PEREGRiNN: Penalized-Relaxation Greedy Neural Network Verifier

Abstract

Neural Networks (NNs) have increasingly apparent safety implications commensurate with their proliferation in real-world applications: both unanticipated as well as adversarial misclassifications can result in fatal outcomes. As a consequence, techniques of formal verification have been recognized as crucial to the design and deployment of safe NNs. In this paper, we introduce a new approach to formally verify the most commonly considered safety specifications for ReLU NNs – i.e. polytopic specifications on the input and output of the network. Like some other approaches, ours uses a relaxed convex program to mitigate the combinatorial complexity of the problem. However, unique in our approach is the way we use a convex solver not only as a linear feasibility checker, but also as a means of penalizing the amount of relaxation allowed in solutions. In particular, we encode each ReLU by means of the usual linear constraints, and combine this with a convex objective function that penalizes the discrepancy between the output of each neuron and its relaxation. This convex function is further structured to force the largest relaxations to appear closest to the input layer; this provides the further benefit that the most “problematic” neurons are conditioned as early as possible, when conditioning layer by layer. This paradigm can be leveraged to create a verification algorithm that is not only faster in general than competing approaches, but is also able to verify considerably more safety properties; we evaluated PEREGRiNN on a standard MNIST robustness verification suite to substantiate these claims.

Fast BATLLNN: Fast Box Analysis of Two-Level Lattice Neural Networks

“…Exp. 3) Comparison with general NN verifiers: nnenum [5], Pere-griNN [23] and Alpha-Beta-Crown [33]. All experiments were run within a VMWare Workstation Pro virtual machine (VM) running on a Linux host with 48 hyper-threaded cores and 256 GB of memory.…”

“…The literature on more general NN verifiers is far richer. These NN verifiers can generally be grouped into three categories: (i) SMT-based methods, which encode the problem into a Satisfiability Modulo Theory problem [12,21,22]; (ii) MILP-based solvers, which directly encode the verification problem as a Mixed Integer Linear Program [3, 6-8, 18, 24, 27]; (iii) Reachability based methods, which perform layer-by-layer reachability analysis to compute the reachable set [5,13,19,20,29,32,36,37]; and (iv) convex relaxations methods [10,23,31,35]. Methods in categories (i) -(iii) tend to suffer from poor scalability, especially relative to convex relaxation methods.…”

“…Methods in categories (i) -(iii) tend to suffer from poor scalability, especially relative to convex relaxation methods. In this paper, we perform comparisons with state-of-theart examples from category (iv) [23,33] and category (iii) [5], as perform well overall in the standard verifier competition [2].…”

“…Although it seems unnecessary to introduce the function 𝔰 ′ , this notation directly connects (23) to full-dimensional regions of the arrangement 𝔥 𝑎 . Indeed, it states that the intersection term of interest is non-empty if and only if there is a full-dimensional region in the hyperplane arrangement whose index function 𝔰 : {𝑙 𝑎 𝑖 : 𝑖 = 1, .…”

“…In this experiment, we compared the verification performance of Fast BATLLNN with state-of-the-art (SOTA) NN verifiers designed to work on general deep NNs. For this experiment, we compared against generic verifiers Alpha-Beta-Crown [33], nnenum [5] and PeregriNN [23], as a representative sample of SOTA NN verifiers. Moreover, we conducted this experiment on the same 240 networks used in [15], and described in Section 6.1.1; this further facilitates a limited comparison with that algorithm, subject to the caveats described in Section 6.1.1 and Section 6.1.3.…”