A single-layer weight repair method for feedforward neural networks based on verification

Abstract

The present invention discloses a single-layer weight repair method for a feedforward neural network based on verification. The trained neural network is first verified by a verifier. If the feedforward neural network is wrong, the verifier will provide a counterexample, and then the counterexample is used to modify the link weights of the error layer of the feedforward neural network until the modified feedforward neural network passes the verification. In the process of repairing the neural network, the present invention adds a penalty term to the objective function and proposes a single-layer repair method for the feedforward neural network. This single-layer repair method does not require retraining, and thus does not require obtaining the original training data (the original training data is generally difficult to obtain). The error layer is located and modified, which can not only modify the error from the source, but also maintain the original characteristics of the feedforward neural network to a certain extent, thereby converting the repair problem into an optimization problem.

Description

Technical Field

[0001] The invention relates to the technical field of airborne collision avoidance systems, and in particular to a verification-based feedforward neural network single-layer weight repair method. Background Art

[0002] The Airborne Collision Avoidance System (ACAS) can display the situation around the aircraft and provide voice warnings when necessary, while helping the pilot to avoid danger with appropriate maneuvers, all of which help to avoid catastrophic accidents. The ACAS achieves collision avoidance prediction through a built-in feedforward neural network, which makes the safety and reliability of the feedforward neural network particularly important. Due to the opacity of the feedforward neural network, it is necessary to provide strict security guarantees for the feedforward neural network, and formal verification can provide security guarantees for the feedforward neural network. The verification of the feedforward neural network consists of two parts: the feedforward neural network and the properties to be verified. These two parts are input into the verifier, and the feedforward neural network is encoded by the verifier. If the feedforward neural network meets the properties, the output is satisfied. If the feedforward neural network does not meet the properties, the output is a counterexample. For feedforward neural networks that do not meet the properties, the errors generated will lead to serious consequences, so the erroneous feedforward neural network needs to be repaired until it meets the properties and passes the verification.

[0003] There are currently three main methods for repairing faulty feedforward neural networks. The first is retraining (BAUER-MARQUART F, BOETIUS D, LEUE S, et al. SpecRepair: Counter-Example Guided Safety Repair of Deep Neural Networks; proceedings of the Model Checking Software: 28th International Symposium, SPIN 2022, Virtual Event, May 21, 2022, Proceedings, F, 2022 [C]. Springer.), which adds the counterexamples provided by the verification to the original training set to retrain the weights of the feedforward neural network. However, this method is difficult to obtain the original training data, which will cost a lot of time and computing costs, and cannot guarantee the correctness of other inputs of the retrained feedforward neural network. The second is to modify the weights (Ben Goldberger, Guy Katz, "Minimal modifications of deep neural networks using verification," LPAR, 2020, 23rd). This method uses the verification results to modify the weights of the output layer connections and converts the repair problem into a verification problem. However, this method can only be modified in the last layer. Each verification of the program requires a lot of calculations, which causes the operation to time out and can only be stopped manually. In addition, the modified feedforward neural network will cause a decrease in accuracy when input normally. The third method is to modify the structure (Matthew Sotoudeh, Aditya VThakur, "Provable repair of deep neural networks," ACMSIGPLAN, 2021, 588–603). This method proposes a decoupled DNN structure that separates the activation state and activation value of neurons, converts the single-layer repair problem into a linear programming problem, and then solves the weights of the error layer links through the linear programming problem. However, this method is still not suitable for large feedforward neural networks. Summary of the invention

[0004] The present invention aims to solve the problem that the existing feedforward neural network repair may lead to a decrease in accuracy and the possible emergence of new errors, and provides a single-layer weight repair method for a feedforward neural network based on verification.

