[Paper Review] NeuroDiff: Scalable Differential Verification of Neural Networks using Fine-Grained Approximation

Brandon Paulsen, Jingbo Wang+2 more|arXiv (Cornell University)|Sep 21, 2020

Adversarial Robustness in Machine Learning56 references4 citations

TL;DR

NeuroDiff proposes a scalable differential verification technique for feed-forward ReLU neural networks using fine-grained convex approximations and symbolic variables to drastically improve accuracy and speed. It achieves up to 1000× speedup and 5× higher accuracy than the state-of-the-art on equivalence verification tasks for compressed or modified networks.

ABSTRACT

As neural networks make their way into safety-critical systems, where misbehavior can lead to catastrophes, there is a growing interest in certifying the equivalence of two structurally similar neural networks. For example, compression techniques are often used in practice for deploying trained neural networks on computationally- and energy-constrained devices, which raises the question of how faithfully the compressed network mimics the original network. Unfortunately, existing methods either focus on verifying a single network or rely on loose approximations to prove the equivalence of two networks. Due to overly conservative approximation, differential verification lacks scalability in terms of both accuracy and computational cost. To overcome these problems, we propose NeuroDiff, a symbolic and fine-grained approximation technique that drastically increases the accuracy of differential verification while achieving many orders-of-magnitude speedup. NeuroDiff has two key contributions. The first one is new convex approximations that more accurately bound the difference neurons of two networks under all possible inputs. The second one is judicious use of symbolic variables to represent neurons whose difference bounds have accumulated significant error. We also find that these two techniques are complementary, i.e., when combined, the benefit is greater than the sum of their individual benefits. We have evaluated NeuroDiff on a variety of differential verification tasks. Our results show that NeuroDiff is up to 1000X faster and 5X more accurate than the state-of-the-art tool.

Motivation & Objective

• To address the lack of scalable and accurate methods for verifying functional equivalence between two structurally similar neural networks, especially in safety-critical applications.
• To overcome the limitations of existing differential verification tools that rely on overly conservative approximations, leading to poor scalability and accuracy.
• To develop a technique that enables formal guarantees on the behavioral similarity of compressed or pruned neural networks and their original counterparts.
• To reduce approximation error accumulation during forward analysis of network differences while maintaining computational efficiency.
• To integrate symbolic abstraction with fine-grained convex bounds to achieve complementary improvements in verification precision and performance.

Proposed method

• Introduces novel convex approximations to tightly bound the output difference of two ReLU networks across all inputs, replacing coarse-grained interval concretizations used in prior work.
• Employs symbolic variables to represent neurons in hidden layers where difference bounds have accumulated significant error, enabling more precise propagation of uncertainty.
• Combines symbolic abstraction with convex approximation in a forward analysis pipeline using symbolic interval arithmetic to compute difference bounds.
• Uses a partitioning strategy to isolate regions of high uncertainty and applies more refined analysis only where needed, improving efficiency.
• Leverages the structural similarity between networks (e.g., weight pruning or quantization) to exploit shared computation and reduce redundant analysis.
• Employs a timeout-based verification framework that returns 'verified' if the difference is provably below a tolerance ε, or 'undetermined' otherwise.

Experimental results

Research questions

• RQ1 Can fine-grained convex approximations significantly reduce the over-approximation error in differential verification of ReLU networks?
• RQ2 To what extent can symbolic variables mitigate error accumulation in difference bounds during forward propagation?
• RQ3 How do convex approximations and symbolic abstraction jointly improve verification accuracy and scalability compared to using either technique alone?
• RQ4 Can the proposed method achieve orders-of-magnitude speedup while maintaining or improving accuracy on real-world neural network compression tasks?
• RQ5 What is the impact of input perturbation and network width on the effectiveness of the proposed approximation techniques?

Key findings

• NeuroDiff achieves up to 1000× speedup compared to the state-of-the-art tool ReluDiff on differential verification tasks.
• The method improves verification accuracy by up to 5×, significantly reducing false negatives in equivalence checking.
• Convex approximations are most effective when pre-ReLU delta intervals are wide but still contain symbolic information, which aligns with higher perturbation settings.
• The combination of convex approximations and symbolic variables yields synergistic benefits, with performance gains greater than the sum of individual techniques.
• In MNIST experiments, increasing perturbation widened delta intervals, confirming that convex approximations are most beneficial under such conditions.
• The approach successfully verifies functional equivalence between original and compressed networks (e.g., pruned or quantized) with formal guarantees under a user-defined ε tolerance.