A neural network verification method based on error divide and conquer

Abstract

The present application relates to a kind of neural network verification methods based on error divide and conquer, the strict approximation function of network node in given input range is given using improved symbolic linear relaxation calculation, and using the error constraint segmentation strategy of over-approximation node divides the original verification problem into equivalent series of sub-problems, and the safety property of entire neural network is verified by carrying out complete verification to series of sub-problems.Through the method of the present application, the state space in neural network verification process is effectively reduced, the safety property verification and evaluation of neural network can be efficiently carried out, and the scalability of neural network trusted verification method can be improved.

Description

Technical Field

[0001] This invention belongs to the field of neural network credibility verification technology, specifically relating to a neural network verification method based on error divide-and-conquer. Background Technology

[0002] In recent years, neural network technology has developed rapidly and has been widely applied in safety-critical fields such as autonomous driving, facial recognition, and medical diagnosis due to its outstanding performance in image classification, object detection, and natural language processing. However, neural networks are inherently uncertain; slight perturbations can often lead to erroneous results. Furthermore, deployed neural network models typically consist of millions of parameters, making them "black box" in nature, difficult to understand, and challenging to analyze. Therefore, employing formal verification methods to ensure the credibility of neural network behavior and that outputs meet expectations helps safeguard the reliability of safety-critical systems that rely on neural networks for critical decisions.

[0003] Currently, formal verification methods for neural networks are divided into two categories: complete and incomplete. Incomplete methods introduce over-approximation relaxation into the network, thus only verifying a subset of the input and cannot guarantee a definite verification result, making it impossible to determine the reliability of the neural network. Complete methods are usually based on solution techniques from mixed-integer linear programming (MILP) or satisfiability theory (SAT / SMT), precisely encoding the network and theoretically providing a definite result for the verification problem.

[0004] However, since the state space in the neural network verification process grows exponentially with the increase of the number of ReLU nodes, on the one hand, a large-scale state space may lead to problems such as the infeasibility or inability to solve the verification method, making it impossible to verify the credibility of the neural network. On the other hand, a complete neural network verification method requires high computational resources, especially when verifying the security properties of some complex networks, which requires a large search space, and such high computational resources cannot be met in practical applications. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a neural network verification method based on error divide-and-conquer. The technical problem to be solved by this invention is achieved through the following technical solution:

[0006] This invention provides a neural network verification method based on error divide-and-conquer, comprising:

[0007] Step 1: Obtain the parameters of the neural network model to be verified, and based on the neural network model and security attribute constraints, obtain the initial verification question, and add the initial verification question to the verification question set; wherein, the parameters of the neural network model include the structure, weights and biases of the neural network model;

[0008] Step 2: Use the improved symbolic linear relaxation algorithm to obtain the symbolic upper bound function and symbolic lower bound function of each node output in the hidden layer of the neural network model for each verification problem in the current verification problem set, wherein the hidden layer includes an affine layer and a ReLU layer;

[0009] Step 3: For the neural network model under each verification problem, construct the node error matrix of all ReLU layer nodes of the neural network model under each verification problem according to the symbolic upper bound function and the symbolic lower bound function;

[0010] Step 4: Determine whether each verification question in the current verification question set meets the segmentation condition, segment the verification questions that meet the segmentation condition, update the verification question set according to the segmentation result, and add the verification questions that do not meet the segmentation condition to the indivisible question set.

[0011] In this process, after updating the set of verification questions, steps 2-4 are repeated until there are no verification questions in the current set of verification questions that meet the splitting conditions. Then, all verification questions in the current set of verification questions are added to the set of indivisible questions.

[0012] Step 5: Encode each verification problem in the indivisible problem set using MILP and then add it to the solver in parallel for verification. Determine the safety of the neural network model based on the verification results.

[0013] The segmentation conditions are: the current segmentation depth is less than the preset upper limit of the number of segmentations, and the maximum error value in the node error matrix under the current verification problem is greater than or equal to the preset branch threshold value.

