{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/formal-security-analysis-of-neural-networks","title":"Formal Security Analysis of Neural Networks using Symbolic Intervals","arxiv_id":"1804.10829","date":"2018-04-28","proceeding":null,"authors":["Shiqi Wang","Kexin Pei","Justin Whitehouse","Junfeng Yang","Suman Jana"],"abstract":"Due to the increasing deployment of Deep Neural Networks (DNNs) in real-world\nsecurity-critical domains including autonomous vehicles and collision avoidance\nsystems, formally checking security properties of DNNs, especially under\ndifferent attacker capabilities, is becoming crucial. Most existing security\ntesting techniques for DNNs try to find adversarial examples without providing\nany formal security guarantees about the non-existence of such adversarial\nexamples. Recently, several projects have used different types of\nSatisfiability Modulo Theory (SMT) solvers to formally check security\nproperties of DNNs. However, all of these approaches are limited by the high\noverhead caused by the solver.\n  In this paper, we present a new direction for formally checking security\nproperties of DNNs without using SMT solvers. Instead, we leverage interval\narithmetic to compute rigorous bounds on the DNN outputs. Our approach, unlike\nexisting solver-based approaches, is easily parallelizable. We further present\nsymbolic interval analysis along with several other optimizations to minimize\noverestimations of output bounds.\n  We design, implement, and evaluate our approach as part of ReluVal, a system\nfor formally checking security properties of Relu-based DNNs. Our extensive\nempirical results show that ReluVal outperforms Reluplex, a state-of-the-art\nsolver-based system, by 200 times on average. On a single 8-core machine\nwithout GPUs, within 4 hours, ReluVal is able to verify a security property\nthat Reluplex deemed inconclusive due to timeout after running for more than 5\ndays. Our experiments demonstrate that symbolic interval analysis is a\npromising new direction towards rigorously analyzing different security\nproperties of DNNs.","url_abs":"http://arxiv.org/abs/1804.10829v3","url_pdf":"http://arxiv.org/pdf/1804.10829v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"formal-security-analysis-of-neural-networks","repo_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"formal-security-analysis-of-neural-networks","repo_url":"https://github.com/rm2pt/veriprune","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"Apache-2.0"}},{"paper_slug":"formal-security-analysis-of-neural-networks","repo_url":"https://github.com/tcwangshiqi-columbia/Neurify","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"tf","reach":{"status":"ok"}},{"paper_slug":"formal-security-analysis-of-neural-networks","repo_url":"https://github.com/tcwangshiqi-columbia/ReluVal","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[{"task_slug":"autonomous-vehicles","task_name":"Autonomous Vehicles"},{"task_slug":"collision-avoidance","task_name":"Collision Avoidance"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=1804.10829","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1804.10829"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/tcwangshiqi-columbia/ReluVal","reach":{"status":"ok","spdx":"NOASSERTION"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rm2pt/veriprune","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact","reach":{"status":"ok","spdx":"Apache-2.0"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/tcwangshiqi-columbia/Neurify","reach":{"status":"ok"}}],"summary":{"unverified":15},"by_repo_kind":{"listed":{"samples":15,"ran":0,"repositories":2}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"ef0baf6862000da8","entry":"eran_affine","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/eranlayers.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/eranlayers.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ef0baf6862000da8"}},{"code_sha256_prefix":"0b4762e13a8c346d","entry":"eran_conv2d_without_activation","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/eranlayers.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/eranlayers.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0b4762e13a8c346d"}},{"code_sha256_prefix":"822ae5b5b52798e2","entry":"extract_mean","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/read_net_file.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/read_net_file.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"822ae5b5b52798e2"}},{"code_sha256_prefix":"ba593c787e773e89","entry":"getEps2","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/diff_analysis_artifact.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/diff_analysis_artifact.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ba593c787e773e89"}},{"code_sha256_prefix":"411b3e36989e2fcf","entry":"nodePrune_nnet","repo":"rm2pt/veriprune","repo_kind":"listed","path":"DiffNN-Code/python/prune_nnet.py","file_url":"https://github.com/rm2pt/veriprune/blob/HEAD/DiffNN-Code/python/prune_nnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"411b3e36989e2fcf"}},{"code_sha256_prefix":"efcc5bf84e113a01","entry":"nodePrune_nnet","repo":"rm2pt/veriprune","repo_kind":"listed","path":"DiffNN-Code/python/prune_scale_nnet.py","file_url":"https://github.com/rm2pt/veriprune/blob/HEAD/DiffNN-Code/python/prune_scale_nnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"efcc5bf84e113a01"}},{"code_sha256_prefix":"96cf9fddb9aeb8a0","entry":"product","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/read_net_file.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/read_net_file.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"96cf9fddb9aeb8a0"}},{"code_sha256_prefix":"d8c6bb8a9ac1500c","entry":"readNNet","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/NNet/utils/readNNet.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/NNet/utils/readNNet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d8c6bb8a9ac1500c"}},{"code_sha256_prefix":"1c51a497f30584f0","entry":"read_csv_file","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"DiffNN-Code/python/make_HAR_properties.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/DiffNN-Code/python/make_HAR_properties.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"1c51a497f30584f0"}},{"code_sha256_prefix":"0b0a40d002bbc34f","entry":"read_csv_file","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"DiffNN-Code/python/make_mnist_properties.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/DiffNN-Code/python/make_mnist_properties.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"0b0a40d002bbc34f"}},{"code_sha256_prefix":"ab8fc8f6b5ce1d25","entry":"read_network","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"DiffNN-Code/python/common.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/DiffNN-Code/python/common.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"ab8fc8f6b5ce1d25"}},{"code_sha256_prefix":"c4e78fa7b2f1d238","entry":"round_nnet_16bit","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"DiffNN-Code/python/round_nnet.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/DiffNN-Code/python/round_nnet.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"c4e78fa7b2f1d238"}},{"code_sha256_prefix":"144602513b4d55e3","entry":"runRepl","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/read_net_file.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/read_net_file.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"144602513b4d55e3"}},{"code_sha256_prefix":"d2fabb9a6d5f04f0","entry":"subtract_nnets","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"DiffNN-Code/python/subtract_nnets.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/DiffNN-Code/python/subtract_nnets.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d2fabb9a6d5f04f0"}},{"code_sha256_prefix":"8966ad509beb7504","entry":"tensorshape_to_intlist","repo":"pauls658/ReluDiff-ICSE2020-Artifact","repo_kind":"listed","path":"eran/tf_verify/eranlayers.py","file_url":"https://github.com/pauls658/ReluDiff-ICSE2020-Artifact/blob/HEAD/eran/tf_verify/eranlayers.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8966ad509beb7504"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}