Reachability Analysis for Feed-Forward Neural Networks using Face Lattices

2020·Arxiv

Abstract

Abstract

Deep neural networks have been widely applied as an effective approach to handle complex and practical problems. However, one of the most fundamental open problems is the lack of formal methods to analyze the safety of their behaviors. To address this challenge, we propose a parallelizable technique to compute exact reachable sets of a neural network to an input set. Our method currently focuses on feed-forward neural networks with ReLU activation functions. One of the primary challenges for polytope-based approaches is identifying the intersection between intermediate polytopes and hyperplanes from neurons. In this regard, we present a new approach to construct the polytopes with the face lattice, a complete combinatorial structure. The correctness and performance of our methodology are evaluated by verifying the safety of ACAS Xu networks and other benchmarks. Compared to state-of-the-art methods such as Reluplex, Marabou, and NNV, our approach exhibits a significantly higher efficiency. Additionally, our approach is capable of constructing the complete input set given an output set, so that any input that leads to safety violation can be tracked.

1 Introduction

Deep neural networks (DNNs) have been playing a critical role in handling complex and practical problems and are being widely applied in safety-critical, autonomous cyber-physical systems (CPS). However, one major obstacle in realizing autonomous CPS is the lack of formal methods to provide guarantees on functional behaviors, such as in safety-critical systems like autonomous motor vehicles and robotic surgery machines. A slight perturbation in the input of a neural network may lead to an error behavior in output [13]. Recently, there has been significant effort to develop methods to establish robustness and formal guarantees of learning-enabled components (LECs) like DNNs [14,6,3,1,8,23,24,21,25,16,17,20,18,19]. There are two primary classes of reachability methodologies to formally analyze DNNs, over-approximation and exact (or complete) analysis. The over-approximation methods are mainly based on mixedinteger linear programs (MILPs) [11,1,10], zonotopes [3], abstract domain [17], and linearization [22,25]. These methods can only guarantee the soundness of the analysis but not completeness. The MILPs-based work [1] can guarantee both aspects when neural networks have only one output, but fails when they have multiple outputs. Because it estimates the range of outputs independently and eventually generates a box domain that over approximates exact reachable sets. Most of the over-approximation methods are capable of efficiently analyzing large scales neural networks based ReLU activation functions. Their main strategy is replacing each ReLU function with a more conservative domain so that the number of output reachable sets of each layer can be largely reduced. But these approaches are only limited to point-wise inputs with a very little perturbation, and their conservativeness of the estimated reachable sets will exponentially grow as the input domain increases. This is already studied in [19].

While the exact analysis is mainly based on the satisfiability modulo theory (SMT) [8,9], polytopes [23] and Star set in a tool named NNV [19]. Through these approaches, both soundness and completeness of the verification can be guaranteed. The strategy of Reluplex [8] is extending the simplex method to handle the piece-wise linear ReLU activation function by allowing variables of defined ReLU pairs to temporarily violate their semantics. The Marabou [9] is an improved version of Reluplex. It supports arbitrary piecewise-linear activation function, parallel computation, etc. Another work ReluVal [21] is based on interval arithmetic to over approximate the bounds on the outputs. The influence of each input variable on the output is analyzed so that it can repeatedly split the input intervals and efficiently refine the output range. All these works focus on the satisfiability problem that is to determine whether there exists output that locates in the unsafe domain. While the works [23,19] are conducting the reachability analysis of a neural network. Given an input set, they can compute the exact output sets of a neural network. This reachability analysis is also associated with the quantification of linear regions of neural networks [12,15,4]. A linear region of a piecewise linear functions refers to a maximum convex subset of an input set in , on which the function F is linear. Accordingly, the input set is splitted by the ReLU function in each neuron into pieces which are linear regions. Each output set of a network computed by [23,19] corresponds to the output with respect to a linear region. Therefore, the number of output sets computed is equal to the number of linear regions. These methods can provide a full understanding of the neural network’s behavior and are promising directions towards safe networks.

