{"type":"ScholarlyArticle","title":"Towards Scalable Complete Verification of Relu Neural Networks via Dependency-based Branching","authors":[{"name":"Panagiotis Kouvaros","slug":"panagiotis-kouvaros","given":"Panagiotis","family":"Kouvaros","affiliation":"Department of Computing , Imperial College London , UK"},{"name":"Alessio Lomuscio","slug":"alessio-lomuscio","given":"Alessio","family":"Lomuscio","affiliation":"Department of Computing , Imperial College London , UK"}],"abstract":"We introduce an efficient method for the complete verification of ReLU-based feed-forward neural networks. The method implements branching on the ReLU states on the basis of a notion of dependency between the nodes. This results in dividing the original verification problem into a set of sub-problems whose MILP formulations require fewer integrality constraints. We evaluate the method on all of the ReLU-based fully connected networks from the first competition for neural network verification. The experimental results obtained show 145% performance gains over the present state-of-the-art in complete verification.","doi":"10.24963/ijcai.2021/364","url":"https://ijcai.org/proceedings/2021/364","pdf":"https://ijcai.org/proceedings/2021/0364.pdf","markdown":"https://ijcai.org/proceedings/2021/364.md","bibtex":"https://ijcai.org/proceedings/2021/bibtex/364","volume":{"slug":"2021","title":"Proceedings of the Thirtieth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2021","url":"https://ijcai.org/proceedings/2021/","year":2021,"location":"Montreal","dates":"19-27 August 2021","editors":"Prof. Zhi-Hua Zhou","isbn":"978-0-9992411-9-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2021"},"section":"Machine Learning","track":"Main Track","number":364,"pages":{"first":2643,"last":2650},"keywords":["Machine Learning: Deep Learning","Multidisciplinary Topics and Applications: Validation and Verification"],"videos":[],"references":[{"position":1,"raw":"[Achterberg, 2007] T. Achterberg. Conflict analysis in mixed integer programming. Discrete Optimization, 4(1):4-20, 2007.","title":"Conflict analysis in mixed integer programming","authors":"T Achterberg","year":"2007","venue":"Discrete Optimization","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Anderson et al., 2019] R. Anderson, J. Huchette, C. Tjan- draatmadja, and J. Vielma. Strong mixed-integer pro- gramming formulations for trained neural networks. In IPCO19, pages 27-42, 2019.","title":"Strong mixed-integer programming formulations for trained neural networks","authors":"R Anderson, J Huchette, C Tjandraatmadja, J Vielma","year":"2019","venue":"IPCO","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bastani et al., 2016] O. Bastani, Y. Ioannou, L. Lampropou- los, D. Vytiniotis, A. V. Nori, and A. Criminisi. Measur- ing neural net robustness with constraints. In NeurIPS16, pages 2613-2621, 2016.","title":"Measuring neural net robustness with constraints","authors":"O Bastani, Y Ioannou, L Lampropoulos, D Vytiniotis, A V Nori, A Criminisi","year":"2016","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Biere et al., 2009] A. Biere, M Heule, and H. Maaren. Handbook of satisfiability, volume 185. IOS press, 2009.","title":"Handbook of satisfiability","authors":"A Biere, H Heule, Maaren","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Botoeva et al., 2020] E. Botoeva, P. Kouvaros, J. Kronqvist, A. Lomuscio, and R. Misener. Efficient verification of neu- ral networks via dependency analysis. In AAAI20, 2020.","title":"Efficient verification of neural networks via dependency analysis","authors":"E Botoeva, P Kouvaros, J Kronqvist, A Lomuscio, R Misener","year":"2020","venue":"AAAI20","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Cheng et al., 2017] C. Cheng, G. Nührenberg, and H. Ruess. Maximum resilience of artificial neural networks. In ATVA17, pages 251-268. Springer, 2017.","title":"Maximum resilience of artificial neural networks","authors":"C Cheng, G Nührenberg, H Ruess","year":"2017","venue":"ATVA","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dathathri et al., 2020] S. Dathathri, K. Dvijotham, A. Ku- rakin, A. Raghunathan, J. Uesato, R. Bunel, S. Shankar, J. Steinhardt, I. Goodfellow, P. Liang, and P. Kohli. Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming. In NeurIPS20, 2020.","title":"Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming","authors":"S Dathathri, K Dvijotham, A Kurakin, A Raghunathan, J Uesato, R Bunel, S Shankar, J Steinhardt, I Goodfellow, P Liang, P Kohli","year":"2020","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Dvijotham et al., 2018] K. Dvijotham, R. Stanforth, S. Gowal, T. Mann, and P. Kohli. A dual approach to scalable verification of deep networks. In UAI, volume 1, page 2, 2018.","title":"A dual approach to scalable verification of deep networks","authors":"K Dvijotham, R Stanforth, S Gowal, T Mann, P Kohli","year":"2018","venue":"UAI","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Ehlers, 2017] R. Ehlers. Formal verification of piece-wise linear feed-forward neural networks. In ATVA17, volume 10482, pages 269-286. Springer, 2017.","title":"Formal verification of piece-wise linear feed-forward neural networks","authors":"R Ehlers","year":"2017","venue":"ATVA","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Fazlyab et al., 2020] M. Fazlyab, M. Morari, and G. J. Pap- pas. Safety verification and robustness analysis of neu- ral networks via quadratic constraints and semidefinite programming. IEEE Transactions on Automatic Control, 2020.","title":"Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite programming","authors":"M Fazlyab, M Morari, G J","year":"2020","venue":"IEEE Transactions on Automatic Control","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Fischetti and Jo, 2018] M. Fischetti and J. Jo. Deep neu- ral networks and mixed integer linear optimization. Con- straints, pages 1-14, 2018.","title":"Deep neural networks and mixed integer linear optimization","authors":"M Fischetti, J Jo","year":"2018","venue":"Constraints","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Julian et al., 2016] K. Julian, J. Lopez, J. Brush, M. Owen, and M. Kochenderfer. Policy compression for aircraft col- lision avoidance systems. In DASC16, pages 1-10, 2016.","title":"Policy compression for aircraft collision avoidance systems","authors":"K Julian, J Lopez, J Brush, M Owen, M Kochenderfer","year":"2016","venue":"DASC","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Katz et al., 2017] G. Katz, C. W. Barrett, D. L. Dill, K. Ju- lian, and M. J. Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In CAV17, pages 97-117, 2017.","title":"Reluplex: An efficient SMT solver for verifying deep neural networks","authors":"G Katz, C W Barrett, D L Dill, K Julian, M J Kochenderfer","year":"2017","venue":"CAV","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Katz et al., 2019] G. Katz, D. A. Huang, D. Ibeling, K. Ju- lian, C. Lazarus, R. Lim, P. Shah, S. Thakoor, H. Wu, A. Zeljic, D. L. Dill, M. J. Kochenderfer, and C. W. Bar- rett. The marabou framework for verification and analysis of deep neural networks. In CAV19, pages 443-452, 2019.","title":"The marabou framework for verification and analysis of deep neural networks","authors":"G Katz, D A Huang, D Ibeling, K Julian, C Lazarus, R Lim, P Shah, S Thakoor, H Wu, A Zeljic, D L Dill, M J Kochenderfer, C W Barrett","year":"2019","venue":"CAV","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Klotz and Newman, 2013] E. Klotz and A. Newman. Prac- tical guidelines for solving difficult mixed integer linear programs. Surveys in Operations Research and Manage- ment Science, 18(1-2):18-32, 2013.","title":"Practical guidelines for solving difficult mixed integer linear programs","authors":"E Klotz, A Newman","year":"2013","venue":"Surveys in Operations Research and Management Science","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"A. Land and A. Doig. An automatic method for solving discrete programming problems. In 50 Years of Integer Programming 1958-2008, pages 105-132. Springer, 2010.","title":"An automatic method for solving discrete programming problems","authors":"A Land, A Doig","year":"2010","venue":"50 Years of Integer Programming 1958-2008","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[LeCun et al., 1998] Y. LeCun, C. Cortes, and C. J. Burges. The mnist database of handwritten digits, 1998.","title":"The mnist database of handwritten digits","authors":"Y Lecun, C Cortes, C J Burges","year":"1998","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Lomuscio and Maganti, 2017] A. Lomuscio and L. Maga- nti. An approach to reachability analysis for feed-forward relu neural networks. CoRR, abs/1706.07351, 2017.","title":"An approach to reachability analysis for feed-forward relu neural networks","authors":"Maganti Lomuscio, ] A Lomuscio, L Maganti","year":"2017","venue":null,"doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Morrison et al., 2016] D. Morrison, S. Jacobson, J. Sauppe, and E. Sewell. Branch-and-bound algorithms: A survey of recent advances in searching, branching, and pruning. Discrete Optimization, 19:79-102, 2016.","title":"Branch-and-bound algorithms: A survey of recent advances in searching, branching, and pruning","authors":"D Morrison, S Jacobson, J Sauppe, E Sewell","year":"2016","venue":"Discrete Optimization","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[P. Henriksen, 2020] A. Lomuscio P. Henriksen. Efficient neural network verification via adaptive refinement and ad- versarial search. In ECAI20, 