Formal Verification of Piece-Wise Linear Feed-Forward Neural Networks (1705.01320v3)

Abstract: We present an approach for the verification of feed-forward neural networks in which all nodes have a piece-wise linear activation function. Such networks are often used in deep learning and have been shown to be hard to verify for modern satisfiability modulo theory (SMT) and integer linear programming (ILP) solvers. The starting point of our approach is the addition of a global linear approximation of the overall network behavior to the verification problem that helps with SMT-like reasoning over the network behavior. We present a specialized verification algorithm that employs this approximation in a search process in which it infers additional node phases for the non-linear nodes in the network from partial node phase assignments, similar to unit propagation in classical SAT solving. We also show how to infer additional conflict clauses and safe node fixtures from the results of the analysis steps performed during the search. The resulting approach is evaluated on collision avoidance and handwritten digit recognition case studies.

• The paper introduces a verification method that integrates global linear approximations with specialized node phase propagation.
• It reduces the search space for ReLU and MaxPool nodes by effectively inferring conflict clauses during the verification process.
• Experimental results on collision avoidance and MNIST demonstrate significant reductions in verification time compared to traditional SMT and ILP methods.

Formal Verification of Piece-Wise Linear Feed-Forward Neural Networks

The paper presents a verification methodology specifically designed for feed-forward neural networks employing piece-wise linear activation functions, which are prevalent in deep learning applications. Existing integration methods using SMT and ILP solvers encounter challenges with these kinds of networks due to the complexity of their behavior. The proposed approach aims to enhance the feasibility and efficiency of verifying formal properties within these networks.

Central to this proposal is the integration of a global linear approximation to encapsulate the network's behavior within the verification task. The methodology incorporates a specialized verification algorithm that leverages this linear representation. The algorithm uses a process akin to unit propagation in SAT solving for deducing additional node phases from partial assignments. Furthermore, this technique allows for the derivation of conflict clauses and the assertion of safe node configurations based on analytical observations made during the search process.

Key Methodological Advances

1. Linear Approximation: At the foundation of the presented approach lies a linear abstraction of the network's overall behavior, facilitating the application of SMT-like reasoning. This simplifies exploring variable interdependencies across large numbers of potential node phase combinations.
2. Node Phase Propagation: The method involves novel reasoning strategies to deduce node phases of ReLU and MaxPool elements within the feed-forward architecture, thus minimizing the necessary search space.
3. Conflict Clause Inference: Through analytical steps during the search, new conflict clauses are inferred, providing improved learning and propagation over consecutive verification iterations.

By combining satisfiability solving with linear programming, the approach effectively prunes infeasible node phase combinations and achieves significant reductions in verification time. The paper evaluates the efficacy of this method through experiments on two specific use cases: collision avoidance and handwritten digit recognition. These experiments demonstrated notable improvements in verification times compared to traditional SMT and ILP methods.

Experimental Evaluation

Two case studies were used to evaluate the approach:

• Collision Avoidance: Here, a vehicle collision scenario was analyzed to derive safety margins under various assumptions. This experimental configuration illustrated the tool's efficiency, highlighting how additional linear constraints derived from prior evaluations can enhance solver performance.
• Handwritten Digit Recognition (MNIST): Tests on the well-established MNIST dataset demonstrated the approach's capacity to handle challenging verification conditions, particularly when evaluating robustness against adversarial and noise perturbations. Despite the improvements, the computational burden remains nontrivial for more complex configurations, indicating room for further enhancement.

Implications and Future Work

The proposed approach opens new avenues for reliable AI system verification in contexts employing large piece-wise linear network architectures. As deep learning models increasingly incorporate such networks in critical applications, ensuring their reliability through formal verification becomes paramount.

The paper suggests future work in optimizing branching heuristics further and addressing the scalability limitations when dealing with more extensive networks. This could facilitate more widespread adoption of the verification method in practical AI deployments. Furthermore, incorporating advanced learning techniques to modify and optimize the structure of neural networks during training could refine the verification process, as suggested by the authors.

Overall, this work represents a meaningful step in the formal analysis and verification of neural networks in AI, emphasizing methodological strength and potential areas for refinement.