Optimization and Abstraction: A Synergistic Approach for Analyzing Neural Network Robustness

TL;DR

This paper introduces Charon, a new verification tool that combines optimization and abstraction techniques to efficiently verify neural network robustness, outperforming existing methods on numerous benchmarks.

Contribution

The paper presents a novel synergistic algorithm that integrates gradient-based optimization with abstraction-based proof search for neural network robustness verification.

Findings

Charon significantly outperforms state-of-the-art tools

The approach is sound and δ-complete

Experimental results on hundreds of benchmarks

Abstract

In recent years, the notion of local robustness (or robustness for short) has emerged as a desirable property of deep neural networks. Intuitively, robustness means that small perturbations to an input do not cause the network to perform misclassifications. In this paper, we present a novel algorithm for verifying robustness properties of neural networks. Our method synergistically combines gradient-based optimization methods for counterexample search with abstraction-based proof search to obtain a sound and ({\delta}-)complete decision procedure. Our method also employs a data-driven approach to learn a verification policy that guides abstract interpretation during proof search. We have implemented the proposed approach in a tool called Charon and experimentally evaluated it on hundreds of benchmarks. Our experiments show that the proposed approach significantly outperforms three state-of-the-art tools, namely AI^2 , Reluplex, and Reluval.

Equations

$$W_1=\left[\begin{array}{c}1\\ 2\end{array}\right]b_1=\left[\begin{array}{c}-1\\ 1\end{array}\right]W_2=\left[\begin{array}{cc}2& 1\\ -1& 1\end{array}\right]b_2=\left[\begin{array}{c}1\\ 2\end{array}\right]$$

$$\mathcal{N}(x)=\left[\begin{array}{cc}1& 1.1\\ -1& 1\end{array}\right]\mathrm{ReLU}\left(\left[\begin{array}{cc}1& -3\\ 0& 3\end{array}\right]x+\left[\begin{array}{c}1\\ 1\end{array}\right]\right)+\left[\begin{array}{c}-3\\ 1.2\end{array}\right]$$

$$x_{\ast }=\underset{x\in I}{\mathrm{argmin}}\left(\mathcal{F}(x)\right)$$

$$\mathcal{F}(x)=(\mathcal{N}(x){)}_K-\underset{j\ne K}{\max }(\mathcal{N}(x){)}_j$$

$$\phi (\theta \rho (\mathcal{N},I,K,x_{\ast }))$$

$$F(\theta )=-\sum _{s\in S}{\text{cost}}_{\theta }(s)\text{vspace}-0.1in$$

$$\emph{cost}_{\theta}(s)=\left\{\begin{array}[]{ll}\emph{Time}(\emph{Verify}_{\theta}(s))&{\rm if}\ s\ {\rm solved}\ {\rm within}\ t\\ p\cdot t&{\rm otherwise}\end{array}\right.$$

$$\mathcal{F}(x_{\ast })\le \delta$$

$$I=\left\{x^{\prime }\in {}^n\mid \forall i.(x_i\ge \tau \wedge x_i\le x_i^{\prime }\le 1)\vee x_i^{\prime }=x_i\right\}.$$

$$D(X)=\sup \{\Vert x_1-x_2{\Vert }_2\mid x_1,x_2\in X\}$$

$$k>{\log }_{\lambda }\left(\frac{\delta }{2K_{\mathcal{N}}D(I)}\right)$$

$$y_K-y_i$$

$$=((\mathcal{N}(x_{\ast }){)}_K-(\mathcal{N}(x_{\ast }){)}_i)-\delta$$

$$>0$$

Full text

Machine learning, Abstract Interpretation, Optimization, Robustness

††copyright: acmlicensed††price: 15.00††doi: 10.1145/3314221.3314614††journalyear: 2019††isbn: 978-1-4503-6712-7/19/06††conference: Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation; June 22–26, 2019; Phoenix, AZ, USA††booktitle: Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI ’19), June 22–26, 2019, Phoenix, AZ, USA††ccs: Theory of computation Abstraction††ccs: Computing methodologies Neural networks

1. Introduction

In recent years, deep neural networks (DNNs) have gained enormous popularity for a wide spectrum of applications, ranging from image recognition(He et al., 2016; Krizhevsky et al., 2012) and malware detection (Yuan et al., 2014; Yuan et al., 2016) to machine translation(Wu et al., 2016). Due to their surprising effectiveness in practice, deep learning has also found numerous applications in safety-critical systems, including self-driving cars (ApolloAuto, 2017; Bojarski et al., 2016), unmanned aerial systems (Julian et al., 2016), and medical diagnosis (Esteva et al., 2017).

Despite their widespread use in a broad range of application domains, it is well-known that deep neural networks are vulnerable to adversarial counterexamples, which are small perturbations to a network’s input that cause the network to output incorrect labels (Evtimov et al., 2017; Papernot et al., 2016). For instance, Figure 1 shows two adversarial examples in the context of speech recognition and image classification. As shown in the top half of Figure 1, two sound waves that are virtually indistinguishable are recognized as “How are you?” and “Open the door” by a DNN-based speech recognition system (Gong and Poellabauer, 2018). Similarly, as illustrated in the bottom half of the same figure, applying a tiny perturbation to a panda image causes a DNN to misclassify the image as that of a gibbon.

It is by now well-understood that such adversarial counterexamples can pose serious security risks (Yuan et al., 2017). Prior work (Bastani et al., 2016; Katz et al., 2017a; Pei et al., 2017a, b; Gehr et al., 2018) has advocated the property of local robustness (or robustness for short) for protecting neural networks against attacks that exploit such adversarial examples. To understand what robustness means, consider a neural network that classifies an input $x$ as having label $y$. Then, local robustness requires that all inputs $x^{\prime}$ that are “very similar” 111For example, “very similar” may mean $x^{\prime}$ is within some $\epsilon$ distance from $x$, where distance can be measured using different metrics such as $L^{2}$ norm. to $x$ are also classified as having the same label $y$.

Due to the growing consensus on the desirability of robust neural networks, many recent efforts have sought to algorithmically analyze robustness of networks. Of these, one category of methods seeks to discover adversarial counterexamples using numerical optimization techniques such as Projected Gradient Descent (PGD) (Madry et al., 2018) and Fast Gradient Sign Method (FGSM) (Goodfellow et al., 2015). A second category aims to prove network robustness using symbolic methods ranging from SMT-solving (Katz et al., 2017a) to abstract interpretation (Gehr et al., 2018; Wang et al., 2018). These two categories of methods have complementary advantages. Numerical counterexample search methods can quickly find violations, but are “unsound”, in that they fail to offer certainty about a network’s robustness. In contrast, proof search methods are sound, but they are either incomplete (Gehr et al., 2018) (i.e., suffer from false positives) or do not scale well (Katz et al., 2017a).

In this paper, we present a new technique for robustness analysis of neural networks that combines the best of proof-based and optimization-based methods. Our approach combines formal reasoning techniques based on abstract interpretation with continuous and black-box optimization techniques from the machine learning community. This tight coupling of optimization and abstraction has two key advantages: First, optimization-based methods can efficiently search for counterexamples that prove the violation of the robustness property, allowing efficient falsification in addition to verification. Second, optimization-based methods provide a data-driven way to automatically refine the abstraction when the property can be neither falsified nor proven.

