Verification of RNN-Based Neural Agent-Environment Systems
Total Page:16
File Type:pdf, Size:1020Kb
The Thirty-Third AAAI Conference on Artificial Intelligence (AAAI-19) Verification of RNN-Based Neural Agent-Environment Systems Michael E. Akintunde, Andreea Kevorchian, Alessio Lomuscio, Edoardo Pirovano Department of Computing, Imperial College London, UK Abstract and realised via a previously trained recurrent neural net- work (Hausknecht and Stone 2015). As we discuss below, We introduce agent-environment systems where the agent we are not aware of other methods in the literature address- is stateful and executing a ReLU recurrent neural network. ing the formal verification of systems based on recurrent We define and study their verification problem by providing networks. The present contribution focuses on reachability equivalences of recurrent and feed-forward neural networks on bounded execution traces. We give a sound and complete analysis, that is we intend to give formal guarantees as to procedure for their verification against properties specified whether a state, or a set of states are reached in the system. in a simplified version of LTL on bounded executions. We Typically this is an unwanted state, or a bug, that we intend present an implementation and discuss the experimental re- to ensure is not reached in any possible execution. Similarly, sults obtained. to provide safety guarantees, this analysis can be used to show the system does not enter an unsafe region of the state space. 1 Introduction The rest of the paper is organised as follows. After the A key obstacle in the deployment of autonomous systems is discussion of related work below, in Section 2, we introduce the inherent difficulty of their verification. This is because the basic concepts related to neural networks that are used the behaviour of autonomous systems is hard to predict; in throughout the paper. In Section 3 we define Recurrent Neu- turn this makes their certification a challenge. ral Agent-Environment Systems and define their verification decision problem. In Section 4 we show that for verification Progress has been made over the past few years in the purposes recurrent networks can be simulated by simpler area of verification of multi-agent systems where a num- feed-forward networks as long as the analysis is on bounded ber of methods based on model checking and theorem prov- executions. We exploit this in Section 5 where we provide a ing have been put forward (Alechina et al. 2010; Lomuscio, complete (up to bounded executions) procedure for the ver- Qu, and Raimondi 2017; Kouvaros, Lomuscio, and Pirovano ification of recurrent neural agent-environment systems. We 2018). Some of this work has been combined with safety give details of an implementation of the approach in Sec- analysis and abstraction thereby resulting in the assessment tion 6, where we benchmark the procedures previously in- of designs such as autonomous underwater vehicles (Ezekiel troduced. et al. 2011). A key assumption made in the literature on autonomous systems is that their designs have been traditionally imple- Related Work. As mentioned above, there is a large litera- mented by engineers. But parts of AI systems are increas- ture on verification of agent-based systems. With the excep- ingly realised by machine learning, thereby making present tions mentioned below, differently from this paper, this body verification approaches not applicable. For example, vision of work deals with agents that are designed by using declar- systems currently being tested in autonomous vehicles make ative or procedural programming languages. Therefore their use of special classes of feed-forward neural networks to aims and techniques are different from ours. classify the environment at runtime (Redmon et al. 2016). It There has been recent work on the formal verification of follows that, to be able to verify and certify forthcoming au- feed-forward networks. This was first explored in (Pulina tonomous systems, methods for the verification of systems and Tacchella 2010), which addressed sigmoid activation based on neural networks are urgently required. functions, and could be scaled up to approximately 20 neu- In this paper we develop a novel method for the veri- rons. More recently, (Katz et al. 2017; Lomuscio and Mag- fication of closed-loop systems of one agent, based on a anti 2017; Ehlers 2017; Bunel et al. 2017; Gehr et al. 2018; neural network, interacting with an environment. Specifi- Ruan, Huang, and Kwiatkowska 2018) considered ReLU ac- cally, we study systems in which the agent is memoryful tivation functions, as we do here, but differently from the present contribution, all previous analyses are limited to Copyright