[0005] To solve the above problems, the present invention is achieved through the following technical solutions:

[0006] The single-layer weight repair method of the feedforward neural network based on verification includes the following steps:

[0007] Step 1: Use the verifier to verify the trained feedforward neural network of the airborne collision avoidance system to verify whether it meets the given safety attributes, and use the input of the feedforward neural network that does not meet the safety attributes as a counterexample to find the error layer of the feedforward neural network through the back propagation method;

[0008] Step 2: Set the penalty function according to the counterexample provided by the verifier, where the penalty function f(θ) is:

[0009]

[0010] Where θ is the weight of the error layer of the feedforward neural network, f l (θ) is the loss function of the feedforward neural network, μ is the coefficient of the penalty term, For the penalty item, Counterexamples for feedforward neural networks provided to the verifier, For input is the output of the feedforward neural network, i∈{1,2,…,v}, v is the number of counterexamples provided by the verifier, is the satisfaction function;

[0011] Step 3: Take the penalty function as the optimization target, take the weight of the error layer of the feedforward neural network as the particle, use the particle swarm optimization algorithm to optimize the objective function to obtain the optimal solution, and use the optimal solution as the new weight of the error layer of the feedforward neural network. At this time, the repair of the trained feedforward neural network is completed.

[0012] In step 1 above, the specific process of finding the error layer of the feedforward neural network through the back propagation method is as follows:

[0013] Step 1.1, input the counterexample into the feedforward neural network, pass it to the output layer of the feedforward neural network, and record the output value of the feedforward neural network;

[0014] Step 1.2 compares the output of the output layer of the feedforward neural network with the true label, and calculates the total error of the feedforward neural network using the mean square error loss function;

[0015] Step 1.3, starting from the output layer of the feedforward neural network, use the chain rule to calculate the gradient of each weight of the feedforward neural network and propagate it back to each layer of the feedforward neural network; the gradient of each weight gr k

[0016]

[0017] Among them, MSE represents the total error of the feedforward neural network, represents the kth weight of the jth neuron in the sth layer; s = 1, 2, ..., S, S represents the number of layers of the feedforward neural network; j = 1, 2, ..., J, J represents the number of neurons in the sth layer of the feedforward neural network; k = 1, 2, ..., K, K represents the weight number of the jth neuron in the sth layer of the feedforward neural network;

[0018] Step 1.4: Calculate the sum of the absolute values ​​of the gradients of all weights of all neurons in each layer of the feedforward neural network, and determine the layer with the largest total gradient as the error layer of the feedforward neural network.

[0019] In the above step 2, the satisfaction function is an objective function that combines a given function represented by a feedforward neural network with the safety property of the defined feedforward neural network.

[0020] The specific process of step 3 above is as follows:

[0021] Step 3.1, use the penalty function set in step 2 as the objective function of the particle swarm optimization algorithm;

[0022] Step 3.2, initialize the particle swarm: set the upper and lower limits of the search space, the upper and lower limits of each particle's speed, the local learning factor C1 and the global learning factor C2, and the maximum number of iterations of the algorithm T; regard the weight of the error layer of the feedforward neural network as the position of a particle, and randomly generate the initial population within a given range, and the position and speed of each particle in the random initial population;

[0023] Step 3.3, calculate the fitness value of each particle according to the objective function, save the optimal position of each particle, the optimal fitness value of the individual, the optimal position of the group and the optimal fitness value of the group;

[0024] Step 3.4, update the speed and position of each particle according to the speed and position update formula;

[0025] Step 3.5, calculate the fitness value of each particle after the update, and compare the current fitness value of each particle with the fitness value at its historical optimal position: if the current fitness value is better than the fitness value at the historical optimal position, the updated position is used as the optimal position of the particle; otherwise, the position before the update is used as the optimal position of the particle;

[0026] Step 3.6, traverse each particle in the population, and compare the fitness value corresponding to its optimal position with the optimal fitness value of the population: if the fitness value corresponding to the optimal position of the particle is better than the optimal fitness value of the population, then the optimal position of the particle is used as the optimal position of the population, and the optimal fitness value of the population is updated; otherwise, keep the optimal position of the population and the optimal fitness value of the population unchanged;

[0027] Step 3.7: Determine whether the searched results meet the stopping conditions, that is, reach the maximum number of iterations or meet the accuracy requirements: if the stopping conditions are met, output the optimal position of the population as the new weight of the error layer of the feedforward neural network; otherwise, go to step 3.4 and continue running until the conditions are met.

