Original: Neural Abstractions
Revised: Neural Abstractions

Original: Abstract
Revised: Abstract

Original: We present a novel method for the safety verification of dynamical models, which uses neural networks to represent abstractions of the dynamics.
Revised: We present a novel method for the safety verification of dynamical models, which uses neural networks to represent abstractions of the dynamics.

Original: Neural networks have extensively been used before as approximators; in this work, we make a step further and use them for the first time as abstractions.
Revised: Neural networks have extensively been used before as approximators; in this work, we make a step further and use them for the first time as abstractions.

Original: We synthesise a neural network so as to approximate a nonlinear model whilst ensuring an arbitrarily tight, formally certified bound on the approximation error, using counterexampleguided inductive synthesis.
Revised: We synthesise a neural network so as to approximate a nonlinear model whilst ensuring an arbitrarily tight, formally certified bound on the approximation error, using counterexampleguided inductive synthesis.

Original: We show that this produces a neural ODE with nondeterministic disturbances that constitutes a formal abstraction of the concrete system under analysis.
Revised: We show that this produces a neural ODE with nondeterministic disturbances that constitutes a formal abstraction of the concrete system under analysis.

Original: This guarantees a fundamental property: if the abstract system is safe, i.e., free from any initialised trajectory that reaches an undesirable state, then the concrete system is also safe.
Revised: This guarantees a fundamental property: if the abstract system is safe, i.e., free from any initialised trajectory that reaches an undesirable state, then the concrete system is also safe.

Original: By using neural ODEs with ReLU activation functions as abstractions, we cast the safety verification problem for nonlinear dynamical models into that of hybrid automata with affine dynamics, which we verify using SpaceEx.
Revised: By using neural ODEs with ReLU activation functions as abstractions, we cast the safety verification problem for nonlinear dynamical models into that of hybrid automata with affine dynamics, which we verify using SpaceEx.

Original: We demonstrate that our approach performs comparably to the mature tool Flow* on existing benchmark nonlinear models.
Revised: We demonstrate that our approach performs comparably to the mature tool Flow* on existing benchmark nonlinear models.

Original: We additionally demonstrate and that it is effective on models that do not exhibit local
Revised: We additionally demonstrate and that it is effective on models that do not exhibit local

Original: Lipschitz continuity, which are out of reach to the existing technologies.
Revised: Lipschitz continuity, which are out of reach to the existing technologies.

Original:  Introduction
Revised:  Introduction

Original: Dynamical models describe processes that are ubiquitous in science and engineering.
Revised: Dynamical models describe processes that are ubiquitous in science and engineering.

Original: They are widely used to model the behaviour of cyber-physical system designs, whose correctness is crucial when they are deployed in safety-critical domains [10,12,46].
Revised: They are widely used to model the behaviour of cyber-physical system designs, whose correctness is crucial when they are deployed in safety-critical domains [10,12,46].

Original: To guarantee that a dynamical model satisfies a safety specification, simulations are useful but insufficient because they are inherently non-exhaustive and they suffer from numerical errors, which may leave unsafe behaviours unidentified.
Revised: To guarantee that a dynamical model satisfies a safety specification, simulations are useful but insufficient because they are inherently non-exhaustive and they suffer from numerical errors, which may leave unsafe behaviours unidentified.

Original: Formal verification of continuous dynamical models tackles the question of determining with formal certainty whether every possible behavior of the model satisfies a safety specification [42, 48, 109].
Revised: Formal verification of continuous dynamical models tackles the question of determining with formal certainty whether every possible behavior of the model satisfies a safety specification [42, 48, 109].

Original: In this paper, we present a method to combine machine learning and symbolic reasoning for a sound and effective safety verification of nonlinear dynamical models.
Revised: In this paper, we present a method to combine machine learning and symbolic reasoning for a sound and effective safety verification of nonlinear dynamical models.

Original: The formal verification problem for continuous-time and hybrid dynamical models is unsolvable in general and, even for models with linear dynamics, complete procedures are available under stringent conditions [11,69,83,84].
Revised: The formal verification problem for continuous-time and hybrid dynamical models is unsolvable in general and, even for models with linear dynamics, complete procedures are available under stringent conditions [11,69,83,84].

Original: For most practical models that contain nonlinear terms [78,102], methods for formal verification with soundness guarantees involve laborious safety and reachability procedures whose efficacy can only be demonstrated in practice.
Revised: For most practical models that contain nonlinear terms [78,102], methods for formal verification with soundness guarantees involve laborious safety and reachability procedures whose efficacy can only be demonstrated in practice.

Original: Formal verification of nonlinear models require ingenuity, and has involved sophisticated analysis techniques such as mathematical relaxations [25, 32–34,45,100,101], abstract interpretation [49,50,53,79,93], constraint solving [18,37,82], and discrete abstractions [5,9,28,35].
Revised: Formal verification of nonlinear models require ingenuity, and has involved sophisticated analysis techniques such as mathematical relaxations [25, 32–34,45,100,101], abstract interpretation [49,50,53,79,93], constraint solving [18,37,82], and discrete abstractions [5,9,28,35].

Original: Notwithstanding recent progress, both scalability and expressivity remain open challenges for nonlinear models: the largest model used in the annual competition has 7 variables [63].
Revised: Notwithstanding recent progress, both scalability and expressivity remain open challenges for nonlinear models: the largest model used in the annual competition has 7 variables [63].

Original: In addition, existing formal approaches rely on symbolic reasoning techniques that explicitly leverage the structure of the dynamics.
Revised: In addition, existing formal approaches rely on symbolic reasoning techniques that explicitly leverage the structure of the dynamics.

Original: This results in verification procedures that are bespoke to restricted classes of models.
Revised: This results in verification procedures that are bespoke to restricted classes of models.

Original: For example, it is common for formal verification procedures to require the input model to be Lipschitz continuous.
Revised: For example, it is common for formal verification procedures to require the input model to be Lipschitz continuous.

Original: Yet, dynamical models with vector fields that violate this assumption are abundant in literature, and a wide variety of models of natural phenomena are non-Lipschitz, from fluid dynamics to n-body orbits and chaotic systems, as well as in engineering, from electrical circuits and hydrological systems [47,52].
Revised: Yet, dynamical models with vector fields that violate this assumption are abundant in literature, and a wide variety of models of natural phenomena are non-Lipschitz, from fluid dynamics to n-body orbits and chaotic systems, as well as in engineering, from electrical circuits and hydrological systems [47,52].

Original: Our approach makes progress in expressivity, showing that using neural networks as abstractions of dynamical systems enables an effective formal verification of nonlinear dynamical models, including models that do not exhibit local Lipschitz continuity.
Revised: Our approach makes progress in expressivity, showing that using neural networks as abstractions of dynamical systems enables an effective formal verification of nonlinear dynamical models, including models that do not exhibit local Lipschitz continuity.

