DL2: Training and Querying Neural Networks with Logic Ma Marc - - PowerPoint PPT Presentation

DL2: Training and Querying Neural Networks with Logic

Ma Marc Fischer er, Mislav Balunović, Dana Drachsler-Cohen, Timon Gehr, Ce Zhang, Martin Vechev

github.com/eth-sri/dl2

finding adversarial examples

[Szegedy et al., 2013]

finding adversarial examples using a generator [Song et al., 2018] differencing neural networks

[Pei et al., 2017]

finding inputs that deactivates neurons

dog

( , "cat")

?

NN dog GEN NN dog NN cat

?

NN dog

? ?

NN1 NN2

dog cat

find i[32, 32, 3] where i in [0, 1], class(NN1(i)) = dog, class(NN2(i)) = cat, i – image ! < 2

finding adversarial examples

[Szegedy et al., 2013]

finding adversarial examples using a generator [Song et al., 2018] differencing neural networks

[Pei et al., 2017]

finding inputs that deactivates neurons

find i[100] where i in [-1, 1], class(NN(GEN(i, cat))) = dog return GEN(i, cat) find i[224, 224, 3] where i in [0, 1], class(NN1(i)) = dog, i – image " < 25 find i[32, 32, 3] where i in [0, 1], NN(i).l3[17] = 0, class(NN(i)) = cat, i – image # < 100

find i[32, 32, 3] where i in [0, 1], class(NN1(i)) = dog, class(NN2(i)) = cat, i – image ! < 2

?

NN1 NN2

dog cat

differencing neural networks

find i[32, 32, 3] where i in [0, 1], class(NN1(i)) = dog, class(NN2(i)) = cat, i – image ! < 2

finding adversarial examples

[Szegedy et al., 2013]

finding adversarial examples using a generator [Song et al., 2018] differencing neural networks

[Pei et al., 2017]

finding inputs that deactivates neurons

find i[100] where i in [-1, 1], class(NN(GEN(i, cat))) = dog return GEN(i, cat) find i[224, 224, 3] where i in [0, 1], class(NN1(i)) = dog, i – image " < 25 find i[32, 32, 3] where i in [0, 1], NN(i).l3[17] = 0, class(NN(i)) = cat, i – image # < 100

find i[32, 32, 3] where i in [0, 1], class(NN1(i)) = dog, class(NN2(i)) = cat, i – image ! < 2, NN1(i).p[dog] > 0.8, NN1(i).p[cat] < 0.1

finding adversarial examples

[Szegedy et al., 2013]

finding adversarial examples using a generator [Song et al., 2018] differencing neural networks

[Pei et al., 2017]

finding inputs that deactivates neurons

find i[100] where i in [-1, 1], class(NN1(GEN(i, cat))) = dog, class(NN2(GEN(i, cat))) = car return GEN(i, cat) find i[224, 224, 3] where i in [0, 1], class(NN1(i)) = dog, i – image " < 25, i – image " > 5 find i[32, 32, 3] where i in [0, 1], NN(i).l3[17] = 0, class(NN(i)) = cat, i – image # < 100, i[:8, :8, :] = image[:8, :8, :]

find i[100] where i in [-1, 1], class(NN(GEN(i, cat))) = dog return GEN(i, cat)

query

L(ϕ) ≥ 0

differentiable loss minimize loss

DL2 Querying

Theorem:

logical formula ϕ

L(ϕ) = 0 if and only if ϕ is satisfied

ϕ := @

100

^

j=1

(−1 ≤ ij ∧ ij ≤ 1) 1 A ∧ ^

logitNN(GEN(i, cat))k < logitNN(GEN(i, cat))dog !

arg min

i∈[−1,1]100

X

max

• logitNN(GEN(i, cat))i−

logitNN(GEN(i, cat))dog, 0

• <latexit sha1_base64="CrZWmjgsGvR/zUZD9IXyGOaZzE=">ADH3icrVJLb9QwEHbCq4RHt3DkYrEC7aJ0lRQkOFY8BdKkdi20jpEjnc2tTZxUnuCuoryO7jSX8MNce2PQcLZLFBajoxk6/P3zYzH40nKTBoMglPHvXT5ytVra9e9Gzdv3V7vbdzZM0WlBYxFkRX6IOEGMqlgjBIzOCg18DzJYD+Zv2j1/U+gjSzUB1yUEOU8VXImBUdLxRuOx7hOc6nimiEcY7cj1rJpKJOKTjZDP4w+1mEQtIyp8rieL5XOX2TcGDAN41iUraLgiPmdNi3Spg3K+TFLZDp42NFZkUps4u6ws9MOvT61W94pgj/1z0cm+EwlnSTMe8/JPpToU8D2pY3jHv9YBQsjV4E4Qr0ycp2494PNi1ElYPCZRsmYVBiVHONUmTQeKwyUHIx5ylMLFQ8BxPVy09r6APLTOms0HYpEv2bETNc2MWeWI9c46H5rzWkv/SJhXOnkW1VGWFoER30azKBa0nQA6lRoEZgsLuNDS1krFIdcoJ0Tz2MvwT5Gw1ub+F0J2v6rflSvpqSxj0uZ3yLPs/0Kz3fnItjbGoWPR1vn/S3n686t0bukftkQELylGyTN2SXjIlwjpzPzhfnxD1xv7rf3O+dq+usYu6Sv8w9/Qkq7QRw</latexit>

Goal: holds for all inputs

ϕ

generalizes adversarial robustness training generalizes previous work for training with constraints applicable to supervised, semi-supervised and unsupervised training tr trai ain w with th vi viola

• lation
• n

qu query for vi viola

• lation
• n

z∗

z∗

arg min

θ

L(ϕ)(x, z∗, θ)

θ

= arg min

z∈A

L(¬ϕ)(x, z, θ)

DL2 Training

“A car should be considered more similar to a truck than a dog.”

∀z ∈ B✏(x) ∩ [0, 1]d.y = car = ⇒ logit✓(z)truck > logit✓(z)dog + δ

Supervised Training Example

Resnet-18 on CIFAR-10

standard training DL2 training

20 40 60 80 100

Constraint Accuracy

50.47 99.42 standard training DL2 training

20 40 60 80 100

Prediction Accuracy

91.89 88.99

“A car should be considered more similar to a truck than a dog.”

∀z ∈ B✏(x) ∩ [0, 1]d.y = car = ⇒ logit✓(z)truck > logit✓(z)dog + δ

Supervised Training Example

Resnet-18 on CIFAR-10

standard training DL2 training

20 40 60 80 100

Constraint Accuracy

50.47 99.42 standard training DL2 training

20 40 60 80 100

Prediction Accuracy

91.89 88.99

“A car should be considered more similar to a truck than a dog.”

∀z ∈ B✏(x) ∩ [0, 1]d.y = car = ⇒ logit✓(z)truck > logit✓(z)dog + δ

Supervised Training Example

Resnet-18 on CIFAR-10

standard training DL2 training

20 40 60 80 100

Constraint Accuracy

50.47 99.42 standard training DL2 training

20 40 60 80 100

Prediction Accuracy

91.89 88.99

github.com/eth-sri/dl2

DL2: Training and Querying Neural Networks with Logic

find i[32, 32, 3] where i in [0, 1], class(NN1(i)) = dog, class(NN2(i)) = cat, i – image ! < 2, NN1(i).p[7] > 0.8 NN1(i).p[1] < 0.1

Querying Training

generalizes adversarial robustness training generalizes previous work for training with constraints applicable to supervised, semi-supervised and unsupervised training