Taming Reachability Analysis of DNN-Controlled Systems via Abstraction-Based Training

TL;DR

This paper introduces an abstraction-based method for verifying DNN-controlled systems by inserting an abstraction layer during training, enabling efficient and tight black-box reachability analysis regardless of DNN type or size.

Contribution

It proposes a novel abstraction layer during training that allows black-box reachability analysis, overcoming limitations of existing over-approximation methods.

Findings

Significant improvements in analysis efficiency and tightness.

Comparable DNN performance with enhanced verification properties.

Broad applicability to various DNN architectures.

Abstract

The intrinsic complexity of deep neural networks (DNNs) makes it challenging to verify not only the networks themselves but also the hosting DNN-controlled systems. Reachability analysis of these systems faces the same challenge. Existing approaches rely on over-approximating DNNs using simpler polynomial models. However, they suffer from low efficiency and large overestimation, and are restricted to specific types of DNNs. This paper presents a novel abstraction-based approach to bypass the crux of over-approximating DNNs in reachability analysis. Specifically, we extend conventional DNNs by inserting an additional abstraction layer, which abstracts a real number to an interval for training. The inserted abstraction layer ensures that the values represented by an interval are indistinguishable to the network for both training and decision-making. Leveraging this, we devise the first black-box reachability analysis approach for DNN-controlled systems, where trained DNNs are only queried as black-box oracles for the actions on abstract states. Our approach is sound, tight, efficient, and agnostic to any DNN type and size. The experimental results on a wide range of benchmarks show that the DNNs trained by using our approach exhibit comparable performance, while the reachability analysis of the corresponding systems becomes more amenable with significant tightness and efficiency improvement over the state-of-the-art white-box approaches.