Original: Abstraction is a standard process in formal verification that aims at translating the model under analysis—the concrete model—into a model that is simpler to analyse—the abstract model—such that verification results from the abstract model carry over to the concrete model [19, 38].
Revised: Abstraction is a standard process in formal verification that aims at translating the model under analysis—the concrete model—into a model that is simpler to analyse—the abstract model—such that verification results from the abstract model carry over to the concrete model [19, 38].

Original: In verification of continuous-time systems, an abstraction usually consists of a partitioning of the state space of the concrete model into a finite set of regions that define the states of an abstract, finite-state machine with corresponding dynamics.
Revised: In verification of continuous-time systems, an abstraction usually consists of a partitioning of the state space of the concrete model into a finite set of regions that define the states of an abstract, finite-state machine with corresponding dynamics.

Original: Our method follows an approach that constructs abstract, finite-state machines whose states are augmented with continuous linear dynamics and non-deterministic drifts.
Revised: Our method follows an approach that constructs abstract, finite-state machines whose states are augmented with continuous linear dynamics and non-deterministic drifts.

Original: Finite-state machines with continuous, possibly non-deterministic dynamics are known as hybrid automata [68], and the process of abstracting dynamical nonlinear models into hybrid automata is called hybridisation ; this process has been widely applied in formal verification [8, 14,15,20,43,55,62,70,88,91,96,97,99].
Revised: Finite-state machines with continuous, possibly non-deterministic dynamics are known as hybrid automata [68], and the process of abstracting dynamical nonlinear models into hybrid automata is called hybridisation ; this process has been widely applied in formal verification [8, 14,15,20,43,55,62,70,88,91,96,97,99].

Original: Hybridising involves partitioning the state space and computing a local overapproximation of the concrete model within each region of the partition.
Revised: Hybridising involves partitioning the state space and computing a local overapproximation of the concrete model within each region of the partition.

Original: Common approaches for hybridisation partition the state space by tuning the granularity of rectangular or simplicial meshes, until a desired approximation error is attained.
Revised: Common approaches for hybridisation partition the state space by tuning the granularity of rectangular or simplicial meshes, until a desired approximation error is attained.

Original: This may yield abstract hybrid automata that are too large in the number of discrete states to be effectively verified.
Revised: This may yield abstract hybrid automata that are too large in the number of discrete states to be effectively verified.

Original: Notably, modern tools for the verification of hybrid automata are designed for models that rarely have over hundred discrete states [7], while arbitrary meshes grow exponentially as the granularity increases.
Revised: Notably, modern tools for the verification of hybrid automata are designed for models that rarely have over hundred discrete states [7], while arbitrary meshes grow exponentially as the granularity increases.

Original: Explosion in discrete states has been mitigated using deductive approaches that construct an appropriate partitioning from the expressions that define the concrete model and, unlike our method, rely on syntactic restrictions [13,24,28,44,67,77,80,81,95].
Revised: Explosion in discrete states has been mitigated using deductive approaches that construct an appropriate partitioning from the expressions that define the concrete model and, unlike our method, rely on syntactic restrictions [13,24,28,44,67,77,80,81,95].

Original: We propose an inductive approach to abstraction that combines the tasks of partitioning the state space and overapproximating the dynamics into the single task of training a neural network.
Revised: We propose an inductive approach to abstraction that combines the tasks of partitioning the state space and overapproximating the dynamics into the single task of training a neural network.

Original: We leverage the approximation capability of neural networks with ReLU activation functions to partition the state space into arbitrary polyhedral regions, where each region and local affine approximation correspond to a combinatorial configuration of the neurons.
Revised: We leverage the approximation capability of neural networks with ReLU activation functions to partition the state space into arbitrary polyhedral regions, where each region and local affine approximation correspond to a combinatorial configuration of the neurons.

Original: We show that this ultimately enables verifying nonlinear dynamical models using efficient safety verifiers for hybrid automata with affine dynamics (cf.
Revised: We show that this ultimately enables verifying nonlinear dynamical models using efficient safety verifiers for hybrid automata with affine dynamics (cf.

Original: Figure 1).
Revised: Figure 1).

Original: Our abstraction procedure synthesises abstract models by alternating a learner , which proposes candidate abstractions, and a certifier , which formally assures (or disproves) their validity, in a counterexample-guided inductive synthesis (CEGIS) loop [105,106].
Revised: Our abstraction procedure synthesises abstract models by alternating a learner , which proposes candidate abstractions, and a certifier , which formally assures (or disproves) their validity, in a counterexample-guided inductive synthesis (CEGIS) loop [105,106].

Original: First, the learner uses gradient descent to train a neural network that approximates the concrete model over a finite set of sample observations of its dynamics; then, the certifier uses satisfiability modulo theories (SMT) to check the validity of an upper-bound on the approximation error over the entire continuous domain of interest.
Revised: First, the learner uses gradient descent to train a neural network that approximates the concrete model over a finite set of sample observations of its dynamics; then, the certifier uses satisfiability modulo theories (SMT) to check the validity of an upper-bound on the approximation error over the entire continuous domain of interest.

Original: If the latter disproves the bound, then it produces a counterexample which its added to the set of samples and the loop is repeated.
Revised: If the latter disproves the bound, then it produces a counterexample which its added to the set of samples and the loop is repeated.

Original: If it certifies the bound, then the procedure returns a neural network approximation and a sound upper-bound on the error.
Revised: If it certifies the bound, then the procedure returns a neural network approximation and a sound upper-bound on the error.

Original: Altogether, neural network and error bound define a neural ODE with bounded additive non-determinism that overapproximates the concrete model, which we call a neural abstraction .
Revised: Altogether, neural network and error bound define a neural ODE with bounded additive non-determinism that overapproximates the concrete model, which we call a neural abstraction .

Original: We demonstrate the efficacy of our method over multiple dynamical models from a standard benchmark set for the verification of nonlinear systems [63], as well as additional locally non-Lipschitz models, and compare our approach with Flow*, the state-of-the-art verification tool for nonlinear
Revised: We demonstrate the efficacy of our method over multiple dynamical models from a standard benchmark set for the verification of nonlinear systems [63], as well as additional locally non-Lipschitz models, and compare our approach with Flow*, the state-of-the-art verification tool for nonlinear

Original: 1 1 Concrete nonlinear system x ...
Revised: 1 1 Concrete nonlinear system x ...

Original: ˙ x
Revised: ˙ x

Original: ReLU
Revised: ReLU

Original: Neural abstraction  

Revised: Neural abstraction

Original: [Figure]
Revised: [Figure]

Original: hybrid
Revised: hybrid

Original: [Figure]
Revised: [Figure]

Original: Abstractionsynthesis
Revised: Abstractionsynthesis

Original: Model translation
Revised: Model translation

Original: Safety
Revised: Safety

Original: [Figure]
Revised: [Figure]

Original: models [32,33,35].
Revised: models [32,33,35].

