ML Security PapersBridging Efficiency and Safety: Formal Verification of Neural Networks with Early Exits
Yizhak Yisrael Elboher 1, Avraham Raviv 2, Amihay Elboher 3, Zhouxing Shi 4, Omri Azencot 3, Hillel Kugler 2, Guy Katz 1
Published on arXiv
2512.20755
Input Manipulation Attack
OWASP ML Top 10 — ML01
Key Finding
Early exit architectures not only accelerate inference but also improve formal verifiability, enabling more robustness queries to be solved in less time compared to standard networks
Ensuring the safety and efficiency of AI systems is a central goal of modern research. Formal verification provides guarantees of neural network robustness, while early exits improve inference efficiency by enabling intermediate predictions. Yet verifying networks with early exits introduces new challenges due to their conditional execution paths. In this work, we define a robustness property tailored to early exit architectures and show how off-the-shelf solvers can be used to assess it. We present a baseline algorithm, enhanced with an early stopping strategy and heuristic optimizations that maintain soundness and completeness. Experiments on multiple benchmarks validate our framework's effectiveness and demonstrate the performance gains of the improved algorithm. Alongside the natural inference acceleration provided by early exits, we show that they also enhance verifiability, enabling more queries to be solved in less time compared to standard networks. Together with a robustness analysis, we show how these metrics can help users navigate the inherent trade-off between accuracy and efficiency.
Key Contributions
- Formalizes a robustness property tailored to early exit (EE) neural network architectures, handling conditional execution paths that standard verification methods do not address
- Proposes a sound and complete verification algorithm with early stopping and heuristic optimizations that reduce redundant sub-queries and improve scalability
- Demonstrates empirically that EE architectures enhance verifiability — more robustness queries can be solved in less time — on top of their inference efficiency benefits
🛡️ Threat Analysis
The paper provides certified robustness guarantees for neural networks — a defense against adversarial input manipulation — by formally verifying that predictions remain consistent within small input neighborhoods. The entire motivation is adversarial perturbations and robustness guarantees.