Architecture-Preserving Provable Repair of Deep Neural Networks
arXiv:2304.03496 · doi:10.1145/3591238
Abstract
Deep neural networks (DNNs) are becoming increasingly important components of software, and are considered the state-of-the-art solution for a number of problems, such as image recognition. However, DNNs are far from infallible, and incorrect behavior of DNNs can have disastrous real-world consequences. This paper addresses the problem of architecture-preserving V-polytope provable repair of DNNs. A V-polytope defines a convex bounded polytope using its vertex representation. V-polytope provable repair guarantees that the repaired DNN satisfies the given specification on the infinite set of points in the given V-polytope. An architecture-preserving repair only modifies the parameters of the DNN, without modifying its architecture. The repair has the flexibility to modify multiple layers of the DNN, and runs in polynomial time. It supports DNNs with activation functions that have some linear pieces, as well as fully-connected, convolutional, pooling and residual layers. To the best our knowledge, this is the first provable repair approach that has all of these features. We implement our approach in a tool called APRNN. Using MNIST, ImageNet, and ACAS Xu DNNs, we show that it has better efficiency, scalability, and generalization compared to PRDNN and REASSURE, prior provable repair methods that are not architecture preserving.
Accepted paper at PLDI 2023. Tool is available at https://github.com/95616ARG/APRNN/
References in corpus (10)
- Very Deep Convolutional Networks for Large-Scale Image Recognition
- An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
- Training language models to follow instructions with human feedback
- PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximations
- Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifiers
- MNIST-C: A Robustness Benchmark for Computer Vision
- Memory-Based Model Editing at Scale
- Globally-Robust Neural Networks
- Complete Verification via Multi-Neuron Relaxation Guided Branch-and-Bound
- Sound and Complete Neural Network Repair with Minimality and Locality Guarantees