Time-Limited Continuous Verification

• Time-limited continuous verification is a methodological umbrella that evaluates system correctness, safety, and trust over explicitly bounded time intervals.
• It employs techniques such as interval analysis, discretization reductions, and probabilistic risk bounds to avoid naive high-frequency sampling.
• Applications span dynamical systems, learning-enabled control, and operational security, balancing rigorous soundness with practical tractability.

Time-limited continuous verification denotes a family of verification problems in which correctness, safety, trust, or validity is assessed over continuous time but only within an explicitly delimited temporal scope. In the dynamical-systems literature, the scope is typically a finite horizon $[0,T]$ and the object of verification is a continuous-time trajectory, a reachable tube, or a temporal-logic formula over dense time (Ishii et al., 2016, Jasour et al., 2021). In security and networking, the same temporal limitation appears as verification epochs, response deadlines, or holder-chosen verification periods that bound how long a verifier may continue checking a status or identity claim (Xiao et al., 2024, Manimaran et al., 15 Sep 2025). Across these settings, the shared technical issue is how to obtain sound conclusions over continuous evolution without reducing the problem to naive high-frequency sampling or unbounded re-verification.

1. Formal scope and problem classes

A standard formal setting is a continuous-time dynamical system governed by ordinary differential equations. One representative formulation considers a system $CS=(u,x,U\times X,X_0,F)$, where $u\in\mathbb{R}^m$ is a vector of parameters, $x\in\mathbb{R}^n$ the state variables, $U\times X\subseteq\mathbb{R}^{m+n}$ a box domain, $X_0\subseteq X$ an initial-state box, and $F:U\times X\to\mathbb{R}^n$ a Lipschitz-continuous vector field. A signal $\tilde{x}:[0,T]\to X$ satisfies $\tilde{x}(0)\in X_0$ and $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$ for some fixed $CS=(u,x,U\times X,X_0,F)$0 (Ishii et al., 2016). In this setting, the time limit is the horizon determined by the specification, such as $CS=(u,x,U\times X,X_0,F)$1 for a bounded STL formula (Ishii et al., 2016).

Temporal specifications over continuous time appear in several logical formalisms. Bounded Signal Temporal Logic admits formulas of the form $CS=(u,x,U\times X,X_0,F)$2, with atomic propositions $CS=(u,x,U\times X,X_0,F)$3 of the form $CS=(u,x,U\times X,X_0,F)$4 (Ishii et al., 2016). Continuous-time Metric Temporal Logic and MITL are also used for finite-horizon verification, both directly over dense-time signals and via reductions to discrete time under explicit assumptions such as non-Berkeleyness and flatness restrictions (0911.5642, Selvaratnam et al., 2022). For stochastic systems, the time-limited property may be a lower bound on the probability of satisfying a safe-LTL formula over a finite time horizon or a reach–avoid–stay requirement over $CS=(u,x,U\times X,X_0,F)$5 (Anand et al., 2021, Neustroev et al., 2024).

A second class of problems concerns continuous verification as an operational protocol rather than as trajectory analysis. In wireless zero-trust networking, verification is repeated over time and the trust level degrades between successful verifications; the central quantity is the Age of Trust, $CS=(u,x,U\times X,X_0,F)$6, with long-term average $CS=(u,x,U\times X,X_0,F)$7 (Xiao et al., 2024). In verifiable-credential systems, time-limited continuous verification means that a holder discloses tokens only for epochs $CS=(u,x,U\times X,X_0,F)$8, enabling repeated revocation checks only during that declared period (Manimaran et al., 15 Sep 2025). In Sybil-resistant consensus, the verification window is explicit in the protocol API: challenges are bound to identity, window, and index, and responses arriving after the wall-clock deadline are rejected (Maleki et al., 7 Jan 2026).

These formulations share a bounded temporal semantics, but they differ in what is being certified: temporal truth of a trajectory, probability of satisfaction, continuous-time safety of a closed loop, freshness of trust, or continued validity of a credential. This suggests that the topic is best understood as a methodological umbrella rather than as a single formalism.

2. Dense-time monitoring and interval-based runtime verification

A rigorous approach to finite-horizon monitoring of continuous trajectories is interval analysis. In one such method, the monitoring algorithm performs a forward simulation of a continuous-time dynamical system, detects a set of time intervals in which the atomic propositions hold, and validates the property by propagating the time intervals (Ishii et al., 2016). The procedure is organized in three phases: atomic-proposition monitoring, STL-formula propagation, and an initial-time check (Ishii et al., 2016).