Original: We instantiate our approach on top of SpaceEx [59], which is a state-of-the-art tool specialised to linear hybrid models [56,58,85].
Revised: We instantiate our approach on top of SpaceEx [59], which is a state-of-the-art tool specialised to linear hybrid models [56,58,85].

Original: We evaluate both approaches in safety verification using flowpipe propagation , which computes the set of reachable states from a given set of initial states up to a given time horizon.
Revised: We evaluate both approaches in safety verification using flowpipe propagation , which computes the set of reachable states from a given set of initial states up to a given time horizon.

Original: Our experiments demonstrate that our approach performs comparably with Flow* for Lipschitz continuous model, and succeeds with non-Lipschitz models that are out of range for Flow* and violate the working assumptions of many verification tools.
Revised: Our experiments demonstrate that our approach performs comparably with Flow* for Lipschitz continuous model, and succeeds with non-Lipschitz models that are out of range for Flow* and violate the working assumptions of many verification tools.

Original: These outcomes suggest that neural abstractions are a promising technology, also in view of recent results on direct methods for the safety verification for neural ODEs [65,66,92].
Revised: These outcomes suggest that neural abstractions are a promising technology, also in view of recent results on direct methods for the safety verification for neural ODEs [65,66,92].

Original: We summarise our contributions in the following points:
Revised: We summarise our contributions in the following points:

Original: • we introduce the novel idea of leveraging neural networks to represent abstractions in formal verification, and we instantiate it in safety verification of nonlinear dynamical models; • we present a CEGIS procedure for the synthesis of neural ODEs that formally overapproximate the dynamics of nonlinear models, which we call neural abstractions; • we define a translation from neural abstractions defined using ReLU activation functions to hybrid automata with affine dynamics and additive non-determinism; • we implement our approach 2 and demonstrate its comparable performance w.r.t.
Revised: • we introduce the novel idea of leveraging neural networks to represent abstractions in formal verification, and we instantiate it in safety verification of nonlinear dynamical models; • we present a CEGIS procedure for the synthesis of neural ODEs that formally overapproximate the dynamics of nonlinear models, which we call neural abstractions; • we define a translation from neural abstractions defined using ReLU activation functions to hybrid automata with affine dynamics and additive non-determinism; • we implement our approach 2 and demonstrate its comparable performance w.r.t.

Original: the state-ofthe-art tool Flow* in safety verification of Lipschitz-continuous models, and even superior efficacy on models that
Revised: the state-ofthe-art tool Flow* in safety verification of Lipschitz-continuous models, and even superior efficacy on models that

Original: do not exhibit local Lipschitz continuity.
Revised: do not exhibit local Lipschitz continuity.

Original: We consider there to be no significant negative societal impact of our work.
Revised: We consider there to be no significant negative societal impact of our work.

Original:  Neural Abstractions of Dynamical Models
Revised:  Neural Abstractions of Dynamical Models

Original: We study the formal verification question of whether an n -dimensional, continuous-time, autonomous dynamical model with possibly uncertain (bounded) disturbances, considered within a region of interest, is safe with respect to a region of bad states when initialised from a region of initial states.
Revised: We study the formal verification question of whether an n -dimensional, continuous-time, autonomous dynamical model with possibly uncertain (bounded) disturbances, considered within a region of interest, is safe with respect to a region of bad states when initialised from a region of initial states.

Original: Definition 1 (Dynamical Model) .
Revised: Definition 1 (Dynamical Model) .

Original: A dynamical model F defined over a region of interest X ⊆ R n , consists of a nonlinear function f : R n → R n and a possibly null disturbance radius δ ≥ 0 .
Revised: A dynamical model F defined over a region of interest X ⊆ R n , consists of a nonlinear function f : R n → R n and a possibly null disturbance radius δ ≥ 0 .

Original: Its dynamics are given by the system of nonlinear ODEs ˙ x = f
Revised: Its dynamics are given by the system of nonlinear ODEs ˙ x = f

Original: [Equation]
Revised: [Equation]

Original: + d,
Revised: + d,

Original: [Equation]
Revised: [Equation]

Original: δ,
Revised: δ,

Original: [Equation]
Revised: [Equation]

Original: ∈ X , (1) where ∥ · ∥ denotes a norm operator (unless explicitly stated, we assume the norm operator to be given the same semantics across the paper).
Revised: ∈ X , (1) where ∥ · ∥ denotes a norm operator (unless explicitly stated, we assume the norm operator to be given the same semantics across the paper).

Original: A trajectory of F defined over time horizon T > 0 is a function ξ : [0 , T ] → R n that admits derivative at each point in [0 , T ] such that, for all t ∈ [0 , T ] , it holds true that ξ ( t ) ∈ X and ˙ ξ ( t ) =
Revised: A trajectory of F defined over time horizon T > 0 is a function ξ : [0 , T ] → R n that admits derivative at each point in [0 , T ] such that, for all t ∈ [0 , T ] , it holds true that ξ ( t ) ∈ X and ˙ ξ ( t ) =

Original: f ( ξ ( t ))
Revised: f ( ξ ( t ))

Original: + d t for some ∥ d t ∥ < δ .
Revised: + d t for some ∥ d t ∥ < δ .

Original: Notably, symbol d in
Revised: Notably, symbol d in

Original: Equation (1) is interpreted as a non-deterministic disturbance that at any time can take any possible value within the bound provided by δ .
Revised: Equation (1) is interpreted as a non-deterministic disturbance that at any time can take any possible value within the bound provided by δ .

Original: Let the compact sets X 0 ⊂
Revised: Let the compact sets X 0 ⊂

Original: X be a region of initial states and X B ⊂ X be a region of bad states.
Revised: X be a region of initial states and X B ⊂ X be a region of bad states.

Original: We say that a trajectory ξ defined over time horizon T is initialised
Revised: We say that a trajectory ξ defined over time horizon T is initialised

Original: if ξ (0) ∈ X 0 ; additionally, we say that it is safe if ξ ( t ) ̸∈ X B for all t ∈ [0 , T ] ; dually, we say that it is unsafe if ξ ( t ) ∈
Revised: if ξ (0) ∈ X 0 ; additionally, we say that it is safe if ξ ( t ) ̸∈ X B for all t ∈ [0 , T ] ; dually, we say that it is unsafe if ξ ( t ) ∈

Original: X B for some t ∈ [0 , T ] .
Revised: X B for some t ∈ [0 , T ] .

Original: The safety verification question for consists of determining whether all initialised trajectories are safe.
Revised: The safety verification question for consists of determining whether all initialised trajectories are safe.

Original: If this is the case, then we say that the model is safe with respect to X 0 and X B .
Revised: If this is the case, then we say that the model is safe with respect to X 0 and X B .

Original: If there exist at least one initialised trajectory that is unsafe, then we say that the model is unsafe.
Revised: If there exist at least one initialised trajectory that is unsafe, then we say that the model is unsafe.

