Neural Lower Bounds for Verification
Abstract —Recent years have witnessed the deployment of branch-and-bound (BaB) frameworks for formal verification in deep learning—proving or disproving a desirable property of a neural network.
The main computational bottleneck of BaB is the estimation of lower bounds via convex relaxations.
Past work in this field has relied on traditional optimization algorithms whose inefficiencies have limited their scope.
To alleviate this deficiency, we propose a novel graph neural network (GNN) based approach.
Our GNN architecture closely resembles the network we wish to verify.
During inference, it performs forward-backward passes through the GNN layers to compute a feasible dual solution of the convex relaxation, thereby providing a valid lower bound.
During training, its parameters are estimated via a loss function that encourages large lower bounds over a time horizon.
Using standard publicly available data sets, we show that our approach provides a significant speedup for formal verification compared to the state of the art solvers.
Moreover, the GNN achieves good generalization performance on unseen networks.
I. I NTRODUCTION
The application of deep learning to safety critical domains such as autonomous vehicles [4] and personalized medicine [29] requires its formal verification, that is, proving or disproving its desirable properties.
For instance, one desirable property is the robustness of a given network to so-called adversarial examples.
These are examples that are similar to real images but ones which the neural network misclassifies with a high probability.
They are obtained by applying small but deliberately chosen perturbations that are often imperceptible to the human eye.
Formal verification is typically carried out using the branchand-bound (BaB) framework.
The BaB framework solves a mixed integer programming (MIP) formulation of the verification problem.
It works by hierarchically splitting the domain of the MIP into subdomains via a routine known as branching.
For each subdomain it computes an upper and a lower bound of the MIP objective.
If the upper bound of a subdomain is less than the lower bound of another, the latter subdomain can be pruned thereby reducing the search space for the optimal solution.
Branching is usually performed using an efficient heuristics that is either hand-designed or learnt [16, 18, 23].
The upper bound is also efficient to compute as it involves evaluating the objective for any feasible solution.
In contrast, the lower bound computation requires solving a large convex relaxation.
Typically, the relaxation is solved using either commercial solvers such as Gurobi [15] or traditional optimization algorithms such as subgradient descent or proximal minimization [5].
However, neither approach scales elegantly with the size of the relaxation, which prevents current formal verification methods from being applied to deep state-of-the-art networks.
In other words, lower bound estimation forms the main computational bottleneck for
BaB.
A natural question that arises is why do traditional algorithms fail?
We argue that by their very nature, they ignore the rich inherent structure of lower bound estimation for the problem of verification.
Specifically, all lower bounds that one wishes to estimate across multiple subdomains of the same property, across multiple properties of the same network, and across multiple networks share the same form of variables, constraints and objectives.
Furthermore, the coefficients of the objective and constraints are determined from network weights, which themselves are not random but are estimated using real data.
Traditional optimization algorithms are agnostic to this complex high-dimensional structure as it is not “visible” to human intelligence.
However, we argue that this is exactly the type of structure that can be readily exploited by artificial intelligence.
To this end, we propose to use deep learning to efficiently estimate accurate lower bounds of neural networks.
Specifically, we propose the use of a graph neural network (GNN) whose architecture closely resembles that of the network we wish to verify.
Given a subdomain and some initial dual variables it repeatedly computes a direction of ascent.
Every single run of the GNN is made up of one or more forward and backward passes that mimic a run of the network that we’re verifying.
When training the GNN we consider a horizon with a decay factor to output an ascent direction that maximizes the dual objective function that directly corresponds to a lower bound on the final output of the network.
By using a parameterization of the GNN that depends only on the type of nodes and the order of the passes and not on the underlying architecture, we can train a GNN using one network and test it on another.
Our approach can be used to initialize the dual problem for traditional optimization methods, but somewhat surprisingly, we found that it wasn’t necessary.
In all our experiments, we use our GNN-based approach as a stand alone method, that is, we directly use its lower bound in the BaB framework.
Our method leads to a significant reduction in verification time by reducing the number of subdomains visited in the BaB framework due to the computation of more accurate lower bounds.
We consistently beat all baselines on over 80% of all images.
