Neural network robustness verification method and apparatus

Abstract

The present application relates to a kind of neural network robustness verification method and device, neural network robustness verification method can be based on the hardware executable descriptor of acquisition to the generated pre-activation interval under the activation function to be processed is bound processing, obtain activation output interval, and activation output interval is as the input of next layer neuron, until the activation output interval of neural network output layer output is obtained, wherein, for different types of activation function to be processed, for the activation function with different function characteristics based on its corresponding function characteristics and approximation table index is bound processing, for the activation function without explicit function characteristics and custom activation function, based on the bound processing of auxiliary information and approximation table index;The activation output interval of output layer output is used to determine whether the robustness of neural network is established or whether there is an adversarial sample.The present application solves the problem that many verification frameworks support limited activation functions of neural network.

Description

Technical Field

[0001] This application relates to the field of quantum computing technology, and in particular to a method and apparatus for verifying the robustness of neural networks. Background Technology

[0002] Deep neural networks are widely deployed in models for autonomous driving perception, medical image-assisted diagnosis, industrial visual inspection, financial risk control, and speech recognition. However, these models may produce erroneous outputs under adversarial perturbations or input noise, posing safety risks. Therefore, robustness verification of deep neural network models has become a crucial aspect of safety compliance. Its goal is to prove that the model output satisfies a certain property, such as invariant classification results or the constant validity of a certain safety constraint, within a given set of input perturbations. However, many existing robustness verification frameworks offer limited support for neural network activation functions. Summary of the Invention

[0003] The embodiments of this application provide a neural network robustness verification method and apparatus, which at least solves the problem that many verification frameworks have limited support for activation functions of neural networks.

[0004] According to one aspect of this application, a method for verifying the robustness of a neural network is provided, characterized in that the verification method includes: The structure information of the neural network and the hardware executable descriptor of the activation function of the neural network are obtained. The structure information includes at least weights and biases. The hardware executable descriptor includes at least function characteristics, bounding auxiliary information, and an approximation table index. The function characteristics are used to describe at least one of the changing trend and mathematical form of the activation function. The bounding auxiliary information is the information required to calibrate the function value of the activation function when bounding an activation function that does not have the explicitly stated function characteristics or a custom activation function. The approximation table index is used to locate the storage address corresponding to the function value of the activation function at a specified value in the pre-activation interval. The input interval is obtained based on the input samples and perturbation set of the input neural network. Then, based on the input interval, the weights and the bias, the boundary propagation calculation is performed to generate the pre-activation interval of each layer of neurons. Based on the hardware executable descriptor, the activation function to be processed under the pre-activation interval is bounded to obtain the activation output interval, and the activation output interval is used as the input of the next layer of neurons until the activation output interval of the neural network output layer is obtained. The activation function to be processed includes one of the following: activation function with different function characteristics, activation function without explicit function characteristics, and custom activation function. Specifically, for activation function with different function characteristics, bounding is performed based on its corresponding function characteristics and the approximation table index. For activation function without explicit function characteristics and custom activation function, bounding is performed based on bounding auxiliary information and the approximation table index. The robustness of the neural network or the existence of adversarial examples are determined based on the activated output range of the output layer.

[0005] Furthermore, the steps for determining the bounds of the activation function to be processed within the pre-activation interval include: After determining the bounding point of the activation function to be processed within the pre-activation interval, the function value corresponding to the bounding point is obtained based on the approximation table index. The activation output interval is then obtained based on the function value or the function value and the bounding auxiliary information. The bounding point is at least two specified values ​​selected from the pre-activation interval according to the function type of the activation function to be processed; and / or, Before obtaining the structural information of the neural network and the hardware executable descriptor of the activation function of the neural network, the method further includes: The structure information and the hardware executable descriptor are stored in the storage module (10).

[0006] Furthermore, when the mathematical form includes concavity and convexity, and the pre-activation interval is located on a convex or concave segment of the activation function to be processed, the step of obtaining the activation output interval based on the function value includes: The upper and lower bounds of the pre-activated interval, as well as a number of interior point values ​​located between the upper and lower bounds, are used as the boundary points. The function value corresponding to each of the bounding points is obtained based on the approximation table index; Based on the function value, a tangent or chord is generated at the boundary point to construct the upper and lower envelopes of the activation function to be processed, and the activation output interval is determined by the extreme values ​​of the upper and lower envelopes within the pre-activation interval.

[0007] Furthermore, when the activation function to be processed includes an activation function that does not have explicitly stated function characteristics or a user-defined activation function, the step of obtaining the activation output interval based on the function value and the bounding auxiliary information includes: A predetermined number of endpoint values ​​sampled within the pre-activation interval are used as the boundary points; Based on the approximation table index, a predetermined number of function values ​​corresponding to each of the bounding points are obtained; The activation output interval is calculated based on a predetermined number of function values ​​and the bounding auxiliary information.

[0008] Furthermore, if the bounding auxiliary information includes the Lipschitz constant K and the error margin, then the step of calculating the activated output interval based on a predetermined number of function values ​​and the bounding auxiliary information includes: The interval width is obtained by subtracting the lower bound of the pre-activation interval from the upper bound. And calculate the Lipschitz constant K and The product; The upper bound of the activated output interval is obtained by adding the maximum value among a predetermined number of function values, the product, and the error margin. The lower bound of the activated output interval is obtained by subtracting the product and the error margin from the minimum value among a predetermined number of function values.

[0009] Furthermore, when uncertain verification information is determined, the method further includes: The activated output range is adjusted using a predetermined processing strategy, which includes: Input interval splitting strategy: Divide the input interval or the active output interval with an interval width greater than a predetermined value into at least two sub-intervals, and perform the boundary propagation calculation based on the sub-intervals; The uncertain verification information is the information output when robustness is not determined and adversarial examples are not determined.

[0010] Furthermore, the method also includes the following steps: During the boundary determination process, an upper envelope segmented constant function and a lower envelope segmented constant function are constructed for the activation function to be processed. Both the upper envelope segmented constant function and the lower envelope segmented constant function are composed of one or more segmented intervals, and each segmented interval includes a segmented constant. A binary variable is used to represent the segmented interval in which the upper and lower bounds of the pre-activation interval generated by the boundary propagation calculation array module (20) are located. The activation output interval is obtained based on the binary variable, the segmented interval in which it is located, and the segmented constant. Based on the received weights, biases, and pre-activation intervals, the neural network robustness verification problem under the input interval is constructed into a mixed-integer linear programming problem. Based on the one-hot vector of the activation output interval, the true class score, and the score of a candidate incorrect class, the objective function of the mixed-integer linear programming problem is set to minimize the difference between the true class score and the score of a candidate incorrect class. The mixed-integer linear programming problem is transformed into an Ising model. The Ising energy is minimized on the Ising model, and the optimal solution is output. The activation output interval is updated using the solution, and the updated activation output interval is used to determine whether the neural network is robust and whether there are adversarial examples.

[0011] According to another aspect of this application, a neural network robustness verification apparatus is provided, comprising: A storage module is provided for storing the structural information of the neural network and the hardware executable descriptor of the activation function. The structural information includes at least weights and biases. The hardware executable descriptor includes at least function characteristics, bounding assistance information, and an approximation table index. The function characteristics describe at least one of the changing trend and mathematical form of the activation function. The bounding assistance information is information required to calibrate the function value of the activation function when bounding an activation function that does not have the explicitly stated function characteristics or a custom activation function. The approximation table index is used to locate the storage address corresponding to the function value of the activation function at a specified value in the pre-activation interval. A boundary propagation computation array module is connected to the storage module. The boundary propagation computation array module is used to perform boundary propagation computation based on the input interval, the weights, and the bias to generate the pre-activation intervals of neurons in each layer. The input interval is the interval obtained by the boundary propagation computation array module based on the input samples and perturbation set of the input neural network. The neural network bounding module is connected to the boundary propagation computation array module and the storage module. The neural network bounding module is configured to: receive the pre-activation interval and obtain the hardware executable descriptor from the storage module; perform bounding processing on the activation function to be processed under the pre-activation interval based on the hardware executable descriptor to obtain the activation output interval; and feed the activation output interval back to the boundary propagation computation array module so that the boundary propagation computation array module uses the activation output interval as the input required for the next layer of neurons to obtain the pre-activation interval. The activation function to be processed includes one of the activation functions with different function characteristics, activation functions without explicit function characteristics, and custom activation functions. The neural network bounding module (30) performs bounding processing on activation functions with different function characteristics based on their corresponding function characteristics and the approximation table index; and performs bounding processing on activation functions without explicit function characteristics and custom activation functions based on bounding auxiliary information and the approximation table index. The verification and determination module is connected to the neural network bounding module to receive the activation output interval of the neural network output layer fed back by the neural network bounding module. The verification and determination module determines whether the robustness is valid or whether there are adversarial examples based on the activation output interval.

[0012] Furthermore, the neural network bounding module includes: A descriptor processing unit is connected to the storage module and the boundary propagation computing array module. The descriptor processing unit is configured to read the hardware executable descriptor from the storage module to parse out the function characteristics, the bounding auxiliary information, and the approximation table index. A bounding unit is connected to both the descriptor processing unit and the boundary propagation computation array module. Each bounding unit includes multiple bounding links. The descriptor processing unit assigns the hardware executable descriptor and the pre-activation interval to the corresponding bounding links based on the function characteristics. The bounding unit is configured as follows: After determining the boundary point of the activation function to be processed in the pre-activation interval through the boundary-finding link, the function value corresponding to the boundary point is obtained based on the approximation table index, and the activation output interval obtained according to the function value or the function value and the boundary-finding auxiliary information is fed back to the boundary propagation calculation array module.

[0013] Furthermore, if the type of the changing trend includes monotonically increasing or monotonically decreasing, then the bounding link includes a link composed of a monotonically fast bounding circuit and a high-precision function approximation engine, wherein: The monotonic fast bounding circuit is connected to the descriptor processing unit, the high-precision function approximation engine, and the boundary propagation calculation array module, respectively. The monotonic fast bounding circuit is configured to: receive the change trend, the approximation table index, and the pre-activation interval dispatched by the descriptor processing unit; take the upper and lower bound values ​​of the pre-activation interval as the bounding point based on the type of the change trend; and send a function value calculation request and the approximation table index to the high-precision function approximation engine. The high-precision function approximation engine is configured to: in response to a calculation request, obtain the function value corresponding to each of the bounding points based on the approximation table index and feed the function value back to the monotonic fast bounding circuit; The monotonic fast bounding circuit obtains the active output interval based on the type of the change trend and the received function value, and feeds the active output interval back to the boundary propagation calculation array module.

[0014] Furthermore, the mathematical form includes concavity and convexity, and when the pre-activation interval is located in the convex or concave segment of the activation function to be processed, the bounding link further includes a link composed of a convex-concave envelope generation circuit and the high-precision function approximation engine, wherein: The convex-concave envelope generation circuit is connected to the descriptor processing unit, the high-precision function approximation engine, and the boundary propagation calculation array module, respectively. The convex-concave envelope generation circuit is configured to: receive the approximation table index, the mathematical form, and the pre-activation interval assigned by the descriptor processing unit; take the upper bound, lower bound, and several interior point values ​​located between the upper bound and the lower bound of the pre-activation interval as the boundary points; and send a function value calculation request and the approximation table index to the high-precision function approximation engine. The high-precision function approximation engine is configured to: in response to a calculation request, obtain the function value corresponding to each of the bounding points based on the approximation table index and feed the function value back to the convex-concave envelope generation circuit; The convex-concave envelope generation circuit generates tangents or chords at the boundary point based on the function value to construct the upper and lower envelopes of the activation function to be processed, and determines the activation output interval by the extreme values ​​of the upper and lower envelopes within the pre-activation interval, and feeds the activation output interval back to the boundary propagation calculation array module.

[0015] Furthermore, when the activation function to be processed includes an activation function that does not have the explicitly stated function characteristics or a custom activation function, the bounding link further includes a link consisting of a sampling bounding circuit and the high-precision function approximation engine, wherein: The sampling boundary circuit is connected to the descriptor processing unit, the high-precision function approximation engine, and the boundary propagation calculation array module, respectively. The sampling bounding circuit is configured to: receive the pre-activation interval, the approximation table index, and the bounding auxiliary information assigned by the descriptor processing unit; take a predetermined number of endpoint values ​​sampled in the pre-activation interval as the bounding points; and send a function value calculation request and the approximation table index to the high-precision function approximation engine. The high-precision function approximation engine is configured to: in response to a calculation request, calculate in parallel based on the approximation table index to obtain a predetermined number of function values ​​corresponding to each of the bounding points, and feed back the predetermined number of function values ​​to the sampling bounding circuit; The sampling bounding circuit calculates the active output interval based on a predetermined number of the function values ​​and the bounding auxiliary information, and feeds the active output interval back to the boundary propagation calculation array module.

[0016] Furthermore, the hardware executable descriptor also includes a sampling quantity adjustment control parameter, and the sampling bounding circuit is further configured to dynamically adjust the predetermined quantity based on the received sampling quantity adjustment control parameter and the range of the pre-activation interval; and / or, The bounding auxiliary information includes the Lipschitz constant K and the error margin. The calculation steps for the sampling bounding circuit to obtain the active output interval based on a predetermined number of function values ​​and the bounding auxiliary information include: The interval width is obtained by subtracting the lower bound of the pre-activation interval from the upper bound. And calculate the Lipschitz constant K and The product; The upper bound of the activated output interval is obtained by adding the maximum value among a predetermined number of function values, the product, and the error margin. The lower bound of the activated output interval is obtained by subtracting the product and the error margin from the minimum value among a predetermined number of function values.

[0017] Furthermore, the hardware executable descriptor also includes a pre-set security margin. The neural network bounding module further includes: An interval adjustment circuit is connected between the boundary-finding unit and the boundary propagation calculation array module. The interval adjustment circuit is configured to receive the active output intervals output by multiple boundary-finding links, adjust the upper and lower bounds of all the active output intervals based on the safety margin, and then feed the active output intervals back to the boundary propagation calculation array module.

[0018] Furthermore, when the activation function to be processed has a value range, the interval adjustment circuit also trims the activation output interval to the value range; and / or, The neural network bounding module also includes: An output boundary buffer unit is connected between the interval adjustment circuit and the boundary propagation calculation array module. The output boundary buffer unit is used to buffer the active output interval output by the interval adjustment circuit so that the boundary propagation calculation array module can input the active output interval read from the output boundary buffer unit into the next layer of the neural network.

[0019] Furthermore, the device also includes: A refinement and scheduling control module is connected between the boundary propagation computation array module and the verification and determination module. The refinement and scheduling control module is configured to: upon receiving uncertain verification information sent by the verification and determination module, adjust the active output interval using a predetermined processing strategy. The predetermined processing strategy includes: Input interval splitting strategy: Divide the input interval or the active output interval with an interval width greater than a predetermined value into at least two sub-intervals, and transmit at least two of the sub-intervals to the boundary propagation calculation array module, so that the boundary propagation calculation array module performs the boundary propagation calculation based on the sub-intervals; The uncertain verification information is the information output by the verification judgment module when it fails to determine that robustness is established and fails to determine that adversarial examples exist.

[0020] Furthermore, the predetermined processing strategy also includes: Activate the approximation encryption strategy: For the interneurons with the highest influence, when the bounding link also includes a sampling bounding circuit, increase the predetermined number of endpoint values ​​sampled by the sampling bounding circuit in the pre-activation interval of the interneuron. The interneuron is a neuron located in the hidden layer between the input and output layers of the neural network. The interneurons with the highest influence include those that cause the largest reduction in the width of the activated output interval output by the neural network output layer when the pre-activation interval is tightened to a single point; and / or, Local priority refinement strategy: The boundary propagation computation array module sorts the interval tasks to be processed based on gradient sensitivity or interval width, so that the boundary propagation computation array module prioritizes processing the interval tasks with the largest interval width or the highest gradient sensitivity based on the sorting. The interval width is the difference between the upper and lower bounds of the interval task. The gradient sensitivity is the absolute value of the partial derivative of the activation output interval output by the neural network output layer with respect to the interval task. The interval task includes the sub-interval or the activation output interval output by the hidden layer of the neural network.

[0021] Furthermore, the refinement and scheduling control module includes: A refined strategy controller is connected to the verification and determination module. The refined strategy controller is used to execute the predetermined processing strategy when it receives uncertain verification information sent by the verification and determination module. The task queue and sub-interval cache unit are connected to the refinement strategy controller and the boundary propagation calculation array module. The task queue and sub-interval cache unit is used to receive the interval tasks generated by the refinement strategy controller after executing the predetermined processing strategy, and provide the interval tasks to the boundary propagation calculation array module for boundary propagation calculation.

