DL2: Training and Querying Neural Networks with Logic Ma Marc Fischer er , Mislav Balunovi ć , Dana Drachsler-Cohen, Timon Gehr, Ce Zhang, Martin Vechev github.com/eth-sri/dl2
differencing neural networks finding inputs that deactivates [Pei et al., 2017] neurons NN 1 dog 0 ? ? NN cat NN dog NN 2 cat finding adversarial examples finding adversarial examples [Szegedy et al., 2013] using a generator [Song et al., 2018] ? ? dog NN dog NN dog GEN ( , "cat")
differencing neural networks finding inputs that deactivates [Pei et al., 2017] neurons find i[32, 32, 3] find i[32, 32, 3] where i in [0, 1], where i in [0, 1], class (NN1(i)) = dog, NN(i).l3[17] = 0, class (NN2(i)) = cat, class (NN(i)) = cat, i – image ! < 2 i – image # < 100 finding adversarial examples finding adversarial examples [Szegedy et al., 2013] using a generator [Song et al., 2018] find i[224, 224, 3] find i[100] where i in [0, 1], where i in [-1, 1], class (NN1(i)) = dog, class (NN(GEN(i, cat))) = dog i – image " < 25 return GEN(i, cat)
differencing neural networks NN 1 dog ? find i[32, 32, 3] where i in [0, 1], class (NN1(i)) = dog, NN 2 cat class (NN2(i)) = cat, i – image ! < 2
differencing neural networks finding inputs that deactivates [Pei et al., 2017] neurons find i[32, 32, 3] find i[32, 32, 3] where i in [0, 1], where i in [0, 1], class (NN1(i)) = dog, NN(i).l3[17] = 0, class (NN2(i)) = cat, class (NN(i)) = cat, i – image ! < 2 i – image # < 100 finding adversarial examples finding adversarial examples [Szegedy et al., 2013] using a generator [Song et al., 2018] find i[224, 224, 3] find i[100] where i in [0, 1], where i in [-1, 1], class (NN1(i)) = dog, class (NN(GEN(i, cat))) = dog i – image " < 25 return GEN(i, cat)
differencing neural networks finding inputs that deactivates [Pei et al., 2017] neurons find i[32, 32, 3] find i[32, 32, 3] where i in [0, 1], where i in [0, 1], class (NN1(i)) = dog, NN(i).l3[17] = 0, class (NN2(i)) = cat, class (NN(i)) = cat, i – image ! < 2, i – image # < 100, NN1(i).p[dog] > 0.8, i[:8, :8, :] = image[:8, :8, :] NN1(i).p[cat] < 0.1 finding adversarial examples finding adversarial examples [Szegedy et al., 2013] using a generator [Song et al., 2018] find i[224, 224, 3] find i[100] where i in [0, 1], where i in [-1, 1], class (NN1(i)) = dog, class (NN1(GEN(i, cat))) = dog, i – image " < 25, class (NN2(GEN(i, cat))) = car i – image " > 5 return GEN(i, cat)
