TNODEV: Neural ODE Verification Toolbox

• The paper introduces TNODEV, a toolbox that integrates lightweight falsification with CTMM-based fast interval reachability and iterative refinement to deliver sound verification of neural ODEs.
• It employs continuous-time mixed monotonicity to compute tight over-approximations, enabling effective handling of safety properties in both closed-loop and hybrid neural ODE models.
• The tool’s lock-free parallel scheduler and three input-splitting heuristics notably reduce verification time, making it practical for high-dimensional, safety-critical applications.

TNODEV usually denotes the Toolbox for Neural ODE Verification, an end-to-end, sound verifier for neural ordinary differential equations that combines lightweight falsification, interval-based reachability via continuous-time mixed monotonicity (CTMM), iterative refinement with three input-set splitting heuristics, and parallel scheduling in a single verification pipeline (Sayed et al., 15 Jun 2026). It is designed for settings in which neural ODE models appear in safety-critical workflows, including continuous-time controllers for cyber-physical systems and classifiers embedded in automated decision pipelines. In the literature represented here, the acronym also appears in a distinct sense as a “roadmap for ‘TNODEV’ (Nomadic Node Deployment)” in a digital-twin case study of LTE nomadic nodes in Kathmandu; this is a separate usage and should not be conflated with the neural-ODE verification toolbox (Mavromatis et al., 2024).

1. Scope, problem setting, and verdict semantics

TNODEV addresses the formal verification of neural ODE behavior under bounded input uncertainty. Existing tools dedicated to neural ODE are described as providing only a single reachability call without iterative input-set refinement, which limits the precision of their verdicts to whatever one reachability call can deliver (Sayed et al., 15 Jun 2026). TNODEV is presented as the first sound formal verifier for neural ODE that integrates a falsification checker, a fast interval-based reachability backend based on continuous-time mixed monotonicity, a verification and refinement loop with three input-set splitting heuristics, and a parallel scheduler in a single end-to-end pipeline.

The verification problem is posed over an initial input set $X$, a safety property $P$, and a final time $t_x$. The toolbox returns one of three verdicts. It returns FALSIFIED if the falsification stage finds a concrete counterexample. It returns SAFE if the queue of input cells becomes empty within the verification budget, meaning that all subcells have been discharged by sound over-approximation and specification checking. It returns UNKNOWN if either the iteration budget $K$ or wall-clock timeout $T_{\max}$ is reached while the queue remains nonempty (Sayed et al., 15 Jun 2026).

This formulation is significant because it separates concrete violation finding from proof-oriented over-approximation. A plausible implication is that TNODEV is intended not merely as a reachability engine but as a verification orchestrator whose precision derives from iterative decomposition of the initial set rather than from a single enclosure alone.

2. End-to-end workflow and scheduler

TNODEV’s workflow has four main stages: a falsification checker, a verification and refinement loop, a parallel scheduler, and an output stage (Sayed et al., 15 Jun 2026).

The falsification checker draws samples from the initial input set $X$, specifically corners, centroid, random points. Each sample is integrated forward under the neural ODE to time $t_x$. If any trajectory violates the safety property $P$, TNODEV immediately returns FALSIFIED together with a concrete counterexample.

If falsification does not succeed, TNODEV enters the verification and refinement loop. A queue $Q$ of input “cells” is maintained, initially $Q=\{X\}$. The loop repeats until $P$0 is empty or the budget is exhausted. A batch of cells is popped from $P$1 and processed in parallel. For each cell $P$2, the verifier computes an interval over-approximation $P$3 by calling $P$4, then invokes the specification interface to check whether $P$5 is contained in the safe set. If the check passes, the cell is marked SAFE; otherwise, the cell is split into two subcells by the chosen heuristic and the children are pushed back onto $P$6.