[0022] Furthermore, the refinement and scheduling control module also includes: A budget manager, connected to the refinement strategy controller, provides the refinement strategy controller with budget constraints required to execute the predetermined processing strategy, so that the refinement strategy controller can decide whether to terminate the execution of the predetermined processing strategy based on the budget constraints. The budget constraints include one or more of the following: computational resource budget, time budget, and error budget.

[0023] Furthermore, the structural information also includes layer type information describing the structural type of the hidden layer of the neural network. When the layer type information includes a fully connected layer or a convolutional layer, the boundary propagation computation array module includes: An affine layer boundary propagation unit is connected to the storage module and the neural network bounding module. The boundary propagation calculation array module is configured to: when the structure type of the current layer is determined to be the fully connected layer or the convolutional layer based on the layer type information read from the storage module, call the affine layer boundary propagation unit to obtain the activation output interval of the previous layer neuron output by the neural network bounding module, and read the weights and biases from the storage module, so as to generate the pre-activation interval of the current layer neuron by performing boundary propagation calculation based on the activation output interval, the weights and the biases through the affine layer boundary propagation unit.

[0024] Furthermore, when the layer type information also includes a normalized layer, the boundary propagation calculation array module further includes: A normalized boundary propagation unit is connected to the neural network boundary-finding module and the affine layer boundary propagation unit. The boundary propagation calculation array module is configured to: when the structure type of the current hidden layer is determined to be the normalized layer based on the layer type information read from the storage module, call the normalized boundary propagation unit to update the pre-activation interval of the current layer based on the pre-set scaling parameters and offset parameters.

[0025] Furthermore, when the layer type information includes a residual structure or a channel splicing structure, the boundary propagation calculation array module further includes: A boundary combination unit is connected to the neural network boundary-finding module and optionally connected to at least one of the affine layer boundary propagation unit and the normalized boundary propagation unit. The boundary propagation calculation array module is configured to: when determining that the structure type of the current hidden layer is a residual structure or a channel splicing structure based on the layer type information read from the storage module, call the boundary combination unit to perform a combination operation on the pre-activation intervals from different branches to obtain the pre-activation intervals of the current layer. The different branches include the main branch and residual branch forming the residual structure, or multiple feature input branches used for the channel splicing structure. The combination operation includes: For the interval addition operation of the residual structure: add the lower bound values ​​of different pre-activated intervals to obtain a new lower bound value, and add the upper bound values ​​of different pre-activated intervals to obtain a new upper bound value; For the element-wise maximum-minimum combination operation of the channel splicing structure: take the minimum value among multiple lower bound values ​​from different pre-activated intervals as the new lower bound value, and take the maximum value among multiple upper bound values ​​as the new upper bound value.

[0026] Furthermore, the storage module includes: A weight memory, connected to the boundary propagation calculation array module, is used to store the weights; A bias memory, connected to the boundary propagation computing array module, is used to store the bias. A descriptor memory, connected to the neural network bounding module, is used to store the hardware executable descriptors.

[0027] Furthermore, the device also includes: A host interface and task management module are respectively connected to the storage module, the boundary propagation computation array module, the neural network bounding module, and the verification and judgment module. The host interface and task management module are configured as follows: The received structural information and the hardware executable descriptor are written into the storage module, and the received input samples and perturbation set are sent to the boundary propagation computing array module; and / or, The verification information generated by the verification and determination module and the intermediate boundary information are sent to the receiving end. The verification information includes the conclusion that robustness is established, or the conclusion that adversarial examples exist, and the activation output interval output by the output layer when adversarial examples exist. The intermediate boundary information includes at least one of the pre-activation interval and the activation output interval output by the hidden layer.

[0028] Furthermore, the verification and determination module includes: The Ising solver unit is connected to the boundary propagation calculation array module, the neural network bounding module, and the storage module, respectively. The Ising solver unit is configured as follows: The activation output interval is received from the neural network bounding module. The activation output interval is obtained by the neural network bounding module through the following process: constructing an upper envelope piecewise constant function and a lower envelope piecewise constant function for the activation function to be processed. The upper envelope piecewise constant function and the lower envelope piecewise constant function are each composed of one or more segmented intervals, and each segmented interval includes a piecewise constant; using binary variables to represent the segmented intervals in which the upper and lower bounds of the pre-activation interval generated by the boundary propagation calculation array module are located; and obtaining the activation output interval based on the binary variables, the segmented intervals in which they are located, and the piecewise constants. Based on the received weights, biases, and pre-activation intervals, the neural network robustness verification problem under the input interval is constructed into a mixed-integer linear programming problem. Based on the one-hot vector of the activation output interval, the true class score, and the score of a candidate incorrect class, the objective function of the mixed-integer linear programming problem is set to minimize the difference between the true class score and the score of a candidate incorrect class. The mixed-integer linear programming problem is transformed into an Ising model. The Ising energy is minimized on the Ising model, and the optimal solution is output. The activation output interval is updated using the solution, and the updated activation output interval is used to determine whether the neural network is robust and whether there are adversarial examples.

[0029] The beneficial effects of the embodiments of this application are as follows: This application provides a method for verifying the robustness of a neural network. After obtaining the structural information of the neural network and the hardware executable descriptor of the activation function, it can perform bounding processing on different types of activation functions to obtain the activation output range based on the hardware executable descriptor. Specifically, for activation functions with different function characteristics, bounding processing can be performed based on their corresponding function characteristics and approximation table indices. For activation functions without explicit function characteristics or custom activation functions, bounding processing can be performed based on bounding auxiliary information and approximation table indices, thereby achieving accurate bounding for neural networks with arbitrary activation functions. The robustness verification of the neural network is then achieved based on the activation output range obtained from the bounding. The main data processing path, consisting of boundary propagation calculation and bounding processing, realizes the transformation from the pre-activation range to the activation output range and prepares for boundary propagation in the next layer. It maintains upper and lower bounds for the pre-activation and activation output of each neuron, and the boundary propagation calculation and bounding processing can propagate to the neural network output layer in a pipelined / parallel manner to achieve the bound comparison required for verification.

[0030] Therefore, the method provided in this application achieves full coverage bound finding for various activation functions (those with different function characteristics, those without explicit function characteristics, and custom activation functions), thereby completing accurate verification of neural network robustness. The bound finding method is highly adaptable, and the robustness verification is comprehensive. The boundary propagation calculation and bound finding processing steps of this method can be piped parallel, significantly reducing memory access and control overhead on general-purpose platforms, improving overall verification throughput, and reducing latency and bound finding overhead. Simultaneously, through the standardized design of hardware executable descriptors, the security and reliability of the verification results can be ensured, providing a generalized and engineering-oriented implementation scheme for neural network robustness verification.

[0031] Details of one or more embodiments of this application are set forth in the following drawings and description to make other features, objects and advantages of this application more readily apparent. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart illustrating a neural network robustness verification method provided in an embodiment of this application.

[0034] Figure 2This is a schematic diagram of the principle structure of a neural network robustness verification device provided in an embodiment of this application.

[0035] Figure 3 This is a connection diagram of a neural network robustness verification device provided in an embodiment of this application.

[0036] In the picture: 10. Storage Module; 11. Weight Memory; 12. Bias Memory; 13. Descriptor Memory; 20. Boundary Propagation Computation Array Module; 21. Affine Boundary Propagation Unit; 22. Normalized Boundary Propagation Unit; 23. Boundary Combination Unit; 30. Neural Network Boundary Module; 31. Descriptor Processing Unit; 32. Boundary Module; 321. Monotonic Fast Boundary Module; 322. High-Precision Function Approximation Engine; 323. Convex-Concave Envelope Generation Circuit; 324. Sampling Boundary Module; 33. Interval Adjustment Circuit; 34. Output Boundary Buffer Unit; 40. Verification and Judgment Module; 50. Refinement and Scheduling Control Module; 51. Refinement Strategy Controller; 52. Task Queue and Sub-Interval Buffer Unit; 53. Budget Manager; 60. Host Interface and Task Management Module; 70. Power Supply and Clock Module. Detailed Implementation

[0037] Embodiments of this application will now be described in more detail with reference to the accompanying drawings. While some embodiments of this application are shown in the drawings, it should be understood that embodiments of this application can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of the embodiments of this application. It should be understood that the accompanying drawings and embodiments are for illustrative purposes only and are not intended to limit the scope of protection of this application.

[0038] To achieve robustness verification of neural networks, existing robustness verification schemes mainly include: (1) Satisfiability Modulo Theory (SMT) represents the Rectified Linear Unit (ReLU) network as constraints and performs branching solutions. This method relies heavily on the piecewise structure of ReLU, which leads to branch explosion in large-scale models and high engineering costs. Here, SMT is short for Satisfiability Modulo Theories. ReLU is short for Rectified Linear Unit, which is one of the most commonly used activation functions in deep learning. Its core function is to introduce nonlinearity into the neural network, helping the model learn complex feature maps.

[0039] (2) In the boundary propagation-based verification method, Interval Boundary Propagation (IBP) is one of the core technologies in the "boundary propagation-based verification" path of robustness verification. Interval Boundary Propagation (IBP) propagates the upper and lower bounds through interval arithmetic, which is fast in processing verification requirements, but its limitation is that the obtained boundary may be too loose, and it cannot achieve a more accurate verification effect. For example, DeepPoly uses "abstract transformers" to process different layers of neural networks and explicitly supports various network components such as ReLU, Sigmoid (Sigmoid activation function), Tanh (hyperbolic tangent activation function), and MaxPool (maximum pooling layer). The latest work combines tighter bounds (such as the SDP idea, which is short for Semidefinite Programming) with boundary propagation to improve compactness, but it still faces the problem of computational and implementation complexity.

[0040] Non-piecewise linear activation functions are neural network activation functions that lack the "piecewise linear" characteristic. These include the sigmoid activation function, the hyperbolic tangent activation function (Tanh), the Gaussian error linear unit (GELU), the lightweight non-piecewise linear activation function (Swish), the soft-plus function, and custom activation functions. In existing robustness verification, for non-piecewise linear activations, existing software verifiers typically employ methods such as numerical sampling, local linearization, and global upper bounds on the Lipschitz constant. This significantly increases computational complexity, requiring frequent calls to high-precision function libraries, differentiation, or table lookups. Furthermore, when implemented on general-purpose CPUs (Central Processing Units) and GPUs (Graphics Processing Units), memory access and branch control overhead are high, making it difficult to achieve stable throughput for engineering-grade verification.

[0041] In conclusion, existing technologies have at least the following shortcomings in robustness verification scenarios that support "arbitrary activation functions": (1) The overhead of precise bounding for neural networks with arbitrary activation functions is large: For neural networks with arbitrary activation functions, it is necessary to reliably obtain or conservatively estimate the maximum / minimum value within the interval. Software implementation often relies on complex numerical routines, function library calls and branch judgments, resulting in low throughput and high latency.

[0042] (2): Insufficient engineering consistency: Under different activation functions, different parameterized activations, and different input interval widths, the software verifier needs to maintain complex "activation processing logic", resulting in high version iteration costs and difficulty in ensuring stable and reproducible bounding behavior.

[0043] In response to the problems existing in the current technology, there is an urgent need for a dedicated device that can provide "support for bounding arbitrary activation functions" at the hardware architecture level, so as to achieve clear technical effects in terms of throughput, energy consumption, scalability and engineering reproducibility.

[0044] To address the aforementioned issues, firstly, the first embodiment of this application provides a method for verifying the robustness of a neural network. Please refer to [link to relevant documentation]. Figure 1 The verification method includes the following steps: Step S11: Obtain the structural information of the neural network and the hardware executable descriptor of the activation function of the neural network. The structural information includes at least weights and biases. The hardware executable descriptor includes at least function characteristics, bounding auxiliary information, and approximation table index. The function characteristics are used to describe at least one of the changing trend and mathematical form of the activation function. The bounding auxiliary information is the information required to calibrate the function value of the activation function when bounding an activation function that does not have explicit function characteristics or a user-defined activation function. The approximation table index is used to locate the storage address corresponding to the function value of the activation function at a specified value in the pre-activation interval.

[0045] Step S12: Obtain the input interval based on the input samples and perturbation set of the input neural network, and then perform boundary propagation calculation to generate the pre-activation interval of each layer of neurons based on the input interval, weights and biases.

[0046] Step S13: Based on the hardware executable descriptor, perform bounding processing on the activation functions to be processed under the pre-activation interval to obtain the activation output interval, and use the activation output interval as the input of the next layer of neurons until the activation output interval of the neural network output layer is obtained. The activation functions to be processed include one of the following: activation functions with different function characteristics, activation functions without explicit function characteristics, and custom activation functions. Specifically, for activation functions with different function characteristics, bounding processing is performed based on their corresponding function characteristics and approximation table index. For activation functions without explicit function characteristics and custom activation functions, bounding processing is performed based on bounding auxiliary information and approximation table index.

[0047] In other words, after identifying the function type of the activation function to be processed, this application can perform bounding processing on different types of activation functions based on different hardware executable descriptors. When bounding, after finding the specified values ​​required for the upper and lower bounds of the activation output interval in the pre-activation interval, the corresponding function value can be found based on the information of the approximation table index to obtain the upper and lower bounds of the activation output interval. The activation output interval can be obtained without performing complex function calculations, which can reduce the computational overhead of general-purpose platforms.

[0048] Step S14: Determine whether the robustness of the neural network is valid or whether there are adversarial examples based on the activation output range of the output layer.

[0049] As can be seen from steps S12 to S14 above, the neural network robustness verification method provided in this application, after obtaining the structural information of the neural network and the hardware executable descriptor of the activation function, can perform bounding processing on different types of activation functions to be processed based on the hardware executable descriptor to obtain the activation output range. Specifically, for activation functions with different function characteristics, bounding processing can be performed based on their corresponding function characteristics and approximation table indexes. For activation functions without explicit function characteristics and custom activation functions, bounding processing can be performed based on bounding auxiliary information and approximation table indexes, thereby achieving accurate bounding for neural networks with arbitrary activation functions, and then using the activation output range obtained from the bounding to achieve robustness verification of the neural network. The main data processing path, consisting of boundary propagation calculation and bounding processing, realizes the conversion from the pre-activation range to the activation output range and prepares for boundary propagation in the next layer. It achieves the maintenance of upper and lower bounds for the pre-activation and activation output of each neuron, and the boundary propagation calculation and bounding processing can propagate to the neural network output layer in a pipelined / parallel manner to achieve the bound comparison required for verification.

[0050] Therefore, the method provided in this application achieves full coverage bound finding for various activation functions (those with different function characteristics, those without explicit function characteristics, and custom activation functions), thereby completing accurate verification of neural network robustness. The bound finding method is highly adaptable, and the robustness verification is comprehensive. The boundary propagation calculation and bound finding processing steps of this method can be piped parallel, significantly reducing memory access and control overhead on general-purpose platforms, improving overall verification throughput, and reducing latency and bound finding overhead. Simultaneously, through the standardized design of hardware executable descriptors, the security and reliability of the verification results can be ensured, providing a generalized and engineering-oriented implementation scheme for neural network robustness verification.

[0051] The steps for finding the bounds of the activation function to be processed in the pre-activation interval include: After determining the bounding points of the activation function to be processed within the pre-activation interval, the function values ​​corresponding to the bounding points are obtained based on the approximation table index. The activation output interval is then obtained based on the function values ​​or the function values ​​and bounding auxiliary information. The bounding points are at least two specified values ​​selected from the pre-activation interval according to the function type of the activation function to be processed.

[0052] For example, when the activation function to be processed has a trend of monotonically increasing or monotonically decreasing, the upper and lower bounds of the pre-activation interval can be used as bounding points to obtain the function values ​​corresponding to each bounding point based on the approximation table index. Then, the activation output interval is obtained based on the received function values. When the activation function to be processed is a user-defined activation function or an activation function without explicit functional characteristics, a predetermined number of specified values ​​can be collected according to sampling requirements to calculate the activation output interval, achieving targeted and flexible selection of bounding points for different activation functions.

[0053] Before obtaining the structural information of the neural network and the hardware executable descriptor of the activation function of the neural network, the method provided in this application further includes: storing the structural information and the hardware executable descriptor in the storage module 10, thereby obtaining the structural information and hardware executable descriptor required for verification from the storage module 10 at any time. Thus, this application achieves centralized management of "structural basic data and bounding-specific data" by uniformly storing the hardware executable descriptor of the activation function through the storage module 10, ensuring efficient data scheduling and reducing latency, providing stable and efficient data support for performing boundary propagation calculations and obtaining the activation output range through bounding processing. This improves the universality, accuracy, and efficiency of bounding, providing efficient and reliable core support for robustness verification.

