[Paper Review] Pruning and Slicing Neural Networks using Formal Verification

Ori Lahav, Guy Katz|arXiv (Cornell University)|May 28, 2021

Adversarial Robustness in Machine Learning40 references4 citations

TL;DR

This paper proposes a formal verification-based framework for pruning and slicing deep neural networks (DNNs) to reduce size while preserving output equivalence or bounded error. By leveraging SMT-based verification, it identifies redundant neurons—including phase-redundant, k-forward-redundant, and result-preserving types—and applies network slicing to partition the input space, enabling up to 71% reduction in DNN size with formal guarantees on correctness.

ABSTRACT

Deep neural networks (DNNs) play an increasingly important role in various computer systems. In order to create these networks, engineers typically specify a desired topology, and then use an automated training algorithm to select the network's weights. While training algorithms have been studied extensively and are well understood, the selection of topology remains a form of art, and can often result in networks that are unnecessarily large - and consequently are incompatible with end devices that have limited memory, battery or computational power. Here, we propose to address this challenge by harnessing recent advances in DNN verification. We present a framework and a methodology for discovering redundancies in DNNs - i.e., for finding neurons that are not needed, and can be removed in order to reduce the size of the DNN. By using sound verification techniques, we can formally guarantee that our simplified network is equivalent to the original, either completely, or up to a prescribed tolerance. Further, we show how to combine our technique with slicing, which results in a family of very small DNNs, which are together equivalent to the original. Our approach can produce DNNs that are significantly smaller than the original, rendering them suitable for deployment on additional kinds of systems, and even more amenable to subsequent formal verification. We provide a proof-of-concept implementation of our approach, and use it to evaluate our techniques on several real-world DNNs.

Motivation & Objective

• To address the problem of DNNs being unnecessarily large due to heuristic architecture choices, which limits deployment on resource-constrained devices.
• To provide formal guarantees when removing neurons by using verification techniques instead of relying on heuristic pruning methods.
• To extend redundancy detection beyond 'dead' neurons to include phase-redundant, k-forward-redundant, and result-preserving neurons.
• To integrate pruning with input domain slicing, enabling sub-network specialization for faster inference.
• To enable scalable, verifiable DNN compression that maintains accuracy within a prescribed tolerance.

Proposed method

• Using formal verification via the Marabou SMT-based DNN verifier to check whether removing specific neurons preserves network output within a tolerance bound.
• Defining and detecting four types of redundancy: dead neurons, phase-redundant neurons, k-forward-redundant neurons, and result-preserving redundant neurons.
• Applying input domain slicing by partitioning the input space into sub-domains to simplify each sub-network independently.
• Using simulation to filter candidate neurons before formal verification, reducing the number of verification queries.
• Combining pruning with slicing to generate a family of small, specialized DNNs, each valid for a specific input sub-domain.
• Validating the correctness of neuron removal with a single final verification query per sub-domain to ensure result-preserving behavior.

Experimental results

Research questions

• RQ1 Can formal verification be used to identify and remove neurons that are redundant not only in output but also in contribution to the network’s behavior?
• RQ2 Can redundancy detection be extended beyond 'dead' neurons to include neurons whose removal causes only bounded output deviation?
• RQ3 Does input domain slicing enable the discovery of additional redundancies that are not apparent in the full network?
• RQ4 Can the combination of pruning and slicing reduce DNN size significantly while maintaining formal guarantees on output fidelity?
• RQ5 To what extent does the complexity of the input sub-domain affect the degree of pruning achievable?

Key findings

• The proposed method achieved up to 71% reduction in overall DNN size on airborne collision avoidance networks while preserving output equivalence within a prescribed tolerance.
• On 75% of input sub-domains, the method successfully identified and removed an additional 12.3% of forward-redundant and result-preserving neurons.
• In some sub-domains, the simplification pipeline reduced the network to a linear transformation, indicating complete linearization due to slicing.
• In sub-domains where the method failed, the number of candidate neurons for removal was similar to successful cases, indicating consistent candidate quality.
• The approach achieved significant compression without relying on specific activation functions, unlike prior work limited to ReLU networks.
• The framework is agnostic to the underlying verification engine and can be integrated with any DNN verification tool, including those based on SMT, LP, or abstract interpretation.