LEVIS: Large Exact Verifiable Input Spaces for Neural Networks

2024-08-16

arXiv.org

AI Summary

In safety-critical applications, precisely characterizing the largest verifiably adversarial-free input region ( C ) for neural networks remains challenging due to high dimensionality, non-convexity, and discontinuity. This paper proposes LEVIS, a dual-framework approach: LEVIS-α identifies the largest verifiable ball crossing decision boundaries, while LEVIS-β approximates full coverage of ( C ) via multi-ball fusion. We introduce three novel techniques—collinear/orthogonal directional search, nearest adversarial point localization, and geometric boundary-intersection analysis—integrated with convex relaxation and interval propagation for sound verification. We provide theoretical guarantees on verifiability and convergence. Evaluated on power flow regression and image classification tasks, LEVIS significantly improves verifiable region coverage, enabling robust model selection and reliable control design. Visualization of verification trajectories and quantitative robustness metrics further demonstrate its effectiveness and generalizability.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Search and Retrieval-Augmented AI: Vertical and domain-specific search

Abstract

The robustness of neural networks is paramount in safety-critical applications. While most current robustness verification methods assess the worst-case output under the assumption that the input space is known, identifying a verifiable input space $mathcal{C}$, where no adversarial examples exist, is crucial for effective model selection, robustness evaluation, and the development of reliable control strategies. To address this challenge, we introduce a novel framework, $ exttt{LEVIS}$, comprising $ exttt{LEVIS}$-$alpha$ and $ exttt{LEVIS}$-$eta$. $ exttt{LEVIS}$-$alpha$ locates the largest possible verifiable ball within the central region of $mathcal{C}$ that intersects at least two boundaries. In contrast, $ exttt{LEVIS}$-$eta$ integrates multiple verifiable balls to encapsulate the entirety of the verifiable space comprehensively. Our contributions are threefold: (1) We propose $ exttt{LEVIS}$ equipped with three pioneering techniques that identify the maximum verifiable ball and the nearest adversarial point along collinear or orthogonal directions. (2) We offer a theoretical analysis elucidating the properties of the verifiable balls acquired through $ exttt{LEVIS}$-$alpha$ and $ exttt{LEVIS}$-$eta$. (3) We validate our methodology across diverse applications, including electrical power flow regression and image classification, showcasing performance enhancements and visualizations of the searching characteristics.

Problem

• Identifying verifiable input spaces for neural networks robustness
• Addressing high dimensionality and non-convexity in input spaces
• Developing scalable methods for large exact verifiable regions

Innovation

• Uses mixed-integer programming for adversarial points
• Integrates complementarity-constrained optimization for scalability
• Identifies verifiable balls intersecting multiple boundaries