Moreover, the GNN shows good generalization performance in two ways: when trained purely on easy properties it performs well on difficult properties as well; moreover, when trained on a small network it also generalizes well to larger networks.
This is important as the training complexity is directly proportional to the difficulty of the training properties and the size of the model we do the training on.
Neural network verification has been an active field of research in recent years with plenty of different methods being proposed in the literature [10, 17, 28, 30, 31].
Bunel et al.
[6] introduced a unified framework for many of these methods by writing them as branch-and-bound frameworks (BaB).
BaB is made up of three components: the branching strategy decides how to split the current domain into several smaller subdomains; the upper bound computation aims to find a counter-example of the property in each subdomain; and the computation of the lower bound, which is the focus of this work, that aims to return a certificate of robustness for each subdomain.
Most bounding methods create relaxations of the original problem.
There are a variety of relaxations that have easily computable closed-form solutions such as Interval Bound
Propagation (Gowal et al.
[12]) or WK, the method introduced by Wong and Kolter [30].
However, these relaxations tend to be quite loose and therefore lead to bad estimates of the final layer output of a neural network.
Hence different linear programming (LP) relaxations were proposed that provide tighter bounds:
Planet introduced by Ehlers [10], Reluplex by Katz et al.
[17], or the Anderson relaxation (Anderson et al.
However, these often require an iterative solver to optimize them, which tends to not scale well.
We will therefore use machine learning approaches to come up with better bounds than the best current iterative methods.
Our work is similar in spirit to the recent machine learning approaches for a variety of combinatorial optimization problems [3, 7], and mixed integer linear programs (MILPs) [1, 11, 16, 18].
Often, different instances of these problems share a common structure, which can be exploited using learning.
In the context of MILPs, learning has mostly been used to improve the branching strategies in BaB algorithms [16, 18, 23], including a recent approach that focuses on neural network verification [23].
Encouragingly, for the task of branching, the learning frameworks have been shown to outperform hand-designed heuristics.
However, only limited work has been done on learning the bound computation in the BaB algorithm:
Dvijotham et al.
[8, 9] propose several different learned methods: one that treats every layer separately, and another that uses a simple forward-backward architecture.
Gowal et al.
[13] propose a method called predictor-verifier (PVT) that learns a robust training procedure and a verifier simultaneously.
However, these methods end up beating Interval
Bound propagation, a comparatively weak baseline, by a small margin only.
There is thus a large scope for improvement which we explore in our work.
III. B ACKGROUND
In our work we focus on returning a lower bound on the output of the neural network we are trying to verify on a given subdomain.
As the neural network is highly non-convex and thus hard to optimize over, Bunel et al.
[5] introduced a decomposition based technique for the Planet relaxation [10].
We therefore begin with a brief description of the Planet relaxation [10] and the decomposition technique of [5] before describing our learning framework.
We are given a convex input domain C , an input vector z 0 ∈ C , together with the network weights W and biases b , and a non-linear activation function σ ( · ) .
In our case we use the
ReLU activation defined as σ ( x ) = max ( x , 0 ) as it is widely used in machine learning in general [21, 24] as well as in neural network verification [6, 8, 10].
a) Planet Relaxation.
: We denote the output of the kth layer before the application of the ReLU as ˆz k and the output of applying the ReLU to ˆz k as z k .
Given the lower bounds l k and upper bounds u k of the values of ˆz k , we relax the ReLU activations z k = σ ( ˆz k ) to its convex hull cvx _ hull σ ( ˆz k ,
[Equation]
k , l k , u k ) , defined as follows:
[Equation]
Note that the computation of the convex hull requires the knowing of the lower and upper bounds (i.e. l k and u k ) for each intermediate node.
The bounds do not have to be optimal, however, the tighter the bounds are, the tighter the relaxation will be as well.
There are different ways of computing said bounds that have been proposed in the literature [12, 27, 30].
In our experiments we use the method proposed by Wong and
Kolter [30].
For the sake of clarity, we introduce the following notations for the constraints corresponding to the input and the k -th layer respectively: [Equation] and
[Equation]
Using the above notation, the Planet relaxation for computing the lower bound can be written as:
[Equation]
b) Lagrangian Decomposition.
: We often merely need approximations of the bounds rather than the precise values of them.
