Differential Zonotopes for Verifying Global Robustness of DNNs

2026-06-19

AI Summary

Verifying global robustness of deep neural networks—defined as the requirement that any two perturbed inputs should not yield highly confident yet inconsistent predictions—is a computationally challenging 2-safety problem. This work proposes a static analysis method based on differential halo zonotopes, which extends the zonotope abstract domain to jointly propagate pairs of inputs and tightly capture their differences. By incorporating a confidence-aware mechanism that disregards low-confidence discrepancies, the approach defines a more practical notion of global robustness under symmetric confidence constraints. The implemented tool, TwoSafe, significantly outperforms existing methods on standard benchmarks, achieving breakthroughs in both precision and scalability, and for the first time enables verification of network models an order of magnitude larger than those previously supported.

Abstract

The robustness of deep neural networks (DNNs) is critical in security-sensitive applications, where small input perturbations should not alter model predictions. This property is commonly formalized as local or global robustness: the former considers perturbations around a single input, while the latter -- strictly stronger -- quantifies over all input pairs. While local robustness can be expressed as a safety property, global robustness is a 2-safety property, making it substantially more challenging to verify. We present a novel static analysis technique for verifying the global robustness of DNNs. Our approach is based on differential halo zonotopes, a new abstract domain that extends zonotopes to jointly propagate pairs of perturbed inputs in lock-step while tightly bounding their divergence. In addition, we introduce a symmetric variant of confidence-based global robustness that disregards perturbations leading to differing but low-confidence predictions. This relaxation yields a practically meaningful notion of robustness that applies to a broader class of networks. We implement our approach in a new tool, called TwoSafe, and evaluate it on standard DNN verification benchmarks, including widely deployed models. Our results show that TwoSafe significantly outperforms the state of the art in both precision and scalability, enabling the verification of networks an order of magnitude larger than those handled by prior techniques.

Problem

• global robustness
• deep neural networks
• verification
• 2-safety property
• input perturbations

Innovation

• differential zonotopes
• global robustness
• 2-safety
• abstract interpretation
• neural network verification