F AST AND C OMPLETE : E NABLING C OMPLETE N EURAL N ETWORK V ERIFICATION WITH R APID AND M ASSIVELY P ARALLEL I NCOMPLETE V ERIFIERS
Anonymous authors
Paper under double-blind review
A BSTRACT
Formal veriﬁcation of neural networks (NNs) is a challenging and important problem.
Existing efﬁcient complete solvers typically require the branch-and-bound (BaB) process, which splits the problem domain into sub-domains and solves each sub-domain using faster but weaker incomplete veriﬁers, such as Linear Programming (LP) on linearly relaxed sub-domains.
In this paper, we propose to use the backward mode linear relaxation based perturbation analysis (LiRPA) to replace
LP during the BaB process, which can be efﬁciently implemented on the typical machine learning accelerators such as GPUs and TPUs.
However, unlike LP,
LiRPA when applied naively can produce much weaker bounds and even cannot check certain conﬂicts of sub-domains during splitting, making the entire procedure incomplete after BaB. To address these challenges, we apply a fast gradient based bound tightening procedure combined with batch splits and the design of minimal usage of LP bound procedure, enabling us to effectively use LiRPA on the accelerator hardware for the challenging complete NN veriﬁcation problem and signiﬁcantly outperform LP-based approaches.
On a single GPU, we demonstrate an order of magnitude speedup compared to existing LP-based approaches.
I NTRODUCTION
Although neural networks (NNs) have achieved great success on various complicated tasks, they remain susceptible to adversarial examples (Szegedy et al., 2013): imperceptible perturbations of test samples might unexpectedly change the NN predictions.
Therefore, it is crucial to conduct formal veriﬁcation for NNs such that they can be adopted in safety or security-critical settings.
Formally, the neural network veriﬁcation problem can be cast into the following decision problem:
Given a neural network f ( · ) , an input domain C , and a property P .
∀ x ∈ C , does f ( x ) satisfy P ?
The property P is typically a desirable outputs of the NN conditioned on the inputs.
Typically, consider is a binary classiﬁer f ( x ) and is a positive example x 0 , we can set P to be f ( x ) ≥where x is bounded within an l ∞ norm ball C
= { x |(cid:107) x − x 0 (cid:107) ∞ ≤ (cid:15) } .
The success of veriﬁcation guarantees that the label of x 0 cannot ﬂip for any perturbed inputs bounded within C .
In this paper we study the complete veriﬁcation setting, where given sufﬁcient time, the veriﬁer should give a deﬁnite “yes/no” answer for a property under veriﬁcation.
In the above setting, it must solve the non-convex optimization problem min x ∈C f ( x ) to a global minimum.
Complete NN veriﬁcation is generally a challenging NP-Hard problem (Katz et al., 2017) which usually requires expensive formal veriﬁcation methods such as SMT (Katz et al., 2017) or MILP solvers (Tjeng et al., 2019b).
On the other hand, incomplete solvers such as convex relaxations of NNs (Salman et al., 2019) can only provide a sound analysis, i.e., they can only approximate the lower bound of min x ∈ C
f
( x ) as f and verify the property when f ≥ 0 .
No conclusion can be drawn when f < 0 .
Recently, a Branch and Bound (BaB) style framework (Bunel et al., 2018; 2020b) has been adopted for efﬁcient complete veriﬁcation.
BaB solves the optimization problem min x ∈C f ( x ) to a global minimum by branching into multiple sub-domains recursively and bounding the solution for each sub-domain using incomplete veriﬁers.
BaB typically uses a Linear Programming (LP) bounding procedure as an incomplete veriﬁer to provide feasibility checking and relatively tight bounds for each sub-domain.
However, the relatively high solving cost of LPs and incapability of parallelization (especially on massively parallel hardware accelerators like GPUs or TPUs) greatly limit the performance and scalability of the existing complete BaB based veriﬁers.
In this paper, we aim to use fast and typically weak incomplete veriﬁers for complete veriﬁcation.
Speciﬁcally, we focus on a class of incomplete veriﬁers using efﬁcient bound propagation operations, referred to as linear relaxation based perturbation analysis (LiRPA) algorithms (Xu et al., 2020).
Representative algorithms in this class include convex outer adversarial polytope (Wong & Kolter, 2018), CROWN (Zhang et al., 2018) and DeepPoly (Singh et al., 2019b).
LiRPA algorithms exhibit high parallelism as the bound propagation process is similar to forward or backward propagation of NNs, which can fully exploit machine learning accelerators (e.g., GPUs and TPUs).
Although LiRPA bounds are very efﬁcient for incomplete veriﬁcation, especially in training certiﬁed adversarial defenses (Wong et al., 2018; Mirman et al., 2018; Wang et al., 2018a; Zhang et al., 2020), they are generally considered too loose to be useful in the complete veriﬁcation setting with BaB compared to LPs.
As we will demonstrate later, using LiRPA bounds naively in BaB cannot even guarantee the completeness, and thus we need additional measures to make them useful for complete veriﬁcation.
In fact, LiRPA methods have been used to get upper and lower bounds for each ReLU neuron in constructing tighter LPs (Bunel et al., 2018; Lu & Kumar, 2020). Except one concurrent work (Bunel et al., 2020a), complete veriﬁers are based on relatively expensive solvers like LP and cannot take beneﬁt from massively parallel hardware like LiRPA does.
Our main contributions are:
• We show that LiRPA bounds, when improved with fast gradient optimizers, can potentially outperform bounds obtained by LP veriﬁers.
