Fast SDP certification of neural networks : towards large multi-class datasets

2026-07-03

AI Summary

This work addresses the high computational cost in verifying adversarial robustness of multi-class neural networks, which traditionally requires separate optimization for each target class. To overcome this limitation, the authors propose a unified quadratic model that jointly verifies all target classes through a single semidefinite programming (SDP) relaxation. The approach introduces an active neuron pruning strategy to reduce problem dimensionality and accelerate SDP convergence. Notably, this is the first method to handle all output classes simultaneously within a single optimization framework, substantially improving verification efficiency. Experimental results demonstrate that the proposed technique significantly speeds up robustness certification, enabling SDP-based verification to scale to large-scale multi-class datasets.

Abstract

We present a new quadratic model for the certification problem in adversarial robustness, which simultaneously accounts for all possible target classes. Building on this model, we propose a novel semidefinite programming (SDP) relaxation for incomplete verification. A key advantage of our approach is that it certifies robustness in a single optimization, avoiding the need for a separate resolution per class. This yields a significant computational speed-up and enables scalability to large datasets with many classes. To further improve efficiency, we also propose an effective pruning strategy of active neurons, thus reducing the problem dimensionality and accelerating convergence.

Problem

• adversarial robustness
• neural network certification
• semidefinite programming
• multi-class datasets
• scalability

Innovation

• semidefinite programming
• adversarial robustness
• multi-class certification
• quadratic model
• neuron pruning