We can therefore make use of the primal-dual formulation of the problem as every feasible solution to the dual problem provides a valid lower bound for the primal problem.
Following the work of Bunel et al.
[5] we will use the Lagrangian decomposition [14].
To this end, we first create two copies
ˆz A , k , ˆz B , k of each variable ˆz k :
[Equation]
Next we obtain the dual by introducing Lagrange multipliers ρρρ corresponding to the equality constraints of the two copies of each variable:
[Equation]
Problem (5) is unconstrained with respect to ρρρ .
In other words any possible ρρρ is a feasible solution and thus by duality provides a lower bound for the primal problem (4).
We therefore aim to maximize q ( ρρρ ) to get the tightest possible lower bound.
Given an assignment to the dual variables, Bunel et al.
[5] showed that the minimization over z ∗ 0 , ˆz ∗ A , ˆz ∗ B can be done efficiently.
The supergradients can then be easily computed as ∇ ρρρ ( q ) =
ˆz ∗ B − ˆz ∗ A .
This is used to come up with lower bounds via supergradient ascent (see appendix X for a more detailed explanation).
Unfortunately, this is known to be quite slow.
We therefore take a different approach that learns to estimate a better ascent direction, thereby providing larger lower bounds more efficiently.
IV. GNN F RAMEWORK
The key observation of our work is based on the fact that several previously known lower bound computation techniques can be thought of as performing forward-backward style passes through the network to update the dual variables.
These include supergradient ascent and proximal maximization [5].
However, the exact form of the passes is restricted to those suggested by standard optimization algorithms, which are agnostic to the special structure of neural lower bound computation.
This observation suggests a natural generalization: parameterize the forward and backward passes, and estimate the parameters using a training data set so as to exploit the problem and data structure more successfully.
In what follows, we first provide an overview of our approach that achieves this generalization through graph neural networks (GNN).
The remaining subsections describe the various components of the GNN and the forward and backward passes in greater detail.
A. Overview
Inspired by the approach of Lu and Kumar [23], who use a graph neural network (GNN) to come up with better branching decisions, we propose to use a GNN for efficient bound computation.
Since previous bound computation approaches perform forward and backward passes on the network they wish to verify, it makes sense to use a GNN that mimics the architecture of that network as closely as possible.
To this end, we treat the neural network as a graph G NN =
( V NN , E NN ) and provide it as input for the GNN.
We denote the GNN as an isomorphic graph to G NN , that is, G GNN =
( V GNN , E GNN ) where there is a one-to-one correspondence between the nodes
V NN and V GNN and edges E NN and E GNN .
For every node v ∈ V GNN we first compute a feature vector f , which contains local information about the node.
We then use this feature vector and a learned function g to compute an embedding vector µµµ , a high-dimensional vector that encapsulates a lot of the important information about the corresponding node, the structure of the neural network, and the state of the optimization algorithm.
The embedding vectors are initialized based on the nodes’ features and then updated using forward and backward passes in the
GNN.
Exchanging information with its neighbours ensures that the embedding vectors capture the global information of the structure of the problem.
Once we have gotten a learned representation of each node we will convert the embedding vectors into a dual ascent direction, which will be used to update the dual variables.
Having provided an overview we will now describe the GNN’s main elements in greater detail.
B. GNN Components
a) Nodes.
: We create a node v k
[ i ] in our GNN for every dual variable ρρρ k
[ i ] .
Every dual variable corresponds to the output of the non-linear activation and the input to the next linear layer.
We denote the set of all nodes in the GNN by
V GNN .
b) Node Features.
For each node v k
[ i ] we define a corresponding d -dimensional feature vector f k
[ i ] ∈ R d describing the current state of that node as follows:
[Equation]
Here, ρρρ k is the current assignment to the corresponding dual variables and ˆz B , k and ˆz A , k are the closed-form solutions to the inner minimization problem of the dual problem as explained above.
The term ˆz B , k
[ i ] − ˆz A , k
[ i ] corresponds to the supergradient of q .
While more complex features could be included, we deliberately chose the simple features described above and rely on the power of GNNs to efficiently compute an accurate ascent direction.
c) Edges.