This is because LiRPA allows joint optimization of both intermediate layer bounds of ReLU neurons (which determine the tightness of relaxation) and output bounds, while LP can only optimize output bounds with ﬁxed relaxations on ReLU neurons.
• We show that BaB purely using LiRPA bounds is insufﬁcient for complete veriﬁcation due to the lack of feasibility checking for sub-domains.
To address this issue, we design our algorithm to only invoke LP when absolutely necessary and exploits hardware parallelism when possible.
• To fully exploit the hardware parallelism on the machine learning accelerators, we use a batch splitting approach that splits on multiple neurons simultaneously, further improving our efﬁciency.
• On a few standard and representative benchmarks, our proposed NN veriﬁcation framework can outperform previous baselines signiﬁcantly, with a speedup of around 30X compared to basic BaB baselines, and up to 5X compared to recent state-of-the-art complete veriﬁers.
B ACKGROUND 2. F ORMAL DEFINITION OF N EURAL NETWORK (NN) VERIFICATION
Notations of NN.
For illustration, we deﬁne an L -layer feedforward NN f : R | x | → R with L weights W ( i ) ( i ∈ { 1 , · · · , L } ) recursively as f ( i ) ( x ) =
W ( i ) h
( i − 1) ( x ) ,
hidden layer h
( i ) ( x ) =
ReLU ( f ( i ) ( x )) , input layer h (0) ( x ) = x , and ﬁnal output f ( x ) = f
( L ) ( x ) .
For simplicity we ignore biases.
We use h ( i ) j to represent the j -th neuron in i -th layer.
We focus on verifying ReLU based
NNs, but our method can also be generalized to other activation functions supported by LiRPA.
NN Veriﬁcation Problem.
Given an input x , its bounded input domain C , and a feedforward NN f ( · ) , the aim of formal veriﬁcation is to prove or disprove certain properties P of NN outputs.
Since most properties studied in previous works can be expressed as a Boolean expression over a linear equation of network output, where the linear property can be merged into the last layer weights of a
NN, the ultimate goal of complete veriﬁcation reduces to prove or disprove:
[Equation]
Due to the non-linearity and non-convexity of NNs, ﬁnding the exact minimum of f ( x ) over the bounded input domain C is challenging as the optimization process is generally an NP-hard problem (Katz et al., 2017).
However, in practice, a sound approximation of the lower bound for f ( x ) , denoted as f , can be more easily obtained and is sufﬁcient to verify the property.
Thus, a good veriﬁcation strategy to obtain a tight approximation f can save several magnitudes of time cost.
Note that the approximation must be sound, i.e., ∀ x ∈ C , f ≤ f ( x ) such that proving f ≥ 0 is sufﬁcient to prove the desired property f ( x ) ≥
given x ∈ C .
2. B RANCH AND B OUND (B A B) FRAMEWORK FOR N EURAL N ETWORK V ERIFICATION
Branch and Bound (BaB), an effective strategy in solving traditional combinatorial optimization problems, has been customized and widely adopted for NN veriﬁcation (Bunel et al., 2018; 2020b).
Speciﬁcally, BaB based veriﬁcation framework is a recursive process, consisting of two main steps: branching and bounding.
For branching , BaB based methods will divide the bounded input domain
C into sub-domains {C i
|C
=
(cid:83) i C i } , each deﬁned as a new independent veriﬁcation problem.
For instance, it can split a ReLU unit h to be negative and positive cases as C
= C ∩
h ≥ 0 and
C 1 = C ∩ h < 0 for a ReLU-based network; For each sub-domain C i , BaB based methods will perform bounding to obtain a relaxed but sound lower bound f C i .
A tightened global lower bound over C can then be obtained by taking the minimum values of generated lower bounds from all the sub-domains as f = min
i f C i .
Branching and bounding will be performed recursively to tighten the approximated global lower bound over C until either (1) the approximated lower bound f becomes larger than 0 and prove the property or (2) a violation is located and disprove it.
Soundness of BaB We say the veriﬁcation process is sound if we can always trust the ”yes/no” answer given by the veriﬁer.
It is straightforward to see that the whole BaB based veriﬁcation process is sound as long as the bounding methods used for each sub-domain C i are sound.
Completeness of BaB The completeness of the BaB-based NN veriﬁcation process, which was assumed in the previous work (Bunel et al., 2020b; 2018), is not always true even if all possible sub-domains are considered with a sound bounding method.
Taking ReLU-based NN veriﬁcation as an example, contrary to intuition, we may be still unable to verify certain properties when all ReLU units are split into positive/negative cases.
We point out that the key factor for completeness is to involve feasibility checking in the bounding method and we prove the completeness of our proposed method in Section 3.2.
Branching in BaB In BaB, we build a search tree where each leaf is a sub-domain, and the property can be proven only when it is valid on all leaves.
The branching step determines the shape of the tree, and when good leaves are chosen for further split the total number of branches and running time can be signiﬁcantly reduced.
BaBSR is a simple branching heuristic proposed by Bunel et al.
(2018), which assigns each activation node a score to estimate the potential improvement for tightening f by splitting it, and it then selects the node with the largest score to split for each branching step.
The score of each activation (ReLU) node could be roughly estimated by its upper and lower bounds obtained from the sound approximation methods during each bounding step.
Bounding with Linear Programming (LP)
A typical bounding method used in BaB based veriﬁcation is Linear Programming bounding procedure (sometimes simply referred to as “LP” or “LP veriﬁer” in our paper).