Original: We tackle safety verification by abstraction, that is, we construct an abstract dynamical model that captures all behaviours of the concrete nonlinear model.
Revised: We tackle safety verification by abstraction, that is, we construct an abstract dynamical model that captures all behaviours of the concrete nonlinear model.

Original: This implies that, if the abstract model is safe then the concrete model is necessarily safe too, and we can thus apply a verification procedure over the abstraction to determine whether the concrete model is safe.
Revised: This implies that, if the abstract model is safe then the concrete model is necessarily safe too, and we can thus apply a verification procedure over the abstraction to determine whether the concrete model is safe.

Original: Notably, the converse may not hold: lack of safety of the abstract model does not carry over to the concrete model, because our abstraction is an overapproximation.
Revised: Notably, the converse may not hold: lack of safety of the abstract model does not carry over to the concrete model, because our abstraction is an overapproximation.

Original: We ultimately obtain a sound (but not complete) safety verification procedure.
Revised: We ultimately obtain a sound (but not complete) safety verification procedure.

Original: Our approach synthesises an abstract dynamical model defined in terms a feed-forward neural network with ReLU activation functions and endowed with a bounded non-deterministic disturbance.
Revised: Our approach synthesises an abstract dynamical model defined in terms a feed-forward neural network with ReLU activation functions and endowed with a bounded non-deterministic disturbance.

Original: This can be seen as a neural ODEs [31] augmented with an additive non-deterministic drift that ensures the abstract model to overapproximate the concrete model.
Revised: This can be seen as a neural ODEs [31] augmented with an additive non-deterministic drift that ensures the abstract model to overapproximate the concrete model.

Original: To the best of our knowledge, this is the first work to consider neural ODEs with non-deterministic semantics.
Revised: To the best of our knowledge, this is the first work to consider neural ODEs with non-deterministic semantics.

Original: Our feed-forward neural network consists of an n -dimensional input layer y 0 , k hidden layers y 1 , . . .
Revised: Our feed-forward neural network consists of an n -dimensional input layer y 0 , k hidden layers y 1 , . . .

Original: , y k with dimensions
Revised: , y k with dimensions

Original: h 1 , . .
Revised: h 1 , . .

Original: , h k respectively, and an n -dimensional output layer
Revised: , h k respectively, and an n -dimensional output layer

Original: y k +1 .
Revised: y k +1 .

Original: Each hidden or output layer with index i are respectively associated matrices of weights
Revised: Each hidden or output layer with index i are respectively associated matrices of weights

Original: W i ∈
Revised: W i ∈

Original: R h i × h
Revised: R h i × h

Original: i −and a vectors of biases b
Revised: i −and a vectors of biases b

Original: i ∈ R h i .
Revised: i ∈ R h i .

Original: Upon a valuation of the input layer, the value of every subsequent hidden layer is given by the following equation:
Revised: Upon a valuation of the input layer, the value of every subsequent hidden layer is given by the following equation:

Original: [Equation]
Revised: [Equation]

Original: Whereas many activation functions exist, we focus our study on ReLU activation functions, applying function max { x, 0 } to every element x ∈ R of its h
Revised: Whereas many activation functions exist, we focus our study on ReLU activation functions, applying function max { x, 0 } to every element x ∈ R of its h

Original: i -dimensional argument.
Revised: i -dimensional argument.

Original: Finally, the value of the output layer is given by the affine map
Revised: Finally, the value of the output layer is given by the affine map

Original: y k +

Revised: y k +

Original: =
Revised: =

Original: W k +1 x k
Revised: W k +1 x k

Original: + b k +1 .
Revised: + b k +1 .

Original: Altogether, the network results in a function N whose output is N ( x ) =
Revised: Altogether, the network results in a function N whose output is N ( x ) =

Original: y k +1 for every given input y 

Revised: y k +1 for every given input y

Original: = x .
Revised: = x .

Original: Definition 2 (Neural Abstraction) .
Revised: Definition 2 (Neural Abstraction) .

Original: Let F be a dynamical model given by function f : R n → R n and disturbance radius δ ≥ 0 and let X ⊆ R n be a region of interest.
Revised: Let F be a dynamical model given by function f : R n → R n and disturbance radius δ ≥ 0 and let X ⊆ R n be a region of interest.

Original: A feed-forward neural network
Revised: A feed-forward neural network

Original: N : R n → R n defines a neural abstraction of F with error bound ϵ > 0 over X , if it holds true that
Revised: N : R n → R n defines a neural abstraction of F with error bound ϵ > 0 over X , if it holds true that

Original: [Equation]
Revised: [Equation]

Original: Then, the neural abstraction consists of the dynamical model A defined by N and disturbance ϵ , whose dynamics are given by the following neural ODE with bounded additive disturbances:
Revised: Then, the neural abstraction consists of the dynamical model A defined by N and disturbance ϵ , whose dynamics are given by the following neural ODE with bounded additive disturbances:

Original: [Equation]
Revised: [Equation]

Original: Theorem 1 (Soundness of Neural Abstractions) .
Revised: Theorem 1 (Soundness of Neural Abstractions) .

Original: If A is a neural abstraction of a dynamical system
Revised: If A is a neural abstraction of a dynamical system

Original: F over a region of interest X ⊆ R n , then every trajectory of F is also a trajectory of A .
Revised: F over a region of interest X ⊆ R n , then every trajectory of F is also a trajectory of A .

Original: AbstractionSynthesis
Revised: AbstractionSynthesis

Original: [Figure]
Revised: [Figure]

Original: Candidate N
Revised: Candidate N

Original: Valid neural abstraction
Revised: Valid neural abstraction

Original: [Figure]
Revised: [Figure]

Original: Safety
Revised: Safety

Original: Verification
Revised: Verification

Original: [Figure]
Revised: [Figure]

Original: Proof of Theorem 1.
Revised: Proof of Theorem 1.

Original: Let ξ be a trajectory of F and T be the time horizon over which ξ is defined.
Revised: Let ξ be a trajectory of F and T be the time horizon over which ξ is defined.

Original: Then, let t ∈ [0 , T ] .
Revised: Then, let t ∈ [0 , T ] .

Original: By definition of trajectory we have that (i) ξ ( t )
Revised: By definition of trajectory we have that (i) ξ ( t )

Original: ∈
Revised: ∈

Original: X
Revised: X

Original: and there exists d t s.t.
Revised: and there exists d t s.t.

Original: (ii) ∥
Revised: (ii) ∥

Original: d t ∥ ≤ δ and (iii) ˙ ξ ( t ) =
Revised: d t ∥ ≤ δ and (iii) ˙ ξ ( t ) =

Original: f ( ξ ( t ))
Revised: f ( ξ ( t ))

Original: + d t .
Revised: + d t .

