Neural network robustness verification method for traffic sign recognition

Abstract

The invention discloses a neural network robustness verification method for traffic sign recognition, and the method comprises the following steps: S1, constructing an AGTN model; s2, constructing an NNVF neural network verification framework; s3, performing structure analysis on the neural network model to extract key features; s4, inputting the extracted features into an AGTN model; s5, calling each algorithm verification sample by the NNVF neural network verification framework; and S6, normalization analysis is carried out on the output result, and a unified robustness verification conclusion is obtained.Compared with the prior art, the AGTN algorithm combination-timeout prediction model is constructed, the optimal verification algorithm combination and timeout duration configuration can be adaptively generated according to the scale, depth, accuracy and other core features of the traffic sign recognition neural network, and the robustness of the traffic sign recognition neural network is improved. The NNVF verification framework realizes standardized processing of models and verification properties, reduces the use cost of verification tools, and improves the universality of the method.

Description

Technical Field

[0001] This invention relates to the field of computers, and more particularly to a method for verifying the robustness of neural networks for traffic sign recognition. Background Technology

[0002] With the rapid development of artificial intelligence technology, autonomous driving has become a core direction of intelligent transportation. Traffic sign recognition (TSR), as a key module for vehicle environmental perception, directly determines the rule execution and operational safety of autonomous driving. Current mainstream autonomous driving systems rely on convolutional neural networks (CNNs) for traffic sign detection and classification. While these models offer excellent recognition performance, their complex internal decision-making mechanisms and lack of interpretability pose potential safety risks during deployment. Numerous studies have shown that deep neural networks are highly sensitive to natural disturbances in traffic scenarios (lighting, weather, occlusion, etc.) and adversarial examples; even minor disturbances can lead to model misidentification and even traffic accidents. Therefore, conducting robust formal verification of the model is a core prerequisite for ensuring the safety and reliability of autonomous driving systems.

[0003] Against this backdrop, robustness verification of neural networks has gradually become an important direction in deep learning security research. Although existing verification algorithms have made some progress in terms of verification capability and result accuracy, they are often accompanied by high computational complexity and significant verification time overhead. Furthermore, due to differences in theoretical assumptions and implementation mechanisms among different algorithms, a single verification method cannot consistently maintain optimal performance on various neural network models, thus exhibiting certain limitations in practical applications. Therefore, how to effectively optimize verification time costs and achieve flexible adaptation to different types of neural network models while ensuring the reliability of verification results remains a pressing research problem.

[0004] Users of validation tools also face high usage costs in practical applications. Different validators often use incompatible model and property input formats, requiring users to rewrite property descriptions according to the specific tool's requirements and convert the model to be validated into the corresponding format. This problem is further amplified by the significant differences in input specifications and supported low-level operations among validators. Even when using a unified intermediate representation format, different validators do not support the same set of operators. This inconsistency in format and interface makes running multiple validation algorithms simultaneously on the same validation task difficult and costly. Users often need a deep understanding of the internal details of each validator to complete the necessary format conversions and configurations.

[0005] Domestic and international technological situation:

[0006] Robust boundary calculations are mainly divided into two categories: one is the exact solution method, which has high complexity but reliable conclusions; the other is the approximate solution method, which is efficient and adaptable to large networks, but has approximation errors.

[0007] Regarding exact verification algorithms, Katz et al. proposed the SMT solver Reluplex, which utilizes real number computation principles. Its core lies in extending the simplex algorithm (the standard algorithm for solving LP instances) to support ReLU constraints, thereby enabling robustness verification of ReLU feedforward neural networks. Huang et al. built an automatic verification framework based on SMT, and Ehlers et al. proposed the global linear approximation tool PLANET. Cheng, Tjeng et al. transformed the problem into mixed-integer programming (MIP) and mixed-integer linear programming, significantly improving computational speed. However, although exact methods perform well on small networks, their scalability in large-scale neural networks remains limited, and they are generally difficult to apply to activation functions other than ReLU and maxpooling.

[0008] Computing an accurate robustness boundary is an NP-complete (NPC) problem. Therefore, to improve verification speed and increase the size of verifiable networks, researchers have proposed approximate methods to compute approximate lower bounds of the robustness boundary, and combined these with sample attack verification algorithms capable of estimating approximate upper bounds, to cover the robustness performance of neural networks on a majority of samples. Typical approximation methods include abstract interpretation, convex optimization, Lipschitz constant estimation, and interval boundary propagation.

[0009] In summary, exact methods generate stricter robustness boundaries and have stronger verification capabilities, but they often come with higher computational complexity and time overhead. Approximate methods are more efficient and scalable, but their verification results may be conservative or even fail to verify on some samples. Due to differences in theoretical foundations, operator support, and applicable network types among different algorithms, a single algorithm cannot consistently achieve optimal verification results on various neural network models. Therefore, how to combine the advantages of exact and approximate methods while ensuring verification reliability, and how to make more reasonable strategy choices and resource allocations in the verification process to effectively reduce verification time costs and improve adaptability to different models, remains a pressing problem to be solved.

[0010] Meanwhile, as the demand for neural network verification continues to grow, especially with the increasing comprehensive requirements for verification scope, efficiency, and ease of use in real-world application scenarios, researchers have begun to explore methods to integrate multiple verification tools into a unified platform in order to improve verification efficiency, expand the verification scope, and lower the barrier to entry.

[0011] In conclusion, given the increasingly urgent need for autonomous driving safety, researching a neural network robustness verification platform with adaptive capabilities and visual verification functions for traffic sign recognition scenarios has significant theoretical and engineering application value. This research will not only help promote the implementation of robustness verification technology in real traffic systems but also lay the foundation for building reliable, interpretable, and verifiable intelligent driving systems. The key technical challenges to overcome are as follows:

[0012] 1. In the research and experimentation of neural network robustness verification, existing works often focus on a single dimension (such as the algorithm's solveability or boundary tightness on large-scale networks). However, real-world applications are more complex, typically influenced by multiple factors including model structure, operator type, property form, perturbation settings, and computational resources, thus placing higher demands on robustness verification. Taking verification algorithms as an example, while exact methods can provide more rigorous and reliable verification conclusions, their computational complexity is high, and the verification process is often significantly time-consuming, making it difficult to meet the needs of efficient verification. Approximate methods have advantages in computational efficiency and can improve scalability, but due to the existence of relaxation and errors, they may not be able to provide effective judgments for some difficult samples, thus affecting the comprehensiveness and accuracy of the verification results. Therefore, how to fully leverage the complementary advantages of exact and approximate methods within a limited time budget to form a verification strategy that balances efficiency and verification capability, and maintains stable performance on different types of networks, is one of the core challenges facing robustness verification.

[0013] In practical applications, the use of validation tools often comes with high engineering and configuration costs. Existing validators lack a unified standard for model representation and property description. Different tools typically require their own specific input formats and semantic constraints. Users need to reorganize the property descriptions for the target validator and convert the network to be validated into a model format acceptable to them. Due to significant differences in input specifications, supported operator types, and implementation details among validators, this adaptation work is often further complicated. Even when using general intermediate representations such as ONNX, different validators still have inconsistent support for operator sets and operator semantics, which may still lead to problems such as inability to directly import or the need for additional rewriting. As a result, when trying to combine or compare multiple validation algorithms in the same validation task, the cost of input transformation, parameter configuration, and compatibility debugging increases significantly. Users usually need to master the specific limitations and interface constraints of each validator in order to complete the cross-tool validation process setup and stable operation.

[0014] Meanwhile, designing and implementing a robust verification platform for traffic signs also presents numerous challenges. These include how to provide flexible import capabilities for custom neural network models, how to automatically fill in some configuration items by parsing neural network models, and how to integrate different algorithms for robustness verification, providing users with a sound and stable robust verification platform. These issues are all extremely challenging. Summary of the Invention

[0015] The purpose of this invention is to provide a robust verification method for neural networks for traffic sign recognition that solves the above-mentioned problems. By orderly combining the sample attack verification method with the approximate verification algorithm and the exact verification algorithm, an algorithm combination-timeout prediction model AGTN and its matching training dataset are constructed. Taking the multidimensional features of the neural network to be verified as input, the algorithm combination scheme and the corresponding timeout allocation after balancing the verification time and verification capability are output, thereby automatically generating more suitable verification configurations for different models.

