Artificial Neural Networks (ANNs) are being deployed for an increasing number of safety-
critical applications, including autonomous cars and medical diagnosis. However, con-
cerns about their reliability have been raised due to their black-box nature and apparent
fragility to adversarial attacks. These concerns are amplified when ANNs are deployed
on restricted system, which limit the precision of mathematical operations and thus in-
troduce additional quantization errors. Here, we develop and evaluate a novel symbolic
verification framework using software model checking (SMC) and satisfiability modulo
theories (SMT) to check for vulnerabilities in ANNs and mainly in Multilayer Perceptron
(MLP). More specifically, here is proposed several ANN-related optimizations for SMC,
including invariant inference via interval analysis, slicing, expression simplifications, and
discretization of non-linear activation functions. With this verification framework, we can
provide formal guarantees on the safe behavior of ANNs implemented both in floating-
and fixed-point arithmetic. In this regard, the current verification approach was able
to verify and produce adversarial examples for 52 test cases spanning image classifica-
tion and general machine learning applications. Furthermore, for small- to medium-sized
ANN, this approach completes most of its verification runs in minutes. Moreover, in con-
trast to most state-of-the-art methods, the presented approach is not restricted to specific
choices regarding activation functions and non-quantized representations. Experiments
show that this approach can analyze larger ANN implementations and substantially re-
duce the verification time compared to state-of-the-art techniques that use SMT solving.
|
