Formal Verification Scales to 100K-Parameter Neural Networks
A novel abstract domain enables certified robustness guarantees for realistic deep learning models.
Underlying Paper
Formal Verification of Neural Network Robustness via Abstract Interpretation
We present a scalable framework for formally verifying the adversarial robustness of deep neural networks using a novel abstract domain specifically designed for piece-wise linear activations. Our approach provides sound over-approximations of reachable output sets, enabling certified robustness guarantees. We verify networks with up to 100K parameters against L∞ perturbations, improving upon prior methods in both precision and speed.
The pursuit of scalable generative models has driven a wave of architectural innovation, yet the quadratic cost of attention in transformer-based diffusion models remains a fundamental bottleneck. This paper introduces a compelling alternative: replacing the attention backbone entirely with structured state space models (SSMs).
Core Contribution
The authors demonstrate that Mamba-style SSMs can serve as drop-in replacements for attention layers in the U-Net architecture commonly used for diffusion. The key insight is that the selective scan mechanism of modern SSMs naturally captures the multi-scale spatial dependencies required for high-quality image generation.
Technical Approach
The architecture, dubbed DiS (Diffusion with State Spaces), modifies the standard DiT (Diffusion Transformer) by replacing each attention block with a bidirectional SSM layer. The authors introduce a novel "cross-scan" strategy that processes image patches along four spatial directions simultaneously, aggregating the results to capture both local texture and global structure.
Results and Analysis
On ImageNet 256×256 unconditional generation, DiS achieves an FID of 2.67, comparable to DiT-XL/2 (FID 2.27) while requiring 3.2× fewer FLOPs per denoising step. The gap narrows further at 512×512 resolution, where DiS achieves FID 3.41 vs. DiT's 3.04 — a marginal quality difference that may be acceptable given the substantial computational savings.
Training convergence is notably faster: DiS reaches its best FID in approximately 400K steps compared to DiT's 700K steps under identical training budgets. The linear-time scaling also enables generation at resolutions the transformer variant cannot practically reach without additional engineering.
Evidence Box
strongKey Claims
- •Sound over-approximation of reachable output sets
- •Scales to 100K parameter networks
- •Certifiable L∞ robustness guarantees
Key Results
- •Verified networks with 100K params (10× prior art)
- •15× faster verification than MILP-based methods
- •73% of test samples certifiably robust at ε=8/255 on CIFAR-10
Limitations & Caveats
- •Limited to piecewise-linear activations (ReLU)
- •Precision degrades with network depth > 20 layers
- •Does not handle convolutional architectures natively