Original: By (i) and condition (3) we have that ∥ f ( ξ ( t )) −N ( ξ ( t ))
Revised: By (i) and condition (3) we have that ∥ f ( ξ ( t )) −N ( ξ ( t ))

Original: ∥ + δ ≤
Revised: ∥ + δ ≤

Original: ϵ .
Revised: ϵ .

Original: Then, by (ii) we have that ∥ f ( ξ ( t )) − N ( ξ ( t ))
Revised: Then, by (ii) we have that ∥ f ( ξ ( t )) − N ( ξ ( t ))

Original: ∥ + ∥
Revised: ∥ + ∥

Original: d t ∥ ≤ ϵ which, by triangle inequality, implies that ∥ f ( ξ ( t ))
Revised: d t ∥ ≤ ϵ which, by triangle inequality, implies that ∥ f ( ξ ( t ))

Original: + d t − N ( ξ ( t ))
Revised: + d t − N ( ξ ( t ))

Original: ∥ ≤ ϵ .
Revised: ∥ ≤ ϵ .

Original: Using (iii), we rewrite it into ∥ ˙ ξ ( t ) − N ( ξ ( t ))
Revised: Using (iii), we rewrite it into ∥ ˙ ξ ( t ) − N ( ξ ( t ))

Original: ∥ ≤ ϵ .
Revised: ∥ ≤ ϵ .

Original: Finally, we define d ′ t = ˙
Revised: Finally, we define d ′ t = ˙

Original: ξ ( t ) − N ( ξ ( t )) .
Revised: ξ ( t ) − N ( ξ ( t )) .

Original: As a result, we have that ∥ d ′ t ∥ ≤ ϵ and ˙ ξ ( t ) =
Revised: As a result, we have that ∥ d ′ t ∥ ≤ ϵ and ˙ ξ ( t ) =

Original: N ( ξ ( t ))
Revised: N ( ξ ( t ))

Original: + d ′ t which, together with (i), show that ξ is a trajectory of A .
Revised: + d ′ t which, together with (i), show that ξ is a trajectory of A .

Original: Corollary 1.
Revised: Corollary 1.

Original: Let X 0 ⊂
Revised: Let X 0 ⊂

Original: X be a region of initial states and X B ⊂ X and region of bad states.
Revised: X be a region of initial states and X B ⊂ X and region of bad states.

Original: It holds true that if A is safe with respect to X 0 and X B then also F is safe with respect to X 0 and X B .
Revised: It holds true that if A is safe with respect to X 0 and X B then also F is safe with respect to X 0 and X B .

Original: Proof of Corollary 1.
Revised: Proof of Corollary 1.

Original: By Theorem 1, if there exists an initialised trajectory of F that is unsafe, then the same is an initialised trajectory of A that is unsafe.
Revised: By Theorem 1, if there exists an initialised trajectory of F that is unsafe, then the same is an initialised trajectory of A that is unsafe.

Original: The statement follows by contraposition.
Revised: The statement follows by contraposition.

Original: Remark 1 (Existence of Neural Abstractions) .
Revised: Remark 1 (Existence of Neural Abstractions) .

Original: Let F be a dynamical model defined by function f and disturbance radius δ ≥ 0 , and let X ⊆ R n be a domain of interest.
Revised: Let F be a dynamical model defined by function f and disturbance radius δ ≥ 0 , and let X ⊆ R n be a domain of interest.

Original: A neural abstraction of F with arbitrary error bound ϵ > 0 over X exists if a neural network that approximates f with error bound ϵ − δ (cf.
Revised: A neural abstraction of F with arbitrary error bound ϵ > 0 over X exists if a neural network that approximates f with error bound ϵ − δ (cf.

Original: condition (3) ) exists over the same domain.
Revised: condition (3) ) exists over the same domain.

Original: In this work, we do not prescribe conditions on either width or depth of the network to ensure existence of a neural abstraction.
Revised: In this work, we do not prescribe conditions on either width or depth of the network to ensure existence of a neural abstraction.

Original: Such conditions are given by universal approximation theorems for neural networks with ReLU activation functions, which have been developed in seminal work in machine learning [23,39,60,71,87,90].
Revised: Such conditions are given by universal approximation theorems for neural networks with ReLU activation functions, which have been developed in seminal work in machine learning [23,39,60,71,87,90].

Original: Altogether, we define the neural abstraction of a non-linear dynamical system F as a neural ODE with an additive disturbance A that approximates the dynamics while also accounting for the approximation error.
Revised: Altogether, we define the neural abstraction of a non-linear dynamical system F as a neural ODE with an additive disturbance A that approximates the dynamics while also accounting for the approximation error.

Original: Notably, we place no assumptions on the vector field f .
Revised: Notably, we place no assumptions on the vector field f .

Original: In particular, Theorem 1 does not require f to be Lipschitz continuous: the soundness of a neural abstraction relies on condition (3), whose certification we offload to an SMT solver (cf.
Revised: In particular, Theorem 1 does not require f to be Lipschitz continuous: the soundness of a neural abstraction relies on condition (3), whose certification we offload to an SMT solver (cf.

Original: Section 3.2).
Revised: Section 3.2).

Original: The resulting neural abstraction is to a hybrid automaton with affine dynamics and non-deterministic disturbance (cf.
Revised: The resulting neural abstraction is to a hybrid automaton with affine dynamics and non-deterministic disturbance (cf.

Original: Section 4), which does not rely on the Picard-Lindelof theorem to ensure uniqueness or existence of a solutions.
Revised: Section 4), which does not rely on the Picard-Lindelof theorem to ensure uniqueness or existence of a solutions.

Original:  Formal Synthesis of Neural Abstractions
Revised:  Formal Synthesis of Neural Abstractions

Original: Our approach to abstraction synthesis follows two phases—a learning phase and a certification phase— that alternate each other in a CEGIS loop [1,3,40,75,98,105,106] (cf.
Revised: Our approach to abstraction synthesis follows two phases—a learning phase and a certification phase— that alternate each other in a CEGIS loop [1,3,40,75,98,105,106] (cf.

Original: Figure 2, left).
Revised: Figure 2, left).

Original: Our learning phase trains the parameters of a neural network N to approximate the system dynamics over a finite set of samples S ⊂
Revised: Our learning phase trains the parameters of a neural network N to approximate the system dynamics over a finite set of samples S ⊂

Original: X of the domain of interest.
Revised: X of the domain of interest.

Original: Learning uses gradient descent algorithms, which can possibly scale to large amounts of samples.
Revised: Learning uses gradient descent algorithms, which can possibly scale to large amounts of samples.

Original: Then, our certification phase either confirms the validity of condition (3) or produces a counterexample which we use to sample additional states and repeat the loop.
Revised: Then, our certification phase either confirms the validity of condition (3) or produces a counterexample which we use to sample additional states and repeat the loop.

Original: Certification is based on SMT solving, which reasons symbolically over the continuous domain
Revised: Certification is based on SMT solving, which reasons symbolically over the continuous domain

Original: X and assures soundness.
Revised: X and assures soundness.