However, improvement of the efficiency is challenging. The work [23] is constructing the input set with a polytope. It has three basic operations when a polytope passes through one layer of a neural network. They are respectively, affine transformation by the weight matrix and bias vector between layers, intersection and division by hyperplanes from the non-differentiable point at 0 in ReLU function of each neuron, and projection on the hyperplane due to the property of the negative domain in ReLU function. One of the primary challenges is to identify the intersection of a polytope with a hyperplane. To solve this problem, they use H-representation (H-rep) which is a set of linear inequalities to check the feasibility with another linear inequality from the hyperplane. This computation is treated as a linear programming problem. For the affine transformation and projection, the H-rep is transformed to V -representation (V -rep) which is a set of vertices. However, the change between H-rep and V -rep are respectively a vertex enumeration problem and a facet enumeration problem in computational geometry, both of which have high computational complexity. Therefore, the constant representation switching and feasibility inspecting lead to undesirable efficiency. The work [19] proposed the Star set which can avoid the transformation between H-rep and the V -rep. Instead, it identifies the intersection using optimization. But a large number of neurons will yield too many optimization processes and therefore impact its efficiency.

As a complementary approach, we present a novel face-lattice-based and parallelizable methodology that is capable of the sound and complete reachability analysis with higher efficiency. This method currently focuses on feed-forward neural networks with ReLU activation. To overcome the challenge, we develop an intuitive approach that is to inspect the distribution of a polytope’s vertices on the sides of the hyperplane. If vertices scatter on both sides of or on the hyperplane, the intersection happens. Otherwise, it doesn’t. The following problem is how to identify polytopes and their vertices generated from this intersection so that their complete structure information can be maintained for future operations. Here, we introduce the face lattice to encode the complete combinatorial structure for polytopes and preserves the adjacency between faces of the polytope, so that those three types of operations on polytopes can be more efficiently conducted.

2 Preliminaries

2.1 Feedforward Neural Networks

A FNN consists of one input layer, multiple hidden layers, and one output layer. Each layer contains multiple neurons which are interconnected with neurons in the next layer by weights in a feed-forward way. The output of each neuron is associated with three components: its input weight , input bias b and the activation function f, as shown in:

where and are respectively the weight and bias from the jth neuron of the previous layer to the ith neuron of the current layer, and is an input to this neuron and also the output of jth neuron in the front layer, and is the output of the ith neuron. In this paper, we consider the ReLU activation which is defined as ReLU(x) = max(0, x). Let denote the weight matrix, the bias vector between the (k-1)th layer and kth layer, and be its input consisting of elements , then the output of the kth layer will be

For the first hidden layer, its input is also the input to the network. Besides, the output of one layer is also an input of the next layer. Therefore, given an input , the output of the kth hidden layer will be

2.2 Face Lattices

The geometric background of the face lattice structure is introduced in this section. It includes the concepts of supporting hyperplane, faces of polytopes as well as the properties of this structure. More other geometric details can be found in work [5].

Definition 1 (Supporting Hyperplane). A hyperplane H denoted by ais supporting polytope P if one of its closed halfspaces, aor acontains P.

Definition 2 (Face). The face of a convex polytope is an intersection of this polytope with a supporting hyperplane. When the polytope is full dimensional, the face is named a nontrivial face. The polytope itself and the empty set are also its faces which are called trivial faces. When the dimension of is k, the face is denoted as k-f or k-face. The function aff(S) indicates the affine hull of S, which is the smallest affine set that contains S.

A d-dimensional convex polytope P is called full dimensional if it locates in , otherwise it is not full dimensional if it is in . The convex polytope P consists of different dimensional daces. Regardless of P’s dimension and the space it locates in, it contains a set of 0-faces, 1-faces, . . . , (d-2)-faces, (d-1)- faces as well as the empty set and itself. The 0-face, 1-face, (d-2)-face and (d-1)- face are respectively named vertex, edges, ridges and facets.