c 2019, Association for the Advancement of Artificial feed-forward networks and purely reachability conditions. Intelligence (www.aaai.org). All rights reserved. Instead, our contribution focuses on systems based on re- 6006 current neural networks specified in a restricted version of Neural networks are generally used to learn highly non- LTL. Further recent work on verification of neural networks linear, non-programmatic functions; upon training, the net- focuses on adversarial examples, e.g., (Huang et al. 2017), work computes an approximation of such a function by and has different aims from those here pursued. means of the weights and biases learned. Much closer to the work here presented is (Akintunde et Definition 2 (Function computed by FFNN). Let N be a al. 2018), where a verification method for reachability in (i) closed-loop systems controlled by a ReLU feed-forward net- FFNN. For each layer L of N, let c and d denote respec- work is presented. In contrast with this work, we here focus tively the number of inputs and output nodes of layer i. We (i) (i) c on recurrent neural networks, which require a different theo- define the computed function for L , denoted f : R ! d (i) (i) (i) (i) retical treatment. We take up the model introduced there of a R , by f (x) = σ (W x+b ). Further, for an m-layer neural agent-environment system, and modify it by introduc- FFNN N with p input nodes and q output nodes, the com- p q ing agents based on recurrent networks. The implementation puted function for N as a whole, f : R ! R , is defined as here presented uses the module released in (Akintunde et al. f(x) = f (m)(f (m−1)(::: (f (2)(x)))). 2018) for the verification of feed-forward networks, but ex- tends it by supporting agents defined on recurrent networks as well. Recurrent neural networks. Recurrent neural networks (RNNs) are known to be difficult to train and whose be- 2 Preliminaries haviour is difficult to predict. Differently from FFNNs, whose output is always the same given a certain single in- In this section we introduce our notation for neural networks put, RNNs were designed to process sequences of data, and that will be used throughout the rest of the paper. We as- are equipped with a state that evolves over time. As a result, sume the basic definition of a neural network and related the behaviour of an RNN depends on the history of their in- notions (Haykin 1999). puts. We formalise this below. Feed-forward neural networks. Feed-forward neural Definition 3. A single-layer recurrent neural network networks are a simple class of neural networks consisting of (RNN) R with h hidden units and input size i and output size multiple hidden layers and admitting no cycles. The presen- o is a neural network associated with the weight matrices i×h h×h h×o tation here loosely follows that in (Akintunde et al. 2018). Wi!h 2 R , Wh!h 2 R and Wh!o 2 R , and the two activation functions σ : Rh ! Rh and σ0 : Ro ! Ro. Definition 1. An n-layer feed-forward multilayer neural network (FFNN) N is a neural network resulting from the The weight matrix Wi!h defines the weights of the con- (i) composition of n layers, each denoted by L , for 1 ≤ i ≤ nections between input units and hidden units, Wh!h de- n. Each layer L(i) is defined by a weight matrix W (i), a fines the weights of the connections between hidden units, bias vector b(i), and an activation function σ(i). We refer to and Wh!o defines the weights of the connections between L(1) as the input layer of the network, and L(n) as the out- hidden units and output units. We refer to the value of the put layer. Any additional layers which lie between these two hidden units as the state of the network, due to the self-loop layers are referred to as hidden layers. introduced by Wh!h. The activation function σ is applied to the state before it is passed onto the next time step, and σ0 is Each layer of the network is composed of nodes, in which applied to the state of the network at a given time step, in or- computations combine the output of nodes in the previous der to compute the output of the network at that time step. In layer to produce an output. This output is then used in the what follows, we only consider ReLU activation functions computations of nodes in successive layers. for σ and σ0. We only consider fully-connected neural networks where all the nodes in each layer have a connection to every node Definition 4 (Function computed by RNN). Let N be an in the adjacent layers (with the exception of the input and RNN with weight matrices Wi!h, Wh!h and Wh!o. Let output layers L(1) and L(n), which intuitively are only con- x¯ 2 (Rk)n denote an input sequence of length n where each nected to layers L(2) and L(n−1) respectively).