The workflow of our approach is shown schematically in Figure 2 and consists of both a training and a deployment phase. During the training phase, our method uses black-box optimization techniques to learn a so-called verification policy $\pi_{\theta}$ from a representative set of training problems. Then the deployment phase uses the learned verification policy to guide how gradient-based counterexample search should be coupled with proof synthesis for solving previously-unseen verification problems.

The input to the deployment phase of our algorithm consists of a neural network $\mathcal{N}$ as well as a robustness specification $(I,K)$ which states that all points in the input region $I$ should be classified as having label $K$. Given this input, our algorithm first uses gradient-based optimization to search for an adversarial counterexample, which is a point in the input region $I$ that is classified as having label $K^{\prime}\neq K$. If we can find such a counterexample, then the algorithm terminates with a witness to the violation of the property. However, even if the optimization procedure fails to find a true counterexample, the result $x_{*}$ of the optimization problem can still convey useful information. In particular, our method uses the learned verification policy $\pi_{\theta}$ to map all available information, including $x_{*}$, to a promising abstract domain $\mathcal{A}$ to use when attempting to verify the property. If the property can be verified using domain $\mathcal{A}$, then the algorithm successfully terminates with a robustness proof.

In cases where the property is neither verified nor refuted, our algorithm uses the verification policy $\pi_{\theta}$ to split the input region $I$ into two sub-regions $I_{1},I_{2}$ such that $I=I_{1}\cup I_{2}$ and tries to verify/falsify the robustness of each region separately. This form of refinement is useful for both the abstract interpreter as well as the counterexample finder. In particular, since gradient-based optimization methods are not guaranteed to find a global optimum, splitting the input region into smaller parts makes it more likely that the optimizer can find an adversarial counterexample. Splitting the input region is similarly useful for the abstract interpreter because the amount of imprecision introduced by the abstraction is correlated with the size of the input region.

As illustrated by the discussion above, a key part of our verification algorithm is the use of a policy $\pi_{\theta}$ to decide (a) which abstract domain to use for verification, and (b) how to split the input region into two sub-regions. Since there is no obvious choice for either the abstract domain or the splitting strategy, our algorithm takes a data-driven approach to learn a suitable verification policy $\pi_{\theta}$ during a training phase. During this training phase, we use a black-box optimization technique known as Bayesian optimization to learn values of $\theta$ that lead to strong performance on a representative set of verification problems. Once this phase is over, the algorithm can be deployed on networks and properties that have not been encountered during training.

Our proposed verification algorithm has some appealing theoretical properties in that it is both sound and $\delta$-complete (Gao et al., 2012). That is, if our method verifies the property $(I,K)$ for network $\mathcal{N}$, this means that $\mathcal{N}$ does indeed classify all points in the input region $I$ as belonging to class $K$. Furthermore, our method is $\delta$-complete in the sense that, if the property is falsified with counterexample $x_{*}$, this means that $x_{*}$ is within $\delta$ of being a true counterexample.

We have implemented the proposed method in a tool called Charon 222Complete Hybrid Abstraction Refinement and Optimization for Neural Networks., and used it to analyze hundreds of robustness properties of ReLU neural networks, including both fully-connected and convolutional neural networks, trained on the MNIST (Lecun et al., 1998) and CIFAR (Krizhevsky, 2009) datasets. We have also compared our method against state-of-the-art network verification tools (namely, Reluplex, ReluVal, and ${\rm AI}^{2}$) and shown that our method outperforms all prior verification techniques, either in terms of accuracy or performance or both. In addition, our experimental results reveal the benefits of learning to couple proof search and optimization.

In all, this paper makes the following key contributions:

• •

We present a new sound and $\delta$-complete decision procedure that combines abstract interpretation and gradient-based counterexample search to prove robustness of deep neural networks.

• •

We describe a method for automatically learning verification policies that direct counterexample search and abstract interpretation steps carried out during the analysis.

• •

We conduct an extensive experimental evaluation on hundreds of benchmarks and show that our method significantly outperforms state-of-the-art tools for verifying neural networks. For example, our method solves $2.6\times$ and $16.6\times$ more benchmarks compared to ReluVal and Reluplex respectively.

Organization.

The rest of this paper is organized as follows. In Section 2, we provide necessary background on neural networks, robustness, and abstract interpretation of neural networks. In Section 3, we present our algorithm for checking robustness, given a verification policy (i.e., the deployment phase). Section 4 describes our data-driven approach for learning a useful verification policy from training data (i.e., the training phase), and Section 5 discusses the theoretical properties of our algorithm. Finally, Sections 6 and  7 describe our implementation and experimental evaluation, Section 8 discusses related work, and Section 9 concludes.

2. Background

In this section, we provide some background on neural networks and robustness.

2.1. Neural Networks

A neural network is a function $\mathcal{N}:{}^{n}\to{}^{m}$ of the form $L_{1}\circ\sigma_{1}\circ\dots\circ\sigma_{k-1}\circ L_{k}$, where each $L_{i}$ is a differentiable layer and each $\sigma_{i}$ is a non-linear, almost-everywhere differentiable activation function. While there are many types of activation functions, the most popular choice in modern neural networks is the rectified linear unit (ReLU), defined as $\mathrm{ReLU}(x)=\max(x,0)$. This function is applied element-wise to the output of each layer except the last. In this work, we consider feed-forward and convolutional networks, which have the additional property of being Lipschitz-continuous 333Recall that a function is Lipschitz-continuous if there exists a positive real constant $M$ such that, for all $x_{1},x_{2}$, we have $|f(x_{1})-f(x_{2})|\leq M|x_{1}-x_{2}|$.

For the purposes of this work, we think of each layer $L_{i}$ as an affine transformation $(W,\overline{b})$ where $W$ is a weight matrix and $\overline{b}$ is a bias vector. Thus, the output of the $i$’th layer is computed as $\overline{y}=W\overline{x}+\overline{b}$. We note that both fully-connected as well as convolutional layers can be expressed as affine transformations (Gehr et al., 2018). While our approach can also handle other types of layers (e.g., max pooling), we only focus on affine transformations to simplify presentation.

In this work, we consider networks used for classification tasks. That is, given some input $x\in{}^{n}$, we wish to put $x$ into one of $m$ classes. The output of the network $y\in{}^{m}$ is interpreted as a vector of scores, one for each class. Then $x$ is put into the class with the highest score. More formally, given some input $x$, we say the network $\mathcal{N}$ assigns $x$ to a class $K$ if $(\mathcal{N}(x))_{K}>(\mathcal{N}(x))_{j}$ for all $j\neq K$.

Example 2.1.

Figure 3 shows a 2-layer feedforward neural network implementing the XOR function. To see why this network “implements” XOR, consider the vector $[0\ 0]^{\top}$. After applying the affine transformation from the first layer, we obtain $[0\ -1]^{\top}$. After applying ReLU, we get $[0\ 0]^{\top}$. Finally, after applying the affine transform in the second layer, we get $[1\ 0]^{\top}$. Because the output at index zero is greater than the output at index one, the network will classify $[0\ 0]^{\top}$ as a zero. Similarly, this network classifies both $[0\ 1]^{\top}$ and $[1\ 0]^{\top}$ as $1$ and $[1\ 1]^{\top}$ as [math].

