PRIMA: general and precise neural network certification via scalable convex hull approximations

Niklas, Müller, Mark; Makarchuk, Gleb; Singh, Gagandeep; Püschel, Markus; Vechev, Martin

doi:10.1145/3498704

Cited by 50 publications

(16 citation statements)

References 34 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Comparison with incomplete methods. We extend the comparison to more recent works: incomplete methods that used solvers (Müller et al 2022;Wang et al 2021a;Singh et al 2019b,a;Tjandraatmadja et al 2020). We emphasize that these works are incomplete: they do not provide proof that an image correctly predicted has no adversarial attack (see Appendix A for definitions).…”

Section: F3 Comparisons With Other Methodsmentioning

confidence: 99%

A Scalable, Interpretable, Verifiable & Differentiable Logic Gate Convolutional Neural Network Architecture From Truth Tables

Benamira¹,

Peyrin²,

Kuen-Yew³

2022

Preprint

View full text Add to dashboard Cite

With the expanding role of neural networks, the need for complete and sound verification of their property has become critical. In the recent years, it was established that Binary Neural Networks (BNNs) have an equivalent representation in Boolean logic and can be formally analyzed using logical reasoning tools such as SAT solvers. However, to date, only BNNs can be transformed into a SAT formula. In this work, we introduce Truth Table Deep Convolutional Neural Networks (TTnets), a new family of SAT-encodable models featuring for the first time real-valued weights. Furthermore, it admits, by construction, some valuable conversion features including post-tuning and tractability in the robustness verification setting. The latter property leads to a more compact SAT symbolic encoding than BNNs. This enables the use of general SAT solvers, making property verification easier. We demonstrate the value of TTnets regarding the formal robustness property: TTnets outperform the verified accuracy of all BNNs with a comparable computation time. More generally, they represent a relevant trade-off between all known complete verification methods: TTnets achieve high verified accuracy with fast verification time, being complete with no timeouts. We are exploring here a proof of concept of TTnets for a very important application (complete verification of robustness) and we believe this novel real-valued network constitutes a practical response to the rising need for functional formal verification. We postulate that TTnets can apply to various CNN-based architectures and be extended to other properties such as fairness, fault attack and exact rule extraction.

show abstract

Section: F3 Comparisons With Other Methodsmentioning

confidence: 99%

A Scalable, Interpretable, Verifiable & Differentiable Logic Gate Convolutional Neural Network Architecture From Truth Tables

Benamira¹,

Peyrin²,

Kuen-Yew³

2022

Preprint

View full text Add to dashboard Cite

show abstract

“…These relaxations are relatively inexpensive yet very effective when adapted for complete verification via branch-and-bound, and are hence at the core of the α-β-CROWN (Xu et al, 2021;Wang et al, 2021) and OVAL frameworks (Bunel et al, 2020a;De Palma et al, 2021c). A number of works have recently focused on devising tighter neural network relaxations (Singh et al, 2019a;Anderson et al, 2020;Tjandraatmadja et al, 2020;Müller et al, 2022). These have been integrated into recent branch-and-bound verifiers (De Palma et al, 2021a;Ferrari et al, 2022) and yield strong results for harder verification properties on medium-sized networks.…”

Section: Related Workmentioning

confidence: 99%

IBP Regularization for Verified Adversarial Robustness via Branch-and-Bound

Palma¹,

Bunel²,

Dvijotham³

et al. 2022

Preprint

View full text Add to dashboard Cite

Recent works have tried to increase the verifiability of adversarially trained networks by running the attacks over domains larger than the original perturbations and adding various regularization terms to the objective. However, these algorithms either underperform or require complex and expensive stage-wise training procedures, hindering their practical applicability. We present IBP-R, a novel verified training algorithm that is both simple and effective. IBP-R induces network verifiability by coupling adversarial attacks on enlarged domains with a regularization term, based on inexpensive interval bound propagation, that minimizes the gap between the non-convex verification problem and its approximations. By leveraging recent branch-and-bound frameworks, we show that IBP-R obtains state-of-the-art verified robustness-accuracy trade-offs for small perturbations on CIFAR-10 while training significantly faster than relevant previous work. Additionally, we present UPB, a novel branching strategy that, relying on a simple heuristic based on β-CROWN, reduces the cost of state-of-the-art branching algorithms while yielding splits of comparable quality.

show abstract

“…While the robustness of neural models has received considerable attention [7][8][9][10][11][12][13][14][15][16][17][18][19][20][21], the challenge of obtaining robustness guarantees for ensembles of tree-based models has only been investigated recently [4,22,23]. However, these initial works only consider numerical features and are based on worst-case approximations, which do not scale well to the difficult p -norm setting.…”

Section: Introductionmentioning

confidence: 99%

(De-)Randomized Smoothing for Decision Stump Ensembles

Horváth¹,

Niklas²,

Fischer³

et al. 2022

Preprint

Self Cite

View full text Add to dashboard Cite

Tree-based models are used in many high-stakes application domains such as finance and medicine, where robustness and interpretability are of utmost importance. Yet, methods for improving and certifying their robustness are severely under-explored, in contrast to those focusing on neural networks. Targeting this important challenge, we propose deterministic smoothing for decision stump ensembles. Whereas most prior work on randomized smoothing focuses on evaluating arbitrary base models approximately under input randomization, the key insight of our work is that decision stump ensembles enable exact yet efficient evaluation via dynamic programming. Importantly, we obtain deterministic robustness certificates, even jointly over numerical and categorical features, a setting ubiquitous in the real world. Further, we derive an MLE-optimal training method for smoothed decision stumps under randomization and propose two boosting approaches to improve their provable robustness. An extensive experimental evaluation shows that our approach yields significantly higher certified accuracies than the state-of-the-art for tree-based models. We release all code and trained models at ANONYMIZED. * Equal contribution Preprint. Under review.

show abstract

PRIMA: general and precise neural network certification via scalable convex hull approximations

Cited by 50 publications

References 34 publications

A Scalable, Interpretable, Verifiable & Differentiable Logic Gate Convolutional Neural Network Architecture From Truth Tables

A Scalable, Interpretable, Verifiable & Differentiable Logic Gate Convolutional Neural Network Architecture From Truth Tables

IBP Regularization for Verified Adversarial Robustness via Branch-and-Bound

(De-)Randomized Smoothing for Decision Stump Ensembles

Contact Info

Product

Resources

About