[0016] To achieve the above objectives, the technical solution adopted by this invention is: a neural network robustness verification method for traffic sign recognition, the method steps of which are as follows:

[0017] S1. Construct the AGTN model, taking the multidimensional features of the traffic sign recognition neural network as input, and outputting the appropriate combination of verification algorithms and the timeout duration of each algorithm;

[0018] The AGTN model adopts a dual multilayer perceptron structure, including an algorithm combination generation module (MLP) and a timeout generation module (MLP), which respectively output the optimal algorithm combination and the corresponding timeout duration adapted to the current model. The AGTN model adaptively generates the optimal algorithm combination and timeout duration to improve the platform's processing efficiency while ensuring verification accuracy.

[0019] S2. Construct an NNVF neural network verification framework. The NNVF neural network verification framework standardizes the traffic sign recognition neural network model to be verified, describes the robust verification properties through the NNPL domain-specific language, performs semantically preserved network simplification on the standardized model, and performs reduction processing on the standardized verification properties to convert the complex properties into a unified form that the verification algorithm can handle.

[0020] S3. Perform structural analysis on the traffic sign recognition neural network model to be verified, and extract the key features that affect the robustness verification.

[0021] S4. The extracted features are used as input to the trained AGTN model to obtain an adaptive optimal combination of verification algorithms and timeout configuration. The combination of verification algorithms includes at least one of adversarial example attack algorithms, approximate verification algorithms, and exact verification algorithms, and is arranged in order of computational cost from low to high.

[0022] The S5.NNVF neural network verification framework calls each algorithm sequentially to verify the samples according to the order of the algorithm combination. If an algorithm outputs "safe" or "unsafe", the verification is terminated immediately; if it outputs "unknown", the next algorithm is executed, until all algorithms in the combination have been executed.

[0023] S6. Normalize and analyze the output results of each verification algorithm to obtain a unified robustness verification conclusion.

[0024] Preferably, in step S1, the AGTN model is constructed as follows:

[0025] a. Select the PGD adversarial example attack algorithm, α-CROWN approximate verification algorithm, β-CROWN exact verification algorithm, and MIP exact verification algorithm as the basic verification algorithms, and generate all possible algorithm combinations;

[0026] b. Construct traffic sign recognition MLP and CNN neural network model datasets of different sizes, depths, and accuracy rates, and extract the core features of each model;

[0027] The traffic sign recognition model dataset is trained based on the GTSRB and TSRD traffic sign datasets, covering MLP models with 1-4 layers and CNN models with 1-4 layers, and different accuracy models are generated by adjusting the training hyperparameters.

[0028] c. Use various algorithm combinations to robustly verify the models in the dataset, and calculate the verification rate and verification time of each combination. Determine the optimal algorithm combination for each model based on the principle of "prioritizing verification rate and selecting the shortest time when the verification rate is the same".

[0029] d. Calculate the longest time taken to verify successful samples under each optimal algorithm combination, and divide the timeout duration into five intervals: 0, 30, 60, 90, and 120 seconds;

[0030] e. A dual multilayer perceptron structure is adopted to train the algorithm combination generation submodule and the timeout generation submodule separately. The algorithm combination generation submodule takes the core features of the model as input and outputs the optimal algorithm combination; the timeout generation submodule takes the core features of the model and the algorithm combination as input and outputs the timeout configuration.

[0031] Preferably, in step S2, the NNVF neural network verification framework performs the following network simplification operations: merging batch normalization layers with convolutional / fully connected layers, removing identity structures, converting matrix multiplication + addition to generalized matrix multiplication, merging continuous generalized matrix multiplications, merging continuous convolutional layers, binding explicit padding to convolutional / pooling layers, and shifting activation functions across reshaping operations. All simplification operations ensure that the semantics of the model output remain unchanged.

[0032] To enable validators to be applied to a wider range of real-world networks, NNVF provides network simplification tools. Because different validators support varying sets of operators and structural patterns, many practical models often contain operators that the validators do not support or combinations of operators that are difficult to handle. Therefore, the NNVF neural network validation framework performs a semantically preserved structural rewrite of the network before the validator is invoked: on the one hand, it removes unsupported structures; on the other hand, it equivalently transforms several operator sequences into more "common and widely supported" operator or structural forms, thereby reducing the engineering costs of network import and subsequent analysis, and improving the coverage of validators. This idea is abstracted at the framework level as an equivalent transformation of the network's "operation graph."

[0033] The formal definition is to define deep neural networks Represented as an operation diagram , where nodes Represents a specific operator, edge Representing the input dependencies of operators, network simplification is defined as a mapping: , operation diagram Transform into an equivalent network with a more common structure To ensure consistent output behavior: Under the above constraints, the goal of simplification is not to change the model's functionality, but to prioritize the use of more generally supported structures through structural rewriting so that subsequent translators and validators can handle it stably.

[0034] NNVF primarily uses the following network simplification techniques:

[0035] (1) BatchNormalizationSimplification: BatchNormalization is removed from the network by merging it with its preceding Conv or Gemm; if there is no preceding layer to merge, BatchNormalization is converted into an equivalent Conv. This transformation can reduce the number of model operators and improve validator support.

[0036] (2) IdentityRemoval: This rule removes identity structures from the network that have no semantic impact, including explicit Identity, single-input Concat, and Flatten acting on flattened tensors. Such structures may be introduced by the derivation process or user error. Their removal does not affect the network behavior, but can significantly reduce the complexity of the graph structure and reduce subsequent pattern matching and translation branches.

[0037] (3) ConvertMatMulfoledbyAddtoGemm; When a common linear pattern of "matrix multiplication (MatMul) followed by addition (Add)" appears in the network, it is converted into the equivalent Gemm (generalized matrix multiplication) operator. Gemm provides a unified expression for "multiplication and addition", which is beneficial for subsequent processing and analysis: on the one hand, it reduces the number of operators, and on the other hand, it allows downstream validators to cover such linear patterns by only supporting Gemm.

[0038] (4) CombineConsecutiveGemm; If two consecutive Gemm exist, they are merged into an equivalent Gemm, thereby reducing the depth of the operation graph and the number of nodes. This rule is essentially a combination of consecutive affine transformations and is often used to compress linear layer links into a single-layer representation to reduce the coding size inside the validator.

[0039] (5) CombineConsecutiveConv; under special conditions, consecutive Convs can be merged into a single equivalent Conv. The conditions currently supported by the framework include: the first convolutional layer has a stride of 1 and a diagonal 1×1 convolutional kernel without zero padding, and the second convolutional layer also has no zero padding.

[0040] (6) BundlePad; This rule binds (merges) the explicit Pad with the following Conv or MaxPool, which simplifies the model structure and improves importability and compatibility.

[0041] (7) MoveActivationsBackward; This rule moves the activation function across reshape operators (reshaping operations) so that it follows the nearest non-reshaping operator. This rule can reduce the complexity of pattern matching in subsequent analysis (reducing the number of possible patterns), thereby improving the stability and feasibility of subsequent steps (such as structure recognition, operator sequence merging, etc.).

[0042] It is important to emphasize that network simplification is always based on For correctness constraints (semantic preservation), the goal is to change the "representation" rather than the "function." Therefore, this module is more suitable as a general preprocessing step in the framework layer, providing a more stable structural foundation for subsequent property reduction, input translation, and validator execution.

[0043] The goal of the property reduction module is to encode general neural network validation problems into a set of standardized problems that can be handled within the capability boundaries of the target validator, without requiring the underlying validator to natively support complex property types. This decouples the "property representation capability" from the "validator support capability." The validation problems addressed by this module can typically be abstracted as follows: given a deep neural network... With properties and specifications The properties are determined by input constraints (preconditions). Output constraints (postconditions) By common definition, the verification task aims to prove or falsify the following propositions:

[0044]

[0045] In engineering practice, many verifiers only support a few fixed types of properties (such as local robustness or specific forms of reachability constraints), while more general security properties are often difficult to express directly as acceptable inputs for verifiers. The property reduction module, through systematic logical transformation and network structure enhancement, reduces complex properties to a unified target property type, enabling verifiers to cover a wider range of verification problems by only implementing the processing of a single property type.