[0014] In one embodiment of the present invention, in step 2, for adjacent affine layers and ReLU layers, the upper bound function and lower bound function of the symbolic function output by each node of the affine layer are:

[0015]

[0016]

[0017] In the formula, This represents the sign upper bound function of the output of the node at level i. This represents the signed lower bound function of the output of the node at level i. Denote the symbolic upper bound function of the node output of the (i - 1)-th layer, Denote the symbolic lower bound function of the node output of the (i - 1)-th layer, [W i + Denote the positive weight matrix of the i-th layer, [W i - Denote the negative weight matrix of the i-th layer, b i Denote the bias vector of the i-th layer;

[0018] The symbolic upper bound function and symbolic lower bound function of each node output by the ReLU layer are:

[0019]

[0020]

[0021] In the formula, Denote the symbolic upper bound function of the node output of the (i + 1)-th layer, Denote the symbolic lower bound function of the node output of the (i + 1)-th layer, λ u Denote the coefficient of the symbolic upper bound function of the node output of the ReLU layer, μ u Denote the constant of the symbolic upper bound function of the node output of the ReLU layer, λ l Denote the coefficient of the symbolic lower bound function of the node output of the ReLU layer, μ l Denote the constant of the symbolic lower bound function of the node output of the ReLU layer;[[ID=I]]

[0022] Among them, if abs(l) ≥ u, then λ l = μ l = 0;

[0023] If abs(l) < u, then λ l = 1, μ l = 0;

[0024] In the formula, abs() represents taking the absolute value, u represents the approximate upper bound of the node input, and l represents the approximate lower bound of the node input.

[0025] In an embodiment of the present invention, in the said step 3, for a neural network model under a verification problem, construct the node error matrix of all ReLU layer nodes of the neural network model under this verification problem, including:

[0026] According to the symbolic upper bound function and symbolic lower bound function of each node, and the input of the neural network model, calculate the approximate upper bound and approximate lower bound of the input of each node;

[0027] ​​Based on the approximate upper and lower bounds of the input of the nodes, the node errors of all ReLU layers are calculated.

[0028] The node error is calculated according to the following formula:

[0029] ξ=ξ dir +ξ indir ;

[0030]

[0031]

[0032] In the formula, ξ represents the nodal error, ξ dir ξ represents the direct error at the nodes. indir This represents the nodal indirect error, where pow(2,i) represents 2. i ;

[0033] Based on the calculated node errors, the node error matrix of all ReLU layer nodes is constructed. Where, ξ ij s represents the node error of the j-th node in the i-th layer. max L represents the maximum number of nodes in the hidden layer, R represents the number of hidden layers, and R represents the set of real numbers.

[0034] In one embodiment of the present invention, step 4 involves segmenting the verification problem that satisfies the segmentation condition, including:

[0035] The ReLU node corresponding to the maximum error value in the node error matrix under the current verification problem is segmented into an active state and an inactive state.

[0036] Based on the partitioning results of the ReLU nodes, the current verification problem is decomposed into two new verification problems using the verification problem decomposition algorithm;

[0037] Wherein, if the ReLU node is stably in an active state, then As a constraint on this node, a new verification problem arises: if the ReLU node is stably in an inactive state, then... As a constraint on this node, a new verification problem is derived, in which, This represents the node variable after the ReLU node is activated. This represents the node variables before the ReLU node is activated.

[0038] In one embodiment of the present invention, in step 5, if the verification results of all verification questions in the indivisible question set are Safe, then the neural network model satisfies the security attribute; if there is a verification question in the indivisible question set with an Unsafe verification result or the verification program execution time exceeds the preset verification time limit, then the neural network model does not satisfy the security attribute.

[0039] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0040] The present invention provides a neural network verification method based on error divide-and-conquer. This method employs an improved symbolic linear relaxation to compute a rigorous approximation function for network nodes within a given input range. It then uses an error constraint partitioning strategy for over-approximated nodes to divide the original verification problem into a series of equivalent subproblems. Complete verification of these subproblems is then performed to verify the security properties of the entire neural network. This method effectively reduces the state space in the neural network verification process, enabling efficient verification and evaluation of neural network security properties and improving the scalability of neural network reliability verification methods.

[0041] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of a neural network verification method based on error divide-and-conquer provided in an embodiment of the present invention;

[0043] Figure 2 This is a flowchart of a neural network verification method based on error divide-and-conquer provided in an embodiment of the present invention;

[0044] Figures 3a-3b This is a schematic diagram of an improved symbolic linear relaxation algorithm provided in an embodiment of the present invention;

[0045] Figure 4 This is a schematic diagram of a segmentation process based on node error provided in an embodiment of the present invention; Detailed Implementation

[0046] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the following detailed description of a neural network verification method based on error divide-and-conquer, in conjunction with the accompanying drawings and specific embodiments, is provided.