The face lattice L(P) is a complete combinatorial structure that contains all faces of P and partially orders them by face containment. One face is said to contain a face if the is a subset of the . A tetrahedron and its face lattice are shown in (a) and (b) of Figure 1. The empty face is not considered for a conciser presentation. Besides the 3-face which is the tetrahedron itself, there are 14 faces described by blue blocks and their dimension ranges from 0 to 2. The face containment only consider higherdimensional faces containing adjacent lower-dimensional faces. For instance, the () contains ) and ), and the is contained in ) and ). The containment relation is expressed in a grey connection line. All the polytopes refer to convex polytopes that are expressed in the face lattice structure in the following sections

3 Operations of Polytopes

As discussed in the introduction, there are three basic operations in processing polytopes in the neural network. In terms of the sequential order, they are respectively, the affine transformation by weights, intersection and division by a hyperplane H, and the projection on H. The affine transformation is mapping the current polytope to another space. The combinatorial theory considers polytopes that differ only by a change of coordinates (an affine transformation) are equivalent [5]. The main reason is that the affine transformation only changes vertices but preserve polytopes’ combinatorial structure. Therefore, its face lattice stays unchanged under this transformation. The projection on a hyperplane is orthogonally mapping the polytope on this hyperplane. Similarly to the affine transformation, it only works on its vertices. The rest of this section only focuses on the intersection and division.

3.1 Intersection of Face Lattices with Hyperplanes

Since the face lattice contains all the information of faces adjacency, determination of an intersection between a polytope P and a hyperplane H can be simplified to finding the

Fig. 1: A demonstration of the face lattice of a tetrahedron P and its intersection and division. by a hyperplane H. In (b), the blocks filled with blue and connected by grey lines is its face lattice which structure is based on the Hasse diagram. The number of each entry represents the face’s dimension. The grey connection only allows that highdimensional faces contain low-dimensional faces. The blocks with red frames and blue color are the faces intersecting with H in P, which are extracted from positive and negative vertices in terms of the Lemma 1. The face lattice of new generated faces is in red, which is extracted according to the Lemma 2. The red connection between blue blocks and red blocks denote the containment relation between faces in P and new faces. (c) and (d) represent the face lattice of the positive and negative polytopes, respectively.

intersection of edges in P with H. It then can be realized by checking the distribution of edges’ vertices on the side of H. Let the H be described by a. To compute the vertices’ distribution, we can substitute the x with vertices. Let vertices such that ax are greater than 0, smaller than 0, and equal to 0 be respectively called positive vertices vertices , and zero vertices . Accordingly, there are three cases in the intersection and division:

(1) There exist both and . In this case, the hyperplane H intersects with P, and a set of new faces of dimensions between 0 and (d-1) are generated, where and for all . The original polytope is thus divided into two non-empty sub-polytopes which consists of nonnegative vertices, and which consists of nonpositive vertices.

(2) There are no s. In such cases, polytope P is contained in the closed halfspace a. The sub-polytops generated from this operation is the P itself. It is a positive polytope

(3) There are no s. In such cases, polytope P is contained in the closed halfspace a. The sub-polytops generated from this operation is also the P itself. It is a negative polytope

Here we focus on the first case where the intersection occurs. To identify those two sub-polytopes, we first need to find the faces of P that yield the in the intersec- tion. Edges with both positive and negative vertices or at least having one zero vertex are said to have intersection with the hyperplane H. In terms of the Lemma 1, higherdimensional faces that also intersect with the H can be identified from these edges. Thus all faces of P that intersect with H are obtained. Intersecting with H, each of such face will generate a new face that is one-dimension lower. These new faces the . The process is demonstrated in the (b) of Figure 1. For instance, the ) intersects with H and generates a new face ) whose vertices ) and ) are respectively generated from the intersection of H with () and ) .

Lemma 2 states that the face containment relation of the new faces is inherited from faces’ in the polytope. An example is shown in (b) of Figure 1. The red blocks represent the new faces set , and the red connection between the red blocks represent the inherited face containment relation. For instance, the relation that the new face () contains the new face ) is derived from the relation that () contains ) in P. Overall, these two steps in intersection generate a new face lattice that includes all the faces of P and all the new generated faces . Then as shown in (c) and (d), the division is splitting this face lattice into the and according to vertices.

Lemma 1. If a k-f(k-dimensional face) intersects with a hyperplane H, all the (k+1)-fs where also intersect with H.

