Incremental Bounded Model Checking of Artificial Neural Networks in CUDA

Abstract

Artificial Neural networks (ANNs) are powerful computing systems employed for various applications due to their versatility to generalize and to respond to unexpected inputs/patterns. However, implementations of ANNs for safetycritical systems might lead to failures, which are hardly predicted in the design phase since ANNs are highly parallel and their parameters are hardly interpretable. Here we develop and evaluate a novel symbolic software verification framework based on incremental bounded model checking (BMC) to check for adversarial cases and coverage methods in multi-layer perceptron (MLP). In particular, we further develop the efficient SMTbased Context-Bounded Model Checker for Graphical Processing Units (ESBMC-GPU) in order to ensure the reliability of certain safety properties in which safety-critical systems can fail and make incorrect decisions, thereby leading to unwanted material damage or even put lives in danger. This paper marks the first symbolic verification framework to reason over ANNs implemented in CUDA. Our experimental results show that our approach implemented in ESBMC-GPU can successfully verify safety properties and covering methods in ANNs and correctly generate 28 adversarial cases in MLPs.

How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Review

“…Another subfield of model checking that can help the implementation of ML on safety-critical applications is bounded model checking. The latter consists of constructing Boolean formulas that are not satisfiable if there is a counterexample of length k. [195] propose a verification framework based on incremental bounded model checking on neural networks. The framework uses CUDA.…”

Verifying Quantized Neural Networks using SMT-Based Model Checking

“…Our methodology is a generalization of the previous work by Sena et al on the SMT verification of CUDA implementations of ANNs [69]. As we expound in the next Section 3, we take advantage of existing techniques in software verification to model both ANNs and QNNs as SMT formulas.…”

“…In our evaluation, we consider ANNs trained on two datasets: the UCI Iris dataset [24] and a vocalic character recognition dataset [69]. This section gives the details of the datasets themselves, the neural networks we trained on top of them, and the safety properties that we used to test our verification approach and our general experimental setup.…”

“…This work's main contribution is providing a sound verification approach for checking the safety of MLPs with arbitrary activation functions and taking into account the FWL effects in the weights and bias due to fixed-point implementation. SMT-based approaches [43,49,50,65,69] have been used for safety verification of ANNs. The advantage of those techniques is the SMT solvers' soundness; however, there is an important drawback: the scalability is limited since they are sensitive to the ANN complexity.…”

“…Our approach implemented on top of ESBMC has some similarities with other techniques described here, e.g., regarding the covering methods proposed by Sun et al [72], model checking to obtain adversarial cases proposed by Huang et al [43], and incremental verification of ANNs implemented in CUDA by Sena et al [69]. However, the main contribution concerns our requirements and how we handle, with invariant inference, the actual implementations of ANNs with non-linear activation functions, also considering FWL effects.…”