QuantifyML: Counting-Based ML Evaluation

• QuantifyML is a framework that translates trained models into C programs and uses CBMC to generate CNF formulas for exact projected model counting over bounded input domains.
• It quantifies learnability, safety, and robustness by computing metrics like accuracy, precision, recall, and F1-score based on complete counts rather than sample estimates.
• Empirical studies on MNIST, relational graphs, and ACAS Xu reveal that standard test-set accuracy can be misleading, highlighting the framework’s ability to expose hidden model vulnerabilities and scalability challenges.

Searching arXiv for the specified paper and closely related work to ground the article. arxiv_search(query="(Usman et al., 2021) QuantifyML How Good is my Machine Learning Model", max_results=5) QuantifyML is a framework for evaluating trained machine learning models by translating them into a C program, feeding that program to the CBMC model checker to obtain a formula in conjunctive normal form, and then using projected model counting to compute precise counts of model behavior over a bounded input domain (Usman et al., 2021). Its central claim is that test-set accuracy is often an imperfect proxy for what a model has learned, especially when the test data are not representative, when different architectures fail in different regions of the input space, or when safety and adversarial behavior arise in sparsely sampled regions (Usman et al., 2021). QuantifyML therefore replaces sampling-based evaluation with counting over a bounded, precisely defined input space, and uses these counts to quantify learnability, safety, and robustness (Usman et al., 2021).

1. Conceptual basis

QuantifyML starts from the observation that the efficacy of machine learning models is typically determined by computing their accuracy on test data sets, but that this may be misleading because the test data may not be representative of the problem being studied (Usman et al., 2021). The framework addresses three recurrent issues: a held-out test set may not cover the full problem space, different models may appear comparable even though their errors are concentrated in different regions, and safety or adversarial failures may occur in rare but important parts of the domain (Usman et al., 2021).

The framework evaluates a model relative to a bounded input scope and a formal specification. For learnability, the specification is a ground-truth predicate over the input domain. For safety, it is a property of the form $Pre \Rightarrow Post$. For local robustness, it is a neighborhood specification around a concrete input, typically defined by constraining each dimension to $[x_j-\epsilon, x_j+\epsilon]$ (Usman et al., 2021). The resulting counts are used to compute quantities analogous to accuracy, precision, recall, F1-score, safety satisfaction, safety violation, and robustness fractions (Usman et al., 2021).

This design places QuantifyML in the model-checking tradition rather than in statistical evaluation. The framework quantifies behavior over all inputs in the chosen bounded domain, rather than estimating behavior from a sample (Usman et al., 2021).

2. Translation and counting pipeline

QuantifyML operates through a fixed toolchain: model translation, bounded verification, CNF generation, and projected model counting (Usman et al., 2021).

Stage	Artifact	Role
Model translation	C program	Encodes a trained decision tree or neural network
CBMC encoding	CNF formula	Captures bounded executions and logical predicates
Projected counting	Input-space counts	Counts satisfying assignments projected to primary input variables

The inputs to the framework are a trained model, a logical specification, and an input-domain bound (Usman et al., 2021). The trained model is translated into C. For decision trees, the C control flow mirrors the tree’s branching. For neural networks, the translation encodes the standard layer-by-layer computation (Usman et al., 2021).

The C program and the relevant predicates are then passed to CBMC. CBMC constructs a control-flow graph, encodes bounded executions as bit-vector constraints, and flattens them to CNF (Usman et al., 2021). Because this encoding introduces auxiliary variables, QuantifyML uses projected model counting, treating input variables as primary variables and CBMC-introduced variables as auxiliary variables (Usman et al., 2021).

The framework uses projMC for exact projected model counting and ApproxMC for scalable approximate counting (Usman et al., 2021). The output is a set of counts for conjunctions and disjunctions of model predicates and specification predicates, from which evaluation metrics are derived (Usman et al., 2021).

3. Formalization of learnability

For multi-class classification with labels $l \in \{1,\dots,L\}$, QuantifyML introduces, for each label $l$, two predicates: one that returns $1$ if the model predicts label $l$, and one that returns $1$ if the ground truth for the input is $l$ (Usman et al., 2021). True positives, false positives, true negatives, and false negatives are then expressed as projected model counts over conjunctions of these predicates (Usman et al., 2021).

From these counts, QuantifyML computes accuracy, precision, recall, and F1-score (Usman et al., 2021). The key methodological point is that these are not sample estimates; they are derived from counts over the entire bounded input domain (Usman et al., 2021).

The neural-network encoding is explicit at the level of neuron computation. The paper describes each neuron as applying an activation function to a weighted sum of its inputs,

$$N(X) = o\!\left(\sum_i w_i \cdot N_i(X) + b\right),$$

where $N_i$ denotes the value of the $[x_j-\epsilon, x_j+\epsilon]$0-th neuron in the previous layer, $[x_j-\epsilon, x_j+\epsilon]$1 are weights, $[x_j-\epsilon, x_j+\epsilon]$2 is a bias term, and $[x_j-\epsilon, x_j+\epsilon]$3 is the activation function (Usman et al., 2021). The final decision layer is represented with max or softmax logic in C (Usman et al., 2021).

For decision trees, each root-to-leaf path becomes a conjunction of predicates on attributes, again encoded directly in C (Usman et al., 2021). The framework supports non-binary inputs and multi-class outputs (Usman et al., 2021).