Proof. indicates . Since , then . Therefore, (k+1)-f also intersect with H.

Lemma 2. Given two faces k-f and (k+1)-f where , and that they both intersect with a hyperplane H where and , then .

Proof. indicates . Therefore, can be derived.

4 Reachability Analysis with Face Lattices

In this section, we use and to represent the input and output polytope sets of the kth layer. By substituting the with , and the output with in the Equation 1, we obtain

which indicates the three basic operations on polytopes. The operation on inside the parentheses is the affine transformation. The function indicates a sequence of intersection and division, and projection on the transformed polytope. As claimed in the abstract, our approach can derive the complete input set given an output set. It is realized by incorporating the transformation tuple in Definition 3 to maintain mathematical relation between an intermediate polytope and a subset of the initial input to the neural network. Thus, any violation of safe properties in output can be mapped back into the input. From the perspective of the linear region presented in Introduction section, the Equation 3 is one linear function and is one linear region.

Definition 3 (Transformation Tuple). Given an input polytope to the neural network and a polytope , a transformation tuple is denoted by where , such that

4.1 Processing of Transformation Tuple

Take the output computation of the first layer for example, suppose we have an initial input , then its transformation tuple can be initialized as where is an identity matrix, and is an array of zeros. After the affine transformation by weights and , the stays unchanged and the tuple will be updated to , where

Let be this updated tuple. Afterwards, the intersection and division operation will be conducted on this new tuple for each neuron in this layer. Suppose we start by processing the first neuron, we can first derive a hyperplane x where ais an array with its first element a[1] = 1 and the rest being zeros, and . When considering the ithe neuron, the a[i] = 1 and the rest keeps the same. According to the ReLU function, the subset of that is in the closed halfspace ax stays unchanged. For the subset that is in the closed halfspace ax, all its x[1] is set to 0. These subsets can be identified by the intersection operation. Instead of determining the intersection of with , we choose to check the intersection of its with a mapped-back hyperplane from by Equation 5 and 6. This approach is directly operating the initial input subset , which is helpful for the further computation. Besides, the intersection and division on the is also the process of splitting and generating linear regions.

The method of mapping into the space of and obtaining is as following. From the Equation 3, we can derive that

where xand x. By combining this equation with , we have

Thus, we can obtain the mapped hyperplane x, where aand .

During the intersection and division operation, the processing of the tuple depends on different cases. In the first case, will be splitted into two polytopes and by the hyperplane . Correspondingly, the original tuple of will also be splitted and we achieve

According to the property of the ReLU function, stays unchanged and no projection operation is needed. While the points of the should be mapped to the where the first element x[1] of them will be changed to zero. As shown in the following equation, this operation can be realized by left multiplying with where is an identify matrix with the first diagonal entry being zero. When processing with the ith neuron, will be an identify matrix with ith diagonal entry being zero.

After the projection, the , where

While in the second case, only is generated from the intersection and division on . Then and no projection operation is needed. In the third case, only is generated where . The projection is applied though Equation 7 and 8. Overall, the first case yields two intermediate polytopes and . The second and third cases respectively yields and .

This process is computing the output of one neuron, which is denoted by in Equation 9. Afterward, these output polytopes will be the input to the next neuron, This process is repeated until all the neurons in the first layer are considered. Then the polytopes obtained are the output of the first layer. The computing output of one layer to its inputs is denoted by . For a formal description, let represent the sequence of affine transformation, intersection and division, and projection for the jth neuron in the kth layer, and be the output set of this layer with respect to an input set to this layer, then we have

. Let be the process of Equation 9, and be the output of the kth layer to an input to the network, then we have

4.2 Mapping Back to Input

Let the unsafe range of output be a set of halfspaces x . Suppose we have an output polytope . Similarly with the Equation 5, we have

By combining with this equation, we can derive that

and that aand are parameters of the mapped halfspace in the ’s space. To determine unsafety, we can check the existence of vertices that are contained in the mapped halfspaces. To extract the unsafe set in the input , we can apply a series of the intersection and division operations to the s (linear regions) with the . Negative polytopes generated from such operation are the input sets that violate the safety requirement.