2.2. Robustness

(Local) robustness (Bastani et al., 2016) is a key correctness property of neural networks which requires that all inputs within some region of the input space fall within the same region of the output space. Since we focus on networks designed for classification tasks, we will define “the same region of the output space” to mean the region which assigns the same class to the input. That is, a robustness property asserts that a small change in the input cannot change the class assigned to that input.

More formally, a robustness property is a pair $(I,K)$ with $I\subseteq{}^{n}$ and $0\leq K\leq m-1$. Here, $I$ defines some region of the input that we are interested in and $K$ is the class into which all the inputs in $I$ should be placed. A network $\mathcal{N}$ is said to satisfy a robustness property $(I,K)$ if for all $x\in I$, we have $(\mathcal{N}(x))_{K}>(\mathcal{N}(x))_{j}$ for all $j\neq K$.

Example 2.2.

Consider the following network with two layers, i.e., $\mathcal{N}(x)=W_{2}(\mathrm{ReLU}(W_{1}x+b_{1}))+b_{2}$ where:

[TABLE]

For the input $x=0$, we have $\mathcal{N}(0)=[1\ 3]^{\top}$; thus, the network outputs label 1 for input [math]. Let $I=[-1,1]$ and $K=1$. Then for all $x\in I$, the output of $\mathcal{N}$ is of the form $[a+1\ a+2]^{T}$ for some $a\in[0,3]$. Therefore, the network classifies every point in $I$ as belonging to class 1, meaning that the network is robust in $[-1,1]$. On the other hand, suppose we extend this interval to $I^{\prime}=[-1,2]$. Then $\mathcal{N}(2)=[8\ 6]^{\top}$, so $\mathcal{N}$ assigns input $2$ as belonging to class 0. Therefore $\mathcal{N}$ is not robust in the input region $[-1,2]$.

2.3. Abstract Interpretation for Neural Networks

In this paper, we build on the prior ${\rm AI}^{2}$ work (Gehr et al., 2018) for analyzing neural networks using the framework of abstract interpretation (Cousot and Cousot, 1977). ${\rm AI}^{2}$ allows analyzing neural networks using a variety of numeric abstract domains, including intervals (boxes) (Cousot and Cousot, 1977), polyhedra (Singh et al., 2017), and zonotopes (Ghorbal et al., 2009). In addition, ${\rm AI}^{2}$ also supports bounded powerset domains  (Cousot and Cousot, 1977), which essentially allow a bounded number of disjunctions in the abstraction. Since the user can specify any number of disjunctions, there are many different abstract domains to choose from, and the precision and scalability of the analysis crucially depend on one’s choice of the abstract domain.

The following example illustrates a robustness property that can be verified using the bounded zonotope domain with two disjuncts but not with intervals or plain zonotopes:

Example 2.3.

Consider a network defined as:

[TABLE]

As in the previous example, the first index in the output vector corresponds to class $A$ and the second index corresponds to class $B$. Now, suppose we want to verify that for all $x\in[0,1]^{2}$, the network assigns class $B$ to $x$.

Let us now analyze this network using the zonotope abstract domain, which overapproximates a given region using a zonotope (i.e., center-symmetric polytope). The analysis of this network using the zonotope domain is illustrated in Figure 4. At first, the initial region is propagated through the affine transformation as a single zonotope. Then, this zonotope is split into two pieces, the blue (crosshatched) one for which $x_{1}\geq 0$ and the red (diagonally striped) one for which $x_{1}\leq 0$. The ReLU transforms the red piece into a line. (We omit the ReLU over $x_{2}$ because it does not change the zonotopes in this case.) After the ReLU, we show two cases: on top is the plain zonotope domain, and on the bottom is a powerset of zonotopes domain. In the plain zonotope domain, the abstraction after the ReLU is the join of the blue and red zonotopes, while in the powerset domain we keep the blue and red zonotopes separate. The final images show how the second affine transformation affects all three zonotopes.

This example illustrates that the propery cannot be verified using the plain zonotope domain, but it can be verified using the powerset of zonotopes domain. Specifically, observe that the green (vertically striped) zonotope at the top includes the point $[1.2\ 1.2]^{\top}$ (marked by a dot), where the robustness specification is violated. On the other hand, the blue and red zonotopes obtained using the powerset domain do not contain any unsafe points, so the property is verified using this more precise abstraction.

3. Algorithm for Checking Robustness

In this section, we describe our algorithm for checking robustness properties of neural networks. Our algorithm interleaves optimization-based counterexample search with proof synthesis using abstraction refinement. At a high level, abstract interpretation provides an efficient way to verify properties but is subject to false positives. Conversely, optimization based techniques for finding counterexamples are efficient for finding adversarial inputs, but suffer from false negatives. Our algorithm combines the strengths of these two techniques by searching for both proofs and counterexamples at the same time and using information from the counterexample search to guide proof search.

Before we describe our algorithm in detail, we need to define our optimization problem more formally. Given a network $\mathcal{N}$ and a robustness property $(I,K)$, we can view the search for an adversarial counterexample as the following optimization problem:

[TABLE]

where our objective function $\mathcal{F}$ is defined as follows:

[TABLE]

Intuitively, the objective function $\mathcal{F}$ measures the difference between the score for class $K$ and the maximum score among classes other than $K$. Note that if the value of this objective function is not positive at some point $x$, then there exists some class which has a greater (or equal) score than the target class, so point $x$ constitutes a true adversarial counterexample.

The optimization problem from Eq. 1 is clearly useful for searching for counterexamples to the robustness property. However, even if the solution $x_{*}$ is not a true counterexample (i.e., $\mathcal{F}(x_{*})>0$), we can still use the result of the optimization problem to guide proof search.

Based on this intuition, we now explain our decision procedure, shown in Algorithm 1, in more detail. The Verify procedure takes as input a network $\mathcal{N}$, a robustness property $(I,K)$ to be verified, and a so-called verification policy $\pi_{\theta}$. As mentioned in Section 1, the verification policy is used to decide what kind of abstraction to use and how to split the input region when attempting to verify the property. In more detail, the verification policy $\pi_{\theta}$, parameterized by $\theta$, is a pair $(\pi^{\alpha}_{\theta},\pi^{I}_{\theta})$, where $\pi^{\alpha}_{\theta}$ is a (parameterized) function known as the domain policy and $\pi^{I}_{\theta}$ is a function known as the partition policy. The domain policy is used to decide which abstract domain to use, while the partition policy determines how to split the input region $I$ into two partitions to be analyzed separately. In general, it is quite difficult to write a good verification policy by hand because there are many different parameters to tune and neural networks are quite opaque and difficult to interpret. In Section 4, we explain how the parameters of these policy functions are learned from data.

At a high-level, the Verify procedure works as follows: First, we try to find a counterexample to the given robustness property by solving the optimization problem from Eq. 1 using the well-known projected gradient descent (PGD) technique. If $\mathcal{F}(x_{*})$ is non-positive, we have found a true counterexample, so the algorithm produces $x_{*}$ as a witness to the violation of the property. Otherwise, we try to verify the property using abstract interpretation.