Original: As a consequence, when certification confirms condition (3) formally valid, then as per Theorem 1 our neural abstraction
Revised: As a consequence, when certification confirms condition (3) formally valid, then as per Theorem 1 our neural abstraction

Original: A is a sound overapproximation of the concrete model
Revised: A is a sound overapproximation of the concrete model

Original: F and is thus passed to safety verification (cf.
Revised: F and is thus passed to safety verification (cf.

Original: Figure 2, right).
Revised: Figure 2, right).

Original: Neural networks have been used in the past as representations of formal certificates for the correctness of systems such as Lyapunov neural networks, neural barrier certificates, neural ranking functions and supermartingales [1, 2, 4, 29, 30, 41, 64, 86, 94, 108, 114, 115].
Revised: Neural networks have been used in the past as representations of formal certificates for the correctness of systems such as Lyapunov neural networks, neural barrier certificates, neural ranking functions and supermartingales [1, 2, 4, 29, 30, 41, 64, 86, 94, 108, 114, 115].

Original: In the present work, we use neural networks for the first time as abstractions, and we instantiate this idea in safety verification of nonlinear models.
Revised: In the present work, we use neural networks for the first time as abstractions, and we instantiate this idea in safety verification of nonlinear models.

Original: We shall now present the components of our abstraction synthesis procedure: learner (cf.
Revised: We shall now present the components of our abstraction synthesis procedure: learner (cf.

Original: Section 3.1) and certifier (cf.
Revised: Section 3.1) and certifier (cf.

Original: Section 3.2).
Revised: Section 3.2).

Original: 3.1 Learning Phase
Revised: 3.1 Learning Phase

Original: As with many machine learning-based algorithm, learning neural abstractions hinges on the loss function used as part of the gradient descent scheme for optimising parameters.
Revised: As with many machine learning-based algorithm, learning neural abstractions hinges on the loss function used as part of the gradient descent scheme for optimising parameters.

Original: The task is that of a regression problem, so the choice of loss function to be minimised is simple, namely,
Revised: The task is that of a regression problem, so the choice of loss function to be minimised is simple, namely,

Original: [Equation]
Revised: [Equation]

Original: where ∥ · ∥ 2 represents the 2 − norm of its input, and S ⊂ X is a finite set of data points that are sampled from the domain of interest.
Revised: where ∥ · ∥ 2 represents the 2 − norm of its input, and S ⊂ X is a finite set of data points that are sampled from the domain of interest.

Original: In other words, the neural abstractions are synthesised using a scheme based on gradient descent to find the parameters that minimise the mean square error over S .
Revised: In other words, the neural abstractions are synthesised using a scheme based on gradient descent to find the parameters that minimise the mean square error over S .

Original: The main inputs to the learning procedure are the vector field f of the concrete dynamical model, an initial set of points S sampled uniformly from the domain of interest X .
Revised: The main inputs to the learning procedure are the vector field f of the concrete dynamical model, an initial set of points S sampled uniformly from the domain of interest X .

Original: Additional parameters include the hyper-parameters for the learning scheme such as the learning rate, and a stopping criterion for the learning procedure.
Revised: Additional parameters include the hyper-parameters for the learning scheme such as the learning rate, and a stopping criterion for the learning procedure.

Original: For the latter, there are two possible options: a target error which all data points must satisfy, or a bound on the value of the loss function.
Revised: For the latter, there are two possible options: a target error which all data points must satisfy, or a bound on the value of the loss function.

Original: If a target error smaller than ϵ − δ is provided, this is when all points in the data set S satisfy the specification (3) and certification subsequently check that this generalises over the entire X .
Revised: If a target error smaller than ϵ − δ is provided, this is when all points in the data set S satisfy the specification (3) and certification subsequently check that this generalises over the entire X .

Original: If an alternative loss-based stopping criterion is provided, then an error bound on the approximation is estimated using the maximum approximation error over the data set S for use in certification.
Revised: If an alternative loss-based stopping criterion is provided, then an error bound on the approximation is estimated using the maximum approximation error over the data set S for use in certification.

Original: This estimated bound is conservative, i.e., greater than the maximum, to allow for successful certification to be more likely.
Revised: This estimated bound is conservative, i.e., greater than the maximum, to allow for successful certification to be more likely.

Original: After learning, the network N is translated to symbolic form and passed to the certification block, which checks condition (3) as described in Section 3.2.
Revised: After learning, the network N is translated to symbolic form and passed to the certification block, which checks condition (3) as described in Section 3.2.

Original: The certifier either determines condition (3) valid, and thus the CEGIS loop terminates, or computes a counterexample that falsifies the condition.
Revised: The certifier either determines condition (3) valid, and thus the CEGIS loop terminates, or computes a counterexample that falsifies the condition.

Original: The counterexample is returned to the learning procedure and augmented by sampling for additional points nearby in order to maximise the efficiency of learning and the overall synthesis.
Revised: The counterexample is returned to the learning procedure and augmented by sampling for additional points nearby in order to maximise the efficiency of learning and the overall synthesis.

Original: 3.2 Certification Phase
Revised: 3.2 Certification Phase

Original: The purpose of the certification is to check that at no point in the domain of interest X is the maximum error greater than the upper bound ϵ − δ , as per the specification in condition (3).
Revised: The purpose of the certification is to check that at no point in the domain of interest X is the maximum error greater than the upper bound ϵ − δ , as per the specification in condition (3).

Original: Therefore, the certifier is provided with the negation of the specification, namely
Revised: Therefore, the certifier is provided with the negation of the specification, namely

Original: [Equation]
Revised: [Equation]

Original: The certifier seeks an assignment s cex of the variable x such that the quantifier-free formula ϕ is satisfiable , namely that the specified bound is violated.
Revised: The certifier seeks an assignment s cex of the variable x such that the quantifier-free formula ϕ is satisfiable , namely that the specified bound is violated.

Original: If this search is successful, then the network N has not achieved the specified accuracy over X , and is thus not a valid neural abstraction.
Revised: If this search is successful, then the network N has not achieved the specified accuracy over X , and is thus not a valid neural abstraction.

Original: The corresponding assignment s cex forms the counterexample that is provided back to the learner (the machine learning procedure from Section 3.1).
Revised: The corresponding assignment s cex forms the counterexample that is provided back to the learner (the machine learning procedure from Section 3.1).

Original: Alternatively, if no assignment is found then specification (3) is proven valid; network N and error bound ϵ are then passed to the safety verification procedure (cf.
Revised: Alternatively, if no assignment is found then specification (3) is proven valid; network N and error bound ϵ are then passed to the safety verification procedure (cf.

Original: Section 4).
Revised: Section 4).

Original: Certification of the accuracy of the neural abstractions is performed by an SMT solver.
Revised: Certification of the accuracy of the neural abstractions is performed by an SMT solver.