4. Safety and local robustness

QuantifyML extends beyond learnability to safety properties and local robustness (Usman et al., 2021). A safety property is written as $[x_j-\epsilon, x_j+\epsilon]$4, where $[x_j-\epsilon, x_j+\epsilon]$5 constrains inputs and $[x_j-\epsilon, x_j+\epsilon]$6 constrains model outputs (Usman et al., 2021). The framework defines two quantities: the portion of the input region for which the model satisfies the property, denoted QuantifyMLS, and the portion for which the model violates the property, denoted QuantifyMLN (Usman et al., 2021).

Local robustness is handled by fixing a region $[x_j-\epsilon, x_j+\epsilon]$7 around a specific input. In the paper’s formulation, $[x_j-\epsilon, x_j+\epsilon]$8 is defined by altering each component within a bounded interval, such as $[x_j-\epsilon, x_j+\epsilon]$9 (Usman et al., 2021). Robustness is then the fraction of points in that region for which the model preserves the label of interest (Usman et al., 2021).

This distinction between existence and fraction is important. Traditional verification often asks whether a counterexample exists. QuantifyML instead asks how much of the region satisfies or violates the relevant condition (Usman et al., 2021). For adversarial analysis, that yields a graded robustness measure rather than a Boolean certificate.

5. Empirical studies

The framework was evaluated on relational graph properties, MNIST local robustness, and ACAS Xu safety properties (Usman et al., 2021).

In the relational setting, QuantifyML was applied to $l \in \{1,\dots,L\}$0 graph properties over adjacency matrices with a scope of $l \in \{1,\dots,L\}$1 nodes, comparing decision trees and small neural networks trained on the same data (Usman et al., 2021). Several properties that appeared nearly perfect under statistical evaluation were substantially weaker under counting-based evaluation. For example, for the decision-tree model on PreOrder, statistical precision was $l \in \{1,\dots,L\}$2, but QuantifyML precision was $l \in \{1,\dots,L\}$3; statistical F1-score was $l \in \{1,\dots,L\}$4, but QuantifyML F1-score was $l \in \{1,\dots,L\}$5 (Usman et al., 2021). For Connex, the decision tree’s statistical accuracy was $l \in \{1,\dots,L\}$6, whereas QuantifyML accuracy was $l \in \{1,\dots,L\}$7; statistical recall was $l \in \{1,\dots,L\}$8, whereas QuantifyML recall was $l \in \{1,\dots,L\}$9 (Usman et al., 2021). These examples show that a model can look nearly perfect on sampled data while performing poorly over the full bounded domain (Usman et al., 2021).

For neural networks on the same graph tasks, QuantifyML often revealed weaker generalization than statistical metrics suggested. On Antisymmetric, statistical accuracy was $l$0, while QuantifyML accuracy was $l$1; statistical precision was $l$2, while QuantifyML precision was $l$3 (Usman et al., 2021). The paper reports that decision trees generalized better than neural networks across these relational tasks under QuantifyML metrics, even when statistical metrics were similar (Usman et al., 2021).

On MNIST, the framework quantified local robustness for a decision tree with $l$4 test accuracy (Usman et al., 2021). For labels $l$5, $l$6, and $l$7, the robustness fraction was reported as $l$8, while random sampling over $l$9, $1$0, and $1$1 perturbations misleadingly returned $1$2 (Usman et al., 2021). By contrast, labels $1$3, $1$4, and $1$5 showed low robustness, with reported values $1$6, $1$7, and $1$8, respectively (Usman et al., 2021). This demonstrates that the framework can expose adversarial fragility hidden by sample-based estimates.

On ACAS Xu, QuantifyML analyzed $1$9 published safety properties for a small $l$0-layer neural network trained to $l$1 test accuracy (Usman et al., 2021). The framework could compute counts even for properties whose precondition regions were absent from the test set. The paper reports that for properties $l$2, $l$3, and $l$4, no test inputs fell into the precondition region, yet QuantifyML still returned counts, and that “the neural network never satisfies property 4” (Usman et al., 2021).

6. Position, limitations, and research context

QuantifyML generalizes the “Model Counting meets Machine Learning” idea from binary decision trees to multi-class decision trees and neural networks, and extends the scope from learnability to safety and robustness (Usman et al., 2021). Its distinguishing feature is that it turns model evaluation into a projected model-counting problem over a finite domain (Usman et al., 2021).

The framework’s main limitation is scalability. CNFs generated by CBMC can become large, especially for neural networks and high-dimensional inputs, and exact counting is computationally hard (Usman et al., 2021). In the ACAS Xu study, ApproxMC used a $l$5-second timeout, and the paper reports timeouts for some analyses (Usman et al., 2021). For MNIST, partial evaluation and changing the representation of weights and biases from floats to longs reduced formula size, and making $l$6 of the pixels concrete led to a $l$7 decrease in the number of variables and a $l$8 decrease in the number of clauses, but the resulting formulas still remained challenging for model counters (Usman et al., 2021).

A further limitation is semantic rather than computational: the counts are always relative to a user-specified bounded domain (Usman et al., 2021). This makes QuantifyML precise within scope, but any conclusions depend on whether the chosen scope is representative of the problem of interest (Usman et al., 2021).

The term quantification also has a distinct meaning elsewhere in machine learning. In the prevalence-estimation literature, quantification denotes estimating test-data class proportions under shifts such as prior-probability shift (Firat, 2016), and this line has been extended to multi-label quantification (Moreo et al., 2022) and end-to-end bag-level prevalence estimation with Gaussian latent representations (Pérez-Mon et al., 23 Jan 2025). This suggests that QuantifyML is not a quantification method in that prevalence-estimation sense, but rather a counting-based framework for assessing trained models against formal specifications over bounded domains (Usman et al., 2021).