{"type":"ScholarlyArticle","title":"A Dual Approach to Verify and Train Deep Networks","authors":[{"name":"Sven Gowal","slug":"sven-gowal","given":"Sven","family":"Gowal","affiliation":""},{"name":"Krishnamurthy Dvijotham","slug":"krishnamurthy-dvijotham","given":"Krishnamurthy","family":"Dvijotham","affiliation":""},{"name":"Robert Stanforth","slug":"robert-stanforth","given":"Robert","family":"Stanforth","affiliation":""},{"name":"Timothy Mann","slug":"timothy-mann","given":"Timothy","family":"Mann","affiliation":""},{"name":"Pushmeet Kohli","slug":"pushmeet-kohli","given":"Pushmeet","family":"Kohli","affiliation":""}],"abstract":"This paper addressed the problem of formally verifying desirable properties of neural networks, i.e., obtaining provable guarantees that neural networks satisfy specifications relating their inputs and outputs (e.g., robustness to bounded norm adversarial perturbations). Most previous work on this topic was limited in its applicability by the size of the network, network architecture and the complexity of properties to be verified. In contrast, our framework applies to a general class of activation functions and specifications. We formulate verification as an optimization problem (seeking to find the largest violation of the specification) and solve a Lagrangian relaxation of the optimization problem to obtain an upper bound on the worst case violation of the specification being verified. Our approach is anytime, i.e., it can be stopped at any time and a valid bound on the maximum violation can be obtained. Finally, we highlight how this approach can be used to train models that are amenable to verification.","doi":"10.24963/ijcai.2019/854","url":"https://ijcai.org/proceedings/2019/854","pdf":"https://ijcai.org/proceedings/2019/0854.pdf","markdown":"https://ijcai.org/proceedings/2019/854.md","bibtex":"https://ijcai.org/proceedings/2019/bibtex/854","volume":{"slug":"2019","title":"Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2019","url":"https://ijcai.org/proceedings/2019/","year":2019,"location":"Macao","dates":"10-16 August 2019","editors":"Sarit Kraus","isbn":"978-0-9992411-4-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2019"},"section":"Best Sister Conferences","track":"Best Sister Conferences","number":854,"pages":{"first":6156,"last":6160},"keywords":["Machine Learning: Deep Learning","Machine Learning: Learning Theory"],"videos":[],"references":[{"position":1,"raw":"[Athalye and Sutskever, 2017] Anish Athalye and Ilya Sutskever. Synthesizing robust adversarial examples. arXiv preprint arXiv:1707.07397, 2017.","title":"Synthesizing robust adversarial examples","authors":"Anish Athalye, Ilya Sutskever","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Athalye et al., 2018] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. arXiv preprint arXiv:1802.00420, 2018.","title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","authors":"Anish Athalye, Nicholas Carlini, David Wagner","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bunel et al., 2017] Rudy Bunel, Ilker Turkaslan, Philip HS Torr, Pushmeet Kohli, and M Pawan Kumar. Piecewise lin- ear neural network verification: a comparative study. arXiv preprint arXiv:1711.00455, 2017.","title":"Piecewise linear neural network verification: a comparative study","authors":"Rudy Bunel, Ilker Turkaslan, Pushmeet Philip Hs Torr, M Pawan Kohli, Kumar","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Carlini and Wagner, 2017a] Nicholas Carlini and David Wagner. Adversarial examples are not easily detected: Bypassing ten detection methods. In Proceedings of the 10th ACM Workshop on Artificial Intelligence and Secu- rity, pages 3-14. ACM, 2017.","title":"Adversarial examples are not easily detected: Bypassing ten detection methods","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Carlini and Wagner, 2017b] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural net- works. In 2017 IEEE Symposium on Security and Privacy, pages 39-57. IEEE, 2017.","title":"Towards evaluating the robustness of neural networks","authors":"Wagner Carlini, Nicholas Carlini, David Wagner","year":"2017","venue":"IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Cheng et al., 2017] Chih-Hong Cheng, Georg Nührenberg, and Harald Ruess. Maximum resilience of artificial neu- ral networks. In International Symposium on Automated Technology for Verification and Analysis, pages 251-268. Springer, 2017.","title":"Maximum resilience of artificial neural networks","authors":"Cheng","year":"2017","venue":"International Symposium on Automated Technology for Verification and Analysis","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dvijotham et al., 2018a] Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O'Donoghue, Jonathan Uesato, and Pushmeet Kohli. Training verified learners with learned verifiers. arXiv preprint arXiv:1805.10265, 2018.","title":"Training verified learners with learned verifiers","authors":"Dvijotham","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Dvijotham et al., 2018b] Krishnamurthy Dvijotham, Robert Stanforth, Sven Gowal, Timothy Mann, and Pushmeet Kohli. A dual approach to scalable verification of deep networks. arXiv preprint arXiv:1803.06567, 2018.","title":"A dual approach to scalable verification of deep networks","authors":"Dvijotham","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Ehlers, 2017] Ruediger Ehlers. Formal verification of piece- wise linear feed-forward neural networks. In International Symposium on Automated Technology for Verification and Analysis, pages 269-286. Springer, 2017.","title":"Formal verification of piecewise linear feed-forward neural networks","authors":"Ruediger Ehlers","year":"2017","venue":"International