Reachability Analysis of Deep Neural Networks with Provable Guarantees (1805.02242v1)

Abstract: Verifying correctness of deep neural networks (DNNs) is challenging. We study a generic reachability problem for feed-forward DNNs which, for a given set of inputs to the network and a Lipschitz-continuous function over its outputs, computes the lower and upper bound on the function values. Because the network and the function are Lipschitz continuous, all values in the interval between the lower and upper bound are reachable. We show how to obtain the safety verification problem, the output range analysis problem and a robustness measure by instantiating the reachability problem. We present a novel algorithm based on adaptive nested optimisation to solve the reachability problem. The technique has been implemented and evaluated on a range of DNNs, demonstrating its efficiency, scalability and ability to handle a broader class of networks than state-of-the-art verification approaches.

• The paper presents an adaptive nested optimization algorithm to compute Lipschitz bounds, enhancing scalability and verification of deep neural networks.
• It outperforms traditional MILP, SAT, and SMT approaches by efficiently handling diverse layers such as sigmoid, max pooling, and softmax.
• Empirical tests validate its utility in safety verification and adversarial example generation while establishing the NP-completeness of the reachability problem.

Overview of the Paper on Reachability Analysis of Deep Neural Networks

The paper discusses a robust approach for verifying the correctness of deep neural networks (DNNs) through a generic reachability problem. The reachability problem is designed to compute bounds on a Lipschitz-continuous function over the outputs of a feed-forward DNN for a given set of inputs. These bounds provide a measure of the output range and serve as a basis for verifying the safety and robustness of DNNs. The primary contribution of the paper is an algorithm based on adaptive nested optimization, which addresses the scalability issues of existing methods and handles a broader class of network architectures.

The motivation behind this research stems from the concerns about deploying DNNs in safety-critical applications, where guarantees on the network's behavior are essential. Existing verification methods converting the task into a constraint satisfaction problem, such as using MILP, SAT, or SMT solvers, often struggle with scalability and are limited to networks with simple layer types, like ReLU. The proposed approach overcomes these limitations by generalizing the verification problem into a reachability problem that can interface with various DNN architectures, including those with sigmoid, max pooling, and softmax layers.

Key Contributions and Insights

1. Algorithm Design: The proposed algorithm leverages global optimization techniques to systematically find the bounds of the evaluation function, given its Lipschitz continuity. This is achieved through a nested optimization process, with careful error bound guarantees that ensure reliable reachability results. The focus on Lipschitz continuity allows the application of the method to networks with diverse layer compositions.
2. Efficiency and Scalability: In comparison to state-of-the-art approaches like SHERLOCK and Reluplex, the proposed method demonstrates superior efficiency, notably in terms of computational time, without sacrificing the rigor of model verification. This efficiency arises from the algorithm's independence from network size and its ability to perform computations in a linear time frame concerning error bounds.
3. Supporting NP-Completeness: The paper provides a theoretical underpinning for the NP-completeness of the reachability problem, establishing its computational boundaries and laying the groundwork for future extensions.
4. Empirical Validation: The algorithm was implemented and tested across different networks, including those beyond the capability of existing algorithms. The results indicated not only successful range analysis but also potential in safety verification tasks, such as adversarial example generation and robustness evaluation.

Implications and Future Directions

The implications of this research are both theoretical and practical. Theoretically, it advances the understanding of network verification by establishing a general approach that improves upon constraints-based methods. Practically, the reachability analysis technique offers a robust tool for industries working with DNNs in safety-critical systems, enabling more informed deployment decisions.

The paper's authors speculate potential future extensions, such as integrating this method with GPU-accelerated computing for enhanced scalability and adapting it to other deep learning architectures, like recurrent neural networks. These directions are grounded in the framework's flexibility and performance demonstrated in this research.

Overall, this paper significantly contributes to the field of neural network verification by presenting a scalable and generalized approach for achieving provable guarantees, fostering confidence in the deployment of complex DNNs in sensitive domains.