[0046] Preferably, in step S2, the property reduction process of the NNVF neural network verification framework is as follows:

[0047] a. Negate the verification property and transform it into disjunctive normal form (DNF);

[0048] The algorithm first calculates Intuitively, this means: if the original property... If something can be falsified, then there must exist some input such that... Established; and the DNF format will This can be expressed as an OR of several "disjuncts," with each disjunct containing an AND of multiple constraints. Thus, finding counterexamples can be decomposed into finding a satisfying solution for each disjunct separately.

[0049] b. Construct a sub-validation problem for each disjunctive term and extract the input and output constraints for each disjunctive term;

[0050] For each Algorithm extracts input constraints With output constraints In this way, each subproblem corresponds to a specific "violation pattern": the input meets certain conditions, and the output falls into a certain violation region.

[0051] c. Geometrize the output constraints into a half-space polyhedron and construct a suffix network;

[0052] Output constraints It is further transformed into a half-space polyhedron And construct a suffix network based on this. The suffix network is then combined with the original network to form a new network. And rewrite the properties into a standard comparative form (e.g.) This process essentially embeds the determination of whether the output violates the constraints into the comparison of the output components of a new network, thereby reducing complex postconditions to a canonical form that is easier for the validator to support.

[0053] d. Finally, the suffix network is combined with the original traffic sign recognition neural network, and the complex properties are reduced to the standard output component comparison form.

[0054] The property reduction module systematically reduces general properties to a unified form easily supported by the validator through a path of "negation and DNF decomposition—branch-by-branch constraint extraction—output constraint geometrization—suffix network embedding decision—unification into a standard property form." On the one hand, it significantly improves the framework's ability to support diverse property expressions; on the other hand, it moves the general work of handling complex properties to the framework layer, thereby reducing the need for large-scale engineering modifications on the validator side to adapt to new properties, providing key support for the scalability and maintainability of the tool integration framework.

[0055] As a preferred option, the specific rules for sequentially calling each verification algorithm in step S5 are as follows:

[0056] First, execute the PGD adversarial example attack algorithm. If an adversarial example is detected, output the SAT conclusion and terminate the verification.

[0057] If not detected, the α-CROWN approximate verification algorithm is executed. If robustness can be proven, the UNSAT conclusion is output and the verification is terminated.

[0058] If the output is unknown, execute the β-CROWN or MIP exact verification algorithm and output the corresponding conclusion based on the verification result;

[0059] If no conclusion is reached within the timeout period, output UNKNOWN.

[0060] Compared with the prior art, the advantages of the present invention are as follows:

[0061] (1) The present invention constructs an AGTN algorithm combination-timeout prediction model, which can adaptively generate the optimal combination of verification algorithms and timeout duration configuration based on the core features of the traffic sign recognition neural network, such as scale, depth, and accuracy. This solves the problems of poor compatibility of fixed algorithm combinations and lack of specificity in timeout duration configuration, realizes the reasonable allocation of verification resources, and significantly improves verification efficiency.

[0062] (2) Based on the NNVF verification framework, this invention realizes the standardization of model and verification properties. The ONNX unified intermediate representation solves the model format compatibility problem of different verification tools. The NNPL domain-specific language realizes the standardized description of verification properties. At the same time, the semantically preserved network simplification and property reduction reduce the cost of using verification tools and improve the versatility of the method.

[0063] (3) This invention has been specially optimized for the scene characteristics of traffic sign recognition. The model dataset is trained based on real traffic sign datasets (GTSRB, TSRD). The verification property is the category invariance of traffic sign recognition. The verification results contain specific information of adversarial examples, which can directly provide a basis for the optimization and improvement of traffic sign recognition models in autonomous driving scenarios. It has strong engineering practicality. Attached Figure Description Figure 1 This is a diagram of the overall architecture of the present invention; Figure 2 This is a model architecture diagram of the AGTN model; Figure 3 A schematic diagram illustrating the correlation between neural network model size and robustness verification; Figure 4 This diagram illustrates the relationship between neural network model depth and robustness verification. Figure 5 This diagram illustrates the relationship between the accuracy and robustness verification of a neural network model. Figure 6 The diagram illustrates the relationship between timeout duration and robustness verification. Figure 7 This is a schematic diagram illustrating the experimental evaluation results of the CNN network model. Figure 8 A schematic diagram showing the experimental evaluation results of models with different accuracy rates; Figure 9 This is a schematic diagram of the NNVF framework of the present invention. Detailed Implementation

[0064] The present invention will be further described below.

[0065] I. A robustness verification method for neural networks for traffic sign recognition, the steps of which are as follows:

[0066] S1. Construct the AGTN model, taking the multidimensional features of the traffic sign recognition neural network as input, and outputting the appropriate combination of verification algorithms and the timeout duration of each algorithm;

[0067] The AGTN model adopts a dual multilayer perceptron structure, including an algorithm combination generation module (MLP) and a timeout generation module (MLP), which respectively output the optimal algorithm combination and the corresponding timeout duration adapted to the current model. The AGTN model adaptively generates the optimal algorithm combination and timeout duration to improve the platform's processing efficiency while ensuring verification accuracy.

[0068] The core of this invention's neural network robustness verification lies in whether the network's prediction result can still maintain the expected target category after the input undergoes a certain degree of perturbation. In autonomous driving scenarios, one of the core objectives of neural network robustness verification is to evaluate whether the model output can still accurately match the preset traffic sign category label when the input is subjected to specific perturbations such as illumination distortion, partial occlusion, and noise interference during traffic sign recognition. Furthermore, different models have different architectures and scales, making it difficult for fixed algorithm combinations to adapt to all scenarios. The high computational complexity of precise algorithms may lead to verification timeouts, affecting the overall platform efficiency. Therefore, this invention addresses two key issues: first, how to adaptively select the optimal algorithm combination based on model characteristics; and second, how to optimize the verification timeout duration to maximize the effective verification sample size within a limited time.

[0069] Therefore, this invention constructs an AGTN model, which has two main modules: AGTN algorithm combination and timeout prediction, integrating four methods: adversarial example attack algorithm (PGD), approximation algorithm (α-CROWN), and exact algorithm (β-CROWN, MIP). The overall architecture of the AGTN model is as follows: Figure 1 As shown.

[0070] The core function of the AGTN model in this invention is to adaptively generate the optimal algorithm combination and timeout duration based on the characteristics of the input model, thereby improving the platform's processing efficiency while ensuring verification accuracy. The model architecture is as follows: Figure 2 As shown, a dual multilayer perceptron (MLP) structure is adopted, responsible for algorithm combination decision-making and timeout prediction respectively. Algorithm combination MLP: The input is model features, containing one input layer, one hidden layer (20 neurons), and one output layer. To avoid overfitting on small datasets, a Dropout regularization layer is added after the hidden layer. Timeout prediction MLP: The input is "the output of the algorithm combination MLP + model features", with a total of 6 feature dimensions. The output is a timeout classification (0, 30, 60, 90, 120 seconds, 5 categories), adapting to the rapid validation requirements of traffic sign recognition models.

[0071] S2. Construct an NNVF neural network verification framework. The NNVF neural network verification framework standardizes the traffic sign recognition neural network model to be verified, describes the robust verification properties through the NNPL domain-specific language, performs semantically preserved network simplification on the standardized model, and performs reduction processing on the standardized verification properties to convert the complex properties into a unified form that the verification algorithm can handle.

[0072] This invention, the NNVF neural network verification framework, is geared towards engineering practices for formal verification of deep neural networks, addressing issues such as difficulties in reusing verification tools, inconsistent input / output specifications, and high adaptation costs. NNVF abstracts the verification process into a systematic transformation from a unified task description to executable inputs for the verifier, achieving consistent scheduling and unified management of multiple verifiers through intermediate representations and pluggable adaptation mechanisms at the framework layer.

