An Abstract Domain for Certifying Neural Networks. Department of Computer Science

Transcription

1 An Abstract Domain for Certifying Neural Networks Gagandeep Singh Timon Gehr Markus Püschel Martin Vechev Department of Computer Science

2 Adversarial input perturbations Neural network f 8 I " Neural network f 7 I L % (I ', ε) Neural network f 9 I Rotate(I ', ε,α, β) 2

3 Neural network robustness Given: Perturbation Regions: To Prove: Neural network f: R 5 R 7 Perturbation region R I ', φ. L % I ', ε : All images I where pixel values in I and I ' differ by at most ε 2. Rotate(I ', ε,α, β): All images I in L % I ', ε rotated by θ [α, β] I R I ', φ. f I [c] > f(i)[j] where c is the correct output and j is any other output Challenges The size of R I ', φ grows exponentially in the number of pixels: cannot compute f I for all I separately Prior work on verification Precise but does not scale: SMT solving [CAV 7] input refinement [USENIX 8] semidefinite relaxations [ICLR 8] Scales but imprecise linear relaxations [ICML 8] abstract interpretation [S&P 8, NIPS 8] 3

4 This work: contributions A new abstract domain combining floating point Polyhedra with Intervals: custom transformers for common functions in neural networks such as affine transforms, ReLU, sigmoid, tanh, and maxpool activations scalable and precise analysis DeepPoly: complete and parallelized end-to-end implementation based on ELINA First approach to certify robustness under rotation combined with linear interpolation: based on input refinement ε = 0.00, α = 45 I, β = 65 I Network ε NIPS 8 DeepPoly Ø 6 layers Ø 300 neurons Ø 6 layers Ø 34,688 neurons proves 2% 5.8 sec 0.3 proves 37% 7 sec proves 64% 4.8 sec proves 43% 88 sec 4

5 Neural network transformations 5

6 Our Abstract Domain Shape: associate a lower polyhedral a L M and an upper polyhedral a L N constraint with each x L Concretization of abstract element a: Domain invariant: store auxiliary concrete lower and upper bounds l L, u L for each x L less precise than Polyhedra, restriction needed to ensure scalability captures affine transformation precisely unlike Octagon, TVPI custom transformers for ReLU, sigmoid, tanh, and maxpool activations n: #neurons, m: #constraints w 5WX : max #neurons in a layer, L: # layers Transformer Polyhedra Our domain Affine Ο(nm U U ) Ο(w 5WX L) ReLU Ο(exp (n, m)) Ο() 6

7 Example: Analysis of a Toy Neural Network Input layer Hidden layers Output layer 0 0 [,] x ] x^ max (0, x^) x _ x` max (0, x`) x a x ]] 0 [,] x U x b x c x d x ]' x ]U max (0, x b ) max (0, x d ) constraints per neuron 2. Pointwise transformers => parallelizable. 3. Backsubstitution => helps precision. 4. Non-linear activations => approximate and minimize the area 7

8 [,] 0 0 x ] x^ max (0, x^) x _ x` max (0, x`) x a x ]] 0 [,] x U x b x c x d x ]' x ]U max (0, x b ) max (0, x d )

9 ReLU activation Pointwise transformer for x g max(0, x L ) that uses l L, u L if u L 0, a g M = a g N = 0, l g = u g = 0, if l L 0, a g M = a g N = x L, l g = l L, u g = u L, if l L < 0 and u L > 0 x^ max (0, x^) x _ x b max (0, x b ) x c choose (b) or (c) depending on the area Constant runtime 9

10 Affine transformation after ReLU x _ 0 x` x c Imprecise upper bound u` by substituting u _, u c for x _ and x c in aǹ 0

11 Backsubstitution x _ 0 x` x c

12 x ] 0 x^ max (0, x^) x _ 0 x` x U x b 0 max (0, x b ) x c Affine transformation with backsubstitution is pointwise, complexity: Ο wu 5WX L 2

13 [,] 0 0 max (0, x^) max (0, x`) x ] x^ x _ x` x a x ]] 0 [,] x U x b x c x d x ]' x ]U max (0, x b ) max (0, x d )

14 Checking for robustness Prove x ]] x ]U > 0 for all inputs in, [,] Computing lower bound for x ]] x ]U using l ]], u ]U gives - which is an imprecise result 4 With backsubstitution, one gets as the lower bound for x ]] x ]U, proving robustness

15 More complex perturbations: rotations Challenge: Rotate(I ', ε,α, β) is non-linear and cannot be captured in our domain unlike L % I ', ε Solution: Over-approximate Rotate(I ', ε,α, β) with boxes and use input refinement for precision Result: Prove robustness for networks under Rotate(I ', 0.00,-45,65) 5

16 Experimental evaluation Neural network architectures: fully connected feedforward (FFNN) convolutional (CNN) Training: trained to be robust with DiffAI [ICML 8] and PGD [Madry et al.] without adversarial training Datasets: MNIST CIFAR0 DeepPoly vs. state-of-the-art DeepZ [NIPS 8] and Fast-Lin [ICML 8] 6

17 Results 7

18 MNIST FFNN (3,00 hidden units) 8

19 CIFAR0 CNNs (4,852 hidden units) 9

20 Large Defended CNNs (6 layers) trained via DiffAI [ICML 8] Dataset Model #neurons ε %verified robustness Average runtime (s) DeepZ DeepPoly DeepZ DeepPoly MNIST ConvBig 34, ConvBig 34, ConvBig 34, ConvSuper 88, CIFAR0 ConvBig 62, ConvBig 62,

21 Ongoing work Combine abstract interpretation with MILP/LP solvers [ICLR 9] Geometric perturbations Applying verification during training and improving DiffAI Beyond classification Others. 2

22 Conclusion A new abstract domain combining floating point Polyhedra with Intervals: n: #neurons, m: #constraints w 5WX : max #neurons in a layer, L: # layers Transformer Polyhedra Our domain Affine Ο(nm U U ) Ο(w 5WX L) ReLU Ο(exp (n, m)) Ο() DeepPoly: complete and parallelized end-to-end implementation based on ELINA 22