[0054] When the mathematical form includes concavity and convexity, and the pre-activation interval is located on a convex or concave segment of the activation function to be processed, the steps for obtaining the activation output interval based on the function value include: using the upper and lower bounds of the pre-activation interval, and several interior points located between the upper and lower bounds as bounding points; obtaining the function value corresponding to each bounding point based on the approximation table index; and generating tangents or chords at the bounding points based on the function values ​​to construct the upper and lower envelopes of the activation function to be processed, and determining the activation output interval by the extreme values ​​of the upper and lower envelopes within the pre-activation interval.

[0055] In this application, targeting scenarios with concave and convex mathematical forms, the upper and lower bounds of the pre-activation interval and several interior points are selected as bounding points. Accurate function values ​​are quickly obtained based on an approximation table index. Then, upper and lower envelopes are constructed by generating tangents / chords, and the activation output interval is determined by the extreme values ​​of these envelopes. This bounding process addresses the shortcomings of existing verification frameworks, such as insufficient accuracy and complex implementation, in finding bounds for concave and convex activation functions.

[0056] When the activation function to be processed includes activation functions without explicit function properties or user-defined activation functions, the steps to obtain the activation output range based on the function value and bounding auxiliary information include: A predetermined number of endpoint values ​​sampled within the pre-activation interval are used as bounding points. A predetermined number of function values ​​corresponding to each bounding point are obtained based on the approximation table index. The activation output interval is calculated based on the predetermined number of function values ​​and bounding auxiliary information.

[0057] Therefore, this application addresses scenarios where the activation function to be processed does not have definite functional characteristics (no clear trend of change, non-concave / convexity) or is a custom activation function. It uniformly samples a predetermined number of bounding points within the pre-activation interval, without relying on the inherent mathematical characteristics of the activation function. This adapts to various bounding needs without definite characteristics or custom activation functions, balancing the universality and accuracy of bounding.

[0058] The bounding auxiliary information includes the Lipschitz constant K and the error margin. The steps for calculating the activation output interval based on a predetermined number of function values ​​and the bounding auxiliary information include: The interval width is obtained by subtracting the lower bound of the pre-activated interval from the upper bound. And calculate the Lipschitz constant K and The product of the maximum value, the product, and the error margin among a predetermined number of function values ​​is added together to obtain the upper bound of the active output interval. The lower bound of the active output interval is obtained by subtracting the product and the error margin from the minimum value among a predetermined number of function values.

[0059] Therefore, this application, when the bounding auxiliary information includes the Lipschitz constant K and the error margin, uses the above calculation steps to obtain the upper and lower bounds of the activated output interval for activation functions without explicit functional characteristics or custom activation functions. This significantly improves the bounding accuracy and security of such activation functions while ensuring bounding efficiency, effectively solving the pain points of large bounding deviations and loose security bounds in existing verification frameworks. The upper and lower bounds of the output interval are solved by calculating half the width of the pre-activated interval and the Lipschitz constant K, combined with the maximum and minimum values ​​of the sampling function and the error margin. This approach relies on the Lipschitz constant K to calibrate the security bound, avoiding deviations caused by incomplete sampling, and compensates for approximation errors caused by the approximation table index and hardware quantization errors through the error margin, ensuring the reliability of the activated output interval.

[0060] When uncertain verification information is determined, the method provided in this application further includes the following steps: The activation output range is adjusted using a predetermined processing strategy, which includes: Input interval splitting strategy: Divide the input interval or the activation output interval with an interval width greater than a predetermined value into at least two sub-intervals, and perform boundary propagation computation based on the sub-intervals. The uncertain verification information refers to the output information when robustness is not determined and adversarial examples are not detected.

[0061] As can be seen, this application can further adjust the activation output interval when determining uncertain verification information, thereby improving the accuracy and completeness of robustness verification. This can be achieved by splitting the input interval or an excessively wide activation output interval into multiple sub-intervals and re-performing boundary propagation, thus refining the interval, narrowing the bounding range, and reducing bounding errors. This overcomes the shortcomings of existing designs that cannot handle uncertain verification results and are prone to incomplete verification, providing reliable support for accurately determining robustness and identifying adversarial examples.

[0062] In addition, to make the verification results more accurate, the method provided in this application embodiment also includes the following steps: First, during the boundary determination process, an upper envelope piecewise constant function and a lower envelope piecewise constant function are constructed for the activation function to be processed. Both the upper envelope piecewise constant function and the lower envelope piecewise constant function are composed of one or more segmented intervals, and each segmented interval includes a piecewise constant. A binary variable is used to represent the segmented interval where the upper and lower bounds of the pre-activation interval generated by the boundary propagation calculation array module (20) are located. Based on the binary variable and its segmented interval and the piecewise constant, the activation output interval is obtained.

[0063] Next, based on the received weights, biases, and pre-activation intervals, the problem of verifying the robustness of the neural network under the input interval is constructed into a mixed-integer linear programming problem. Based on the one-hot vector of the activation output interval, the true class score, and the score of a candidate incorrect class, the objective function of the mixed-integer linear programming problem is set to minimize the difference between the true class score and the score of a candidate incorrect class.

[0064] Finally, the mixed-integer linear programming problem is transformed into the Ising model. The Ising energy minimization problem is performed on the Ising model, and the optimal solution is output. The activation output interval is updated by the solution, and the updated activation output interval is used to determine whether the neural network is robust and whether there are adversarial examples.

[0065] Therefore, this application constructs the neural network robustness verification problem as a mixed-integer linear programming problem, transforms it into an Ising model, and then solves the Ising model by minimizing its energy. The result is used to update the activation output interval. Using this updated interval to determine the robustness of the neural network and the presence of adversarial examples makes the verification results more accurate, improving the efficiency and accuracy of neural network robustness verification. The construction of the mixed-integer linear programming problem will be described in detail in the following embodiments.

[0066] Secondly, this application can also feed back the updated activation output range to the boundary propagation calculation execution step, so as to realize the repropagation or real-time feedback of the activation output range and the pre-activation range, making the final activation output and verification results more accurate and reliable.

[0067] In this embodiment, the Ising model can be solved for energy minimization using a predetermined computing device. This predetermined computing device may include, but is not limited to: a Coherent Ising Machine (CIM), a quantum annealing computer, an adiabatic quantum computer, a CMOS annealer, an FPGA-based annealing accelerator, a GPU-accelerated computing device, a TPU or AI-specific accelerator chip, a classical high-performance computer (HPC), a multi-core CPU server, a parallel computing cluster, a supercomputing platform, gate-based quantum computers (including superconducting quantum computers, ion trap quantum computers, optical quantum computers, silicon-based quantum computers, spin quantum computers, topological quantum computers, etc.), a simulated quantum simulator, a digital quantum simulator, an optical parametric oscillation network system, a neuromorphic computing chip, a memristor array computing device, and other dedicated or general-purpose computing devices capable of solving the Ising model for energy minimization using quantum computing, simulated annealing, quantum annealing, adiabatic evolution, tensor network computation, Monte Carlo methods, branch and bound algorithms, variational quantum algorithms, or other optimization algorithms. All of the above computing devices are capable of solving the Ising model.

[0068] The second embodiment of this application provides a neural network robustness verification device. Specifically, this neural network robustness verification device is a hardware architecture capable of supporting boundary propagation for arbitrary activation functions. Internally, the device maintains upper and lower bounds for the input (pre-activation) and output (post-activation) of each neuron, respectively, and accelerates the verification process and improves energy efficiency through a dedicated main data path and a hardware bounding module. The neural network robustness verification device can implement the neural network robustness verification method provided in the first embodiment of this application. The structure of the device and the specific implementation of the verification method will be described in detail below.

[0069] Please see Figure 2 The robustness verification device for the neural network includes: a storage module 10, a boundary propagation computation array module 20, a neural network boundary finding module 30, and a verification and judgment module 40.

[0070] Storage module 10 stores the structural information of the neural network and the hardware executable descriptors of the activation functions. The structural information includes at least weights and biases, and the hardware executable descriptors include at least function characteristics, bounding assistance information, and an approximation table index. Function characteristics describe at least one of the following: the trend of change and the mathematical form of the activation function. The trend of change is, for example, a monotonically decreasing or monotonically increasing trend; the mathematical form is, for example, concavity or convexity. The bounding assistance information is the information needed to calibrate the function value of the activation function when bounding activation functions that do not have explicit function characteristics or user-defined activation functions. The approximation table index is used to locate the storage address corresponding to the function value of the activation function at a specified value within the pre-activation interval.

[0071] Storage module 10 stores three core types of information from the hardware executable descriptor: function characteristics, bounding assistance information, and approximation table index. These provide "characteristic judgment basis," "calibration basis," and "function value location basis" for activation function bounding, respectively. Function characteristics are used to distinguish activation function types, providing a prerequisite for selecting the bounding method. Bounding assistance information specifically addresses the calibration problem of bounding for "unclear characteristics / custom activation functions," avoiding bounding bias and being key to robustly verifying neural networks with arbitrary activation functions. The approximation table index enables rapid location of specified numerical function values ​​within the pre-activation interval without real-time calculation, significantly improving bounding efficiency. These three elements work together to ensure the accuracy and efficiency of the bounding process.

[0072] The storage module 10 uniformly stores the hardware executable descriptors of neural network structure information and activation functions, realizing centralized management of "basic data + boundary-finding dedicated data", ensuring the efficiency of data scheduling and reducing latency. It provides stable and efficient data support for the subsequent boundary propagation calculation array module 20 to perform boundary propagation calculation and the neural network boundary-finding module 30 to output activation output range, and ensures the continuity of data interaction between modules.

[0073] Boundary propagation computation array module 20 is connected to storage module 10. Boundary propagation computation array module 20 performs boundary propagation computation based on input intervals, weights, and biases to generate pre-activation intervals for neurons in each layer. The input interval is the interval obtained by boundary propagation computation array module 20 based on the input samples and perturbation set of the input neural network.

[0074] The boundary propagation computation array module 20 can realize the layer-by-layer propagation of "input perturbation → pre-activation interval of each layer", accurately simulating the signal propagation process of each layer of the neural network. It ensures that the pre-activation interval can truly reflect the impact of the perturbation on each layer of neurons, and provides an input basis that fits the actual scenario for subsequent activation function bounding and robustness verification.

[0075] Secondly, the boundary propagation computation array module 20 is directly connected to the storage module 10, enabling it to quickly acquire core data required for boundary propagation calculations, such as weights and biases, avoiding delays caused by data transfer. Simultaneously, the pre-activation intervals generated by the boundary propagation computation array module 20 can be directly fed back to the neural network bounding module 30, forming a closed-loop logic of "boundary propagation → bounding → re-propagation," ensuring the seamless connection of bounding and propagation processes across all layers of the neural network and improving overall verification efficiency.

[0076] The neural network bounding module 30 is connected to the boundary propagation computation array module 20 and the storage module 10. The neural network bounding module 30 is configured to: receive a pre-activation interval and obtain a hardware executable descriptor from the storage module 10; perform bounding processing on the activation functions to be processed under the pre-activation interval based on the hardware executable descriptor to obtain an activation output interval; and feed the activation output interval back to the boundary propagation computation array module 20, so that the boundary propagation computation array module 20 uses the activation output interval as the input required for the next layer of neurons to obtain the pre-activation interval. The activation functions to be processed include one of the following: activation functions with different function characteristics, activation functions without explicit function characteristics, and user-defined activation functions. All of the above types of activation functions to be processed are non-linear activation functions. Specifically, the neural network bounding module 30 performs bounding processing on activation functions with different function characteristics based on their corresponding function characteristics and approximation table indices; and for activation functions without explicit function characteristics and user-defined activation functions, it performs bounding processing based on bounding auxiliary information and approximation table indices.

[0077] The neural network bounding module 30 uses a hardware executable descriptor to perform bounding on various activation functions (with different characteristics, ambiguous characteristics, and custom functions), achieving precise adaptation between the bounding method and the activation function type. This breaks through the limitations of existing technologies that rely on a single bounding method and can only adapt to a few common activation functions, achieving universality for activation function bounding and adapting to the robustness verification needs of neural networks with different structures and activation function types. Secondly, the activation output range generated after bounding is fed back to the boundary propagation computation array module 20 as input to the pre-activation range of the next layer, completing a layer-by-layer closed loop of "bounding → boundary propagation." This ensures that the bounding processing of each layer of the neural network proceeds coherently, ultimately enabling accurate acquisition of the activation output range of the output layer, providing direct evidence for robustness assessment.

[0078] It is evident that the neural network bounding module 30 can complete the bounding process of various activation functions by cooperating with the storage module 10 and the boundary propagation computing array module 20. This simplifies the device structure, reduces hardware implementation costs, and, with the support of the hardware executable descriptor, balances bounding efficiency and bounding accuracy.

[0079] The verification and judgment module 40 is connected to the neural network bounding module 30 to receive the activation output range of the neural network output layer output fed back by the neural network bounding module 30. The verification and judgment module 40 determines whether the robustness is valid or whether there are adversarial examples based on the activation output range.

[0080] The verification and judgment module 40 uses the activation output range of the output layer as the judgment criterion, accurately reflecting the impact of the perturbed input range on the output after propagation through each layer of the neural network, ensuring the accuracy of robustness judgment: if the activation output range meets the preset safety range, robustness is determined to be valid and there are no adversarial examples. If it exceeds the safety range, robustness is determined to be invalid and there are adversarial examples. The judgment logic conforms to the core requirements of robustness verification, and the results are interpretable. Secondly, the verification and judgment module 40 is directly connected to the neural network bounding module 30, ensuring that the activation output range of the output layer can be quickly transmitted to the verification and judgment module 40, avoiding the decrease in verification efficiency caused by data delay. At the same time, its judgment result can be directly output, providing a clear reference basis for the robustness optimization of the neural network.

[0081] As described above, the neural network robustness verification device provided in this application includes a storage module 10, a boundary propagation computation array module 20, a neural network bounding module 30, and a verification and determination module 40. The storage module 10 stores the structural information of the neural network and the hardware executable descriptors of the activation functions. The boundary propagation computation array module 20 performs boundary propagation computation based on the input interval, weights, and biases to generate pre-activation intervals for each layer of neurons. The neural network bounding module 30 receives the pre-activation intervals and obtains the hardware executable descriptors from the storage module 10. Based on the hardware executable descriptors, it performs bounding processing on the activation functions to be processed under the pre-activation intervals to obtain the activation output intervals, and feeds back the activation output intervals to the boundary propagation computation array module 20. The activation functions to be processed include activation functions with different function characteristics, activation functions without explicit function characteristics, and user-defined activation functions. The verification and determination module 40 determines whether robustness is established or whether adversarial examples exist based on the activation output intervals output by the neural network output layer. The main data path, comprised of the boundary propagation computation array module 20 and the neural network bounding module 30, realizes the transformation from the pre-activation interval to the activation output interval and prepares for boundary propagation in the next layer. It enables the maintenance of upper and lower bounds for the pre-activation and activation output of each neuron within the hardware device, achieving pipelined / parallel propagation to the neural network output layer to realize the boundary comparisons required for verification. Furthermore, this device avoids the technical bottlenecks brought about by software function libraries and branch logic judgments.

[0082] Therefore, the device provided in this application embodiment achieves full coverage bounding for various activation functions (with different function characteristics, without explicit function characteristics, and custom activation functions), thereby completing accurate verification of neural network robustness. The bounding method is highly adaptable, and the robustness verification is comprehensive. This device supports interval bounding for arbitrary activation functions at the hardware level, rather than relying on software branches and function library calls of general-purpose computers, improving reproducibility and engineering consistency. The boundary propagation computing array module 20 and the neural network bounding module 30 form a pipelined parallel system, significantly reducing memory access and control overhead on general-purpose platforms. The dedicated main data path formed by the boundary propagation computing array module 20 and the neural network bounding module 30 improves the overall verification throughput and reduces latency and bounding overhead. Simultaneously, through the standardized design of hardware executable descriptors, hardware adaptation of the bounding process is achieved, improving verification efficiency and ensuring the security and reliability of verification results, providing a generalized and engineered hardware implementation scheme for neural network robustness verification.

[0083] like Figure 3 As shown, the neural network bounding module 30 provided in this application includes a descriptor processing unit 31 and a bounding unit. The descriptor processing unit 31 is connected to the storage module 10 and the boundary propagation computation array module 20. The descriptor processing unit 31 is configured to read the hardware executable descriptor from the storage module 10 to parse out function characteristics, bounding auxiliary information, and approximation table index.