As mentioned in Section 2, there are many different abstract domains that can be used to verify the property, and the choice of the abstract domain has a huge impact on the success and efficiency of verification. Thus, our approach leverages the domain policy $\pi^{\alpha}_{\theta}$ to choose a sensible abstract domain to use when attempting to verify the property. Specifically, the domain policy $\pi^{\alpha}_{\theta}$ takes as input the network $\mathcal{N}$, the robustness specification $(I,K)$, and the solution $x_{*}$ to the optimization problem and chooses an abstract domain $\mathcal{A}$ that should be used for attempting to prove the property. If the property can be verified using domain $\mathcal{A}$, the algorithm terminates with a proof of robustness.

In cases where the property is neither verified nor refuted in the current iteration, the algorithm makes progress by splitting the input region $I$ into two disjoint partitions $I_{1},I_{2}$ such that $I=I_{1}\uplus I_{2}$. The intuition is that, even if we cannot prove robustness for the whole input region $I$, we may be able to increase analysis precision by performing a case split. That is, as long as all points in both $I_{1}$ and $I_{2}$ are classified as having label $K$, this means that all points in $I$ are also assigned label $K$ since we have $I=I_{1}\cup I_{2}$. In cases where the property is false, splitting the input region into two partition can similarly help adversarial counterexample search because gradient-based optimization methods do not always converge to a global optimum.

Based on the above discussion, the key question is how to partition the input region $I$ into two regions $I_{1},I_{2}$ so that each of $I_{1},I_{2}$ has a good chance of being verified or falsified. Since this question again does not have an obvious answer, we utilize our partition policy $\pi^{I}_{\theta}$ to make this decision. Similar to the domain policy, $\pi^{I}_{\theta}$ takes as input the network, the property, and the solution $x_{*}$ to the optimization problem and “cuts” $I$ into two sub-regions $I_{1}$ and $I_{2}$ using a hyper-plane. Then, the property is verified if and only if the recursive call to Verify is succsessful on both regions.

Example 3.1.

Consider the XOR network from Figure 3 and the robustness property $([0.3,0.7]^{2},1)$. That is, for all inputs $\overline{x}$ with $0.3\leq x_{1},x_{2}\leq 0.7$, $\overline{x}$ should be assigned to class 1 (assume classes are zero-indexed). We now illustrate how Algorithm 1 verifies this property using the plain interval and zonotope abstract domains. The process is illustrated in Figure 5, which shows the splits made in each iteration as well as the domain used to analyze each region ($\mathbb{Z}$ denotes zonotopes, and $\mathbb{I}$ stands for intervals).

Algorithm 1 starts by searching for an adversarial counterexample, but fails to find one since the property actually holds. Now, suppose that our domain policy $\pi^{\alpha}_{\theta}$ chooses zonotopes to try to verify the property. Since the property cannot be verified using zonotopes, the call to Analyze will fail. Thus, we now consult the partition policy $\pi^{I}_{\theta}$ to split this region into two pieces $I_{1}=[0.3,0.5]\times[0.3,0.7]$ and $I_{2}=[0.5,0.7]\times[0.3,0.7]$.

Next, we recursively invoke Algorithm 1 on both sub-regions $I_{1}$ and $I_{2}$. Again, there is no counterexample for either region, so we use the domain policy to choose an abstract domain for each of $I_{1}$ and $I_{2}$. Suppose that $\pi^{\alpha}_{\theta}$ yields the zonotope domain for both $I_{1}$ and $I_{2}$. Using this domain, we can verify robustness in $I_{1}$ but not in $I_{2}$. Thus, for the second sub-problem, we again consult $\pi^{I}_{\theta}$ to obtain two sub-regions $I_{2,1}=[0.5,0.7]\times[0.3,0.42]$ and $I_{2,2}=[0.5,0.7]\times[0.42,0.7]$ and determine using $\pi^{\alpha}_{\theta}$ that $I_{2,1},I_{2,2}$ should be analyzed using intervals and zonotopes respectively. Since robustness can be verified using these domains, the algorithm successfully terminates. Notice that the three verified subregions cover the entire initial region.

4. Learning a Verification Policy

As described in Section 3, our decision procedure for checking robustness uses a verification policy $\pi_{\theta}=(\pi^{\alpha}_{\theta},\pi^{I}_{\theta})$ to choose a suitable abstract domain and an input partitioning strategy. In this section, we discuss our policy representation and how to learn values of $\theta$ that lead to good performance.

4.1. Policy Representation

In this work, we implement verification policies $\pi^{\alpha}_{\theta}$ and $\pi^{I}_{\theta}$ using a function of the following shape:

[TABLE]

where $\rho$ is a featurization function that extracts a feature vector from the input, $\varphi$ is a selection function that converts a real-valued vector to a suitable output (i.e., an abstract domain for $\pi^{\alpha}_{\theta}$ and the two subregions for $\pi^{I}_{\theta}$), and $\theta$ corresponds to a parameter matrix that is automatically learned from a representative set of training data. We discuss our featurization and selection functions in this sub-section and explain how to learn parameters $\theta$ in the next sub-section.

Featurization.

As standard in machine learning, we need to convert the input $\iota=(\mathcal{N},I,K,x_{*})$ to a feature vector. Our choice of features is influenced by our insights about the verification problem, and we deliberately use a small number of features for two reasons: First, a large number of dimensions can lead to overfitting and poor generalization (which is especially an issue when training data is fairly small). Second, a high-dimensional feature vector leads to a more difficult learning problem, and contemporary Bayesian optimization engines only scale to a few tens of dimensions.

Concretely, our featurization function considers several kinds of information, including: (a) the behavior of the network near $x_{*}$, (b) where $x_{*}$ falls in the input space, and (c) the size of the input space. Intuitively, we expect that (a) is useful because as $x_{*}$ comes closer to violating the specification, we should need a more precise abstraction, while (b) and (c) inform how we should split the input region during refinement. Since the precision of the analysis is correlated with how the split is performed, we found the same featurization function to work well for both policies $\pi^{\alpha}_{\theta}$ and $\pi^{I}_{\theta}$. In Section 6, we discuss the exact features used in our implementation.

Selection function.

Recall that the purpose of the selection function $\varphi$ is to convert $\theta\rho(\iota)$ to a ”strategy”, which is an abstract domain for $\pi^{\alpha}$ and a hyper-plane for $\pi^{I}$. Since the strategies for these two functions are quite different, we use two different selection functions, denoted $\varphi_{\alpha},\varphi_{I}$ for the domain and partition policies respectively.

The selection function $\varphi_{\alpha}$ is quite simple and maps $\theta\rho(\iota)$ to a tuple $(d,k)$ where $d$ denotes the base abstract domain (either intervals $\mathbb{I}$ or zonotopes $\mathbb{Z}$ in our implementation) and $k$ denotes the number of disjuncts. Thus, $(\mathbb{Z},2)$ denotes the powerset of zonotopes abstract domain, where the maximum number of disjuncts is restricted to $2$, and $(\mathbb{I},1)$ corresponds to the standard interval domain.

In the case of the partition policy $\pi^{I}$, the selection function $\varphi_{I}$ is also a tuple $(d,c)$ where $d$ is the dimension along which we split the input region and $c$ is the point at which to split. In other words, if $\varphi_{I}(\theta\rho(\iota))=(d,c)$, this means that we split the input region $I$ using the hyperplane $x_{d}=c$. Our selection function $\varphi_{I}$ does not consider arbitrary hyperplanes of the form $c_{1}x_{1}+\ldots c_{n}x_{n}=c$ because splitting the input region along an arbitrary hyperplane may result in sub-regions that are not expressible in the chosen abstract domain. In particular, this is true for both the interval and zonotope domains used in our implementation.

