[Paper Review] Verifying Neural Networks with Mixed Integer Programming

Vincent Tjeng, Russ Tedrake|arXiv (Cornell University)|Nov 20, 2017

Adversarial Robustness in Machine Learning35 references105 citations

TL;DR

This paper proposes using mixed integer programming (MIP) to verify robustness of piecewise affine neural networks, such as those with ReLU and maxpool layers, enabling provable guarantees against adversarial examples. It demonstrates that MIP-based verification is up to ten times faster than prior methods and identifies inputs robust to natural perturbations like blurring, with some images provably immune to all blurred variants.

ABSTRACT

Neural networks have demonstrated considerable success in a wide variety of real-world problems. However, the presence of adversarial examples - slightly perturbed inputs that are misclassified with high confidence - limits our ability to guarantee performance for these networks in safety-critical applications. We demonstrate that, for networks that are piecewise affine (for example, deep networks with ReLU and maxpool units), proving no adversarial example exists - or finding the closest example if one does exist - can be naturally formulated as solving a mixed integer program. Solves for a fully-connected MNIST classifier with three hidden layers can be completed an order of magnitude faster than those of the best existing approach. To address the concern that adversarial examples are irrelevant because pixel-wise attacks are unlikely to happen in natural images, we search for adversaries over a natural class of perturbations written as convolutions with an adversarial blurring kernel. When searching over blurred images, we find that as opposed to pixelwise attacks, some misclassifications are impossible. Even more interestingly, a small fraction of input images are provably robust to blurs: every blurred version of the input is classified with the same, correct label.

Motivation & Objective

• To address the challenge of verifying robustness in deep neural networks against adversarial examples in safety-critical applications.
• To develop a method that can provably determine whether any adversarial example exists for a given network and input.
• To extend verification beyond pixel-wise perturbations to more natural image distortions, such as blurring.
• To identify inputs that are provably robust to entire classes of natural perturbations, not just small pixel-wise changes.

Proposed method

• Formulates the robustness verification problem for ReLU and maxpool networks as a mixed integer program (MIP).
• Uses MIP to either prove no adversarial example exists within a given perturbation radius or find the closest such example.
• Applies the MIP formulation to fully-connected MNIST classifiers with three hidden layers, achieving significantly faster solve times than prior approaches.
• Extends the search for adversarial examples beyond pixel-wise perturbations to include convolutions with an adversarial blurring kernel.
• Employs MIP to verify robustness over the entire space of blurred inputs, identifying inputs that maintain their correct classification under all such perturbations.

Experimental results

Research questions

• RQ1 Can mixed integer programming be effectively used to verify robustness of ReLU-based neural networks?
• RQ2 How does MIP-based verification compare in speed and scalability to existing verification methods?
• RQ3 Are adversarial examples meaningful when considering natural perturbations like blurring, rather than arbitrary pixel-wise changes?
• RQ4 Can we identify inputs that are provably robust to all blurred versions of themselves?
• RQ5 What fraction of inputs in a dataset are robust to natural blurring perturbations, and under what conditions?

Key findings

• MIP-based verification for fully-connected MNIST networks with three hidden layers is an order of magnitude faster than the best existing approach.
• When searching over blurred images, some misclassifications are provably impossible due to the network's structure and the nature of the perturbation.
• A small but non-zero fraction of MNIST inputs are provably robust to all blurred versions, meaning every blurred variant is classified correctly.
• The method successfully identifies inputs that maintain their correct label under all convoluted perturbations with an adversarial blurring kernel.
• The results suggest that adversarial examples under natural perturbations are less common and more structured than under unconstrained pixel-wise attacks.