[Paper Review] Safety Verification of Neural Network Controlled Systems

Arthur Clavière, Eric Asselin+2 more|arXiv (Cornell University)|Nov 10, 2020

Adversarial Robustness in Machine LearningComputer Science31 references23 citations

TL;DR

This paper presents a system-level safety verification framework for neural network-controlled systems, combining validated simulation for physical dynamics and abstract interpretation for neural network controllers to perform sound reachability analysis. Applied to the ACAS Xu use case, it proves safety for 90.3% of initial states within 12 days, offering actionable insights into system weaknesses and controller behavior.

ABSTRACT

In this paper, we propose a system-level approach for verifying the safety of neural network controlled systems, combining a continuous-time physical system with a discrete-time neural network based controller. We assume a generic model for the controller that can capture both simple and complex behaviours involving neural networks. Based on this model, we perform a reachability analysis that soundly approximates the reachable states of the overall system, allowing to achieve a formal proof of safety. To this end, we leverage both validated simulation to approximate the behaviour of the physical system and abstract interpretation to approximate the behaviour of the controller. We evaluate the applicability of our approach using a real-world use case. Moreover, we show that our approach can provide valuable information when the system cannot be proved totally safe.

Motivation & Objective

• To address the lack of formal safety verification methods for neural network-controlled systems due to the absence of comprehensive specifications at the neural network level.
• To provide a formal proof of safety for complex, real-world systems like ACAS Xu without requiring item-level refinement or compliance with traditional software standards.
• To develop a generic, scalable model that captures multi-component neural network controllers with pre- and post-processing.
• To enable practical safety assessment even when complete safety cannot be formally proven, by identifying unsafe regions and providing explainable insights.

Proposed method

• Proposes a generic system model integrating a continuous-time physical system with a discrete-time neural network controller, including pre- and post-processing components.
• Uses validated numerical integration to soundly approximate the reachable states of the physical system over time.
• Applies abstract interpretation to over-approximate the output set of the neural network controller, ensuring soundness despite non-computable exact semantics.
• Performs a reachability analysis by iteratively computing reachable sets of the overall system, combining physical system evolution and controller abstraction.
• Employs symbolic state partitioning and iterative split refinement to improve coverage when safety cannot be proven for initial symbolic states.
• Uses a threshold-based pruning strategy to manage computational complexity, discarding symbolic states that exceed a predefined limit.

Experimental results

Research questions

• RQ1 Can a system-level approach provide sound safety guarantees for neural network-controlled systems when traditional item-level verification is inapplicable?
• RQ2 How can the interaction between a continuous-time physical system and a discrete-time neural network controller be formally modeled for safety verification?
• RQ3 What is the practical applicability of reachability analysis in real-world systems like ACAS Xu, especially when complete safety cannot be proven?
• RQ4 How can the results of safety verification be made interpretable and useful for system improvement, even in the absence of a full proof?

Key findings

• The proposed method achieved a safety coverage of 90.3% for the ACAS Xu use case, proving safety for 90.3% of the initial state space.
• The reachability analysis took approximately 12 days to complete on a standard server with 24 threads and 64 GB RAM.
• The most challenging verification tasks occurred when the intruder approached from the left or right (x0 < 0 ∧ y0 > 0 or x0 > 0 ∧ y0 > 0), with coverage dropping to ~75% and computation time reaching ~5×10⁴ seconds.
• The results showed symmetry across the x₀ = 0 axis, both in coverage and computation time, consistent with the physical symmetry of the collision avoidance problem.
• The method identified specific initial state regions where safety could not be proven, enabling targeted retraining or controller switching strategies.
• The approach provides explainable insights into controller behavior, such as identifying critical operational scenarios and potential weaknesses in the system design.