Safety Verification of Deep Neural Networks

被引:550
作者
Huang, Xiaowei [1 ]
Kwiatkowska, Marta [1 ]
Wang, Sen [1 ]
Wu, Min [1 ]
机构
[1] Univ Oxford, Dept Comp Sci, Oxford, England
来源
COMPUTER AIDED VERIFICATION, CAV 2017, PT I | 2017年 / 10426卷
基金
英国工程与自然科学研究理事会;
关键词
D O I
10.1007/978-3-319-63387-9_1
中图分类号
TP301 [理论、方法];
学科分类号
081202 ;
摘要
Deep neural networks have achieved impressive experimental results in image classification, but can surprisingly be unstable with respect to adversarial perturbations, that is, minimal changes to the input image that cause the network to misclassify it. With potential applications including perception modules and end-to-end controllers for self-driving cars, this raises concerns about their safety. We develop a novel automated verification framework for feed-forward multi-layer neural networks based on Satisfiability Modulo Theory (SMT). We focus on safety of image classification decisions with respect to image manipulations, such as scratches or changes to camera angle or lighting conditions that would result in the same class being assigned by a human, and define safety for an individual decision in terms of invariance of the classification within a small neighbourhood of the original image. We enable exhaustive search of the region by employing discretisation, and propagate the analysis layer by layer. Our method works directly with the network code and, in contrast to existing methods, can guarantee that adversarial examples, if they exist, are found for the given region and family of manipulations. If found, adversarial examples can be shown to human testers and/or used to fine-tune the network. We implement the techniques using Z3 and evaluate them on state-of-the-art networks, including regularised and deep learning networks. We also compare against existing techniques to search for adversarial examples and estimate network robustness.
引用
收藏
页码:3 / 29
页数:27
相关论文
共 30 条
[1]  
Ambrosio L., 2000, Oxford Mathematical Monographs
[2]  
[Anonymous], 2015, CoRR
[3]  
[Anonymous], ABS160507262 CORR
[4]  
[Anonymous], CAV 2017
[5]  
[Anonymous], 2015, ARXIV PREPRINT ARXIV
[6]  
[Anonymous], 2016, CORR
[7]  
[Anonymous], 2016, ACM SIGKDD INT C KNO
[8]  
[Anonymous], CVPR 2016
[9]  
[Anonymous], 2016, CORR
[10]  
[Anonymous], 2016, P NIPS