[0084] The bounding unit is connected to both the descriptor processing unit 31 and the boundary propagation computation array module 20, and includes multiple bounding links. The descriptor processing unit 31 is also configured to assign hardware executable descriptors and pre-activation intervals to the corresponding bounding links based on function characteristics. The pre-activation intervals are directly transmitted to the descriptor processing unit 31 by the boundary propagation computation array module 20.

[0085] The bounding element is configured as follows: After determining the bounding point of the activation function to be processed within the pre-activation interval through the bounding link, the function value corresponding to the bounding point is obtained based on the approximation table index. The activation output interval obtained based on the function value or the function value and bounding auxiliary information is then fed back to the boundary propagation calculation array module 20. The bounding point is the specified value located within the pre-activation interval.

[0086] The descriptor processing unit 31 and the bounding unit of the neural network bounding module 30 in this application have clearly defined roles and work collaboratively, realizing a standardized and streamlined bounding process of "descriptor parsing and dispatching → bounding point determination → function value acquisition → activation output interval generation". Simultaneously, through the design of multiple bounding links in the bounding unit, precise adaptation between different types of activation functions to be processed and bounding methods is achieved. This simplifies the implementation logic of the neural network bounding module 30, reduces hardware design complexity, and improves the versatility, accuracy, and efficiency of bounding. It provides efficient and reliable core support for the robustness verification of the entire device, further strengthening the hardware advantages of this device compared to existing software verification frameworks.

[0087] The design of multiple bounding chains in the bounding unit replaces the cumbersome parsing and bounding logic at the software level, improving bounding efficiency and avoiding the complexity of software implementation. Furthermore, the multiple bounding chain design supports more types of activation functions (including custom and ambiguous feature functions), solving the problem of limited activation function support in existing software frameworks.

[0088] The collaborative approach between the descriptor processing unit 31 and the bounding unit simplifies the hardware implementation logic and reduces hardware resource consumption. Simultaneously, on-demand calibration using bounding auxiliary information balances bounding efficiency and accuracy, avoiding the limitations of existing hardware solutions that are either inefficient or inaccurate. When adding a new activation function type, only the corresponding bounding link needs to be added, and the corresponding function characteristics need to be supplemented in the hardware executable descriptor; there is no need to modify the overall structure of the neural network bounding module 30. This adapts to the robustness verification needs of neural networks with different structures and activation function types, resulting in a wider range of applications and stronger versatility and scalability.

[0089] When the trend of change is monotonically increasing or monotonically decreasing, the bounding link consists of a monotonically fast bounding circuit 321 and a high-precision function approximation engine 322. Wherein: The monotonic fast bounding circuit 321 is connected to the descriptor processing unit 31, the high-precision function approximation engine 322, and the boundary propagation calculation array module 20. The monotonic fast bounding circuit 321 is configured to: receive the change trend, approximation table index, and pre-activation interval dispatched by the descriptor processing unit 31; use the upper and lower bounds of the pre-activation interval as bounding points based on the type of change trend; and send a function value calculation request and approximation table index to the high-precision function approximation engine 322. The high-precision function approximation engine 322 is configured to: respond to the calculation request; obtain the function value corresponding to each bounding point based on the approximation table index; and feed the function value back to the monotonic fast bounding circuit 321.

[0090] The monotonic fast boundary finding circuit 321 obtains the active output range based on the type of change trend and the received function value, and feeds the active output range back to the boundary propagation calculation array module 20.

[0091] Therefore, this application utilizes a link consisting of a monotonically increasing or monotonically decreasing activation function to perform upper and lower bound calculations through a monotonically increasing / decreasing type activation function. In other words, this dedicated bounding link for monotonically increasing / decreasing activation functions achieves a precise adaptation between "monotonically increasing function characteristics" and "bounding method." By combining the endpoint bounding strategy of the monotonically increasing / decreasing type activation function with the efficient function value acquisition capability of the high-precision function approximation engine 322, it replaces the complex software-level general bounding logic in existing verification frameworks. This significantly improves the bounding efficiency of monotonically increasing activation functions, reduces hardware resource consumption, and ensures the accuracy and security of the activation output range, thus strengthening the hardware-based and highly efficient technical advantages of this device.

[0092] When the mathematical form includes concavity and convexity, and the pre-activation region is located in the convex or concave segment of the activation function to be processed, the bounding link also includes a link composed of a convex-concave envelope generation circuit 323 and a high-precision function approximation engine 322. Wherein: The convex-concave envelope generation circuit 323 is connected to the descriptor processing unit 31, the high-precision function approximation engine 322, and the boundary propagation calculation array module 20, respectively. The convex-concave envelope generation circuit 323 is configured to receive the approximation table index, mathematical form, and pre-activation interval assigned by the descriptor processing unit 31. It uses the upper and lower bounds of the pre-activation interval, along with several interior points located between the upper and lower bounds, as boundary points, and sends a function value calculation request and the approximation table index to the high-precision function approximation engine 322. The number of interior points can be one or more, such as values ​​selected near inflection points.

[0093] The high-precision function approximation engine 322 is configured to: in response to a calculation request, obtain the function value corresponding to each boundary point based on the approximation table index and feed the function value back to the convex-concave envelope generation circuit 323. The convex-concave envelope generation circuit 323 generates tangents or chords at the boundary points based on function values ​​to construct the upper and lower envelopes of the activation function to be processed. The extreme values ​​of the upper and lower envelopes within the pre-activation interval determine the activation output interval, and the activation output interval is fed back to the boundary propagation calculation array module 20 as the input of the next layer of neurons.

[0094] For example, in some embodiments of this application, for the convex segment of the activation function to be processed: The chord between any two bounding points lies above the graph of the function (the function lies below the chord). The tangent at any bounding point lies below the graph of the function (the function lies above the tangent). Concave segment: In this case, the opposite is true: the chord is below the graph of the function, and the tangent is above the graph of the function.

[0095] In this application, targeting scenarios with concave-convex mathematical forms, a dedicated bounding chain is designed, consisting of a convex-concave envelope generation circuit 323 and a high-precision function approximation engine 322, to achieve compact and accurate bounding for concave-convex activation functions. This dedicated bounding chain precisely adapts to the mathematical characteristics of concave-convex activation functions. The convex-concave envelope generation circuit 323 selects the upper and lower bounds of the pre-activation interval and several interior point values ​​as bounding points. The high-precision function approximation engine 322, in conjunction with the high-precision function approximation engine, quickly obtains accurate function values ​​based on the approximation table index. Then, by generating tangents / chords, the upper and lower envelopes are constructed, and the activation output interval is determined by the extreme values ​​of the upper and lower envelopes. This bounding chain not only solves the pain points of insufficient accuracy and complex implementation in existing verification frameworks for concave-convex activation functions but also balances bounding efficiency and hardware feasibility. Meanwhile, the convex-concave envelope generation circuit 323 is logically connected to the preceding descriptor processing unit 31, the subsequent boundary propagation calculation array module 20, and the high-precision function approximation engine 322, seamlessly integrating into the entire device's "boundary propagation → bounding → feedback" closed loop. This not only ensures the efficiency and smoothness of the bounding process for convex-concave activation functions but also generates a compact and secure activation output range, providing accurate and reliable basis for subsequent boundary propagation and robustness determination of each layer of the neural network. This further enhances the device's adaptability to different types of activation functions, highlighting the efficiency and accuracy advantages of hardware-based bounding compared to software implementation, while simplifying the hardware implementation logic for convex-concave activation function bounding and reducing the difficulty of engineering implementation.

[0096] Furthermore, when the activation function to be processed includes an activation function without explicit functional characteristics or a user-defined activation function, the bounding link also includes a link consisting of a sampling bounding circuit 324 and a high-precision function approximation engine 322, wherein: The sampling boundary circuit 324 is connected to the descriptor processing unit 31, the high-precision function approximation engine 322, and the boundary propagation calculation array module 20, respectively. The sampling bounding circuit 324 is configured to receive the pre-activation interval, approximation table index and bounding auxiliary information assigned by the descriptor processing unit 31, and use a predetermined number of endpoint values ​​uniformly sampled within the pre-activation interval as bounding points, and send a function value calculation request and approximation table index to the high-precision function approximation engine 322. The high-precision function approximation engine 322 is configured to: respond to a calculation request, calculate in parallel based on the approximation table index to obtain a predetermined number of function values ​​corresponding to each bounding point, and feed back the predetermined number of function values ​​to the sampling bounding circuit 324; The sampling boundary circuit 324 calculates the active output interval based on a predetermined number of function values ​​and boundary auxiliary information, and feeds the active output interval back to the boundary propagation calculation array module 20.

[0097] Therefore, this application provides a dedicated bounding chain consisting of a sampling bounding circuit 324 and a high-precision function approximation engine 322 for scenarios where the activation function to be processed does not have definite functional characteristics (no clear trend of change, non-concave / convexity) or is a custom activation function. This bounding chain accurately solves the core pain points of existing verification frameworks, such as limited support for ambiguous characteristics and custom activation functions, low bounding accuracy, and complex implementation. Through the division of labor and cooperation between the sampling bounding circuit 324 and the high-precision function approximation engine 322, universal, accurate, and efficient bounding for this type of special activation function is achieved. After receiving the relevant information assigned by the descriptor processing unit 31, the sampling bounding circuit 324 uniformly samples a predetermined number of bounding points within the pre-activation interval. It does not rely on the inherent mathematical characteristics of the activation function, adapts to various bounding needs for activation functions without definite characteristics and custom activation functions, and balances the universality and accuracy of bounding. The high-precision function approximation engine 322 calculates the function values ​​at each bounding point in parallel based on the approximation table index, significantly improving the efficiency of function value acquisition and adapting to high real-time verification requirements. Simultaneously, it ensures high accuracy of function values, providing reliable support for subsequent bounding calculations. The sampling bounding circuit 324 combines the feedback function values ​​with bounding auxiliary information to complete the calculation of the activation output interval, achieving dual protection of function value calibration and safety bound solution. This avoids bounding deviations caused by the lack of clear characteristics of the activation function, ensuring that the generated activation output interval is compact and safe. This bounding link simplifies the hardware implementation logic for bounding this type of special activation function and further expands the adaptability of the entire device to various activation functions. It strengthens the hardware advantages and versatility of this device compared to existing software verification frameworks, providing strong support for the comprehensiveness and reliability of neural network robustness verification, ensuring that the entire device can adapt to the robustness verification requirements of neural networks with different structures and activation function types.

[0098] In addition, multiple bounding links in the bounding unit of this application share a high-precision function approximation engine 322, which reduces the design complexity of the neural network bounding module 30 and reduces the difficulty and cost of engineering implementation.

[0099] In this application, the hardware executable descriptor stored in the storage module 10 may also include an identity identifier (function ID) for identifying the identity of the activation function, and specific adjustable parameters of the activation function (such as α, β, etc.).

[0100] The identifier, serving as a unique identifier for the activation function, enables the neural network bounding module 30 (especially the descriptor processing unit 31) to quickly and accurately identify the specific type of the activation function to be processed (such as monotonic functions, concave-convex functions, user-defined functions, etc.). It allows for matching the corresponding bounding path (monotonically fast bounding path, convex-concave envelope bounding path, etc.) without additional analysis of complex features, significantly improving the matching efficiency of the bounding path and avoiding bounding errors caused by misidentification of the activation function type. Simultaneously, it facilitates the storage module 10's classification and management of hardware executable descriptors for various activation functions.

[0101] Specific adjustable parameters (such as α, β, etc.) are core components of the activation function's inherent characteristics. Stored in the hardware executable descriptor, they allow the neural network bounding module 30 to directly obtain the precise parameter configuration of the activation function during the bounding process, without additional calculations or external input. This ensures that the bounding processing of the activation function closely matches its actual characteristics, improving bounding accuracy. Simultaneously, storing these adjustable parameters in the hardware executable descriptor enables flexible parameter configuration and reuse, adapting to the same type of activation functions with different parameter settings. This broadens the device's adaptability to various activation functions, enhancing the versatility and flexibility of the solution.

[0102] In some implementations, the parameters α and β can vary depending on the type of activation function, defining the specific form, operational rules, or characteristic thresholds of the activation function. For example, if the activation function is Leaky ReLU, α can represent the slope of the negative half-axis (e.g., α=0.01), used to define the function's trend in the negative interval. If the activation function is a Sigmoid or Tanh-type modified function, β can represent a scaling factor or offset parameter, used to adjust the function's output range and steepness. If it is a custom activation function, α and β can serve as user-defined core operational parameters, defining the function's nonlinear transformation rules.

[0103] In some implementations, the hardware executable descriptor stored in the storage module 10 may further include a keypoint table, which can be configured with one or more of the following: critical points, inflection points, periodic points, etc., of the activation function. The keypoint table can assist the neural network bounding module 30 in accurately and efficiently completing the bounding process, optimizing the compactness and reliability of the activation output interval.

[0104] A key point table aids in the accurate identification of activation function characteristics: critical points, inflection points, and periodic points are key locations where the activation function's morphology (monotonicity, convexity / concavity) undergoes abrupt changes or exhibits core features. Using this key point table, the neural network bounding module 30 (e.g., the descriptor processing unit 31) can quickly locate nodes where function characteristics change, without requiring global function analysis, thus avoiding bounding bias caused by missing characteristic abrupt changes (e.g., inflection points can accurately divide the convex and concave segments of the function, adapting to the convex / concave envelope bounding chain). In scenarios such as sampling bounding and convex / concave envelope bounding, nodes in the key point table can be prioritized as bounding points, reducing invalid sampling / computation, improving bounding efficiency, and ensuring that the bounding covers the key regions of the function characteristics, further tightening the activation output interval and avoiding robustness misjudgments caused by an overly loose interval. Furthermore, the accuracy of the activation output interval generated by the neural network bounding module 30 can be verified by the function characteristics corresponding to the key point table (e.g., the extreme values ​​of the function corresponding to critical points). Combined with error budgeting and safety margin, this ensures that the upper bound is not underestimated and the lower bound is not overestimated, improving the reliability of the bounding results.

[0105] The key point table also enables the verification device to adapt to the bounding of complex activation functions: for non-monotonic, piecewise convex-concave, or periodic activation functions, the key point table can clearly define the segment boundaries and periodic patterns of the function, assisting the neural network bounding module 30 in splitting the bounding interval and matching the corresponding bounding strategy, thus broadening the device's adaptability to complex activation functions.

[0106] The hardware executable descriptor also includes a sampling quantity adjustment control parameter (configured in refine_cap in storage module 10). The sampling bounding circuit 324 is also used to dynamically adjust the predetermined quantity according to the received sampling quantity adjustment control parameter and the range of the pre-activated interval, so as to achieve a balance between bounding accuracy and bounding efficiency.

[0107] The bounding auxiliary information includes the Lipschitz constant K and the error margin, eps_margin, which can be pre-configured in the storage module 10. The calculation steps for the sampling bounding circuit 324 to obtain the active output interval based on a predetermined number of function values ​​and the bounding auxiliary information include: The interval width is obtained by subtracting the lower bound of the pre-activated interval from the upper bound. And calculate the Lipschitz constant K and The product of the maximum value, the product, and the error margin among a predetermined number of function values ​​is added together to obtain the upper bound of the active output interval. The lower bound of the active output interval is obtained by subtracting the product and the error margin from the minimum value among a predetermined number of function values.

[0108] Therefore, when the bounding auxiliary information includes the Lipschitz constant K and the error margin, this application, for activation functions without explicit functional characteristics or custom activation functions, uses the above calculation steps to obtain the upper and lower bounds of the activated output interval. While ensuring bounding efficiency and hardware feasibility, it significantly improves the bounding accuracy and security of such activation functions, effectively solving the pain points of large bounding deviations and loose security bounds in existing verification frameworks. The upper and lower bounds of the output interval are solved by calculating half the width of the pre-activated interval and the product of the Lipschitz constant K, combined with the maximum and minimum values ​​of the sampling function and the error margin. This relies on the Lipschitz constant K to calibrate the security bound, avoiding deviations caused by incomplete sampling, and compensates for the approximation error of the high-precision function approximation engine 322 and the quantization error of hardware operations through the error margin, ensuring the reliability of the activated output interval. This calculation step is simple and clear, directly adaptable to hardware implementation, reducing the difficulty of device design and deployment without affecting bounding efficiency.

[0109] Hardware executable descriptors also include pre-set security margins. The neural network bounding module 30 also includes: Interval adjustment circuit 33, connected between the boundary finding unit and the boundary propagation calculation array module 20, is configured to receive the active output intervals from multiple boundary finding links, based on a safety margin. After adjusting the upper and lower bounds of all active output intervals, the active output intervals are fed back to the boundary propagation calculation array module 20.

