Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks
Not on the map. Why?
Abstract (arXiv)
Deep neural networks have emerged as a widely used and effective means for tackling complex, real-world problems. However, a major obstacle in applying them to safety-critical systems is the great difficulty in providing formal guarantees about their behavior. We present a novel, scalable, and efficient technique for verifying properties of deep neural networks (or providing counter-examples). The technique is based on the simplex method, extended to handle the non-convex Rectified Linear Unit (ReLU) activation function, which is a crucial ingredient in many modern neural networks. The verification procedure tackles neural networks as a whole, without making any simplifying assumptions. We evaluated our technique on a prototype deep neural network implementation of the next-generation airborne collision avoidance system for unmanned aircraft (ACAS Xu). Results show that our technique can successfully prove properties of networks that are an order of magnitude larger than the largest networks verified using existing methods.
Key facts. Cited by 739 papers in the map (data through 7 Oct 2026). First posted on arXiv 3 Feb 2017.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2018: 1; 2019: 0; 2020: 0; 2021: 137; 2022: 147; 2023: 128; 2024: 108; 2025: 98; 2026: 120.
739 papers.
Sort:
By area:
- 2018Scalable agent alignment via reward modeling: a research directioncited by 438
- 2023Are aligned neural networks adversarially aligned?cited by 305
- 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 224
- 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
- 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
- 2022General Cutting Planes for Bound-Propagation-Based Neural Network Verificationcited by 102
- 2022Complete Verification via Multi-Neuron Relaxation Guided Branch-and-Boundcited by 92
- 2024Marabou 2.0: A Versatile Formal Analyzer of Neural Networkscited by 81
- 2021Explainability of deep vision-based autonomous driving systems: Review and challengescited by 80
- 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
- 2021The Second International Verification of Neural Networks Competition (VNN-COMP 2021): Summary and Resultscited by 71
- 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
38 more
- 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 64
- 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
- 2023First Three Years of the International Verification of Neural Networks Competition (VNN-COMP)cited by 58
- 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
- 2022Certified Training: Small Boxes are All You Needcited by 51
- 2022Safe Reinforcement Learning via Shielding under Partial Observabilitycited by 49
- 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 48
- 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
- 2022Logic-Based Explainability in Machine Learningcited by 47
- 2023Evaluating Superhuman Models with Consistency Checkscited by 47
- 2024Neural Network Verification with Branch-and-Bound for General Nonlinearitiescited by 47
- 2021Fast Certified Robust Training with Short Warmupcited by 45
- 2022Efficiently Computing Local Lipschitz Constants of Neural Networks via Bound Propagationcited by 45
- 2021Improved Branch and Bound for Neural Network Verification via Lagrangian Decompositioncited by 44
- 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 44
- 2021MultiplexNet: Towards Fully Satisfied Logical Constraints in Neural Networkscited by 44
- 2022Causality-based Neural Network Repaircited by 44
- 2022Towards Formal XAI: Formally Approximate Minimal Explanations of Neural Networkscited by 42
- 2021CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothingcited by 41
- 2021Reachability Analysis of Neural Feedback Loopscited by 41
- 2022Adversarial Robustness of Deep Neural Networks: A Survey from a Formal Verification Perspectivecited by 41
- 2021Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Aheadcited by 40
- 2021Guidance on the Assurance of Machine Learning in Autonomous Systems (AMLAS)cited by 40