: We denote the set of all the edges connecting the nodes in V GNN by E GNN .
The edges are equivalent to the weights in the neural network that we are trying to verify.
We define e kij to be the edge connecting nodes v k
[ i ] and v k + 1 [ j ] and assign it the value of W kij .
d) Embeddings.
For every node v k
[ i ] we compute a corresponding p -dimensional embedding vector µµµ k
[ i ] ∈ R p using a learned function g :
[Equation]
In our case g is a multilayer perceptron (MLP), which is made up of a series of linear layers Θ i and non-linear activations σ .
We have the following set of trainable parameters:
[Equation]
Given a feature vector f we compute the following set of vectors:
[Equation]
We initialize the embedding vector to be µµµ =
µµµ T 1 , where T 1 +is the depth of the MLP.
C. Forward and Backward Passes.
So far the embedding vector µµµ solely depends on the current state of that node and does not take the underlying structure of the problem or the neighbouring nodes into consideration.
We therefore introduce a method that updates the embedding vectors by simulating the forward and backward passes in the original network.
The forward pass consists of a weighted sum of three parts: the first term is the current embedding vector, the second is the embedding vector of the previous layer passed through the corresponding linear or convolutional filters, and the third is the average of all neighbouring embedding vectors:
[Equation]
Both the second and the third term can be implemented using existing deep learning functions.
Similarly
[Equation]
we perform a backward pass as follows:
[Equation]
Here Θ
, Θ back, Θ
back∈ R p × p are all learnable parameters.
To ensure better generalization performance to unseen neural networks with a different network architecture we include normalization parameters Q and Q ′ .
These are matrices whose elements are the number of neighbouring nodes in the previous and following layer respectively for each node.
We repeat this process of running a forward and backward pass
T 2 times.
The high-dimensional embedding vectors are now capable of expressing the state of the corresponding node taking the entire problem structure into consideration as they are directly influenced by every single other node, even if we set T 2 = 1.
D. Update Step
Finally, we need to reduce each p-dimensional embedding vector to a single value to get an ascent direction ˆ ρ ˆ ρ ˆ ρ t + 1 k .
We simply use a linear output function Θ Θ Θ out to get: ˆ ρ ˆ ρ ˆ ρ t + 1 k
[Equation]
Ideally the GNN would output a new ascent direction that will lead us directly to the global optimum of equation (5).
However, as the dual problem is complex this may not be feasible in practice without making the GNN very large, thereby resulting in computationally prohibitive inference.
Instead, we propose to run the GNN a small number of times to return ascent directions that gradually move towards the optimum.
Given a step size η t + 1 , previous dual variables ρρρ t , and the new ascent direction ˆ ρ ˆ ρ ˆ ρ t + 1 we update the dual variables as follows:
[Equation]
Similar to many iterative optimization methods we decay our stepsize as we want to take smaller steps the closer we get to the optimal solution.
Given an initial step size η 0 , we define the step size at time t as follows: η t = η 0 ∗√ t .
The hyper-parameters for the GNN computation of the duals are the depth of the MLP ( T 1 ), how many forward and backward passes we run ( T 2 ), and the embedding size ( p ).
E. Fail-safe Strategy.
As with almost all machine learning based optimization algorithms, we do not have any convergence guarantees.
For a few subdomains our GNN might diverge rather than improve on the value returned for its parent.
We therefore introduce a fail-safe strategy that ensures our algorithm performs well even when our GNN fails.
We compare whether the final bound of a given subdomain outputted by the GNN beats the bound returned for its parent domain by a given absolute threshold.
If it fails to do so, then we add the subdomain into a second set of current subdomains.
We use supergradient ascent to solve these subdomains on which our GNN performed poorly.
This way we reduce the risk of our branch-and-bound algorithm timing out on certain properties.
F. Running Standard Algorithms using the GNN
As mentioned earlier, the motivation behind our GNN framework is to offer a parameterized generalization of previous methods for lower bound computation.
We now formalize the generalization using the following proposition.
Proposition 1: Our GNN architecture can simulate supergradient ascent [5] (proof in appendix XI).
V. GNN T RAINING
Having described the structure of the GNN we will now show how to train its learnable parameters.