[0110] When the hardware executable descriptor contains a pre-set safety margin, this application adds an interval adjustment circuit 33 to the neural network bounding module 30. The interval adjustment circuit 33 adjusts all active output intervals based on the safety margin, further improving the safety and reliability of the active output intervals and effectively avoiding robust misjudgments caused by potential errors in bounding and hardware operation processes.

[0111] During adjustment, the interval adjustment circuit 33 can add a safety margin to the upper limit of the activated output interval. Round up and subtract the safety margin from the lower bound of the active output range. Rounded down. This safety margin. It can be obtained by mapping the approximation error or quantization error through statistics or determination.

[0112] The interval adjustment circuit 33 connects the boundary-finding unit and the boundary propagation calculation array module 20. It receives the active output intervals from each boundary-finding link and adjusts them based on a safety margin by "adding the safety margin to the upper bound and rounding up, and subtracting the safety margin from the lower bound and rounding down". This not only compensates for potential errors such as boundary-finding deviations and hardware quantization through the safety margin, ensuring that the adjusted interval completely covers the true output range of the activation function, but also adapts to the hardware operation logic through the rounding operation, ensuring the validity of the interval data. This design has simple logic, strong hardware feasibility, does not affect the overall efficiency of boundary-finding and boundary propagation, and fits the overall closed-loop logic of the device, further enhancing the accuracy of robustness verification and providing a safer and more reliable interval basis for subsequent boundary propagation at each layer and the final robustness determination.

[0113] When the activation function to be processed has a range, the interval adjustment circuit 33 will also trim the activation output interval to within that range. Therefore, when the activation function has a range, trimming the adjusted activation output interval to that range ensures that the activation output interval perfectly matches the actual output limit of the activation function, avoiding the propagation of invalid intervals.

[0114] The neural network bounding module 30 provided in this embodiment further includes an output bounding buffer unit 34. The output bounding buffer unit 34 is connected between the interval adjustment circuit 33 and the boundary propagation calculation array module 20. The output bounding buffer unit 34 is used to buffer the active output interval output by the interval adjustment circuit 33, so that the boundary propagation calculation array module 20 can input the active output interval read from the output bounding buffer unit 34 into the next layer of the neural network.

[0115] This application utilizes an output boundary buffer unit 34 added to the neural network bounding module 30 to buffer the active output interval, effectively coordinating the rhythm of interval adjustment and boundary propagation, and improving the overall operating efficiency and stability of the device. The output boundary buffer unit 34 receives and buffers the active output interval from the interval adjustment circuit 33, preventing data blocking or delays caused by processing rate mismatch between the interval adjustment circuit 33 and the boundary propagation calculation array module 20. Simultaneously, it provides a stable source of interval reading for the boundary propagation calculation array module 20, ensuring it can read the active output interval as needed and accurately input it into the next layer of the neural network, guaranteeing a smooth and continuous process of "interval adjustment → buffering → boundary propagation." This buffering design is highly hardware-feasible, requires no additional complex calculations, does not increase hardware resource consumption, and aligns with the interaction logic between the neural network bounding module 30 and the boundary propagation calculation array module 20, providing stable support for subsequent boundary propagation and robustness determination, and effectively preventing data interaction stuttering.

[0116] The apparatus provided in this application further includes a refinement and scheduling control module 50, which is connected between the boundary propagation computation array module 20 and the verification and determination module 40. The refinement and scheduling control module 50 is configured to adjust the activation output range using a predetermined processing strategy when receiving uncertain verification information sent by the verification and determination module 40. The uncertain verification information is the information output by the verification and determination module 40 when it fails to determine that robustness is achieved and does not determine the existence of adversarial examples. The predetermined processing strategy includes: Input interval splitting strategy: Divide the input interval or the active output interval with an interval width greater than a predetermined value into at least two sub-intervals, and transmit at least two sub-intervals to the boundary propagation calculation array module 20 so that the boundary propagation calculation array module 20 performs boundary propagation calculation based on the sub-intervals.

[0117] This application addresses the issue of uncertain verification results output by the verification judgment module 40 by adding a refinement and scheduling control module 50. This module further adjusts the active output interval to improve the accuracy and completeness of robustness verification. The refinement and scheduling control module 50 refines the interval by splitting the input interval or an excessively wide active output interval into multiple sub-intervals and feeding this data back to the boundary propagation calculation array module 20 to re-execute boundary propagation. This reduces the boundary range and lowers the boundary error. It overcomes the shortcomings of existing designs that cannot handle uncertain verification results and are prone to incomplete verification, providing reliable support for accurate robustness determination and adversarial example identification.

[0118] The pre-defined processing strategy executed by the refinement and scheduling control module 50 also includes: Activate the approximation encryption strategy: For the intermediate neuron with the highest impact, when the bounding link also includes the sampling bounding circuit 324, increase the predetermined number of endpoint values ​​sampled by the sampling bounding circuit 324 in the pre-activation interval of the intermediate neuron, or reduce the polynomial degree of the activation function used to approximate the intermediate neuron from the current order. Increase to a higher order ,in, > Intermediate neurons are neurons located in the hidden layer between the input and output layers of a neural network. The intermediate neurons with the greatest influence include those that cause the largest reduction in the width of the activated output interval of the neural network output layer when the pre-activation interval is tightened into a single point.

[0119] The activation approximation encryption strategy targets the most influential intermediate neurons. When the bounding link is the link containing the sampling bounding circuit 324, it precisely focuses on the neurons that have the greatest impact on the verification result by increasing the predetermined number or increasing the degree of the activation function approximation polynomial, effectively improving the bounding accuracy and activation function approximation accuracy of such neurons. This strategy can quickly solve the uncertain state of verification judgment, providing support for robust and accurate judgment. This strategy is highly targeted, balancing accuracy and efficiency while reducing hardware resource consumption.

[0120] Local priority refinement strategy: The boundary propagation computation array module 20 sorts the interval tasks to be processed based on gradient sensitivity or interval width, so that the boundary propagation computation array module 20 processes the interval tasks with the largest interval width or the highest gradient sensitivity based on the sorting. The interval width is the difference between the upper and lower bounds of the interval task, and the gradient sensitivity is the absolute value of the partial derivative of the activation output interval of the neural network output layer with respect to the interval task. The interval task includes sub-intervals or the activation output interval of the hidden layer of the neural network.

[0121] The local priority refinement strategy prioritizes tasks (refined sub-intervals and hidden layer activation output intervals) to be processed by the boundary propagation computation array module 20 based on gradient sensitivity or interval width. This prioritizes tasks with the largest interval width or the highest gradient sensitivity, precisely focusing on the intervals that have the greatest impact on the verification results and the strongest uncertainty, quickly reducing bounding errors and tightening the output intervals. It also avoids invalid tasks consuming hardware resources, further enhancing the accuracy and efficiency of the device verification.

[0122] The refinement and scheduling control module 50 in this application includes a refinement strategy controller 51 and a task queue and sub-interval buffer unit 52. The refinement strategy controller 51 is connected to the verification and determination module 40. The refinement strategy controller 51 is used to execute a predetermined processing strategy when it receives uncertain verification information sent by the verification and determination module 40.

[0123] The task queue and sub-interval buffer unit 52 is connected to the refinement strategy controller 51 and the boundary propagation calculation array module 20. The task queue and sub-interval buffer unit 52 is used to receive the interval tasks generated by the refinement strategy controller 51 after executing the predetermined processing strategy, and to provide the interval tasks to the boundary propagation calculation array module 20 for boundary propagation calculation.

[0124] The refinement and scheduling control module 50 in this application features a refinement strategy controller 51 and a task queue and sub-interval caching unit 52 that work collaboratively and seamlessly to effectively ensure the efficient execution of predetermined processing strategies. The refinement strategy controller 51 precisely interfaces with the verification and judgment module 40, and upon receiving uncertain verification information, can quickly execute predetermined processing strategies to ensure timely response to uncertain verification states. The task queue and sub-interval caching unit 52 handles the interval tasks generated after strategy execution, achieving task caching and orderly supply, avoiding delays and blockages caused by chaotic interval task transmission or mismatched processing rates. Simultaneously, the task queue and sub-interval caching unit 52 provide a stable source of task input for the boundary propagation computation array module 20, ensuring coherent and efficient boundary propagation computation.

[0125] The refinement and scheduling control module 50 provided in this application also includes a budget manager 53, which is connected to the refinement strategy controller 51. The budget manager 53 provides the refinement strategy controller 51 with budget constraints required to execute a predetermined processing strategy, enabling the refinement strategy controller 51 to decide whether to terminate the execution of the predetermined processing strategy based on the budget constraints. Budget constraints include one or more of the following: computational resource budget, time budget, and error budget. Time budgets include limits on execution time such as the total verification duration limit, single task processing time limit, and refinement iteration limit; termination occurs if the verification duration limit is exceeded (timeout). Computational resource budgets include computational resource quotas, storage capacity limits for the task queue and sub-interval cache unit 52, and data transmission bandwidth limits; termination occurs if the memory of the task queue and sub-interval cache unit 52 is exhausted. Termination occurs when the maximum refinement depth reaches the limit set by the refine_cap control parameter. Error budgets include limits such as when the approximation error reaches a specified upper limit.

[0126] The budget manager 53 added to the refinement and scheduling control module 50 in this application can precisely control the execution boundary of the predetermined processing strategy, balancing verification accuracy with resource and time costs. Budget constraints avoid the waste of hardware resources and verification delays caused by excessive strategy execution, while preventing insufficient execution from failing to resolve uncertain verification states.

[0127] The structural information stored in the storage module 10 also includes layer type information describing the structural type of the hidden layers in the neural network. When the layer type information includes fully connected layers or convolutional layers, the boundary propagation computation array module 20 provided in this application includes affine layer boundary propagation units 21.

[0128] The affine layer boundary propagation unit 21 is connected to the storage module 10 and the neural network boundary finding module 30. The boundary propagation calculation array module 20 is configured to: when determining whether the current layer's structure type is a fully connected layer or a convolutional layer based on the layer type information read from the storage module 10, call the affine layer boundary propagation unit 21 to obtain the activation output range of the previous layer's neurons output by the neural network boundary finding module 30, and read the weights and biases from the storage module 10, so as to generate the pre-activation range of the current layer's neurons by performing boundary propagation calculations based on the activation output range, weights, and biases through the affine layer boundary propagation unit 21.

[0129] The affine layer boundary propagation unit 21 added to the boundary propagation computation array module 20 in this application enables precise adaptation to fully connected layers and convolutional layers, ensuring the targeted and efficient nature of boundary propagation computation. The boundary propagation computation array module 20 can accurately determine the current layer structure based on layer type information, call the affine layer boundary propagation unit 21, and, combined with the activation output interval of the previous layer and the weights and biases in the storage module 10, efficiently generate the pre-activation interval of the current layer. This further improves the accuracy and efficiency of boundary propagation and enhances the device's adaptability to neural networks with different structures.

[0130] When the layer type information also includes a normalized layer, the boundary propagation calculation array module 20 provided in this application further includes a normalized boundary propagation unit 22, which is connected to the neural network boundary calculation module 30 and to the affine layer boundary propagation unit 21. The boundary propagation calculation array module 20 is configured as follows: When the structure type of the current hidden layer is determined to be a normalized layer based on the layer type information read from the storage module 10, the normalized boundary propagation unit 22 is called to update the pre-activation range of the current layer based on the pre-set scaling parameters and offset parameters.

[0131] When the layer type information includes a normalized layer, the normalized boundary propagation unit 22 added to the boundary propagation computation array module 20 achieves accurate adaptation to the normalized layer, improving the coverage of common neural network layer structures by boundary propagation. In other words, the boundary propagation computation array module 20 can determine that the current layer is a normalized layer based on the layer type information, call the normalized boundary propagation unit 22, and update the pre-activation interval of the current layer in conjunction with preset scaling and offset parameters. This avoids errors caused by adapting a general propagation unit to a normalized layer, improves the accuracy and completeness of boundary propagation, and further expands the device's adaptability to neural networks with different structures.

[0132] When the layer type information includes residual structure or channel splicing structure, the boundary propagation calculation array module 20 provided in this application also includes a boundary combination unit 23. The boundary combination unit 23 is connected to the neural network boundary calculation module 30 and can be selectively connected to at least one of the affine layer boundary propagation unit 21 and the normalized boundary propagation unit 22.

[0133] The boundary propagation computation array module 20 is configured to: when determining the structure type of the current hidden layer as a residual structure or a channel splicing structure based on the layer type information read from the storage module 10, call the boundary combination unit 23 to perform a combination operation on the pre-activation intervals from different branches to obtain the pre-activation intervals of the current layer. The different branches include the main branch and residual branches that form the residual structure, or multiple feature input branches used for the channel splicing structure. The combination operation includes: For interval addition operations on residual structures: add the lower bounds of different pre-activated intervals to obtain a new lower bound, and add the upper bounds of different pre-activated intervals to obtain a new upper bound.

[0134] For the element-wise maximum-minimum combination operation of the channel splicing structure: take the minimum value among multiple lower bounds from different pre-activated intervals as the new lower bound, and take the maximum value among multiple upper bounds as the new upper bound.

[0135] Therefore, by precisely adapting the boundary combination unit 23 to two common hidden layer structures—residual and channel splicing—boundary propagation coverage of various layer structures is improved. The boundary propagation calculation array module 20 can accurately call the boundary combination unit 23 based on layer type information, performing interval addition for the residual structure and element-wise maximum-minimum combination for the channel splicing structure, accurately combining different branch pre-activation intervals to generate the current layer's pre-activation interval. The setting of the boundary combination unit 23 avoids adaptation bias in general propagation units, improves the accuracy and coherence of boundary propagation, and ensures efficient and accurate boundary propagation under two special structures, thus providing reliable support for subsequent boundary calculation and robustness verification.

[0136] The storage module 10 in this application includes a weight memory 11, a bias memory 12, and a descriptor memory 13. The weight memory 11 is connected to the boundary propagation computation array module 20 and is used to store weights. The bias memory 12 is connected to the boundary propagation computation array module 20 and is used to store biases. The descriptor memory 13 is connected to the neural network bounding module 30 and is used to store hardware executable descriptors.

[0137] This application achieves classified storage and dedicated provisioning of weights, biases, and hardware executable descriptors by configuring a weight memory 11, a bias memory 12, and a descriptor memory 13 in the storage module 10, avoiding scheduling chaos and latency caused by mixed data storage. This ensures that the boundary propagation computing array module 20 can quickly acquire weights and biases, and that the neural network bounding module 30 can efficiently read hardware executable descriptors. The storage module 10 has a simple structure and is hardware-implementable, improving data reading and scheduling efficiency and reducing data interaction losses.

[0138] Furthermore, the verification device provided in this application also includes a host interface and task management module 60, which is connected to the storage module 10, the boundary propagation computing array module 20, the neural network bounding module 30, and the verification and judgment module 40, respectively. The host interface and task management module 60 is configured as follows: The received structural information and hardware executable descriptor are written to the storage module 10, and the received input samples and perturbation set are sent to the boundary propagation computation array module 20. At least one of the verification information and intermediate boundary information generated by the verification and determination module 40 can also be sent to the receiving end. The verification information includes the conclusion that robustness is valid, or the conclusion that adversarial examples exist, and the activation output range of the output layer when adversarial examples exist. The intermediate boundary information includes at least one of the pre-activation range and the activation output range of the hidden layer.

[0139] This application uses a host interface and task management module 60 to coordinate the scheduling of data input and output tasks of the device, enabling the modules to work together and interact with external systems. The host interface and task management module 60 can write structural information and hardware executable descriptors into the storage module 10, and send input samples and disturbance sets to the boundary propagation computing array module 20, ensuring accurate data supply for device startup and operation. Simultaneously, the host interface and task management module 60 can send verification information and intermediate boundary information to the receiving end, enabling the output of verification results and intermediate data for subsequent analysis and control.

[0140] Furthermore, to make the verification results more accurate, the verification judgment module 40 provided in this application includes an Ising solution unit, which is connected to the boundary propagation calculation array module 20, the neural network bounding module 30, and the storage module 10, respectively. The Ising solution unit is configured as follows: The activation output interval is received from the neural network bounding module 30. This activation output interval is obtained by the neural network bounding module 30 through the following process: Constructing an upper envelope piecewise constant function and a lower envelope piecewise constant function for the activation function to be processed. Both the upper and lower envelope piecewise constant functions are composed of one or more segmented intervals, each including a piecewise constant. Using binary variables to represent the upper and lower bounds of the pre-activation interval generated by the boundary propagation calculation array module 20, the activation output interval is obtained based on the binary variables, their respective segmented intervals, and the piecewise constants. This achieves piecewise linear modeling of the activation function to be processed. The activation function to be processed can be a nonlinear monotonically increasing or decreasing activation function, a custom activation function, a convex or concave activation function, etc. The function values, which are determined by the binary variables, their segmented intervals, and the upper and lower bounds of the activation output interval based on the segmented constants, can be pre-stored in the storage module 10. The storage location of the function values ​​can be located by the approximation table index. The high-precision function approximation engine 322 of the neural network bounding module 30 can read the corresponding function values ​​based on the approximation table index and return them to the Ising solver, thus avoiding complex calculations and improving the solution efficiency of the Ising solver.