- 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
- 2021Provable Repair of Deep Neural Networkscited by 39
- 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
- 2022Neural Lyapunov Control of Unknown Nonlinear Systems with Stability Guaranteescited by 39
- 2022The Third International Verification of Neural Networks Competition (VNN-COMP 2022): Summary and Resultscited by 39
- 2023When Deep Learning Meets Polyhedral Theory: A Surveycited by 39
- 2021POLAR: A Polynomial Arithmetic Framework for Verifying Neural-Network Controlled Systemscited by 38
- 2022Don't Lie to Me! Robust and Efficient Explainability with Verified Perturbation Analysiscited by 38
- 2021OVERT: An Algorithm for Safety Verification of Neural Network Control Policies for Nonlinear Systemscited by 37
- 2021How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Reviewcited by 36
- 2021Neural Network Robustness as a Verification Property: A Principled Case Studycited by 35
- 2021Scalable Certified Segmentation via Randomized Smoothingcited by 35
- 2023A Survey on Knowledge Editing of Neural Networkscited by 34
- 2021A Review of Formal Methods applied to Machine Learningcited by 33
- 2021Towards Scalable Verification of Deep Reinforcement Learningcited by 33
50 most cited of 739 All 739 (JSON)
- 2026Security Properties of Neural Networks as Decision Problems30 Sep 2026
- 2026Certification-Based Differentially Private Learning30 Sep 2026
- 2026Verifying Neural Networks with Reinforcement Learning28 Sep 2026
- 2026ZonoGPT: Towards An Abstract Domain for Verifying Large GPT Models28 Sep 2026
- 2026Zero-Storage Procedural Neural Synthesis via Boundary Dynamics: Formal Verification in Lean 4 and Bare-Metal Gauntlet Validation27 Sep 2026
- 2026NNV3: Expanding Neural Network Verification to New Architectures and Domains24 Sep 2026
- 2026Exploring Solver-Level Warmstarting for Neural Network Verification22 Sep 2026
- 2026Incremental Consistency Execution for Autonomous Intelligent Systems21 Sep 2026
- 2026SoK: Formal Methods for Fact-Checking and Information Integrity19 Sep 2026
- 2026Building Trust in Artificial Intelligence: A Necessity for Railway Applications16 Sep 2026
- 2026Large Language Models in the Loop: A Stability- and Network-Aware Survey in Networked Control, Cyber-Physical, and Multi-Agent Systems15 Sep 2026
- 2026The Misery of Mechanistic Interpretability: A Formal Perspective14 Sep 2026
38 more
- 2026Robust Policy Optimization via Adversarial Importance Sampling11 Sep 2026
- 2026Probabilistic Model Checking of Autoregressive Neural Sequence Models1 Sep 2026
- 2026(DNN)2: Doubly Non-Negative Relaxations for Deep Neural Networks25 Aug 2026
- 2026On the Applicability of Safety Nets: A Safety-By-Design Solution for Certifying Neural Networks20 Aug 2026
- 2026Certified Mechanistic Interpretability: Lifting Single-Input Findings to Bounded Neighbourhoods17 Aug 2026
- 2026Certified but Private: Scalable Zero-Knowledge Proofs for Neural Network Guarantees17 Aug 2026
- 2026Beyond L2: Generalizing Abductive Latent Explanations to Diverse Prototype-Based Architectures17 Aug 2026
- 2026Branch and Bound for Relational Verification of Neural Networks13 Aug 2026
- 2026Clustered Randomized Smoothing for Stochastic Prediction Functions12 Aug 2026
- 2026Look Before You Leap: Pre-Action Verification for LLM Agents9 Aug 2026
- 2026Directed Neuro-Symbolic Stochastic Execution for Verification of Distributed Parallel AI Programs8 Aug 2026
- 2026VACS: Value-Aligned Compositional Shielding for Multi-Agent Reasoning7 Aug 2026
- 2026The Off-Support Barrier: Why Semantic Safety Constraints Are Not Learning-Problem Invariants, and What Follows for Prior Design, Containment, and Verification1 Aug 2026
- 2026Learning Lookahead Lemmas for Neural Network Verification31 Jul 2026
- 2026Mining Verdict Boundaries for Neural Network Verification31 Jul 2026
- 2026Certified Training for Convolutional Perturbations20 Jul 2026
- 2026Integrating High-Level Requirements to Low-Level Tests with Machine-Readable V&V Specifications20 Jul 2026
- 2026Lookahead Branching for Neural Network Verification19 Jul 2026
