Title: Let a Neural Network be Your Invariant
Venue: NeurIPS 2025
Accepted: yes
Keywords: Neural Model Checking

Inductive Invariants

Safety Verification
Abstract: Safety verification ensures that a system avoids undesired behaviour. 
Liveness complements safety, ensuring that the system also achieves its
desired objectives.  A complete specification of functional correctness must
combine both safety and liveness.  Proving with mathematical
certainty that a system satisfies a safety property demands presenting an
appropriate inductive invariant of the system, whereas proving liveness
requires showing a measure of progress witnessed by a ranking function. 
Neural model checking has recently introduced a data-driven approach to the
formal verification of reactive systems, albeit focusing on ranking
functions and thus addressing liveness properties only.  In this paper, we
extend and generalise neural model checking to additionally encompass
inductive invariants and thus safety properties as well.  Given a system and
a linear temporal logic specification of safety and liveness, our approach
alternates a learning and a checking component towards the construction of a
provably sound neural certificate.  Our new method introduces a neural
certificate architecture that jointly represents inductive invariants as
proofs of safety, and ranking functions as proofs of liveness.  Moreover,
our new architecture is amenable to training using constraint solvers,
accelerating prior neural model checking work otherwise based on gradient
descent. We experimentally demonstrate that our method is orders of
magnitude faster than the state-of-the-art model checkers on pure liveness
and combined safety and liveness verification tasks written in
SystemVerilog, while enabling the verification of richer properties than was
previously possible for neural model checking.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel extension to neural model checking by enabling neural networks to serve simultaneously as inductive invariants (for safety verification) and ranking functions (for liveness verification). The authors propose a unified neural certificate architecture—called a partially-ranking function—that classifies reachable states (safety) and ranks their progress toward satisfying liveness properties. Unlike prior work that uses gradient descent, this approach leverages constraint solvers (e.g., SMT, MILP) for training, improving both correctness guarantees and computational efficiency.\nThe authors demonstrate the practicality and effectiveness of the method through extensive experiments on 634 benchmarks from SystemVerilog designs, showing up to big speedups over both traditional symbolic model checkers and previous neural approaches, especially for combined safety-liveness verification tasks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths \n\n- The paper presents a robust and formally grounded method that advances the frontier of neural formal verification. The constraint-based training of partially-ranking functions is innovative and mathematically sound.\n- The paper is well-structured and includes motivating examples, mathematical formulation, and diagrams that effectively communicate the ideas.\n- The approach addresses a critical gap in existing neural model checking, namely the inability to reason about safety properties, and brings it to parity with classical model checking tools.\n- The unification of safety and liveness certificates into a single neural network and the replacement of gradient descent with SMT/MILP solvers are novel contributions.\n\nWeaknesses\n\n- Although the authors scale to realistic hardware designs, it remains unclear how well the method generalizes to larger or more complex systems\n- The method depends heavily on solver behavior and issues like solver unsoundness or numerical instability are not deeply analyzed\n\nQUESTIONS:\nCan the authors elaborate on the frequency and nature of solver errors encountered during experiments? Would fallback strategies be practical or recommended?\n\nDo the authors foresee limitations in applying this to software model checking, such as pointer-based memory or concurrency?\n\nThe architecture is piecewise-linear and intentionally simple for SMT compatibility. How expressive is it for more complex invariants/rankings?\n\nIn cases where the neural certificate fails to converge, how does one determine whether the issue is with architecture capacity, undersampling, or unsatisfiability of the spec?\n\nLIMITATIONS:\nFuture work could strengthen solver diagnostics and scalability to more diverse systems.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-06-07"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents a novel approach to model checking of reactive systems against full linear temporal logic (LTL) specifications. Unlike prior neural methods, which were limited to proving liveness properties via learned ranking functions, this work introduces a unified neural certificate that simultaneously encodes inductive invariants (for safety) and ranking functions (for liveness).