Exact Certification in Computational Methods

• Exact certification is a formal process that guarantees properties exactly under defined semantic models, ensuring both soundness and completeness.
• Methodologies include MIQCP formulations for neural poisoning, NTK-based MILP reductions, and interval or symbolic verification in numerical systems.
• Applications span machine learning, computational algebra, and physical design where precise certification aligns model behavior with rigorous, verifiable guarantees.

Exact certification denotes a family of technical procedures that do not merely supply heuristic evidence or conservative lower bounds, but instead establish a property exactly with respect to a specified semantic model. Across the literature, the phrase refers to different objects—worst-case poisoning effectiveness, uniqueness of polynomial roots, invariance of optimizer-induced decisions, or correctness of a physically derived design quantity—but the common structure is a certificate whose validity is tied to an explicit formal specification and whose gap to the target property is either zero or precisely characterized by stated assumptions (Sosnin et al., 18 Feb 2026, Lee, 2022, Vyas et al., 29 Jun 2026).

1. Core meanings and formal criteria

The term has no single universal definition across fields. In data-poisoning robustness, exact certification means that the certificate is both sound and complete: the reported value equals the true worst-case attack objective under a fixed training pipeline and threat model, so the same optimization simultaneously returns an attack achieving the maximum and a tight upper bound on all attacks (Sosnin et al., 18 Feb 2026). In the NumericalCertification package for polynomial systems, certification of a regular numerical approximation means that an algorithm produces a compact region containing a unique solution, with rigorous convergence and uniqueness guarantees; by contrast, singular roots are handled only by “soft verification,” which does not provide the same uniqueness certificate (Lee, 2022). In Physics-Anchored Certification, exactness is structural: the certified quantity is derived deterministically from immutable bound inputs and LM-writable free variables, and the model is not allowed to assert the certified value itself, making forgery impossible by construction relative to the engine’s equations (Vyas et al., 29 Jun 2026).

A cross-domain comparison is therefore best understood in terms of what is being certified, under which semantics, and what kind of exactness is claimed.

Setting	Object certified	Meaning of “exact”
Data poisoning in neural training	Worst-case attack objective	Sound and complete equality to the true worst case (Sosnin et al., 18 Feb 2026)
Polynomial system solving	Existence and uniqueness of a root near an approximation	Unique-solution certificate for regular roots (Lee, 2022)
NTK-based label poisoning	Robust radius against label flips	True minimal flip count under the NTK-equivalent model (Sabanayagam et al., 2024)
Partition-aggregation ensembles	Ensemble robustness radius	Exact aggregation given exact per-partition flip counts (Mohgaonkar et al., 13 Apr 2026)
Physical design with LMs	Satisfaction of physics-based goal predicates	Deterministic derivation from fixed inputs, not model assertion (Vyas et al., 29 Jun 2026)
Coordinate relevance in decision problems	Sufficiency/minimality of coordinate sets	Exact preservation of optimizer decisions (Simas, 16 Mar 2026)

Two recurrent formal motifs appear. The first is semantic exactness: the certificate is exact relative to a chosen mathematical model, such as a deterministic training pipeline, a kernel-equivalent infinite-width network, or IEEE-754 floating-point execution (Sosnin et al., 18 Feb 2026, Mohgaonkar et al., 13 Apr 2026, Murray, 6 Mar 2026). The second is attainment: many exact certificates identify not only a guarantee but also a witness, such as a worst-case poisoning dataset, a unique polynomial root enclosure, or an explicit coordinate set certifying optimizer invariance (Sosnin et al., 18 Feb 2026, Lee, 2022, Simas, 16 Mar 2026).

A plausible implication is that exact certification is less a single method than a design criterion: the certified statement must be aligned with the semantics actually executed or mathematically modeled, and any residual approximation must be made explicit rather than hidden inside the certificate.