- 2026Random Parameter Noise Does Not Make Exact ReLU Verification Easy15 Jul 2026
- 2026Traffic-Aware Randomized Smoothing for LLM-Based Network Intrusion Detection15 Jul 2026
- 2026Physics-Audited Agentic Discovery in Scientific Machine Learning8 Jul 2026
- 2026Repurposing CLIP to Localize at Pixel Level6 Jul 2026
- 2026Fast SDP certification of neural networks : towards large multi-class datasets3 Jul 2026
- 2026Improving Certified Robustness via Adversarial Distillation30 Jun 2026
- 2026Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement22 Jun 2026
- 2026Are Safety Guarantees in Neural Networks Safe? How to Compute Trustworthy Robustness Certifications22 Jun 2026
- 2026Verifiable Foundation Models for Robot Safety22 Jun 2026
- 2026Formal Verification of Learned Multi-Agent Communication Policies via Decision Tree Distillation17 Jun 2026
- 2026Some Complexity Results for Robustness Verification for Binarized Neural Networks17 Jun 2026
- 2026Veriphi: Attack-Guided Neural Network Verification with Dataset-Dependent Training Methods16 Jun 2026
- 2026Robustness Verification of Recurrent Neural Networks with Abstraction Refinement10 Jun 2026
- 2026Hybrid Robustness Verification for Spatio-Temporal Neural Networks8 Jun 2026
- 2026Scaling Neural Network Verification with Tensor Parallelism and Fully Sharded Data Parallelism8 Jun 2026
- 2026A Note on the Strategic Confinement Problem7 Jun 2026
- 2026veriFIRE: an Industrial Case Study in Verifying Consistency Properties for a DNN-Based Wildfire Detection System2 Jun 2026
- 2026MLSkip: Data Skipping for ML Filters via Lightweight Metadata2 Jun 2026
- 2026Rethinking Evaluation Paradigms in IBP-based Certified Training1 Jun 2026
- 2026Neural Network Verification using Partial Multi-Neuron Relaxation28 May 2026
50 newest of 739 All 739 (JSON)
- 2025Systems Security Foundations for Agentic Computingcited by 9
- 2025Stop Reducing Responsibility in LLM-Powered Multi-Agent Systems to Local Alignmentcited by 7
- 2025Assured autonomy: How operations research powers and orchestrates generative AI systemscited by 4
- 2026FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversightcited by 2
- 2026Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcementcited by 2
- 2026Look Before You Leap: Pre-Action Verification for LLM Agentscited by 1
- 2026Formal Semantics for Agentic Tool Protocols: A Process Calculus Approachcited by 0
- 2026Provably Secure Agent Guardrailcited by 0
- 2026Physics-Audited Agentic Discovery in Scientific Machine Learningcited by 0
- 2026Large Language Models in the Loop: A Stability- and Network-Aware Survey in Networked Control, Cyber-Physical, and Multi-Agent Systemscited by 0
- 2026Large Language Models in the Loop: A Stability- and Network-Aware Survey in Networked Control, Cyber-Physical, and Multi-Agent Systems15 Sep 2026
- 2026Look Before You Leap: Pre-Action Verification for LLM Agents9 Aug 2026
- 2026Physics-Audited Agentic Discovery in Scientific Machine Learning8 Jul 2026
- 2026Toward Safe LLM Agents: A Survey of Specification, Verification, and Enforcement22 Jun 2026
- 2026Provably Secure Agent Guardrail28 May 2026
- 2026Formal Semantics for Agentic Tool Protocols: A Process Calculus Approach25 Mar 2026
- 2026FormalJudge: A Neuro-Symbolic Paradigm for Agentic Oversight11 Feb 2026
- 2025Assured autonomy: How operations research powers and orchestrates generative AI systems30 Dec 2025
- 2025Systems Security Foundations for Agentic Computing1 Dec 2025
- 2025Stop Reducing Responsibility in LLM-Powered Multi-Agent Systems to Local Alignment15 Oct 2025
- 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
- 2022Causality-based Neural Network Repaircited by 44
- 2024Certified Robustness to Data Poisoning in Gradient-Based Trainingcited by 17
- 2026Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programmingcited by 3
- 2026The Defense Trilemma: Why Prompt Injection Defense Wrappers Fail?cited by 2
- 2024Confidence Preservation Property in Knowledge Distillation Abstractionscited by 1
- 2026Beyond Red-Teaming: Formal Guarantees of LLM Guardrail Classifierscited by 0
