Global optimization of objective functions represented by ReLU networks

Neural networks can learn complex, non-convex functions, and it is challenging to guarantee their correct behavior in safety-critical contexts. Many approaches exist find failures (e.g., adversarial examples), but these cannot the absence of failures. Verification algorithms address this need provide formal guarantees about a neural network by answering “yes or no” questions. For example, they answer whether violation exists within certain bounds. However, individual no" questions qualitative such as “what largest error bounds”; answers lie domain optimization. Therefore, we propose strategies extend existing verifiers perform optimization find: (i) most extreme failure given input region (ii) minimum perturbation required cause failure. A naive approach using bisection search with an off-the-shelf verifier results many expensive overlapping calls verifier. Instead, that tightly integrates process into verification procedure, achieving better runtime performance than approach. We evaluate our implemented extension Marabou, state-of-the-art verifier, compare its MIPVerify, optimization-based observe complementary between Marabou MIPVerify.