\n\nThe key innovation lies in training these neural certificates using constraint solving, rather than gradient descent, and verifying their correctness via a single symbolic check. The authors demonstrate that their method is sound, scalable for many practical tasks, and significantly outperforms both prior neural model checkers and established symbolic model checking tools on an extended benchmark suite.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n-----------\n - Clear Technical Innovation: The central idea—joint learning of safety and liveness proofs using a unified neural network—is novel and well-motivated. Prior work addressed liveness only; this paper closes that critical gap.\n - Soundness Preserved: Despite using machine learning components, the approach guarantees formal soundness through symbolic verification. The combination of logic-based training and model checking is elegant and rigorous.\n - Strong Empirical Performance: On a comprehensive 634-task benchmark, the method outperforms five decades of symbolic model checking techniques in many categories, especially for properties combining safety and liveness. Reported speedups (up to 10⁴×) are significant.\n\nWeaknesses\n---------------\n - Scalability Limits of Constraint Solvers: Although the paper reports excellent performance on the benchmark suite, it does not address how the constraint-solver-based training will scale to systems with large state spaces or complex invariants. Solvers tend to struggle with large, nonlinear constraint encodings—this bottleneck should be discussed more explicitly.\n- Baseline selection: The evaluation is strong, but lacks a direct comparison with the most recent symbolic checkers such as rIC3 (https://arxiv.org/html/2502.13605v1). It's unclear whether the proposed method would retain its performance advantage in those cases.\n - Assumes Büchi Automata Are Given: The approach assumes that the violation automaton for ¬Φ (a nondeterministic Büchi automaton) is already constructed. This step can be a significant practical hurdle, especially for real-world LTL specifications.\n\nQUESTIONS:\n- How does the method handle specifications where the Büchi automaton for ¬Φ is very large or nondeterministic? Can the approach scale symbolically in that case?\n- Would your method benefit from hybrid approaches (e.g., warm-starting with gradient descent and refining with constraint solving)?\n- How do you plan to scale your method to train large networks specifically how you use the solver efficiently?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents a new approach for proving safety and liveness of reactive systems, where the proofs are represented using neural networks. The results build on recent results, including [56,57], which address temporal model checking and liveness verification, respectively. In this paper, reactive systems can be construed as state-transition systems, which admit variables and that transition relations, set of initial states, etc. are described symbolically (for instance, by means of SMT formulas). The proof techniques adopted in the paper are in fact standard in the verification literature. To prove safety, one establishes a program invariant. To prove liveness, one provides a ranking function. The authors prove the two properties at the same time using the notion of \"partially\" ranking function: the proof rules (5) - (7). In this paper, the authors propose to represent such a partially ranking function as a neural network (i.e. a \"neural certificate\"). Neural certificates are not new, as the authors also describe in Section 5, but the paper is the first time when they are employed for partially ranking functions. The authors then propose a new learning algorithm for inferring neural certificates, which are curiously not based on standard ML machinery, but based on SMT solvers. In fact, the SMT-based learning algorithm is reminiscent of CEGAR-based formula synthesis that exploits constraint solvers. The connection between neural certificates and SMT solvers lies in the well-known fact that neural networks (with ReLU activation functions) can be translated into MILP (Mixed Integer Linear Programming), which can in turn be solved by most SMT-solvers. \n\nIn the implementation and experiments, the work assumes a SystemVerilog input, which consists of a program and a property to verify. The implementation combines many existing tools including SPOT to convert an LTL formula into an automaton, EBMC to convert SystemVerilog program into SMT over bitvectors, bitwuzla to solve SMT over bitvectors, and Gurobi to solve MILP constraints. Experiments are conducted on an extension of prior benchmarks from [57], which includes both safety and liveness properties. In total, this is a 634 task suite. The authors report highly encouraging experimental results, in particular outperforming existing symbolic approaches on safety-liveness properties.