Original: Several options exist for the selection of the SMT solver, with the requirement that the solver should reason over quantifier-free nonlinear real arithmetic formulae [54,61].
Revised: Several options exist for the selection of the SMT solver, with the requirement that the solver should reason over quantifier-free nonlinear real arithmetic formulae [54,61].

Original: This is because the vector field f may contain nonlinear terms.
Revised: This is because the vector field f may contain nonlinear terms.

Original: In our experiments, we employ dReal [61], which supports polynomial and non-polynomial terms such as transcendental functions like trigonometric or exponential ones.
Revised: In our experiments, we employ dReal [61], which supports polynomial and non-polynomial terms such as transcendental functions like trigonometric or exponential ones.

Original: A successful verification process allows for the full abstraction to be constructed using the achieved error ϵ and neural network N .
Revised: A successful verification process allows for the full abstraction to be constructed using the achieved error ϵ and neural network N .

Original: CEGIS has been shown to perform well and terminate successfully across a wide variety of problems.
Revised: CEGIS has been shown to perform well and terminate successfully across a wide variety of problems.

Original: We demonstrate the robustness of our procedure in Appendix B. x y
Revised: We demonstrate the robustness of our procedure in Appendix B. x y

Original: X
Revised: X

Original: X
Revised: X

Original: X˙ x = f 1 ( x ) x ∈ X˙ x = f 3 ( x ) x ∈ X˙ x = f 2 ( x ) x ∈ Xx ∈ Xx ∈
Revised: X˙ x = f 1 ( x ) x ∈ X˙ x = f 3 ( x ) x ∈ X˙ x = f 2 ( x ) x ∈ Xx ∈ Xx ∈

Original: Xx ∈
Revised: Xx ∈

Original: Xx ∈ X
Revised: Xx ∈ X

Original:  Safety Verification of Neural Abstractions
Revised:  Safety Verification of Neural Abstractions

Original: Neural abstractions are dynamical models expressed in terms of neural ODEs with additive disturbances (cf.
Revised: Neural abstractions are dynamical models expressed in terms of neural ODEs with additive disturbances (cf.

Original: Equation 4).
Revised: Equation 4).

Original: Corollary 1 ensures the fact for which concluding that a neural abstraction is safe suffices to assert that the concrete dynamical model is also safe.
Revised: Corollary 1 ensures the fact for which concluding that a neural abstraction is safe suffices to assert that the concrete dynamical model is also safe.

Original: Consequently, once a neural
Revised: Consequently, once a neural

Original: ODE is formally proven to be an abstraction for the concrete dynamical model, which is entirely delegated to our synthesis procedure (cf.
Revised: ODE is formally proven to be an abstraction for the concrete dynamical model, which is entirely delegated to our synthesis procedure (cf.

Original: Section 3), our definition of neural abstractions enables any procedure for the safety verification of neural ODEs with disturbances to be a valid safety verification procedure for the corresponding dynamical model.
Revised: Section 3), our definition of neural abstractions enables any procedure for the safety verification of neural ODEs with disturbances to be a valid safety verification procedure for the corresponding dynamical model.

Original: Safety verification approaches for dynamical systems controlled by neural networks solve a similar problem [17,51,72,74,103,110,111,113], yet with a subtle difference: neural network controllers take control actions at discrete points in time.
Revised: Safety verification approaches for dynamical systems controlled by neural networks solve a similar problem [17,51,72,74,103,110,111,113], yet with a subtle difference: neural network controllers take control actions at discrete points in time.

Original: Instead, neural ODEs characterise dynamics over continuous time.
Revised: Instead, neural ODEs characterise dynamics over continuous time.

Original: Some procedures for the direct verification of neural ODEs have been introduced very recently, and this currently an area under active development [65, 66, 92].
Revised: Some procedures for the direct verification of neural ODEs have been introduced very recently, and this currently an area under active development [65, 66, 92].

Original: Yet, existing approaches do not consider the case of a neural ODE with a non-deterministic drift.
Revised: Yet, existing approaches do not consider the case of a neural ODE with a non-deterministic drift.

Original: Therefore, in order to obtain a verification procedure for neural abstractions, we build upon the observation that a neural ODEs with ReLU activation functions and non-deterministic drift defines a hybrid automaton with affine dynamics.
Revised: Therefore, in order to obtain a verification procedure for neural abstractions, we build upon the observation that a neural ODEs with ReLU activation functions and non-deterministic drift defines a hybrid automaton with affine dynamics.

Original: Hybrid automata (cf.
Revised: Hybrid automata (cf.

Original: Figure 3) model the interaction between continuous dynamical systems and finite-state transition systems [68,112].
Revised: Figure 3) model the interaction between continuous dynamical systems and finite-state transition systems [68,112].

Original: A hybrid automaton consists of a finite set of variables and a finite graph, whose vertices we call discrete modes and edges we call discrete transitions.
Revised: A hybrid automaton consists of a finite set of variables and a finite graph, whose vertices we call discrete modes and edges we call discrete transitions.

Original: Every mode is associated with an invariant condition and a flow condition over the variables, which determine the continuous dynamics of the systems on the specific mode.
Revised: Every mode is associated with an invariant condition and a flow condition over the variables, which determine the continuous dynamics of the systems on the specific mode.

Original: Every discrete transition is associated with a guard condition, which determines the effect on discrete transitions between modes.
Revised: Every discrete transition is associated with a guard condition, which determines the effect on discrete transitions between modes.

Original: While we refer the reader to seminal work for a general definition of hybrid automata [68], we present a translation from neural abstractions to hybrid automata.
Revised: While we refer the reader to seminal work for a general definition of hybrid automata [68], we present a translation from neural abstractions to hybrid automata.

Original: 4.1 Translation of Neural Abstractions Into Hybrid Automata
Revised: 4.1 Translation of Neural Abstractions Into Hybrid Automata

Original: We begin with the observation that each neuron within a given hidden layer of a neural network with
Revised: We begin with the observation that each neuron within a given hidden layer of a neural network with

Original: ReLU activation functions induces a hyperplane in the vector space associated with the previous layer
Revised: ReLU activation functions induces a hyperplane in the vector space associated with the previous layer

Original: This hyperplane results in two half-spaces, one corresponding to the neuron being active and one to it being inactive.
Revised: This hyperplane results in two half-spaces, one corresponding to the neuron being active and one to it being inactive.

Original: For the j th neuron in the i th layer, these two halfspaces are respectively the two parts of the hyperplane given by
Revised: For the j th neuron in the i th layer, these two halfspaces are respectively the two parts of the hyperplane given by

Original: [Equation]
Revised: [Equation]

Original: where W i,j is the j th row of the weight matrix W i and
Revised: where W i,j is the j th row of the weight matrix W i and

Original: b i,j is the j th element of the bias b i (cf.
Revised: b i,j is the j th element of the bias b i (cf.