[0028] Compared with the prior art, the present invention first verifies the trained neural network through a verifier. If the feedforward neural network makes a mistake, the verifier will provide a counterexample, and then use the counterexample to modify the link weights of the error layer of the feedforward neural network until the modified feedforward neural network passes the verification. In the process of repairing the neural network, the present invention combines the method of adding penalty terms to the objective function proposed by Bauer-Marquart et al., and proposes a method for repairing a single layer of a feedforward neural network. This single-layer repair method does not require retraining, and thus does not require obtaining the original training data (the original training data is generally difficult to obtain), and can directly modify the error layer, which can not only modify the error from the source, but also maintain the original characteristics of the feedforward neural network to a certain extent, thereby converting the repair problem into an optimization problem. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 Flowchart of the verification-based single-layer weight repair method for feedforward neural networks.

[0030] Figure 2 Flowchart for verifying the feedforward neural network.

[0031] Figure 3 Flowchart of particle swarm optimization algorithm.

[0032] Figure 4 Update position and velocity diagram for particles. DETAILED DESCRIPTION

[0033] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific examples.

[0034] The traditional method for correcting errors in feedforward neural networks is retraining. However, it is generally difficult to obtain the original data set during retraining, and the accuracy of the retrained feedforward neural network will decrease, and it is difficult to ensure that no new errors will occur. To this end, the present invention proposes a single-layer weight repair method for feedforward neural networks based on verification. Based on the formal verification of the security properties of the feedforward neural network, when the verification fails, the verification tool returns a set of counterexamples, and locates the error layer through the back propagation method, and uses the counterexamples to construct a penalty term. The penalty function is composed of the loss function and the penalty term of the feedforward neural network, and then the penalty function is used to define the satisfaction function. The satisfaction function is an objective function that combines the function represented by the original feedforward neural network with the defined security properties of the feedforward neural network. The objective function guides the repair of the link weights of the feedforward neural network. After constructing the objective function, we locate the corresponding layer of the feedforward neural network that needs to be modified, initialize the weight of the layer, and then use the particle swarm optimization algorithm to find the most suitable weight. The weight modification problem of the feedforward neural network is to regard the weight of the layer that needs to be modified as a particle, and the objective function as the optimization target, and finally obtain a set of modified weights, which are re-verified until the feedforward neural network meets the defined properties.

[0035] Based on the verified feedforward neural network single layer weight repair method, such as Figure 1 As shown, it includes the following steps:

[0036] Step 1: Use the verifier to verify the trained feedforward neural network of the airborne collision avoidance system to verify whether it meets the given safety attributes. Use the input of the feedforward neural network that does not meet the safety attributes as a counterexample and use the back propagation algorithm to find the error layer of the feedforward neural network.

[0037] Let N be a feedforward neural network, let φ and ω be the input attribute and output attribute respectively, and the verifier encodes the input attribute and output attribute of the feedforward neural network into constraints respectively. The verification process of the feedforward neural network is: determine whether there is an input x of the feedforward neural network such that xI=φ, N(x)=ω, where N(x) represents the output of the feedforward neural network when the input is x. If the verification query is SAT, that is, there is such an input x, then the required security property is called preservation. Otherwise, the verification tool will return a specific counterexample x0 that violates the relevant property. Figure 2 To verify the feedforward neural network flow chart, the feedforward neural network and the artificially defined security properties are input. If the network satisfies the properties, the output satisfies the properties. If the properties are not satisfied, the counterexample is output.

[0038] In this embodiment, the feedforward neural network of the airborne collision avoidance system (ACAS Xu) has 8 layers, namely 1 input layer, 6 hidden layers and 1 output layer, and each layer is fully connected. The input layer has 5 neurons, each hidden layer has 50 neurons, and the output layer has 5 neurons. The values ​​of the 5 inputs x1~x5 of the feedforward neural network respectively represent the meanings of: the distance from the aircraft to the intruder, the angle between the aircraft and the intruder, the heading angle of the intruder relative to the heading of the aircraft, the speed of the aircraft, and the speed of the intruder. The 5 outputs y1~y5 of the feedforward neural network respectively represent: clear conflict, weak left, weak right, strong left, and strong right.