Symposium on Automated Technology for Verification and Analysis","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Goodfellow et al., 2014] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.","title":"Explaining and harnessing adversarial examples","authors":"Ian J Goodfellow, Jonathon Shlens, Christian Szegedy","year":"2014","venue":null,"doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Goodfellow et al., 2016] Ian Goodfellow, Yoshua Bengio, and Aaron Courville. Deep Learning. MIT Press, 2016.","title":"Deep Learning","authors":"Ian Goodfellow, Yoshua Bengio, Aaron Courville","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Gowal et al., 2018] Sven Gowal, Krishnamurthy Dvi- jotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv:1810.12715, 2018.","title":"On the effectiveness of interval bound propagation for training verifiably robust models","authors":"Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Timothy Mann, Pushmeet Kohli","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Kannan et al., 2018] Harini Kannan, Alexey Kurakin, and Ian Goodfellow. Adversarial logit pairing. arXiv preprint arXiv:1803.06373, 2018.","title":"Adversarial logit pairing","authors":"Alexey Harini Kannan, Ian Kurakin, Goodfellow","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Katz et al., 2017] Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. In International Conference on Computer Aided Verification, pages 97-117. Springer, 2017.","title":"Reluplex: An efficient smt solver for verifying deep neural networks","authors":"Guy Katz, Clark Barrett, David L Dill, Kyle Julian, Mykel, Kochenderfer","year":"2017","venue":"International Conference on Computer Aided Verification","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Kolter and Wong, 2017] J Zico Kolter and Eric Wong. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint arXiv:1711.00851, 2017.","title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","authors":"Wong ; ] J Zico Kolter, Eric Kolter, Wong","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Kurakin et al., 2016] Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02533, 2016.","title":"Adversarial examples in the physical world","authors":"Alexey Kurakin, Ian Goodfellow, Samy Bengio","year":"2016","venue":null,"doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Madry et al., 2017] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017.","title":"Towards deep learning models resistant to adversarial attacks","authors":"Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Mirman et al., 2018] Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for provably robust neural networks. In Proceedings of the 35th International Conference on Machine Learning, vol- ume 80, pages 3578-3586, 2018.","title":"Differentiable abstract interpretation for provably robust neural networks","authors":"Matthew Mirman, Timon Gehr, Martin Vechev","year":"2018","venue":"Proceedings of the 35th International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Papernot et al., 2015] Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adversarial perturbations against deep neu- ral networks. arXiv preprint arXiv:1511.04508, 2015.","title":"Distillation as a defense to adversarial perturbations against deep neural networks","authors":"Nicolas Papernot, Patrick Mcdaniel, Xi Wu, Somesh Jha, Ananthram Swami","year":"2015","venue":null,"doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Raghunathan et al., 2018] Aditi Raghunathan, Jacob Stein- hardt, and Percy Liang. Certified defenses against adver- sarial examples. arXiv preprint arXiv:1801.09344, 2018.","title":"Certified defenses against adversarial examples","authors":"Aditi Raghunathan, Jacob Steinhardt, Percy Liang","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Szegedy et al., 2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.","title":"Intriguing properties of neural networks","authors":"Szegedy","year":"2013","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Tjeng et al., 2017] Vincent Tjeng, Kai Xiao, and Russ Tedrake. Evaluating robustness of neural networks with mixed integer programming. arXiv preprint arXiv:1711.07356, 2017.","title":"Evaluating robustness of neural networks with mixed integer programming","authors":"Vincent Tjeng, Kai Xiao, Russ Tedrake","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Uesato et al., 2018] Jonathan Uesato, Brendan O'Donoghue, Aaron van den Oord, and Pushmeet Kohli. Adversarial risk and the dangers of evaluating against weak attacks. arXiv preprint arXiv:1802.05666, 2018.","title":"Adversarial risk and the dangers of evaluating against weak attacks","authors":"Jonathan Uesato, O' Brendan, Aaron Donoghue, Pushmeet Van Den Oord, Kohli","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Wang et al., 2018] Shiqi Wang, Kexin Pei, Justin White- house, Junfeng Yang, and Suman Jana. Formal secu- rity analysis of neural networks using symbolic intervals. arXiv preprint arXiv:1804.10829, 2018.","title":"Formal security analysis of neural networks using symbolic intervals","authors":"Shiqi Wang, Kexin Pei, Justin Whitehouse, Junfeng Yang, Suman Jana","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Weng et al., 2018] Tsui-Wei Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Duane Boning, Inder- jit S Dhillon, and Luca Daniel. Towards fast computation of certified robustness for relu networks. arXiv preprint arXiv:1804.09699, 2018.","title":"Towards fast computation of certified robustness for relu networks","authors":"Huan Tsui-Wei Weng, Hongge Zhang, Zhao Chen, Cho-Jui Song, Duane Hsieh, Boning, Luca Inderjit S Dhillon, Daniel","year":"2018","venue":null,"doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}