Pruning to 90% Achieves Greater Robustness in Safety-Critical Neural Networks

Scientists are tackling a major hurdle in deploying artificial intelligence safely: the immense computational cost of verifying neural networks for critical applications like surgical robotics and autonomous systems. Minh Le from Georgia Institute of Technology and Phuong Cao from University of Illinois Urbana-Champaign, along with colleagues, demonstrate that pruning , reducing the complexity of these networks , can surprisingly improve their verifiability. Their research, utilising the CROWN verifier and ResNet4 models on datasets including NASA JPL’s Mars Frost Identification, reveals a non-linear relationship between pruning ratios and robustness, showing that strategic reductions in connectivity can actually enhance formal guarantees of reliability , a crucial step towards deploying efficient and trustworthy AI in high-stakes environments.

Verification involved defining properties to ensure the absence of adversarial examples within a defined L∞ distance (ε) for 100 inputs per model, allowing for a quantifiable comparison of robustness. The study unveils that lightly pruned MNIST models, with 40% of connections removed, consistently demonstrate superior local robustness verification across various ε values. This highlights the complex interplay between model compression and verifiability, offering critical insights for selecting the ideal pruning ratio for deploying efficient, yet formally verified, DNNs in high-stakes environments.

Researchers emphasize that model pruning, a technique for reducing the number of connections in a neural network, has shown promise in reducing model size with minimal impact on accuracy and adversarial robustness. This research builds upon previous work demonstrating that pruning can improve verifiable local robustness, but goes further by systematically investigating the impact of varying pruning ratios on local robustness verification across two distinct safety-critical domains. Ultimately, the team’s robustness proofs for pruned neural networks demonstrate the trustworthiness of their inference results, offering a crucial step towards deploying reliable AI in critical applications where human lives or significant resources are at stake.

Pruning’s impact on DNN robustness verification is often

To begin, the team trained ten baseline ResNet4 neural networks for each dataset, utilising seeds ranging from 10 to 100 in increments of 10, ensuring statistical robustness of their findings. Experiments employed cross-entropy loss and the AdamW optimiser with a weight decay of 10−4, coupled with a learning rate scheduler initiating at 10−4 and decreasing by a factor of 0.3 every 30 epochs. Following training, the researchers implemented a naive pruning approach, removing weights with the smallest absolute values specifically from convolutional layers, as these connections were hypothesised to be less critical to performance. Models underwent pruning at ratios of 10% to 80% in 10% increments, with global unstructured L1 pruning applied exclusively to convolutional layers.

After each pruning step, models were retrained using identical hyperparameters until they again achieved the established test set accuracy threshold, ensuring that any observed improvements in verifiability weren’t simply due to a drop in overall model performance. This rigorous retraining process allowed the team to isolate the effect of pruning on formal verification. This technique, which has consistently won the International Verification of Neural Networks Competition from 2021 to 2025, delivers a robust and reliable assessment of local robustness, demonstrating the trustworthiness of inference results for safety-critical tasks. The approach enables the quantification of proven robustness properties, revealing that light pruning (40% on MNIST) and heavy pruning (70%-90% on JPL) can actually improve verifiability, allowing models to surpass the performance of their unpruned counterparts.

Pruning boosts robustness verification, dataset dependent, but requires

Magnitude-based pruning was implemented on convolutional layers, removing the weights with the smallest absolute values, followed by retraining to recover the initial 99% accuracy for MNIST and 84% for JPL. Verification involved defining properties to ensure the absence of adversarial examples within an L∞ distance of ε for 100 inputs per model, rigorously testing the network’s resilience. Results demonstrate that lightly pruned MNIST models, with 40% of connections removed, consistently verified most of their local robustness properties across all tested ε values. Measurements confirm that this disparity highlights the complex interplay between model compression and dataset characteristics, necessitating tailored pruning strategies.

The study’s robustness proofs for pruned neural networks demonstrate the trustworthiness of their inference results, vital for safety-critical tasks where reliability is paramount, potentially safeguarding human lives or billion-dollar missions. Researchers measured the impact of pruning ratios ranging from 10% to 80% in 10% increments, pruning all 10 baseline models with 10 different seeds for each ratio, yielding a comprehensive dataset for analysis. The breakthrough delivers a method to prove, for a given input, that no adversarial input exists within a sufficiently small Lp distance that could alter the model’s output.

Pruning boosts robustness via dataset-specific ratios of retained

By identifying pruning strategies that enhance verifiability, researchers can create more efficient and trustworthy AI solutions for high-stakes environments where failures are unacceptable. However, the authors acknowledge a limitation in understanding why different datasets yield different optimal pruning ratios, highlighting the need for further investigation into the interplay between dataset characteristics and pruning effectiveness. Future work will focus on exploring the impact of various pruning settings, including ratio, criterion, and granularity, on certified local robustness across diverse applications like high-frequency trading and AI-driven medical devices.