Verification Hierarchy

• Verification Hierarchy is an ordered framework that structures verification tasks by levels reflecting differences in informational content, computational complexity, and expressive power.
• It encompasses varied forms—including representation, proof-power, structural, and safety hierarchies—each addressing trade-offs between succinctness and verification rigor.
• The concept guides systematic decomposition and modular verification strategies in systems ranging from multiagent setups to cyber-physical architectures.

Verification hierarchy is an ordered organization of verification tasks, certificates, abstractions, or subsystem levels in which adjacent levels differ in informational content, expressive power, computational complexity, or system scope. In current research, the term is used for complexity gaps between deterministic, nondeterministic, and alternating goal representations in finite-horizon multiagent systems (Rajasekaran et al., 2022), alternation-based local proof systems with identity-independent certificates (Balliu et al., 2016), verification classes for argumentation semantics (Baumann et al., 2016), and multilevel contract and module structures in cyber-physical, hardware, and software verification (Liu et al., 2016). Taken together, these uses suggest that verification is often not a single yes-or-no procedure, but a stratified object whose levels determine what information is exposed, what properties can be certified, and what computational resources are required.

1. Major meanings of the term

Across the literature, a verification hierarchy typically takes one of four forms. First, it can be a representation hierarchy, where the same underlying verification problem changes complexity as specifications become more succinct, as with DFA, NFA, and AFA goal representations in iterated Boolean games (Rajasekaran et al., 2022). Second, it can be a proof-power hierarchy, where quantifier alternation, certificate format, or semantic side-information determines what can be verified, as in the local distributed hierarchy and the verification classes for argumentation semantics (Balliu et al., 2016, Baumann et al., 2016). Third, it can be a structural hierarchy, where verification is distributed across architecture levels, module boundaries, task trees, or transaction layers (Liu et al., 2016, Ishii, 2024). Fourth, it can be a safety hierarchy, where the property being checked is itself graded rather than binary, as in abstract DNN-verification and multilevel robust control-barrier-function verification (Marzari et al., 8 May 2025, Kang et al., 2023).

These forms are not interchangeable, but they share a common pattern: the hierarchy orders verification by what is retained or abstracted away. In some settings, higher levels are more succinct and computationally harder; in others, they are more informative and therefore strictly more powerful; in still others, they are engineering levels that enable proof reuse and decomposition rather than stronger semantics. This suggests that “hierarchy” in verification is best understood as an ordering principle over evidence, abstraction, or decomposition rather than a single formal definition.

2. Hierarchies induced by representation and succinctness

A clean complexity-theoretic instance appears in finite-horizon multiagent systems. In an iterated Boolean game with agent set $\Omega$ and a designated set $W \subseteq \Omega$ of “good” agents, the central questions are realizability—whether there exists a strategy profile that is a $W$-NE—and verification—whether a given strategy profile $\pi$ is a $W$-NE. When each agent’s finite-horizon temporal goal is represented by a DFA, NFA, or AFA, the goal language becomes progressively more succinct, with a worst-case exponential gap between successive representations (Rajasekaran et al., 2022).

The resulting complexity hierarchy is strict for realizability but collapses for verification:

Goal representation	Realizability	Verification
DFA	PSPACE-complete	PSPACE-complete
NFA	EXPTIME-complete	PSPACE-complete
AFA	2EXPTIME-complete	PSPACE-complete

Formally, the paper asks whether an iBG with goal automata $\mathcal{A}$ admits a $W$-NE, yielding PSPACE-completeness for DFA goals, EXPTIME-completeness for NFA goals, and 2EXPTIME-completeness for AFA goals (Rajasekaran et al., 2022). The explanation given in the paper is that determinization causes an exponential blowup from NFA to DFA and a doubly exponential blowup from AFA to DFA, which affects the search for a Nash equilibrium. By contrast, verification can be performed on-the-fly and remains PSPACE-complete for all three representations.

This contrast is significant because it shows that greater representational succinctness does not uniformly make all associated verification questions harder. In this setting, only the existential search problem—realizability—tracks the hierarchy of succinctness. The checking problem—verification of a supplied profile—does not.

A related but more explicitly resource-theoretic hierarchy is the verifier hierarchy based on certificate complexity. “A Verifier Hierarchy” proves a Verifier Trade-off Theorem: reducing inherent verification time from $f(n)$ to $g(n)$, where $f(n) \ge g(n)$, requires certificates of length at least

$W \subseteq \Omega$0

This induces a hierarchy based on certificate length and connects certificate complexity to class separations such as $W \subseteq \Omega$1 versus $W \subseteq \Omega$2 (Kaptein, 31 Jul 2025). The same framework is applied to string periodicity and string rotation, where a $W \subseteq \Omega$3-bit certificate suffices to reduce quadratic verification to linear verification.

