Dissertation Proposal

Scalable and Trustworthy
Neural Network Verification

Hai Duong

Department of Computer Science · George Mason University

Committee
ThanhVu Nguyen (Chair)
Lishan Yang
Keren Zhou
Mary Cummings
Matthew Dwyer (University of Virginia)

DNNs Are Powerful

1theorem gauss (n : Nat) :

2 2 * (List.range (n + 1)).sum = n * (n + 1) := by

3 induction n with

4 | zero => rfl

5 | succ k ih => grind [List.range_succ]

No goals

Make slides for my dissertation proposal.

Dissertation Proposal

Scalable and Trustworthy
Neural Network Verification

Hai Duong

Department of Computer Science · George Mason University

Committee
ThanhVu Nguyen (Chair)
Lishan Yang
Keren Zhou
Mary Cummings
Matthew Dwyer (University of Virginia)

DNNs Are Powerful but Fragile

A safety-critical use

Self-driving: a DNN reads the sign

Surprising failures

input

DNN reads

Stickers

✗

Imperceptible noise

✗

Slight motion blur

✗

Testing: Samples Can Miss Failures

x₀

missed by testing

region X: all inputs within ε of x₀ (ℓ_∞ ball)

Testing runs the DNN on samples.

All 10 samples pass.

A failure hides in between.

Verification: Every Input in X

x₀

counterexample x′

region X: all inputs within ε of x₀ (ℓ_∞ ball)

It reasons about every input in X.

Here: SAT. It returns x′.

Without a violation: UNSAT, a proof for all of X.

How Verification Works: Abstraction

input region X

DNN

class STOP

other classes

reachable outputs

The exact reachable outputs are intractable to compute.

How Verification Works: Abstraction

input region X

DNN

class STOP

other classes

over-approximation

reachable outputs

Abstraction computes an over-approximation instead.

Inside the correct class ⇒ the property holds ✓

∀ x ∈ X : argmax DNN(x) = STOP

What If the Abstraction Is Too Loose?

input region X

DNN

class STOP

other classes

over-approximation

reachable outputs

The over-approximation can cross the boundary.

? Unknown: the abstraction cannot decide

Why Loose? Non-Linear Activations

z₁

upper bound

lower bound

Over-approximation for non-linear activations

The DNN verifier over-approximates ReLU.

It encloses the ReLU region with two linear bounds.

Shaded area = ReLU + spurious points.

Branch: Split the If-Then-Else

z₁

upper bound

lower bound

Case 1: z₁ ≤ 0

Case 2: z₁ > 0

Branch: split on the sign of z₁.

Linear cases: no new over-approximation.

Two subproblems: z₁ ≤ 0 and z₁ > 0.

Abstraction Again: Each Case Is Tighter

z₁

class STOP

other classes

z₁ ≤ 0

z₁ > 0

✓

verified

too loose: split again (z₂)

Each subproblem keeps all of X and fixes the sign of z₁.

Each abstraction is tighter than before.

Branch and Bound

✓

✓ verified by its abstractiontoo loose: split

Bound (compute abstraction) each subproblem first.

Branch only where the abstraction is too loose.

The problem is verified once all leaves are verified.

Why Verification Does Not Scale

n ReLUs: 2ⁿ subproblems

Deep models: abstraction exceeds memory

Too many subproblems, and computing abstraction for each is too expensive.

Thesis and Contributions✓ 8 published or accepted

DNN verification can scale, express real-world properties, and be checked.

Part I · Scalability

NeuralSATclause learning from conflicts

✓ CAV'25

VeriStableneuron stabilization

✓ FSE'24

Rsblearns which ReLU to split next

✓ NeurIPS'26

CoVeNNassume-guarantee over subnetworks

✓ NeurIPS'25Spotlight

Part II · Expressiveness

VeriSstructural perturbations as layers

✓ FSE'26

VeriDouevery blur kernel plus noise

✓ CVPR'26Highlight

Part III · Trustworthiness

APTPBaB proofs + an 800-line checker

✓ NeurIPS'25

LeanVIPRchecks MIP certificates in Lean

✓ NeurIPS'26 Workshop

Outline

Part I · Scalability

Part II · Expressiveness

Part III · Trustworthiness

Completed and Proposed Work

Tackling the Exponential Search TreePart I · Scalability

Rsb learns which neuron to split first.

