def test_calc_avgpool(self): image_data = self._image_data() net = self._network('avgpool') input_bounds = naive_bounds.input_bounds(image_data.image, delta=.1) dual_obj, dual_var_lists = self._build_objective( net, input_bounds, image_data.label) # Explicitly build the expected TensorFlow graph for calculating objective. ( conv2d_0, relu_1, # pylint:disable=unused-variable avgpool_2, relu_3, # pylint:disable=unused-variable linear_obj) = self._verifiable_layer_builder(net).build_layers() (mu_0, ), (lam_1, ), (mu_2, ), _ = dual_var_lists # Expected input bounds for each layer. conv2d_0_lb, conv2d_0_ub = self._expected_input_bounds( image_data.image, .1) relu_1_lb, relu_1_ub = ibp.IntervalBounds( conv2d_0_lb, conv2d_0_ub).apply_conv2d(None, conv2d_0.module.w, conv2d_0.module.b, 'SAME', (1, 1)) avgpool_2_lb = tf.nn.relu(relu_1_lb) avgpool_2_ub = tf.nn.relu(relu_1_ub) relu_3_lb = tf.nn.avg_pool(avgpool_2_lb, ksize=[2, 2], padding='VALID', strides=(1, 1)) relu_3_ub = tf.nn.avg_pool(avgpool_2_ub, ksize=[2, 2], padding='VALID', strides=(1, 1)) # Expected objective value. objective = 0 act_coeffs_0 = -common.conv_transpose( mu_0, conv2d_0.module.w, conv2d_0.input_shape, 'SAME', (1, 1)) obj_0 = -tf.reduce_sum(mu_0 * conv2d_0.module.b, axis=(2, 3, 4)) objective += standard_layer_calcs.linear_dual_objective( None, act_coeffs_0, obj_0, conv2d_0_lb, conv2d_0_ub) objective += standard_layer_calcs.activation_layer_dual_objective( tf.nn.relu, mu_0, lam_1, relu_1_lb, relu_1_ub) act_coeffs_2 = -common.avgpool_transpose( mu_2, result_shape=relu_1.output_shape, kernel_shape=(2, 2), strides=(1, 1)) objective += standard_layer_calcs.linear_dual_objective( lam_1, act_coeffs_2, 0., avgpool_2_lb, avgpool_2_ub) objective_w, objective_b = common.targeted_objective( linear_obj.module.w, linear_obj.module.b, image_data.label) shaped_objective_w = tf.reshape( objective_w, [self._num_classes(), self._batch_size()] + avgpool_2.output_shape) objective += standard_layer_calcs.activation_layer_dual_objective( tf.nn.relu, mu_2, -shaped_objective_w, relu_3_lb, relu_3_ub) objective += objective_b self._assert_dual_objective_close(objective, dual_obj, image_data)
def test_calc_conv_batchnorm(self): image_data = self._image_data() net = self._network('conv_batchnorm') input_bounds = naive_bounds.input_bounds(image_data.image, delta=.1) dual_obj, dual_var_lists = self._build_objective( net, input_bounds, image_data.label) # Explicitly build the expected TensorFlow graph for calculating objective. ( conv2d_0, relu_1, # pylint:disable=unused-variable linear_2, relu_3, # pylint:disable=unused-variable linear_obj) = self._verifiable_layer_builder(net).build_layers() (mu_0, ), (lam_1, ), (mu_2, ), _ = dual_var_lists # Expected input bounds for each layer. conv2d_0_lb, conv2d_0_ub = self._expected_input_bounds( image_data.image, .1) conv2d_0_w, conv2d_0_b = layer_utils.combine_with_batchnorm( conv2d_0.module.w, None, conv2d_0.batch_norm) relu_1_lb, relu_1_ub = ibp.IntervalBounds( conv2d_0_lb, conv2d_0_ub).apply_conv2d(None, conv2d_0_w, conv2d_0_b, 'VALID', (1, 1)) linear_2_lb = snt.BatchFlatten()(tf.nn.relu(relu_1_lb)) linear_2_ub = snt.BatchFlatten()(tf.nn.relu(relu_1_ub)) linear_2_w, linear_2_b = layer_utils.combine_with_batchnorm( linear_2.module.w, None, linear_2.batch_norm) relu_3_lb, relu_3_ub = ibp.IntervalBounds(linear_2_lb, linear_2_ub).apply_linear( None, linear_2_w, linear_2_b) # Expected objective value. objective = 0 act_coeffs_0 = -common.conv_transpose( mu_0, conv2d_0_w, conv2d_0.input_shape, 'VALID', (1, 1)) obj_0 = -tf.reduce_sum(mu_0 * conv2d_0_b, axis=(2, 3, 4)) objective += standard_layer_calcs.linear_dual_objective( None, act_coeffs_0, obj_0, conv2d_0_lb, conv2d_0_ub) objective += standard_layer_calcs.activation_layer_dual_objective( tf.nn.relu, mu_0, lam_1, relu_1_lb, relu_1_ub) act_coeffs_2 = -tf.tensordot(mu_2, tf.transpose(linear_2_w), axes=1) obj_2 = -tf.tensordot(mu_2, linear_2_b, axes=1) objective += standard_layer_calcs.linear_dual_objective( snt.BatchFlatten(preserve_dims=2)(lam_1), act_coeffs_2, obj_2, linear_2_lb, linear_2_ub) objective_w, objective_b = common.targeted_objective( linear_obj.module.w, linear_obj.module.b, image_data.label) objective += standard_layer_calcs.activation_layer_dual_objective( tf.nn.relu, mu_2, -objective_w, relu_3_lb, relu_3_ub) objective += objective_b self._assert_dual_objective_close(objective, dual_obj, image_data)
