CNML: Contrastive Neural Model Checking

• CNML is a bi-encoder representation learning framework that aligns sequential circuits and LTL specifications in a shared latent space via contrastive model checking outcomes.
• The approach leverages symbolic model checking to generate supervision signals, enabling effective cross-modal retrieval and downstream classification tasks.
• Empirical results show that CNML outperforms traditional baselines, achieving higher retrieval accuracy and improved classification metrics in neural-symbolic verification.

Searching arXiv for the specified papers and closely related work to ground the article. Contrastive Neural Model Checking (CNML) is a bi-encoder representation learning framework introduced for learning embeddings of sequential circuits in AIGER format and specifications in Linear Temporal Logic (LTL) in a shared latent space, using the model checking task itself as a self-supervised contrastive objective. Rather than replacing symbolic model checking for sound verification, CNML uses model checking outcomes as supervision to learn semantically meaningful embeddings, so that if a circuit $c$ satisfies a specification $\varphi$, their embeddings are close, and if $c \not\models \varphi$, their embeddings are far. The resulting shared space is used for cross-modal retrieval, intra-modal retrieval, and downstream tasks such as predicting satisfaction $c \models \varphi$ as a classification task (Krsmanovic et al., 2 Oct 2025).

1. Definition and semantic scope

CNML is organized around the classical decision problem

$S \models \varphi\;?$

for a system $S$ and a temporal-logic specification $\varphi$. In the CNML formulation, the satisfaction relation is not treated as the final output of a neural verifier. Instead, it is treated as a guiding signal for representation learning. The paper explicitly distinguishes this objective from symbolic model checking with full soundness guarantees: classical model checking remains algorithmic and symbolic, whereas CNML uses symbolic model checking only to generate labels, then treats model checking as a contrastive learning signal (Krsmanovic et al., 2 Oct 2025).

The central idea is a joint embedding space $\mathbb{R}^d$ in which systems and specifications are aligned by semantics rather than surface form. The target geometry is given by

$$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$

with high similarity for positive pairs $(c,\varphi)$ such that $\varphi$0, and low similarity for negative pairs $\varphi$1 such that $\varphi$2. The paper describes this as analogous to CLIP-style joint vision–LLMs, but for formal languages and hardware circuits rather than images and text. A plausible implication is that CNML reframes verification semantics as an alignment problem between two formal modalities.

This positioning also clarifies a common misconception. CNML does not claim to provide sound verification. The learned embeddings capture a soft approximation of the satisfaction relation; for verification, the method is described as a search or heuristics tool, including retrieval, prioritization, or pretraining, rather than as a replacement for model checking (Krsmanovic et al., 2 Oct 2025).

2. Formal setting: LTL specifications and AIGER circuits

The specification language is Linear-time Temporal Logic over atomic propositions $\varphi$3, with syntax

$\varphi$4

for $\varphi$5, together with derived Boolean operators $\varphi$6 and temporal operators Release, Globally, and Eventually. Semantics are given over infinite traces $\varphi$7, and satisfaction $\varphi$8 is defined inductively. The work uses an assume–guarantee normal form,

$\varphi$9

but, unlike earlier hierarchical-transformer work, all assumptions and guarantees are merged into a single LTL formula string fed to the text encoder (Krsmanovic et al., 2 Oct 2025).

Systems are sequential circuits represented as And-Inverter Graphs encoded in AIGER. AIGER describes Boolean variables encoded as integers, where even integers denote a signal and the subsequent odd integer denotes its negation. Inputs use a single integer variable per input, outputs use a single integer variable per output, AND-gates use three integers with conjunction semantics, and latches use two integers, with latch output at time $c \not\models \varphi$0 equal to its input at time $c \not\models \varphi$1 and initialized to FALSE. The header has the form

$c \not\models \varphi$2

with $c \not\models \varphi$3 the maximum variable index, and $c \not\models \varphi$4, $c \not\models \varphi$5, $c \not\models \varphi$6, $c \not\models \varphi$7 the numbers of inputs, latches, outputs, and AND gates respectively (Krsmanovic et al., 2 Oct 2025).

The induced semantics is a transition system over latch valuations and input valuations, and the model checking relation is

$c \not\models \varphi$8

meaning that for all input traces, the resulting output traces satisfy the LTL formula $c \not\models \varphi$9. In the machine-learning setup, an off-the-shelf model checker determines whether a pair is positive, $c \models \varphi$0, or negative, $c \models \varphi$1. CNML uses only known positives for training, together with implicit negatives within minibatches. This choice is structurally important because the supervision signal is derived from known satisfying pairs rather than from exhaustive positive–negative labeling.