Speciﬁcally, they transform the original veriﬁcation problem into a linear program problem by relaxing every activation unit as a linear convex domain (Ehlers, 2017) and then get the lower bound f C i with a linear solver given domain C i .
For instance, as shown in Figure 1a, h ( i ) j = ReLU ( x ( i ) j ) can be linearly relaxed with the following three constraints: (1) h ( i ) j ≥ x ( i ) j ; (2) h
( i ) j ≥ 0 ; (3) h ( i )
j ≤ u ( i ) j u ( i ) j − l ( i ) j ( x ( i ) j − l ( i ) j ) .
Note that the lower bound l ( i ) j and upper bound u ( i ) j for each activation node h ( i ) j are required in the LP construction given x ∈ C .
They are typically computed by the existing cheap bounding methods like convex outer adversarial polytope (Wong &
Kolter, 2018) or LiRPA (Xu et al., 2020) with low cost.
The tighter the intermediate bounds ( l ( i ) j , u ( i ) j ) are, the tighter f approximated by LP will be.
2. L INEAR R ELAXATION BASED P ERTURBATION A NALYSIS (LiRPA)
Bound propagation in LiRPA Linear relaxation based perturbation analysis (LiRPA) 1 aims to ﬁnd linear upper and lower equations of NN output w.r.t input x ∈ C :
[Equation]
A tight and sound approximation to the lower bound f can then be simply obtained by taking the lower bound of linear equation A x + b w.r.t input x ∈ C .
l ( i ) j u
( i ) j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j l ( i )
j u ( i )
j x ( i )
j h ( i ) j
(a) (
[Figure]
) (c) (d)
To get the coefﬁcients A , A , b , b , LiRPA propagates bounds of f ( x ) as a linear function to the output of each layer, in a backward manner.
At the output layer we simply have:
[Equation]
Then, the next step is to backward propagate the identity linear relationship through a linear layer f ( L ) =
W ( L ) h
( L − 1) to get the linear bounds of f ( x ) w.r.t h ( L − 1) :
[Equation]
C (4)
To get the linear relationship of f ( L − 1) w.r.t f
( x ) , we need to backward propagate through ReLU layer
h
( L − 1) ( x ) = ReLU ( f ( L − 1) ( x )) .
Since it is nonlinear, linear relaxation will be performed.
For illustration, consider j th ReLU neuron at i th layer, h ( i )
j
( x ) = ReLU ( f ( i ) j
( x )) , we can linearly upper and lower bound it by a ( i )
j x + b ( i ) j ≤ h ( i )
j ( x ) ≤ a ( i )
j x + b ( i ) j , where a ( i ) j , a ( i ) j , b ( i ) j , b ( i ) j are deﬁned as:
[Equation]
Here l ( i ) j ≤ f ( i ) j ( x ) ≤ u ( i ) j are intermediate pre-activation bounds for x ∈ C , and α ( i ) j is an arbitrary value between 0 and 1.
The pre-activation bounds l ( i ) j and u ( i ) j can be computed by treating f ( i ) j ( x ) as the output neuron with LiRPA.
Figure 1bcd illustrate the relaxation for each state of ReLU neuron.
With these linear relaxations, we can get the linear equation of f ( L − 1) w.r.t output f ( x ) :
[Equation]
The diagonal matrices D ( L − 1) α , D
[Equation]
L − 1) α and biases reﬂects the linear relaxations and also considers the signs in W ( L ) to maintain the lower and upper bound.
Importantly, D ( L − 1) α has free variables α ( i ) ∈
[0 , 1] which do not affect correctness of the bounds.
Similarly, we can continue backward propagating the linear lower and upper bound of f ( x ) layer by layer (e.g., f ( L − 2) ( x ) , h ( L − 2) ( x ) , etc) until reaching h (0) ( x ) = x , getting the eventual linear equations of f ( x ) in terms of input x :
[Equation]
where
[Equation]
Here α denotes α ( i ) j for all neurons in NN.
The obtained bounds ( L ( x, α ) , U ( x, α ) ) of f ( x ) are linear functions in terms of α and x .
Beyond the simple feedforward NN presented here, LiRPA can support more complicated NN architectures like DenseNet and Transformers by computing L and
U automatically and efﬁciently on general computational graphs (Xu et al., 2020).
Soundness of LiRPA
The above backward bound propagation process guarantees that L ( x, α ) and
U ( x, α ) soundly bound f ( x ) for all x ∈ C .
Detailed proofs can be found in (Zhang et al., 2018;
Singh et al., 2019b) for feedforward NNs and (Xu et al., 2020) for general networks.
P ROPOSED A LGORITHM
Overview In this section, we will ﬁrst introduce our proposed efﬁcient optimization of LiRPA bounds on GPUs that can allow us to achieve tight approximation on par with LP or even tighter 𝑥𝑥Σ Σ Σ
Always Active: 𝐥 𝑗(𝑖) ≥
Always Inactive: 𝐮 𝑗(𝑖) ≤
Linear relaxed Unstable neuron: 𝐥 𝑗(𝑖) < 0 , 𝐮 𝑗(𝑖) >Σ Σ Σ 𝑓(𝑥) ℎ 1(1) ℎ 2(1) ℎ 3(1)
ReLU
Lower bound by Optimized
LiRPA
Example: Optimized LiRPA for ℎ 1(2) 𝑥𝑥Σ Σ Σ Σ Σ Σ 𝑓(𝑥)
Unoptimized LiRPA: 𝑓 = −1.