The atomic phase evaluates propositions $CS=(u,x,U\times X,X_0,F)$9 against validated enclosures of the state. A crucial subroutine, SearchZero, contracts a time-search interval with interval Newton methods and attempts to prove existence and uniqueness of the earliest root of $u\in\mathbb{R}^m$0. The derivative enclosure is obtained from $u\in\mathbb{R}^m$1, and successful termination yields an interval containing the unique earliest zero; returning $u\in\mathbb{R}^m$2 proves the absence of a zero in the search interval (Ishii et al., 2016). The propagation phase then computes interval representations for $u\in\mathbb{R}^m$3, $u\in\mathbb{R}^m$4, and $u\in\mathbb{R}^m$5 through operators such as Invert, Join, and ShiftAll, with Normalize restoring a canonical, non-overlapping approximation (Ishii et al., 2016).

The key theoretical property is soundness. If SearchZero returns a non-empty interval, then for all signals consistent with the system there exists a unique zero in that interval; if it returns $u\in\mathbb{R}^m$6, then no zero exists in the search interval (Ishii et al., 2016). Likewise, if each atomic interval set is a canonical approximation of the true consistent-time intervals, then the propagated set for the full formula is a canonical approximation of the true consistent-time interval set (Ishii et al., 2016). The method is intentionally relaxed: if the verification process cannot succeed at the prescribed precision, it outputs Unknown (Ishii et al., 2016).

A related line in MITL verification under timing uncertainty starts from under- and over-approximating interval queues for the truth sets of atomic propositions. These approximations are lifted inductively through negation, conjunction, and bounded Until, producing $u\in\mathbb{R}^m$7 for every formula $u\in\mathbb{R}^m$8 (Selvaratnam et al., 2022). The gap

$u\in\mathbb{R}^m$9

quantifies conservativeness, and the method is exact when the over-approximations for the atomic propositions coincide with the under-approximations (Selvaratnam et al., 2022).

These results are significant because they replace pointwise sampling with set-based reasoning over dense time. A common misconception is that continuous-time monitoring is simply high-rate discrete monitoring; the interval methods above are explicitly designed to avoid that reduction, and the uncertainty-aware MITL construction makes the residual ambiguity explicit rather than implicit (Ishii et al., 2016, Selvaratnam et al., 2022).

3. Sampling, discretization, and reductions to bounded discrete verification

Another major approach is to reduce continuous-time verification to discrete-time verification under explicit semantic restrictions. For flat MTL, a sampling theorem states that if $x\in\mathbb{R}^n$0 is flat, $x\in\mathbb{R}^n$1 is a continuous-time non-Berkeley signal, and $x\in\mathbb{R}^n$2, then for any finite horizon $x\in\mathbb{R}^n$3, $x\in\mathbb{R}^n$4 on $x\in\mathbb{R}^n$5 iff $x\in\mathbb{R}^n$6 on $x\in\mathbb{R}^n$7 (0911.5642). The discretization map $x\in\mathbb{R}^n$8 preserves propositional structure, rounds Until and Since intervals outward, and rounds Release and Trigger intervals inward (0911.5642).

The non-Berkeleyness assumption is central. In the sampling-based theory, continuous-time signals must not switch faster than the sampling period $x\in\mathbb{R}^n$9 (0911.5642). In automated partial verification of multi-paradigm real-time models, the restriction is strengthened to behaviors that are constant on every interval of length $U\times X\subseteq\mathbb{R}^{m+n}$0 (0804.4383). Under these assumptions, dense-time verification of a mix of timed automata and MTL can be reduced to bounded discrete validity checking by means of under- and over-approximation mappings $U\times X\subseteq\mathbb{R}^{m+n}$1 and $U\times X\subseteq\mathbb{R}^{m+n}$2 (0804.4383).

The resulting decision procedure is partial but sound. If

$U\times X\subseteq\mathbb{R}^{m+n}$3

is valid over discrete time, then the original dense-time implication is valid over non-Berkeley continuous time; dually, if

$U\times X\subseteq\mathbb{R}^{m+n}$4

is not valid over discrete time, then the property is not valid on some continuous run of the system (0804.4383). The operational realization uses bounded-time checks over $U\times X\subseteq\mathbb{R}^{m+n}$5 up to a horizon $U\times X\subseteq\mathbb{R}^{m+n}$6, translates them to propositional SAT by unrolling time $U\times X\subseteq\mathbb{R}^{m+n}$7, and returns PASS, FAIL, or Inconclusive (0804.4383).