3. Hierarchies induced by certificates, interaction, and proof power

In distributed verification, the hierarchy is organized by quantifier alternation over identity-independent certificates. For distributed languages in the LOCAL model, the paper “Local Distributed Verification” defines classes $W \subseteq \Omega$4 and $W \subseteq \Omega$5 and proves the strict chain

$W \subseteq \Omega$6

Here, $W \subseteq \Omega$7 means that every Turing-decidable network predicate can be locally verified with a two-round adversarial protocol using certificates independent of node identities (Balliu et al., 2016). The key technical point is that non-interactive identity-independent certificates are insufficient for all predicates, but challenge-response interaction restores full expressive power.

Argumentation theory yields a different proof-power hierarchy. “Verifiability of Argumentation Semantics” introduces verification classes based on what information about range and anti-range is added on top of conflict-free sets. The paper reports 15 verification classes, collapsed from 128 syntactically possible ones, ordered by informativeness via a reduction relation $W \subseteq \Omega$8 when $W \subseteq \Omega$9 can be computed from $W$0 (Baumann et al., 2016). Standard semantics are then located exactly in this hierarchy: naive semantics are exactly $W$1-verifiable, stable and stage semantics are exactly $W$2-verifiable, admissible, preferred, and ideal semantics are exactly $W$3-verifiable, semi-stable and eager are exactly $W$4-verifiable, grounded and strongly admissible are exactly $W$5-verifiable, and complete semantics are exactly $W$6-verifiable (Baumann et al., 2016). The hierarchy therefore classifies semantics by minimal informational requirements rather than by extension sets alone.

A further certificate hierarchy appears in probabilistic verification of $W$7-regular properties. “A Hierarchy of Supermartingales for $W$8-Regular Verification” introduces generalized Streett supermartingales, lexicographic generalized Streett supermartingales, distribution-valued Streett supermartingales, and progress-measure supermartingales, and proves strict increases in verification power over classic Streett supermartingales (Kura et al., 29 Nov 2025). GSSMs are complete for positive recurrence, DVSSMs are complete for null recurrence, and DVSSMs are described as, in theory, the most powerful certificates in the hierarchy (Kura et al., 29 Nov 2025). This is a verification hierarchy in the literal sense of stronger and weaker certificates for the same almost-sure verification objective.

Taken together, these works suggest a common notion of verification power: richer certificates, more alternation, or more informative side-data can strictly enlarge the class of properties or systems that admit local or automatic verification.

4. Hierarchies induced by system structure and compositional decomposition

In engineering-oriented formal methods, verification hierarchy commonly refers to a decomposition of the system itself. The development flow from architecture to components is a canonical case. “From Design Contracts to Component Requirements Verification” models system development as a hierarchy in which system-level requirements are decomposed into high-level component requirements and then low-level requirements, with assume-guarantee contracts expressed in AGREE over AADL models and automatically translated through Lustre to Simulink observers for component-level verification by Simulink Design Verifier (Liu et al., 2016). The workflow explicitly supports traceability from specification models to design models and is aligned with DO-178C, DO-331, and DO-333.

A distinct structural hierarchy appears in concurrent program verification. “Modular Verification of Concurrent Programs via Sequential Model Checking” arranges threads hierarchically, treating one thread as “main” and the rest as its environment, recursively (Rasin et al., 2021). Verification is reduced to sequential tasks, environment information is gathered lazily through environment queries, and the CoMuS tool works particularly well on hierarchically structured programs (Rasin et al., 2021). The reported advantage is strongest for chain-structured dependencies and weaker for non-hierarchical topologies such as rings.

Hierarchical decomposition is formalized even more directly in synchronous systems. “A Hypergraph-based Formalization of Hierarchical Reactive Modules and a Compositional Verification Method” models modules as directed hypergraphs and introduces an adapter module $W$9 so that a hierarchical module can be decomposed into submodules plus the adapter while preserving the top-level contract (Ishii, 2024). The method allows circular systems in which submodules mutually depend on each other. In the reported experiments, monolithic verification timed out for 36 digital filters, while the compositional method completed in 15.4 seconds while checking 75 guarantee properties (Ishii, 2024).

Microarchitectural memory consistency verification exhibits the same pattern. RealityCheck introduces a modular specification language, $\pi$0spec++, in which hardware designs are specified as hierarchies of modules and interfaces rather than flat models (Manerkar et al., 2020). Interface abstraction permits scalable litmus-test verification, and the paper reports verification of 98 RVWMO litmus tests in under 4 minutes each, with abstraction yielding up to a 32.1% reduction in verification time (Manerkar et al., 2020).

Additional variants reinforce the same structural idea. Hierarchical artifact systems use a rooted tree of tasks and a hierarchy of Vector Addition Systems to obtain decidability and complexity bounds for verification of data-rich workflows with concurrency, artifact relations, and arithmetic constraints (Deutsch et al., 2016). Transaction-level hierarchy in PDVL organizes assertions and functional coverage across TRs and VTRs, compiles them to Gallina for Coq, and reuses lower-level proofs at higher abstraction levels; the paper argues that functional coverage can be converted into proof obligations and that proving them is equivalent to 100% coverage (Strauch, 2 Jan 2025).