[0047] The foregoing and other technical contents, features, and effects of the present invention will be clearly presented in the following detailed description of specific embodiments in conjunction with the accompanying drawings. Through the description of the specific embodiments, a more in-depth and concrete understanding can be gained of the technical means and effects adopted by the present invention to achieve its intended purpose. However, the accompanying drawings are for reference and illustration only and are not intended to limit the technical solutions of the present invention.

[0048] Example 1

[0049] Please refer to the above. Figure 1 and Figure 2 , Figure 1 This is a schematic diagram of a neural network verification method based on error divide-and-conquer provided in an embodiment of the present invention; Figure 2 This is a flowchart of a neural network verification method based on error divide-and-conquer provided in an embodiment of the present invention. As shown in the figure, the neural network verification method based on error divide-and-conquer in this embodiment includes:

[0050] Step 1: Obtain the parameters of the neural network model to be verified, and based on the neural network model and security attribute constraints, obtain the initial verification question and add the initial verification question to the verification question set;

[0051] In this embodiment, the neural network model to be verified is read and parsed to obtain the parameters of the neural network model, including the structure, weights and biases of the neural network model.

[0052] In an optional implementation, the initial validation problem is denoted as (f, x, y) with a segmentation depth of 0, where f represents the neural network model, x represents the input of the model, and y represents the output of the model.

[0053] In an alternative implementation, the validation attributes are initialized before validating the neural network model. First, an empty set of validation questions is initialized, denoted as queue = (), and the initial validation question (f, x, y) and its segmentation depth are added to the set of validation questions, i.e., queue = ([f, 0]). Then, an empty set of indivisible questions is initialized, denoted as sub_problem = []. Next, the validation return result result is initialized as Safe, and the validation time limit time, the upper limit of the number of segmentations count, and the branch threshold ξ0 are set.

[0054] It should be noted that when different neural network models are used for verification, the upper limit of the number of splits (count) and the branch threshold (ξ0) are set to different values.

[0055] In this embodiment, the neural network model to be verified is a feedforward neural network (FFNN).

[0056] Step 2: Use the improved symbolic linear relaxation algorithm to obtain the symbolic upper bound function and symbolic lower bound function of the output of each node in the hidden layer of the neural network model for each validation problem in the current validation problem set;

[0057] In this embodiment, a verification problem is selected from the current set of verification problems as the current verification problem. Under this verification problem, the improved symbolic linear relaxation algorithm is called to hierarchically traverse all nodes of the hidden layer of the neural network model. By deriving the dependency relationship of all nodes in the neural network model on the model input, the symbolic upper bound function and symbolic lower bound function of each node output are obtained.

[0058] Specifically, for a feedforward neural network, the hidden layers include affine layers and ReLU layers. Affine layer modules formed by affine layers and ReLU layers are alternately arranged. An affine layer module is formed by one or more cascaded affine layers. In step 2, for adjacent affine layers and ReLU layers, if the current layer is an affine layer in the neural network, the affine layer performs linear propagation between layers. Therefore, the upper bound function and lower bound function of the signed output of each node in the affine layer are:

[0059]

[0060]

[0061] In the formula, This represents the sign upper bound function of the output of the node at level i. This represents the signed lower bound function of the output of the node at level i. This represents the signed upper bound function of the output of the nodes in the (i-1)th layer. Denotes the signed lower bound function of the output of the node at level i-1, [W i ] + Let [W] represent the positive weight matrix of the i-th layer. i ] - Let b represent the negative weight matrix of the i-th layer. i This represents the bias vector of the i-th layer.

[0062] If the current layer is a ReLU layer in a neural network, then an improved signed linear relaxation algorithm is invoked to linearly relax the non-linear ReLU activation function used in the neural network model point by point. The signed upper bound function and signed lower bound function output by each node of the ReLU layer are:

[0063]

[0064]

[0065] In the formula, Denote the symbolic upper bound function of the output of the node in the (i + 1)-th layer Denote the symbolic lower bound function of the output of the node in the (i + 1)-th layer, λ u Denote the coefficient of the symbolic upper bound function of the output of the ReLU layer node, μ u Denote the constant of the symbolic upper bound function of the output of the ReLU layer node, λ l Denote the coefficient of the symbolic lower bound function of the output of the ReLU layer node, μ l Denote the constant of the symbolic lower bound function of the output of the ReLU layer node.