[0141] Based on the received weights, biases, and pre-activation intervals, the Ising solver constructs the neural network robustness verification problem under the input interval into a mixed-integer linear programming problem. Based on the one-hot vector of the activation output interval, the true class score, and the score of a candidate misclass, the objective function of the mixed-integer linear programming problem is set to minimize the difference between the true class score and the score of a candidate misclass.

[0142] The Ising solver unit transforms the mixed-integer linear programming problem into an Ising model, performs Ising energy minimization on the Ising model, and outputs the optimal solution. This solution is used to update the activation output interval, and the updated activation output interval is used to determine the robustness of the neural network and the presence of adversarial examples, thus improving the accuracy of the verification results. The updated activation output interval can also be fed back to the boundary propagation calculation array module 20 to perform boundary propagation calculations again, achieving real-time feedback adjustment of the activation output interval and the pre-activated interval, thereby improving the accuracy of the entire verification process.

[0143] In this embodiment, the Ising model can be solved for energy minimization using a predetermined computing device. This predetermined computing device may include, but is not limited to: a Coherent Ising Machine (CIM), a quantum annealing computer, an adiabatic quantum computer, a CMOS annealer, an FPGA-based annealing accelerator, a GPU-accelerated computing device, a TPU or AI-specific accelerator chip, a classical high-performance computer (HPC), a multi-core CPU server, a parallel computing cluster, a supercomputing platform, gate-based quantum computers (including superconducting quantum computers, ion trap quantum computers, optical quantum computers, silicon-based quantum computers, spin quantum computers, topological quantum computers, etc.), a simulated quantum simulator, a digital quantum simulator, an optical parametric oscillation network system, a neuromorphic computing chip, a memristor array computing device, and other dedicated or general-purpose computing devices capable of solving the Ising model for energy minimization using quantum computing, simulated annealing, quantum annealing, adiabatic evolution, tensor network computation, Monte Carlo methods, branch and bound algorithms, variational quantum algorithms, or other optimization algorithms. All of the above computing devices are capable of solving the Ising model.

[0144] Therefore, this application realizes the transformation of mixed integer linear programming problems into Ising models through the Ising solution unit of the verification and judgment module 40, uses the coherent Ising machine to efficiently complete the energy minimization solution, and links each module to realize the dynamic update of the activation output interval and robustness judgment, thereby improving the efficiency and accuracy of neural network robustness verification and ensuring the closed-loop nature of the verification process.

[0145] The binary variables are 0-1 binary variables used to uniquely identify the segmented intervals to which the upper and lower bounds of the pre-activation intervals lie. All 0-1 binary variables satisfy the constraint that their summation equals 1, meaning that the upper and lower bounds of each pre-activation interval correspond to only one segmented interval. The segmented constant can be the approximate function value of the activation function within the corresponding segmented interval, obtained by the neural network bounding module 30 based on the approximation table index in the storage module 10. This clarifies the source of the binary variable constraints and the segmented constant, ensuring the rigor of piecewise linear modeling, avoiding confusion in the segmentation identification of pre-activation intervals, and further improving the accuracy of constructing and solving the mixed-integer linear programming problem.

[0146] The process by which the Ising solver updates the activation output interval based on the solution result includes: if the solution result is less than or equal to 0, it is determined that an adversarial example exists, and the upper or lower bound of the activation output interval is tightened; if the optimal solution result is greater than 0, it is determined that the neural network is robust within the current input interval, and the activation output interval remains unchanged. The updated activation output interval is fed back to the boundary propagation computation array module 20 for pre-activation interval calculation or interval refinement processing of the next layer of neurons.

[0147] To make the solution and verification process of the Ising element more concrete, it may include the following: Given a trained neural network: f: In this formula, d is the dimension of the input interval, and k is the number of categories. The network output f(x) can usually be regarded as the logit or score of each category.

[0148] make For a nominal input (clean sample), its true predicted label is defined as: .

[0149] Given a perturbation budget ,around disturbance A sphere (hypercube) is defined as: If the network is For local robustness, the predicted class must remain unchanged for any input that satisfies the perturbation constraint. Equivalently, "robustness is broken" can be expressed as: the existence of some adversarial example. This makes a certain error category The score is not less than the true category score: 1.2 Piecewise Linear Modeling of Neural Networks The pre-activation region of the neural network is: in: It is the first Layer The neuron corresponds to the first neuron in the previous layer. The weight of each activation; It is a bias; It is the activation output of the previous layer; It is a linear combination of the current layer (the input to the activation function).

[0150] For a monotonic activation function, maintain an upper envelope piecewise constant function and a lower envelope piecewise constant function; that is, both of these envelope piecewise constant functions are piecewise constant functions. Utilizing the piecewise constant structure of the envelope function, for any layer... and the neurons in that layer Maintain the upper bound of the pre-activated region. and the lower realm Activate the upper bound of the output interval and the lower realm For each neuron, a binary variable is used to represent the upper and lower bounds of the pre-activation interval. For example, for sample x, the lower layer... The upper bound of the j-th neuron binary variable Indicates that it falls in the first Segmentation intervals: And satisfy: And segmented interval constraints (using dividing points) limited (Which section does it fall on?) here: For the first The value of each line segment (i.e., the value of the piecewise constant).

[0151] These are the dividing points (line segment boundaries) of the pre-activated interval domain.

[0152] The input layer satisfies the perturbation constraints (with For example, each dimension is clamped independently): The robustness verification problem can be written as: minimizing the difference between the true class score and the score of a candidate incorrect class. in It is a one-hot vector. It is the output layer of the neural network (the first layer) The activation output interval vector of the layer. If the optimal value (i.e., the optimal solution) is less than or equal to 0, then there exists an input such that the score of the wrong class is not less than the score of the true class, thus violating robustness. For One-hot vector: dimension is (K is the total number of categories in the classification task), in the vector, only the position corresponding to the true category is 1, and all other positions are 0. For One-hot vector: also with dimension 1 In the vector, only the position corresponding to the candidate error category is 1, and all other positions are 0; and the position of its "1" is related to... Completely different (because it's an "error category").

[0153] Constant / Variable Setting and Mixed Integer Linear Programming Problems 2.1 Variables and Constants It is a constant.

[0154] These are real number decision variables.

[0155] .

[0156] (i.e., binary variables).

[0157] “ " indicates that the output layer has only one neuron (for example, the validation target is written as a single scalar difference output).

[0158] This represents the activation output of each neuron in each layer, and is a continuous variable.

[0159] It is an integer (0 / 1) variable, responsible for selecting which segment of the piecewise linear interval (i.e., which segment the upper and lower bounds of the pre-activation interval belong to).

[0160] It is the boundary of the segmented interval, if Improper settings can affect MILP tightness and numerical stability.

[0161] 2.2 Solving the linearized Mixed Integer Linear Programming Problem (MILP): After linearizing the nonlinear activation function to be processed, the optimization problem is written as mixed-integer linear programming (MILP): In the above formula, the objective function In robustness verification, if the optimization objective is defined as "the real class logit",... If the target class is "logit", then proving that the difference is always greater than 0 within the perturbation set proves robustness.

[0162] Activate output interval constraints (segmentation / segment selection): and .

[0163] The propagation of the upper and lower bounds of the pre-activation interval is split according to the weight sign. Separate by positive and negative: When determining the lower bound of the pre-activation interval, positive weights (w≥0) are multiplied by the lower bound of the activation output interval of the previous layer, and negative weights (w<0) are multiplied by the upper bound of the activation output interval of the previous layer. When determining the upper bound of the pre-activation interval, positive weights are multiplied by the upper bound of the activation output interval of the previous layer, and negative weights are multiplied by the lower bound of the activation output interval of the previous layer.

[0164] Therefore, two equations emerge: - Segmented interval constraints: / Restricted to the selected segment interval Inside: The lower realm: .

[0165] Upper Realm: .

[0166] This ensures that the upper and lower bounds of each pre-activated interval must and can only fall within a single segmented interval.

[0167] right Similarly.

[0168] Combined with the "one-hot" constraint (summing to 1), this will force It falls within a certain range.

[0169] Input disturbance box constraints.

[0170] yes The coordinate form of the perturbation set.

[0171] This indicates that the input is the activation of layer 0.

[0172] To make the neural network robustness verification device and method provided in the embodiments of this application clearer, the third embodiment of this application, in conjunction with the content of the above two embodiments, introduces a specific application example of verifying the robustness of a neural network based on the verification device.

[0173] The verification apparatus and verification method provided in this application can at least solve the following technical problems: P1: In the robustness verification of neural networks, how to quickly and reproducibly calculate the "from the input interval to the output interval of the neural network" for any activation function, so as to perform robustness verification and avoid branch logic becoming a bottleneck.

[0174] P2: How to maintain upper and lower bounds for the pre-activation and activation output of each neuron within the hardware device, and propagate them to the network output layer in a pipelined / parallel manner to achieve the bound comparison required for verification and judgment.

[0175] P3: How to enable devices to support user-defined or parameterized activation functions through a hardware structure of "programmable activation descriptor + multi-mode bounding circuit (monotonic / convex / concave / general function cases)"?

[0176] P4: How to provide hardware-level refinement mechanisms (interval splitting, activation approximation refinement, error budget control) to improve the tightness of the bounds when verification is uncertain, thereby improving the verification success rate and efficiency.

[0177] First, the verification device in this embodiment includes a host interface and task management module 60, a storage module 10, a boundary propagation computing array module 20, a neural network bounding module 30, a refinement and scheduling control module 50, a verification judgment module 40, and a power supply and clock module 70. The power supply and clock module 70 is configured in the verification device and connected to other modules.

[0178] Host interface and task management module 60: Used to receive the structural information and adjustable activation function parameters of the neural network model to be verified, the description of the input samples and perturbation set, the verification target, and to send back the verification conclusion / intermediate boundary information.

[0179] The host interface and task management module 60 supports multiple interface types, which may include one or more combinations of PCIe (Peripheral Component Interconnect Express), Ethernet, CXL (ComputeExpress Link), and fiber optic interconnect (a high-speed interface / interconnection method using optical fiber as the transmission medium).

[0180] The storage module 10 includes a weight memory 11, a bias memory 12, and a descriptor memory 13 (also known as an activation descriptor memory, or ADM for short). The weight memory 11 stores the weights W of the neural network, and the bias memory 12 stores the biases b of the neural network. The descriptor memory 13 stores the hardware-executable descriptors for each type of activation function.

[0181] Hardware executable descriptors include, but are not limited to: function ID (identifier), parameters (such as α, β, etc.), monotonicity flags (increasing / decreasing / non-monotonic), convexity and segmentation information, upper bound K of the Lipschitz constant, key point table (critical points / inflection points / periodic points, etc.), approximation table index (which can locate the storage address of the lookup table LUT, coefficient table, etc.), allowable error budget and safety margin (used to ensure that the upper bound is not underestimated and the lower bound is not overestimated), etc.

[0182] Boundary propagation calculation array module 20 is used to perform boundary propagation calculations to propagate upper and lower bounds between layers. Boundary propagation calculation array module 20 includes at least: Affine layer boundary propagation unit 21: used for the linear part of fully connected / convolutional neural networks.

[0183] Normalized bound propagation unit 22: such as the equivalent linearization of BatchNorm / LayerNorm in the inference state.

[0184] Boundary combination unit 23 with residual / splicing structure: used to implement interval addition operation, element-wise maximum and minimum combination operation, etc.

[0185] The neural network bounding module 30, as the core hardware unit of the verification device, is used to receive the pre-activation interval of each neuron. The hardware executable descriptor of the activation function is then used to output the safe output bound of the activation function over the input range. (That is, activate the output range).

[0186] The neural network bounding module 30 internally includes at least: Descriptor processing unit 31: Selects the optimal bounding link based on the hardware executable descriptor of the activation function to achieve bounding of the upper and lower bounds of the activation output interval.

[0187] Monotonic Fast Bounding Circuit 321: Performs fast bounding for monotonically increasing or decreasing activation functions.

[0188] 323 Convex-Concave Envelope Generation Circuit: Supports safe bounding for convex-concave or piecewise functions.

[0189] Sampling bounding circuit 324 for general functions (activation functions without explicit function characteristics, user-defined activation functions): provides a safe bounding method for general functions.

[0190] The high-precision function approximation engine 322 uses one or more of the following methods to approximate functions and obtain function values: Look-Up Table (LUT) with approximation table indexing, polynomial approximation, CORDIC (Coordinate Rotation Digital Computer) iterative computation, etc. Polynomial approximation fits activation functions with polynomials (such as first-order, second-order, or higher-order polynomials). CORDIC iterative computation is a hardware-efficient numerical computation algorithm that achieves function approximation through iterative coordinate rotation, eliminating the need for multipliers, adapting to special activation functions such as trigonometric functions, and balancing efficiency and accuracy.

[0191] Interval adjustment circuit 33: ensures that the upper limit is not underestimated and the lower limit is not overestimated, thereby ensuring the accuracy of the activated output interval.

[0192] Output boundary buffer unit 34: Prepares data for the next layer boundary propagation.

[0193] The refinement and scheduling control module 50 can trigger a predetermined processing strategy when the output layer verification conditions cannot be directly determined. The predetermined processing strategy includes one or more of the following: input interval splitting strategy, activation approximation encryption strategy, and local priority refinement strategy.

[0194] The refinement and scheduling control module 50 includes: Task queue and sub-interval cache unit 52: manages and stores refined interval tasks.

[0195] Refinement Policy Controller 51: Determines when and how to refine the current task.

[0196] Budget Manager 53: Ensures efficient use of system resources.

[0197] The verification and judgment module 40 is used to compare the upper and lower bounds of the active output range of the output layer: If the lower bound of the target category is greater than the upper bound of other categories, the decision is passed. If a necessary flip condition exists, the counterexample interval information or candidate counterexamples are output. This verification decision module 40 can output: verification information and output boundary certificate.

[0198] Power and clock module 70: Provides low-noise power and synchronous clock for array computing, LUT / storage, interface and control logic, ensuring stable operation of the verification device.

[0199] The verification device provided in this application embodiment is provided with a descriptor memory 13. The "hardware executable descriptors" stored in the descriptor memory 13 uniformly represent the information required for finding the bounds of any activation function (monotonicity / convexity / Lipschitz upper bound / approximation table index, etc.), thus structurally supporting the bounds requirement of any activation function.

[0200] The neural network bounding module 30 in the verification device maps different types of activation functions to different hardware bounding links through the descriptor processing unit 31, achieving high-throughput interval bounding. The interval adjustment circuit 33 ensures the safety of the output upper / lower bounds (the upper bound is not underestimated, and the lower bound is not overestimated) through hardware, meeting the provable verification correctness requirements. Through the hardware closed loop of "boundary propagation computing array module 20 + neural network bounding module 30 + refinement and scheduling control module 50", a structured acceleration and energy efficiency improvement are formed, which is different from the pure software execution of general-purpose computers.

[0201] The workflow of the robustness verification method executed by the verification device in this application embodiment includes the following steps: S101: The host interface and task management module 60 receives the structural information (weights W, bias b) of the neural network to be verified, the hardware executable descriptor of any activation function, and the input samples. and disturbance sets (such as) Norm sphere radius ).

[0202] S102: Boundary Propagation Computation Array Module 20 based on input samples and the set of disturbances, initialize the input interval as The affine transformation boundary propagation and activation function output boundary calculation are performed alternately layer by layer.

[0203] S103: The neural network bounding module 30, based on the hardware-executable descriptor in the descriptor memory 13, pre-activation intervals for each neuron. Dynamically select the optimal bounding path to generate a safe activation output range. .

[0204] S104: If the current output layer boundary satisfies the robustness judgment condition (the lower bound of the target class is higher than the upper bound of all other classes), then jump to S107. Otherwise, the refinement and scheduling control module 50 starts the refinement strategy (pre-defined processing strategy), splits the current input interval or the wide interval of the intermediate layer structure into sub-intervals, and generates new sub-tasks for queuing.

[0205] S105: The system retrieves the refined sub-intervals from the task queue and sub-interval cache unit 52, returns to S102 to continue propagation and bounding, until all sub-tasks are processed or the resource / time budget limit is reached.

[0206] S106: If a class reversal is detected in any subtask, record the information of the negative example interval (i.e. the activation output interval corresponding to the class reversal).

