On Integer Programming for the Binarized Neural Network Verification Problem

2025-10-01

AI Summary

This paper addresses the formal robustness verification problem for Binary Neural Networks (BNNs)—i.e., determining whether a given input remains correctly classified under bounded adversarial perturbations. To overcome the low efficiency and poor scalability of existing Integer Programming (IP)-based verifiers, we propose: (1) a linear objective construction strategy for multi-class classification that uniformly encodes misclassification conditions; (2) tight, structure-aware valid inequalities derived from the recursive architecture of BNNs, substantially reducing the integrality gap; and (3) an integrated optimization framework combining big-M linearization, architecture-aware pruning, and custom constraint generation. Experiments demonstrate that our method verifies larger perturbation radii within time limits and achieves significantly higher verification success rates and computational efficiency compared to state-of-the-art IP baselines. The approach establishes a more powerful and scalable optimization framework for formal robustness assessment of BNNs.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Natural Language Processing: Safety and Robustness

Application Category

• Web Mining and Content Analysis: Robustness and generalizability of Web mining methods
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Security and Privacy: Large-scale security measurements

Abstract

Binarized neural networks (BNNs) are feedforward neural networks with binary weights and activation functions. In the context of using a BNN for classification, the verification problem seeks to determine whether a small perturbation of a given input can lead it to be misclassified by the BNN, and the robustness of the BNN can be measured by solving the verification problem over multiple inputs. The BNN verification problem can be formulated as an integer programming (IP) problem. However, the natural IP formulation is often challenging to solve due to a large integrality gap induced by big-$M$ constraints. We present two techniques to improve the IP formulation. First, we introduce a new method for obtaining a linear objective for the multi-class setting. Second, we introduce a new technique for generating valid inequalities for the IP formulation that exploits the recursive structure of BNNs. We find that our techniques enable verifying BNNs against a higher range of input perturbation than existing IP approaches within a limited time.

Problem

• Improving integer programming for BNN verification robustness
• Reducing integrality gap in BNN verification formulations
• Generating valid inequalities using BNN recursive structure

Innovation

• Integer programming formulation for BNN verification
• Linear objective method for multi-class classification
• Valid inequalities exploiting BNN recursive structure