The scheduler uses a work-stealing thread pool. Each worker pops one cell at a time, runs reachability plus specification checking, and then either marks the cell SAFE or pushes two children onto $P$7, all without global locks (Sayed et al., 15 Jun 2026). This engineering choice reflects the independence of per-cell reachability and specification checks. This suggests that the architecture is designed to exploit embarrassingly parallel structure in refinement-based verification.

3. CTMM reachability and refinement heuristics

The core reachability backend is interval-based reachability via continuous-time mixed monotonicity (CTMM). CTMM is described as overcoming the usual wrapping effect of interval propagation by embedding the original neural ODE into a $P$8-dimensional monotone system whose interval bounds can be tracked tightly (Sayed et al., 15 Jun 2026).

Given

$P$9

and writing $t_x$0, CTMM proceeds in three steps. First, it computes an over-approximation of the reachable tube

$t_x$1

by any off-the-shelf ODE reachability method, such as CORA, obtaining $t_x$2. On $t_x$3, interval arithmetic on the analytic Jacobian $t_x$4 yields interval bounds $t_x$5.

Second, TNODEV builds a decomposition function $t_x$6 satisfying

$t_x$7

by shifting off-diagonal Jacobian entries to constant sign via a precomputed shift matrix $t_x$8.

Third, it integrates once the embedded system

$t_x$9

and obtains

$K$0

Because only one $K$1-dimensional integration is required per call, CTMM is described as extremely fast, which makes it suitable as a subroutine within a refinement loop.

If a cell is inconclusive, TNODEV splits it along one input dimension selected by one of three heuristics. In the representation

$K$2

the Naive heuristic chooses

$K$3

that is, the largest side of the box. The Most-Sensitive-Input-Radius (MSIR) heuristic computes

$K$4

with the cost of one interval Jacobian pass, described as negligible relative to reachability. The Interval-Norm-Gradient (ING) heuristic perturbs the center $K$5 in each input dimension, recomputes reachability, estimates

$K$6

and incurs $K$7 extra reachability calls per refinement (Sayed et al., 15 Jun 2026).

Empirically, MSIR is reported to provide the best trade-off of precision versus cost. ING is stated to be prohibitive in higher dimensions because of its $K$8-fold overhead.

4. Supported model classes and formal specifications

TNODEV currently supports three model classes and associated specification forms (Sayed et al., 15 Jun 2026).

Pure Neural ODE Safety uses the model

$K$9

with an interval safe-set inclusion specification in which the safe set $T_{\max}$0 is an axis-aligned interval $T_{\max}$1.

Closed-Loop Neural ODE considers a neural plant plus a neural-network controller: $T_{\max}$2 The closed loop is treated as an autonomous system

$T_{\max}$3

with the same interval safe-set inclusion specification as above.

General Neural ODE (GNODE) Classification Robustness addresses hybrid networks with pre-ODE discrete layers, an ODE block, and post-ODE discrete layers. For a clean example $T_{\max}$4, the perturbation set is

$T_{\max}$5

and the robustness property is

$T_{\max}$6

TNODEV encodes this as the half-space intersection

$T_{\max}$7

The specification interface supports two concrete checks. For interval safe-set inclusion, $T_{\max}$8 iff $T_{\max}$9 and $X$0 component-wise. For classification robustness, TNODEV checks emptiness of $X$1 for each $X$2, where

$X$3

This organization is notable because it places pure flows, closed-loop controlled dynamics, and hybrid GNODE classifiers within a single verification framework. A plausible implication is that TNODEV’s principal abstraction boundary is the pair of interfaces Reach and SpecCheck, rather than any one application domain.

5. Implementation choices and benchmark results

The implementation is described as a MATLAB, C++, or Python front-end driving external tools. The default reachability backend is CTMM via TIRA, while CORA’s zonotopes or NNV 2.0 star-set can be used on demand. The design is modular: new model classes or reachability engines can be plugged in by implementing the standard Reach and SpecCheck interfaces. These choices are said to maximize raw speed per reachability call while retaining soundness, with the trade-off that pure interval CTMM can produce looser enclosures that the refinement loop can correct by splitting (Sayed et al., 15 Jun 2026).

