Deep neural networks have become widely used, obtaining remarkable results in domains such as computer vision, speech recognition, natural language processing, audio recognition, social network filtering, machine translation, and bio-informatics, where they have produced results comparable to human experts. However, these networks can be easily "fooled" by adversarial perturbations: minimal changes to correctly-classified inputs, that cause the network to misclassify them. This phenomenon represents a concern for both safety and security, but it is currently unclear how to measure a network's robustness against such perturbations. Existing techniques are limited to checking robustness around a few individual input points, providing only very limited guarantees. We propose a novel approach for automatically identifying safe regions of the input space, within which the network is robust against adversarial perturbations. The approach is data-guided, relying on clustering to identify well-defined geometric regions as candidate safe regions. We then utilize verification techniques to confirm that these regions are safe or to provide counter-examples showing that they are not safe. We also introduce the notion of targeted robustness which, for a given target label and region, ensures that a NN does not map any input in the region to the target label. We evaluated our technique on the MNIST dataset and on a neural network implementation of a controller for the next-generation Airborne Collision Avoidance System for unmanned aircraft (ACAS Xu). For these networks, our approach identified multiple regions which were completely safe as well as some which were only safe for specific labels. It also discovered several adversarial perturbations of interest.

Abstract. Removing bugs in programs -even when location of faulty statements is known -is tedious and error-prone, particularly because of the increased likelihood of introducing new bugs as a result of fixing known bugs. We present an automated approach for generating likely bug fixes using behavioral specifications. Our key insight is to replace a faulty statement that has deterministic behavior with one that has nondeterministic behavior, and to use the specification constraints to prune the ensuing nondeterminism and repair the faulty statement. As an enabling technology, we use the SAT-based Alloy tool-set to describe specification constraints as well as for solving them. Initial experiments show the effectiveness of our approach in repairing programs that manipulate structurally complex data. We believe specification-based automated debugging using SAT holds much promise.

Deep Neural Networks (DNN) are increasingly used in a variety of applications, many of them with substantial safety and security concerns. This paper introduces DeepCheck, a new approach for validating DNNs based on core ideas from program analysis, specifically from symbolic execution. The idea is to translate a DNN into an imperative program, thereby enabling program analysis to assist with DNN validation. A basic translation however creates programs that are very complex to analyze. DeepCheck introduces novel techniques for lightweight symbolic analysis of DNNs and applies them in the context of image classification to address two challenging problems in DNN analysis: 1) identification of important pixels (for attribution and adversarial generation); and 2) creation of 1-pixel and 2-pixel attacks. Experimental results using the MNIST data-set show that DeepCheck's lightweight symbolic analysis provides a valuable tool for DNN validation.

We present techniques for automatically inferring formal properties of feed-forward neural networks. We observe that a significant part (if not all) of the logic of feed forward networks is captured in the activation status (on or off ) of its neurons. We propose to extract patterns based on neuron decisions as preconditions that imply certain desirable output property e.g., the prediction being a certain class. We present techniques to extract input properties, encoding convex predicates on the input space that imply given output properties and layer properties, representing network properties captured in the hidden layers that imply the desired output behavior. We apply our techniques on networks for the MNIST and ACASXU applications. Our experiments highlight the use of the inferred properties in a variety of tasks, such as explaining predictions, providing robustness guarantees, simplifying proofs, and network distillation.

Squamous cell carcinoma of the oral cavity (OSCC) is the most common head-andneck malignancy. Importantly, we are experiencing an alarming rise in the incidence of oropharyngeal squamous cell carcinoma (OPSCC) globally. Oncogenic viruses, human papillomavirus (HPV) and Epstein-Barr virus (EBV), are known to be co-associated with OSCC and OPSCC cases. However, the reported incidence of HPV and EBV coinfection in OSCCs and OPSCCs globally is unknown. To address this, we performed a formal meta-analysis and systematic review on published studies that report the detection of both EBV and HPV in OSCCs and OPSCCs. Our analysis revealed 18 relevant studies out of a total of 1820 cases (1181 from the oral cavity and 639 from the oropharynx). Overall, HPV and EBV co-infection was found in 11.9% of OSCC and OPSCC cases combined (95% CI: 8%-14.1%). Based on anatomical subsite, dual positivity estimates were 10.5% (95% CI: 6.7%-15.1%) for OSCC and 14.2% (95% CI: 9.1%-21.3%) for OPSCC. The highest dual positivity rates described were in European countries: for OSCC 34.7% (95% CI: 25.9%-44.6%) in Sweden and for OPSCC, 23.4% (95% CI: 16.9%-31.5%) in Poland. Given these substantive prevalence rates, the value of detecting dual infection in the diagnosis and prognosis of these cancers deserves careful longitudinal studies, as do implications for cancer prevention and therapy. We further proposed molecular mechanisms that could explain how HPV and EBV could co-contribute to the aetiology of OSCCs and OPSCCs.