2020.","title":"Efficient neural network verification via adaptive refinement and adversarial search","authors":"A Lomuscio, P Henriksen","year":"2020","venue":"ECAI20","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Papadimitriou and Steiglitz, 1998] C. Papadimitriou and K. Steiglitz. Combinatorial optimization: algorithms and complexity. Courier Corporation, 1998.","title":"Combinatorial optimization: algorithms and complexity","authors":"C Papadimitriou, K Steiglitz","year":"1998","venue":null,"doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Rössig and Petkovic, 2020] A. Rössig and M. Petkovic. Ad- vances in verification of relu neural networks. Journal of Global Optimization, pages 1-44, 2020.","title":"Advances in verification of relu neural networks","authors":"A Rössig, M Petkovic","year":"2020","venue":"Journal of Global Optimization","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[S. Bak et al., 2020] H. Tran S. Bak, K. Hobbs, and T. John- son. Improved geometric path enumeration for verifying relu neural networks. In CAV20, pages 66-96, 2020.","title":"Improved geometric path enumeration for verifying relu neural networks","authors":"H, Tran S Bak, K Hobbs, T Johnson","year":"2020","venue":"CAV","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Singh et al., 2019] G. Singh, T. Gehr, M. Püschel, and P. Vechev. An abstract domain for certifying neural net- works. POPL19, 3(POPL):1-30, 2019.","title":"An abstract domain for certifying neural networks","authors":"G Singh, T Gehr, M Püschel, P Vechev","year":"2019","venue":"POPL","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Szegedy et al., 2014] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. Intrigu- ing properties of neural networks. In ICLR14, 2014.","title":"Intriguing properties of neural networks","authors":"C Szegedy, W Zaremba, I Sutskever, J Bruna, D Erhan, I Goodfellow, R Fergus","year":"2014","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Tjandraatmadja et al., 2020] C. Tjandraatmadja, R. Ander- son, J. Huchette, W. Ma, K. Patel, and J. Vielma. The con- vex relaxation barrier, revisited: Tightened single-neuron relaxations for neural network verification. In NeurIPS20, 2020.","title":"The convex relaxation barrier, revisited: Tightened single-neuron relaxations for neural network verification","authors":"C Tjandraatmadja, R Anderson, J Huchette, W Ma, K Patel, J Vielma","year":"2020","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Tjeng et al., 2019] V. Tjeng, K. Y. Xiao, and R. Tedrake. Evaluating robustness of neural networks with mixed in- teger programming. In ICLR19, 2019.","title":"Evaluating robustness of neural networks with mixed integer programming","authors":"V Tjeng, K Y Xiao, R Tedrake","year":"2019","venue":"ICLR","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Tran et al., 2020] H. Tran, S. Bak, W. Xiang, and T. John- son. Verification of deep convolutional neural networks using imagestars. In International Conference on Com- puter Aided Verification, pages 18-42. Springer, 2020.","title":"Verification of deep convolutional neural networks using imagestars","authors":"H Tran, S Bak, W Xiang, T Johnson","year":"2020","venue":"International Conference on Computer Aided Verification","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"VNN-COMP. Verification of neural networks competition (vnn-comp20). https://sites.google. com/view/vnn20/vnncomp, 2020. Accessed: 2021-05-29.","title":"Verification of neural networks competition","authors":null,"year":"2021","venue":null,"doi":null,"url":"https://sites.google.com/view/vnn20/vnncomp,2020","internal_url":null},{"position":30,"raw":"[Wang et al., 2018] S. Wang, K. Pei, J. Whitehouse, J. Yang, and S. Jana. Efficient formal safety analysis of neural net- works. In NeurIPS18, pages 6369-6379, 2018.","title":"Efficient formal safety analysis of neural networks","authors":"S Wang, K Pei, J Whitehouse, J Yang, S Jana","year":"2018","venue":"NeurIPS","doi":null,"url":null,"internal_url":null},{"position":31,"raw":"[Weng et al., 2018] L. Weng, G. Zhang, H. Chen, Z. Song, C. Hsieh, L. Daniel, D. Boning, and I. Dhillon. Towards fast computation of certified robustness for relu networks. In ICML18, pages 5276-5285, 2018.","title":"Towards fast computation of certified robustness for relu networks","authors":"L Weng, G Zhang, H Chen, Z Song, C Hsieh, L Daniel, D Boning, I Dhillon","year":"2018","venue":"ICML","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"[Wong and Kolter, 2018] E. Wong and J. Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In ICML18, pages 5286-5295, 2018.","title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","authors":"E Wong, J Kolter","year":"2018","venue":"ICML","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}