<latexit sha1_base64="CrZWmjgsGvR/zUZD9IXyGOaZzE=">ADH3icrVJLb9QwEHbCq4RHt3DkYrEC7aJ0lRQkOFY8BdKkdi20jpEjnc2tTZxUnuCuoryO7jSX8MNce2PQcLZLFBajoxk6/P3zYzH40nKTBoMglPHvXT5ytVra9e9Gzdv3V7vbdzZM0WlBYxFkRX6IOEGMqlgjBIzOCg18DzJYD+Zv2j1/U+gjSzUB1yUEOU8VXImBUdLxRuOx7hOc6nimiEcY7cj1rJpKJOKTjZDP4w+1mEQtIyp8rieL5XOX2TcGDAN41iUraLgiPmdNi3Spg3K+TFLZDp42NFZkUps4u6ws9MOvT61W94pgj/1z0cm+EwlnSTMe8/JPpToU8D2pY3jHv9YBQsjV4E4Qr0ycp2494PNi1ElYPCZRsmYVBiVHONUmTQeKwyUHIx5ylMLFQ8BxPVy09r6APLTOms0HYpEv2bETNc2MWeWI9c46H5rzWkv/SJhXOnkW1VGWFoER30azKBa0nQA6lRoEZgsLuNDS1krFIdcoJ0Tz2MvwT5Gw1ub+F0J2v6rflSvpqSxj0uZ3yLPs/0Kz3fnItjbGoWPR1vn/S3n686t0bukftkQELylGyTN2SXjIlwjpzPzhfnxD1xv7rf3O+dq+usYu6Sv8w9/Qkq7QRw</latexit> <latexit sha1_base64="CcFtO9a/hN1DG9LDZQUwxMEn/w=">ACVXicbZDfSxtBEMf3rtYf5+/6MvRUBAp4c4W9DGoD75ILTRGyAaZ28wlS3b3jt29kHjcH+Gr/mHiHyN0L0lL1Q4sfPczM8zMN8kFNzaKnj3/w9LH5ZXVtWB9Y3Nre2f307XJCs2wzTKR6ZsEDAqusG25FXiTawSZCOwko7M63xmjNjxTv+w0x56EgeIpZ2Ad6tAx6HzIb3caUTOaRfhexAvRIu4ut31Tmg/Y4VEZkAY7pxlNteCdpyJrAKaGEwBzaCAXadVCDR9MrZvlX4xZF+mGbaPWXDGf23owRpzFQmrlKCHZq3uRr+L9ctbHrSK7nKC4uKzQelhQhtFtbHh32ukVkxdQKY5m7XkA1BA7POouDVmET+nRDQc3RHarx03x85arCZPiwp6IHkqnJHD+jXWgW0jykdT8qSJrKcVNUfcjcndzVxXsdvnX0vro+a8bfm0c/vjdbpwvVsk8+kwMSk2PSIhfkirQJIyNyTx7Io/fkvfhL/vK81PcWPXvkVfjbvwEqV7WS</latexit> <latexit sha1_base64="k3vypAInlAp+A2CQfh8fN5UKLU8=">ADVHicrVLfb9MwEHZSBqPA1sEjLxYVSuNKhlIMSkaQjB0zQkuk2qS+Q419Rtfs2+DKrIfyQ8IPGX8MIDaZKhsEbJ9n+/H135/Pp/CySGh3nu2W3bmzcvLV5u3n7r2t7c7O/ROd5krASKRqs58riGSCYxQYgRnmQIe+xGc+ovXK/30ApSWafIBlxlMYh4mcioFx5Lydqw5u+Aqm0n6cp/2WART7DNfhp8gCMEr5vu+Vi4jmNorT1xV4AyhM9YVDtiIY3x5iXPk+AfCtAyTslwhoPLk7GxC/GkXYf12KEMw/WnF5TJpEknIq41aM4ptlKSeCc7dZakIbGmMYxSkOJxqsvR0emX6O3b37Dtcp2L7NzNIOBt2Cs3WPnOQ9e/YdsxVp1tPrcwOt0naFTGb0O3AZ0SWPHXucrC1KRx5Bg1YGx62Q4KbhCKSIwbZryLhY8BDGJUx4DHpSVENh6OSCeg0VeVKkFbsekTBY62XsV96xhxn+q2Iv+mjXOcvpgUMslyhETUD03ziGJKVxNGA6lAYLQsARdKlrVSMeOKCyznsF02wb365evgZG/oPh3uvX/WPThs2rFJHpJHpE9c8pwckHfkmIyIsL5YP2xiW/Y3+2er1dqoXW2riXlA/rDW1i9onBVM</latexit> <latexit