{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/safety-verification-of-deep-neural-networks","title":"Safety Verification of Deep Neural Networks","arxiv_id":"1610.06940","date":"2016-10-21","proceeding":null,"authors":["Xiaowei Huang","Marta Kwiatkowska","Sen Wang","Min Wu"],"abstract":"Deep neural networks have achieved impressive experimental results in image\nclassification, but can surprisingly be unstable with respect to adversarial\nperturbations, that is, minimal changes to the input image that cause the\nnetwork to misclassify it. With potential applications including perception\nmodules and end-to-end controllers for self-driving cars, this raises concerns\nabout their safety. We develop a novel automated verification framework for\nfeed-forward multi-layer neural networks based on Satisfiability Modulo Theory\n(SMT). We focus on safety of image classification decisions with respect to\nimage manipulations, such as scratches or changes to camera angle or lighting\nconditions that would result in the same class being assigned by a human, and\ndefine safety for an individual decision in terms of invariance of the\nclassification within a small neighbourhood of the original image. We enable\nexhaustive search of the region by employing discretisation, and propagate the\nanalysis layer by layer. Our method works directly with the network code and,\nin contrast to existing methods, can guarantee that adversarial examples, if\nthey exist, are found for the given region and family of manipulations. If\nfound, adversarial examples can be shown to human testers and/or used to\nfine-tune the network. We implement the techniques using Z3 and evaluate them\non state-of-the-art networks, including regularised and deep learning networks.\nWe also compare against existing techniques to search for adversarial examples\nand estimate network robustness.","url_abs":"http://arxiv.org/abs/1610.06940v3","url_pdf":"http://arxiv.org/pdf/1610.06940v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"safety-verification-of-deep-neural-networks","repo_url":"https://github.com/VeriDeep/DLV","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"none","reach":{"status":"unanswered"}},{"paper_slug":"safety-verification-of-deep-neural-networks","repo_url":"https://github.com/KatyaKom/Python-Z3-NNVerif","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"none","reach":{"status":"unanswered"}}],"tasks":[{"task_slug":"adversarial-attack","task_name":"Adversarial Attack"},{"task_slug":"adversarial-defense","task_name":"Adversarial Defense"},{"task_slug":"classification","task_name":"General Classification"},{"task_slug":"image-classification","task_name":"Image Classification"},{"task_slug":"self-driving-cars","task_name":"Self-Driving Cars"},{"task_slug":"image-classification","task_name":"image-classification"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1610.06940","atlas_url":"https://app.syntology.ai/?focus=1610.06940","mcp":null,"developers":"https://syntology.ai/developers"},"arxiv_metadata":null,"syntology_extracted_results":null}