4.3 Parallelizable Algorithm

Two potential parallelizable algorithms are proposed in this section based on the fact that input polytopes to one network layer are independent. One is processing in parallel all the input polytopes to one layer until all their output is completed, and then repeating this procedure to the following layers until the final output of the neural network is achieved. This strategy is described in Algorithm 1 where it is parallelized by replacing for with parfor in Line 5. To simplify this presentation, we assume that the output layer of neural networks is also with ReLU function . Accordingly, when n is the number of layers in the neural network, the output of this algorithm is the final reachable set of the neural network. The description of functions are as following:

(1) layerOutput() corresponds to the Equation 10. The and corresponds to the symbols in Equation 9 and 10, respectively.

(2) singleLayerOutput() corresponds to the Equation 9.

(3) linearTransform() corresponds to the Equation 4. The P is an element polytope, and the is initialized with the transformed P.

(4) intersectDivide() corresponds to the operation of intersection and division. by a hyperplane as shown in the (b), (c) and (d) of Figure 1. Its output are one positive sub-polytope and one negative sub-polytope .

(5) projectionHyerplane() corresponds to the projection of the negative sub-polytopes on a hyperplane determined by the ith neuron, as shown in Equation 7.

However, when programmed in Python using its embedded multiprocessing package, this parallel algorithm will suffer from a computational burden due to copying the parent process memory in the computation of each layer. It means that when the function singleLayerOutput() is invoked in parallel, the memory in the parent process will be copied to those multiple created children processes. This memory copying occurs in each network layer and leads to an extra-large computational burden. This phenomenon is significant when there is a large number of polytopes in .

Therefore, an alternative method is inherited from the first one to handle that situation. Instead of processing polytopes in parallel in each layer, we choose to start processing them in parallel from a specific layer. The details are illustrated in Algorithm 2. It first computes the output polytopes of the j layer to the input by invoking the function layerOutput in Algorithm 1. Then, the algorithm from Line 3 to the end will be executed. In this process, the memory copying only happens once in Line 3 with a relatively smaller number of polytopes in . Therefore, it outperforms Algorithm 1. For the complexity, the maximum number of output sets that both of algorithms can compute for a network with total m hidden neurons and one input set is . In practice, the actual number is much smaller since the intersection and division doesn’t really split intermediates polytopes in every neuron.

5 Evaluation

5.1 Safety Verification of ACAS Xu Networks

In this section, we evaluate our method against the Reluplex, Marabou, and NNV. They are currently well-known approaches that also do the exact reachability analysis of feed-forward neural networks with ReLU activation functions. The evaluation task is to verify the safety of ACAS Xu networks in [7]. Given an input domain and an unsafe domain, Reluplex and Marabou solve the satisfiability problem, which is they only determine if there are outputs satisfying unsafe conditions. While our method and NNV are computing all the exact reachable sets of the output and then determining their intersection with the unsafe area.

The ACAS Xu networks are used to approximate a large lookup table that converts sensor measurements into maneuver advisories in an Airborne Collision Avoidance System so that the massive memory occupation by the table and the lookup time can be reduced. The set of networks contain 45 fully-connected DNNs for different combinations of discretized parameters. Each one has five inputs, five outputs, and six hidden layers. Each layer consists of fifty neurons with ReLU activation functions. Therefore there are 300 hidden neurons total in each network. The five inputs consist of the sensor measurements: (1) : Distance from ownship to intruder; (2) : Angle to intruder relative to ownship heading direction; (3) : Heading angle of intruder relative to ownship heading direction; (4) : Speed of ownship; (5) : Speed of intruder. The outputs are advisory scores for five different actions, where the lowest score corresponds to the best action. The five actions are respectively, clear of conflict (COC), weak right, strong right, weak left, and strong left. There are ten safety properties which specify input bounds and linear constraints on the output. The details can be found in the Appendix of [8].