Optimized LiRPA: 𝑓 = −0.
BaB :
Prove: 𝑓 𝑥 ≥ 0,∀𝑥
∈
𝒞 ℎ 1(2) ℎ 2(2) ℎ 3(2) ℎ 1(1) ℎ 2(1) ℎ 3(1) ℎ 1(2) ℎ 2(2) ℎ 3(2)
Split ℎ 2(2)
Pick ℎ 1(2)
Split ℎ 1(2)
Pick ℎ 2(2)
𝑓 = −0.
𝑓 = 0.17 ✓ 𝑓 = 0.25 ✓ 𝑓 = 0.31 ✓ tigher l 1(2) and 𝑢 1(2) make tighter relaxation for some cases but in a much faster manner.
In Fig.
2, we provide a two-layer NN example to illustrate how our optimized LiRPA can improve the performance of BaB veriﬁcation.
We then show that feasibility checking is an important factor to guarantee the completeness of BaB, and BaB using LiRPA without feasibility checking will end up to be incomplete.
To ensure completeness, we design our algorithm with minimal usage of LP for checking feasibility of splits.
Finally, we propose batch split design by solving a batch of sub-domains in a massively parallel manner on
GPUs to fully leverage the beneﬁts of cheap and parallelizable LiRPA.
We further improve BaBSR in a parallel fashion for branching and we summarize the detailed proposed algorithm in Section 3.4.
O PTIMIZED LiRPA FOR C OMPLETE V ERIFICATION
Concrete outer bounds with optimizable parameters We propose to use LiRPA as the bounding step in BaB. A pair of sound and concrete lower bound and upper bound ( f, f ) to f ( x ) can be obtained according to Eq.
7 given ﬁxed α
= α 0 :
[Equation]
Because L , U are linear functions w.r.t x when α 0 is ﬁxed, it is easy to solve Eq.
8 using H ¨ older’s inequality when C is a (cid:96) p norm ball (Xu et al., 2020).
In incomplete veriﬁcation settings, α can be set via certain heuristics (Zhang et al., 2018).
Salman et al.
(2019) showed that, the variable α is equivalent to dual variables in the LP relaxed veriﬁcation problem (Wong & Kolter, 2018).
Thus, an optimal selection of α given the same pre-activation bounds l ( i ) j and u ( i )
j can in fact, lead to the the same optimal solution for f and f as in LP.
Previous complete veriﬁers typically use LiRPA variants to obtain intermediate layer bounds l ( i ) j and u ( i ) j to construct a LP problem (e.g., Bunel et al.
; Lu & Kumar (2020) used convex outer adversarial polytope (Wong & Kolter, 2018)), and solve LP to obtain bounds at output layer.
The main reason for using LP is that it typically produces much tighter bounds than LiRPA when α is not optimized.
To replace LP with fast and accelerator-friendly LiRPA algorithms in the complete veriﬁcation setting, we use optimized LiRPA to produce tighter bounds:
[Equation]
The inner minimization and maximization have closed form solutions based on H¨older’s inequality, so we only need to optimize on α .
Since we use a differentiable framework (Xu et al., 2020) to compute the LiRPA bounds L and U , the gradients ∂ L ∂ α and ∂ U ∂ α can be obtained easily.
Optimization over α can be done via projected gradient descent (each coordinate of α is constrained in [0 , 1] ).
Since the gradient computation and optimization process are done on GPUs, the bounding process is still very fast and can be one or two magnitudes faster than solving an LP.
Optimized LiRPA bounds can be tighter than LP Solving Eq.
9 using gradient descent with a small number of iterations cannot guarantee to converge to the global optima, so it seems the bounds must be looser than LP.
Counter-intuitively, by optimizing α , we can potentially obtain tighter bounds than LP.
When a LP relaxation is constructed, preactivation bounds l ( i ) j , u ( i )
j must be ﬁxed to construct the “triangle” relaxation for the j -th ReLU neuron in layer i .
During the LP optimizatin process, only the output bounds are optimized; l ( i ) j and u ( i ) j stay unchanged.
However, in the LiRPA formulation, L ( x, α ) and U ( x, α ) are complex functions of α : since pre-activation bounds l ( i ) j and u ( i )
j are also computed by LiRPA, they depend on all α ( i (cid:48) )
j (cid:48) (0 < i (cid:48) < i ) in previous layers.
Thus, the gradients ∂ L ∂ α and ∂ U ∂ α can tighten output layer bounds f and f indirectly by tightening intermediate layer bounds l ( i ) j and u ( i ) j , forming a tighter convex relaxation for the next iteration.
An LP solver cannot achieve this because adding l ( i ) j and u ( i ) j as optimization variables makes the problem non-linear.
This is the key to our success of applying LiRPA based bounds for the complete veriﬁcation setting, where tighter bounds are essential.
[Figure]
In Figure 3, we illustrate our optimized LiRPA bounds and the LP solution.
Initially, we use LiRPA with α set via a fast heuristic to compute intermediate layer bounds l
j and u ( i ) j
and then use them to build a relaxed LP problem.
The solution to this initial LP problem is the red line.
This LP solution is much tighter than the LiRPA solution with a heuristically set α , shown as the left-most point of the blue line.
Then, we optimize α and LiRPA quickly outperforms this LP solution.
The optimized α also produces tighter intermediate layer bounds, l (cid:48)
( i ) j and u (cid:48)
( i ) j .
We can create a new LP with optimized bounds l (cid:48)
( i ) j and u (cid:48)
( i ) j , whose solution is the light blue line.