5. Hierarchies of safety, robustness, and semantic granularity

Another major use of verification hierarchy replaces binary acceptance with graded safety. “Advancing Neural Network Verification through Hierarchical Safety Abstract Interpretation” defines Abstract DNN-Verification, in which verification is performed against a user-defined abstraction hierarchy over output classes rather than a single safe/unsafe predicate (Marzari et al., 8 May 2025). The abstraction function $\pi$1 groups outputs into safety levels, so a result can be “provably safe,” “abstract safe,” or unsafe. The paper states that the new formulation remains NP-complete, but may require the same in the worst case or even potentially less computational effort than traditional binary verification, because higher-level abstractions can permit earlier termination (Marzari et al., 8 May 2025). It also allows adversarial inputs to be ranked by abstract safety-level violation.

Robust control-barrier-function verification yields a multilevel optimization hierarchy. For control-affine polynomial systems with bounded additive uncertainty, verification is formulated as a three-level polynomial optimization problem over uncertainty, control, and state, while synthesis adds an outer optimization over the parameters of a chosen parametric CBF candidate (Kang et al., 2023). By invoking KKT conditions for the inner control and uncertainty optimizations, verification reduces to a single-level POP and synthesis to a min-max POP, both treated with semidefinite relaxations based on Lasserre’s hierarchy (Kang et al., 2023). The paper proves asymptotic global convergence for both verification and synthesis relaxations.

Hierarchy-consistency verification in continual learning is a more application-specific example. HCV operates in the IIRC setting by incrementally discovering superclass-subclass relations and using them during both training and inference (Wang et al., 2021). The method has two phases—Learning Hierarchical Relations and Superclass Pseudo-Labeling—and improves existing continual learning methods by 3–21% absolute accuracy measured by precision-weighted Jaccard similarity, while increasing hierarchical consistency as measured by the Hierarchy Correctness Score, with iCaRL+HCV reaching up to approximately 76% HCS (Wang et al., 2021). Here the hierarchy is not a complexity hierarchy; it is a hierarchy of labels whose consistency is itself the verification target.

These examples show that verification hierarchies need not order proof systems alone. They can also order levels of tolerated violation, quantify nested adversarial choices, or encode semantic relations among labels and outputs.

6. Contemporary methodological variants, empirical lessons, and limitations

Recent work on LLM evaluation illustrates a methodological verification hierarchy organized by role separation and information restriction. “Cross-Context Verification” combines session-isolated solution generation with a Hierarchical Cross-Context Architecture containing four layers—Designer, Executor, Analysts, and Integrator—with strictly upward information flow and no lateral communication among analysts (Song, 23 Mar 2026). On 9 SWE-bench Verified problems, the paper reports perfect separation between contaminated and genuine reasoning with Mann-Whitney $\pi$2, $\pi$3, and $\pi$4, and states that 33% of prior contamination labels are false positives (Song, 23 Mar 2026). A pilot Worker $\pi$5 Verifier $\pi$6 Director pipeline in which later stages saw prior conclusions yielded 100% sycophantic confirmation and unchanged $\pi$7, which the paper presents as evidence that information restriction, not structural complexity alone, is the key mechanism (Song, 23 Mar 2026).

A different modern variant appears in decentralized distributed digital ledgers. “Multilevel Verification on a Single Digital Decentralized Distributed Ledger” models verification authorities as a perfect $\pi$8-ary tree of height $\pi$9, where each level verifies both the transactions and the correctness of the previous level’s metadata (Thada et al., 2024). The paper gives formulas for the total number of authorities,

$W$0

and for adversarial catch-up probability through multilevel confirmation dynamics (Thada et al., 2024). Here verification hierarchy is a chain of trust embedded in ledger state rather than a complexity class or proof system.

Several recurring lessons follow. First, more levels do not automatically imply stronger verification. In multiagent systems, realizability becomes harder across DFA, NFA, and AFA goals while verification stays PSPACE-complete (Rajasekaran et al., 2022). In HCCA, adding more review stages without information restriction produced a negative result rather than improvement (Song, 23 Mar 2026). Second, hierarchy is often beneficial when it aligns with the actual modular or organizational structure of the system being analyzed, as in contract export, reactive-module decomposition, and modular memory-model verification (Liu et al., 2016, Ishii, 2024, Manerkar et al., 2020). Third, when hierarchy is used to grade safety or admissibility, it changes the semantics of the verdict itself: verification can return a level of violation, a minimal information class, or a recurrence certificate rather than only acceptance or rejection (Marzari et al., 8 May 2025, Baumann et al., 2016, Kura et al., 29 Nov 2025).

In that sense, the modern verification hierarchy is less a single doctrine than a unifying research pattern: verification is stratified whenever the problem benefits from ordered abstractions, ordered certificates, or ordered system levels, and the technical content of the hierarchy lies in proving what each level can express, decide, or certify.