The Cost of Relaxation: Evaluating the Error in Convex Neural Network Verification
Provides theoretical bounds on the error of convex relaxation methods for neural network verification, which is important for practitioners relying on these methods for safety-critical applications.
The paper studies the worst-case error introduced by convex relaxations in neural network verification, showing that the distance between relaxed and original outputs grows exponentially with network depth and linearly with input radius, with misclassification probability exhibiting step-like behavior.
Many neural network (NN) verification systems represent the network's input-output relation as a constraint program. Sound and complete, representations involve integer constraints, for simulating the activations. Recent works convexly relax the integer constraints, improving performance, at the cost of soundness. Convex relaxations consider outputs that are unreachable by the original network. We study the worst case divergence between the original network and its convex relaxations; both qualitatively and quantitatively. The relaxations' space forms a lattice, where the top element corresponds to a full relaxation, with every neuron linearized. The bottom element corresponds to the original network. We provide analytical upper and lower bounds for the $\ell_\infty$-distance between the fully relaxed and original outputs. This distance grows exponentially, w.r.t. the network's depth, and linearly w.r.t. the input's radius. The misclassification probability exhibits a step-like behavior, w.r.t. input radius. Our results are supported by experiments on MNIST, Fashion MNIST and random networks.