4.2. Learning using Bayesian Optimization

As made evident by Eq. 3, the parameter matrix $\theta$ has a huge impact on the choices made by our verification algorithm. However, manually coming up with these parameters is very difficult because the right choice of coefficients depends on both the property, the network, and the underlying abstract interpretation engine. In this work, we take a data-driven approach to solve this problem and use Bayesian optimization to learn a parameter matrix $\theta$ that leads to optimal performance by the verifier on a set of training problems.

Background on Bayesian optimization.

Given a function $F:{}^{n}\to\real$, the goal of Bayesian optimization is to find a vector $\overline{x^{*}}\in{}^{n}$ that maximizes $F$. Importantly, Bayesian optimization does not assume that $F$ is differentiable; also, in practice, it can achieve reasonable performance without having to evaluate $F$ very many times. In our setting, the function $F$ represents the performance of a verification policy. This function is not necessarily differentiable in the parameters of the verification policy, as a small perturbation to the policy parameters can lead to the choice of a different domain. Also, evaluating the function requires an expensive round of abstract interpretation. For these reasons, Bayesian optimization is a good fit to our learning problem.

At a high level, Bayesian optimization repeatedly samples inputs until a time limit is reached and returns the best input found so far. However, rather than sampling inputs at random, the key part of Bayesian optimization is to predict what input is useful to sample next. Towards this goal, the algorithm uses (1) a surrogate model $\mathcal{M}$ that expresses our current belief about $F$, and (b) an acquisition function $\mathcal{A}$ that employs $\mathcal{M}$ to decide the most promising input to sample in the next iteration. The surrogate model $\mathcal{M}$ is initialized to capture prior beliefs about $F$ and is updated based on observations on the sampled points. The acquisition function $\mathcal{A}$ is chosen to trade off exploration and exploitation where ”exploration” involves sampling points with high uncertainty, and ”exploitation” involves sampling points where $\mathcal{M}$ predicts a high value of $F$. Given model $\mathcal{M}$ and function $\mathcal{A}$, Bayesian optimization samples the most promising input $\overline{x}$ according to $\mathcal{A}$, evaluates $F$ at $\overline{x}$, and updates the statistical model $\mathcal{M}$ based on the observation $F(\overline{x})$. This process is repeated until a time limit is reached, and the best input sampled so far is returned as the optimum. We refer the reader to  (Mockus, 2010) for a more detailed overview of Bayesian optimization.

Using Bayesian optimization.

In order to apply Bayesian optimization to our setting, we first need to define what function we want to optimize. Intuitively, our objective function should estimate the quality of the analysis results based on decisions made by verification policy $\pi_{\theta}$. Towards this goal, we fix a set $S$ of representative training problems that can be used to estimate the quality of $\pi_{\theta}$. Then, given a parameters matrix $\theta$, our objective function $F$ calculates a score based on (a) how many benchmarks in $S$ can be successfully solved within a given time limit, and (b) how long it takes to solve the benchmarks in $S$. More specifically, our objective function $F$ is parameterized by a time limit $t\in\real$ and penalty $p\in\real$ and calculates the score for a matrix $\theta$ as follows:

[TABLE]

where:

[TABLE]

Intuitively, $p$ controls how much we want to penalize failed verification attempts – i.e., the higher the value of $p$, the more biased the learning algorithm is towards more precise (but potentially slow) strategies. On the other hand, small values of $p$ bias learning towards strategies that yield fast results on the solved benchmarks, even if some of the benchmarks cannot be solved within the given time limit. 444In our implementation, we choose $p=2$, $t=700s$.

In order to apply Bayesian optimization to our problem, we also need to choose a suitable acquisition function and surrogate mode. Following standard practice, we adopt a Gaussian process (Rasmussen and Williams, 2006) as our surrogate model and use expected improvement (Brochu et al., 2010) for the acquisition function.

5. Termination and Delta Completeness

In this section, we discuss some theoretical properties of our verification algorithm, including soundness, termination, and completeness. To start with, it is easy to see that Algorithm 1 is sound, as it only returns ”Verified” once it establishes that every point in the input space is classified as $K$. This is the case because every time we split the input region $I$ into two sub-regions $I_{1},I_{2}$, we ensure that $I=I_{1}\cup I_{2}$, and the underlying abstract interpreter is assumed to be sound. However, it is less clear whether Algorithm 1 always terminates or whether it has any completeness guarantees.

Our first observation is that the Verify procedure, exactly as presented in Algorithm 1, does not have termination guarantees under realistic assumptions about the optimization procedure used for finding adversarial counterexamples. Specifically, if the procedure Minimize invoked at line 2 of Algorithm 1 returned a global minimum, then we could indeed guarantee termination. 555However, if we make this assumption, the optimization procedure itself would be a sound and complete decision procedure for verifying robustness! However, since gradient-based optimization procedures do not have this property, Algorithm 1 may not be able to find a true adversarial counterexample even as we make the input region infinitesimally small. Fortunately, we can guarantee termination and a form of completeness (known as $\delta$-completeness) by making a very small change to Algorithm 1.

To guarantee termination of our verification algorithm, we will make the following slight change to line 3 of Algorithm 1: Rather than checking $\mathcal{F}(x_{*})\leq 0$ (for $\mathcal{F}$ as defined in Eq. 2) we will instead check:

[TABLE]

While this modification can cause our verification algorithm to produce false positives under certain pathological conditions, the analysis can be made as precise as necessary by picking a value of $\delta$ that is arbitrarily close to [math]. Furthermore, under this change, we can now prove termination under some mild and realistic assumptions. In order to formally state these assumptions, we first introduce the following notion of the diameter of a region:

Definition 5.1.

For any set $X\subseteq{}^{n}$, its diameter $D(X)$ is defined as $\sup\{\|x_{1}-x_{2}\|_{2}\mid x_{1},x_{2}\in X\}$ if this value exists. Otherwise the set is said to have infinite diameter.

We now use this notion of diameter to state two key assumptions that are needed to prove termination:

Assumption 1.

There exists some $\lambda\in(0,1)$ such that for any network $\mathcal{N}$, input region $I$, and point $x_{*}\in I$, if $\pi^{I}(N,I,x_{*})=(I_{1},I_{2})$, then $D(I_{1})<\lambda D(I)$ and $D(I_{2})<\lambda D(I)$.

Intuitively, this assumption states that the two resulting subregions after splitting are smaller than the original region by some factor $\lambda$. It is easy to enforce this condition on any partition policy by choosing a hyper-plane $x_{d}=c$ where $c$ is not at the boundary of the input region.

Our second assumption concerns the abstract domain:

Assumption 2.

Let $\mathcal{N}^{\#}$ be the abstract transformer representing a network $\mathcal{N}$. For a given input region $I$, we assume there exists some $K_{\mathcal{N}}\in\real$ such that $D(\gamma(\mathcal{N}^{\#}(\alpha(I))))<K_{\mathcal{N}}D(I)$.

This assumption asserts that the Lipschitz continuity of the network extends to its abstract behavior. Note that this assumption holds in several numerical domains including intervals, zonotopes, and powersets thereof.

Theorem 5.2.

*Consider the variant of Algorithm 1 where the predicate at line 3 is replaced with Eq. 4. Then, if the input region has finite diameter, the verification algorithm always terminates under Assumptions 1 and 2.

