., Intel MKL or OpenBLAS) since the main computation of LiRPA is just matrix multiplications.
In Figure 5, we show the performance of our algorithm on a single CPU core and multiple CPU cores (in blue), and compare it to our main results with one CPU core plus one GPU (in red).
As we can see, the running time decreases when the number of CPU cores increases, but the speedup is not linear due to the limitation of the underlying linear algebra library and hardware.
There is a big gap between the running time on 8 CPU cores and the time on one CPU core + one GPU, and the performance gap is more obvious on Wide and Deep models.
Thus, the speedup of LiRPA computation on GPUs is signiﬁcant.
However, surprisingly, even when using only one CPU core, we are still signiﬁcantly faster than baseline B A BSR and also get very competitive performance when compared to GNN-O NLINE which needs one GPU additionally.
This shows the efﬁciency of LiRPA based veriﬁcation algorithms.
[Figure]
[Figure] instances)
[Figure]
(B A BSR: 522.48s)
(B A BSR: 3325.65s) (B A BSR: 2855.19s)