Output Range Analysis for Deep Feedforward Neural Networks

Abstract

Deep neural networks (NN) are extensively used for machine learning tasks such as image classification, perception and control of autonomous systems. Increasingly, these deep NNs are also been deployed in high-assurance applications. Thus, there is a pressing need for developing techniques to verify neural networks to check whether certain user-expected properties are satisfied. In this paper, we study a specific verification problem of computing a guaranteed range for the output of a deep neural network given a set of inputs represented as a convex polyhedron. Range estimation is a key primitive for verifying deep NNs. We present an efficient range estimation algorithm that uses a combination of local search and linear programming problems to efficiently find the maximum and minimum values taken by the outputs of the NN over the given input set. In contrast to recently proposed "monolithic" optimization approaches, we use local gradient descent to repeatedly find and eliminate local minima of the function. The final global optimum is certified using a mixed integer programming instance. We implement our approach and compare it with Reluplex, a recently proposed solver for deep neural networks. We demonstrate the effectiveness of the proposed approach for verification of NNs used in automated control as well as those used in classification.

Optimization and abstraction: a synergistic approach for analyzing neural network robustness

“…Thus, comparing against ReluVal on the verifiably-robust benchmarks allows us to evaluate the benefits of learning a verification policy from data. 8 The results of this comparison are shown in Figure 15. As we can see from this figure, ReluVal is still only able to solve between 35-70% of the benchmarks that can be successfully solved by Charon.…”

“…Huang et al [23] showed a verification framework, based on an SMT solver, which verified robustness with respect to a certain set of functions that can manipulate the input. A few recent papers [8,32,53] use Mixed Integer Linear Programming (MILP) solvers to verify local robustness properties of neural networks. These methods do not use abstraction and do not scale very well, but combining these techniques with abstraction is an interesting area of future work.…”

Towards formal methods and software engineering for deep learning: Security, safety and productivity for dl systems development

“…Dutta et al [35] also study the automatic estimation of the output-range for deep NNs. A key concept of theirs is that sets of possible inputs are compactly represented by convex polyhedral.…”

ReLU networks as surrogate models in mixed-integer linear programs

“…An exact MILP formulation of a ReLU network can be obtained by programming each ReLU operator with a binary variable and applying the big-M method. This formulation has recently been applied to formal verification [32,33,34,35,36], to count linear regions [37], and to compress DNNs [38]. Common for these works is consideration of a single ReLU network subject to input bounds.…”