Concerned with the reliability of neural networks, researchers have developed verification techniques to prove their robustness. Most verifiers work with real-valued networks. Unfortunately, the exact (complete and sound) verifiers face scalability challenges and provide no correctness guarantees due to floating point errors. We argue that Binarized Neural Networks (BNNs) provide comparable robustness and allow exact and significantly more efficient verification. We present a new system, EEV, for efficient and exact verification of BNNs. EEV consists of two parts: (i) a novel SAT solver that speeds up BNN verification by natively handling the reified cardinality constraints arising in BNN encodings; and (ii) strategies to train solver-friendly robust BNNs by inducing balanced layer-wise sparsity and low cardinality bounds, and adaptively cancelling the gradients. We demonstrate the effectiveness of EEV by presenting the first exact verification results for L-inf-bounded adversarial robustness of nontrivial convolutional BNNs on the MNIST and CIFAR10 datasets. Compared to exact verification of real-valued networks of the same architectures on the same tasks, EEV verifies BNNs hundreds to thousands of times faster, while delivering comparable verifiable accuracy in most cases.

中文翻译：

---

二值化神经网络的高效精确验证

考虑到神经网络的可靠性，研究人员开发了验证技术来证明其鲁棒性。大多数验证者使用实值网络。不幸的是，精确（完整且健全的）验证器面临可扩展性挑战，并且由于浮点错误而无法提供正确性保证。我们认为二值化神经网络 (BNN) 提供了相当的鲁棒性，并允许进行精确且显着更有效的验证。我们提出了一个新系统 EEV，用于高效准确地验证 BNN。EEV 由两部分组成：(i) 一种新颖的 SAT 求解器，它通过本地处理 BNN 编码中出现的具体化基数约束来加速 BNN 验证；(ii) 通过引入平衡的逐层稀疏性和低基数界限来训练对求解器友好的鲁棒 BNN 的策略，并自适应地取消梯度。我们通过在 MNIST 和 CIFAR10 数据集上展示非平凡卷积 BNN 的 L-inf 有界对抗性鲁棒性的第一个精确验证结果来证明 EEV 的有效性。与在相同任务上对相同架构的实值网络进行精确验证相比，EEV 验证 BNN 的速度要快数百到数千倍，同时在大多数情况下提供可比的可验证准确性。