NeuralSAT learns from conflicts; VeriStable stabilizes neurons.

CoVeNN computes abstraction in GPU memory.

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

NeuralSAT and VeriStable: Prune the Tree✓ FSE'24✓ CAV'25TSE · submitted

NeuralSAT learns the clause z₂ > 0 from the conflict: both z₂ ≤ 0 cases are pruned.

VeriStable: once z₁ and z₂ are decided, z₃ is stable, so it needs no split.

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

NeuralSAT: Results✓ CAV'25TSE · submitted

2,611

instances solved, the most of all tools

Instances solved: all VNN-COMP'25 and RNN benchmarks

NeuralSAT

2,611

αβ-CROWN

VNN-COMP winner

2,387

BICCOS

αβ-CROWN variant, simpler networks

1,836

Marabou

SMT-based

1,497

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Rsb: Learned Branching✓ NeurIPS'26 · accepted

The branching order decides the size of the search tree.

z₁

z₂

z₃

input

layer 1

layer 2

output

unstablesplitstable

✓

FSB (hand-crafted): 2 splits, 4 branches

FSB greedily splits z₂ first. The abstraction is not tight enough, so it splits again.

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Rsb: Learned Branching✓ NeurIPS'26 · accepted

The branching order decides the size of the search tree.

z₁

z₂

z₃

input

layer 1

layer 2

output

unstablesplitstable

✓

Rsb (learned): 1 split, 2 branches

Rsb splits z₁ first. The abstraction gets tighter.

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Rsb: How It Learns✓ NeurIPS'26 · accepted

Rsb produces weights a that rescale the FSB scores ω.

FSB score ω per unstable neuron

z₁

×0.6

0.3

z₂

×0.3

0.5

z₃

×0.1

0.1

split

FSB splits z₂: 2 splits, 4 branches

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Rsb: How It Learns✓ NeurIPS'26 · accepted

Rsb produces weights a that rescale the FSB scores ω.

rescaled score a × ω

z₁

×0.6

0.3

0.18

z₂

×0.3

0.5

0.15

z₃

×0.1

0.1

0.01

split

Rsb splits z₁: 1 split, 2 branches

Actor network

picks which neuron to split

BaB verifier

environment

reward

weights a

reward: −1 per unverified subproblem

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Rsb: Results✓ NeurIPS'26 · accepted

+11%

instances solved vs. FSB

−50%

branches explored vs. FSB

Instances solved, 600 hard instances

Rsb

165

FSB

148

UPB

133

Polarity

Also generalizes to unseen architectures (CNN) and activations (Sigmoid).

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Deep Networks Exhaust GPU Memory

GPU memory
24 GB

OOM ✗

residual blocks

SOTA verifiers compute abstraction for the whole network at once.

αβ-CROWN and NeuralSAT run out of memory beyond 9 ResNet blocks.

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

CoVeNN: Assume-Guarantee Verification✓ NeurIPS'25Spotlight

GPU memory
24 GB

fits ✓

guarantee
→
assumption

subnetwork 1

subnetwork 2

subnetwork 3

Assume an input range, prove an output range, then pass it to the next subnetwork.

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

CoVeNN: Results✓ NeurIPS'25Spotlight

~7×

Outline

Part I · Scalability

Part II · Expressiveness

Part III · Trustworthiness

Completed and Proposed Work

Beyond Local Robustness

SOTA verifiers target local robustness (LR): independent bounded noise per input.

Original

ℓ_∞ noise

Motion blur

Scaling

Audio echo

ℓ₂ ∩ halfspace

Bit flips

✓ LR

✗ not LR

In these perturbations, the inputs are correlated.

Structural Robustness via LR✓ FSE'26✓ CVPR'26Highlight

Spec: for all variants of motion blur from all angles 0° to 90°, plus noise, still STOP?