[0073] A schematic diagram of the NNVF framework of this invention is shown below. Figure 9 As shown, NNVF represents the verification task as a combination of "network + property," where the network uses ONNX as a unified intermediate representation, and the properties are normalized using the domain-specific language NNPL. Based on this, the framework organizes the key processing steps in a pipeline manner as follows:

[0074] First, the network is structurally simplified to reduce redundant operators and improve downstream compatibility;

[0075] Secondly, the properties are reduced to transform complex constraints into a uniform form that the verifier can handle;

[0076] Subsequently, the input translation and execution scheduling are completed through the validator plugin, and the outputs of different validators are parsed and normalized to form consistent semantic conclusions and structured results. This design isolates the differences between validators at the plugin side, keeping the main framework flow stable. Thus, when expanding to include new validators or new property types, only the corresponding translation, execution, and result parsing modules need to be added to complete the integration.

[0077] (1) Network input formatting

[0078] To describe general deep neural network architectures, NNVF chooses the open-source DNN representation format ONNX. The table below shows the number of ONNX operations supported by each validator in NNVF.

[0079]

[0080] (2) Formatting of property input

[0081] For a long time, DNN validators have lacked a unified and universal property description format, often requiring users to repeatedly rewrite properties and adjust constraint expressions. To address this issue, NNVF proposed a domain-specific language (DSL) embedded in Python, called NNPL, for standardized descriptions of validation properties of deep neural networks.

[0082] The core design philosophy of NNPL is to express various properties that "existing validators can handle" using a unified syntax and semantics without relying on specific network structures. This allows the same property specification to be further translated by NNVF into the input formats of different validators, reducing the workload of users repeatedly modifying properties when switching between multiple tools. Furthermore, since NNPL is embedded in Python, property writing can directly reuse data processing and preprocessing code from the Python ecosystem (e.g., loading datasets, performing normalization / denormalization), making the property specification more closely aligned with the actual development process of deep learning models.

[0083] NNPL mainly consists of three parts: Python module imports, variable definitions, and the final property expressions. The import section is used to introduce the Python modules or packages required for property description. Its syntax is consistent with Python's import conventions and allows importing arbitrary Python modules to reuse data and preprocessing code. Import statements, at the grammatical level, contain at least three common forms: `import`. <id>、import <id>as <id>and from <id>import <id>Furthermore, it allows for multiple import statements or empty statements. This design enables property files to be directly integrated with tools such as NumPy and dataset loading tools, thereby completing operations such as "sample taking, statistical calculation, and input construction" within the property specification, avoiding the separation of preprocessing logic into additional scripts.

[0084] After the import is complete, NNPL allows you to define variables through a series of assignment statements, such as... <assignment> ::= <id> '=' <expr>And can be repeated to constitute <assignment-list>These variables are typically used for: loading data and configurations (such as constants, paths, means, and variances), aliasing complex sub-expressions to improve readability, and providing reusable intermediate quantities for subsequent property expressions.

[0085] Property expressions are used to characterize the core part of the expected behavior of the network and must be placed at the end of the specification file; only Python import statements and variable assignment statements are allowed before this, which are used to complete preparatory work such as data loading, parameter setting, and intermediate expression definition. Property expressions are described on a subset of first-order logic, and at the same time, arbitrary Python code is allowed to be embedded and variables and expressions defined previously can be reused, so as to balance the formal expression ability and engineering usability. To support common property construction, NNPL provides logical combination and quantification functions such as Forall, And, Or, Implies, etc., and supports obtaining the minimum / maximum index of the network output through argmin / argmax; inside the expression, the network can be regarded as a function and directly called, and its input can be either a symbol variable obtained by universal quantification or a specific numerical input such as a numpy array.

[0086] Example of local robustness property: Its core meaning is that the code first defines the network N to be verified and gives the data preprocessing parameters (mean and standard deviation stddev). Since the input sample x is read in an unnormalized form, the variable x_ is mapped back from the normalized space to the original pixel space through denormalize to ensure that the perturbation is carried out under a consistent scale. Subsequently, the perturbation radius parameter (default 2 / 255) is introduced, and the robustness requirement is formalized using the Forall-Implies structure: for any normalized input x_, if its denormalization satisfies the pixel range constraint 0 < denormalize(x_) < 1 and is within the neighborhood of the original sample x, then the predicted class of the network output must remain true_class = 3. If this property can be proven to hold, it indicates that the model has verifiable classification stability for samples within this perturbation range; otherwise, adversarial samples that satisfy the constraints can be generated as counterexamples.

[0087] The NNPL and ONNX of the present invention can support DNNs with multiple inputs, multiple outputs, and arbitrary tensor shapes. The ONNX format adopted by NNVF is more common and more convenient to obtain in most machine learning frameworks.

[0088] This invention converts the model into an ONNX unified intermediate representation using the NNVF neural network validation framework, and describes the robustness validation property using the NNPL domain-specific language. The robustness validation property is the category invariance of traffic sign recognition, which is formally described as follows: for a given traffic sign image sample x0, for all inputs x in the perturbation set X(x0,ϵ), the model's predicted category is consistent with the true category of x0, where the perturbation set X(x0,ϵ) satisfies x∈[0,1]n and ||x−x0||p≤ϵ, p∈1,2,∞, and ϵ is the perturbation radius.

[0089] After completing input formatting, network simplification, and property reduction, the framework internally represents a unified "network + property" validation problem. To shield heterogeneity and support seamless switching of the same validation task across different backends, NNVF introduces an "input translation and validation execution" component on the backend side: on the one hand, it automatically converts the unified representation into artifacts acceptable to the target validator; on the other hand, it drives the validator to run and manages resources and exceptions in a consistent manner, thereby achieving the integrated effect of "unified frontend description and automatic backend adaptation".

[0090] Different validators exhibit significant differences in the output formats of validation conclusions, counterexample representations, and runtime statistics: some directly output sat / unsat / unknown, some output custom status codes or log text, and some provide input vectors when a counterexample is found but lack a unified format specification. Therefore, NNVF introduces an "output translation and result normalization" component after the validator execution to parse, verify, and structurally encapsulate heterogeneous outputs, ultimately forming a unified result object which is then processed by the storage and display modules.

[0091] (1) Unify result semantics

[0092] The framework maps the validator output to four types of states:

[0093] SAT: Inputs that violate the rules (find counterexamples / adversarial examples);

[0094] UNSAT: The property can be proven to hold in the given input domain (without counterexamples).

[0095] UNKNOWN: A provable conclusion cannot be obtained within resource constraints (e.g., premature termination, bounded non-convergence, etc.).

[0096] ERROR: The program failed to run or the output was unparseable (e.g., crash, malformed format, missing dependencies).

[0097] This unified semantics not only facilitates horizontal comparison of different validators, but also facilitates the establishment of a stable mapping with task states (FINISHED / FAILED / TIMEOUT), supporting platform-side retrieval, statistics, and report generation.

[0098] (2) Output translator: a result translator for the validator

[0099] Similar to input translation, output translation employs a validator-specific parser: extracting (i) the conclusion state, (ii) the time consumption and key statistics from the validator's stdout / stderr, log file, or result file, and (iii) if it is SAT, extracting counterexample inputs and necessary auxiliary information (such as the trigger category, violated inequalities, etc.). The framework requires the output translator to consistently return at least three states: SAT / UnSAT / Unknown, and to return counterexamples when SAT is reached, thus ensuring that both "provable conclusions" and "verifiable counterexamples" can be consumed and displayed by the framework.

[0100] S3. Perform structural analysis on the traffic sign recognition neural network model to be verified, and extract the key features that affect the robustness verification.

[0101] The key features of this invention include five features: the number of fully connected layers, the number of neurons in fully connected layers, the number of convolutional layers, the number of neurons in convolutional layers, and the accuracy of the model. In addition, the timeout generation model uses a combination of algorithms generated by the algorithm generation model as the sixth feature input to predict the corresponding timeout duration.

[0102] S4. The extracted features are used as input to the trained AGTN model to obtain an adaptive optimal combination of verification algorithms and timeout configuration. The combination of verification algorithms includes at least one of adversarial example attack algorithms, approximate verification algorithms, and exact verification algorithms, and is arranged in order of computational cost from low to high.

