Reliable and Interpretable Artificial Intelligence

Transcription

1

2 (Sept 15, 2017)

3 Reliable and Interpretable Artificial Intelligence

4 How good (robust) is your neural net? [1] Pei et. al., DeepXplore: Automated Whitebox Testing of Deep Learning Systems, SOSP 2017

5 Attacks on Machine Learning

6 Related work: Adversarial examples

7 Related Work: Robustness Guarantees

8 Related Work: Systematic Testing

9 Wanted: Automated and scalable analysis to verify realistic NNs Useful in: Ensuring correctness of a larger (CPS) system that uses the NN Proving robustness of the NN (beyond finding adversarial examples) Learning interpretable specs of the NN Comparing NNs (joint work with Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri)

10 Problem Statement and Challenges Neural Network Analysis Problem Given - a neural network N - a property over inputs φ - a property over outputs ψ check whether i I. i φ N i ψ holds Challenges: - The property φ over inputs usually captures an unbounded set of inputs - Existing symbolic solutions do not scale to large networks (e.g. conv nets)

11 Key Observation: AI for AI Deep Neural Nets: Affine transforms + Restricted non-linearity + Abstract Interpretation: Scalable and Precise Numerical Domains

12 Concrete AI 2 : Abstract Interpretation for NNs Inputs Neuron values Neuron values Outputs...

13 Concrete AI 2 : Abstract Interpretation for NNs Inputs Neuron values Neuron values Outputs... Concrete layer transformer

14 Abstract Concrete AI 2 : Abstract Interpretation for NNs Inputs Neuron values Neuron values Outputs... Concrete layer transformer...

15 Abstract Concrete AI 2 : Abstract Interpretation for NNs Inputs Neuron values Neuron values Outputs... Concrete layer transformer Abstract layer transformer Abstract numerical element...

16 Zonotope Abstract Domain n m k n = a n 0 + a n i ε i n m i=1 k = a m 0 + a m i ε i i=1 a 0 n a 0 m m

17 Zonotope Abstract Domain n m k n = a n 0 + a n i ε i n m i=1 k = a m 0 + a m i ε i i=1 a 0 n a 0 m m ε i a i n n + m n m, n m

18 Abstract AI 2 : Abstracting Neurons φ 0 φ 1 φ n 1 φ n...

19 Abstract AI 2 : Abstracting Neurons φ 0 φ 1 φ n 1 φ n... Robustness specification φ 0 x 0 = 0 x 1 = ε 1 x 2 = x 784 = ε 784 i. ε i [0,1]

20 Abstract AI 2 : Abstracting Neurons φ 0 φ 1 φ n 1 φ n... Robustness specification φ 0 Captures a set of images x 0 = 0 x 1 = ε 1 x 2 = x 784 = ε 784 i. ε i [0,1]

21 Abstract AI 2 : Abstracting Neurons φ 0 φ 1 φ n 1 φ n... Robustness specification φ 0 x 0 = 0 x 1 = ε 1 x 2 = x 784 = ε 784 i. ε i [0,1] Captures a set of images Output constraint φ n x 0 = 0 x 1 = ε ε ε 2 + x 2 = ε ε ε 1 + x 9 = ε ε ε 1 + i. ε i [0,1] Captures all possible output vectors

22 Abstract AI 2 : Abstracting Neurons φ 0 φ 1 φ n 1 φ n... Robustness specification φ 0 x 0 = 0 x 1 = ε 1 x 2 = x 784 = ε 784 i. ε i [0,1] Captures a set of images Output constraint φ n x 0 = 0 x 1 = ε ε ε 2 + x 2 = ε ε ε 1 + x 9 = ε ε ε 1 + i. ε i [0,1] Captures all possible output vectors Label i is possible iff: φ n { j. x i x j }

23 Abstract Neuron Transformers a = 0.2n + 0.4m n 0.2 z = ReLU(a) b = 0.1n + 0.5m m 0.5 q = ReLU(b)

24 Abstract Neuron Transformer a = 0.2n + 0.4m z z = ReLU a = max(0, a) n 0.2 z = ReLU(a) a b = 0.1n + 0.5m m 0.5 q = ReLU(b)

25 Abstract Neuron Transformer a = 0.2n + 0.4m z z = ReLU a = max(0, a) n 0.2 z = ReLU(a) a m 0.5 b = 0.1n + 0.5m q = ReLU(b) # f ReLU = f # # k f 1 f i # ψ = ψ x i 0 ψ 0 ψ 0 = ቊ ψ[x i 0] if (ψ x i < 0 ) otherwise

26 The AI 2 System Supports neural networks with: Layers: Fully-connected, convolutional, max-pooling, flattening Activation functions: ReLU Supported numerical domains: Intervals, Zonotopes, Polyhedra, Bounded powerset domain

27 Experimental Results MNIST ConvNet 6 layers, 15K neurons CIFAR-10 ConvNet 6 layers, 57K neurons

28 Abstract Concrete Inputs Neuron values Neuron values Outputs... Concrete layer transformer Abstract layer transformer Abstract numerical element...