2. Exact certification in neural-network robustness and poisoning

A prominent recent usage concerns robustness against training-time attacks. In "Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming" (Sosnin et al., 18 Feb 2026), adversarial data manipulation, mini-batch SGD training, and post-training evaluation are encoded in one Mixed-Integer Quadratically Constrained Programming formulation. The network class is feed-forward with ReLU activations, training is deterministic mini-batch SGD under fixed initialization, data order, and hyperparameters, and losses are hinge loss for binary classification or squared error for regression. The resulting MIQCP includes poisoning variables, forward-pass variables, ReLU binaries, hinge binaries, gradient variables, parameter-update constraints, and test-time prediction binaries (Sosnin et al., 18 Feb 2026).

The key proposition states that if training updates are encoded exactly, ReLU and hinge nonlinearities use valid big-$M$ bounds, poisoning constraints correctly encode the threat model, and a global MIQCP solver proves optimality, then the optimal value

$F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$

is exactly the worst-case poisoning objective under the specified pipeline and threat model (Sosnin et al., 18 Feb 2026). This yields soundness, because solver dual bounds dominate all feasible attacks, and completeness, because global optimality and exact algebraic encoding ensure the maximum is attained by some feasible poisoning (Sosnin et al., 18 Feb 2026). The framework supports bounded perturbations, label flips, arbitrary substitutions in bounded attacker domains, untargeted test-error objectives, denial-of-service objectives based on cumulative training loss, and targeted or backdoor variants via modified evaluation constraints (Sosnin et al., 18 Feb 2026).

The experimental regime is intentionally small-scale: Iris, Diabetes, and Halfmoons with single linear layers or small linear models, solved with Gurobi 13.0 on AMD EPYC 9334 CPU under a 1-hour limit and 8 threads (Sosnin et al., 18 Feb 2026). On these instances, optimization-based bounds tightening, auxiliary formulations, and primal heuristics improve proof times and dual bounds; proven optimality holds for small linear settings, while larger budgets still yield sound upper bounds and strong incumbents (Sosnin et al., 18 Feb 2026). This suggests that exact certification in this sense is currently a tractable methodology mainly for small or specially structured training pipelines.

A related but structurally different line studies exact robustness to label flipping through the Neural Tangent Kernel. "Exact Certification of (Graph) Neural Networks Against Label Poisoning" (Sabanayagam et al., 2024) exploits the equivalence between sufficiently wide GNNs trained with regularized hinge loss and kernel SVMs with the network NTK. The bilevel poisoning problem is reduced to a MILP by writing the SVM dual, its KKT conditions, and tight big-$M$ linearizations for complementary slackness. The paper derives sample-wise and collective certificates, as well as multiclass one-vs-all formulations, and proves exactness for the infinite-width regime; finite-width guarantees translate with high probability under the stated approximation bounds (Sabanayagam et al., 2024). The framework also reports data-dependent robustness hierarchies across GCN, SGC, GraphSAGE, GIN, APPNP, and residual variants, and identifies a robustness plateauing phenomenon for intermediate perturbation budgets (Sabanayagam et al., 2024).

"Exact Certification of Neural Networks and Partition Aggregation Ensembles against Label Poisoning" (Mohgaonkar et al., 13 Apr 2026) extends the theme in two directions. First, ScaLabelCert gives a polynomial-time exact certificate for sufficiently wide neural networks under NTK-based kernel regression or small-$C$ kernel SVM regimes. In the multiclass setting, the exact radius is obtained by solving relaxed per-target problems $O_2(c')$ whose minimum across target classes matches the original combinatorial objective, with greedy solutions in $O(C \cdot n \log n)$ time for a single model (Mohgaonkar et al., 13 Apr 2026). Second, EnsembleCert aggregates per-partition white-box flip counts into an exact ensemble certificate for partition-aggregation ensembles via a Multiple-Choice Knapsack Problem, reducing ensemble certification to $O(C \cdot N_p^2)$ time when exact per-partition costs are available (Mohgaonkar et al., 13 Apr 2026). On CIFAR-10, the reported median improvement is up to $+26.5\%$ more certifiable label flips than a black-box partition-based approach while requiring 100 times fewer partitions (Mohgaonkar et al., 13 Apr 2026).