3. Architecture and contrastive objective

CNML is a bi-encoder model with a circuit encoder $c \models \varphi$2 and a specification encoder $c \models \varphi$3, with no shared parameters. Each encoder is initialized from CodeBERT and treated as a text encoder: circuits and specifications are both provided as token sequences, specifically AIGER text and LTL text. For a pair $c \models \varphi$4, the circuit and specification are separately encoded into pooled vectors $c \models \varphi$5, then projected into a $c \models \varphi$6-dimensional space: $c \models \varphi$7 The vectors are normalized to unit length for cosine similarity,

$c \models \varphi$8

The use of two separate encoders is described as deliberate: it forces each encoder to model its own modality well, enforces alignment only via the contrastive objective rather than parameter sharing, and helps reduce overfitting to syntactic or dataset-artifact shortcuts (Krsmanovic et al., 2 Oct 2025).

For a minibatch of $c \models \varphi$9 positive pairs $S \models \varphi\;?$0, CNML builds an $S \models \varphi\;?$1 similarity matrix

$S \models \varphi\;?$2

Diagonal entries $S \models \varphi\;?$3 are positive pairs; off-diagonal entries $S \models \varphi\;?$4, $S \models \varphi\;?$5, are treated as negative pairs, under the assumption that different circuit–specification pairs in a minibatch almost never satisfy each other. The objective is to maximize diagonal similarity and minimize off-diagonal similarity (Krsmanovic et al., 2 Oct 2025).

The loss is

$S \models \varphi\;?$6

where $S \models \varphi\;?$7 is a symmetric contrastive cross-entropy loss, $S \models \varphi\;?$8 is representation similarity regularization, and $S \models \varphi\;?$9. The contrastive component follows an InfoNCE-style formulation with temperature scaling $S$0, initial $S$1, and symmetric row-wise and column-wise cross-entropy. The regularization term is adopted to stabilize training, avoid overfitting, and allow a higher learning rate without catastrophic forgetting in BERT-like encoders. The paper does not expand the full formula for $S$2, but states that the general idea is to penalize excessive changes in the similarity structure of embeddings across training (Krsmanovic et al., 2 Oct 2025).

4. Data generation, training regime, and evaluation protocol

A core contribution is the synthetic dataset

$S$3

The generation process has three stated steps. First, LTL formulas are produced by adapting the formula generation technique from Schmitt et al. (2021) to obtain diverse, semantically meaningful assume–guarantee specifications. Second, for each specification, a circuit is synthesized that by construction satisfies the specification using the Strix LTL synthesis tool of Meyer et al. (2018) and existing synthesis pipelines to generate varied AIGER circuits. Third, two augmentation measures are applied to avoid syntactic shortcuts: assumption shuffling, which permutes the order of assumption subformulas within a specification, and fixed IO width, which enforces a uniform number of input and output wires across all circuits, even if unused (Krsmanovic et al., 2 Oct 2025).

For generalization experiments, the paper derives a second dataset, cnml-split, through formula splitting. If

$S$4

and $S$5, then for any individual guarantee $S$6,

$S$7

This makes it possible to transform complex multi-guarantee specifications into multiple single-guarantee specifications while keeping the circuit fixed. The resulting dataset is used to train CNML-simple, which sees only single-guarantee formulas during pre-training (Krsmanovic et al., 2 Oct 2025).

Batch construction is performed greedily at the start of each epoch to ensure no duplicate circuits or specifications within a batch, and off-diagonal pairs are cross-checked against the full dataset to reduce the chance that an off-diagonal pair is actually a known positive. The reported false-negative rate is approximately $S$8. The optimization stack is PyTorch 2.3 and HuggingFace Transformers, with CodeBERT backbones, projection dimension $S$9, AdamW with $\varphi$0, $\varphi$1, weight decay $\varphi$2, learning rate $\varphi$3, linear warm-up for $\varphi$4 steps, linear decay, per-GPU batch size $\varphi$5, gradient accumulation $\varphi$6, and $\varphi$7A100 GPUs under DDP with mixed precision. Training time is reported as approximately $\varphi$8 hours to the best checkpoint on cnml-base for CNML-base (Krsmanovic et al., 2 Oct 2025).

The evaluation protocol centers on retrieval tasks and a downstream classification task. Cross-modal retrieval asks either for circuits satisfying a given specification or for specifications satisfied by a given circuit. Intra-modal retrieval asks for circuits that are functionally similar in the sense of satisfying roughly the same specifications. Retrieval datasets are drawn from the test split of cnml-base at candidate-set sizes $\varphi$9 and $\mathbb{R}^d$0, with exactly one satisfying match per batch. The metrics are Mean Reciprocal Rank, Mean Rank, Recall@1\%, and Recall@10\%. Baselines include bag-of-keywords, Weisfeiler–Lehman Graph Kernel, an unadapted CodeBERT encoder, and Siamese-CNML (Krsmanovic et al., 2 Oct 2025).