The reported evaluation covers direct reachability comparison, safe-set inclusion verification, and MNIST GNODE classification robustness.

Benchmark setting	Tool/result	Reported outcome
Spiral 2D single-call reachability	CTMM	0.3 s, $X$4
Spiral 2D single-call reachability	NNV 2.0	4.2 s, $X$5
Spiral 2D single-call reachability	CORA	25 s, $X$6
FPA 5D single-call reachability	CTMM	0.32 s, $X$7
FPA 5D single-call reachability	NNV 2.0	2.16 s, $X$8
FPA 5D single-call reachability	CORA	12.34 s, $X$9

For these single-call benchmarks, the geometric-mean width is $t_x$0. The interpretation given is that CTMM is 7–80× faster per call, but its intervals can be 4× wider on strongly rotated flows (Sayed et al., 15 Jun 2026).

For safe-set inclusion verification, the benchmarks are Spiral (linear and nonlinear, 2D), FPA (5D), Cartpole (12D), and ACC (8D linear and nonlinear), with budget $t_x$1 splits and timeout $t_x$2 min. Out of 18 runs (6 benchmarks × 3 heuristics), TNODEV reported 14 SAFE and 4 UNKNOWN, with ING exhausting budget or timeout. MSIR consistently minimized both iterations and wall-clock time. The paper gives the Cartpole example: Naive needed 2037 splits in 2.73 min; MSIR needed 63 splits in 56 s (Sayed et al., 15 Jun 2026).

For MNIST classification robustness on GNODE models CNODE_S and CNODE_M from Manzanas et al. 2022, with attack radius $t_x$3 and the first 50 test images, the hybrid pipeline handles pre-ODE layers and the post-ODE FC layer by NNV 2.0 star sets, while the ODE block is handled by TNODEV’s closed-form matrix-exponential to interval box. The reported results are: NNV 2.0 (single call) certifies 49/50 robust for CNODE_S in 10.8 s/image and 50/50 for CNODE_M in 166 s/image; TNODEV (fast mode) certifies 29/50 robust for CNODE_S in 2.2 s/image and 30/50 for CNODE_M in 0.83 s/image; TNODEV (LP-tight boundary) yields the same robust counts but is 5–25× slower than fast mode. The reported trade-off is that TNODEV is 5–200× faster per image, but the interval hull of the linear ODE block widens logits by ~7–8×, reducing the number of certifiable images (Sayed et al., 15 Jun 2026).

6. Interpretation, limitations, and acronym ambiguity

The central technical trade-off in TNODEV is explicit. CTMM gives blazing-fast reachability calls and is described as 1–2 orders of magnitude faster than NNV 2.0 or CORA for the same input cell, but interval over-approximations may be looser than zonotopic or star-set methods in some regimes (Sayed et al., 15 Jun 2026). TNODEV addresses this by combining sound over-approximation with iterative refinement and parallelization. This suggests a verification philosophy in which coarse but very fast enclosures are made practically useful through selective partitioning of the input space.

A common source of confusion is the acronym itself. In the neural-ODE verification literature, TNODEV refers to the Toolbox for Neural ODE Verification (Sayed et al., 15 Jun 2026). In a separate LTE digital-twin case study for Kathmandu, the same acronym is used in the phrase “a quantitatively proven, cost-effective roadmap for ‘TNODEV’ (Nomadic Node Deployment)” (Mavromatis et al., 2024). The two usages are unrelated in subject matter: one concerns formal verification of continuous-time neural models, while the other concerns deployment planning for LTE nomadic nodes within the DRIVE digital twin.

Within the verification context, TNODEV’s distinguishing feature is therefore not a single reachability algorithm alone, but the integration of falsification, CTMM-based reachability, refinement heuristics, and lock-free parallel scheduling into one sound end-to-end pipeline.