[Paper Review] A Dual Approach to Scalable Verification of Deep Networks

Krishnamurthy, Dvijotham+4 more|arXiv (Cornell University)|Mar 17, 2018

Adversarial Robustness in Machine Learning15 references172 citations

TL;DR

This paper presents a general optimization-based verification framework for neural networks that yields upper bounds on worst-case specification violations via a tight, anytime dual formulation applicable to arbitrary architectures and activations. It demonstrates state-of-the-art verified bounds on adversarial robustness for MNIST and CIFAR-10 and shows scalability beyond prior methods.

ABSTRACT

This paper addresses the problem of formally verifying desirable properties of neural networks, i.e., obtaining provable guarantees that neural networks satisfy specifications relating their inputs and outputs (robustness to bounded norm adversarial perturbations, for example). Most previous work on this topic was limited in its applicability by the size of the network, network architecture and the complexity of properties to be verified. In contrast, our framework applies to a general class of activation functions and specifications on neural network inputs and outputs. We formulate verification as an optimization problem (seeking to find the largest violation of the specification) and solve a Lagrangian relaxation of the optimization problem to obtain an upper bound on the worst case violation of the specification being verified. Our approach is anytime i.e. it can be stopped at any time and a valid bound on the maximum violation can be obtained. We develop specialized verification algorithms with provable tightness guarantees under special assumptions and demonstrate the practical significance of our general verification approach on a variety of verification tasks.

Motivation & Objective

• Motivate the need for provable guarantees beyond standard test-set accuracy in safety-critical settings.
• Propose an optimization-based verification formulation that can handle arbitrary feedforward networks and activation functions.
• Develop a dual, unconstrained convex optimization approach to efficiently compute valid upper bounds on verification objectives.
• Demonstrate tight, scalable verification bounds on adversarial robustness for image classifiers and other tasks.
• Highlight the method's anytime nature and its applicability to discrete inputs and combinatorial input constraints.

Proposed method

• Formulate verification as finding the largest violation of a linear specification over all allowed inputs.
• Apply a Lagrangian relaxation to obtain an upper bound on the worst-case verification objective (weak duality).
• Derive a separable, layer-wise optimization that leads to an unconstrained dual problem solvable by subgradient methods.
• Provide closed-form or easily solvable one-dimensional subproblems for activation bounds and for the linear perturbation terms per layer.
• Show equivalence to existing LP-based verifications for piecewise linear activations and extend to general activations.
• Demonstrate the approach’s anytime property, i.e., usable bounds can be obtained even if the computation is interrupted.

Experimental results

Research questions

• RQ1 Can verification be performed on general feedforward networks with any activation function and architecture?
• RQ2 Can duality yield computable, tight upper bounds for the worst-case violations of a given specification?
• RQ3 How does the proposed method compare to existing verifications (e.g., SDP, LP relaxations) in terms of tightness and scalability?
• RQ4 Can the verification framework accommodate discrete inputs and combinatorial/input-space constraints?
• RQ5 What are the practical bounds achievable on adversarial robustness for MNIST and CIFAR-10 under norm-bounded perturbations?

Key findings

• The framework yields valid upper bounds on the verification objective for any dual variable choice and the bound is tightened by an optimization over dual variables.
• For piecewise linear activations, the method recovers the LP dual used in prior work, while providing an unconstrained dual that avoids nonconvex training-time backpropagation concerns.
• The layer-wise, separable structure enables efficient convex optimization via subgradient methods, scaling to large networks.
• Specialized verification algorithms with provable tightness guarantees are developed for single hidden-layer networks.
• The approach achieves state-of-the-art verified bounds on adversarial error rates for MNIST and CIFAR-10 under infinity-norm perturbations, and it can handle discrete or combinatorial input constraints.
• Experiments on MNIST, CIFAR, GitHub classifier stability tasks, and a complex digit-sum task demonstrate tight bounds and favorable comparisons to existing methods (where applicable).