Marabou: Neural Network Verification Framework

• Marabou is a formal verification framework for deep neural networks, supporting piecewise-linear constraints like ReLU for robust safety analysis.
• It combines SMT-style solving, case-splitting, and bound propagation to handle mixed linear and nonlinear constraints efficiently.
• Its extensions enable applications in robustness, optimization, and security with features like proof production and abstraction-refinement.

Marabou is a general-purpose formal verification and analysis framework for deep neural networks that checks satisfiability of mixed linear and nonlinear constraint systems induced by a network and a specification. In its standard formulation, a verifier query asks whether there exists an input satisfying given bounds and output-side constraints; a SAT answer yields a concrete witness, whereas an UNSAT answer establishes that the specified bad behavior is absent on the analyzed region. Across the literature, Marabou is presented first as an SMT-style verifier for feed-forward, piecewise-linear networks and later as a broader analyzer with ONNX and VNN-LIB support, network-level abstract interpretation, proof production, CEGAR for selected nonlinear activations, and multiple application-specific front ends (Wu et al., 2024).

1. Formal problem class and specification model

Marabou’s core verification problem is usually written over a feed-forward network $\mathcal{N} : \mathbb{R}^m \to \mathbb{R}^k$ together with a property $P$ constraining inputs and outputs by linear inequalities. One standard form is

$$\exists x \in \mathbb{R}^m, y \in \mathbb{R}^k \text{ such that } (\mathcal{N}(x)=y) \land P(x,y),$$

with SAT meaning that a witness exists and UNSAT meaning that the corresponding safety condition holds (Isac et al., 2022). In the robustness setting, the input region is typically an axis-aligned box,

$x_i \in [l_i,u_i],$

and the output condition is a linear inequality such as preservation of a class logit ordering over the entire region (Casadio et al., 2023).

The internal representation separates three ingredients. Affine layers contribute linear equations; input and output requirements contribute linear bounds and inequalities; activations contribute nonlinear constraints, most prominently ReLUs. In the DNN proof literature around Marabou, the linear fragment is often expressed as

$A \cdot V = 0,\quad l \le V \le u,$

with $V$ collecting input, hidden, and output variables, while ReLU constraints are handled separately as piecewise-linear relations between pre-activation and post-activation variables (Isac et al., 2022). This encoding extends naturally to common verification tasks such as local robustness, output range analysis, safety properties for control systems, and hidden-neuron activation predicates (Wu et al., 2024).

The semantic interpretation of SAT and UNSAT is central to later extensions. A SAT result is easy to validate externally by evaluating the network on the returned witness. An UNSAT result is more delicate because it asserts the non-existence of an adversarial or unsafe assignment, and this asymmetry motivates a substantial line of work on proof production and independent checking for Marabou’s UNSAT answers (Isac et al., 2022).

2. Solving methodology and internal reasoning

Marabou’s classical solving architecture combines a specialized Simplex core with case-splitting over piecewise-linear activation phases. Ignoring activations, affine layers yield linear equalities of the form

$b_i = \sum_l w_{i,l} v_l + p_i,$

and the solver maintains a tableau, bounds, and a current assignment that satisfies the equations but may violate bounds. It then pivots and updates variables to repair violations; if no repair is possible, the linear subproblem is infeasible (Isac et al., 2022).

For ReLUs, Marabou uses explicit phase reasoning. A ReLU $f=\max(0,b)$ has an active phase $b \ge 0, f=b$ and an inactive phase $b \le 0, f=0$. The solver starts from the affine constraints together with symbolic piecewise-linear constraints, solves the linear relaxation, and either finds a fully consistent model or splits on a ReLU phase, recursively exploring the resulting search tree (Isac et al., 2022). This makes the procedure sound and complete for linear plus piecewise-linear constraints, at the expected exponential worst-case cost.

Marabou 2.0 reorganizes this core into a more modular engine. Its default per-node decision procedure is DeepSoI, a sum-of-infeasibilities method adapted to piecewise-linear constraints, and its SMT solver interleaves theory solving with branching on undetermined piecewise-linear constraints (Wu et al., 2024). The architecture also includes a NetworkLevelReasoner that reconstructs the network DAG and applies interval bound propagation, symbolic bound propagation, DeepPoly/CROWN, LP-based and MILP-based bound tightening, forward-backward analysis, and iterative propagation; by default, DeepPoly/CROWN is used (Wu et al., 2024).

A notable engineering change in Marabou 2.0 is that case splits are encoded as bound updates rather than as new equations, enabling context-dependent data structures for efficient backtracking and reducing both runtime and memory usage. The same release describes optional Gurobi-based LP/MILP solving, split-and-conquer and portfolio parallelization, and a CEGAR solver for selected non-piecewise-linear activations such as Sigmoid and Tanh (Wu et al., 2024).