A more expressive translation-based route targets full MITL over timed automata with continuous-time signal semantics. Both the timed automaton network and the MITL formula are translated into Constraint LTL over clocks (CLTLoc), and satisfiability of the resulting CLTLoc formula is checked by available decision procedures (Menghi et al., 2018). The encoding uses a two-copy trick for clocks, explicit variables for current locations and transitions, auxiliary formulae for synchronization and edge modes, and fresh variables for MITL subformulae (Menghi et al., 2018).

These reductions clarify the boundary between exact dense-time reasoning and approximation. Flat formulas with suitable sampling periods admit exact correspondence (0911.5642). Mixed TA+MTL models under under-/over-approximation yield sound but only partially complete answers (0804.4383). Full MITL can be handled through CLTLoc encodings, at the price of more elaborate symbolic machinery (Menghi et al., 2018). A plausible implication is that “time-limited continuous verification” often becomes tractable only after the temporal scope is bounded and the semantic assumptions are made explicit.

4. Finite-horizon probabilistic verification and risk bounds

For uncertain and stochastic systems, time-limited verification is frequently formulated as a probability bound over a finite horizon. In risk-bounded trajectory verification, a nominal continuous-time trajectory $U\times X\subseteq\mathbb{R}^{m+n}$8 over $U\times X\subseteq\mathbb{R}^{m+n}$9 must satisfy uncertain nonlinear constraints $X_0\subseteq X$0, and safety at risk level $X_0\subseteq X$1 means $X_0\subseteq X$2 (Jasour et al., 2021). The method constructs deterministic “risk-contour” constraints from moments of the uncertainty, yielding polynomial inequalities $X_0\subseteq X$3 and $X_0\subseteq X$4 (Jasour et al., 2021). Sum-of-squares certificates in the variable $X_0\subseteq X$5 are then used to prove these inequalities for all $X_0\subseteq X$6 without time discretization (Jasour et al., 2021).

An important computational property is that the resulting semidefinite program size depends on the polynomial degrees and the number of constraints, but not on the duration $X_0\subseteq X$7 nor on any time discretization parameter (Jasour et al., 2021). The reported examples include a lane-changing car, tube verification around a car path, and an aerial vehicle trajectory, with solve times under $X_0\subseteq X$8 second in the described cases (Jasour et al., 2021).

For switched stochastic systems, finite-horizon temporal logic verification can be reduced to a set of reachability tasks extracted from the automaton for the negation of a safe-LTL specification. Each reachability task is bounded using a common or multiple barrier certificate. If a barrier function satisfies $X_0\subseteq X$9 on $F:U\times X\to\mathbb{R}^n$0, $F:U\times X\to\mathbb{R}^n$1 on $F:U\times X\to\mathbb{R}^n$2, and $F:U\times X\to\mathbb{R}^n$3 for all modes, then $F:U\times X\to\mathbb{R}^n$4 (Anand et al., 2021). The final lower bound on satisfaction probability is obtained compositionally from the accepting runs of the automaton (Anand et al., 2021).

Continuous-time stochastic supermartingale certificates provide another finite-horizon construction. For an SDE $F:U\times X\to\mathbb{R}^n$5, a reach–avoid–stay certificate $F:U\times X\to\mathbb{R}^n$6 is required to satisfy nonnegativity, an initial bound, a safety bound, and generator inequalities implying decrease toward the target and persistence inside it (Neustroev et al., 2024). The soundness theorem yields $F:U\times X\to\mathbb{R}^n$7 and $F:U\times X\to\mathbb{R}^n$8, and the same inequalities specialize to a fixed finite horizon $F:U\times X\to\mathbb{R}^n$9 by applying optional stopping to $\tilde{x}:[0,T]\to X$0 (Neustroev et al., 2024).

These methods show that bounded continuous-time verification need not be qualitative. It can instead produce an upper bound on violation probability, a lower bound on specification satisfaction, or a rigorously certified risk upper bound (Jasour et al., 2021, Anand et al., 2021, Neustroev et al., 2024). The common misconception that probabilistic guarantees require time discretization is directly contradicted by the moment/SOS construction and the continuous-time supermartingale framework, both of which treat time as a continuous variable throughout (Jasour et al., 2021, Neustroev et al., 2024).

