Verified Relative Safety Margins for Neural Network Twins

2024-09-25

arXiv.org

AI Summary

This work addresses the problem of comparing decision robustness between homogenous neural network classifiers—e.g., a pruned, quantized, or distilled model and its original counterpart. We formally introduce the *Relative Safety Margin* (RSM), a quantitative measure capturing the confidence-level disparity between their decision boundaries on identical inputs, thereby enabling verifiable local implication (N₂ ⇒ N₁). Methodologically, we integrate convex relaxation, interval propagation, and class-boundary sensitivity analysis to derive rigorous upper and lower bounds on RSM over input perturbation sets. Unlike conventional equivalence verification, RSM enables fine-grained, quantitative, and formally provable robustness comparison. Experiments on MNIST, CIFAR-10, and two medical imaging datasets demonstrate RSM’s effectiveness across pruning, quantization, and knowledge distillation. The approach significantly improves both accuracy and interpretability in assessing decision consistency and quality of compressed models.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Security and Privacy: Large-scale security measurements
• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• Search and Retrieval-Augmented AI: Web evaluation methodologies and metrics

Abstract

Given two Deep Neural Network (DNN) classifiers with the same input and output domains, our goal is to quantify the robustness of the two networks in relation to each other. Towards this, we introduce the notion of Relative Safety Margins (RSMs). Intuitively, given two classes and a common input, RSM of one classifier with respect to another reflects the relative margins with which decisions are made. The proposed notion is relevant in the context of several applications domains, including to compare a trained network and its corresponding compact network (e.g., pruned, quantized, distilled network). Not only can RSMs establish whether decisions are preserved, but they can also quantify their qualities. We also propose a framework to establish safe bounds on RSM gains or losses given an input and a family of perturbations. We evaluate our approach using the MNIST, CIFAR10, and two real-world medical datasets, to show the relevance of our results.

Problem

• Comparing two neural networks over entire input regions
• Establishing formal local implication between network classifiers
• Verifying consistent correct decisions across input domains

Innovation

• Formal local implication for neural networks
• Sound formulation for verified implications
• Comparing original and compact network versions