3. Supported representations, constraints, and interfaces

Marabou 2.0 presents the input problem as an InputQuery containing variable bounds, linear equations and inequalities, piecewise-linear constraints, and other nonlinear constraints. The main network format is ONNX, with legacy support for NNet and TensorFlow protobuf; specification-side support includes Marabou’s native property format and VNN-LIB, alongside C++ and Python APIs and a higher-level Pythonic interface (Wu et al., 2024).

Within this architecture, Marabou supports a broad family of constraint types with different levels of solver support: ReLU, Max, DNF, Sign, Absolute Value, Leaky ReLU, Round, Clip, Sigmoid, Tanh, Softmax, and Bilinear all appear in the Marabou 2.0 support matrix, though not every component supports every constraint equally (Wu et al., 2024). For piecewise-linear constraints such as ReLU and Max, support spans preprocessing, network-level reasoning, SMT solving, MILP encoding, and, for a subset, proof production. For Sigmoid and Tanh, the principal mechanism is CEGAR-based incremental linearization (Wu et al., 2024).

A concrete example of interface design appears in ANTONIO, where NLP classifiers are exported to ONNX and specifications to VNNLIB so that Marabou can be used unchanged as a back-end verifier. There, Marabou consumes real-valued input boxes derived from sentence embeddings and VNNLIB output constraints expressing classification invariants, without any modification to its solver internals (Casadio et al., 2023). A similar black-box role appears in Vehicle, where Marabou is the target verifier for a typed DSL compiled from functional neural specifications into low-level verifier queries and then linked to Agda proofs (Daggitt et al., 2022).

These interfaces underscore a persistent design pattern: Marabou itself remains a generic numeric verifier, while domain-specific front ends translate application semantics into bounded real-valued inputs and linear or piecewise-linear constraints. This pattern recurs in NLP verification, theorem-prover integration, poisoning analysis, and scientific machine learning (Casadio et al., 2023).

4. Proof production, certificates, and trusted checking

A major line of work on Marabou concerns trust in UNSAT results. The proof-production extension instruments the Simplex-based verifier so that each UNSAT leaf in the search tree carries a machine-checkable witness of infeasibility derived from Farkas’ lemma. For a linear fragment

$P$0

an UNSAT certificate is a vector $P$1 such that $P$2 for all $P$3 satisfying the bounds, which is incompatible with $P$4 (Isac et al., 2022). The key implementation idea is to maintain, for each variable, justification vectors for its current upper and lower bounds under dynamic bound tightening, so that a final contradiction $P$5 can be turned into a Farkas certificate immediately (Isac et al., 2022).

This mechanism extends to Marabou’s ReLU search tree by recording proof nodes for case splits and proof leaves for linear contradictions. In experiments on 180 ACAS Xu queries, Marabou reported 113 UNSAT instances; proof production succeeded with an average overhead of 5.7%, produced proof trees with about 1.46 million leaves in total, and yielded 77 incorrect leaf proofs that were all independently confirmed UNSAT by cvc5 within 20 seconds each (Isac et al., 2022). Proof checking was, on average, 66.5% shorter than running verification from scratch (Isac et al., 2022).

The trust story is pushed further by a formally verified checker in Imandra. That work re-implements Marabou certificate checking in an industrial functional programming language and interactive theorem prover, proving the correctness of the checker’s core reasoning over exact arithmetic rather than floating point. The checker validates contradiction vectors and ReLU-theory lemmas against a formalized polynomial Farkas framework and thereby strengthens independent guarantees for Marabou proofs (Desmartin et al., 2024).

This certificate-based perspective is complementary to other trust-oriented findings. DeepGalaxy, a differential-testing framework for neural-network verifiers, reported 2 detected bugs in Marabou, both unconfirmed at the time of publication, illustrating why independent validation of verifier results matters in practice (Xie et al., 2022).

5. Extensions of the core verifier

Marabou has repeatedly served as a platform for extending exact neural verification beyond its original yes-or-no robustness use case. One extension turns it into a global optimizer. MarabouOpt integrates optimization objectives directly into the branch-and-bound search, supporting both maximization of linear output objectives over input regions and minimization of $P$6 adversarial perturbation size. On ACAS Xu, this integrated approach solved more input-optimization instances than both bisection-over-verification and MIPVerify, whereas on TinyTaxiNet and some MNIST instances MIPVerify remained stronger, yielding a complementary performance profile rather than a strict dominance relation (Strong et al., 2020).

Another extension targets binarized neural networks. By adding sign constraints $P$7, sign-specific deduction rules, weighted-sum layer elimination, LP relaxation, symbolic bound tightening, and polarity-based splitting, Marabou was extended to verify both strictly and partially binarized networks, including an XNOR-Net architecture. On the MNIST BNN benchmark, the full configuration solved 458 out of 500 instances, and polarity-based splitting was especially important for performance (Amir et al., 2020).