666Proofs for all theorems can be found in the appendix.*

In addition to termination, our small modification to Algorithm 1 also ensures a property called $\delta$-completeness (Gao et al., 2012). In the context of satisfiability over real numbers, $\delta$-completeness means that, when the algorithm returns a satisfying assignment $\sigma$, the formula is either indeed satisfiable or a $\delta$-perturbation on its numeric terms would make it satisfiable. To adapt this notion of $\delta$-completeness to our context, we introduce the folowing concept $\delta$-counterexamples:

Definition 5.3.

For a given network $\mathcal{N}$, input region $I$, target class $K$, and $\delta>0$, a $\delta$-counterexample is a point $x\in I$ such that for some $j$ with $1\leq j\leq m$ and $j\neq K$, $\mathcal{N}(x)_{K}-\mathcal{N}(x)_{j}\leq\delta$.

Intuitively, a $\delta$-counterexample is a point in the input space for which the output almost violates the given specification. We can view $\delta$ as a parameter which controls how close to violating the specification a point must be to be considered “almost” a counterexample.

Theorem 5.4.

Consider the variant of Algorithm 1 where the predicate at line 3 is replaced with Eq. 4. Then, the verification algorithm is $\delta$-complete — i.e., if the property is not verified, it returns a $\delta$-counterexample.

6. Implementation

We have implemented the ideas proposed in this paper in a tool called Charon, written in C++. Internally, Charon uses the ELINA abstract interpretation library (eli, [n. d.]) to implement the Analyze procedure from Algorithm 1, and it uses the BayesOpt library  (Martinez-Cantin, 2014) to perform Bayesian optimization.

Parallelization.

Our proposed verification algorithm is easily parallelizable, as different calls to the abstract interpreter can be run on different threads. Our implementation takes advantage of this observation and utilizes as many threads as the host machine can provide by running different calls to ELINA in parallel.

Training.

We trained our verification policy on 12 different robustness properties of a neural network used in the ACAS Xu collision avoidance system (Julian et al., 2016). However, since even verifying even a single benchmark can take a very long time, our implementation uses two tactics to reduce training time. First, we parallelize the training phase of the algorithm using the MPI framework (Forum, 1994) and solve each benchmark at the same time. Second, we set a time limit of 700 seconds (per-process cputime) per benchmark. Contrary to what we may expect from machine learning systems, a small set of benchmarks is sufficient to learn a good strategy for our setting. We conjecture that this is because the relatively small number of features allowed by Bayesian optimization helps to regularize the learned policy.

Featurization.

Recall that our verification policy uses a featurization function to convert its input to a feature vector. As mentioned in Section 4.1, this featurization function should select a compact set of features so that our training is efficient and avoids overfitting our policy to the training set. These features should also capture revalant information about the network and the property so that our learned policy can generalize across networks. With this in mind, we used the following features in our implementation:

• •

the distance between the center of the input region $I$ and the solution $x_{*}$ to the optimization problem

• •

the value of the objective function $\mathcal{F}$ (Eq. 2) at $x_{*}$

• •

the magnitude of the gradient of the network at $x_{*}$

• •

average length of the input space along each dimension

Selection.

Recall from Section 4 that our verification policy $\pi$ uses two different selection functions $\varphi^{\alpha}$ and $\varphi^{I}$ for choosing an abstract domain and splitting plane respectively.

The selection function $\varphi^{I}$ takes a vector of three inputs. The first two are real-valued numbers that decide which dimension to split on. Rather than considering all possible dimensions, our implementation chooses between two dimensions to make training more manageable. The first one is the longest dimension (i.e., input dimension with the largest length), and the second one is the dimension that has the largest influence (Wang et al., 2018) on $\mathcal{N}(x)_{K}$. The last input to the selection function is the offset at which to split the region. This value is clipped to $[0,1]$ and then interpreted as a ratio of the distance from the center of the input region $I$ to the solution $x_{*}$ of Eq. 1. For example, if the value is 0, the region will be bisected, and if the value is 1, then the splitting plane will intersect $x_{*}$. Finally, if the splitting plane is at the boundary of $I$, it is offset slightly so that the strategy satisfies Assumption 1.

The selection function $\varphi^{\alpha}$ for choosing an abstract domain takes a vector of two inputs. The first controls the base abstract domain (intervals or zonotopes) and the second controls the number of disjuncts to use. In both cases, the output is extracted by first clipping the input to a fixed range and then discretizing the resulting value.

7. Evaluation

To evaluate the ideas proposed in this paper, we conduct an experimental evaluation that is designed to answer the following three research questions:

1. (RQ1)

How does Charon compare against state-of-the-art tools for proving neural network robustness? 2. (RQ2)

How does counterexample search impact the performance of Charon? 3. (RQ3)

What is the impact of learning a verification policy on the performance of Charon?

Benchmarks.

To answer these research questions, we collected a benchmark suite of 602 verification problems across 7 deep neural networks, including one convolutional network and several fully connected networks. The fully connected networks have sizes 3$\times$100, 6$\times$100, 9$\times$100, and 9$\times$200, where $N\times M$ means there are $N$ fully connected layers and each interior layer has size $M$. The convolutional network has a LeNet architecture (Lecun et al., 1998) consisting of two convolutional layers, followed by a max pooling layer, two more convolutional layers, another max pooling layer, and finally three fully connected layers. All of these networks were trained on the MNIST (Lecun et al., 1998) and CIFAR (Krizhevsky, 2009) datasets.

7.1. Comparison with ${\rm AI}^{2}$ (RQ1)

For each network, we attempt to verify around 100 robustness properties. Following prior work (Gehr et al., 2018), the evaluated robustness properties are so-called brightening attacks (Pei et al., 2017a). For an input point $x$ and a threshold $\tau$, a brightening attack consists of the input region

[TABLE]

That is, for each pixel in the input image, if the value of that pixel is greater than $\tau$, then the corresponding pixel in the perturbed image may be anywhere between the initial value and one, and all other pixels remain unchanged.

Set-up.

All experiments described in this section were performed on the Google Compute Engine (GCE) (GCP, [n. d.]) using an 8 vcpu instance with 10.5 GB of memory. All time measurements report the total CPU time (rather than wall clock time) in order to avoid biasing the results because of Charon’s parallel nature. For the purposes of this experiment, we set a time limit of 1000 seconds per benchmark.

In this section we compare Charon with ${\rm AI}^{2}$ 777Because we did not have access to the original ${\rm AI}^{2}$, we reimplemented it. However, to allow for a fair comparison, we use the same underlying abstract interpretation library, and we implement the transformers exactly as described in (Gehr et al., 2018)., a state-of-the-art tool for verifying network robustness (Gehr et al., 2018). As discussed in Section 2, ${\rm AI}^{2}$ is incomplete and requires the user to specify which abstract domain to use. Following their evaluation strategy from the IEEE S&P paper (Gehr et al., 2018), we instantiate ${\rm AI}^{2}$ with two different domains, namely zonotopes and bounded powersets of zonotopes of size 64. We refer to these two variants as ${\rm AI}^{2}$-Zonotope and ${\rm AI}^{2}$-Bounded64.

