A Dual Approach to Scalable Verification of Deep Networks

TL;DR

This paper introduces a scalable, general framework for verifying neural network properties by formulating the problem as an optimization task and providing anytime bounds, applicable to various architectures and specifications.

Contribution

It presents a novel verification approach that applies to general activation functions, uses Lagrangian relaxation, and offers anytime bounds with tightness guarantees.

Findings

Applicable to large and complex networks

Provides provable bounds on property violations

Demonstrates effectiveness on diverse verification tasks

Abstract

This paper addresses the problem of formally verifying desirable properties of neural networks, i.e., obtaining provable guarantees that neural networks satisfy specifications relating their inputs and outputs (robustness to bounded norm adversarial perturbations, for example). Most previous work on this topic was limited in its applicability by the size of the network, network architecture and the complexity of properties to be verified. In contrast, our framework applies to a general class of activation functions and specifications on neural network inputs and outputs. We formulate verification as an optimization problem (seeking to find the largest violation of the specification) and solve a Lagrangian relaxation of the optimization problem to obtain an upper bound on the worst case violation of the specification being verified. Our approach is anytime i.e. it can be stopped at any time and a valid bound on the maximum violation can be obtained. We develop specialized verification algorithms with provable tightness guarantees under special assumptions and demonstrate the practical significance of our general verification approach on a variety of verification tasks.