Incremental Satisfiability Modulo Theory for Verification of Deep Neural Networks

TL;DR

This paper introduces DeepInc, an incremental SMT-based verification algorithm for deep neural networks that efficiently checks safety properties after network modifications, significantly improving verification speed and enabling effective DNN repair.

Contribution

The paper presents a novel incremental SMT algorithm for DNN verification, extending the Reluplex framework, and proposes a multi-objective DNN repair method that maintains safety properties more effectively.

Findings

DeepInc outperforms existing methods in verification speed.

The incremental approach accelerates counterexample search by several orders of magnitude.

The repair algorithm preserves more safety properties than state-of-the-art methods.

Abstract

Constraint solving is an elementary way for verification of deep neural networks (DNN). In the domain of AI safety, a DNN might be modified in its structure and parameters for its repair or attack. For such situations, we propose the incremental DNN verification problem, which asks whether a safety property still holds after the DNN is modified. To solve the problem, we present an incremental satisfiability modulo theory (SMT) algorithm based on the Reluplex framework. We simulate the most important features of the configurations that infers the verification result of the searching branches in the old solving procedure (with respect to the original network), and heuristically check whether the proofs are still valid for the modified DNN. We implement our algorithm as an incremental solver called DeepInc, and exerimental results show that DeepInc is more efficient in most cases. For the cases that the property holds both before and after modification, the acceleration can be faster by several orders of magnitude, showing that DeepInc is outstanding in incrementally searching for counterexamples. Moreover, based on the framework, we propose the multi-objective DNN repair problem and give an algorithm based on our incremental SMT solving algorithm. Our repair method preserves more potential safety properties on the repaired DNNs compared with state-of-the-art.