The results of this comparison are summarized in Figure 6. This graph shows the percentage of benchmarks each tool was able to verify or falsify, as well as the percentage of benchmarks where the tool timed out and the percentage where the tool was unable to conclude either true or false. Note that, because Charon is $\delta$-complete, there are no “unknown” results for it, and because ${\rm AI}^{2}$ cannot find counterexamples, ${\rm AI}^{2}$ has no “falsified” results.

The details for each network are shown in Figures 7 - 13. Each chart shows the cumulative time taken on the y-axis and the number of benchmarks solved on the x-axis (so lower is better). The results for each tool include only those benchmarks that the tool could solve correctly within the time limit of 1000 seconds. Thus, a line extending further to the right indicates that the tool could solve more benchmarks. Since ${\rm AI}^{2}$-Bounded64 times out on every benchmark for the convolutional network, it does not appear in Figure 13.

The key take-away lesson from this experiment is that Charon is able to both solve more benchmarks compared to ${\rm AI}^{2}$-Bounded64 on most networks, and it is able to solve them much faster. In particular, Charon solves $59.7\%$ (resp. $84.7\%$) more benchmarks compared to ${\rm AI}^{2}$-Bounded64 (resp. ${\rm AI}^{2}$-Zonotope). Furthermore, among the benchmarks that can be solved by both tools, Charon is 6.15$\times$ (resp. 1.12$\times$ ) faster compared to ${\rm AI}^{2}$-Bounded64 (resp. ${\rm AI}^{2}$-Zonotope). Thus, we believe these results demonstrate the advantages of our approach compared to ${\rm AI}^{2}$.

7.2. Comparison with Complete Tools (RQ1)

In this section we compare Charon with other complete tools for robustness analysis, namely ReluVal (Wang et al., 2018) and Reluplex (Katz et al., 2017a). Among these tools, Reluplex implements a variant of Simplex with built-in support for the ReLU activation function (Katz et al., 2017a), and ReluVal is an abstraction refinement approach without learning or counterexample search.

To perform this experiment, we evaluate all three tools on the same benchmarks from Section 7.1. However, since ReluVal and Reluplex do not support convolutional layers, we exclude the convolutional net from this evaluation.

The results of this comparison are summarized in Figure 14. Across all benchmarks, Charon is able to solve 2.6$\times$ (resp. 16.6$\times$) more problems compared to ReluVal (resp. Reluplex). Furthermore, it is worth noting that the set of benchmarks that can be solved by Charon is a strict superset of the benchmarks solved by ReluVal.

7.3. Impact of Counterexample Search (RQ2)

To understand the benefit of using optimization to search for counterexamples, we now compare the number of properties that can be falsified using Charon vs. Reluplex and ReluVal. (Recall that ${\rm AI}^{2}$ is incomplete and cannot be used for falsification.) Among the 585 benchmarks used in the evaluation from Section 7.2, Charon can falsify robustness of 123 benchmarks. In contrast, Reluplex can only falsify robustness of one benchmark, and ReluVal cannot falsify any of them. Thus, we believe these results demonstrate the usefulness of incorporating optimization-based counterexample search into the decision procedure.

7.4. Impact of Learning a Verification Policy (RQ3)

Recall that a key feature of our algorithm is the use of a machine-learnt verification policy $\pi$ to choose a refinement strategy. To explore the impact of this design choice, we compare our technique against ReluVal on the subset of the 585 benchmarks for which the robustness property holds. In particular, as mentioned earlier, ReluVal is also based on a form of abstraction refinement but uses a static, hand-crafted strategy rather than one that is learned from data. Thus, comparing against ReluVal on the verifiably-robust benchmarks allows us to evaluate the benefits of learning a verification policy from data. 888We compare with ReluVal directly rather than reimplementing the ReluVal strategy inside Charon because our abstract interpretation engine does not support the domain used by ReluVal. Given this, we believe the comparison to ReluVal is the most fair available option.

The results of this comparison are shown in Figure 15. As we can see from this figure, ReluVal is still only able to solve between 35-70% of the benchmarks that can be successfully solved by Charon. Thus, these results demonstrate that our data-driven approach to learning verification policies is useful for verifying network robustness.

8. Related Work

In this section, we survey existing work on robustness analysis of neural networks and other ideas related to this paper.

Adversarial Examples and Robustness.

Szegedy et al. (Szegedy et al., 2013b) first showed that neural networks are vulnerable to small perturbations on inputs. It has since been shown that such examples can be exploited to attack machine learning systems in safety-critical applications such as autonomous robotics (Melis et al., 2017) and malware classication (Grosse et al., 2017).

Bastani et al. (Bastani et al., 2016) formalized the notion of local robustness in neural networks and defined metrics to evaluate the robustness of a neural network. Subsequent work has introduced other notions of robustness (Katz et al., 2017a; Gopinath et al., 2017).

Many recent papers have studied the construction of adversarial counterexamples (Kurakin et al., 2016; Lyu et al., 2015; Nguyen et al., 2015; Tabacof and Valle, 2016; Sabour et al., 2015; Grosse et al., 2016; Madry et al., 2018; Goodfellow et al., 2015). These approaches are based on various forms of gradient-based optimization, for example L-BFGS (Szegedy et al., 2013a), FGSM (Goodfellow et al., 2015) and PGD (Madry et al., 2018). While our implementation uses the PGD method, we could in principle also use (and benefit from advances in) alternative gradient-based optimization methods.

Verification of Neural Networks.

Scheibler et al. (Scheibler et al., 2015) used bounded model checking to verify safety of neural networks. Katz et al.(Katz et al., 2017b) developed the Reluplex decision procedure extending the Simplex algorithm to verify robustness and safety properties of feedforward networks with ReLU units. Huang et al.(Huang et al., 2016) showed a verification framework, based on an SMT solver, which verified robustness with respect to a certain set of functions that can manipulate the input. A few recent papers (Tjeng and Tedrake, 2017; Dutta et al., 2017; Lomuscio and Maganti, 2017) use Mixed Integer Linear Programming (MILP) solvers to verify local robustness properties of neural networks. These methods do not use abstraction and do not scale very well, but combining these techniques with abstraction is an interesting area of future work.

The earliest effort on neural network verification to use abstraction was by Pulina and Tacchella (Pulina and Tacchella, 2010) — in fact, like our method, they considered an abstraction-refinement approach to solve this problem. However, their approach represents abstractions using general linear arithmetic formulas and uses a decision procedure to perform verification and counterexample search. Their approach was shown to be successful for a network with only $6$ neurons, so it does not have good scalability properties. More recently, Gehr et al. (Gehr et al., 2018) presented the AI2 system for abstract interpretation of neural networks. Unlike our work, AI2 is incomplete and cannot produce concrete counterexamples. The most closely related approach from prior work is ReluVal (Wang et al., 2018), which performs abstract interpretation using symbolic intervals. The two key differences between ReluVal and our work are that Charon couples abstract interpretation with optimization-based counterexample search and learns verification policies from data. As demonstrated in Section 7, both of these ideas have a significant impact on our empirical results.

Learning to Verify.