[0039] The airborne collision avoidance system defines a total of 10 safety attributes, as shown in Table 1

[0040]

[0041] Table 1

[0042] For example, in verifying whether the feedforward neural network of the airborne collision avoidance system satisfies the safety property defined that y1 is not the maximum value. When y1 is not the maximum value in the output, the safety property is satisfied. The verifier outputs SAT; if y1 is the maximum value, the safety property is not satisfied The verifier outputs the corresponding inputs (i.e., input range X) that violate the constraints and calls this set of inputs counterexamples.

[0043] The specific process of using the back propagation algorithm to find the misalignment is as follows:

[0044] Step (1.1) runs the counterexample: input the counterexample into the feedforward neural network and pass it to the output layer of the feedforward neural network, and record the output value of the feedforward neural network.

[0045] Step (1.2) Calculate the error: Compare the output value of the output layer with the true label and calculate the total error of the feedforward neural network. The present invention uses the mean square error loss function to calculate the total error MSE of the feedforward neural network:

[0046]

[0047] Among them, f i (x) is the output of the feedforward neural network corresponding to the i-th counterexample, y i is the true label of the i-th counterexample, and n is the number of counterexamples.

[0048] Step (1.3) Back propagation: Starting from the output layer of the feedforward neural network, the gradient of each weight of each neuron in each layer is calculated using the chain rule and propagated back to each layer of the network.

[0049] The gradient gr for each weight k

[0050]

[0051] Among them, MSE represents the total error of the feedforward neural network, represents the kth weight of the jth neuron in the sth layer, s=1, 2, ..., S, S represents the number of layers of the feedforward neural network; j=1, 2, ..., J, J represents the number of neurons in the sth layer of the feedforward neural network; k=1, 2, ..., K, K represents the weight number of the jth neuron in the sth layer of the feedforward neural network.

[0052] Step (1.4) calculates the sum of the absolute values ​​of the gradients of all weights of all neurons in each layer of the feedforward neural network: if the sum gradient is the largest, it proves that this layer is the layer that is "most responsible" for the wrong output, and we identify it as the wrong layer.

[0053] Step 2: Set the penalty function according to the counterexample provided by the verifier, where the penalty function f(θ) is:

[0054]

[0055] Where θ is the weight of the error layer of the feedforward neural network. l (θ) is the loss function of the feedforward neural network. μ is the coefficient of the penalty term. The size of the penalty term of the penalty function can be controlled by adjusting the penalty function parameters to balance the trade-off between the objective function and the constraints. is the penalty term, where Counterexamples for feedforward neural networks provided to the verifier, For input is the output of the feedforward neural network; v is the number of counterexamples provided by the verifier; is the satisfaction function, which is the objective function that combines the function represented by the feedforward neural network (because the feedforward neural network is given an input and then undergoes various transformations to obtain an output, so it can be regarded as a combination of functions) with the safety properties of the defined feedforward neural network; Indicates taking 0 and The larger value in .

[0056] In the ACAS Xu system, 10 safety attributes are described (Table 1), and each safety attribute corresponds to a satisfaction function:

[0057]

[0058]

[0059]

[0060]

[0061]

[0062]

[0063]

[0064]

[0065]

[0066]

[0067]

[0068] For a feedforward neural network N:R n →R m , given an input x∈R n , so that the confidence value y∈Rm of the m-class label. We consider a set of formal constraints consisting of input and output attributes A set of attributes It is stipulated that for the input set For all points in The ellipse in the.

[0069] For simplicity, we consider the interval input set And assume is a Boolean combination of constraints given in conjunctive normal form (CNF):

[0070]

[0071]

[0072] Atomic Constraints The form is as follows:

[0073]

[0074] in, is a computable function that outputs the value y.

[0075] Theorem: According to Atomic constraints of the form The satisfaction function is defined as:

[0076]

[0077] Given a formal constraint The satisfaction function is defined as:

[0078]

[0079] Definition: Given the satisfaction function f obtained from the network N sat and an input-output attribute We can get:

[0080]

[0081] This definition shows that if there is a counterexample, then the satisfaction function of the counterexample is less than 0.

[0082] Taking the airborne collision avoidance system (ACAS-Xu) as an example, is the counterexample found by the verifier, let θ be the weight of the error layer of the feedforward neural network. According to the security property Define a satisfaction function f sat =-y1+max i≠1 (y i ). Let c(θ) be equal to the satisfaction function f sat , if the input is a counterexample, c(θ)<0; otherwise, c(θ)>0. Let a penalty term c + (θ) = max(0, -c(θ)), let the loss function of the feedforward neural network be f l (θ), then the penalty function f(θ) = f l (θ)+μ·c + (θ). μ is set to 2.