In the experiment, All the 45 networks are tested on Property 1,2,3 and 4. The hardware configuration is Intel Core i7-6700 CPU @3.4GHz8 Processor, 64 GB Memory, 64-bit Ubuntu 18.043. The summary of results are shown in Table 1. The details are shown in Table 3,4,5 and 6 in Appendix. In the implementation, Marabou DNC, NNV, ReluVal and our method that support parallel computation are all assigned with 8 processors. While Reluplex and Marabou is implemented in a nonparallel way. The following is the evaluation of each method:

– Reluplex: As the summary indicates, Reluplex exhibits a relatively lower efficiency compared to other methods. Besides, an incorrect result is found in our implementation. The test on the and Property 2 identifies an adversarial input that generates an output . While the desired output for Property 2 is that the score for COC (the first element of output) is not maximum. Clearly, this output doesn’t violate this condition.

– Marabou: For the performance of Marabou, It shows an improvement in the effi-ciency compared to Reluplex. But It still takes a significant time to complete tasks. Its scalability to larger and deeper neural networks is unclear.

– Marabou DnC: It is a divide-and-conquer solving mode of the Marabou, where the input range is partitioned into sub-ranges. Compared to Reluplex and Marabou, it shows a higher efficiency on Property 1 and 2. However, it fails to outperform them on Property 3 and 4. This performance inconsistency is related to its configuration. Its configuration consists of parameters such as initial-divides and online divides flags which are the number of times to bisect the input region. Such parameters can greatly affect performance. Besides, their optimal selection differs between different networks. Therefore, their optimal performance can’t be always achieved. The parameters we applied for this implementation are the default values.

– ReluVal: Compared to other tools, it exhibits a higher efficiency in some cases such as Property 1, but it can be very slow in other cases such as Property 2. Its performance is also inconsistent. ReluVal is constructed with two modes, CHECK ADV MODE and CHECK NORM MODE. The first mode can quickly breathe search for counter-examples but it can’t guarantee to identify them if they truly exist. While the second mode can return adversarial examples if exist but its high efficiency can’t be guaranteed. As recommended by their authors, The first mode is applied in the beginning. For those tasks without finding adversarial examples, the second mode is then applied. But the performance of the second mode can be greatly affected by its parameters in the configuration. For instance, the parameter ”depth” indicates from which depth the algorithm should start checking adversarial examples. Its optimal value also differs between networks. Thus, its optimal performance can’t be guaranteed. The parameters we utilized are default values for this experiment.

– NNV Exact Star: It shows high efficiency in Property 3 and 4 but fails to complete most of the tasks in Property 1 and 2. As introduced in the beginning, this inconsistency is probably related to the optimization processes involved in the computation of output sets.

– Face Lattice: Our method shows a relatively higher and more consistent efficiency. In Property 1, our method fails to outperform ReluVal because we compute the exact output sets first and then solve the satisfiability problem while the large input range of Property 1 yields a significant number of linear regions to compute. However, the output sets obtained from the test on Property 1 can be reused for Property 2 where networks have the same output reachable sets.

In addition to the high efficiency, our approach can also visualize the exact reachability of a neural network so that an intuitive inspection can first be conducted for safety

Table 1: Summary of the performance of each method on Property 1,2,3 and 4. The SAT means there exists output that satisfies the unsafe condition, which indicates that the neural network is unsafe. While the UNSAT means that there doesn’t exist such output, which indicates the network is safe. The TIMEOUT is set to 5h for all the tasks. The TIME represents the total running time (seconds) of one method on 45 networks.

properties. An example of the exact reachable set of the network is demonstrated in Figure 2, whose lower bound and upper bound of the input are [1500, -0.06, 3.1, 1000, 700] and [1800, 0.06, 3.14, 1200, 800]. Additionally, 2000 random inputs are sampled to demonstrate the method’s correctness. The reachable sets are visualized separately in two figures. With such output sets, we can verify different safety properties, instead of running the algorithm repeatedly for each property as Reluplex and Marabou do. Besides, our method can also compute the exact input set that leads to property violations. For instance, the inputs that make the network violate Property2 are computed as shown in Figure 3. It is a union of 104 polytopes. The element belonging to these polytopes will yield property violations. For the element that doesn’t belong to them but are contained in the input range, they won’t cause any violation.