[0066] Please combine Figures 3a-3b with the schematic diagram of the improved symbolic linear relaxation algorithm shown in the figure, and give a specific description of the improved symbolic linear relaxation algorithm.

[0067] If abs(l) ≥ u, where abs() represents taking the absolute value, u represents the approximate upper bound of the input of the node, and l represents the approximate lower bound of the input of the node, then the improved symbolic linear relaxation algorithm adopts a zero approximation. As Figure 3a shown, for formulas (3) and (4), they can be written as follows:

[0068]

[0069]

[0070] That is to say, λ l = μ l = 0.

[0071] If abs(l) < u, then the improved symbolic linear relaxation algorithm adopts an identity approximation. As Figure 3b shown, for formulas (3) and (4), they can be written as follows:

[0072] <000023​​​​​​​​​​​​​​​​​​

[0077] In an optional implementation, in step 3, for a neural network model under a verification problem, the node error matrix of all ReLU layer nodes of the neural network model under the verification problem is constructed, including:

[0078] Step a: Based on the upper and lower bound functions of the sign for each node, and the input of the neural network model, calculate the approximate upper and lower bounds of the input for each node;

[0079] In this embodiment, the input of the neural network model is substituted into the signed upper bound function and signed lower bound function of each node output obtained in step 2 to calculate the approximate upper bound and approximate lower bound of the input for each node. The signed upper bound function and signed lower bound function of the current layer node can be used to obtain a more precise approximate upper bound and approximate lower bound of the input for the next layer node.

[0080] Step b: Calculate the node errors of all ReLU layers based on the approximate upper and lower bounds of the node inputs;

[0081] It should be noted that for affine layers, since affine layers perform linear propagation between layers, there is no node error on the nodes of the affine layer, that is, the node error of the affine layer is 0. In this embodiment, it is only necessary to calculate the node error of the nodes on the ReLU layer.

[0082] The node error of the ReLU layer includes direct error and indirect error, which is calculated according to the following formula:

[0083] ξ=ξ dir +ξ indir (9);

[0084] In the formula, ξ represents the nodal error, ξ dir ξ represents the direct error at the nodes. indir This represents the indirect error between nodes.

[0085] Direct error refers to the over-approximation error generated when the nonlinear nodes in the hidden layer are relaxed to the closed interval formed by the linear constraints during the linear relaxation process. Indirect error represents the impact of the over-approximation nodes on all nodes in subsequent layers. Specifically, the formulas for calculating direct and indirect errors are as follows:

[0086]

[0087]

[0088] In the formula, pow(2,i) represents 2 i .

[0089] Step c: Based on the calculated node errors, construct the node error matrix for all ReLU layer nodes. Where, ξ ij s represents the node error of the j-th node in the i-th layer. max L represents the maximum number of nodes in the hidden layer, R represents the number of hidden layers, and R represents the set of real numbers.

[0090] Step 4: Determine whether each verification question in the current verification question set meets the splitting condition. Segment the verification questions that meet the splitting condition and update the verification question set according to the splitting results. At the same time, add the verification questions that do not meet the splitting condition to the indivisible question set.

[0091] In this process, after updating the set of verification questions, steps 2-4 are repeated until no verification question in the current set meets the segmentation criteria. Then, all verification questions in the current set are added to the indivisible question set. A schematic diagram of the node error-based segmentation process in this embodiment is shown below. Figure 4 As shown.

[0092] In this embodiment, the segmentation conditions are: the current segmentation depth is less than the preset upper limit of the number of segmentations, and the maximum error value in the node error matrix under the current verification problem is greater than or equal to the preset branch threshold value.

[0093] In this embodiment, based on the obtained node error matrix E, the corresponding segmentation strategy is invoked to segment the nodes. Specifically, in step 4, the verification problems that meet the segmentation conditions are segmented, including:

[0094] Step (1): Segment the ReLU node corresponding to the maximum error value in the node error matrix under the current verification problem, and divide the ReLU node into active and inactive states;

[0095] Step (2): Based on the partitioning results of ReLU nodes, the current verification problem is decomposed into two new verification problems using the verification problem decomposition algorithm.

