SpecAttack: Specification-Based Adversarial Training for Deep Neural Networks

Safety specification-based adversarial training aims to generate examples violating a formal safety specification and therefore provides approaches for repair. The need for maintaining high prediction accuracy while ensuring the save behavior remains challenging. Thus we present SpecAttack, a queryefficient counter-example generation and repair method for deep neural networks. Using SpecAttack allows specifying safety constraints on the model to find inputs that violate these constraints. These violations are then used to repair the neural network via re-training such that it becomes provably safe. We evaluate SpecAttack’s performance on the task of counter-example generation and repair. Our experimental evaluation demonstrates that SpecAttack is in most cases more query-efficient than comparable attacks, yields counterexamples of higher quality, with its repair technique being more efficient, maintaining higher functional correctness, and provably guaranteeing safety specification compliance. Introduction Deep neural networks (DNNs) are increasingly applied in safety-critical domains, such as self-driving cars, unmanned aircraft, medical diagnosis, and face recognition based security protocols. Due to this widespread adoption, it is even more important to ensure that these neural networks behave as expected–that is, with respect to a formal safety specification. Unfortunately, it has been shown that neural networks are vulnerable to–sometimes intentionally crafted– adversarial examples. These inputs, also called counterexamples, cause the neural network to show unsafe behavior. Finding inputs leading to such an error is thus necessary to identify the limitations of current machine learning models and suggest ways to provably repair these models. In this paper, we focus on the efficient generation of highquality counter-examples, as well as leveraging them to perform a repair that produces provably safe neural networks. This approach is related to adversarial training as performed by (Goodfellow, Shlens, and Szegedy 2015; Madry et al. 2018), but considers formal safety specifications instead of a defence against robustness attacks. Therefore, we discuss three threads of work towards counter-example generation and repair of DNNs in the context of formal safety specifications: Verification. The formal method community has come up with techniques that verify a neural network’s safety in a 0 1 2 3 4 5 ·10 −50 0 50 100 150