- 2026Security Properties of Neural Networks as Decision Problemscited by 0
- 2026Security Properties of Neural Networks as Decision Problems30 Sep 2026
- 2026Beyond Red-Teaming: Formal Guarantees of LLM Guardrail Classifiers11 May 2026
- 2026The Defense Trilemma: Why Prompt Injection Defense Wrappers Fail?7 Apr 2026
- 2026Exact Certification of Data-Poisoning Attacks Using Mixed-Integer Programming18 Feb 2026
- 2024Certified Robustness to Data Poisoning in Gradient-Based Training9 Jun 2024
- 2024Confidence Preservation Property in Knowledge Distillation Abstractions21 Jan 2024
- 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attacks16 Oct 2023
- 2022Causality-based Neural Network Repair20 Apr 2022
- 2024Concept-based Analysis of Neural Networks via Vision-Language Modelscited by 6
- 2023Fast Certification of Vision-Language Models Using Incremental Randomized Smoothingcited by 4
- 2026CUAAudit: Meta-Evaluation of Vision-Language Models as Auditors of Autonomous Computer-Use Agentscited by 3
- 2025Randomized Smoothing Meets Vision-Language Modelscited by 1
- 2025CeTAD: Towards Certified Toxicity-Aware Distance in Vision Language Modelscited by 0
- 2026CUAAudit: Meta-Evaluation of Vision-Language Models as Auditors of Autonomous Computer-Use Agents11 Mar 2026
- 2025Randomized Smoothing Meets Vision-Language Models19 Sep 2025
- 2025CeTAD: Towards Certified Toxicity-Aware Distance in Vision Language Models8 Mar 2025
- 2024Concept-based Analysis of Neural Networks via Vision-Language Models28 Mar 2024
- 2023Fast Certification of Vision-Language Models Using Incremental Randomized Smoothing15 Nov 2023
- 2018Scalable agent alignment via reward modeling: a research directioncited by 438
- 2023Are aligned neural networks adversarially aligned?cited by 305
- 2023Are aligned neural networks adversarially aligned?26 Jun 2023
- 2018Scalable agent alignment via reward modeling: a research direction19 Nov 2018
- 2023Efficient Symbolic Reasoning for Neural-Network Verification23 Mar 2023
- 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 224
- 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
- 2022General Cutting Planes for Bound-Propagation-Based Neural Network Verificationcited by 102
- 2022Complete Verification via Multi-Neuron Relaxation Guided Branch-and-Boundcited by 92
- 2024Marabou 2.0: A Versatile Formal Analyzer of Neural Networkscited by 81
- 2021Explainability of deep vision-based autonomous driving systems: Review and challengescited by 80
- 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
- 2021The Second International Verification of Neural Networks Competition (VNN-COMP 2021): Summary and Resultscited by 71
- 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
- 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 64
- 2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systemscited by 63
- 2023First Three Years of the International Verification of Neural Networks Competition (VNN-COMP)cited by 58
12 most cited of 709 All 709 (JSON)
- 2026Certification-Based Differentially Private Learning30 Sep 2026
- 2026Verifying Neural Networks with Reinforcement Learning28 Sep 2026
- 2026ZonoGPT: Towards An Abstract Domain for Verifying Large GPT Models28 Sep 2026
- 2026Zero-Storage Procedural Neural Synthesis via Boundary Dynamics: Formal Verification in Lean 4 and Bare-Metal Gauntlet Validation27 Sep 2026
- 2026NNV3: Expanding Neural Network Verification to New Architectures and Domains24 Sep 2026
- 2026Exploring Solver-Level Warmstarting for Neural Network Verification22 Sep 2026
- 2026Incremental Consistency Execution for Autonomous Intelligent Systems21 Sep 2026
- 2026SoK: Formal Methods for Fact-Checking and Information Integrity19 Sep 2026
- 2026Building Trust in Artificial Intelligence: A Necessity for Railway Applications16 Sep 2026
- 2026The Misery of Mechanistic Interpretability: A Formal Perspective14 Sep 2026
- 2026Robust Policy Optimization via Adversarial Importance Sampling11 Sep 2026
- 2026Probabilistic Model Checking of Autoregressive Neural Sequence Models1 Sep 2026
12 newest of 709 All 709 (JSON)