[0207] S107: Verification and judgment module 40 summarizes all task results (all active output ranges). If all task branches are verified, it outputs "Verification passed"; otherwise, it outputs "An adversarial counterexample exists" and the corresponding active output range or candidate point.

[0208] S108: The host interface and task management module 60 will transmit the final verification information, output boundary certificate or counterexample range information back.

[0209] The description of the perturbation set in S101 can also include the following categories: Norm type + specific threshold: radius of the sphere except for norm (e.g.) , Norm sphere), and you can also directly specify the norm type and perturbation threshold (e.g. Norm perturbation ≤ ε (Normal perturbation ≤ δ), which clarifies the constraint range of the perturbation.

[0210] Hybrid perturbation constraints: combining multiple methods (such as norm constraints + component level constraints), for example, " "The radius of the norm sphere is ≤ ε and the perturbation of each component is ≤ δ", further defining the perturbation range more precisely.

[0211] The embodiments of this application are further described below.

[0212] The terms and objects involved in the embodiments of this application include: Interval bounds: for any scalar variable In a device, this is represented by a pair of registers or memory units: in This is the lower bound value. This is the upper bound value.

[0213] Neuron input / output boundaries: For each neuron, device maintenance: pre-activation input interval Activate output interval This point is used to support boundary propagation under arbitrary activation functions.

[0214] Safety boundary: In the embodiments of this application, "safety" means that the true minimum value is not less than the given lower bound, and the true maximum value is not greater than the given upper bound, that is: , .

[0215] System architecture and workflow: The verification device includes a host interface and task management module 60, a storage module 10, a boundary propagation computation array module 20, a neural network bounding module 30, a refinement and scheduling control module 50, and a verification judgment module 40. Among them, the boundary propagation computation array module 20 and the neural network bounding module 30 constitute the main data path, realizing the conversion from the pre-activated interval to the activated output interval, and preparing for the boundary propagation of the next layer.

[0216] S201, Task Reception and Parameter Loading: The host interface and task management module 60 receives a complete verification task package, including: network topology information (i.e., structural information: number of layers). (Structure type and size of each layer), weight With bias (Write to weight memory 11 and bias memory 12 respectively), and write the hardware executable descriptor corresponding to each activation function to descriptor memory 13. The hardware executable descriptor includes: identifier func_id, specific adjustable parameter param[] of activation function, monotonicity flag mono_flag, convexity flag convex_flag, Lipschitz constant lip_K, base address of LUT memory pointing to lookup table lut_ptr, approx_mode (function approximation mode, such as LUT, polynomial, CORDIC, mixed mode), error margin eps_margin, sample number adjustment control parameter refine_cap, etc.

[0217] Input Sample (a d-dimensional real vector) and the description of the perturbation set (e.g.) Norm radius ); Input range initialized to The input buffer of the boundary propagation computation array module 20 is written as the initial activation output boundary.

[0218] S202, Boundary Propagation and Pre-Activation Boundary Generation: Boundary propagation computation array module 20 initiates pipeline processing, performing boundary propagation computation layer by layer starting from layer 1: Affine layer boundary propagation unit 21 reads the activation output range of the previous layer. Current layer weight and bias For each output neuron Calculate the pre-activation interval using the positive and negative weight separation method. Boundary: in, All are integers. , All operations can be performed in a fixed-point multiply-accumulate array. The multiply-accumulate array can be configured in the affine boundary propagation unit 21 or it can be an independent module connected to the affine boundary propagation unit 21.

[0219] If the current layer contains BatchNorm (Batch Normalization) or LayerNorm (Layer Normalization), then the normalization bound propagation unit 22 treats it as an affine transformation. ,renew . For learnable scaling parameters, The offset parameter is learnable.

[0220] If the current layer has a residual structure or a channel splicing structure, the boundary combination unit 23 performs an interval addition operation (e.g., ...). Or perform an element-wise maximum-minimum combination operation ( ).

[0221] Finally, the pre-activation range of the current layer is obtained. The pre-activated interval is then fed into the neural network bounding module 30.

[0222] S203, Safety bounds for arbitrary activation functions: The neural network bounding module 30 processes all neurons in parallel. The process is as follows: The descriptor processing unit 31 reads the hardware-executable descriptor of the current layer activation function from the descriptor memory 13ADM. Based on mono_flag and convex_flag, it determines which bounding path to assign to perform the bounding calculation of the activation output interval. 11) If mono_flag = "incrementing": call the monotonic fast bounding circuit 321, triggering the high-precision function approximation engine 322 to calculate. and Output .

[0223] 12) If mono_flag = "decreasing": the processing logic is the same as in 11), but the order is swapped. .

[0224] 13) If convex_flag is known and the interval is located in a convex or concave segment: the convex-concave envelope generation circuit 323 generates tangents or chords at the endpoints and several internal points (such as near inflection points) to construct a compact safety bound.

[0225] 14) Otherwise (unknown monotonicity / non-convex / custom function): Enable Lipschitz sampling bounding circuit 324. In a general function bounding chain, sampling bounding circuit 324 performs the following steps: 21) In Uniform selection within Number of sampling points {z_k} ( (Can be dynamically adjusted by refine_cap).

[0226] 22) Calling the high-precision function approximation engine for parallel computing 322 .

[0227] Set interval width The security bounds are calculated using lip_K provided by the hardware executable descriptor: 23) The activated output range of all bounding links is fed into the range adjustment circuit 33: Mapping approximation error and quantization error into additional safety margins The interval adjustment circuit 33 performs an adjustment on the upper boundary. (The upper bound of the output range to be activated plus a safety margin) (Round up), and apply to the lower bound. (Subtract the safety margin from the lower bound of the activated output range) Round down.

[0228] If the function has a known range (e.g.) The interval adjustment circuit 33 will activate the output interval forced clipping to this value range. The final safe output boundary... Write to output boundary buffer unit 34 for use by the next layer.

[0229] S204, Decision and Refinement Loop: The verification and determination module 40 receives the activation output ranges of all categories in the last layer. : 31) If If the condition is met, the robustness is determined to be "valid", and the process jumps to S108 in the workflow. To verify the target category.

[0230] 32) If it exists Make If the counterexample is found, the counterexample interval information is recorded and marked as "adversarial example exists". Otherwise, the determination result is uncertain, and the refinement and scheduling control module 50 is triggered.

[0231] The refinement and scheduling control module 50 executes one or more of the following pre-defined processing strategies: Input interval splitting strategy: split the interval with the largest width in the original input dimension. Split into and Two new subtasks are generated and added to the task queue and sub-range cache unit 52; Activate the approximation encryption strategy: Increase the sampling number of the intermediate neurons with the highest influence (such as those that contribute the most to the output boundary). Alternatively, one could switch to a higher-order polynomial approximation.

[0232] Local priority refinement strategy: Based on gradient sensitivity or interval width sorting, prioritize processing the branches that contribute the most to the uncertainty of the output.

[0233] The system retrieves a new subtask from the task queue and sub-interval buffer unit 52, returns to S102 in the workflow to continue propagation, until: All subtasks have been validated; Find at least one counterexample; Budget Manager 53 triggers termination conditions (such as timeout, memory exhaustion, maximum refinement depth reaching refine_cap).

[0234] S205. Conclusion Generation and Feedback: The results of all subtasks are summarized by the verification and judgment module 40. If all branches satisfy The output will be "Verification passed".

[0235] If any branch has a guaranteed flip, output "Verification failed" and counterexample interval information (or sample from it to generate candidate adversarial examples).

[0236] Otherwise (timeout exit), output "pending" along with the current tightest output boundary as a certificate.

[0237] The final conclusion, output boundaries, and counterexample range information are transmitted back to the host computer via the host interface and the task management module 60.

[0238] As can be seen from the above, the embodiments of this application adopt a fully hardware pipelined architecture, and the boundary propagation computation array module 20 and the neural network bounding module 30 can process multiple layers / multiple neurons in parallel. The high-precision function approximation engine 322 supports multiple implementations such as LUT, polynomial, and CORDIC, and can be configured according to power consumption / area / accuracy requirements. The interval adjustment circuit 33 ensures that even if there is an approximation error, the output boundary still meets the provably verifiable correctness requirements.

[0239] This application also provides the following alternative solutions and extensions: (A1) The sampling strategy of the sampling bounding circuit 324 can be uniform sampling, Chebyshev node sampling or adaptive sampling (controlled by the refinement strategy controller 51), but all of them are implemented in hardware as a deterministic process and circuit structure.

[0240] (A2) Lipschitz constant source alternatives: lip_K can be provided by the user, estimated and written by an offline tool, or written by the device via a calibration task before deployment; - interval adaptive K can be supported (the descriptor contains a K table or K calculation parameters).

[0241] (A3) Refined strategy alternatives: Interval splitting can be applied to the input dimension, the pre-activation intervals of hidden layer neurons, or key comparison terms of output constraints. Multiple queue priorities (influence priority / width priority / hierarchy priority) can be introduced.

[0242] (A4) Model structure replacement: Supports activations such as GELU / Swish in Transformer; supports boundary propagation of residual, skip connection, splicing and attention modules (implemented through boundary combination unit 23 and corresponding hardware executable descriptor extension).

[0243] Compared with the prior art, the embodiments of this application effectively solve the technical problems P1 to P4 mentioned above, and bring at least the following beneficial effects: E1: Hardware that can prove bounds for any activation function. Through the multi-link structure of the descriptor memory 13ADM and the neural network bounding module 30, the device supports range bounds for any activation function at the hardware level, rather than relying on software branches and function library calls of a general-purpose computer, thus improving reproducibility and engineering consistency.

[0244] E2: Throughput and energy efficiency improvements. The boundary propagation computing array module 20 and the neural network bounding module 30 form a pipelined parallel system, significantly reducing memory access and control overhead on general-purpose platforms. This application embodiment improves overall verification throughput through a dedicated data path.

[0245] E3: Supports a wider family of activation functions. Many existing verification frameworks have limited support for activation functions or are complex to implement. This application embodiment supports more activation types (including custom ones) through descriptors and the hardware neural network bounding module 30, reducing the cost of expansion.

[0246] E4: Boundary compactness can be improved through a refinement mechanism. By refining and encrypting the intervals of the scheduling control module 50, the boundary can be gradually tightened when the determination is uncertain, thereby improving the verification success rate and resource utilization efficiency.

[0247] E5: Unlike the structural improvements of general-purpose computers, the embodiments of this application introduce a dedicated descriptor memory 13, various circuits of the boundary unit, an interval adjustment circuit 33 that can inject error safety margin, a boundary cache multi-bank and a refinement and scheduling control module 50, etc., to achieve technical improvements to the internal structure and performance of the computing device, rather than simply executing human rule steps on a general-purpose computer.

[0248] It should be noted that the term "comprising" and its variations used in the embodiments of this application are open-ended, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; and the term "some embodiments" means "at least some embodiments". The modifications of "one" and "multiple" mentioned in the embodiments of this application are illustrative and not restrictive. Those skilled in the art should understand that, unless explicitly indicated otherwise in the context, they should be understood as "one or more".

[0249] The steps described in the method embodiments provided in this application can be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of protection of this application is not limited in this respect.

[0250] The term "embodiment" in this specification refers to a specific feature, structure, or characteristic described in connection with an embodiment that may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily imply the same embodiment, nor does it imply independence from or alternative to other embodiments. The various embodiments in this specification are described in a related manner, with reference to each other for similar or identical parts. In particular, for apparatus, device, and system embodiments, since they are substantially similar to method embodiments, the description is relatively simple, and relevant details are referred to in the description of the method embodiments.

[0251] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of patent protection. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the appended claims.

Claims

1. A method for verifying the robustness of a neural network, characterized in that, The verification method includes: The structure information of the neural network and the hardware executable descriptor of the activation function of the neural network are obtained. The structure information includes at least weights and biases. The hardware executable descriptor includes at least function characteristics, bounding auxiliary information, and an approximation table index. The function characteristics are used to describe at least one of the changing trend and mathematical form of the activation function. The bounding auxiliary information is the information required to calibrate the function value of the activation function when bounding an activation function that does not have the explicitly stated function characteristics or a custom activation function. The approximation table index is used to locate the storage address corresponding to the function value of the activation function at a specified value in the pre-activation interval. The input interval is obtained based on the input samples and perturbation set of the input neural network. Then, based on the input interval, the weights and the bias, the boundary propagation calculation is performed to generate the pre-activation interval of each layer of neurons. Based on the hardware executable descriptor, the activation function to be processed under the pre-activation interval is bounded to obtain the activation output interval, and the activation output interval is used as the input of the next layer of neurons until the activation output interval of the neural network output layer is obtained. The activation function to be processed includes one of the following: activation function with different function characteristics, activation function without explicit function characteristics, and custom activation function. Specifically, for activation function with different function characteristics, bounding is performed based on its corresponding function characteristics and the approximation table index. For activation function without explicit function characteristics and custom activation function, bounding is performed based on bounding auxiliary information and the approximation table index. The robustness of the neural network or the existence of adversarial examples are determined based on the activated output range of the output layer.

2. The neural network robustness verification method according to claim 1, characterized in that, The steps for finding the bounds of the activation function to be processed within the pre-activation region include: After determining the bounding point of the activation function to be processed within the pre-activation interval, the function value corresponding to the bounding point is obtained based on the approximation table index. The activation output interval is then obtained based on the function value or the function value and the bounding auxiliary information. The bounding point is at least two specified values ​​selected from the pre-activation interval according to the function type of the activation function to be processed; and / or, Before obtaining the structural information of the neural network and the hardware executable descriptor of the activation function of the neural network, the method further includes: The structure information and the hardware executable descriptor are stored in the storage module (10).

3. The neural network robustness verification method according to claim 2, characterized in that, The mathematical form includes concavity and convexity, and when the pre-activation interval is located in the convex or concave segment of the activation function to be processed, the step of obtaining the activation output interval based on the function value includes: The upper and lower bounds of the pre-activated interval, as well as a number of interior point values ​​located between the upper and lower bounds, are used as the boundary points. The function value corresponding to each of the bounding points is obtained based on the approximation table index; Based on the function value, a tangent or chord is generated at the boundary point to construct the upper and lower envelopes of the activation function to be processed, and the activation output interval is determined by the extreme values ​​of the upper and lower envelopes within the pre-activation interval.

4. The neural network robustness verification method according to claim 2, characterized in that, When the activation function to be processed includes an activation function that does not have explicitly stated function characteristics or a user-defined activation function, the step of obtaining the activation output interval based on the function value and the bounding auxiliary information includes: A predetermined number of endpoint values ​​sampled within the pre-activation interval are used as the boundary points; Based on the approximation table index, a predetermined number of function values ​​corresponding to each of the bounding points are obtained; The activation output interval is calculated based on a predetermined number of function values ​​and the bounding auxiliary information.

5. The neural network robustness verification method according to claim 4, characterized in that, The bounding auxiliary information includes the Lipschitz constant K and the error margin. The step of calculating the activated output interval based on a predetermined number of function values ​​and the bounding auxiliary information includes: The interval width is obtained by subtracting the lower bound of the pre-activation interval from the upper bound. And calculate the Lipschitz constant K and The product; The upper bound of the activated output interval is obtained by adding the maximum value among a predetermined number of function values, the product, and the error margin. The lower bound of the activated output interval is obtained by subtracting the product and the error margin from the minimum value among a predetermined number of function values.

6. The neural network robustness verification method according to claim 1, characterized in that, When uncertain verification information is determined, the method further includes: The activated output range is adjusted using a predetermined processing strategy, which includes: Input interval splitting strategy: Divide the input interval or the active output interval with an interval width greater than a predetermined value into at least two sub-intervals, and perform the boundary propagation calculation based on the sub-intervals; The uncertain verification information is the information output when robustness is not determined and adversarial examples are not determined.

7. The neural network robustness verification method according to claim 1, characterized in that, The method further includes the following steps: During the bounding process, an upper envelope piecewise constant function and a lower envelope piecewise constant function are constructed for the activation function to be processed. Both the upper envelope piecewise constant function and the lower envelope piecewise constant function are composed of one or more segmented intervals, and each segmented interval includes a piecewise constant. A binary variable is used to represent the segmented interval in which the upper and lower bounds of the pre-activation interval are located. Based on the binary variable, the segmented interval in which it is located, and the piecewise constant, the activation output interval is obtained. Based on the received weights, biases, and pre-activation intervals, the neural network robustness verification problem under the input interval is constructed into a mixed-integer linear programming problem. Based on the one-hot vector of the activation output interval, the true class score, and the score of a candidate incorrect class, the objective function of the mixed-integer linear programming problem is set to minimize the difference between the true class score and the score of a candidate incorrect class. The mixed-integer linear programming problem is transformed into an Ising model. The Ising energy is minimized on the Ising model, and the optimal solution is output. The activation output interval is updated using the solution, and the updated activation output interval is used to determine whether the neural network is robust and whether there are adversarial examples.

