Verification of Neural Networks (Lecture Notes)

Abstract: These lecture notes provide an introduction to the verification of neural networks from a theoretical perspective. We discuss feed-forward neural networks, recurrent neural networks, attention mechanisms, and transformers, together with specification languages and algorithmic verification techniques.

• The paper establishes formal foundations for neural network verification by linking automata theory with LRA and NNL frameworks.
• It proves decidability for feed-forward ReLU networks while demonstrating NP-hard and undecidable cases for RNNs and richer activations.
• The work offers concrete reductions from 3SAT and outlines practical implications for designing verification pipelines for neural architectures.

Verification of Neural Networks: Theoretical Foundations and Decidability

Introduction and Motivation

With the pervasiveness of neural networks in safety-critical systems, the need for mathematically rigorous verification techniques has become acute. Unlike classical programs, neural networks are opaque artifacts generated by optimization rather than explicit code, complicating the task of providing formal post hoc guarantees. This lecture note (2604.25733) develops a systematic, formal perspective on neural network verification, with an emphasis on expressivity, specification languages, algorithmic verification, and the theoretical boundaries of tractability and decidability. The treatment spans feed-forward networks (including ReLU NNs), recurrent neural networks (RNNs), and transformer architectures, with extensive use of automata theory and formal logic.

Formal Specification Languages for Neural Networks

The work delineates the transition from natural-language properties to formal specification languages congruent with automated verification. It identifies linear real arithmetic (LRA) and neural network logic (NNL) as foundational. LRA provides a decidable first-order logic for real-valued constraints, supporting quantifiers, conjunctions, disjunctions, and linear terms. NNL extends LRA with a neural network predicate, facilitating input-output specifications at the functional level:

$N(\vec{x}) = \vec{y}$

where $N$ is a neural network, $\vec{x}$ its input, and $\vec{y}$ its output. This enables the formalization of properties such as permutation invariance/equivariance, fairness, robustness, max/sort function computation, and equivalence of networks over a domain.

The reduction of NNL formulas involving ReLU NNs to LRA formulas is formalized and shown to be effective. This yields concrete decidability results for classes of specifications on ReLU architectures.

Decidability and Complexity: The LRA-NNL Connection

A central technical contribution is the automata-theoretic proof of decidability for LRA and, by reduction, for ReLU-based NNL. Infinite words over a suitable alphabet encode real numbers, with B\"uchi automata used to recognize sets of numbers defined by LRA formulas. Atomic real-valued operations (addition, scalar multiplication, equality, order) are encoded via effective automata constructions, enabling logical connectives and quantifiers to be simulated via automata-theoretic closure properties and projection. Emptiness of the resulting automaton corresponds to validity of the logical formula.

The complexity is tightly characterized for important fragments. The existential quantifier-free fragment (existential NNL) is shown to be NP-complete, while universal NNL is coNP-complete, aligning with the complexity of SMT solving for LRA. The reachability fragment (verification of input-output existence with polyhedral pre/post conditions) is NP-hard for ReLU-based architectures:

Figure 1: Neural network architecture for encoding 3CNF-SAT in reachability, used in the NP-hardness reduction.

This result hinges on an explicit reduction from 3SAT to the reachability property of a shallow ReLU network.

Beyond ReLU: Hardness and Expressive Power

When extending beyond ReLU activation (e.g., to $\tanh$, sigmoid, or functions involving exponentiation), verification quickly crosses into undecidable territory. The theory establishes the effective equivalence between NNL with these activation functions and the first-order theory of the real exponential field. The latter's decidability is a prominent open problem, with no known effective procedure.

Despite this, the work provides formal reductions in both directions, showing that any property expressible in the real exponential field can be encoded in neural network verification with sufficiently rich activation functions, and vice versa. This marks a concrete barrier at the expressive boundary of ReLU and related piecewise-linear activations.

RNNs: Undecidability Emerges

The notes present a decisive negative result: while feed-forward ReLU networks allow for decidable verification, verification for RNNs is undecidable, even for minimal architectures using piecewise-linear activation and real-valued weights. Via a series of constructions, it is shown that RNNs can simulate probabilistic finite automata (PFAs), whose language emptiness problem is undecidable for threshold-style acceptance. The simulation is made precise through a gadget construction that transforms arbitrary PFAs (after state augmentation) into RNNs that reflect the measure computation through their dynamics. Thus, for an RNN with one output and threshold acceptance,

Figure 2: Augmented PFA construction where transitions are distributed so each state has a unique incoming letter type, restructuring to support RNN simulation.

the language non-emptiness (i.e., is there an input string yielding output above/below/equal to a threshold) is undecidable.

Expressivity and Verification of Transformers

The notes examine multi-head self-attention and transformer architectures, highlighting that transformers are not only empirically powerful but can compute and recognize functionally complex properties. The notes provide illustrative constructions of encoder-only transformers implementing $argmax^*$, sorting, and recognition of context-free languages (e.g., Dyck-1), showing competitive expressivity with automata-based models.

Figure 3: Schematic of a single attention head $H=(Q,K,V)$, depicting query, key, and value transformations, with attention weights computed as softmax of the compatibility scores.

Figure 4: A multi-head attention layer with masked self-attention, controlling information flow in sequential positions and enabling causal modeling.

Figure 5: Transformer architecture that implements $argmax^*$ over sequences, combining structured attention with tailored feed-forward blocks.

While verification for unrestricted transformers is Turing-hard (and thus undecidable), fixed-depth and specialized attention variants may admit tractable analysis, a direction highlighted for future investigation.

Numerical, Formal, and Complexity Highlights

• The automata-theoretic method yields decision procedures for LRA and ReLU NNL with elementary complexity for fixed quantifier alternation; existential fragments are NP-complete.
• For the reachability property in ReLU NNs, the reduction from 3SAT (NP-hard) is explicit and realized via carefully engineered weight matrices and combinatorial logic in the architecture.
• Any increase in activation class expressivity beyond piecewise linearity (e.g., involving exponentials) immediately collapses verification into the open/undecidable regime of real exponential theory.
• For RNNs, the sharp undecidability result applies for even two-layer Elman-type networks, inherited from the undecidability of the isolated cut-point language problem for PFAs.

Implications and Open Directions

This work provides a detailed cartography of the theoretical landscape for neural network verification, separating recursively-verifiable architectures from those crossing into the territory of undecidability. The decidability and complexity results inform the design of verification pipelines, SMT-based solvers, and abstraction techniques. The explicit automata-theoretic reductions suggest pathways for algorithmic implementation in verification engines, and complexity bounds calibrate practical expectations.

On the theoretical side, the expressivity analysis for transformers and the complexity separation between ReLU and richer nonlinear activation functions direct future work towards:

• Identifying maximal classes of practically relevant NNs with tractable/decidable verification
• Abstraction and over-approximation methods for RNNs and transformers, e.g., via finite-state or automata-theoretic summaries
• New specification languages and logics balancing expressivity against automated reasoning for structured neural architectures

Conclusion

This work (2604.25733) establishes precise semantic and algorithmic foundations for the formal verification of neural networks, systematically charting the boundary between decidability and undecidability in both architecture and specification language. It leverages methods from logic, automata theory, and SMT, producing both upper and lower bounds, concrete reductions, and constructions for network simulation and encoding. It points towards a nuanced, principle-driven approach for the future development of verification techniques tailored to the next generation of neural architectures.