[0103] The S5.NNVF neural network verification framework calls each algorithm sequentially to verify the samples according to the order of the algorithm combination. If an algorithm outputs "safe" or "unsafe", the verification is terminated immediately; if it outputs "unknown", the next algorithm is executed, until all algorithms in the combination have been executed.

[0104] S6. Normalize and analyze the output results of each verification algorithm to obtain a unified robustness verification conclusion. The naming rule for the algorithm combination is: arrange the algorithm names in the execution order, and separate the algorithms with hyphens (e.g., PGD-α-CROWN-MIP means that PGD, α-CROWN, and MIP are executed in sequence).

[0105] II. AGTN Model Testing:

[0106] 1. Experimental setup and evaluation criteria are shown in Table 1.

[0107] Table 1 Hardware and software environment configuration and dataset:

[0108]

[0109] The evaluation metrics focus on verification efficiency and accuracy, and are defined as follows:

[0110] Total verification time: The total time taken to complete the verification of all samples. The shorter the time, the higher the platform's processing efficiency. Verification rate: The percentage of samples successfully judged as "safe" or "unsafe," calculated using the following formula:

[0111]

[0112] PGD, α-CROWN, β-CROWN, and MIP were selected as the validation algorithms for our experiments. We first evaluated all possible combinations of these algorithms to find the best-performing schemes in terms of both validation rate and total validation time, while eliminating poorly performing schemes. The final algorithm combinations will be used as classification labels in subsequent classification tasks.

[0113] Experiment 1: A small MLP model trained on the MNIST dataset was selected. This model mainly consists of two fully connected layers and one output layer, with each fully connected layer having 512 neurons. The robustness of the MLP model was validated using eight different algorithm combinations: PGD, α-CROWN, αβ-CROWN, PGD-α-CROWN, PGD-αβ-CROWN, MIP, α-CROWN-MIP, and PGD-α-CROWN-MIP. The experimental results are shown in Table 2.

[0114] Table 2 Comparative experimental results of different algorithm combinations on MLP networks:

[0115]

[0116] As can be observed from Table 2:

[0117] (1) In terms of the verification effect, the verification rate of PGD alone is only 0.05 (95 out of 100 samples are "unknown", which can hardly play a reliable verification role), while α-CROWN and αβ-CROWN can steadily increase the verification rate to 0.90 (each has 90 safe samples and 10 unknown samples). After adding MIP or combining with PGD, the number of unknown samples is reduced to 0 and the verification rate reaches 1.00 (for example, MIP, PGD-α-CROWN, α-CROWN-MIP, PGD-αβ-CROWN, and PGD-α-CROWN-MIP all have 90 safe samples and 10 unsafe samples). This shows that "boundary propagation method (α-CROWN) + exact solution (MIP) or superimposed PGD" can significantly improve the coverage and eliminate undetermined samples.

[0118] (2) In terms of validation time, achieving a validation rate of 1.00 is not necessarily slower: MIP itself is the fastest in the table (3.11s) with a validation rate of 1.00, while some more complex combinations will bring significant time overhead (α-CROWN-MIP is 9.20s, PGD-α-CROWN is 7.62s). At the same time, among the schemes with the same validation rate of 1.00, PGD-αβ-CROWN (5.51s) and PGD-α-CROWN-MIP (6.24s) are relatively more time-efficient, indicating that there is a phenomenon of "the same validation coverage but very different time consumption" in combination strategies. When choosing, we should pay more attention to the optimal configuration under the premise of ensuring no unknown samples.

[0119] Experiment 2: Based on the conclusions of Experiment 1, and after removing some algorithms and combinations that performed poorly in validation, the remaining five algorithm combinations were used to validate a CNN model trained on the CIFAR-10 dataset. This CNN model contains one convolutional layer with 128 channels. The comparative experimental results of different algorithm combinations on the CNN network are shown in Table 3.

[0120] Table 3:

[0121]

[0122] From Table 3, we can draw the following conclusions:

[0123] (1) From the perspective of the verification effect, both PGD-α-CROWN and PGD-αβ-CROWN can achieve a verification rate of 0.97, but there are still 3 unknown samples in each (i.e., there are still samples that cannot be completely determined). However, once MIP is introduced (whether it is MIP alone, α-CROWN-MIP, or PGD-α-CROWN-MIP), the number of unknown samples becomes 0 and the verification rate increases to 1.00. This shows that under this set of data, "accurately solving the MIP of the class" is the key link to eliminate the unknown and achieve complete verification.

[0124] (2) In terms of verification time, the efficiency of different combinations varies greatly: with the same verification rate of 0.97, the time taken by PGD-αβ-CROWN is as high as 193.52s, which is much higher than the 13.65s of PGD-α-CROWN. This shows that the αβ version brings significant additional overhead but does not improve the verification rate. In the scheme with the same verification rate of 1.00, MIP alone is the slowest (750.62s), α-CROWN-MIP reduces the time to 302.62s, and PGD-α-CROWN-MIP with PGD added reduces it to 83.64s. This shows that a reasonable combination can greatly accelerate the verification process while maintaining complete verification.

[0125] Based on the conclusions of Experiments 1 and 2, and considering the applicability, stability verification, and computational cost under different network structures, we ultimately selected PGD-α-CROWN, PGD-αβ-CROWN, PGD-α-CROWN-MIP, and MIP as four algorithm combinations for subsequent experiments and comparisons.

[0126] 2. Experiment on the influence of features on the robustness verification of neural networks

[0127] This experiment explores the correlation between key features of neural network models, such as size, depth, and accuracy, and robustness validation rate and total validation time. The experiment will conduct robust validation experiments on MLP or CNN neural networks with different structures using four selected algorithm combinations: PGD-α-CROWN, PGD-αβ-CROWN, PGD-α-CROWN-MIP, and MIP. The validation rate and total validation time of each model will be recorded simultaneously. Through in-depth analysis of the experimental data, the feature factors that significantly affect the validation effect will be identified and determined as the input feature parameters of the AGTN model.

[0128] Experiment 3: Focusing on the key influencing factor of neural network model size, five CNN models trained on the CIFAR10 dataset were selected, with their network sizes showing a gradient increasing trend. Robustness verification experiments were conducted using three algorithm combinations: PGD-α-CROWN, PGD-αβ-CROWN, and PGD-α-CROWN-MIP. By comparing and analyzing the verification rate and verification time data obtained from the experiments, the influence of model size on the selection of algorithm combinations was explored. The relevant experimental results are as follows: Figure 3 As shown, this diagram illustrates the correlation between the size of the neural network model and robustness verification.

[0129] Figure 3 (a) The results show that the overall validation accuracy of the three methods decreases as the model size increases, indicating that validation of larger-scale models is more difficult and the accuracy advantage is hard to maintain. Figure 3 (b) The validation time increases significantly with the model size. The time cost of different methods varies significantly. PGD-α-CROWN is the most time-efficient, PGD-αβ-CROWN is the most time-consuming and the growth is the most dramatic, and PGD-α-CROWN-MIP is in the middle. This shows that the main cost of large model validation comes from the computation time and requires a trade-off between accuracy and efficiency.

[0130] Experiment 4: This experiment explores the impact of neural network model depth, a core feature, on robustness verification performance (including verification rate and verification time). The experiment used four CNN models trained on the CIFAR10 dataset. The core difference between these four models lies only in the number of convolutional layers: 1, 2, 3, and 4 layers respectively. All other network architecture details and training hyperparameters remained completely identical. For detailed verification data and analysis results, please refer to [link to relevant documentation]. Figure 4 A schematic diagram illustrating the relationship between neural network model depth and robustness verification.

[0131] Figure 4 (a) shows that as the network structure gradually increases from 128, the validation rate of the three combinations generally shows a downward trend: PGD-α-CROWN-MIP has the highest validation rate on the simplest network (128), but the decline is more obvious as the network becomes deeper; PGD-αβ-CROWN is relatively more "stable" in the medium complexity stage, with a validation rate higher than the other two overall, while the validation rates of the three tend to be close on the deepest 96_3_128. Figure 4 (b) shows that the verification time increases significantly with network complexity, and the costs of different combinations vary greatly: PGD-α-CROWN has the lowest overall time and the slowest growth; PGD-αβ-CROWN has a significantly higher time and increases rapidly with network depth; PGD-α-CROWN-MIP has the highest time, especially in deeper networks. Overall, this set of experiments presents a typical "verification rate vs. verification time" tradeoff: PGD-α-CROWN is more efficiency-oriented, PGD-αβ-CROWN has a higher verification rate advantage on some more complex networks but at a higher cost, while the combination of introducing MIP may bring a higher verification rate on simple networks, but the computational cost increases significantly in deep networks.