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n- the paper attacks an important problem in verification\n- the use of neural certificates for the first time for safety-liveness properties\n- CEGAR learning algorithm to infer neural certificates that exploits SMT solvers\n- positive experimental results showing competitiveness of the technique\n\nWeaknesses:\n- Benefits of neural networks are unclear, upon further reflection. \n- Restrictions in the allowed programs by the proposed approach are unclear. \n\nLet me elaborate more on what I perceive as weaknesses of the paper; the authors should address these during the rebuttal. Firstly, the main benefit of neural networks is the existence of backpropagation algorithms that use gradient descent. This is not used in the paper, which opted to \"train\" the neural networks using constraint solvers instead of gradient descent. The authors position the contribution of the paper as \"using neural networks as proofs\". Since we know that neural networks can be seen as MILP formulas, it seems that the entire approach can simply be seen as CEGAR-based formula synthesis (by using SMT-solvers as oracles) and one can dispense of neural networks from their approach. This raises the questions of relevance of the paper to an ML conference.\n\nSecondly, the authors were not very clear in the definition in the preliminaries (Section 2) of what kind of variables are allowed in the programs, and what kind of data types and operations are allowed. There are hints on these in Section 3 and Section 4, based on results and tools that are used to translate from SystemVerilog to neural networks. That is, the programs use bitvectors, but for example no arrays, strings, etc. It would be good if the authors provide more details on the limitation of their approach. What type of programs can your approach handle in theory?\n\nFinally, the paper did a reasonable job in explaining basic concepts in formal verification for an ML conference. That said, there are a few definitions that the authors forgot to define (e.g. MILP).\n\nQUESTIONS:\nPlease respond to what I mentioned above seem to be weaknesses of the paper.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the problem of verifying verilog circuits by conjecturing\nproof certificates using a neural network. Prior work has shown acceleration of\nliveness properties by having a neural network conjecture a measure of progress\n(a ranking function.) The key contribution of this work is to also predict\na safety invariants. These are then fed into a formal verification pipeline\nto assert correctness. The method of learning the neural network departs\nfrom other systems in that it uses a constraint solver, e.g. SMT, to\nset the neural network weights or prove that there exists no neural network\nthat satisfies a set of constraints. This enables smaller networks by using\nlinearly searching the space of neural networks. Finally, they show that\nthis method accelerates or is competitive with existing non-neural solvers.\n\nSTRENGTHS AND WEAKNESSES:\n## Strength\n\n1. The domain of verilog verification is very important -- both historically\n   and particularly given the explosion in bespoke hardware designs for AI \n   acceleration.\n\n2. The provided speed gains seem non-trivial, particularly in a portfolio suite.\n\n3. The method produces much smaller networks, and actually provably the smallest\n   in the class explored, than a naive overparameterized model.\n\n## Weakness\n\n\n1. The largest weakest from my reading, and one that I'd appreciate more exploration\n   in a future draft, is the class of Neural Networks supported by both the synthesis\n   and verification queries. I particular, my understanding is the class of\n   non-linearitie is limited by the theories (efficiently) covered by the SMT\n   solvers.\n\n2. Relatedly, while interesting the counter example loop -- in the formal methods\n   literature an instance of CEGIS? -- implicitly relies on refuting smaller neural\n   architectures having sufficient capacity. This seems to work well in these benchmarks,\n   but may catastrophically fail for larger problems.\n\n3. As a minor criticism, I disagree with the discussion around quantization --\n   namely that the quantization need not be learned. In an information\n   theoretic sense, the optimal quantization is necessarily dependent on the\n   input distribution and downstream arithmetic circuit. Fixing the quantization\n   a-priori necessarily loses expressivity. That said, I think the advantages\n   for fitting into SMT theories might outweigh the downsides.\n\nQUESTIONS:\n1. How was the architecture family selected?\n\n2. What are the limitations on the neural networks that can be used.\n\n3. Do you see a path towards learning to generalize to multi-task settings? i.e., taking the verliog as input and learning to interpolate over verliog programs?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-08"}