def _materialised_conv_layer_dual_objective(w, b, padding, strides, lam_in, mu_out, lb, ub): """Materialised version of `conv_layer_dual_objective`.""" # Flatten the inputs, as the materialised convolution will have no # spatial structure. mu_out_flat = snt.BatchFlatten(preserve_dims=2)(mu_out) # Materialise the convolution as a (sparse) fully connected linear layer. w_flat, b_flat = layer_utils.materialise_conv(w, b, lb.shape[1:].as_list(), padding=padding, strides=strides) activation_coeffs = -tf.tensordot( mu_out_flat, tf.transpose(w_flat), axes=1) dual_obj_bias = -tf.tensordot(mu_out_flat, b_flat, axes=1) # Flatten the inputs, as the materialised convolution will have no # spatial structure. if lam_in is not None: lam_in = snt.FlattenTrailingDimensions(2)(lam_in) lb = snt.BatchFlatten()(lb) ub = snt.BatchFlatten()(ub) return standard_layer_calcs.linear_dual_objective(lam_in, activation_coeffs, dual_obj_bias, lb, ub)
def test_conv2d_layer_dual_objective(self, dtype, tol): num_classes = 5 batch_size = 53 input_height = 17 input_width = 7 kernel_height = 3 kernel_width = 4 input_channels = 3 output_channels = 2 padding = 'VALID' strides = (2, 1) # Output dimensions, based on convolution settings. output_height = 8 output_width = 4 w = tf.random_normal(dtype=dtype, shape=(kernel_height, kernel_width, input_channels, output_channels)) b = tf.random_normal(dtype=dtype, shape=(output_channels, )) lam_in = tf.random_normal(dtype=dtype, shape=(num_classes, batch_size, input_height, input_width, input_channels)) mu_out = tf.random_normal(dtype=dtype, shape=(num_classes, batch_size, output_height, output_width, output_channels)) lb = tf.random_normal(dtype=dtype, shape=(batch_size, input_height, input_width, input_channels)) ub = tf.random_normal(dtype=dtype, shape=(batch_size, input_height, input_width, input_channels)) lb, ub = tf.minimum(lb, ub), tf.maximum(lb, ub) activation_coeffs = -common.conv_transpose( mu_out, w, lb.shape[1:].as_list(), padding, strides) dual_obj_bias = -tf.reduce_sum(mu_out * b, axis=(2, 3, 4)) dual_obj = standard_layer_calcs.linear_dual_objective( lam_in, activation_coeffs, dual_obj_bias, lb, ub) # Compare against equivalent linear layer. dual_obj_lin = _materialised_conv_layer_dual_objective( w, b, padding, strides, lam_in, mu_out, lb, ub) with self.test_session() as session: dual_obj_val, dual_obj_lin_val = session.run( (dual_obj, dual_obj_lin)) self.assertAllClose(dual_obj_val, dual_obj_lin_val, atol=tol, rtol=tol)
def test_linear_layer_dual_objective(self, dtype, tol): w = tf.constant([[1.0, 2.0, 3.0], [4.0, -5.0, -6.0]], dtype=dtype) b = tf.constant([0.1, 0.2, 0.3], dtype=dtype) lb = tf.constant([[-1.0, -1.0]], dtype=dtype) ub = tf.constant([[1.0, 1.0]], dtype=dtype) lam_in = tf.constant([[[-.01, -.02]]], dtype=dtype) mu_out = tf.constant([[[30.0, 40.0, 50.0]]], dtype=dtype) # Activation coefficients: -.01 - 260, and -.02 + 380 activation_coeffs = -tf.tensordot(mu_out, tf.transpose(w), axes=1) dual_obj_bias = -tf.tensordot(mu_out, b, axes=1) dual_obj = standard_layer_calcs.linear_dual_objective( lam_in, activation_coeffs, dual_obj_bias, lb, ub) dual_obj_exp = np.array([[(.01 + 260.0) + (-.02 + 380.0) - 26.0]]) with self.test_session() as session: dual_obj_act = session.run(dual_obj) self.assertAllClose(dual_obj_exp, dual_obj_act, atol=tol, rtol=tol)