This new LP only produces a slightly tighter bound than
LiRPA with optimized α .
In most previous works on complete veriﬁcation, l ( i ) j and u ( i ) j are obtained from unoptimized LiRPA bounds or even weaker methods such as interval arithmetic; thus, our optimized LiRPA bounds can produce quite competitive bounds compared to the LP solution in previous works, and also exploit parallel acceleration from machine learning accelerators.
The tightness and efﬁciency of our optimized LiRPA procedure lead to huge improvements in veriﬁcation time compared to existing baselines.
ReLU Split Constraints In the BaB process, when a ReLU neuron h ( i ) j is split into two subdomains ( h ( i ) j ≥ 0 and h ( i ) j < 0 ), we simply set l ( i ) j ≥ 0 and u ( i ) j < 0 in the bound propagation process.
This allows LiRPA to achieve tightened bound because a split ReLU neuron essentially becomes linear, reducing relaxation errors.
However, When splits are added, LiRPA and LP are not equivalent even under ﬁxed l ( i ) j , u ( i ) j and optimal α .
After splits, LiRPA cannot check certain constraints where LP is capable to, as we will discuss in the next section.
3. C OMPLETENESS WITH M INIMAL U SAGE OF LP B OUNDING P ROCEDURE
Even though our optimized LiRPA can bring us huge speed improvement over LP for BaB based veriﬁcation, we observe that it may end up to be incomplete due to the lack of feasibility checking.
We state such an observation in Theorem 3.1:
Theorem 3.1 (Incompleteness without feasibility checking) BaB based veriﬁcation using LiRPA variants described in Section 2.3 as the bounding methods are incomplete.
We prove the theorem by giving a counter-example in Appendix A.1 where all ReLU neurons are split and thus the LiRPA runs on a linear network for each sub-domain.
As a result, LiRPA can still be indecisive for the veriﬁcation problem.
The main reason is that LiRPA variants will lose the feasibility information encoded by the sub-domain constraints.
For illustration, consider a subdomain C i =
C ∩ h ( i 1 )
j< 0 ∩ h ( i 2 ) j≥ 0 , LiRPA will force h ( i 1 ) j 1 and h ( i 2 )
j 2 to be bounded within [0 , 0] and [ f ( i 2 ) j 2 , f ( i 2 ) j 2 ] where lower and upper bounds are the same and propagate them to get the approximated lower bound f C
i .
However, the feasibility constraint C ∩ h ( i 1 ) j< 0 ∩ h ( i 2 ) j≥is ignored, so two conﬂict splits may be conducted.
On the contrary, LP can fully preserve such feasibility information due to the linear solver involved and easily detect the infeasible sub-domains.
We then state Theorem 3.2, saying that the minimal usage of LP/feasibility checking with linear solver can guarantee the completeness of BaB with LiRPA.
Theorem 3.2 (Minimal feasibility checking for completeness)
The BaB based veriﬁcation with
LiRPA variants described in Section 2.3 is complete if all of the infeasible leaf sub-domains (i.e., sub-domains cannot be further split) are detected by feasibility checking.
We prove the theorem in Appendix A.2, where we show that by checking the feasibility of LP with splits, we can eliminate the cases that incompatible splits are choosen in the LiRPA BaB process.
Since LP is slow while LiRPA can be massively parallelized, we propose to only use LP when the veriﬁcation process is stuck, i.e., either (1) partitioning sub-domains and then estimating with
LiRPA cannot further make any progress, or (2) all unstable neurons have been split.
This way, we make sure that the infeasible sub-domains can be successfully detected by LP at the end while the advantage of massive parallel LiRPA on GPU is fully enjoyed.
See Alg. 1 and Sec.
3.4 for detailed descriptions of our framework.
f, (cid:2) C l 1 , C u 1 , . . .
, C ln , C un (cid:3) ) 8:
Insert Filter (cid:104)
[ f C l 1 , f C l 1 , C l 1 ] , [ f C u 1 , f C u 1 , C u 1 ] , . . .
, [ f C ln , f C 1 n , C ln ] , [ f C un , f C un , C un ] (cid:105) to P 9: f ← min { f C i | ( f C i , C i ) ∈ P } , i = 1 , . . . , n (cid:46)
To ease notation, C i here indicates both C ui and C li 10: f ← min { f C i | ( f C i , C i ) ∈ P } , i = 1 , . .
. , n 11: if length ( P ) >
η then 12: (cid:104)
f C l 1 , f C l 1 , f C u 1 , f C u 1 , . .
, f C ln , f C ln , f C un , f C un , (cid:105) ← compute bound LP ( f, (cid:2)
C l 1 , C u 1 , . . .
, C ln , C un (cid:3) ) 13:
Insert Filter (cid:104)
[ f C l 1 , f C l 1 , C l 1 ] , [ f C u 1 , f C u 1 , C u 1 ] , . . .
, [ f C ln , f C 1 n , C ln ] , [ f C un , f C un , C un ] (cid:105) to P 14: Output f , f
3. B ATCH S PLITS
For state-of-the-art BaB methods (Bunel et al., 2020b; Lu & Kumar, 2020), only one sub-domain can be selected to split during each branching step.
Beneﬁting from our design of using cheap
LiRPA with minimal usage of LP, we can select a batch of sub-domains to split and propagate them in a massively parallel style.
Such batching splitting design can introduce signiﬁcant performance improvement.
Given a batch size n that allows us to use up one GPU memory, we can then approximate n bounds simultaneously.
