CNN Perception Verification for Input Transformation Robustness
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques lack formal guarantees for the robustness of convolutional neural networks (CNNs) to transformations of their input, which is a critical concern for safety-critical applications like autonomous systems, as they are sensitive to variations in input and can lead to unreliable decision-making.
Innovation Solution
A method is provided to encode each layer of the CNN as algebraic classifier constraints, transformations as algebraic transformation constraints, and output changes as algebraic output constraints, determining if a solution exists that would cause a change in classifier output, using mixed-integer linear programming (MILP) to assess robustness and identify potential transformations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If convolutional neural networks are deployed in safety-critical areas, then autonomous systems can make decisions based on learned patterns, but the networks become vulnerable to input transformations and variations that compromise reliability
Solution Approach 1:
The method performs preliminary verification before deployment by systematically checking for vulnerable transformations. It encodes the neural network layers, transformations, and output constraints into algebraic constraints, then uses a solver to determine if any transformation exists that would cause misclassification. This advance detection prevents unreliable decisions in safety-critical operations.
Solution Approach 2:
The verification process provides feedback about the network's vulnerability to specific transformations. When the solver finds a transformation that causes misclassification, the system identifies the parameters of this transformation and can use it to augment the training data, creating a feedback loop that improves robustness through targeted retraining.
2Reliability
If formal verification methods are applied to ensure robustness, then reliability guarantees can be provided, but the complexity of analyzing and encoding constraints increases
Solution Approach 1:
The verification method segments the neural network into individual layers, encoding each layer's constraints separately. It also divides the transformation analysis into distinct components (geometric transformations, photometric transformations, etc.). This segmentation makes the complex verification process more manageable and systematic, allowing each component to be verified independently.
Solution Approach 2:
The patent replaces complex numerical analysis with algebraic constraint encoding. Instead of relying on heuristic methods or extensive computational sampling, the system encodes the neural network and transformations as algebraic constraints and uses a constraint solver to formally verify robustness. This substitution provides exact mathematical guarantees rather than approximate results.
3Reliability
If counterexamples are generated to improve robustness, then the classifier can be retrained with augmented data, but additional computational resources and time are required for retraining
Solution Approach 1:
The method converts harmful vulnerability information into beneficial training data. When the verification process identifies a transformation that causes misclassification, this counterexample is extracted and used to augment the training data. The neural network is then retrained on this enhanced dataset, transforming the previously harmful vulnerability into a learning opportunity that improves overall robustness.
Solution Approach 2:
The approach changes the training parameters by incorporating verification-generated counterexamples into the training dataset. Instead of training only on original data, the system augments the training set with transformed examples that represent edge cases and vulnerabilities identified during verification. This parameter change in the training process leads to a more robust final model.
Data Source
AI summary
There is provided a computer-implemented method for verifying the robustness of a neural network classifier with respect to one or more parameterised transformations applied to an input, the classifier comprising one or more convolutional layers, the method comprising: encoding each layer of the classifier as one or more algebraic classifier constraints; encoding each transformation as one or more algebraic transformation constraints; encoding a change in an output classifier label from the classifier as an algebraic output constraint; determining whether a solution exists which satisfies the classifier constraints, transformation constraints and output constraints, and determining the classifier as robust to the local transformations if no such solution exists. A perception system and a computer readable medium are also provided.