[0132] Experiment 5: This experiment focuses on exploring the intrinsic relationship and influencing mechanism between the accuracy and robustness verification effects of neural network models. This research provides crucial support for the accurate selection of input features for the AGTN model and the robustness verification needs of different performance models in practical scenarios such as traffic sign recognition. The experiment uses an MLP model trained on the MNIST dataset as the core carrier. This model contains two fully connected layers, a hidden layer with 128 neurons, and an output layer. By flexibly adjusting training hyperparameters such as the learning rate and number of iterations, six gradient models with accuracies of 0.318, 0.552, 0.653, 0.745, 0.824, and 0.968 were constructed to ensure the consistency of experimental conditions and the comparability of results. Specific experimental results are as follows: Figure 5 The diagram illustrates the relationship between the accuracy of a neural network model and robustness verification.

[0133] Figure 5 In (a), the verification rates of the three methods (MIP, PGD-α-CROWN-MIP, PGD-αβ-CROWN) remained almost 1.00 under different perturbation ranges and the curves basically overlapped, indicating that they could all stably achieve a near "complete verification" effect in this experimental setup, and the difference in verification accuracy was not significant. Figure 5 (b) shows a significant difference in efficiency: MIP has the longest overall verification time, especially when the perturbation range is small, it takes hundreds of seconds, but the time decreases significantly as the perturbation range increases; in contrast, PGD-α-CROWN-MIP and PGD-αβ-CROWN have significantly lower overall time and less fluctuation, taking only tens of seconds or even less at multiple perturbation points, demonstrating better time efficiency and better scalability without sacrificing the verification rate.

[0134] The results of experiments 3-5 show that the size and structural complexity of neural networks (including increasing the number of neurons in a single layer, increasing network depth, and changes from shallow to multi-layer / wide-deep hybrid structures) significantly alter verifiability performance. The size and depth of the network's neurons, the resulting improvement in accuracy, and the specific structural morphology together constitute the main sources of the "verification rate vs. verification time" tradeoff, and this influence manifests as varying degrees of sensitivity and scalability differences under different combinations of verification algorithms.

[0135] Based on the experimental results of Experiments 3-5 above, the input of the adaptive verification algorithm model AGTN of this invention can be set to five feature values: the number of fully connected layers, the number of neurons in fully connected layers, the number of convolutional layers, the number of neurons in convolutional layers, and the model's accuracy. The timeout generation model will, based on the algorithm generation model, use the algorithm combination generated by the algorithm generation model as the sixth feature value input to predict its corresponding timeout duration.

[0136] 3. The impact of the extended time on the experiment

[0137] The selection of the optimal algorithm combination is just as important as the timeout duration. The reasonable setting of the timeout duration also has a significant impact on the core indicators of robustness verification (verification rate and total verification time). A scientific timeout threshold can greatly optimize verification efficiency while ensuring verification accuracy. This research has key reference significance for the performance optimization of robustness verification platforms in practical application scenarios such as traffic sign recognition.

[0138] This invention specifically selected the CNN_150_3 model trained on the CIFAR-10 dataset for robustness verification experiments. This model consists of three two-dimensional convolutional layers, each with 150 channels, effectively enabling deep feature extraction and spatial aggregation. The timeout durations set in the experiments were 30 seconds, 60 seconds, 90 seconds, 120 seconds, 240 seconds, and 360 seconds, covering short, medium, and long time intervals. The PGD-αβ-CROWN algorithm combination, which has been previously verified to have good adaptability, was used for verification. The perturbation coefficient of 0.007843 and the number of verification samples of 100 were strictly maintained as in previous experiments. During the experiments, the verification rate and total verification time of the model under different timeout durations were recorded simultaneously. Specific experimental data and trend analysis results are as follows: Figure 6 The diagram illustrates the relationship between timeout duration and robustness verification.

[0139] 3.1 Dataset Construction

[0140] The specific construction process of the dataset is as follows: Generate neural network models of different types, depths and widths in batches (covering MLP and CNN architectures commonly used in traffic sign recognition) — Train MLP models of various specifications using the MNIST dataset, with fully connected layer parameters increasing in increments of 10 (maximum 600), and 1-4 layers. Different accuracy versions are obtained by adjusting hyperparameters; Generate various CNN models based on the CIFAR10 dataset, with the number of channels in convolutional layers increasing in increments of 10 (deeper layers are not less than shallower layers), up to a maximum of 260 channels and 4 layers. Since the CNN verification algorithm combination all includes PGD, the accuracy feature is uniformly set to 1.

[0141] Subsequently, all generative models were iteratively validated: the MLP used a combination of MIP and PGD-αβ-CROWN algorithms, and the CNN used a combination of PGD-α-MIP, PGD-αβ-CROWN, and PGD-α-CROWN algorithms. Validation rates and timeout durations were recorded. The optimal algorithm combination was determined according to the principle of "validation rate priority, and shortest execution time when rates are equal." The timeout duration was the longest execution time of successfully validated samples, categorized into five intervals: 0, 30, 60, 90, and 120 seconds. This ensured accurate generation of model feature labels, providing high-quality data support for AGTN model training.

[0142] 3.2 Experimental Setup and Evaluation Indicators

[0143] To verify the practical performance of the proposed adaptive robustness verification method in traffic sign recognition scenarios, comparative verification experiments were designed for two core neural network architectures: MLP and CNN. Each experiment selected eight models with varying numbers of neurons and layers as test samples. Based on the proposed adaptive verification method, a customized verification configuration containing the optimal algorithm combination and timeout duration was generated for each test model. The control group used a unified default verification scheme (PGD-αβ-CROWN algorithm combination with a 60-second single-sample timeout duration) for comparison. The design basis for this default scheme is that the 60-second timeout threshold can prevent the uncontrolled growth of the total verification time for large neural networks. The PGD-αβ-CROWN algorithm combination was selected as the benchmark algorithm due to its wide adaptability and stable verification effect across various neural networks. In addition, comparative experiments were set up with models of different accuracy rates. Customized configurations generated by the adaptive method and the default benchmark configuration were applied to MLP and CNN models with different accuracy levels, respectively, to compare the performance differences between the two in the two core indicators: verification rate and total verification time. The core evaluation metrics for this experiment are total validation time and validation rate. By comparing the performance of the two configurations on these two metrics, the relative advantages of the adaptive robust validation method are comprehensively evaluated.

[0144] 3.3 MLP Model Evaluation Experiment

[0145] First, eight MLP models of varying specifications were constructed and trained based on the GTSRB traffic sign dataset. All models had 1 to 4 fully connected layers, with the same number of layers corresponding to two model versions of different sizes. In the experiments, the perturbation coefficient was set to 0.007843, and the validation sample size was set to 200. Detailed experimental results are shown in Table 4 below.

[0146] Table 4: Experimental Evaluation Results of the Network Model

[0147]

[0148] Table 4 reveals two relatively stable patterns: First, given a 30s timeout setting and the default setting, the validation rate for each network configuration and the default validation rate are both 1.00%, indicating that the selected validation method can achieve complete validation for different MLP structures within this experimental range, and the validation results are not sensitive to the timeout parameter. Second, the validation duration is mainly affected by the network structure and timeout strategy. Under the same algorithm, as the network configuration changes from mlp_16_1 to mlp_16_4 (increasing structural complexity), the duration and the default duration generally show an upward trend. Furthermore, the default timeout increases more significantly, demonstrating that increasing network size / depth will significantly increase the computational cost of verification. At the same time, setting the timeout to 30 seconds can usually reduce the overall timeout to below the default timeout. In addition, some larger-scale networks (such as mlp_512_3 and mlp_512_4) use PGD-αβ-CROWN instead of MIP, and their timeout is longer than the previous two MIP results. This reflects that when the verification difficulty increases under more complex structures, the choice of algorithm will affect the efficiency performance and may require a stronger combination strategy to maintain complete verification.