Taken together, these works separate three notions of exactness. MIQCP-based certification is exact for a finite architecture and explicit training trajectory (Sosnin et al., 18 Feb 2026). NTK/MILP certification is exact for the infinite-width kernel-equivalent regime (Sabanayagam et al., 2024). EnsembleCert is exact at the aggregation layer once exact per-partition flip counts are supplied (Mohgaonkar et al., 13 Apr 2026). The papers therefore certify different semantic objects, even when all use the same word.

3. Numerical and symbolic exact certification

In computational algebraic geometry, exact certification refers to rigorous validation of numerical approximations to solutions of polynomial systems. "The NumericalCertification package in Macaulay2" (Lee, 2022) supports two exact certification methods for regular square systems $F:\mathbb{C}^n \to \mathbb{C}^n$: Smale’s $\alpha$-theory and the Krawczyk method in interval arithmetic. A point $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$0 is an approximate solution in the $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$1-theoretic sense if Newton iterates converge quadratically to a true root $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$2, with constants

$F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$3

and

$F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$4

The package implements the theorem that $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$5 certifies that $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$6 is an approximate solution, while the stronger condition $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$7 supports same-solution tests and explicit distance bounds (Lee, 2022).

The Krawczyk method provides an interval-arithmetic alternative. For a box $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$8, center $F^* = \max_{\tilde D \in T(D)} J(M(\tilde D))$9, and preconditioner $M$0, the Krawczyk operator is

$M$1

If $M$2, the box contains a root, and if additionally $M$3, that root is unique (Lee, 2022). These are exact certificates for regular solutions in the sense that they prove existence and uniqueness of a true solution within a certified enclosure. By contrast, iterative deflation for isolated singular solutions is explicitly labeled “soft verification,” because random squaring-up can produce false positives and does not recover the same uniqueness guarantee (Lee, 2022).

A different exactness notion appears in "From Computational Certification to Exact Coordinates: Heilbronn's Triangle Problem on the Unit Square Using Mixed-Integer Optimization" (Sudermann-Merx, 11 Mar 2026). There the optimization version of Heilbronn’s triangle problem is first solved to certified global optimality via a mixed-integer nonlinear formulation with symmetry breaking, product substitutions, and determinant-based sign fixing. The minimal triangle area is represented using signed shoelace determinants and a global optimization variable $M$4, and Gurobi’s global MINLP procedure proves optimality for $M$5 (Sudermann-Merx, 11 Mar 2026). Exact symbolic refinement then reconstructs algebraic coordinates from the numerically certified optimum using direct symbolic solving, Gröbner bases, or numeric-to-symbolic refinement in quadratic number fields. For $M$6, the exact optimum

$M$7

is paired with exact coordinates in $M$8, giving the first proof that the Comellas–Yebra configuration is globally optimal (Sudermann-Merx, 11 Mar 2026).

These algebraic and geometric examples show that exact certification can couple numerical optimization or numerical approximation with a second symbolic or interval layer. The numerical step identifies the candidate structure; the certification step proves that the structure is not an artifact of floating-point computation (Lee, 2022, Sudermann-Merx, 11 Mar 2026).

4. Physical, quantum, and implementation-level exactness

Several papers redefine exact certification around the semantics of physical execution rather than combinatorial optimality. "Structural Certification for Reliable Physical Design with LLMs" (Vyas et al., 29 Jun 2026) introduces Physics-Anchored Certification, in which bound inputs are read-only, free design variables are writable by the LLM, derived quantities are computed inside a deterministic engine, and the engine alone returns one of three outcomes: Certified, Impossible, or Unknown. Certification is exact when the certified quantity is derived from fixed inputs rather than accepted from the model, and when the certifier is the sole authority to assert the result (Vyas et al., 29 Jun 2026). The framework instantiates this contract across aerodynamics, DNA thermodynamics, post-Newtonian chirp mass verification, RC filter design, and a DLVO-style colloidal stability proxy. Across 80 adversarial trials spanning two models, two temperatures, and a deliberately faulted engine, the structural-exclusive setup produced zero false certifications (Vyas et al., 29 Jun 2026). The guarantee is nevertheless explicitly relative to the engine’s governing equations rather than to all of physical reality (Vyas et al., 29 Jun 2026).