8. A neural network robustness verification device, characterized in that, The neural network robustness verification device can be used to implement the neural network robustness verification method according to any one of claims 1 to 7, and the neural network robustness verification device includes: Storage module (10) is used to store the structural information of the neural network and the hardware executable descriptor of the activation function. The structural information includes at least weights and biases, and the hardware executable descriptor includes at least function characteristics, bounding auxiliary information and approximation table index. Boundary propagation computation array module (20), which is connected to the storage module (10), is used to perform boundary propagation computation based on the input interval, the weight and the bias to generate the pre-activation interval of each layer of neurons. The input interval is the interval obtained by the boundary propagation computation array module (20) based on the input samples and perturbation set of the input neural network. The neural network bounding module (30) is connected to the boundary propagation computation array module (20) and the storage module (10). The neural network bounding module (30) is configured to: receive the pre-activation interval and obtain the hardware executable descriptor from the storage module (10); perform bounding processing on the activation function to be processed under the pre-activation interval based on the hardware executable descriptor to obtain the activation output interval; and feed the activation output interval back to the boundary propagation computation array module (20) so that the boundary propagation computation array module (20) uses the activation output interval as the input required for the next layer of neurons to obtain the pre-activation interval. The activation function to be processed includes one of the activation functions with different function characteristics, activation functions without explicit function characteristics, and custom activation functions. The neural network bounding module (30) performs bounding processing on activation functions with different function characteristics based on their corresponding function characteristics and the approximation table index. For activation functions without explicit function characteristics and custom activation functions, it performs bounding processing based on the bounding auxiliary information and the approximation table index. The verification and determination module (40) is connected to the neural network bounding module (30) to receive the activation output interval of the neural network output layer fed back by the neural network bounding module (30). The verification and determination module (40) determines whether the robustness is valid or whether there are adversarial examples based on the activation output interval.

9. The neural network robustness verification device according to claim 8, characterized in that, The neural network bounding module (30) includes: A descriptor processing unit (31) is connected to the storage module (10) and the boundary propagation computing array module (20). The descriptor processing unit (31) is configured to read the hardware executable descriptor from the storage module (10) to parse out the function characteristics, the bounding auxiliary information and the approximation table index. A bounding unit (32) is connected to the descriptor processing unit (31) and the boundary propagation computation array module (20), respectively. The bounding unit (32) includes multiple bounding links. The descriptor processing unit (31) assigns the hardware executable descriptor and the pre-activation interval to the corresponding bounding links according to the function characteristics. The bounding unit (32) is configured as follows: After determining the boundary point of the activation function to be processed in the pre-activation interval through the boundary-finding link, the function value corresponding to the boundary point is obtained based on the approximation table index, and the activation output interval obtained according to the function value or the function value and the boundary-finding auxiliary information is fed back to the boundary propagation calculation array module (20).

10. The neural network robustness verification device according to claim 9, characterized in that, The type of the changing trend includes monotonically increasing or monotonically decreasing, then the bounding link includes a link composed of a monotonically fast bounding circuit (321) and a high-precision function approximation engine (322), wherein: The monotonic fast bounding circuit (321) is connected to the descriptor processing unit (31), the high-precision function approximation engine (322), and the boundary propagation calculation array module (20), respectively. The monotonic fast bounding circuit (321) is configured to: receive the change trend, the approximation table index, and the pre-activation interval dispatched by the descriptor processing unit (31); take the upper and lower bound values ​​of the pre-activation interval as the bounding point based on the type of the change trend; and send a function value calculation request and the approximation table index to the high-precision function approximation engine (322). The high-precision function approximation engine (322) is configured to: in response to a calculation request, obtain the function value corresponding to each of the bounding points based on the approximation table index and feed the function value back to the monotonic fast bounding circuit (321). The monotonic fast bounding circuit (321) obtains the active output interval based on the type of the change trend and the received function value, and feeds the active output interval back to the boundary propagation calculation array module (20).

11. The neural network robustness verification device according to claim 10, characterized in that, The mathematical form includes concavity and convexity, and when the pre-activation interval is located in the convex or concave segment of the activation function to be processed, the bounding link further includes a link composed of the convex-concave envelope generation circuit (323) and the high-precision function approximation engine (322), wherein: The convex-concave envelope generation circuit (323) is connected to the descriptor processing unit (31), the high-precision function approximation engine (322), and the boundary propagation calculation array module (20), respectively. The convex-concave envelope generation circuit (323) is configured to: receive the approximation table index, the mathematical form, and the pre-activation interval assigned by the descriptor processing unit (31), take the upper bound value, lower bound value, and a number of interior point values ​​located between the upper bound value and the lower bound value of the pre-activation interval as the boundary point, and send a function value calculation request and the approximation table index to the high-precision function approximation engine (322); The high-precision function approximation engine (322) is configured to: in response to a calculation request, obtain the function value corresponding to each of the bounding points based on the approximation table index and feed the function value back to the convex-concave envelope generation circuit (323). The convex-concave envelope generation circuit (323) generates tangents or chords at the boundary point based on the function value to construct the upper and lower envelopes of the activation function to be processed, and determines the activation output interval by the extreme values ​​of the upper and lower envelopes in the pre-activation interval, and feeds the activation output interval back to the boundary propagation calculation array module (20).

12. The neural network robustness verification device according to claim 10, characterized in that, When the activation function to be processed includes an activation function that does not have the explicitly stated function characteristics or a custom activation function, the bounding link further includes a link consisting of a sampling bounding circuit (324) and the high-precision function approximation engine (322), wherein: The sampling boundary circuit (324) is connected to the descriptor processing unit (31), the high-precision function approximation engine (322), and the boundary propagation calculation array module (20), respectively. The sampling bounding circuit (324) is configured to: receive the pre-activation interval, the approximation table index and the bounding auxiliary information assigned by the descriptor processing unit (31), take a predetermined number of endpoint values ​​sampled in the pre-activation interval as the bounding point, and send a function value calculation request and the approximation table index to the high-precision function approximation engine (322); The high-precision function approximation engine (322) is configured to: in response to a calculation request, calculate in parallel based on the approximation table index to obtain a predetermined number of function values ​​corresponding to each of the bounding points, and feed back the predetermined number of function values ​​to the sampling bounding circuit (324). The sampling bounding circuit (324) calculates the active output interval based on a predetermined number of function values ​​and the bounding auxiliary information, and feeds the active output interval back to the boundary propagation calculation array module (20).

13. The neural network robustness verification device according to claim 12, characterized in that, The hardware executable descriptor also includes a sampling quantity adjustment control parameter, and the sampling bounding circuit (324) is further configured to dynamically adjust the predetermined quantity based on the received sampling quantity adjustment control parameter and the range of the pre-activation interval; and / or, The bounding auxiliary information includes the Lipschitz constant K and the error margin. The calculation steps of the sampling bounding circuit (324) to obtain the active output interval based on a predetermined number of function values ​​and the bounding auxiliary information include: The interval width is obtained by subtracting the lower bound of the pre-activation interval from the upper bound. And calculate the Lipschitz constant K and The product; The upper bound of the activated output interval is obtained by adding the maximum value among a predetermined number of function values, the product, and the error margin. The lower bound of the activated output interval is obtained by subtracting the product and the error margin from the minimum value among a predetermined number of function values.

14. The neural network robustness verification device according to claim 10, characterized in that, The hardware executable descriptor also includes a pre-set safety margin, and the neural network bounding module (30) further includes: An interval adjustment circuit (33) is connected between the boundary-finding unit (32) and the boundary propagation calculation array module (20). The interval adjustment circuit (33) is configured to receive the active output intervals output by multiple boundary-finding links, adjust the upper and lower bounds of all the active output intervals based on the safety margin, and then feed the active output intervals back to the boundary propagation calculation array module (20).

15. The neural network robustness verification device according to claim 14, characterized in that, When the activation function to be processed has a value range, the interval adjustment circuit (33) will also trim the activation output interval to the value range; and / or, The neural network bounding module (30) further includes: Output boundary buffer unit (34) is connected between the interval adjustment circuit (33) and the boundary propagation calculation array module (20). The output boundary buffer unit (34) is used to buffer the active output interval output by the interval adjustment circuit (33) so that the boundary propagation calculation array module (20) can input the active output interval read from the output boundary buffer unit (34) into the next layer of the neural network.

16. The neural network robustness verification device according to claim 10, characterized in that, The device further includes: A refinement and scheduling control module (50) is connected between the boundary propagation calculation array module (20) and the verification and determination module (40). The refinement and scheduling control module (50) is configured to: when receiving uncertain verification information sent by the verification and determination module (40), adjust the activation output interval using a predetermined processing strategy. The predetermined processing strategy includes: Input interval splitting strategy: Divide the input interval or the active output interval with an interval width greater than a predetermined value into at least two sub-intervals, and transmit at least two of the sub-intervals to the boundary propagation calculation array module (20) so that the boundary propagation calculation array module (20) performs the boundary propagation calculation based on the sub-intervals; The uncertain verification information is the information output by the verification judgment module (40) when it fails to determine that robustness is established and fails to determine that adversarial samples exist.

17. The neural network robustness verification device according to claim 16, characterized in that, The pre-defined processing strategy also includes: Activate the approximation encryption strategy: For the intermediate neuron with the highest influence, when the bounding link further includes a sampling bounding circuit (324), increase the predetermined number of endpoint values ​​sampled by the sampling bounding circuit (324) in the pre-activation interval of the intermediate neuron. The intermediate neuron is a neuron located in the hidden layer between the input layer and the output layer of the neural network. The intermediate neuron with the highest influence includes the neuron that causes the largest reduction in the width of the activated output interval output by the output layer of the neural network when the pre-activation interval is tightened to a single point; and / or, Local priority refinement strategy: The boundary propagation computation array module (20) sorts the interval tasks to be processed based on gradient sensitivity or interval width, so that the boundary propagation computation array module (20) prioritizes processing the interval tasks with the largest interval width or the highest gradient sensitivity based on the sorting. The interval width is the difference between the upper and lower bounds of the interval task. The gradient sensitivity is the absolute value of the partial derivative of the activation output interval output by the neural network output layer with respect to the interval task. The interval task includes the sub-interval or the activation output interval output by the hidden layer of the neural network.

18. The neural network robustness verification device according to claim 16 or 17, characterized in that, The refinement and scheduling control module (50) includes: A refined strategy controller (51) is connected to the verification and determination module (40). The refined strategy controller (51) is used to execute the predetermined processing strategy when receiving uncertain verification information sent by the verification and determination module (40). The task queue and sub-interval cache unit (52) is connected to the refinement strategy controller (51) and the boundary propagation calculation array module (20). The task queue and sub-interval cache unit (52) is used to receive the interval tasks generated by the refinement strategy controller (51) after executing the predetermined processing strategy, and to provide the interval tasks to the boundary propagation calculation array module (20) for boundary propagation calculation.

19. The neural network robustness verification device according to claim 18, characterized in that, The refinement and scheduling control module (50) also includes: Budget manager (53), which is connected to the refinement strategy controller (51), is used to provide the refinement strategy controller (51) with budget constraints required to execute the predetermined processing strategy, so that the refinement strategy controller (51) can decide whether to terminate the execution of the predetermined processing strategy based on the budget constraints. The budget constraints include one or more of the following: computing resource budget, time budget, and error budget.

20. The neural network robustness verification apparatus according to any one of claims 8 to 17, characterized in that, The structural information also includes layer type information describing the structural type of the hidden layer of the neural network. When the layer type information includes a fully connected layer or a convolutional layer, the boundary propagation computation array module (20) includes: Affine layer boundary propagation unit (21) is connected to the storage module (10) and the neural network boundary calculation module (30). The boundary propagation calculation array module (20) is configured to: when the structure type of the current layer is determined to be the fully connected layer or the convolutional layer based on the layer type information read from the storage module (10), call the affine layer boundary propagation unit (21) to obtain the activation output interval of the previous layer neuron output by the neural network boundary calculation module (30), and read the weight and the bias from the storage module (10) so as to generate the pre-activation interval of the current layer neuron by performing boundary propagation calculation based on the activation output interval, the weight and the bias through the affine layer boundary propagation unit (21).

21. The neural network robustness verification device according to claim 20, characterized in that, When the layer type information also includes a normalized layer, the boundary propagation calculation array module (20) further includes: Normalized boundary propagation unit (22), which is connected to the neural network boundary-finding module (30) and the affine layer boundary propagation unit (21), is configured to: when the structure type of the current hidden layer is determined to be the normalized layer based on the layer type information read from the storage module (10), call the normalized boundary propagation unit (22) to update the pre-activation interval of the current layer based on the pre-set scaling parameters and offset parameters.

22. The neural network robustness verification device according to claim 21, characterized in that, When the layer type information includes a residual structure or a channel splicing structure, the boundary propagation calculation array module (20) further includes: Boundary combination unit (23), the boundary combination unit (23) is connected to the neural network boundary finding module (30), and can be selectively connected to at least one of the affine layer boundary propagation unit (21) and the normalized boundary propagation unit (22). The boundary propagation calculation array module (20) is configured to: when the structure type of the current hidden layer is determined to be a residual structure or a channel splicing structure based on the layer type information read from the storage module (10), call the boundary combination unit (23) to perform a combination operation on the pre-activation intervals from different branches to obtain the pre-activation intervals of the current layer. The different branches include the main branch and residual branch that form the residual structure, or multiple feature input branches used for the channel splicing structure. The combination operation includes: For the interval addition operation of the residual structure: add the lower bound values ​​of different pre-activated intervals to obtain a new lower bound value, and add the upper bound values ​​of different pre-activated intervals to obtain a new upper bound value; For the element-wise maximum-minimum combination operation of the channel splicing structure: take the minimum value among multiple lower bound values ​​from different pre-activated intervals as the new lower bound value, and take the maximum value among multiple upper bound values ​​as the new upper bound value.

23. The neural network robustness verification apparatus according to any one of claims 8 to 17, characterized in that, The storage module (10) includes: A weight memory (11) is connected to the boundary propagation calculation array module (20), and the weight memory (11) is used to store the weights; A bias memory (12) is connected to the boundary propagation computing array module (20), and the bias memory (12) is used to store the bias. The descriptor memory (13) is connected to the neural network bounding module (30) and is used to store the hardware executable descriptor.

24. The neural network robustness verification device according to claim 8, characterized in that, The device further includes: A host interface and task management module (60) is connected to the storage module (10), the boundary propagation computing array module (20), the neural network bounding module (30), and the verification and judgment module (40), respectively. The host interface and task management module (60) is configured as follows: The received structural information and the hardware executable descriptor are written into the storage module (10), and the received input samples and perturbation set are sent to the boundary propagation computing array module (20); and / or, The verification information generated by the verification judgment module (40) and the intermediate boundary information are sent to the receiving end. The verification information includes the conclusion that robustness is established, or the conclusion that adversarial sample exists, and the activation output interval output by the output layer when adversarial sample exists. The intermediate boundary information includes at least one of the pre-activation interval and the activation output interval output by the hidden layer.

25. The neural network robustness verification device according to claim 8, characterized in that, The verification and determination module (40) includes: The Ising solver unit is connected to the boundary propagation calculation array module (20), the neural network bounding module (30), and the storage module (10), respectively. The Ising solver unit is configured as follows: The activation output interval is received from the neural network bounding module (30). The activation output interval is obtained by the neural network bounding module (30) performing the following process: constructing an upper envelope segmented constant function and a lower envelope segmented constant function for the activation function to be processed. The upper envelope segmented constant function and the lower envelope segmented constant function are each composed of one or more segmented intervals, and each segmented interval includes a segmented constant; using a binary variable to represent the segmented interval where the upper and lower bounds of the pre-activation interval generated by the boundary propagation calculation array module (20) are located; and obtaining the activation output interval based on the binary variable, the segmented interval it is located in, and the segmented constant. Based on the received weights, biases, and pre-activation intervals, the neural network robustness verification problem under the input interval is constructed into a mixed-integer linear programming problem. Based on the one-hot vector of the activation output interval, the true class score, and the score of a candidate incorrect class, the objective function of the mixed-integer linear programming problem is set to minimize the difference between the true class score and the score of a candidate incorrect class. The mixed-integer linear programming problem is transformed into an Ising model. The Ising energy is minimized on the Ising model, and the optimal solution is output. The activation output interval is updated using the solution, and the updated activation output interval is used to determine whether the neural network is robust and whether there are adversarial examples.

Images