[0096] In this embodiment, the ReLU node corresponding to the maximum error value in the node error matrix is... Perform segmentation, splitting the node into active states (nodes) active (0, u]) and inactive state (node) inactive The current verification problem is divided into two parts, [l, 0] and then the verification problem decomposition algorithm is called to decompose the current verification problem into two new verification problems. These two new problems are then added to the verification problem set queue.

[0097] In the new verification problem, the MILP encoding of unstable nodes (i.e., ReLU nodes) is as follows:

[0098]

[0099] in, This represents the node variable after the ReLU node is activated. This represents the node variables before the ReLU node is activated. This represents an approximate upper bound of the input before the ReLU node is activated. This represents an approximate lower bound of the input before the ReLU node is activated. Represents a binary variable.

[0100] If the ReLU node is stably in an active state, and its input interval is set to (0, u], then let the equation (12) be... Equivalent to Then As a constraint on this node, a new verification problem is derived.

[0101] If the ReLU node is stably inactive, and its input interval is set to [1, 0], then let the equation (12) be... Equivalent to Then As a constraint on this node, a new verification problem is derived.

[0102] Step 5: Encode each verification problem in the indivisible problem set using MILP and then add it to the solver in parallel for verification. Determine the safety of the neural network model based on the verification results.

[0103] Specifically, in step 5, if the verification results of all verification questions in the indivisible problem set are Safe, then the neural network model satisfies the safety attribute; if there is a verification question in the indivisible problem set with an Unsafe verification result or the verification program execution time exceeds the preset verification time limit, then the neural network model does not satisfy the safety attribute.

[0104] For example, if the verification result of a certain verification question in the indivisible set of questions is Unsafe, then the result is assigned the value Unsafe and the entire verification process is terminated, indicating that the neural network model does not meet the given security property.

[0105] If the verification process takes longer than the preset verification time limit, the result will be assigned the value TimeOut and the entire verification process will be terminated, indicating that an accurate judgment could not be made within the given time limit.

[0106] If the verification procedures for all verification problems in the indivisible problem set return the initial value Safe after execution, it means that the neural network model satisfies the given safety property.

[0107] This embodiment of the neural network verification method based on error divide-and-conquer first calculates the upper and lower bounds of nodes in the neural network model using an improved signed linear relaxation algorithm. Then, it constructs the error matrix of the nodes and recursively divides the verification problem into two parts. Heuristically, it selects the ReLU node with the largest error in the node error matrix and splits it from the initial unstable state into a stable active state and an inactive state, thus creating two subproblems that are easier to verify and can be solved in parallel. Simultaneously, it sets a threshold for the number of splits to ensure the termination of the entire divide-and-conquer process. Finally, it solves the series of subproblems in parallel until one subproblem fails to satisfy the security property to be verified or all subproblems satisfy the security property. The verification result for the security property is then given as Unsafe or Safe, and the loop terminates. If the verification timeout occurs, a verification result TimeOut is given, and the loop terminates. This invention effectively reduces the state space in the neural network verification process, enables efficient verification and evaluation of the security properties of neural networks, and improves the scalability of neural network verification methods.

[0108] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device comprising a list of elements includes not only those elements but also other elements not expressly listed. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device comprising said element. Terms such as "connected" or "linked" are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect. The orientations or positional relationships indicated by terms such as "upper," "lower," "left," and "right" are based on the orientations or positional relationships shown in the accompanying drawings and are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention.