In floating-point neural-network certification, exactness concerns the semantics gap between real-arithmetic proofs and IEEE-754 execution. "Lipschitz-Based Robustness Certification Under Floating-Point Execution" (Murray, 6 Mar 2026) shows concrete counterexamples in which a real-arithmetic robustness guarantee fails once the network is run in floating point, including pronounced discrepancies in float16 (Murray, 6 Mar 2026). The paper develops a compositional theory of layerwise deviations under standard rounding-error models. With layerwise bounds

$M$9

overflow checks, and final-layer pairwise margin deviations, robustness is certified for the executed floating-point network when, for each competitor class,

$C$0

Under the theorem’s conditions, the prediction of the actual floating-point implementation is invariant on the whole certified ball (Murray, 6 Mar 2026). Here “exact” means execution-faithful: the guarantee refers to the semantics that will actually run on hardware, not to an unrealized real-number abstraction.

Quantum settings further split the term. "Toward Instance-Optimal State Certification With Incoherent Measurements" (Chen et al., 2021) notes that literal exact equality of an unknown state $C$1 to a target $C$2 cannot be certified with finite copies in a worst-case statistical sense; the operational task is always to distinguish $C$3 from $C$4 for $C$5 (Chen et al., 2021). The paper derives instance-optimal copy complexity under nonadaptive incoherent measurements, governed up to logarithmic factors by

$C$6

with truncation-dependent effective rank and fidelity to the maximally mixed state (Chen et al., 2021). By contrast, "Direct certification of a class of quantum simulations" (Hangleiter et al., 2016) studies weak-membership certification of frustration-free gapped ground states through local energy measurements, proving completeness and soundness relative to fidelity thresholds and estimator error. In the ideal case of exact zero energy for a frustration-free Hamiltonian, the state is certified to lie in the ground space exactly; in practice, the protocol is a statistical weak-membership test with explicit sample complexity (Hangleiter et al., 2016).

"Classical certification of quantum gates under the dimension assumption" (Nöller et al., 2024) sits between these notions. It certifies single-qubit gates in a black-box, SPAM-robust setting by checking deterministic outcomes of exact computations on a single qubit. For the $C$7 gate and its inverse, the protocol achieves $C$8 sample complexity in the average gate infidelity $C$9, and exactness holds in the ideal case up to unavoidable unitary or anti-unitary gauge freedom (Nöller et al., 2024).

These works show that exactness in physical and quantum contexts is often qualified: either exact under a deterministic forward model, exact for the executed floating-point semantics, or exact only in an idealized noiseless limit, with finite-sample operational tasks reverting to confidence-qualified statements (Vyas et al., 29 Jun 2026, Murray, 6 Mar 2026, Chen et al., 2021, Hangleiter et al., 2016, Nöller et al., 2024).

5. Decision-theoretic certification and hardness frontiers

A separate literature studies exact certification as a structural question about decision problems. "Decision Quotient: A Regime-Sensitive Complexity Theory of Exact Relevance Certification" (Simas, 16 Mar 2026) defines a coordinate-structured decision problem

$O_2(c')$0

with optimizer map

$O_2(c')$1

A coordinate set $O_2(c')$2 is sufficient when

$O_2(c')$3

The canonical abstraction is the optimizer quotient

$O_2(c')$4

which is the coarsest abstraction preserving decision-relevant distinctions (Simas, 16 Mar 2026). The complexity of certifying sufficiency depends strongly on the regime: static sufficiency is coNP-complete, anchor sufficiency is $O_2(c')$5-complete, stochastic decisiveness is PP-hard under succinct encoding with anchor and minimum variants in $O_2(c')$6, and the sequential regime is PSPACE-complete (Simas, 16 Mar 2026). The same paper also identifies twelve tractable subcases, including single-action problems, separable utilities, bounded actions, bounded support, and product distributions (Simas, 16 Mar 2026).