This can help us grow the search tree on a single leaf by a depth of log 2 ( n ) , or split n/ 2 leaf nodes at the same time, accelerating by up to n times.
3. O UR C OMPLETE V ERIFICATION F RAMEWORK
The algorithm of our framework is presented in Alg. 1.
Given the target NN f , input x with domain
C , and the batch size n for parallel optimized LiRPA.
Initially, we run optimized LiRPA to get a tight approximation ( f, f ) over C (Line 2).
Then we utilize the power of GPU to parallel split and maintain a global domain set P storing all the split sub-domains that cannot be veriﬁed with optimized LiRPA (Line 5-10).
In details, batch pick out improves BaBSR (Bunel et al., 2018) in a parallel manner to select n sub-domains in P and determine the corresponding ReLU neuron to split for each of them.
If length of P is less than n , then we reduce n to the length of P .
batch split splits each selected C i to two sub-domains C li and C ui by forcing the selected unstable ReLU neuron to be positive and negative.
optimize LiRPA runs optimized LiRPA in parallel and return the lower and upper bounds for n selected sub-domains simultaneously.
Insert Filter ﬁlters out veriﬁed sub-domains (proved with f C i ≥ 0 or disproved with f C i < 0 ) and inserts the remaining ones to P .
The while loop will break if the property is proved ( f < 0 ) or a counter-example is found ( f ≥ 0 ).
To avoid excessive splits, we set the maximum length of the sub-domains η to control the maximum length of the P (Line 12).
Once, the length reached the threshold, compute bound LP will be called, which implies a for loop to solve the sub-domains by optimized LiRPA enhanced LP (the tightest approximation available with feasibility checking).
Once a sub-domain C i is proved or detected to be infeasible, as an effective heuristic, we will backtrack and prioritize to check its parent node with optimized LiRPA enhanced LP.
If the parent sub-domain is proved/infeasible, it is safe to prune all its child nodes to save LP calls.
Completeness of our framework Our algorithm is complete , because we follow Theorem 3.2 and check feasibility of all split sub-domains that have deep BaB search tree depth (length of P reaches threshold), forming a superset of the worst case where all ReLU neurons are split.
E XPERIMENTS
In this section, we compare our veriﬁer against the state-of-the-art ones to illustrate the effectiveness of our proposed framework.
Overall, our veriﬁer is around 4X faster on Base model, 7X faster on
Wide model, and 20X faster on Deep model than the best LP-based veriﬁer so far.
Setup We follow the most challenging experimental setup used in the state-of-the-art veriﬁer GNNONLINE (Lu & Kumar, 2020) and B A BSR (Bunel et al., 2020b).
Speciﬁcally, we evaluate on CIFAR10 dataset three NNs, Base, Wide and Deep structures.
The dataset is categorized into three difﬁculty levels: Easy, Medium, and Hard, which is generated according to the performance of
BaBSR.
Brieﬂy, we want to verify that for a given l ∞ ≤ (cid:15) , the trained classiﬁer will not predict a speciﬁc wrong label for image x .
The parallel batch size n is set to 64 and the η is set to 12,000 due to the memory constraint.
More details on experimental setup are provided in Appendix B.
Comparisons against state-of-the-art veriﬁers In Table 1, we compare against the following four different methods on the same NNs: (1) BaBSR (Bunel et al., 2020b), a BaB based veriﬁer using a ReLU-split heuristic; (2) MIPP LANET (Ehlers, 2017), a customized MIP solver for
NN veriﬁcation where ReLU-split is randomly selected; (3) GNN (Lu & Kumar, 2020), (4) GNNO NLINE (Lu & Kumar, 2020), a BaB based veriﬁer using GNN to guide the ReLU-split.
(5) P ROXIMAL B A BSR (Bunel et al., 2020a)
an efﬁcient super-gradient ascent algorithm based on Lagrangian decomposition.
The timeout threshold is 3,600 seconds for all properties.
As we can see in Table 1, our approach can be around 10X faster than baseline BaBSR and around 4X faster than GNN split.
The accumulative solved properties with runtime is performed in Figure 4.
Our method used the same split heuristic as BaBSR and can be improved using better methods such as GNN split and we leave it for future work.
[Table]
[Figure]
2 The code link provided in (Bunel et al., 2020a) does not contain complete veriﬁcation, so we directly report the best results in their paper in our table.
Since we use a similar GPU model as theirs, the time is comparable.
[Table]
Performance comparisons on Wide and Deep model architectures The performance of the veriﬁers heavily depends on the size of the NN architectures.
In Table 2, we show that our veriﬁer is affected much less on wide and deep NNs compared to other state-of-the-art veriﬁers.
Note that our method enjoys parallel computing particularly on deep models and can achieve 30X speedup compared to B A BSR.
Even compared with the most recent state-of-the-art GNN-O NLINE , our method can save 20X running time.
In addition, we conduct an ablation study in Appendix C, analyzing the efﬁciency of optimized LiRPA and batch splits separately.
Performance comparisons of our proposed framework on CPU cores with/without GPU acceleration are investigated in Appendix D
[Table]
R ELATED W ORK
Complete veriﬁers Early complete veriﬁers rely on satisﬁability modulo theory (SMT)
(Katz et al., 2017; Huang et al., 2017; Ehlers, 2017) and mixed integer linear programming (MILP) (Tjeng et al., 2019a; Dutta et al., 2018), but they typically do not scale well.