0°

30°

45°

60°

90°

···

one property covers all of these

verifier input

blur angle, noise

→

perturbation layer

encodes blur + noise

new network

→

SOTA verifier

✓ an LR problem

intervals on the input

We turn structural robustness (SR) into local robustness (LR).

Scaling, blur and echo are structured perturbations. They couple input elements, so verifiers cannot encode them as intervals. VeriS encodes the structural perturbation as layers prepended to the DNN. How much of it is applied becomes a few parameters in intervals. The result is an LR problem that existing verifiers solve. They solve 78 percent of 5,508 structural robustness problems they could not encode before. VeriS fixes the kernel, for example blur at one angle. VeriDou turns the kernel entries themselves into variables in intervals, so one property covers every kernel in a range, every angle at once, plus independent pixel noise. It is still an LR problem for existing verifiers. On CIFAR-100, at the same perceptual budget, noise alone finds no counterexamples, predefined kernels find 39 percent, every kernel finds 70 percent, and every kernel plus noise finds 99 percent. Across networks, dual perturbations find counterexamples in up to 99 percent of cases.

Structural Robustness: Applications✓ FSE'26✓ CVPR'26Highlight

echo

Audio

voice-command recognition

echo, low/high-pass filters, time warping

time warp

Health

ECG heart-rhythm monitoring

echo, low/high-pass filters, time warping

blur, scaling, rain, rotation

Image

object recognition

motion blur, scaling, rain drops, rotation

Structural robustness is now verifiable for audio, health and image models.

Outline

Part I · Scalability

Part II · Expressiveness

Part III · Trustworthiness

Completed and Proposed Work

Who Verifies the Verifier?

Verifier returns

✗ SAT

a counterexample x′

Replay DNN(x′) to confirm it.

✓ checkable

Verifier returns

✓ UNSAT

no evidence

Trust 20K+ lines of code.

✗ not checkable

VNN-COMP has found tools that claimed UNSAT when a counterexample existed.

Trusting a Large Verifier

Verifier

20K+ lines · many optimizations

→

✓ UNSAT

The whole verifier is trusted. One bug yields a false UNSAT.

APTP: Proof-Producing Verification✓ NeurIPS'25

Verifier

untrusted

→

APTPchecker

800 lines

→

✓ checked

→

MILP solver

checks one branch

uses

→

✓ infeasible

LeanVIPR: A Verified Certificate Checker✓ NeurIPS'26 Workshop · accepted

DNN verifier

20K+ lines

checked by
→

APTPchecker

800 lines

relies on
→

MILP solver

unverified

APTPchecker relies on an unverified MILP solver.

MILP solvers can return wrong answers, e.g., from floating-point rounding.

LeanVIPR: A Verified Certificate Checker✓ NeurIPS'26 Workshop · accepted

DNN verifier

20K+ lines

checked by
→

APTPchecker

800 lines

relies on
→

MILP solver

unverified

emits
→

VIPR certificate

proof of the result

checked by
→

LeanVIPR

proved in Lean

MILP solvers emit VIPR certificates.

LeanVIPR replays them in exact rational arithmetic.

If LeanVIPR accepts a certificate, then the MILP result holds.

Outline

Part I · Scalability

Part II · Expressiveness

Part III · Trustworthiness

Completed and Proposed Work

Part I · Scalability

completed

NeuralSAT✓ CAV'25

VeriStable✓ FSE'24

Rsb✓ NeurIPS'26

CoVeNN✓ NeurIPS'25Spotlight

proposed

Direction 1: GPT models

abstract domain for verifying GPT models

Part II · Expressiveness

completed

VeriS✓ FSE'26

VeriDou✓ CVPR'26Highlight

proposed

Direction 2: Constrained inputs

input regions like ℓ₂ ball ∩ halfspace

Direction 3: Bit flips

bits flip in multiple parameters at once

Part III · Trustworthiness

completed

APTP✓ NeurIPS'25

LeanVIPR✓ NeurIPS'26 Workshop

proposed

Direction 4: VIPR proofs

soundness, completeness, termination

Real-World Application · Amazon Prime Air

proposed

verify the object detectors of delivery dronesbuilds onPart IPart IIPart III

Amazon Prime Air Drones: Object Detectionplanned · Oct 2026 – Jan 2027

Their delivery drones run object detectors.

