[论文解读] Efficient Formal Safety Analysis of Neural Networks

Shiqi Wang, Kexin Pei+3 more|arXiv (Cornell University)|Sep 19, 2018

Adversarial Robustness in Machine Learning被引用 188

一句话总结

Neurify 引入符号线性放松和定向约束细化，以正式验证神经网络的安全属性，网络规模达到超过10,000个ReLU，并在性能上比Reluplex和ReluVal高出数个数量级。

ABSTRACT

Neural networks are increasingly deployed in real-world safety-critical domains such as autonomous driving, aircraft collision avoidance, and malware detection. However, these networks have been shown to often mispredict on inputs with minor adversarial or even accidental perturbations. Consequences of such errors can be disastrous and even potentially fatal as shown by the recent Tesla autopilot crash. Thus, there is an urgent need for formal analysis systems that can rigorously check neural networks for violations of different safety properties such as robustness against adversarial perturbations within a certain $L$-norm of a given image. An effective safety analysis system for a neural network must be able to either ensure that a safety property is satisfied by the network or find a counterexample, i.e., an input for which the network will violate the property. Unfortunately, most existing techniques for performing such analysis struggle to scale beyond very small networks and the ones that can scale to larger networks suffer from high false positives and cannot produce concrete counterexamples in case of a property violation. In this paper, we present a new efficient approach for rigorously checking different safety properties of neural networks that significantly outperforms existing approaches by multiple orders of magnitude. Our approach can check different safety properties and find concrete counterexamples for networks that are 10$ imes$ larger than the ones supported by existing analysis techniques. We believe that our approach to estimating tight output bounds of a network for a given input range can also help improve the explainability of neural networks and guide the training process of more robust neural networks.

研究动机与目标

• 在使用神经网络的安全关键领域促进形式化安全分析的必要性。
• 开发准确、可扩展的方法来验证神经网络的安全属性或发现反例。
• 通过减少界限的过估计，使对比以往方法更大规模的网络成为可能。
• 展示 Neurify 在多种属性、数据集和体系结构上的性能。

提出的方法

• 引入符号区间分析结合线性放松的符号线性放松，以收紧输出界限。
• 在放松过程中识别被高估的节点，并通过定向约束细化进行改进。
• 对被高估的节点进行优先排序与拆分，以在不进行穷举枚举的情况下收紧输出范围。
• 使用线性求解器（有时也使用二次约束）来验证安全属性并生成反例。
• 通过运行实际网络迭代验证求解器结果，以确认反例或收紧界限。
• 检查由输入扰动（L-infinity、L1、L2）定义的安全属性，以及跨分类的输出不变量。

实验结果

研究问题

• RQ1 可扩展的形式化分析框架是否能够在超越先前能力的情况下验证大型神经网络的多项安全属性？
• RQ2 与之前的区间方法相比，符号线性放松在多大程度上减少了过估计？
• RQ3 定向约束细化是否能可靠地收紧界限并为大型网络提供具体的反例？
• RQ4 在不同数据集和体系结构上，Neurify 相对 Reluplex 和 ReluVal 的表现如何？

主要发现

• Neurify 可分析超过10,000个ReLU的网络，在性能上比先前方法高出若干数量级。
• 平均而言，Neurify 比 Reluplex 快5,000×，比 ReluVal 快20×。
• 该方法可扩展到比现有技术支持的网络规模大10倍。
• Neurify 对在五个数据集上训练的九个网络的六种属性类型进行了安全属性评估。
• 该系统展示了具体的反例和收紧的输出界限，帮助鲁棒性和可解释性。