A complementary impossibility result appears in "Toward a Tractability Frontier for Exact Relevance Certification" (Simas, 8 Apr 2026). There, exact relevance certification asks for the minimal coordinate set needed to determine the optimal action, and the paper proves a meta-impossibility theorem for efficiently checkable structural predicates invariant under theorem-forced closure laws such as coordinate relabeling, action-independent offsets, monotone actionwise transformations, and ghost-action duplication (Simas, 8 Apr 2026). Through same-orbit disagreement witnesses in obstruction families including dominant-pair concentration, margin masking, ghost-action concentration, and additive/statewise offset concentration, the paper shows that no such closure-invariant classifier can exactly characterize tractability across those families (Simas, 8 Apr 2026). The claims are mechanically verified in Lean 4 (Simas, 8 Apr 2026).

"Certification from Examples is Hard for Circuits and Transformers under Minimal Overparametrization" (Luca et al., 21 May 2026) studies yet another exact certification object: the smallest labeled sample set that forces equality of a learned hypothesis to a target function. For a finite domain $O_2(c')$7 and class $O_2(c')$8,

$O_2(c')$9

The paper shows that for threshold circuits of depth at least $O(C \cdot n \log n)$0, adding a single extra gate can force certificate sizes exponential in the input dimension, and that an analogous exponential hardness result holds for log-precision Transformers with one extra final-layer attention head and six auxiliary embedding or residual coordinates (Luca et al., 21 May 2026). Approximate certification is also characterized: polynomially many allowed mistakes still require exponentially large certificates, whereas constant relative error can hide exponentially many absolute mistakes (Luca et al., 21 May 2026). The empirical study on binary addition confirms that uniformly sampled certificate candidates can leave many imperfect Transformer hypotheses undetected (Luca et al., 21 May 2026).

A plausible synthesis is that exact certification becomes computationally hard when the hypothesis or decision class admits sparse, localized “deceivers,” whether those are trigger blocks in circuits, optimizer-equivalent closure orbits, or temporally contingent hidden coordinates (Simas, 16 Mar 2026, Simas, 8 Apr 2026, Luca et al., 21 May 2026).

6. Assumptions, scalability limits, and recurring trade-offs

Across domains, exact certification is typically obtained only after narrowing the semantic scope. In poisoning certification by MIQCP, exactness requires deterministic training, fixed data ordering, fixed horizon $O(C \cdot n \log n)$1, valid big-$O(C \cdot n \log n)$2 bounds, bounded attacker domains for arbitrary substitutions, and a global solver that closes the MIP gap (Sosnin et al., 18 Feb 2026). Scalability degrades combinatorially with the number of binary activation variables, the training horizon, batch size, and poisoning budget, so current exact results are strongest for small models and modest budgets (Sosnin et al., 18 Feb 2026). In NTK-based neural certificates, exactness depends on infinite-width or sufficiently wide regimes, small-$O(C \cdot n \log n)$3 simplifications for SVM, or exact kernel regression solves; finite width converts exactness into asymptotic or high-probability statements (Sabanayagam et al., 2024, Mohgaonkar et al., 13 Apr 2026).

