Evaluating Robustness of Neural Networks with Mixed Integer Programming
Neural networks trained only to optimize for training accuracy can often be fooled by adversarial examples --- slightly perturbed inputs misclassified with high confidence. Verification of networks enables us to gauge their vulnerability to such adversarial examples. We formulate verification of piecewise-linear neural networks as a mixed integer program. On a representative task of finding minimum adversarial distortions, our verifier is two to three orders of magnitude quicker than the state-of-the-art. We achieve this computational speedup via tight formulations for non-linearities, as well as a novel presolve algorithm that makes full use of all information available. The computational speedup allows us to verify properties on convolutional and residual networks with over 100,000 ReLUs --- several orders of magnitude more than networks previously verified by any complete verifier. In particular, we determine for the first time the exact adversarial accuracy of an MNIST classifier to perturbations with bounded l-∞ norm ε=0.1: for this classifier, we find an adversarial example for 4.38% of samples, and a certificate of robustness to norm-bounded perturbations for the remainder. Across all robust training procedures and network architectures considered, and for both the MNIST and CIFAR-10 datasets, we are able to certify more samples than the state-of-the-art and find more adversarial examples than a strong first-order attack.
 This paper studies a Mixed Integer Linear Programming (MILP) approach to verifying the robustness of neural networks with ReLU activations. The main contribution of the paper is a progressive bound tightening approach that results in significantly faster MILP solving. This in turn allows for verifying the robustness of larger networks than previously studied, and even larger datasets such as CIFAR-10. This paper is a solid contribution and should be accepted to ICLR. It is quite well-written, addresses an important problem using a principled method, and achieves strong experimental results that were previously elusive, despite the large body of work in adversarial learning. In particular, the paper has the following strengths: - Clarity: the paper is well-written and easy to read. Tables, figures and pseudocode are nice and easy to understand. - Methodology: the authors take care of a number of bottlenecks in the scalability of MIP solvers for the verification problem. This is the standard approach in the Operations Research (OR) community, and I am really glad to see it in an ICLR submission! - Results: the efficiency of the MIP on the tightened model, and the improvements in the bounds on the adversarial error as compared to very recent methods from the literature are both very strong points in favor of the paper. I do not have any further questions for the authors - good job!
You are a member of the scientific community tasked with peer review. Review the following paper title and abstract.
### Title + Abstract
Evaluating Robustness of Neural Networks with Mixed Integer Programming
Neural networks trained only to optimize for training accuracy can often be fooled by adversarial examples --- slightly perturbed inputs misclassified with high confidence. Verification of networks enables us to gauge their vulnerability to such adversarial examples. We formulate verification of piecewise-linear neural networks as a mixed integer program. On a representative task of finding minimum adversarial distortions, our verifier is two to three orders of magnitude quicker than the state-of-the-art. We achieve this computational speedup via tight formulations for non-linearities, as well as a novel presolve algorithm that makes full use of all information available. The computational speedup allows us to verify properties on convolutional and residual networks with over 100,000 ReLUs --- several orders of magnitude more than networks previously verified by any complete verifier. In particular, we determine for the first time the exact adversarial accuracy of an MNIST classifier to perturbations with bounded l-∞ norm ε=0.1: for this classifier, we find an adversarial example for 4.38% of samples, and a certificate of robustness to norm-bounded perturbations for the remainder. Across all robust training procedures and network architectures considered, and for both the MNIST and CIFAR-10 datasets, we are able to certify more samples than the state-of-the-art and find more adversarial examples than a strong first-order attack.
user
<think>Okay, to do a decent peer review, I should start with summarizing what the work is about. This includes novelty, contributions, clarity, and impact. I might include suggestions to issues that I find critical to the usefulness of the work. Starting with novelty, there are different types of novelty. The first aspect of novelty is scope and scale. Is the work covering a broader perspective than previous works? The second aspect is methodology. Is the proposed methodology novel compared to previous methods? Do they provide any significant advantage over previous methodologies? The third aspect is results. Are the results different compared previous work? Does this lead to any novel theories or an extension of current theories? Next is clarity, I will be reading the work in depth and analyze if any sentences can be potentially ambiguous or misleading. If any sentences are ambiguous, I will state them and give a suggestion on how to rephrase such sentence or how to make more clear to the audience. Lastly, impact is important. I will attempt to predict how such work will impact the scientific community. This might include the applications of such work and how the work might transform the way we study a certain topic. Finally, I will might only mention issues that are critical. This is to keep the review as concise and helpful as possible.</think>



 This paper studies a Mixed Integer Linear Programming (MILP) approach to verifying the robustness of neural networks with ReLU activations. The main contribution of the paper is a progressive bound tightening approach that results in significantly faster MILP solving. This in turn allows for verifying the robustness of larger networks than previously studied, and even larger datasets such as CIFAR-10. This paper is a solid contribution and should be accepted to ICLR. It is quite well-written, addresses an important problem using a principled method, and achieves strong experimental results that were previously elusive, despite the large body of work in adversarial learning. In particular, the paper has the following strengths: - Clarity: the paper is well-written and easy to read. Tables, figures and pseudocode are nice and easy to understand. - Methodology: the authors take care of a number of bottlenecks in the scalability of MIP solvers for the verification problem. This is the standard approach in the Operations Research (OR) community, and I am really glad to see it in an ICLR submission! - Results: the efficiency of the MIP on the tightened model, and the improvements in the bounds on the adversarial error as compared to very recent methods from the literature are both very strong points in favor of the paper. I do not have any further questions for the authors - good job!
assistant
 This paper studies a Mixed Integer Linear Programming (MILP) approach to verifying the robustness of neural networks with ReLU activations. The main contribution of the paper is a progressive bound tightening approach that results in significantly faster MILP solving. This in turn allows for verifying the robustness of larger networks than previously studied, and even larger datasets such as CIFAR-10. This paper is a solid contribution and should be accepted to ICLR. It is quite well-written, addresses an important problem using a principled method, and achieves strong experimental results that were previously elusive, despite the large body of work in adversarial learning. In particular, the paper has the following strengths: - Clarity: the paper is well-written and easy to read. Tables, figures and pseudocode are nice and easy to understand. - Methodology: the authors take care of a number of bottlenecks in the scalability of MIP solvers for the verification problem. This is the standard approach in the Operations Research (OR) community, and I am really glad to see it in an ICLR submission! - Results: the efficiency of the MIP on the tightened model, and the improvements in the bounds on the adversarial error as compared to very recent methods from the literature are both very strong points in favor of the paper. I do not have any further questions for the authors - good job!