The use of data-driven learning in neural network verification is, so far as we know, new. However, there are many papers (Sharma et al., 2013; Liang et al., 2011; Garg et al., 2014; Heo et al., 2016; Si et al., 2018) on the use of such learning in traditional software verification. While most of these efforts learn proofs from execution data for specific programs, there are a few efforts that seek to learn optimal instantiations of parameterized abstract domains from a corpus of training problems (Liang et al., 2011; Oh et al., 2015). The most relevant work in this space is by Oh et al. (Oh et al., 2015), who use Bayesian optimization to adapt a parameterized abstract domain. The abstract domain in that work is finite, and the Bayesian optimizer is only used to adjust the context-sensitivity and flow-sensitivity of the analysis. In contrast, our analysis of neural networks handles real-valued data and a possibly infinite space of strategies.

9. Conclusion and Future Work

We have presented a novel technique for verifying robustness properties of neural networks based on synergistically combining proof search with counterexample search. This technique makes use of black-box optimization techniques in order to learn good refinement strategies in a data-driven way. We implemented our technique and showed that it significantly outperforms state-of-the-art techniques for robustness verification. Specifically, our technique is able to solve 2.6$\times$ as many benchmarks as ReluVal and 16.6$\times$ as many as Reluplex. Our technique is able to solve more benchmarks in general than ${\rm AI}^{2}$, and is able to solve them far faster. Moreover, we provide theoretical guarantees about the termination and ($\delta$-)completeness of our approach.

In order to improve our tool in the future, we plan to explore a broader set of abstract domains and different black-box optimization techniques. Notably, one can view solver-based techniques as a perfectly precise abstract domain. While solver-based techniques have so far proven to be slow on many benchmarks, our method could learn when it is best to apply solvers and when to choose a less precise domain. This would allow the tool to combine solvers and traditional numerical domains in the most efficient way. Additionally, while Bayesian optimization fits our current framework well, it may be possible to modify the framework to work with different learning techniques which can explore higher-dimensional strategy spaces. In particular, reinforcement learning may be an interesting approach to explore in future work.

Acknowledgements.

We thank our shepherd Michael Pradel as well as our anonymous reviewers and members of the UToPiA group for their helpful feedback. This material is based upon work supported by the Sponsor National Science Foundation https://www.nsf.gov/ under Grants No. Grant #CCF-1162076, No. Grant #CCF-1704883, No. Grant #CNS-1646522, and No. Grant #CCF-1453386. This work is also supported by Google Cloud.

Appendix A Proofs

In this section we present the proofs of the theorems in Section 5. For convenience, the assumptions and theorem statements have been copied.

Definition 5.3 0.

For a given network $\mathcal{N}$, input region $I$, target class $M$, and $\delta>0$, a $\delta$-counterexample is a point $x\in I$ such that for some $j$ with $1\leq j\leq m$ and $j\neq M$, $\mathcal{N}(x)_{M}-\mathcal{N}(x)_{j}\leq\delta$.

Definition 5.1 0.

For any set $X\subseteq{}^{n}$, its diameter $D(X)$ is defined as

[TABLE]

if this value exists. Otherwise the set is said to have infinite diameter.

Assumption 1 0.

There exists some $\lambda\in\real$ with $0<\lambda<1$ such that for any network $\mathcal{N}$, input region $I$, and point $x_{*}\in I$, if $(I_{1},I_{2})=\textsc{Refine}(N,I,x_{*})$, then $D(I_{1})<\lambda D(I)$ and $D(I_{2})<\lambda D(I)$.

Assumption 2 0.

Let $\mathcal{N}^{\#}$ be the abstract transformer representing a network $\mathcal{N}$. Let $a$ be an element of the abstract domain representing the input region $I$. We assume there exists some $K_{\mathcal{N}}\in\real$ such that $D(\gamma(\mathcal{N}^{\#}(\alpha(I))))<K_{\mathcal{N}}D(I)$.

Theorem 5.2 0.

Consider the variant of Algorithm 1 where the predicate at line 3 is replaced with Eq. 4. Then, the verification algorithm always terminates under Assumptions 1 and 2.

Proof.

To improve readibility, we define $F(I_{k})=\gamma(\mathcal{N}^{\#}(\alpha(I_{k})))$.

By Assumption 1 there exists some $\lambda\in\real$ with $0<\lambda<1$ such that for any input region $I^{\prime}$, splitting $I^{\prime}$ with Refine yields regions $I_{1}^{\prime}$ and $I_{2}^{\prime}$ with $D(I_{1}^{\prime})<\lambda D(I^{\prime})$ and $D(I_{2}^{\prime})<\lambda D(I^{\prime})$. Because there is one split for each node in the recursion tree, at a recursion depth of $k$, the region $I_{k}$ under consideration has diameter $D(I_{k})<\lambda^{k}D(I)$. By Assumption 2, there exists some $K_{\mathcal{N}}$ such that $D(F(I_{k}))<K_{\mathcal{N}}D(I_{k})$. Notice that when

[TABLE]

we must have $D(F(I_{k}))<\delta/2$.

We will now show that when $k$ satisfies the preceding condition, Algorithm 1 must terminate without recurring. In this case, suppose $x_{*}$ is the point returned by the call to Minimize and the algorithm does not terminate. Then $\mathcal{F}(x_{*})>\delta$ and in particular, $\mathcal{N}(x_{*})_{K}-\mathcal{N}(x_{*})_{i}>\delta$. Since Analyze is sound, we must have $\mathcal{N}(x_{*})\in F(I_{k})$. Then since $D(F(I_{k}))<\delta/2$, we must have that for any point $y^{\prime}\in F(I_{k})$, $\|\mathcal{N}(x_{*})-y^{\prime}\|_{2}<\delta/2$. In particular, for all $i$, $|(\mathcal{N}(x_{*}))_{i}-y^{\prime}_{i}|<\delta/2$, so $y^{\prime}_{i}>(\mathcal{N}(x_{*}))_{i}-\delta/2$ and $y^{\prime}_{i}<(\mathcal{N}(x_{*}))_{i}+\delta/2$. Then, for all $i$,

[TABLE]

Thus, for each point $y^{\prime}\in F(I_{k})$, we have $y^{\prime}_{K}>y^{\prime}_{i}$. Since $y^{\prime}$ ranges over the overapproximated output produced by the abstract interpreter, this exactly satisfies the condition which Analyze is checking, so Analyze must return Verified. Therefore, the maximum recursion depth of Algorithm 1 is bounded, so it must terminate. ∎

Theorem 5.4 0.

Consider the variant of Algorithm 1 where the predicate at line 3 is replaced with Eq. 4. Then, the verification algorithm is $\delta$-complete, meaning that if the algorithm does not return “Verified” then the return value is a $\delta$-counterexample for the property.

Proof.

First note that by Theorem 5.2, Algorithm 1 must terminate. Therefore the algorithm must return some value, and we can prove this theorem by analyzing the possible return values. There are five places at which Algorithm 1 can terminate: lines 4, 8, 12, 15, and 16. We only care about the case where the algorithm does not return “Verified” so we can ignore lines 8 and 16. The return at line 4 is only reached after checking that $x_{*}$ is a $\delta$-counterexample, so clearly if that return statement is used then the algorithm returns a $\delta$-counterexample. This leaves the return statements at lines 12 and 15. We suppose by induction that the recursive calls at lines 10 and 13 are $\delta$-complete. Then if $r_{1}$ is not Verified, it must be a $\delta$-counterexample. Thus the return statement at line 12 also returns a $\delta$-counterexample. Similarly, if $r_{2}$ is not Verified, then it is a $\delta$-counterexample, so line 15 returns a $\delta$-counterexample. ∎