Saif R. Kazi

Mohamad Fares El Hajj Chehade, Wenting Li, Brian W. Bell et al.

The robustness of neural networks is crucial in safety-critical applications, where identifying a reliable input space is essential for effective model selection, robustness evaluation, and the development of reliable control strategies. Most existing robustness verification methods assess the worst-case output under the assumption that the input space is known. However, precisely identifying a verifiable input space \(\mathcal{C}\), where no adversarial examples exist, is challenging due to the possible high dimensionality, discontinuity, and non-convex nature of the input space. To address this challenge, we propose a novel framework, **LEVIS**, consisting of **LEVIS-α** and **LEVIS-\b{eta}**. **LEVIS-α** identifies a single, large verifiable ball that intersects at least two boundaries of a bounded region \(\mathcal{C}\), while **LEVIS-\b{eta}** systematically captures the entirety of the verifiable space by integrating multiple verifiable balls. Our contributions include: (1) introducing a verification framework that uses mixed-integer programming (MIP) to compute nearest and directional adversarial points, (2) integrating complementarity-constrained (CC) optimization with a reduced MIP formulation for scalability, achieving up to a 6 times runtime reduction, (3) theoretically characterizing the properties of the verifiable balls obtained by **LEVIS-α**, and (4) validating the approach across applications including electrical power flow regression and image classification, with demonstrated performance gains and geometric insights into the verifiable region.

Wenting Li, Saif R. Kazi, Russell Bent et al.

Neural networks achieve strong empirical performance, but robustness concerns still hinder deployment in safety-critical applications. Formal verification provides robustness guarantees, but current methods face a scalability-completeness trade-off. We propose a hybrid verifier in a branch-and-bound (BaB) framework that efficiently tightens both upper and lower bounds until an $ε-$global optimum is reached or early stop is triggered. The key is an exact nonlinear program with complementarity constraints (NLP-CC) for upper bounding that preserves the ReLU input-output graph, so any feasible solution yields a valid counterexample and enables rapid pruning of unsafe subproblems. We further accelerate verification with (i) warm-started NLP solves requiring minimal constraint-matrix updates and (ii) pattern-aligned strong branching that prioritizes splits most effective at tightening relaxations. We also provide conditions under which NLP-CC upper bounds are tight. Experiments on MNIST and CIFAR-10 show markedly tighter upper bounds than PGD across perturbation radii spanning up to three orders of magnitude, fast per-node solves in practice, and substantial end-to-end speedups over MIP-based verification, amplified by warm-starting, GPU batching, and pattern-aligned branching.