def test_conv2d_layer_dual_objective_shape(self, dtype): num_classes = 6 batch_size = 23 input_height = 17 input_width = 7 kernel_height = 3 kernel_width = 4 input_channels = 3 output_channels = 5 padding = 'VALID' strides = (2, 1) # Output dimensions, based on convolution settings. output_height = 8 output_width = 4 w = tf.placeholder(dtype=dtype, shape=(kernel_height, kernel_width, input_channels, output_channels)) b = tf.placeholder(dtype=dtype, shape=(output_channels, )) lam_in = tf.placeholder(dtype=dtype, shape=(num_classes, batch_size, input_height, input_width, input_channels)) mu_out = tf.placeholder(dtype=dtype, shape=(num_classes, batch_size, output_height, output_width, output_channels)) lb = tf.placeholder(dtype=dtype, shape=(batch_size, input_height, input_width, input_channels)) ub = tf.placeholder(dtype=dtype, shape=(batch_size, input_height, input_width, input_channels)) activation_coeffs = -common.conv_transpose( mu_out, w, lb.shape[1:].as_list(), padding, strides) dual_obj_bias = -tf.reduce_sum(mu_out * b, axis=(2, 3, 4)) dual_obj = standard_layer_calcs.linear_dual_objective( lam_in, activation_coeffs, dual_obj_bias, lb, ub) self.assertEqual(dtype, dual_obj.dtype) self.assertEqual((num_classes, batch_size), dual_obj.shape)
def test_linear_layer_dual_objective_shape(self, dtype): num_classes = 3 batch_size = 11 input_size = 7 output_size = 5 w = tf.placeholder(dtype=dtype, shape=(input_size, output_size)) b = tf.placeholder(dtype=dtype, shape=(output_size, )) lam_in = tf.placeholder(dtype=dtype, shape=(num_classes, batch_size, input_size)) mu_out = tf.placeholder(dtype=dtype, shape=(num_classes, batch_size, output_size)) lb = tf.placeholder(dtype=dtype, shape=(batch_size, input_size)) ub = tf.placeholder(dtype=dtype, shape=(batch_size, input_size)) activation_coeffs = -tf.tensordot(mu_out, tf.transpose(w), axes=1) dual_obj_bias = -tf.tensordot(mu_out, b, axes=1) dual_obj = standard_layer_calcs.linear_dual_objective( lam_in, activation_coeffs, dual_obj_bias, lb, ub) self.assertEqual(dtype, dual_obj.dtype) self.assertEqual((num_classes, batch_size), dual_obj.shape)
def test_calc_linear(self): image_data = self._image_data() net = self._network('linear') input_bounds = naive_bounds.input_bounds(image_data.image, delta=.1) dual_obj, dual_var_lists = self._build_objective( net, input_bounds, image_data.label) # Explicitly build the expected TensorFlow graph for calculating objective. ( linear_0, relu_1, # pylint:disable=unused-variable linear_obj) = self._verifiable_layer_builder(net).build_layers() (mu_0, ), _ = dual_var_lists # Expected input bounds for each layer. linear_0_lb, linear_0_ub = self._expected_input_bounds( image_data.image, .1) linear_0_lb = snt.BatchFlatten()(linear_0_lb) linear_0_ub = snt.BatchFlatten()(linear_0_ub) relu_1_lb, relu_1_ub = ibp.IntervalBounds(linear_0_lb, linear_0_ub).apply_linear( None, linear_0.module.w, linear_0.module.b) # Expected objective value. objective = 0 act_coeffs_0 = -tf.tensordot( mu_0, tf.transpose(linear_0.module.w), axes=1) obj_0 = -tf.tensordot(mu_0, linear_0.module.b, axes=1) objective += standard_layer_calcs.linear_dual_objective( None, act_coeffs_0, obj_0, linear_0_lb, linear_0_ub) objective_w, objective_b = common.targeted_objective( linear_obj.module.w, linear_obj.module.b, image_data.label) objective += standard_layer_calcs.activation_layer_dual_objective( tf.nn.relu, mu_0, -objective_w, relu_1_lb, relu_1_ub) objective += objective_b self._assert_dual_objective_close(objective, dual_obj, image_data)
def affine_layer_contrib(self, layer, dual_vars_lm1, activation_coeffs, dual_obj_bias): """Computes the contribution of an affine layer to the dual objective. Compute the term:: max_x (lam_{l-1}^T x - mu_l^T (W_l x + b_l)) where W_l, b_l is the affine mapping for layer l. Args: layer: affine (linear/conv) layer. dual_vars_lm1: lam_{l-1}, or None for the first layer. activation_coeffs: mu_l^T W_l dual_obj_bias: mu_l^T b_l Returns: Dual objective contribution. """ return standard_layer_calcs.linear_dual_objective( dual_vars_lm1, activation_coeffs, dual_obj_bias, layer.input_bounds.lower_offset, layer.input_bounds.upper_offset, inverse_temperature=self._inverse_temperature)