5.2 Reachability Analysis of Microbenchmarks

To further evaluate our approach, we compare them on a set of microbenchmarks that are proposed in work [2]. These benchmarks consisting of neural networks are created from two different sources. The networks are trained with some analytical functions. While the networks come from the unwindings of a closed-loop

Fig. 2: Exact reachable set of the network on Property 4. The blue star points are the output w.r.t. 2000 random input samples. They all locate on or inside the output sets.

Fig. 3: Complete input sets that lead to the property violation on the network . It is a union of 104 polytopes.

controller and a plant model. Here we check these networks’ safety on some synthetic unsafe domains. Only Marabou DnC and NNV are considered because they support parallel computation. ReluVal is not included as we are not able to apply ReluVal to these new networks. Problems have been reported to the author but haven’t been solved. For the networks which have only one hidden layer, we equally partition the input range for our method and NNV into 1024 subsets, so that the parallel computation can be applied. The details of each benchmark and the performance of each approach are shown in Table 2. Most of the networks consist of thousands of neurons. Dealing with such a large size of networks, our approach also exhibits a high efficiency. While other methods fail to complete all the tasks.

Table 2: Performance results on microbenchmarks. The label x, k and m respectively denote the number of input, the number of layers and total number of ReLU neurons. is the number of output reachable sets and time(second) is the running time. The TIMEOUT is set to 10 hours.

6 Conclusion and Future Work

The exact reachability analysis of neural networks is a hard problem, but it is essential to conducting robustness verification. In this paper, we presented a polytope-based and parallelizable method to conduct exact reachability analysis of the feed-forward neural networks with ReLU activation. Instead of using the H and V representations, we construct polytopes with the face lattice, a structure encoding complete combinatorial information. Through comparing to state-of-the-art methods like Reluplex, Marabou, NNV, and ReluVal, we can verify its correctness and high efficiency. As discussed, the exact reachable set can be reusable for different properties. The comparison includes the verification of a set of real-world ACAS Xu neural networks and the reachability computation of some other benchmarks. To improve the efficiency and convenience, we can also partition a wide-range input into smaller subsets and build a library for their reachable sets so that further analysis of any input contained in such range can be reduced to merely looking up the library. Overall, there are multiple directions to improve our approach. In the future, we plan to explore more concise and efficient polytope representations than the face lattice because it becomes complicated for high dimensional polytopes. Another potential enhancement is to detect the polytopes in the input set that determine the output range so that the redundant polytopes can be ignored and the computation burden can be reduced. Additionally, we also consider extending our approach to convolutional neural networks (CNNs) in the future.

References

1. Dutta, S., Jha, S., Sanakaranarayanan, S., Tiwari, A.: Output range analysis for deep neural networks. arXiv preprint arXiv:1709.09130 (2017)

2. Dutta, S., Jha, S., Sankaranarayanan, S., Tiwari, A.: Output range analysis for deep feed- forward neural networks. In: NASA Formal Methods Symposium. pp. 121–138. Springer (2018)

3. Gehr, T., Mirman, M., Drachsler-Cohen, D., Tsankov, P., Chaudhuri, S., Vechev, M.: Ai2: Safety and robustness certification of neural networks with abstract interpretation. In: 2018 IEEE Symposium on Security and Privacy (SP). pp. 3–18. IEEE (2018)

4. Hanin, B., Rolnick, D.: Complexity of linear regions in deep networks. arXiv preprint arXiv:1901.09021 (2019)

5. Henk, M., Richter-Gebert, J., Ziegler, G.M.: 16 basic properties of convex polytopes. Hand- book of discrete and computational geometry pp. 255–382 (2004)

6. Huang, X., Kwiatkowska, M., Wang, S., Wu, M.: Safety verification of deep neural networks. In: International Conference on Computer Aided Verification. pp. 3–29. Springer (2017)

7. Julian, K.D., Lopez, J., Brush, J.S., Owen, M.P., Kochenderfer, M.J.: Policy compression for aircraft collision avoidance systems. In: Digital Avionics Systems Conference (DASC), 2016 IEEE/AIAA 35th. pp. 1–10. IEEE (2016)

