Sora: Scalable Black-Box Reachability Analyser on Neural Networks

TY - GEN

T1 - Sora

T2 - ICASSP 2023 - 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

AU - Xu, Peipei

AU - Wang, Fu

AU - Ruan, Wenjie

AU - Zhang, Chi

AU - Huang, Xiaowei

N1 - © 2023 IEEE

PY - 2023/6/10

Y1 - 2023/6/10

N2 - The vulnerability of deep neural networks (DNNs) to input perturbations has posed a significant challenge. Recent work on robustness verification of DNNs not only lacks scalability but also requires severe restrictions on the architecture (layers, activation functions, etc.). To address these limitations, we propose a novel framework, SORA, for scalable blackbox reachability analysis of DNNs. SORA can work on a broad class of neural network structures, including those networks with very deep layers and a huge number of neurons with nonlinear activation functions. Based on the Lipschitz continuity, SORA verifies the reachability property of DNNs with a novel optimisation algorithm and has global convergence guarantee. Our method does not require access to the inner structures of the DNNs, hence a black-box method. Experimental results show that, compared to existing verification methods, SORA shows superior performance in terms of both efficiency and scalability, especially when handling a deep neural network with very deep layers and a large number of neurons with various types of nonlinear activation functions.

AB - The vulnerability of deep neural networks (DNNs) to input perturbations has posed a significant challenge. Recent work on robustness verification of DNNs not only lacks scalability but also requires severe restrictions on the architecture (layers, activation functions, etc.). To address these limitations, we propose a novel framework, SORA, for scalable blackbox reachability analysis of DNNs. SORA can work on a broad class of neural network structures, including those networks with very deep layers and a huge number of neurons with nonlinear activation functions. Based on the Lipschitz continuity, SORA verifies the reachability property of DNNs with a novel optimisation algorithm and has global convergence guarantee. Our method does not require access to the inner structures of the DNNs, hence a black-box method. Experimental results show that, compared to existing verification methods, SORA shows superior performance in terms of both efficiency and scalability, especially when handling a deep neural network with very deep layers and a large number of neurons with various types of nonlinear activation functions.

KW - Deep learning

KW - Robustness

KW - Signal processing

KW - Signal processing algorithms

KW - Closed box

KW - Neurons

KW - Scalability

U2 - 10.1109/ICASSP49357.2023.10097180

DO - 10.1109/ICASSP49357.2023.10097180

M3 - Conference contribution

SN - 9781728163284

T3 - Proceedings of the 2023 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP)

BT - ICASSP 2023

PB - IEEE

Y2 - 4 June 2023 through 10 June 2023

ER -