[Paper Review] Output Range Analysis for Deep Neural Networks

Souradeep Dutta, Susmit Jha+2 more|arXiv (Cornell University)|Sep 26, 2017

Adversarial Robustness in Machine LearningComputer Science10 references75 citations

TL;DR

The paper introduces Sherlock, a hybrid local search and MILP-based method to compute guaranteed output ranges of feedforward ReLU networks over convex input sets, and compares it to Reluplex across synthetic and real-world verification scenarios.

ABSTRACT

Deep neural networks (NN) are extensively used for machine learning tasks such as image classification, perception and control of autonomous systems. Increasingly, these deep NNs are also been deployed in high-assurance applications. Thus, there is a pressing need for developing techniques to verify neural networks to check whether certain user-expected properties are satisfied. In this paper, we study a specific verification problem of computing a guaranteed range for the output of a deep neural network given a set of inputs represented as a convex polyhedron. Range estimation is a key primitive for verifying deep NNs. We present an efficient range estimation algorithm that uses a combination of local search and linear programming problems to efficiently find the maximum and minimum values taken by the outputs of the NN over the given input set. In contrast to recently proposed "monolithic" optimization approaches, we use local gradient descent to repeatedly find and eliminate local minima of the function. The final global optimum is certified using a mixed integer programming instance. We implement our approach and compare it with Reluplex, a recently proposed solver for deep neural networks. We demonstrate the effectiveness of the proposed approach for verification of NNs used in automated control as well as those used in classification.

Motivation & Objective

• Motivate the need for guaranteed output ranges of neural networks in safety-critical and robustness contexts.
• Define the range estimation problem for feedforward ReLU networks over compact input polyhedra.
• Propose a hybrid algorithm combining gradient-based local search with MILP-based global search to certify upper/lower bounds on network outputs.

Proposed method

• Represent the network as a composition of linear maps and ReLU activations with a piecewise affine, continuous global function F.
• Formulate upper/lower bound estimation as a sequence of local searches (gradient ascent/descent) within locally active regions, coupled with MILP feasibility checks for global improvement.
• Encode ReLU nonlinearities in the global search as binary variables within a mixed-integer linear program to test if a higher-output exists within the input polyhedron P.
• Prove termination and approximation guarantees: the algorithm returns bounds within a tolerance delta, with u* ≤ u ≤ u*+delta.
• Implement the approach in the Sherlock tool and compare against Reluplex on synthetic networks and benchmarks including control and MNIST-style classification tasks.
• Discuss gradient computation through backpropagation-style chain rule and use of locally active regions to enable linear-programming-based ascent steps.

Experimental results

Research questions

• RQ1 Can we compute tight, guaranteed output ranges for deep ReLU networks over a compact input polyhedron?
• RQ2 Does a hybrid local search plus MILP approach outperform purely monolithic optimization methods for range estimation?
• RQ3 Can the method be scaled to networks with hundreds to thousands of neurons while preserving accuracy and practicality?
• RQ4 Is the approach applicable to both control-oriented networks and image classification robustness analyses?
• RQ5 How does Sherlock compare to Reluplex in terms of solved instances, speed, and robustness across varied network sparsity and size?

Key findings

• Sherlock combines local gradient ascent within locally active regions and MILP-based global search to certify output ranges with a tolerance delta.
• The method terminates with an upper bound that is within delta of the true maximum, guaranteeing u* ≤ u ≤ u*+delta.
• Sherlock demonstrates scalability to networks with up to about 1500 neurons in experiments and outperforms Reluplex on numerous random and benchmark instances.
• In illustrative applications, Sherlock derives tight control input ranges for nonlinear plant models and can identify perturbation-induced label changes in MNIST-like classifiers, supporting robustness analysis.
• Empirical results indicate network sparsity and total neuron count materially influence performance, with dense, large networks remaining challenging for both Sherlock and Reluplex, though Sherlock more often succeeds within given timeouts.