Our training dataset D consists of a set of samples d i =
( x , ε , W i , b i , l i , u i , ρρρ i ) , each with the following components: a natural input to the neural network we wish to verify ( x ), for example an image; a domain for which we wish to compute the lower bound ( ε ), which in our case is an ℓ ∞ ball; the weights and biases of the neural network ( W , b ) ; the intermediate bounds of the neural network ( l , u ) computed via the WK method [30]; and the initial value of the dual variables ( ρρρ ) .
Recall that we do not use the GNN to directly compute the optimum dual solution.
Instead, we run it iteratively, where each iteration computes an update direction for the dual variables.
In order for the training procedure to more closely resemble its behaviour at inference time, it is crucial to train the GNN using a loss function that takes into account the dual values across a large number of iterations K .
In order to ensure that a single training sample does not dominate the loss by reaching a large positive value, we truncate the loss values for each sample.
The natural point to clamp the individual losses at is the value returned by supergradient ascent ( q iSupG ) plus a small positive threshold κ .
Inference time of our GNN is shorter than supergradient ascent as we run it for significantly fewer iterations (100 andrespectively); so as long as the duals returned by the GNN are as good as those returned by supergradient ascent, the
GNN will outperform the baseline in the BaB setting.
Given the i -th training sample d i = ( x , ε , W i , b i , l i , u i , ρρρ i ) ∈ D , the corresponding dual objective q i , and the dual value returned by supergradient ascent q iSupG , we define its loss L i to be:
[Equation]
Instead of maximizing over the dual value, we minimize over the negative dual instead.
If the decay factor γ ∈ ( 0 , 1 ) is low then we encourage the model to make as much progress in the first few steps as possible, whereas if γ is closer to 1, then more emphasis is placed on the final output of the
GNN, sacrificing progress in the early stages.
Readers familiar with reinforcement learning may be reminded by the discount rates used in algorithms such as Q-learning and policy-gradient methods.
We sum over the individual loss values corresponding to each data point to get the final training objective L : L =
∑ | D | i = 1 L i .
VI. E XPERIMENTS
We will now show the practical effectiveness of our method by comparing its performance with several state-of-the-art verification methods.
a) Setup.
: All our experiments are performed on the test set of the CIFAR10 dataset [20].
We use the same properties used by Lu and Kumar [23].
They randomly chose the properties to verify against out of the list of false classes and compute the epsilon value that determines the size of the input domain using binary search and the BaBSR method.
All properties considered are either true (i.e. the model is provably robust on the given input domain) or time out on all baselines.
We will use three different neural networks to verify properties on, similar to [23].
We will use the main one, which we call the ‘base model’, to do all of our training and most of our testing on.
It is trained robustly using the method introduced by Madry et al.
[25] to achieve robustness against l ∞ perturbations of size up to ε = 8/255 (the amount typically considered in empirical works).
We will further test the transferability of our GNN on two larger networks.
The different network architectures are explained in greater detail in appendix XII.
b) Training Dataset.
: We would like to train the GNN on the same samples that we will encounter during inference time.
However, that is impossible as the structure and the elements of the BaB tree computed at test time depend on the lower bound computation and thus on the GNN.
The depth, breadth and individual elements of the Branch and
Bound tree depend on the branching, the upper bounding, and the lower bounding methods.
Depending on the exact methods used, different subproblems are created and different ones pruned away.
In other words, the subdomains found in the i th level depend on the lower bounding method used in all of the i − 1 previous layers.
This is why we cannot simulate the subdomains from the i th layer perfectly during the training of the GNN without running an entire Branch-andBound computation with the current version of the GNN. This would be very computationally expensive, as it would require rerunning the BaB verification on each property of the training dataset after every gradient update step in the GNN training phase. We will add this explanation to the revised version of the paper. Toresolve that problem we dynamically create a training dataset as follows.
We first pick a fixed number of images from the training dataset used in Lu and Kumar [23] together with the corresponding properties that we are verifying our network against and epsilon values defining the input domain.
We then create the first part of the training dataset by running a complete BaB algorithm on these properties using the supergradient method.
We record the intermediate bounds and parent dual variables for each subdomain visited to create a dataset to train a first GNN on.