Expressiveness

new spec: objects stay located under perturbation

▬ true box ▬ detected box, one per perturbed image

Scalability

large detectors, e.g., YOLO and SSD

Trustworthiness

certified verification results in Lean

Thank you!

Backup Slides

VeriStable: results ✓ FSE'24

APTP: results ✓ NeurIPS'25

ZonoGPT: verifying transformers ICLR'27 · submitted

CLAD: constrained input regions ICLR'27 · submitted

mBFV: multi-parameter bit flips ICLR'27 · submitted

VeriStable: Results✓ FSE'24

12×

more hard problems solved than base DPLL(T) (48 vs. 4)

94%

of the 51 hard problems solved (48)

MNIST_GDVB: hard problems solved, of 51

base DPLL(T)

+ stabilization

+ parallel

+ parallel + restarts

+ stabilization + parallel

+ stabilization + parallel + restarts

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

APTP: Results✓ NeurIPS'25

Works across verifiers

384 / 400NeuralSAT

366 / 368α,β-CROWN

proofs validated

400 UNSAT problems, 16 DNNs

Faster checking

20×

faster than Marabou’s checker

same 54 proofs
median 9 s vs 204 s

Finds real bugs

False UNSAT

caught in NeuralSAT

the checker found a counterexample

One checker validates proofs from different verifiers and catches real bugs.

CoVeNN on Transformers: Intervals Are Too Loose

mean

variance

divide

LayerNorm

QKᵀ

softmax

Attention

MLP

subnetwork 1

mean

variance

divide

LayerNorm

QKᵀ

softmax

Attention

MLP

subnetwork 2

passed on as

interval

one input, used twice

LayerNorm: h − mean(h)

Attention: (W_Q h) · (W_K h)

reachable values vs. interval bound

Block 1

Block 2

Block 3

⋮

Block 24

too loose ✗

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

ZonoGPT: Fixed-Size ZonotopesICLR'27 · submitted

mean

variance

divide

LayerNorm

QKᵀ

softmax

Attention

MLP

subnetwork 1

mean

variance

divide

LayerNorm

QKᵀ

softmax

Attention

MLP

subnetwork 2

passed on as

zonotope

one input, used twice

LayerNorm: h − mean(h)

Attention: (W_Q h) · (W_K h)

reachable values vs. zonotope bound

Block 1

Block 2

Block 3

⋮

Block 24

tight ✓

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

ZonoGPT: ResultsICLR'27 · submitted

GPT-2

first verified, up to GPT-2 Medium

46.5%

of 2,880 text and vision instances verified

Verified on models with 3+ blocks, of 2,160

fused attention

867

unfused (D)

unfused (M)

Fused attention makes deep transformers verifiable.

Part I

1 · prune the tree

2 · branch smarter

3 · compute abstraction at scale

Constrained Input Regions

X = ℓ₂ ball ∩ halfspace

DNN

property holds

violated

reachable outputsover-approximation

Inputs: an ℓ₂ ball cut by a halfspace.

SOTA cannot encode the extra constraint.

SOTA: Enclose the Region in a Box

infeasible

tightest ℓ_∞ box around X

DNN

property holds

violated

reachable outputsover-approximation

? Unknown: crosses the boundary

SOTA computes abstraction over the ℓ_∞ box.

The box adds infeasible inputs.

CLAD: Constrained Abstract DomainICLR'27 · submitted

CLAD computes abstraction over X itself

DNN

property holds

violated

reachable outputsover-approximation

✓ Verified

CLAD propagates the constraints.

Lagrangian relaxation: tighter abstraction.