[0149] 3.4 CNN Model Evaluation Experiment

[0150] For the experimental evaluation of the CNN models, eight CNN models with different specifications were trained using the ChineseTrafficSignDatabase (TSRD) dataset. These models had 1 to 4 convolutional layers, and for the same number of convolutional layers, there were two model versions with different file sizes. The perturbation coefficient was set at 0.007843 as previously mentioned, and the number of validation samples was fixed at 200. The relevant experimental data and results are detailed in Table 5 below.

[0151] Table 5: Experimental Evaluation Results of CNN Network Models

[0152]

[0153] See the diagram illustrating the experimental evaluation results of the CNN network model. Figure 7 ,from Figure 7 (a) As shown in Table 5, the configuration generated using the robust adaptive validation method can maintain the validation rate at a level comparable to or even higher than the default configuration on most CNN networks. Especially on some networks where the default configuration has a low validation rate, the adaptive configuration, by selecting a more suitable algorithm combination (such as introducing PGD-α-CROWN-MIP or using PGD-αβ-CROWN / PGD-α-CROWN in specific architectures), can improve the validation rate to 1.00 or achieve a visible gain; further combined with… Figure 7 (b) It is evident that the adaptive configuration has a more significant advantage in terms of verification time. Compared with the unified strategy of the default configuration, it significantly reduces computational overhead and reduces the long solution time caused by "hard samples" by adjusting the timeout time according to the network and matching a more suitable verification process. On complex or more difficult networks, the total time can be compressed from hundreds to thousands of seconds to tens to hundreds of seconds. At the same time, it can maintain a time consumption close to the default configuration on relatively easy networks, thus demonstrating better verification stability and efficiency scalability.

[0154] 3.5 Evaluation Experiments for Models with Different Accuracy Rates

[0155] For specific evaluation experiments of models with different accuracy rates, one CNN neural network model and one MLP neural network model were selected as research objects. The CNN model was trained on the ChineseTrafficSignDatabase (TSRD) dataset. Its network structure includes two convolutional layers with 32 channels. By adjusting the hyperparameters during training, three model versions with accuracies of 0.33, 0.45, and 0.56 were constructed. The MLP model was trained on the GermanTrafficSignRecognitionBenchmark (GTSRB) dataset. This model includes one input layer, two hidden layers, and one output layer. The hidden layer parameter was configured to 16. Similarly, by adjusting the training hyperparameters, three versions with accuracies of 0.52, 0.75, and 0.92 were obtained. The perturbation coefficient was kept at 0.007843, and the number of validation samples was fixed at 200. Detailed experimental results are shown in Table 6 below.

[0156] Table 6: Experimental Evaluation Results of Models with Different Accuracy Rates

[0157]

[0158] See the diagram illustrating the experimental evaluation results of models with different accuracy rates. Figure 8 .from Figure 8 (a) Comparing the validation rate results in Table 6, the core difference between the generated configuration and the default configuration lies in the more targeted algorithm combinations used for different model / accuracy levels, resulting in a more stable overall validation rate: On CNN_0.3 and CNN_0.45, the two are almost identical and close to 1.00, but on the more challenging CNN_0.66, the validation rate of the generated configuration is significantly higher than that of the default configuration, avoiding the larger drop seen in the default configuration at this point; for the MLP series, the generated configuration, under certain settings, selects more suitable timeouts and combinations to ensure that the validation rate is not inferior to the default configuration, and achieves an improvement from a non-perfect score to a perfect score when needed (e.g., by extending the timeout to 90s to reach 1.00). From Figure 3 Based on the verification time results in .8(b) and Table 3-7, the generated configuration is significantly more time-efficient than the default configuration in most cases, especially in cases where the default configuration's time consumption increases dramatically, such as with cnn_0.66. The generated configuration significantly compresses the total time and is generally shorter than the default configuration in other aspects as well. This time advantage mainly comes from the adaptive setting of the timeout duration in the generated configuration (e.g., mostly using 30s, but increasing to 90s when necessary) and the differentiated selection of the verification process, thereby reducing the long solution time and resource waste caused by the uniform strategy in the default configuration.

[0159] The experimental results above show that the algorithm combinations for generating configurations exhibit clear patterns, with each algorithm complementing the others: most configurations incorporate PGD, a method that does not require relaxation modeling and constructs adversarial examples iteratively using gradient information to determine whether the model is "insecure." The computational cost is determined by the forward inference cost and the number of iterations, and does not grow linearly with the model size. It has good adaptability to different architectures and network sizes, but it can only prove insecurity through counterexamples and cannot provide provable security conclusions. It has significant advantages in scenarios with low model accuracy and many counterexamples, and needs to be combined with other methods to achieve comprehensive verification.

[0160] Apart from the standalone MIP configuration in MLP scenarios, all other generation schemes include α-CROWN. This method transforms the output range into a lower bound propagation problem by linearly relaxing nonlinear activation, and optimizes the α parameter to tighten the bound to improve provability. It is suitable for feedforward, convolutional and other networks. The running time is related to the bound propagation calculation and has low sensitivity to model size. Because it can provide provable evidence for the safe state of samples, it is often used in conjunction with PGD to form an efficient verification combination of "fast counterexample finding + provable safety".

[0161] The combination of PGD and α-CROWN suffers from loose bounds due to approximate relaxation, making it difficult to obtain accurate conclusions for some samples. Therefore, various generation configurations introduce MIP as an accurate verification component. MIP transforms ReLU network verification into a mixed-integer linear programming problem, sorting ReLU nodes and solving them step by step through a heuristic strategy. It terminates early when the verification condition is met to reduce overhead. It relies on ReLU integer modeling and is suitable for feedforward and convolutional networks containing ReLU. The time consumption is highly correlated with the number of activated nodes. It can prove both model safety and insecurity simultaneously. It performs well alone in small-scale, high-accuracy MLPs. The hybrid strategy combined with PGD and α-CROWN outperforms β-CROWN on small-scale CNNs, demonstrating the efficiency and effectiveness advantages of "approximate contraction + accurate solution" in this type of scenario.

[0162] In summary, the proposed neural network robust adaptive verification scheme of this invention, and the AGTN model it constructs, can be used to output the optimal configuration of algorithm combinations and verification timeout parameters. Multiple sets of comparative experiments were conducted on MLPs and CNNs of different sizes, depths, and accuracies to evaluate the verification rate and computational cost of various combination strategies. This allowed for the selection of key features affecting verification performance and superior combination forms, which were then used to construct the training data for AGTN. Experimental results show that the configuration generated by the AGTN model can effectively reduce the overall verification overhead and significantly shorten the cumulative verification time. Under most networks and settings, this configuration outperforms the default scheme in terms of verification rate and total time, or at least maintains the same level.

[0163] III. NNVF Neural Network Validation Framework Model Testing:

[0164] This experiment aims to evaluate whether introducing a tool integration framework can significantly improve the applicability of the validator to existing benchmarks without changing the underlying validator implementation. The core of the experiment is to measure the extent to which the framework, through mechanisms such as unified input representation, network simplification, and property reduction, can lower the adaptation threshold of the validator in terms of "input format / operator support / property expression," thereby improving its operational coverage of public benchmarks.

[0165] 1. Experimental subjects

[0166] A "benchmark" is defined as a set of validation problems used to evaluate the performance of a validator. Each validation problem consists of a DNN and a property specification, querying whether the property holds true for a given network. To evaluate whether the framework improves the applicability of the validator, the experiment collected benchmarks used in the literature for each of the 13 validators supported by the framework and statistically analyzed the operability of these benchmarks on different validators. A total of 19 validation benchmarks are summarized, and the number of properties (#P) ​​and the number of networks (#N) for each benchmark, as well as the structural / property features that may make it difficult for the validator to support, are given in Table 7.

