从神经网络中提取可验证的自动机,实现对数据序列的鲁棒性分析。
Extracting Robust Register Automata from Neural Networks over Data Sequences
- 用带寄存器的确定性自动机建模连续数据序列输入
- 在固定寄存器数下实现多项式时间鲁棒性检测
- 无需白盒访问即可进行形式化推理与鲁棒性验证
自动机提取是一种为黑箱神经模型生成可解释代理的方法,可用于符号化分析。现有方法假设输入字母表有限,因此不适用于来自连续域的数据序列。本文提出使用确定性寄存器自动机(DRAs),其通过寄存器存储并比较数值来扩展有限自动机。主要贡献是构建了一个针对固定寄存器数量的多项式时间鲁棒性检查器,并将其与被动和主动自动机学习算法结合,生成具有统计鲁棒性和等价性保证的代理自动机。关键应用是评估神经网络的鲁棒性:对于给定序列和距离度量,自动机可认证局部鲁棒性或生成具体反例。在循环神经网络和Transformer架构上的实验表明,该框架能可靠地学习准确的自动机,并支持严谨的鲁棒性评估。结果表明,该方法在无需白盒访问的前提下,有效实现了神经网络可解释性与形式化推理的融合。
原文摘要 · Abstract (English)
Automata extraction is a method for synthesising interpretable surrogates for black-box neural models that can be analysed symbolically. Existing techniques assume a finite input alphabet, and thus are not directly applicable to data sequences drawn from continuous domains. We address this challenge with deterministic register automata (DRAs), which extend finite automata with registers that store and compare numeric values. Our main contribution is a framework for robust DRA extraction from black-box models: we develop a polynomial-time robustness checker for DRAs with a fixed number of registers, and combine it with passive and active automata learning algorithms. This combination yields surrogate DRAs with statistical robustness and equivalence guarantees. As a key application, we use the extracted automata to assess the robustness of neural networks: for a given sequence and distance metric, the DRA either certifies local robustness or produces a concrete counterexample. Experiments on recurrent neural networks and transformer architectures show that our framework reliably learns accurate automata and enables principled robustness evaluation. Overall, our results demonstrate that robust DRA extraction effectively bridges neural network interpretability and formal reasoning without requiring white-box access to the underlying network.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。