Higher order logic provers such as proof assistant (Bentkamp et al., 2018) can also be potentially used for NN veriﬁcation, but their scalability to the NN setting has not been demonstrated.
Recently, Bunel et al.
(2018) uniﬁed these approaches into a BaB framework, extended and used in various complete veriﬁers.
LP bounding procedure is used in most of the existing BaB framework (Bunel et al., 2018;
Wang et al., 2018c;
Royo et al., 2019; Lu & Kumar, 2020).
For branching, there are two categories of branching strategies: (1) input node branching (Wang et al., 2018c;
Bunel et al., 2020b; Royo et al., 2019; Anderson et al., 2019) where input features are divided into sub-domains, and (2) activation node (especially,
ReLU) branching (Katz et al., 2017; Bunel et al., 2018; Wang et al., 2018b; Ehlers, 2017; Lu & Kumar, 2020) where hidden layer activations are split into sub-domains.
Bunel et al.
(2018) found that input node branching cost is exponential to input dimension.
Therefore, many state-of-the-art veriﬁers use activation node branching instead, focusing on heuristics to select good activation to split.
BaBSR (Bunel et al., 2018) prioritizes ReLUs for splitting based on their pre-activation bounds; Lu & Kumar (2020) used graph neural network (GNN) to learn good splitting heuristics.
Note that our work can use better branching heuristics like GNN split to achieve further speedup.
There are two mostly relevant concurrent works using GPUs for veriﬁcation.
(1) GPUPoly (M ¨ uller et al., 2020), an extension from DeepPoly on CUDA, is still an incomplete veriﬁer .
Also, it is implemented in CUDA C++, requiring manual effort for customization and gradient computation, so it is not easy to get the gradients for optimizing bounds as we have done for LiRPA (see Section 3.1).
Lagrangian Decomposition (Bunel et al., 2020a) is a GPU-accelerated BaB based complete veriﬁer that iteratively tightens the bounds of a LiRPA method from which it is initialized without using
LP.
However, it solves a much more complicated optimization problem than LiRPA, and typically requires hundreds of iterations to converge for a single sub-domain.
Incomplete veriﬁers Many incomplete veriﬁcation methods rely on convex relaxations of NN, replacing nonlinear activations like ReLUs with linear constraints (Wong & Kolter, 2018;
Zhang et al., 2018; Weng et al., 2018;
Wang et al., 2018b; Gehr et al., 2018; Singh et al., 2018a;b; 2019b;a) or semideﬁnite constraints (Raghunathan et al., 2018; Dvijotham et al., 2020; Dathathri et al., 2020).
Tighter relaxations require more computation and memory in general.
We refer the readers to (Salman et al., 2019) for a comprehensive survey.
Recently, Xu et al.
(2020) categorized the family of linear relaxation based incomplete veriﬁers into LiRPA framework, allowing efﬁcient implementation on machine learning accelerators.
Our work uses LiRPA as the bounding procedure for complete veriﬁcation and exploits its computational efﬁciency to accelerate complete veriﬁcation.
C ONCLUSION
We propose a fast gradient based bound tightening procedure, optimized LiRPA, which is friendly to parallel accelerators.
We utilize this incomplete veriﬁer for complete veriﬁcation.
The completeness of our algorithm is discussed theoretically and we demonstrate up to 5X speedup compared to stateof-the-art veriﬁers across multiple models and properties that can be achieved by our approach.
A P ROOFS A. P ROOF OF T HEOREM 3.
We prove Theorem 3.1 by providing a simple counterexample, and we illustrate the necessity of feasibility checking for completeness of BaB based veriﬁcation.
Consider an NN with only two hidden nodes A = B = ReLU ( x ) and one dimension input x , its output function can be written as f ( x )
=
A − B = ReLU ( x ) − ReLU ( x ) .
As a veriﬁcation problem, we want to verify the property f ( x ) ≥ 0 where x = [ − 1 , 1] .
Since hidden nodes A and B are exactly the same, the ground-truth output range is f ∗ ( x ) =
A complete BaB based veriﬁer is expected to obtain that optimal bound and prove the property after split A and B together while BaB with only LiPRA cannot guarantee that completeness.
Speciﬁcally, BaB with only LiRPA will split the original domain x = [ − 1 , 1] into four sub-domains and approximate the bound with LiRPA respectively:
(1) (feasible) sub-domain x = [ − 1 , 1] , A > 0 , B > 0 with output f = [ x, x ] − [ x, x ] =
[0 , 0] (2) (feasible) sub-domain x = [ − 1 , 1] , A ≤ 0 , B ≤ 0 with output f = [0 , 0] − [0 , 0] =
[0 , 0] (3) (infeasible) sub-domain x = [ − 1 , 1] , A ≤ 0 , B > 0 with output f = [0 , 0] − [ x, x ] =
[ − 1 , 1] (4) (infeasible) sub-domain x = [ − 1 , 1] , A > 0 , B ≤ 0 with output f =
[ x, x ] − [0 , 0]
=
[ − 1 , 1]
Only the ﬁrst two split sub-domains are feasible and therefore the ground-truth lower bound 0 can be obtained by taking the minimum of the estimated bounds from sub-domains (1) and (2).
However, pure LiRPA is not able to tell the infeasibility of sub-domains (3) and (4) and thus BaB with pure
LiRPA will report the minimum − 1 got from all these four sub-domains as the global lower bound for the original input domain, ending up not being able to verify the property, i.e., incomplete.
A. P ROOF OF T HEOREM 3.
We prove Theorem 3.2 by considering the worst case where all unstable ReLU neurons are split.