In numerical algebraic geometry, exact certification is restricted to regular solutions for full rigor, while singular solutions require deflation-based soft verification (Lee, 2022). In weak-membership quantum certification, exact equality is statistically inaccessible at finite sample size, so $O(C \cdot n \log n)$4-separated hypothesis testing replaces literal equality (Chen et al., 2021). In floating-point certification, soundness demands overflow checks and specific IEEE-754 assumptions; lower precision or wide layers can make the bounds vacuous (Murray, 6 Mar 2026). In PHACT, the soundness guarantee is only as strong as the physics engine’s coverage and implementation correctness, so the verdict Unknown is essential for competence boundaries (Vyas et al., 29 Jun 2026).

These constraints produce a consistent trade-off between exactness and coverage. Exact certificates are strongest when the model class, threat model, or execution semantics are sharply delimited. As the system becomes broader—deeper networks, richer stochasticity, larger graphs, wider decision classes, or more realistic physical regimes—either the computational burden rises sharply or the semantics of exactness must weaken to soft verification, probabilistic guarantees, asymptotic exactness, or bounded abstention (Sosnin et al., 18 Feb 2026, Lee, 2022, Sabanayagam et al., 2024, Vyas et al., 29 Jun 2026).

Another recurring trade-off is between structural white-box knowledge and black-box conservatism. EnsembleCert improves substantially on black-box partition aggregation because it uses exact per-partition flip counts rather than worst-case vote-flip assumptions (Mohgaonkar et al., 13 Apr 2026). PHACT avoids forged answers because the engine derives the certified quantity instead of checking a model-supplied value (Vyas et al., 29 Jun 2026). Floating-point-aware certification closes a semantic gap left by real-arithmetic certifiers because it models the execution substrate explicitly (Murray, 6 Mar 2026). This suggests that exact certification often depends less on stronger optimization alone than on aligning the certificate with the internal causal structure of the system being certified.

7. Broader significance and open directions

Exact certification has become a meeting point for optimization, formal methods, numerical analysis, and statistical testing. In machine learning, recent work has pushed exactness from inference-time verification toward training-time poisoning, NTK-based label flipping, and ensemble aggregation (Sosnin et al., 18 Feb 2026, Sabanayagam et al., 2024, Mohgaonkar et al., 13 Apr 2026). In symbolic-numeric computation, exactness is achieved by coupling numerical search with interval or algebraic validation (Lee, 2022, Sudermann-Merx, 11 Mar 2026). In physical design and floating-point verification, the emphasis shifts from abstract mathematical correctness to semantic fidelity of the implemented system (Vyas et al., 29 Jun 2026, Murray, 6 Mar 2026). In decision theory and learning theory, the central issue is not only how to certify exactly, but when exact certification itself is computationally tractable (Simas, 16 Mar 2026, Simas, 8 Apr 2026, Luca et al., 21 May 2026).

Several open directions are explicit in the sources. The MIQCP poisoning framework proposes tighter relaxations, decomposition, and extensions to momentum, Adam, multiclass tasks, and hybrid exact-inexact verification (Sosnin et al., 18 Feb 2026). NTK-based poisoning certificates leave open tighter finite-width transfers and broader attack models beyond label flips (Sabanayagam et al., 2024, Mohgaonkar et al., 13 Apr 2026). Floating-point certification points to convolutional and residual architectures and non-ReLU activations as natural extensions (Murray, 6 Mar 2026). The decision-theoretic literature leaves open sharper classifications for stochastic preservation without full support and richer multi-agent or POMDP-like regimes (Simas, 16 Mar 2026). Physics-Anchored Certification raises the question of how to retain the same structural non-forgeability when the deterministic engine must be replaced by expensive numerical solvers or learned surrogates (Vyas et al., 29 Jun 2026).

A plausible conclusion is that the future of exact certification will depend on two complementary developments. One is semantic specialization: exact certificates become feasible when the semantics of training, inference, numerical computation, or physical design are modeled with sufficient precision. The other is structural abstraction: exactness scales only when symmetry, kernel equivalence, closure laws, or optimizer quotients expose a tractable representation of the property to be certified (Sosnin et al., 18 Feb 2026, Sabanayagam et al., 2024, Simas, 16 Mar 2026, Simas, 8 Apr 2026).