CLAD: ResultsICLR'27 · submitted

+22%

verified overall (1,146 vs. 939)

3.3×

on ConvLarge (59 vs. 18)

Instances verified per network

GCP-CROWNCLAD

ConvSmall (M)

300

358

ConvSmall (C)

315

375

ConvDeep

306

354

ConvLarge

Also ~60% more ℓ₂-ball instances, at a runtime close to GCP-CROWN.

mBFV: Multi-Parameter Bit FlipsICLR'27 · submitted

Rowhammer or radiation flips parameter bits.

Real attacks flip 2 to 24 bits.

SOTA (BFAVerifier) handles 1 flipped parameter.

Only 61% of 1-flip verified instances survive 4 flips.

A 5,000-parameter network has 12.5M parameter pairs.

output change from each flipped parameter

parameters

Enumerating all combinations is infeasible.

Exact MILP covers them but does not scale.

mBFV: Multi-Parameter Bit FlipsICLR'27 · submitted

Key idea: sum the m largest contributions.

This computes abstraction for every combination at once.

BaB over flip locations tightens the abstraction.

Subproblems grow polynomially with neurons.

m = 2: worst case = sum of the top 2

parameters, sorted

mBFV: ResultsICLR'27 · submitted

7.7×

more instances verified than BFAVerifier (293 vs. 38)

1.15M

parameters, up to 4 flips (SOTA: 13K parameters, 1 flip)

Instances verified, of 625

mBFV

293

mBFV without BaB

184

BFAVerifier (SOTA)

exact MILP

Exact MILP verifies none. BaB over flip locations adds 109 instances.

Scalable and TrustworthyNeural Network Verification

DNNs Are Powerful

DNNs Are Powerful but Fragile

Testing: Samples Can Miss Failures

Verification: Every Input in X

How Verification Works: Abstraction

How Verification Works: Abstraction

What If the Abstraction Is Too Loose?

Why Loose? Non-Linear Activations

Branch: Split the If-Then-Else

Abstraction Again: Each Case Is Tighter

Branch and Bound

Why Verification Does Not Scale

Thesis and Contributions✓ 8 published or accepted

Outline

Tackling the Exponential Search TreePart I · Scalability

NeuralSAT and VeriStable: Prune the Tree✓ FSE'24✓ CAV'25TSE · submitted

NeuralSAT: Results✓ CAV'25TSE · submitted

Rsb: Learned Branching✓ NeurIPS'26 · accepted

Rsb: Learned Branching✓ NeurIPS'26 · accepted

Rsb: How It Learns✓ NeurIPS'26 · accepted

Rsb: How It Learns✓ NeurIPS'26 · accepted

Rsb: Results✓ NeurIPS'26 · accepted

Deep Networks Exhaust GPU Memory

CoVeNN: Assume-Guarantee Verification✓ NeurIPS'25Spotlight

CoVeNN: Results✓ NeurIPS'25Spotlight

Outline

Beyond Local Robustness

Structural Robustness via LR✓ FSE'26✓ CVPR'26Highlight

Structural Robustness: Applications✓ FSE'26✓ CVPR'26Highlight

Outline

Who Verifies the Verifier?

Trusting a Large Verifier

APTP: Proof-Producing Verification✓ NeurIPS'25

LeanVIPR: A Verified Certificate Checker✓ NeurIPS'26 Workshop · accepted

LeanVIPR: A Verified Certificate Checker✓ NeurIPS'26 Workshop · accepted

Outline

Completed and Proposed Work

Amazon Prime Air Drones: Object Detectionplanned · Oct 2026 – Jan 2027

Backup Slides

VeriStable: Results✓ FSE'24

APTP: Results✓ NeurIPS'25

CoVeNN on Transformers: Intervals Are Too Loose

ZonoGPT: Fixed-Size ZonotopesICLR'27 · submitted

ZonoGPT: ResultsICLR'27 · submitted

Constrained Input Regions

SOTA: Enclose the Region in a Box

CLAD: Constrained Abstract DomainICLR'27 · submitted

CLAD: ResultsICLR'27 · submitted

mBFV: Multi-Parameter Bit FlipsICLR'27 · submitted

mBFV: Multi-Parameter Bit FlipsICLR'27 · submitted

mBFV: ResultsICLR'27 · submitted

Scalable and Trustworthy
Neural Network Verification