[0083] Step 3: Take the penalty function as the optimization target, take the weight to be modified (i.e., the weight θ of the error layer of the feedforward neural network) as the particle, use the particle swarm optimization algorithm to optimize the objective function to obtain the optimal solution, and use the optimal solution as the new weight of the error layer of the feedforward neural network. At this time, the repair of the trained feedforward neural network is completed.

[0084] Particle Swarm Optimization (PSO) is a classic swarm intelligence algorithm, which is inspired by the social activities of birds flying and foraging. Birds search for the global optimal point through information exchange between individuals. PSO algorithm has the advantages of simple principle, fewer parameter settings and easy implementation. Particle swarm optimization simulates the predation process of bird flocks, regards the problem to be optimized as a flock of preyed birds, and the solution space as the flight space of the bird flock. The position of each bird in the space is a particle of the particle swarm algorithm in the solution space, that is, a solution to the problem to be optimized. The particle swarm optimization algorithm of the present invention is as follows: Figure 3As shown, the specific process is:

[0085] Step (3.1) sets the objective function (also called fitness function) of the particle swarm optimization algorithm, which is the penalty function set in step 2.

[0086] Step (3.2) Initialize the particle swarm: set the upper and lower limits of the search space, two learning factors C1 (local learning factor) C2 (global learning factor), the maximum number of iterations of the algorithm, and the upper and lower limits of each particle's speed. Consider a set of feedforward neural network weights as the location of a particle, give a range, and randomly initialize the particle swarm. Randomly initialize the position and velocity of each particle in the population.

[0087] Step (3.3) calculates the fitness value of each particle according to the fitness function and saves the optimal position of each particle The best fitness value of an individual and the optimal position of a group And the optimal fitness value of the group.

[0088] f fitness =f l (θ)+μ·c + (θ) (7)

[0089] Step (3.4) updates the speed and position of each particle according to the speed and position update formula.

[0090] Speed ​​update formula:

[0091]

[0092] Position update formula:

[0093]

[0094] Figure 4 The diagram shows the updated position and velocity of particles. The movement of particles is affected by three aspects: 1) the previous velocity of the particle; 2) the self-cognition part, which represents the thinking of the particle itself, which can be understood as the distance between the current position of the particle and its best position; 3) the "social part", which represents the information sharing and cooperation between particles, which can be understood as the distance between the current position of the particle and the best position of the group.

[0095] Step (3.5) calculates the fitness value of each particle after the update, and compares the current fitness value of each particle with the fitness value at its historical optimal position: if the current fitness value is better than the fitness value at the historical optimal position, the updated position is used as the optimal position of the particle; otherwise, the position before the update is used as the optimal position of the particle.

[0096] Step (3.6), traverse each particle of the population, and compare the fitness value corresponding to its optimal position with the optimal fitness value of the population: if the fitness value corresponding to the optimal position of the particle is better than the optimal fitness value of the population, then the optimal position of the particle is used as the optimal position of the population, and the optimal fitness value of the population is updated; otherwise, keep the optimal position of the population and the optimal fitness value of the population unchanged.

[0097] Step (3.7) determines whether the searched result meets the stopping condition (reaching the maximum number of iterations or meeting the accuracy requirement). If the stopping condition is met, the optimal position of the population is output as the new weight of the error layer of the feedforward neural network. Otherwise, go to step (3.4) and continue running until the condition is met.

[0098] In this embodiment, after each feedforward neural network of the airborne collision avoidance system (ACASXu) has executed steps 1-3, that is, the weights of the error layers in each feedforward neural network of the airborne collision avoidance system (ACASXu) have been updated, the safety and reliability of each feedforward neural network will be effectively guaranteed.

[0099] The present invention realizes fine-tuning and correction of a trained feedforward neural network after an error occurs, and can effectively repair the feedforward neural network's erroneous judgment of slight disturbances without the need for retraining, thereby realizing automatic correction. This fine-tuning method can also save time and computing costs to a large extent.