5. Empirical behavior and learned representation structure

On cross-modal retrieval, CNML-base substantially outperforms the reported baselines. For $\mathbb{R}^d$1, CNML-base achieves MRR $\mathbb{R}^d$2, MR $\mathbb{R}^d$3, R@1\% $\mathbb{R}^d$4, and R@10\% $\mathbb{R}^d$5, compared with the CodeBERT baseline at MRR $\mathbb{R}^d$6, MR $\mathbb{R}^d$7, R@1\% $\mathbb{R}^d$8, and R@10\% $\mathbb{R}^d$9. For $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$0, CNML-base reports MRR $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$1, MR $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$2, R@1\% $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$3, and R@10\% $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$4. CNML-simple is weaker than CNML-base but remains above non-CNML baselines on the reported tasks. The paper states that CNML-base clearly dominates baselines as problem size grows (Krsmanovic et al., 2 Oct 2025).

On intra-modal circuit retrieval, CNML-base also exceeds algorithmic and neural comparators. For $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$5, CNML-base obtains MRR $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$6, MR $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$7, R@1\% $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$8, and R@10\% $$z_c = f_{\text{circuit}}(c), \quad z_\varphi = f_{\text{spec}}(\varphi),$$9, while the best algorithmic baseline, Weisfeiler–Lehman, gives MRR $(c,\varphi)$0, MR $(c,\varphi)$1, R@1\% $(c,\varphi)$2, and R@10\% $(c,\varphi)$3. For $(c,\varphi)$4, CNML-base records MRR $(c,\varphi)$5, MR $(c,\varphi)$6, R@1\% $(c,\varphi)$7, and R@10\% $(c,\varphi)$8, while the Weisfeiler–Lehman baseline gives MRR $(c,\varphi)$9, MR $\varphi$00, R@1\% $\varphi$01, and R@10\% $\varphi$02 (Krsmanovic et al., 2 Oct 2025).

The representation analysis is framed geometrically. On the test split of cnml-base, cosine similarities show two distinct distributions for positive versus negative circuit–specification pairs, with limited overlap, and the similarity heatmap for a batch has the highest values on the diagonal and lower values off-diagonal. The paper interprets this as evidence that the embedding space encodes the satisfaction relation in a geometrically meaningful way. This suggests that the learned latent space is not merely capturing token overlap or graph-shape similarity, because bag-of-words, edit-distance baselines, and graph kernels underperform the CNML embeddings (Krsmanovic et al., 2 Oct 2025).

The embeddings also transfer to downstream model-checking classification. In a Sentence-BERT-style classifier trained on $\varphi$03 training examples and evaluated on $\varphi$04 test examples, CodeBERT initialization yields accuracy $\varphi$05, precision $\varphi$06, recall $\varphi$07, and F1 $\varphi$08; CNML-simple initialization improves this to accuracy $\varphi$09, precision $\varphi$10, recall $\varphi$11, and F1 $\varphi$12; CNML-base initialization reaches accuracy $\varphi$13, precision $\varphi$14, recall $\varphi$15, and F1 $\varphi$16. The paper presents these results as evidence that contrastive neural model checking learns transferable semantic features about the satisfaction relation (Krsmanovic et al., 2 Oct 2025).

A further empirical point concerns compositional generalization. CNML-simple is trained only on single-guarantee formulas derived from formula splitting, yet is evaluated on multi-guarantee specifications from cnml-base. Despite that distribution shift, it outperforms non-CNML baselines on both retrieval tasks and improves over CodeBERT in downstream classification fine-tuning. The paper states that this indicates generalization from simpler specifications to more complex ones.

6. Relation to neural model checking, limitations, and prospective directions

CNML is situated within a broader neural-symbolic verification literature, but its stated novelty is narrower and more specific than general “neural model checking.” Prior work on LTL and traces is described as learning to decide satisfiability, generate witnesses, or classify traces and formulas, typically with single-modal inputs. Neural SAT, SMT, and theorem-proving systems learn over symbolic formulas and sometimes use contrastive learning, but do not align two different formal semantics into a shared space. In that landscape, CNML is presented as the first framework, to the authors’ knowledge, to treat circuits and LTL specifications as two modalities and learn a shared latent space where satisfaction defines the alignment (Krsmanovic et al., 2 Oct 2025).

The contrast with “Neural Model Checking” is especially sharp. That framework introduces a machine learning approach to model checking temporal logic in which neural networks serve as formal proof certificates for LTL, trained from randomly generated executions and then symbolically checked with satisfiability solving. Its core proof object is a ranking function for fair termination of the synchronous product of a system and a Büchi automaton for $\varphi$17, and formal soundness follows when the quantized neural certificate is verified by SMT.