5. Reachable tubes, continuous-depth models, and neural-network control

A major contemporary application area is verification of learning-enabled continuous-time systems. One line studies continuous-depth models such as neural ODEs. Given an initial ball $\tilde{x}:[0,T]\to X$1 and a horizon $\tilde{x}:[0,T]\to X$2, GoTube over-approximates the reachable set at time points $\tilde{x}:[0,T]\to X$3 by Euclidean balls $\tilde{x}:[0,T]\to X$4, forming a bounding tube (Gruenbacher et al., 2021). Instead of exact global optimization of the worst-case deviation, the method uses surface samples, empirical maxima, and probabilistic Lipschitz caps to ensure

$\tilde{x}:[0,T]\to X$5

with confidence $\tilde{x}:[0,T]\to X$6 (Gruenbacher et al., 2021). The reported advantages are that it does not accumulate overapproximation errors between time steps and avoids the wrapping effect inherent in symbolic techniques (Gruenbacher et al., 2021).

For continuously actuated neural-network control systems, a different abstraction is used. The controller $\tilde{x}:[0,T]\to X$7 is replaced regionwise by an affine map $\tilde{x}:[0,T]\to X$8 with additive uncertainty $\tilde{x}:[0,T]\to X$9, so that $\tilde{x}(0)\in X_0$0 for all $\tilde{x}(0)\in X_0$1 (ArjomandBigdeli et al., 2024). Time-bounded verification over $\tilde{x}(0)\in X_0$2 proceeds by building local abstractions, solving differential inclusions over a time step $\tilde{x}(0)\in X_0$3, checking that intermediate reachable sets stay inside the abstraction regions, and then performing graph reachability over the cell abstraction (ArjomandBigdeli et al., 2024). The abstraction’s soundness is checked through open-loop neural-network verification queries (ArjomandBigdeli et al., 2024).

The practical limitation in this setting is not the continuous-time dynamics alone but the scalability of local neural-network verification. In the reported study, building $\tilde{x}(0)\in X_0$4 local abstractions requires $\tilde{x}(0)\in X_0$5 calls to an NN verifier, and many queries time out or raise exceptions, making this the main bottleneck (ArjomandBigdeli et al., 2024). Even so, the method is presented as the first verification method for continuously actuated neural network control systems (ArjomandBigdeli et al., 2024).

The significance of these results is methodological. Classical continuous-time verification often assumes fixed control periods or symbolic reachable-set propagation. The neural-ODE tube construction and the continuously actuated controller abstraction instead target continuous-time evolution directly (Gruenbacher et al., 2021, ArjomandBigdeli et al., 2024). This suggests that time-limited continuous verification of learned systems increasingly relies on hybrid combinations of statistical guarantees, local linearization, automatic differentiation, and external NN verifiers rather than on a single monolithic reachability engine.

6. Continuous verification as an operational security mechanism

Outside dynamical-system verification, “continuous verification” can denote an ongoing operational process whose validity is itself time-bounded. In wireless zero-trust architectures, Age of Trust models the time elapsed since the last verification plus an initial age depending on the trust score. The average AoT is optimized jointly with throughput, yielding a bi-objective problem between average trust staleness and communication efficiency (Xiao et al., 2024). For a single link with constant service rate $\tilde{x}(0)\in X_0$6, the optimal verification pattern is periodic with period $\tilde{x}(0)\in X_0$7, and the average reward per slot is $\tilde{x}(0)\in X_0$8, with optimizer $\tilde{x}(0)\in X_0$9 or $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$0 (Xiao et al., 2024). When instantaneous $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$1 is known, the same paper formulates the scheduling problem as an infinite-horizon MDP and gives a Q-learning update for the action $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$2 (Xiao et al., 2024).

The concept of time-bounded verification is sharper in cryptographic credential systems. In zkToken, the holder chooses a verification period $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$3, computes epoch-bound tokens $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$4 for $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$5, and sends a one-time verifiable presentation containing tokens, epochs, claims, expiration, and Groth16 proofs (Manimaran et al., 15 Sep 2025). The verifier may repeat only the revocation check without further holder interaction, but only while the current epoch lies among the originally disclosed epochs (Manimaran et al., 15 Sep 2025). After the declared window ends, the verifier cannot continue probing the revocation status, and the system guarantees proven untraceability of the revocation status after the verification period expires (Manimaran et al., 15 Sep 2025).