[0100] It should be noted that although the embodiments of the present invention described above are illustrative, they are not intended to limit the present invention, and therefore the present invention is not limited to the above specific embodiments. Without departing from the principles of the present invention, any other embodiments obtained by those skilled in the art under the guidance of the present invention are deemed to be within the protection of the present invention.

Claims

1. A single-layer weight repair method for a feedforward neural network based on verification, characterized by: The steps include: Step 1: Use the verifier to verify the trained feedforward neural network of the airborne collision avoidance system to verify whether it meets the given safety attributes, and use the input of the feedforward neural network that does not meet the safety attributes as a counterexample to find the error layer of the feedforward neural network through the back propagation method; Right now: Step 1.1, input the counterexample into the feedforward neural network, pass it to the output layer of the feedforward neural network, and record the output value of the feedforward neural network; Step 1.2 compares the output of the output layer of the feedforward neural network with the true label, and calculates the total error of the feedforward neural network using the mean square error loss function; Step 1.3, starting from the output layer of the feedforward neural network, use the chain rule to calculate the gradient of each weight of the feedforward neural network and propagate it back to each layer of the feedforward neural network; the gradient of each weight for: in, represents the total error of the feedforward neural network, Indicates Tier The first weights; , Represents the number of layers of the feedforward neural network; , represents the first The number of neurons in the layer; , represents the first Layer The number of weights of the neurons; Step 1.4, calculate the sum of the absolute values ​​of the gradients of all weights of all neurons in each layer of the feedforward neural network, and determine the layer with the largest total gradient as the error layer of the feedforward neural network; Step 2: Set the penalty function based on the counterexample provided by the verifier, where the penalty function for: In the formula, is the weight of the error layer of the feedforward neural network, is the loss function of the feedforward neural network, is the coefficient of the penalty term, For the penalty item, , Counterexamples for feedforward neural networks provided to the verifier, For input The output of the feedforward neural network is i , The number of counterexamples provided to the verifier, is the satisfaction function, which is the objective function combining the given function represented by the feedforward neural network with the safety property of the defined feedforward neural network; Step 3: Take the penalty function as the optimization target, take the weight of the error layer of the feedforward neural network as the particle, use the particle swarm optimization algorithm to optimize the objective function to obtain the optimal solution, and use the optimal solution as the new weight of the error layer of the feedforward neural network. At this time, the repair of the trained feedforward neural network is completed.

2. The verification-based feedforward neural network single-layer weight repair method according to claim 1 is characterized in that: The specific process of step 3 is as follows: Step 3.1, use the penalty function set in step 2 as the objective function of the particle swarm optimization algorithm; Step 3.2, initialize the particle swarm: set the upper and lower limits of the search space, the upper and lower limits of each particle speed, and the local learning factor C 1 and the global learning factor C 2. Maximum number of iterations of the algorithm T ; The weight of the error layer of the feedforward neural network is regarded as the position of a particle, and the initial population is randomly generated within a given range, and the position and speed of each particle in the random initial population; Step 3.3, calculate the fitness value of each particle according to the objective function, save the optimal position of each particle, the optimal fitness value of the individual, the optimal position of the group and the optimal fitness value of the group; Step 3.4, update the speed and position of each particle according to the speed and position update formula; Step 3.5, calculate the fitness value of each particle after the update, and compare the current fitness value of each particle with the fitness value at its historical optimal position: if the current fitness value is better than the fitness value at the historical optimal position, the updated position is used as the optimal position of the particle; otherwise, the position before the update is used as the optimal position of the particle; Step 3.6, traverse each particle in the population, and compare the fitness value corresponding to its optimal position with the optimal fitness value of the population: if the fitness value corresponding to the optimal position of the particle is better than the optimal fitness value of the population, then the optimal position of the particle is used as the optimal position of the population, and the optimal fitness value of the population is updated; otherwise, keep the optimal position of the population and the optimal fitness value of the population unchanged; Step 3.7, determine whether the searched results meet the stopping condition, that is, reach the maximum number of iterations or meet the accuracy requirements: if the stopping condition is met, output the optimal position of the population as the new weight of the error layer of the feedforward neural network; Otherwise, go to step 3.4 and continue running until the conditions are met.

Images