[0167] Table 7: Validation Benchmark

[0168]

[0169] Does the input constraint cannot be represented by a hyperrectangle (¬HR)? Does the network contain convolution operators (C)? Does the network contain residual structures (R)? Does the network contain non-ReLU activations (¬ReLU)?

[0170] 2. Experimental Results

[0171] The experimental results are presented in Table 8: rows correspond to 13 validators, and columns correspond to 19 benchmarks in Table 3. Each cell is marked with a "semicircle" indicating support status: the left semicircle indicates whether it is natively supported, and the right semicircle indicates whether it can be supported through the framework; if a cell is empty, it means that the validator cannot be "filled" by the framework to support some key elements of the benchmark. In the benchmarks listed in the paper, the main reason for "cannot be filled by the framework" is that the benchmark network contains non-ReLU activation functions (¬ReLU). This also shows that the simplification and reduction of the framework can significantly expand the scope of application, but it is still subject to the fundamental limitation of the validator on the network type (such as non-piecewise linear activation).

[0172] Table 8: Support for benchmark tests by each validator

[0173]

[0174] Overall, the framework delivers a significant improvement in coverage. Of the 223 "validator-benchmark" combinations that are "theoretically possible to support," only 68 combinations are supported without the framework, while 166 combinations are supported with the framework, representing a coverage increase of over 2.4 times. These results directly validate the effectiveness of the framework in "expanding the workable coverage of validators to existing benchmarks."

[0175] In summary, the NNVF neural network validation framework model significantly expands the validator's workable coverage of existing public benchmarks (68→166, corresponding to an improvement of over 2.4 times; approximately 30%→74%) by unifying network and property representations and performing network simplification and property reduction at the framework layer. Meanwhile, experiments also reveal the reasonable boundaries of the framework: when the benchmark contains structural categories that the validator does not support at all (such as non-ReLU activations), framework-level adaptation alone is insufficient to compensate for the deficiencies.

[0176] The robustness verification method for neural networks for traffic sign recognition provided by this invention has been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this invention. At the same time, for those skilled in the art, based on the ideas of this invention, there will be changes in the specific implementation methods and application scope. Modifications and improvements to this invention are possible without exceeding the concept and scope specified in the appended claims. Therefore, the content of this specification should not be construed as a limitation of this invention. < / expr> < / id> < / assignment> < / id> < / id> < / id> < / id> < / id>

Claims

1. A method for verifying the robustness of neural networks for traffic sign recognition, characterized in that: The steps are as follows: S1. Construct the AGTN model, taking the multidimensional features of the traffic sign recognition neural network as input, and outputting the appropriate combination of verification algorithms and the timeout duration of each algorithm; The AGTN model adopts a dual multilayer perceptron structure, including an algorithm combination generation module (MLP) and a timeout generation module (MLP), which respectively output the optimal algorithm combination and the corresponding timeout duration that are suitable for the current model. The AGTN model adaptively generates the optimal algorithm combination and timeout duration to improve the platform's processing efficiency while ensuring verification accuracy. S2. Construct an NNVF neural network verification framework. The NNVF neural network verification framework standardizes the traffic sign recognition neural network model to be verified, describes the robust verification properties through the NNPL domain-specific language, performs semantically preserved network simplification on the standardized model, and performs reduction processing on the standardized verification properties to convert the complex properties into a unified form that the verification algorithm can handle. S3. Perform structural analysis on the traffic sign recognition neural network model to be verified, and extract the key features that affect the robustness verification. S4. The extracted features are used as input to the trained AGTN model to obtain an adaptive optimal combination of verification algorithms and timeout configuration. The combination of verification algorithms includes at least one of adversarial example attack algorithms, approximate verification algorithms, and exact verification algorithms, and is arranged in order of computational cost from low to high. The S5.NNVF neural network verification framework calls each algorithm sequentially to verify the samples according to the order of the algorithm combination. If an algorithm outputs "safe" or "unsafe", the verification is terminated immediately; if it outputs "unknown", the next algorithm is executed, until all algorithms in the combination have been executed. S6. Normalize and analyze the output results of each verification algorithm to obtain a unified robustness verification conclusion.

2. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S1, the AGTN model is constructed as follows: a. Select the PGD adversarial example attack algorithm, α-CROWN approximate verification algorithm, β-CROWN exact verification algorithm, and MIP exact verification algorithm as the basic verification algorithms, and generate all possible algorithm combinations; b. Construct traffic sign recognition MLP and CNN neural network model datasets of different sizes, depths, and accuracy rates, and extract the core features of each model; c. Use various algorithm combinations to robustly validate the models in the dataset, and calculate the validation rate and validation time of each combination. Determine the optimal algorithm combination for each model based on the principle of "prioritizing validation rate, and choosing the shortest time when the validation rates are the same". d. Calculate the longest time taken to verify successful samples under each optimal algorithm combination, and divide the timeout duration into five intervals: 0, 30, 60, 90, and 120 seconds; e. A dual multilayer perceptron structure is adopted to train the algorithm combination generation submodule and the timeout generation submodule separately. The algorithm combination generation submodule takes the core features of the model as input and outputs the optimal algorithm combination; the timeout generation submodule takes the core features of the model and the algorithm combination as input and outputs the timeout configuration.

3. The neural network robustness verification method for traffic sign recognition according to claim 2, characterized in that: In step b, the traffic sign recognition model dataset is trained based on the GTSRB and TSRD traffic sign datasets, covering MLP models with 1-4 layers and CNN models with 1-4 layers, and different accuracy models are generated by adjusting the training hyperparameters.

4. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S1, The algorithm combination generation module MLP takes model features as input and includes one input layer, one hidden layer and one output layer. To avoid overfitting on small datasets, a Dropout regularization layer is added after the hidden layer. The timeout duration generation module MLP takes "the output of the algorithm combination MLP + model features" as input, with a total of six feature dimensions, and outputs a timeout duration classification to meet the rapid verification requirements of traffic sign recognition models.

5. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S2, the NNVF neural network validation framework converts the model into an ONNX unified intermediate representation and standardizes the robustness validation property using the NNPL domain-specific language. This robustness validation property is the category invariance of traffic sign recognition, formally described as: For a given traffic sign image sample x0, for all inputs x within the perturbation set X(x0,ϵ), the model's predicted class is consistent with the true class of x0. The perturbation set X(x0,ϵ) satisfies x∈[0,1]n and |x−x0|p≤ϵ, p∈1,2,∞, where ϵ is the perturbation radius.

6. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S2, the NNVF neural network verification framework performs network simplification as follows: batch normalization layers are merged with convolutional / fully connected layers, identity structures are removed, matrix multiplication + addition is converted to generalized matrix multiplication, continuous generalized matrix multiplications are merged, continuous convolutional layers are merged, explicit padding is bound to convolutional / pooling layers, and activation functions are shifted after the reshaping operation. All simplification operations ensure that the semantics of the model output remain unchanged.

7. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S2, the property reduction process of the NNVF neural network verification framework is as follows: a. Negate the verification property and transform it into disjunctive normal form (DNF); b. Construct a sub-validation problem for each disjunctive term and extract the input and output constraints for each disjunctive term; c. Geometrize the output constraints into a half-space polyhedron and construct a suffix network; d. Combine the suffix network with the original traffic sign recognition neural network to reduce the complex properties to a standard output component comparison form.

8. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S3, the key features include five features: the number of fully connected layers, the number of neurons in fully connected layers, the number of convolutional layers, the number of neurons in convolutional layers, and the accuracy of the model. The timeout generation model, based on the algorithm generation model, uses a combination of algorithms generated by the algorithm generation model as the sixth feature input to predict the corresponding timeout duration.

9. The neural network robustness verification method for traffic sign recognition according to claim 1, characterized in that: In step S5, the specific rules for calling each verification algorithm in sequence are as follows: First, execute the PGD adversarial example attack algorithm. If an adversarial example is detected, output the SAT conclusion and terminate the verification. If not detected, the α-CROWN approximate verification algorithm is executed. If robustness can be proven, the UNSAT conclusion is output and the verification is terminated. If the output is unknown, execute the β-CROWN or MIP exact verification algorithm and output the corresponding conclusion based on the verification result; If no conclusion is reached within the timeout period, output UNKNOWN.

Images