Once we have finished training the first version of the GNN we extend the dataset by running another complete BaB algorithm on the same properties; this time using the first version of the GNN instead of supergradient ascent to compute the lower bounds.
We subsequently resume training the first GNN on the extended dataset for a fixed number of epochs to get a second GNN.
We then repeat this process of extending the dataset and further training the GNN for a fixed number of iterations.
For most properties in the training dataset we acquire a large number of samples over the different iterations.
To speed up training, we reduce the proportion of the training dataset on which we train our GNNs by only picking a small subset of the samples for each property.
We make sure to pick subdomains from different stages of the BaB algorithm in order to get a more diverse training dataset.
We train the GNN using the loss function described in the previous section and using the Adam optimizer [19] with no weight decay.
c) Baselines.
: We compare our work to the baselines used in both Bunel et al.
[6] and Lu and Kumar [23].
We use
MIPplanet, which is a mixed integer solver by the commercial solver GUROBI, BaBSR, a BaB based method that uses an LP solver by GUROBI to compute bounds for the subdomains, and supergradient ascent together with Adam as proposed by Bunel et al.
[5] (for a more detailed description see appendix X).
We run supergradient ascent for 500 steps with a learning rate of 1e-4 (both of these hyper-parameters have been optimized over the validation dataset).
d) Implementation.
: The implementation of our method is based on Pytorch [26].
We compute the intermediate bounds of the network using the method introduced by Wong and
Kolter [30].
The two baselines using GUROBI are run on one
CPU each, as done by Lu and Kumar [23].
We run both the supergradient baseline and our GNN on a single GPU and [Figure] [Figure] [Table]
[Figure]
[Table] [Figure] [Table] CPU each.
One advantage of our method compared to off-theshelf solvers is precisely that we can run it on GPUs and can therefore use more efficient parallelized implementations of mathematical operations.
To speed up the BaB algorithm we parallelize over the lower bound computation for the different subdomains.
We run both the GNN and supergradient ascent with a batch-size of 300.
We run our GNN for 100 steps with an absolute fail-safe threshold of 0.1.
e) Base Model.
: We first run experiments on the base model using a GNN that is trained on 20 easy properties only.
We test the GNN on 425 easy properties, 704 medium properties, and 387 hard properties taken from the dataset created by Lu and Kumar [23].
The difficulty of the properties is determined by how long BaBSR takes to solve them.
We compare our method with previous work by showing how many properties are verified for any given amount of time in seconds (Figure 1).
Our method leads to an over 70% reduction in terms of average time taken compared to BaBSR and MIPplanet (Table I) and times out on significantly fewer properties.
Our GNN also outperforms supergradient ascent.
It leads to a 10% reduction in both time taken and number of subdomains visited (and a 20% improvement when using the median or the geometric mean, see appendix XIII-A, and
XIII-B).
In fact, the GNN beats supergradient ascent on 93.80% of all properties as can be seen in appendix XIII-C. Even though the GNN is trained on easy properties only it generalizes well to harder ones (see appendix XIII-D).
f) Transferability: Larger Models.
: We show further the generalization performance of our GNNs without the need to perform fine-tuning or online learning by testing it on two different larger neural networks.
One of them is wider than the base network, and the other one is deeper.
A more detailed description of the different architectures can be found in appendix XII.
To get better generalization performance, we increase the size of the training dataset to 100 images and train a new GNN based on the base architecture.
As shown in
Figure 1 and Table I, the GNN still outperforms all baselines on both unseen networks.
The GNN beats each baseline on over 85% of all properties (appendix XIII-C).
Good generalisation performance from easy properties to difficult ones and from small networks to larger ones is beneficial as the complexity of training the GNN depends on both the difficulty of the training properties and the size of the model.
Moreover, it allows us to train a single GNN and use it for many different verification tasks on various networks.
VII. D ISCUSSION
We have shown how to improve the complete verification procedure using GNNs that learn how to use the underlying structure of the problem to return better bounds more quickly.
We show that our method consistently beats the existing stateof-the-art algorithms.
Our GNN trained on easy properties on a small network shows good generalization performance on harder properties and on larger unseen networks.
We’ve taken an important step towards creating verification methods for larger state-of-the-art networks.
