mlsanityData to 13 Oct 2026

Provable Repair of Deep Neural Network Defects by Preimage Synthesis and Property Refinement

arXiv 2511.07741 ↗First posted 11 Nov 2025cs.CR cs.SEcited by 0

On the map: LLM safety and security → Machine unlearning

Abstract (arXiv)

It is known that deep neural networks may exhibit dangerous behaviors under various security threats (e.g., backdoor attacks, adversarial attacks and safety property violation) and there exists an ongoing arms race between attackers and defenders. In this work, we propose a complementary perspective to utilize recent progress on "neural network repair" to mitigate these security threats and repair various kinds of neural network defects (arising from different security threats) within a unified framework, offering a potential silver bullet solution to real-world scenarios. To substantially push the boundary of existing repair techniques (suffering from limitations such as lack of guarantees, limited scalability, considerable overhead, etc) in addressing more practical contexts, we propose ProRepair, a novel provable neural network repair framework driven by formal preimage synthesis and property refinement. The key intuitions are: (i) synthesizing a precise proxy box to characterize the feature space preimage, which can derive a bounded distance term sufficient to guide the subsequent repair step towards the correct outputs, and (ii) performing property refinement to enable surgical corrections and scale to more complex tasks. We evaluate ProRepair across four security threats repair tasks on six benchmarks and the results demonstrate it outperforms existing methods in effectiveness, efficiency and scalability. For point-wise repair, ProRepair corrects models while preserving performance and achieving significantly improved generalization, with a speedup of 5x to 2000x over existing provable approaches. In region-wise repair, ProRepair successfully repairs all 36 safety property violation instances (compared to 8 by the best existing method), and can handle 18x higher dimensional spaces.

Key facts. No citing papers in the map yet (data through 13 Oct 2026). Placed in Machine unlearning, one of 12 directions in LLM safety and security. Builds on 35 of its 73 references that are in the map. First posted on arXiv 11 Nov 2025.

Builds on

35 of 73 references.

References · 35

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,950
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,321
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,336
  4. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,862
  5. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,047
  6. 2019AugMix: A Simple Data Processing Method to Improve Robustness and Uncertaintycited by 899
  7. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 742
  8. 2019Adversarial Examples Improve Image Recognitioncited by 284
  9. 2016Safety Verification of Deep Neural Networkscited by 263
  10. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 255
  11. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 242
  12. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 227
23 more
  1. 2019Detecting AI Trojans Using Meta Neural Analysiscited by 198
  2. 2020Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifierscited by 185
  3. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 183
  4. 2019MNIST-C: A Robustness Benchmark for Computer Visioncited by 138
  5. 2021AugMax: Adversarial Composition of Random Augmentations for Robust Trainingcited by 90
  6. 2017Verifying Properties of Binarized Deep Neural Networkscited by 79
  7. 2022MM-BD: Post-Training Detection of Backdoor Attacks with Arbitrary Backdoor Pattern Types Using a Maximum Margin Statisticcited by 54
  8. 2022Causality-based Neural Network Repaircited by 47
  9. 2021Provable Repair of Deep Neural Networkscited by 42
  10. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 34
  11. 2020Improving Neural Network Verification through Spurious Region Guided Refinementcited by 31
  12. 2023Provably Bounding Neural Network Preimagescited by 29
  13. 2019Arachne: Search Based Repair of Deep Neural Networkscited by 26
  14. 2023Robust Backdoor Detection for Deep Learning via Topological Evolution Dynamicscited by 26
  15. 2020Towards Repairing Neural Networks Correctlycited by 14
  16. 2023Provable Preimage Under-Approximation for Neural Networks (Full Version)cited by 14
  17. 2021Sound and Complete Neural Network Repair with Minimality and Locality Guaranteescited by 13
  18. 2022Improving Robustness by Enhancing Weak Subnetscited by 13
  19. 2023Architecture-Preserving Provable Repair of Deep Neural Networkscited by 11
  20. 2025SDP-CROWN: Efficient Bound Propagation for Neural Network Verification with Tightness of Semidefinite Programmingcited by 11
  21. 2019Verifying Aircraft Collision Avoidance Neural Networks Through Linear Approximations of Safe Regionscited by 9
  22. 2023Splitting the Difference on Adversarial Trainingcited by 5
  23. 2023It's Simplex! Disaggregating Measures to Improve Certified Robustnesscited by 4

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2021Adversarial Neuron Pruning Purifies Backdoored Deep Models
  2. 2023QNNRepair: Quantized Neural Network Repair
  3. 2025REFINE: Inversion-Free Backdoor Defense via Model Reprogramming
  4. 2025Causality-Driven Neural Network Repair: Challenges and Opportunities
  5. 2026Shapley-Guided Neural Repair Approach via Derivative-Free Optimization
  6. 2022Trap and Replace: Defending Backdoor Attacks by Trapping Them into an Easy-to-Replace Subnetwork
  7. 2026Kill it with FIRE: On Leveraging Latent Space Directions for Runtime Backdoor Mitigation in Deep Neural Networks
  8. 2024BDefects4NN: A Backdoor Defect Database for Controlled Localization Studies in Neural Networks