[Paper Review] Evaluating Robustness of Neural Networks with Mixed Integer Programming

Vincent Tjeng, Kai Xiao+1 more|arXiv (Cornell University)|Nov 20, 2017

Adversarial Robustness in Machine LearningComputer Science337 citations

TL;DR

The paper formulates robust verification of piecewise-linear neural networks as a MILP, achieving large-speed improvements and enabling verification on networks with over 100k ReLUs and exact MNIST adversarial accuracy at epsilon=0.1.

ABSTRACT

Neural networks have demonstrated considerable success on a wide variety of real-world problems. However, networks trained only to optimize for training accuracy can often be fooled by adversarial examples - slightly perturbed inputs that are misclassified with high confidence. Verification of networks enables us to gauge their vulnerability to such adversarial examples. We formulate verification of piecewise-linear neural networks as a mixed integer program. On a representative task of finding minimum adversarial distortions, our verifier is two to three orders of magnitude quicker than the state-of-the-art. We achieve this computational speedup via tight formulations for non-linearities, as well as a novel presolve algorithm that makes full use of all information available. The computational speedup allows us to verify properties on convolutional networks with an order of magnitude more ReLUs than networks previously verified by any complete verifier. In particular, we determine for the first time the exact adversarial accuracy of an MNIST classifier to perturbations with bounded $l_\infty$ norm $ε=0.1$: for this classifier, we find an adversarial example for 4.38% of samples, and a certificate of robustness (to perturbations with bounded norm) for the remainder. Across all robust training procedures and network architectures considered, we are able to certify more samples than the state-of-the-art and find more adversarial examples than a strong first-order attack.

Motivation & Objective

• Motivate principled robustness evaluation beyond heuristic attacks.
• Formulate neural network robustness verification as a complete MILP problem for piecewise-linear networks.
• Develop tight ReLU and max-function formulations and a progressive bounds tightening presolve to scale to large networks.
• Demonstrate the ability to certify robustness and find adversarial examples across MNIST and CIFAR-10.
• Provide open-source tooling for MIPVerify to enable further research in robust verification.

Proposed method

• Model robustness as a feasibility problem over the adversarial polytope within the input domain.
• Express piecewise-linear network components (ReLU, max, linear layers) as MILP constraints with tight formulations.
• Introduce progressive bounds tightening (ia and lp) to tighten variable bounds before solving.
• Exploit restricted input domain G(x) and asymmetric bounds to reduce non-linearities.
• Compare against SMT-based verifiers (Reluplex) and other verifiers, showing significant speedups.
• Provide code at https://github.com/vtjeng/MIPVerify.jl.

Experimental results

Research questions

• RQ1 Can a complete MILP verifier efficiently certify robustness of large piecewise-linear networks (including conv nets and ResNets) under bounded perturbations?
• RQ2 How does the MILP verifier compare to SMT-based and incomplete verifiers in terms of speed and tightness of robustness certificates?
• RQ3 What is the exact adversarial accuracy achievable for MNIST under l_infinity perturbations with epsilon as small as 0.1, and how does it compare with attacks like PGD?
• RQ4 How do robust training methods and network architectures affect verifiability and robustness certificates?
• RQ5 What factors determine verification time and scales when certifying robustness across MNIST and CIFAR-10?

Key findings

• The MILP verifier is two to three orders of magnitude faster than Reluplex on minimum adversarial distortion tasks.
• It can verify networks with over 100,000 ReLUs, including convolutional and residual layers.
• For MNIST with epsilon=0.1, the authors obtain exact adversarial accuracy: adversarial examples for 4.38% of samples and certificates of robustness for the rest.
• Across MNIST and CIFAR-10, the method certifies more samples and finds more adversarial examples than previous state-of-the-art methods.
• The approach yields tighter lower/upper bounds on adversarial error than prior methods and scales to larger architectures (e.g., LP_d_res with 107,496 units).
• The authors provide open-source tooling (MIPVerify.jl) to reproduce and extend the results.