sha1_base64="zA+cIdtIy9XuJviHAhDzjklmzbM=">AEx3icbVPbtNAEN2AUq4tfDYlxVpbayqSA4MVSBTwAlEkepHqFqvx84qezG74zSp5Yf+A/AK3wOf8M6SZtLGcnS+MyZndkzO3EuhcNW6+/S8krjzt17q/ebDx4+evxkbf3psTOF5XDEjT2NGYOpNBwhAIlnOYWmIolnMS9d3X8pA/WCaO/4zCHjmKZFqngD10vrYRKYZdzmT5udqO+szmXbFDowx+0Nb52mZrzUyetpT5xNMrHD8/WVn1FieKFAI5fMubN2K8dOySwKLqFqRoWDnPEey+DMu5opcJ1ydIuKbnkoamx/tNIR+hsRsmUc0MVe2bds1uM1eD/YmcFpm86pdB5gaD5uFBaSIqG1pLQRFjgKIfeYdwK3yvlXWYZRy9c65MbEwPWewCqgqJwpqLaoGgblqYw+tRCp05r4F06ADLJp2YZDorPCf8xPosuIF1oWJfP9RGwxT1sxbc4VBCWEaIKVNCDqtpfGuSNmJEIw3LzLJZSg+GF8Ymc5RY+j6rKDUGtUFw4hJuTo/idJpcXw0cZzmEaIuZxrhR9djnTk2Y7WUWQM9UV8bCdQehH0pqAgp9JgOaCp0E9KILFgIqtMCAjh5RQC1gYXVQvw0mPRMGXk1XkzwloGhZ7bmCd/1Pl+FMuQk4EzBunqlsiQh69ynMKp9S9zQflUeFXH/JAVaKaRsR5CO5H4qWzvVuXuzkwNH6x3LTcujINm/V7eg7+YhS9ey685WIbG7pYRs5kSuvLbkVB7TWjBNKoPyjLKFbloKqukcsxcjlF+BjhUwTHCHrE73F7cWtvO8f7e+0Xe/vfXm4evJ1s9CrZIM/JNmT1+SAfCH5IhwckV+kd/kT+NjwzT6jcGYurw0yXlG5qx9Q+6LoTt</latexit> <latexit sha1_base64="gNhNyj9ap7SOIqpxjaxlcWGtl2Y=">AGlnicdZTdbts2FMfVrvU67ytdbwbshltaIA3UQHbTOrtw0TarVwtlgFNWyAKAo6kglTpEAeOXYEvVGfZnfD9jAjLcW24oaAgeP/+ZHng0eMcsENBsE/N25+cet258s7X3W/ub7fuvDe6MKzeCYKaH0x4gaEFzCMXIU8DHXQLNIwIdocuj8H6agDVfyHc5zOM1oKnCGUrnW2NwozimFRvql2winV+Zg/JEMSkBhiXhCaEyJkqKubPvN8x9wg0x9hCTcIirs63tYC9YLJp9Bpj2vW0dnd2wdhrFiRgUQmqDEnvSDH05Jq5ExA1Q0LAzlE5rCiTUlzcCclouCW85yVmvkgdVikihtfxLJQm2BNDNmnkWdCWbqz4nfs53UmBycFpymRcIktWBkIQVMR1lMRcA0PbnphTprnNn7Ax1ZSh7Xu3FSZSaoI0Mj7JCoFcq/PqCpAtU2jpbhK4TI0tXRg0gGWXNEtQmRaWGf5Bp9RfyrLIht/KJWElWpHhTODcwHDMkRMaMbFvFr5HzTbFkS46GZarqOTGB+rnTcQiJh86zCRCmUCsHwC1ieHkbJarMrDQyjOQxRF2uJMZW5UWidGlM9STWAXIueKQ2XGQztpSTKJzClwicJl7FPzsegwSdcvTJYrB8ogELX03G1RYEma2m8ZBFvEJauosU7Cx/TOmuBYuBgG4FtAlXW0GfLhkxXcqLtF7pfMJtV2t+SAtUK0/dDy4Nj+2t7OxW5e7DtRjW6T7VXJlh5HfdvPwGtjANb20v/8xBU1R6twypTjMuK/sFpaHvrG4YQxJOZ2UZRlk5q6pL5aJWLlYKqxW2UrBW0CndhWYfmPpasvkjO/7iUSRsL8rX796+qcreaDB4uV9HrRtl+kSHY0Go+DVNWh93Q3ZP3wR9A+vIbV9dRouftof9A+u4fJC52IZ/Nf9p4Modk1cUPZyHVhXsl7Xz4+Dqs1cFtEuapNrKmgVtEktsl8rZO4zLtdh+PsW9u7+rJuGu/7e73He/2/9refv2xe3TveT94v3o7X8wbec+1d+Qde8z75P3t/ev91/mx86zqvN7jd680ey57VW5+h/g10wfQ=</latexit> DL2 Querying query logical formula ϕ differentiable loss minimize loss L ( ϕ ) ≥ 0 0 1 100 ^ ϕ := ( − 1 ≤ i j ∧ i j ≤ 1) @ A find i[100] j =1 X arg min max � logit NN (GEN( i , cat)) i − where i in [-1, 1], i ∈ [ − 1 , 1] 100 k 2 classes class (NN(GEN(i, cat))) = dog ^ k 6 = dog logit NN (GEN( i , cat)) k ∧ logit NN (GEN( i , cat)) dog , 0 � return GEN(i, cat) k 2 classes k 6 = dog ! < logit NN (GEN( i , cat)) dog L ( ϕ ) = 0 if and only if ϕ is satisfied Theorem:
Recommend
More recommend