Further work might include extending our approach to work on different relaxations, such as the Anderson relaxation, which is tighter then Planet but has significantly more constraints.
Alternatively, one could learn a lazy verifier that only solves subdomains for which there is a high chance of pruning and further divides them into more subdomains otherwise.
VIII. B ROADER I MPACT S TATEMENT
Our work expands the applicability of deep learning to safety critical domains as it is essential to be able to verify the robustness of neural networks used in these situations.
This has the potential to save lives when applied to areas like health care or autonomous driving.
However, it may also lead to machines taken over jobs previously carried out by humans and can therefore lead to an increase in unemployment
XI. R EGAINING S UPERGRADIENT A SCENT
We show that our method is strictly more expressive than supergradient ascent by showing that it can simulate it exactly.
The supergradient ascent step is equivalent to update step ρρρ t + 1 = ρρρ t + η t + 1 ˆ ρ ˆ ρ ˆ ρ t + 1 , where
[Equation]
Let Θ 0 be the zero-matrix with non-zero elements Θ 0 [ 1 , 4 ] = 1, Θ 0 [ 2 , 4 ] = − 1.
Moreover, setting T 1 = 1, Θ 1 = 1 and b 0 = b 1 = 0 , we get
[Equation]
, k
[Equation] [Equation]
[Equation]
If we set Θ for 2 = Θ for 3 =
Θ back= Θ back= 0 and Θ for 1 =
Θ back= 1, then the forward and backward passes don’t change the embedding vector.
We now just need to set ΘΘΘ out =
( 1 , − 1 , 0 ,..., 0 ) ⊤ to get the final ascent direction:
[Equation]
We have shown that we can simulate supergradient ascent using our GNN architecture.
XII. N ETWORK A RCHITECTURES
We perform all our experiments on the same three neural networks used by Lu and Kumar [23].
All three networks are trained robustly using the method introduced by Madry et al.
[25] to achieve robustness against l ∞ perturbations of size up to ε = 8/255 (the amount typically considered in empirical works).
The neural network architectures differ in the size and number of convolutional layers used.
However, all of them have two fully connected layers of 100 and 10 units respectively as the final layers.
Each layer but the last is followed by a ReLU activation function.
[Table]
XIII. F URTHER E XPERIMENTAL R ESULTS
We will now compare our method with the different baselines in greater depth.
We first use different statistics to more accurately explain the performances of the different methods.
A. Median
Unlike the arithmetic mean, the median is not skewed by outliers.
The randomly picked threshold at which we stop experiments (3600s) has a larger impact on the mean than the median so as long as methods time-out on less than half of all images.
[Table]
B. Geometric Mean
The geometric mean is less skewed than the arithmetic mean but still encapsulates a lot more information than the median, and is arguably the best suited measure to compare the different methods.
The geometric mean of a set of numbers x 1 ,..., x n is defined to be: (cid:0) ∏ ni = 1 x i (cid:1) 1 n .
As shown in Table IV the GNN is about 20% faster than supergradient ascent and more than 6 times faster than GUROBI and MIPplanet when using the geometric mean.
[Table]
C. Head to Head Performance
The following table outlines the 1-on-1 comparison between the different methods.
The GNN beats each individual baseline on more than 82% of all images on the base and on the wide model and on over 74% on the deep model.
[Table]
D. Base Model Experiments
We now provide a more in-depth analysis of the results on the base model in Figure 2.
The properties are separated into three sets based on the time t i it takes GUROBI BaBSR to solve them: “easy" ( t i < 800), “medium" and a “hard " ( t i > 2400).
The GNN is trained on easy properties only, but it beats the baselines on all three types of properties thus showing good generalization performance.
[Figure]
[Figure] [Figure]
[Figure] [Figure]
[Figure] [Figure]
[Figure] [Figure]
[Table]
XIV. E XPERIMENT S ETUP
We will now explain in greater detail how the experiments described in this paper were run.
We first describe the training procedure used to train the two different GNNs mentioned above.
We then further detail all hyperparameters used in the verification experiments.
A. GNN Training
We train two different GNNs, one on 20 properties and the other on 100.
All of the training properties used are easy; that is BaBSR takes less than 800 seconds to solve them.