A separate strand augments Marabou with abstraction–refinement front ends. One framework constructs abstract networks by merging and freezing neurons so that the abstract network over-approximates the original, then invokes Marabou to verify the abstraction and uses spurious counterexamples for refinement (Elboher et al., 2019). A later approach, NARv, again treats Marabou as a back-end exact solver and reports that on MNIST the Marabou-backed variant reduced verification time by up to 86.3%, while on CIFAR-10 it solved instances that plain Marabou timed out on; against the earlier abstraction-refinement approach, it was reported as 11.6–26.6 times faster (Liu et al., 2022).

Two more recent solver-level enhancements continue this trajectory. Partial multi-neuron relaxation integrates a new bound-tightening front end into Marabou, generating multi-neuron bounds only for a selected subset of neurons; across 344 queries it increased the number of solved queries from 202 to 301 and reduced average time from 751 s to 619 s (Shmuel et al., 28 May 2026). Incremental verification via learned conflicts retains infeasible combinations of ReLU phases across related queries, implemented in Marabou with a SAT-based conflict analyzer; on representative workloads it yielded speedups of up to 1.9\times (Elsaleh et al., 12 Mar 2026).

6. Application domains, empirical profile, and limitations

Marabou’s application record is unusually broad. In NLP verification, ANTONIO converts sentence-level intent classification into embedding-space box constraints and then invokes Marabou through ONNX and VNNLIB. On the R-U-A-Robot benchmark, Marabou verified a substantially larger fraction of semantically derived regions than ERAN; for example, on $P$8 with $P$9, Marabou verified 45.12% of regions versus 10.75% for ERAN (Casadio et al., 2023). In security analysis, VPN formulates backdoor-trigger existence as a verification query and uses Marabou to synthesize triggers for fully connected MNIST models, with discovered triggers transferring to larger convolutional models (Sun et al., 2022). In verification-guided testing, a Negative Selection Algorithm proposes unsafe input partitions and Marabou validates them, reaching about 97% precision for the candidate unsafe regions on ACAS Xu property $$\exists x \in \mathbb{R}^m, y \in \mathbb{R}^k \text{ such that } (\mathcal{N}(x)=y) \land P(x,y),$$0 (Nuhu et al., 2022).

Scientific and industrial case studies further diversify this picture. For a satellite fault-detection pipeline, Marabou was used to verify local robustness of small ReLU classifiers operating on histogram features derived from reaction-wheel time series; the paper reports complete verification runs and analyzes robustness as a function of perturbation type and SNR (Longuet et al., 4 Sep 2025). For a parametric PINN modeling the Grad–Shafranov equation, Marabou 2.0 with Gurobi was used to verify magnetic-axis properties and to expose extrapolation failures; a domain-exploration query over the full $$\exists x \in \mathbb{R}^m, y \in \mathbb{R}^k \text{ such that } (\mathcal{N}(x)=y) \land P(x,y),$$1-interval took 17,642.16 s, while subdividing the domain reduced the total search cost dramatically (Rizqan et al., 29 Apr 2025). For confidence-based global two-safety, Marabou was extended at the encoding level via self-composition and a piecewise-linear softmax abstraction to verify global robustness and fairness properties relating pairs of inputs (Athavale et al., 2024).

Marabou is also used as an external reasoning engine inside broader formal workflows. Vehicle compiles a neural specification language to Marabou queries and Agda definitions, enabling a formally verified system-level theorem about a car steered by a neural controller with over 20,000 nodes; Marabou solved the two generated queries in about 20 seconds on a mid-range laptop (Daggitt et al., 2022).

Empirically, Marabou 2.0 is competitive but not universally dominant. In VNN-COMP 2023 it placed second overall and was the best CPU-only tool, solving 594 instances, compared with 721 for $$\exists x \in \mathbb{R}^m, y \in \mathbb{R}^k \text{ such that } (\mathcal{N}(x)=y) \land P(x,y),$$2-$$\exists x \in \mathbb{R}^m, y \in \mathbb{R}^k \text{ such that } (\mathcal{N}(x)=y) \land P(x,y),$$3-CROWN (Wu et al., 2024). Relative to an earlier Marabou version on 745 benchmarks, Marabou 2.0 achieved at least 2× speedup on 428 instances and at least 10× on 263, while reducing median peak memory from 604 MB to 57 MB (Wu et al., 2024).

The limitations reported across the literature are consistent. Exact verification remains NP-hard, and Marabou’s performance degrades on larger or more weakly structured networks. Full-scale transformers are described as far beyond current scalability in the NLP setting, and large convolutional models motivated alternative back ends in poisoning verification (Casadio et al., 2023). GPU acceleration is not yet part of Marabou 2.0, leaving a performance gap to GPU-based verifiers on some benchmarks (Wu et al., 2024). Proof production does not yet cover every Marabou feature, and for non-piecewise-linear constraints the tool relies on relaxations or CEGAR rather than a uniform exact SMT procedure (Wu et al., 2024). These caveats explain why the surrounding research ecosystem treats Marabou both as a high-assurance exact engine and as a platform for abstraction, specialization, and proof-checking layers that mitigate the cost of exactness without discarding it.