[0109] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A neural network verification method based on error divide-and-conquer, characterized in that, The method for verifying and evaluating the security attributes of a neural network includes: Set a preset verification time limit; Step 1: After reading the neural network model to be verified, parse it to obtain the parameters of the neural network model to be verified, and obtain the initial verification problem according to the neural network model and security attribute constraints. Add the initial verification problem to the verification problem set; wherein, the parameters of the neural network model include the structure, weights and biases of the neural network model; the initial verification problem is denoted as (f, x, y), where f represents the neural network model, x represents the input of the model, and y represents the output of the model; Step 2: Using the improved symbolic linear relaxation algorithm, by traversing all nodes of the hidden layer of the neural network model, the dependency relationship of all nodes in the neural network model on the model input is derived, and the symbolic upper bound function and symbolic lower bound function of the output of each node in the hidden layer of the neural network model under each verification problem in the current verification problem set are obtained. The hidden layer includes an affine layer and a ReLU layer. Step 3: For the neural network model under each verification problem, construct the node error matrix of all ReLU layer nodes of the neural network model under each verification problem according to the symbolic upper bound function and the symbolic lower bound function; Step 4: Determine whether each verification question in the current verification question set meets the segmentation condition, segment the verification questions that meet the segmentation condition, update the verification question set according to the segmentation result, and add the verification questions that do not meet the segmentation condition to the indivisible question set. In this process, after updating the set of verification questions, steps 2-4 are repeated until there are no verification questions in the current set of verification questions that meet the splitting conditions. Then, all verification questions in the current set of verification questions are added to the set of indivisible questions. Step 5: Encode each verification problem in the indivisible problem set using MILP and then add it to the solver in parallel for verification. Determine the safety of the neural network model based on the verification results. The segmentation conditions are: the current segmentation depth is less than the preset upper limit of the number of segmentations, and the maximum error value in the node error matrix under the current verification problem is greater than or equal to the preset branch threshold value. In step 5, if the verification results of all verification questions in the indivisible question set are Safe, then the neural network model satisfies the safety attribute; if there is a verification question in the indivisible question set with an Unsafe verification result or the verification program execution time exceeds the preset verification time limit, then the neural network model does not satisfy the safety attribute.

2. The neural network verification method based on error divide-and-conquer as described in claim 1, characterized in that, In step 2, for adjacent affine layers and ReLU layers, the upper bound function and lower bound function of the symbolic function output by each node of the affine layer are: In the formula, This represents the sign upper bound function of the output of the node at level i. This represents the signed lower bound function of the output of the node at level i. This represents the signed upper bound function of the output of the nodes in the (i-1)th layer. Denotes the signed lower bound function of the output of the node at level i-1, [W i ] + [W] represents the positive weight matrix of the i-th layer. i ] - Let b represent the negative weight matrix of the i-th layer. i This represents the bias vector of the i-th layer; The upper and lower bound functions of the sign function output by each node of the ReLU layer are: In the formula, This represents the signed upper bound function of the output of the node at level i+1. Let λ represent the signed lower bound function of the output of the node at level i+1. u μ represents the coefficients of the sign upper bound function of the ReLU layer node output. u λ is a constant representing the upper bound of the sign function of the ReLU layer node output. l μ represents the coefficients of the signed lower bound function output by the ReLU layer nodes. l A constant representing the sign lower bound function of the ReLU layer node output; Where, if abs(l)≥u, then λ l =μ l =0; If abs(l) < u, then λ l = 1, μ l = 0; In the formula, abs() represents taking the absolute value, u represents the approximate upper bound of the node's input, and l represents the approximate lower bound of the node's input.

3. The neural network verification method based on error divide-and-conquer as described in claim 2, characterized in that, In step 3, for a neural network model under a validation problem, the node error matrix of all ReLU layer nodes of the neural network model under the validation problem is constructed, including: Based on the upper and lower bound functions of the sign for each node, and the input of the neural network model, the approximate upper and lower bounds of the input for each node are calculated. Based on the approximate upper and lower bounds of the input of the nodes, the node errors of all ReLU layers are calculated. The node error is calculated according to the following formula: ξ=ξ dir +ξ indir ; In the formula, ξ represents the nodal error, ξ dir ξ represents the direct error at the nodes. indir This represents the nodal indirection error, where pow(2,i) represents 2. i ; Based on the calculated node errors, the node error matrix of all ReLU layer nodes is constructed. Where, ξ ij s represents the node error of the j-th node in the i-th layer. max L represents the maximum number of nodes in the hidden layer, R represents the number of hidden layers, and R represents the set of real numbers.

4. The neural network verification method based on error divide-and-conquer as described in claim 3, characterized in that, In step 4, the verification problem that meets the segmentation criteria is segmented, including: The ReLU node corresponding to the maximum error value in the node error matrix under the current verification problem is segmented into an active state and an inactive state. Based on the partitioning results of the ReLU nodes, the current verification problem is decomposed into two new verification problems using the verification problem decomposition algorithm; Wherein, if the ReLU node is stably in an active state, then As a constraint on this node, a new verification problem arises: if the ReLU node is stably in an inactive state, then... As a constraint on this node, a new verification problem is derived, in which, This represents the node variable after the ReLU node is activated. This represents the node variables before the ReLU node is activated.

Images