A related but distinct security primitive is the Human Challenge Oracle. Here real time is partitioned into equal-length windows, challenges are generated as $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$6, and verification checks a timestamp deadline, a signature or MAC binding the prompt to $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$7, and challenge correctness (Maleki et al., 7 Jan 2026). The stated security properties include time-bound human advantage, identity binding, real-time constraint, and bounded human throughput, leading to the cost bound

$\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$8

for sustaining $\dot{\tilde{x}}(t)=F(u,\tilde{x}(t))$9 active identities in one window (Maleki et al., 7 Jan 2026).

These operational frameworks illustrate a different meaning of “time-limited continuous verification.” The goal is not to prove that a physical trajectory satisfies a temporal logic formula, but to regulate how long repeated checking remains possible and what information or cost structure that repeated checking induces (Xiao et al., 2024, Manimaran et al., 15 Sep 2025, Maleki et al., 7 Jan 2026). A plausible implication is that bounded verification windows can serve either performance objectives, as in AoT, or privacy objectives, as in zkToken.

7. Recurring trade-offs, limitations, and research directions

Across the literature, the dominant trade-off is between soundness and tractability. Interval methods provide sound Valid and Unsat answers but may return Unknown when uniqueness or canonical overlap conditions cannot be proved (Ishii et al., 2016). Under-/over-approximation methods for dense-time reduction similarly yield PASS, FAIL, or Inconclusive depending on which approximation becomes decisive (0804.4383). MITL verification under timing uncertainty makes the same issue quantitative through the gap $CS=(u,x,U\times X,X_0,F)$00 (Selvaratnam et al., 2022).

A second recurring trade-off concerns time discretization. Some approaches explicitly avoid it: moment/SOS risk verification works over the entire planning horizon without time discretization (Jasour et al., 2021); interval monitoring reasons over continuous time through validated integration (Ishii et al., 2016); continuous-time supermartingale certificates and continuously actuated controller abstractions are designed precisely because fixed control periods can distort the verification problem (Neustroev et al., 2024, ArjomandBigdeli et al., 2024). Other approaches accept discretization, but only under conditions that preserve meaning, such as flatness, granularity constraints, and non-Berkeleyness (0911.5642, 0804.4383).

A third trade-off is between expressiveness and automation. Flat MTL admits a clean sampling theorem, whereas full MTL is not in general sampling-invariant (0911.5642). Barrier-certificate decomposition handles safe-LTL over finite traces rather than unrestricted temporal logics (Anand et al., 2021). Full MITL over timed automata becomes manageable only via an intermediate logic and solver pipeline (Menghi et al., 2018). In stochastic and learning-enabled settings, richer models often require either semidefinite programs, iterative CEGIS loops, IBP cell partitioning, or large numbers of local NN-verification queries (Anand et al., 2021, Neustroev et al., 2024, ArjomandBigdeli et al., 2024).

Finally, many papers identify scalability as horizon-dependent in some methods and horizon-independent in others. ODE integration cost, enclosure blow-up, and the number of detected crossings dominate interval monitoring (Ishii et al., 2016). SAT or SMT encodings grow with unrolling depth in bounded model checking (0804.4383, Menghi et al., 2018). By contrast, the SOS certificate size in risk-bounded trajectory verification is independent of $CS=(u,x,U\times X,X_0,F)$01 (Jasour et al., 2021). This suggests that the phrase “time-limited” does not by itself imply favorable asymptotic scaling; the decisive factor is whether the underlying representation grows with the horizon, with the number of region boundaries, with the formula structure, or with the number of verification epochs.

Taken together, the literature presents time-limited continuous verification as a broad technical area centered on bounded temporal semantics over continuous evolution. Its mature forms include interval-based dense-time monitoring, sampling-preserving reductions, probabilistic barrier and supermartingale methods, tube-based verification for continuous-depth models, and cryptographic or protocol mechanisms that explicitly bound the duration of repeated verification (Ishii et al., 2016, 0911.5642, Jasour et al., 2021, Anand et al., 2021, Gruenbacher et al., 2021, Manimaran et al., 15 Sep 2025).