We showed above that it suffices to use 20 training images to get good performance on the base model.
In order to achieve better generalization performance on the wide and deep networks we had to train a second GNN on more images.
We train both GNNs for three iterations, as explained above.
For each iteration we train the GNN on 10,000 subdomains for a total of 50 epochs.
At the start of each of the three iterations, we randomly select the subdomains to train on, choosing the same number of subdomains for each property.
We aim to minimize the loss function (13) using a horizon of 100 and a decay factor γ = 0 .
We train the GNN using the Adam optimizer [19] with a learning rate of 1 e − 2 and no weight decay; we manually decay the learning rate by a factor of 10 if the loss function doesn’t improve for two consecutive epochs.
For the update step we use an initial step size of µ = 1 e − 3 , and decay it as explained above.
We set the embedding size to be 32 for all GNNs.
Moreover, we set T 1 = 1 and T 2 = 1.
That is, we use a 2-layer MLP to initialize the embedding vectors and perform just one set of forward and backward passes.
At the beginning of the first iteration we create the dataset by running the BaB algorithm using supergradient ascent and Adam to compute the lower bounds; we set the learning rate to be 1 e − 4 .
For the second and third iterations we further extend the dataset, this time using the current version of the GNN to compute the final lower bounds.
B. Verification Experiments
For all verification experiments mentioned in this work we run the BaB algorithm outlined in appendix IX.
We run 100 iterations of the GNN compared to 500 when using supergradient ascent.
This together with the significant reduction in subdomains visited in the
BaB algorithm when using the GNN more than compensates for the fact that one iteration of the GNN takes longer than one iteration of supergradient ascent.
If the GNN performs poorly on a subdomain and the fail-safe method is used, it is likely to also not do well on the child subdomains.
We therefore use supergradient ascent to solve all subdomains that result from further subdividing the current one.
For all experiment we use a batch-size of 300 for both the GNN and supergradient descent.
For the base experiments we store all current subdomains in memory because it is quicker; for the deep and wide models we store them as files because the experiments are more memory expensive.
XV. C OMPARISON TO P REVIOUS W ORK
Whilst [22] and our work both focus on using GNN for neural network verification problems, there are several key differences between the two papers.
Firstly, they focus on different elements of the Branch-and-Bound algorithm.
Whilst our method outputs an ascent direction for the dual variables, the branching GNN returns a branching score for each ReLU node.
The two papers use different loss functions: we train the GNN in a self-supervised way by optimise the dual objective, whilst [22] train their GNN in a supervised manner based on the actual improvement score, that evaluates the possible gain from branching at each node.
They aim to imitate the strong branching strategy.
Another key difference between the two methods is the training dataset for the GNN, as they use the strong branching heuristic to create some training properties which is very expensive.
The two papers also differ in the GNN architectures they use: they have different feature vectors, and different types of forward and backward update steps.
Finally, Lu and Kumar [22] use online-learning to fine-tune their GNN at inference time, which we do not.
XVI. GNN
We now present the GNN Bounding Method as an algorithm below.
i , ρρρ i ) 3: ρρρ 0 : =
ρρρ
Initialize variables 4: for t = 0 , ··· , K − 1 do 5: f k
[ i ] : = (cid:0) ρρρ k
[ i ] , ˆz A , k
[ i ] , ˆz B , k
[ i ] , ˆz B , k
[ i ] − ˆz A , k
[ i ] (cid:1) ⊤ .
6: µ µ µ k
[ i ] : =
g ( f k
[ i ]) i 7: µµµ k
[ i ] : =
F ( µµµ k − 1 , µµµ k , W k ) the to the layer 8: µµµ k
[ i ] : =
B ( µµµ k , µµµ k + 1 , W k + 1 ) to the layer 9: ˆ ρ ˆ ρ ˆ ρ t + 1 k = ΘΘΘ out µµµ k . direction 10: ρρρ t + 1 = ρρρ t + η t
+
ˆ ρ ˆ ρ ˆ ρ t +
Compute variables 11: end for 12: if q ( ρρρ K ) > 0 then 13: return UNSAT 14: else 15: return ρρρ K q ( ρρρ K ) 16: end if 17: end function