8. Katz, G., Barrett, C., Dill, D.L., Julian, K., Kochenderfer, M.J.: Reluplex: An efficient smt solver for verifying deep neural networks. In: International Conference on Computer Aided Verification. pp. 97–117. Springer (2017)

9. Katz, G., Huang, D.A., Ibeling, D., Julian, K., Lazarus, C., Lim, R., Shah, P., Thakoor, S., Wu, H., Zelji´c, A., et al.: The marabou framework for verification and analysis of deep neural networks. In: International Conference on Computer Aided Verification. pp. 443–452. Springer (2019)

10. Kouvaros, P., Lomuscio, A.: Formal verification of cnn-based perception systems. arXiv preprint arXiv:1811.11373 (2018)

11. Lomuscio, A., Maganti, L.: An approach to reachability analysis for feed-forward relu neural networks. arXiv preprint arXiv:1706.07351 (2017)

12. Montufar, G.F., Pascanu, R., Cho, K., Bengio, Y.: On the number of linear regions of deep neural networks. In: Advances in neural information processing systems. pp. 2924–2932 (2014)

13. Moosavi-Dezfooli, S.M., Fawzi, A., Frossard, P.: Deepfool: a simple and accurate method to fool deep neural networks. In: Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition. pp. 2574–2582 (2016)

14. Pulina, L., Tacchella, A.: An abstraction-refinement approach to verification of artificial neu- ral networks. In: International Conference on Computer Aided Verification. pp. 243–257. Springer (2010)

15. Serra, T., Tjandraatmadja, C., Ramalingam, S.: Bounding and counting linear regions of deep neural networks. arXiv preprint arXiv:1711.02114 (2017)

16. Singh, G., Gehr, T., Mirman, M., P¨uschel, M., Vechev, M.: Fast and effective robustness cer- tification. In: Advances in Neural Information Processing Systems. pp. 10825–10836 (2018)

17. Singh, G., Gehr, T., P¨uschel, M., Vechev, M.: An abstract domain for certifying neural net- works. Proceedings of the ACM on Programming Languages 3(POPL), 41 (2019)

18. Tran, H.D., Musau, P., Lopez, D.M., Yang, X., Nguyen, L.V., Xiang, W., Johnson, T.T.: Paral- lelizable reachability analysis algorithms for feed-forward neural networks. In: Proceedings of the 7th International Workshop on Formal Methods in Software Engineering. pp. 31–40. IEEE Press (2019)

19. Tran, H.D., Musau, P., Lopez, D.M., Yang, X., Nguyen, L.V., Xiang, W., Johnson, T.T.: Star- based reachability analsysis for deep neural networks. In: 23rd International Symposisum on Formal Methods (FM’19). Springer International Publishing (October 2019)

20. Wang, S., Pei, K., Whitehouse, J., Yang, J., Jana, S.: Efficient formal safety analysis of neural networks. In: Advances in Neural Information Processing Systems. pp. 6369–6379 (2018)

21. Wang, S., Pei, K., Whitehouse, J., Yang, J., Jana, S.: Formal security analysis of neural networks using symbolic intervals. In: 27th {USENIX} Security Symposium ({USENIX} Security 18). pp. 1599–1614 (2018)

22. Weng, T.W., Zhang, H., Chen, H., Song, Z., Hsieh, C.J., Boning, D., Dhillon, I.S., Daniel, L.: Towards fast computation of certified robustness for relu networks. arXiv preprint arXiv:1804.09699 (2018)

23. Xiang, W., Tran, H., Johnson, T.: Reachable set computation and safety verification for neural networks with relu activations. arXiv preprint arXiv:1712.08163 (2017)

24. Xiang, W., Tran, H., Johnson, T.: Output reachable set estimation and verification for multi- layer neural networks. IEEE transactions on neural networks and learning systems (99), 1–7 (2018)

25. Zhang, H., Weng, T.W., Chen, P.Y., Hsieh, C.J., Daniel, L.: Efficient neural network ro- bustness certification with general activation functions. In: Advances in Neural Information Processing Systems. pp. 4944–4953 (2018)

Table 3: Property 1

Table 4: Property 2

Table 5: Property 3

Table 6: Property 4