Assume there are N unstable ReLU neurons { h i | i = 1 , , , N } given input domain C and NN f in total.
We can then have 2 N partitioned leaf sub-domains S =
{C i | i = 1 , ..., 2 N } in worst case consisting of feasible sub-domains S feas =
{C feasi |C feasi (cid:54) = ∅} and infeasible sub-domains
S infeas = {C infeasi |C infeasi = ∅} .
Since we perform feasibility checking for every leaf sub-domain in S
=
{C i | i = 1 , ..., 2 N } , all the infeasible sub-domain belongs to S infeas will be detected and we make sure the estimated lower bound for any C infeas ∈ S infeas by LiRPA will not contribute to global lower bound f .
Therefore, the global lower bound is estimated by f = min
i f C feasi where
C feasi ∈ S feas .
To prove the whole BaB veriﬁcation is complete, it is sufﬁcient to prove this estimated lower bound is the exact minimum of f bounded in C .
Since all sub-domains belong to S feas are leaf subdomains, i.e., no unstable ReLU neurons available for any sub-domain C feasi ∈ S feas , the neural network bounded within C feasi is a linear function.
We can have an exact minimum of f to subdomain C feasi estimated by LiRPA.
Since S feas covers all the feasible region within C , the minimal value of all feasible sub-domains min i f C feasi where C feasi ∈ S feas forms the exact minimum of f to input domain C .
Now, we prove it to be complete.
B E XPERIMENTAL S ETUP
We follow the most challenging experimental setup used in the state-of-the-art veriﬁer GNNONLINE (Lu & Kumar, 2020) and B A BSR (Bunel et al., 2020b).
Speciﬁcally, we evaluate on CIFAR10 dataset with the same standard robustly trained convolutional neural networks, Base, Wide, and Deep structures, used in (Lu & Kumar, 2020).
The Base model contains 2 convolution layers with 8 and 16 ﬁlters as well as two linear layers with 100 and 10 hidden units.
In total, the Base model has 3,172 ReLU activation units.
The Wide model contains 2 convolution layers with 16 and 32 ﬁlters and two linear layers with 100 and 10 hidden units, which has 6,244 ReLU activation units in total.
The Deep model contains 4 convolution layers and all of them have 8 ﬁlters and two linear layers with 100 and 10 hidden units, which has 3,756 ReLU activation units in total.
The property is deﬁned as given a image x which the model predicted its label y c correctly.
Given another wrong label y c (cid:48) and (cid:15) , we prove:
[Equation]
where f ( · ) is a multi-class classiﬁer, e ( c ) and e ( c
[Equation]
) are one-hot encoding vectors for labels y c and y c (cid:48) .
We want to verify that for a given (cid:15) , the trained classiﬁer will not predict wrong label y c (cid:48) for image x .
All properties including x , (cid:15) , and c (cid:48) are provided by (Lu & Kumar, 2020).
Speciﬁcally, they categorize veriﬁcation properties solved within 800s as easy, between 800s and 2400s as medium and more than 2400s as hard by B A BSR.
Our experiments are conducted on one Intel E5 CPU and one Nvidia RTX 1080TI GPU.
The parallel batch size n is set to 64 and the η is set to 12,000 due to the memory constraint.
To make a fair comparison, we use one CPU core for all methods since the LP based method can only utilize one
CPU core.
Also, we use one GPU for GNN, GNN-O NLINE , and our methods.
In Optimized LiRPA, we apply 200 steps gradient decent at the initial bounds solving.
After that during splits, we usesteps gradient decent and early stop once f > 0 or no improvement.
C A BLATION STUDY
Our efﬁcient framework leverages two powerful components: (1) Optimized LiRPA and (2) Batch
Splits.
In this section, we conduct breakdown experiments to show how the individual technique can help with complete veriﬁcation.
As we can see from Table 3, only using Batch Splits cannot help with the problems.
We observe that, without Optimized LiRPA and LP in the Batch Splits stage, the
LiRPA bounds we obtained are very loose, making the global lower bound improvement slow.
In contrast, only using Optimized LiRPA even split single node at one time can still save around 70% computational time beneﬁted from the tighter LiRPA bounds.
Finally, combining Batch Splits and
Optimized LiRPA allows us to rarely use LP and save up to 96.82% computational time.
[Table]
D C OMPLETE VERIFICATION WITH L I RPA ON CPU VS GPU
In this section
[Table]
we investigate the performance of our algorithm for the cases where one/multiple
CPU cores are available without GPU acceleration.
Note that existing baselines such as B A BSR and
MIP PLANET can only utilize one CPU core subject to the Gurobi solver.
GNN and GNN-O NLINE need one GPU to forward GNN during branching while the rest of the veriﬁcation processes all perform on CPU cores.
In contrast, our method is much more ﬂexible, we are not limited by the number of CPU cores or GPUs and for a fair comparison, we only use one CPU core and one GPU (same with GNN and GNN-O NLINE ) in our paper’s experimental results.
In Figure 5, results of various computational environments are shown.
As we can see, the running time decreases by the number of CPU cores increasing.
However, the descent rate seems not constant.
It may be caused by the CPU dispatcher or memory cache, and we leave the problem for future work.
Also, there is a huge gap between 8 CPU cores with one CPU core + one GPU and the performance gap is more obvious on Wide and Deep models.
Surprisingly, even by using one CPU core, we still get very competitive performance even compare with GNN-O NLINE which needs one GPU additionally.
[Figure]