Original: Section 2).
Revised: Section 2).

Original: Therefore, every combinatorial configuration of the neural network defines an intersection of halfspaces that defines a polyhedral region in the vector space of the input neurons.
Revised: Therefore, every combinatorial configuration of the neural network defines an intersection of halfspaces that defines a polyhedral region in the vector space of the input neurons.

Original: Moreover, every configuration also defines a linear function from input to output neurons.
Revised: Moreover, every configuration also defines a linear function from input to output neurons.

Original: The space of configurations thus defines a partitioning of the input space, where each region is associated with an affine function.
Revised: The space of configurations thus defines a partitioning of the input space, where each region is associated with an affine function.

Original: A neural abstraction casts into a hybrid automaton, where every mode is determined by a configuration of the hidden neurons and each of these configurations induces a system of affine ODEs (cf.
Revised: A neural abstraction casts into a hybrid automaton, where every mode is determined by a configuration of the hidden neurons and each of these configurations induces a system of affine ODEs (cf.

Original: Figure 3).
Revised: Figure 3).

Original: Discrete Modes We represent a configuration of a neural network as a sequence C
Revised: Discrete Modes We represent a configuration of a neural network as a sequence C

Original: = ( c 1 , . . .
Revised: = ( c 1 , . . .

Original: , c k ) of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . .
Revised: , c k ) of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . .

Original: . , c k ∈ { 0 , 1 } h k , where k denotes the number of hidden layers and h 1 , . . .
Revised: . , c k ∈ { 0 , 1 } h k , where k denotes the number of hidden layers and h 1 , . . .

Original: , h k denote the number neurons in each of them (cf.
Revised: , h k denote the number neurons in each of them (cf.

Original: Section 2).
Revised: Section 2).

Original: Every vector c i represents the configuration of the neurons at the i th hidden later, and the j th element of c i represent the activation status of the j th neuron at the i th later, which equals to 1 is the neuron is active and 

Revised: Every vector c i represents the configuration of the neurons at the i th hidden later, and the j th element of c i represent the activation status of the j th neuron at the i th later, which equals to 1 is the neuron is active and

Original: if it is inactive.
Revised: if it is inactive.

Original: Every mode of the hybrid automaton corresponds to exactly one configuration of neurons.
Revised: Every mode of the hybrid automaton corresponds to exactly one configuration of neurons.

Original: Invariant Conditions We define the invariant of each mode as a restriction of the domain of interest to a region X C ⊆ X , which denotes the maximal set of states that enables configuration C .
Revised: Invariant Conditions We define the invariant of each mode as a restriction of the domain of interest to a region X C ⊆ X , which denotes the maximal set of states that enables configuration C .

Original: To construct X C , we define a higher-dimensional polyhedron on the space of valuation of the neurons that enable configuration C , i.e.,
Revised: To construct X C , we define a higher-dimensional polyhedron on the space of valuation of the neurons that enable configuration C , i.e.,

Original: [Equation]
Revised: [Equation]

Original: Note that diag( v ) denotes the square diagonal matrix whose diagonal takes its coefficients from vector v ; in our case, this results in a square diagonal matrix whose coefficients are either 0 or 1.
Revised: Note that diag( v ) denotes the square diagonal matrix whose diagonal takes its coefficients from vector v ; in our case, this results in a square diagonal matrix whose coefficients are either 0 or 1.

Original: Then, we project Y C onto the input neurons y 0 , denoted Y C
Revised: Then, we project Y C onto the input neurons y 0 , denoted Y C

Original: ↾ y 0 .
Revised: ↾ y 0 .

Original: Since the input neurons y 0 are equivalent to the state variables of the dynamical model, the invariant condition of mode C results in
Revised: Since the input neurons y 0 are equivalent to the state variables of the dynamical model, the invariant condition of mode C results in

Original: [Equation]
Revised: [Equation]

Original: A projection can be computed using the Fourier-Motzkin algorithm or by projecting the vertices of the polyhedron in a double description method.
Revised: A projection can be computed using the Fourier-Motzkin algorithm or by projecting the vertices of the polyhedron in a double description method.

Original: However, even though this is effective in our experiments, it has worst-case exponential time complexity.
Revised: However, even though this is effective in our experiments, it has worst-case exponential time complexity.

Original: A polynomial time construction can be obtained by propagating halfspaces backwards along the network, similarly to methods used in abstraction-refinement [27,57].
Revised: A polynomial time construction can be obtained by propagating halfspaces backwards along the network, similarly to methods used in abstraction-refinement [27,57].

Original: We outline the alternative construction in Appendix C.1.
Revised: We outline the alternative construction in Appendix C.1.

Original: Flow Conditions
Revised: Flow Conditions

Original: The dynamics of each mode C can be seen itself as a dynamical system with bounded disturbance:
Revised: The dynamics of each mode C can be seen itself as a dynamical system with bounded disturbance:

Original: [Equation]
Revised: [Equation]

Original: The matrix A C ∈ R n × n and the vector of drifts b C ∈ R n determine the linear ODE of the mode, whereas ϵ > 0 is the error bound derived from the neural abstraction.
Revised: The matrix A C ∈ R n × n and the vector of drifts b C ∈ R n determine the linear ODE of the mode, whereas ϵ > 0 is the error bound derived from the neural abstraction.

Original: The coefficients of the system are given by the weights and biases of the neural network as follows:
Revised: The coefficients of the system are given by the weights and biases of the neural network as follows:

Original: [Equation]
Revised: [Equation]

Original: Discrete Transitions and Guard Conditions A discrete transition exists between any two given modes if the two polyhedra that define their invariant conditions share a facet and the dynamics pass through at some point along the facet.
Revised: Discrete Transitions and Guard Conditions A discrete transition exists between any two given modes if the two polyhedra that define their invariant conditions share a facet and the dynamics pass through at some point along the facet.

Original: This can be checked by considering the sign of the Lie derivative between the dynamics and the corresponding facet, that is, the inner product between the dynamics and the normal vector to the facet.
Revised: This can be checked by considering the sign of the Lie derivative between the dynamics and the corresponding facet, that is, the inner product between the dynamics and the normal vector to the facet.

Original: In practice, we take a faster but more conservative approach by considering that a transition exists between two modes when the corresponding polyhedral regions share at least a vertex.
Revised: In practice, we take a faster but more conservative approach by considering that a transition exists between two modes when the corresponding polyhedral regions share at least a vertex.

Original: The guard condition of a discrete transition is simply the invariant of the destination mode.
Revised: The guard condition of a discrete transition is simply the invariant of the destination mode.

Original: 4.2 Enumeration of Feasible Modes
Revised: 4.2 Enumeration of Feasible Modes

Original: A given configuration C exists in the hybrid automaton if and only if the corresponding set X C , which is a convex polyhedron in R n , is nonempty; this consists of verifying that the linear program (LP) constructed from the polyhedron is feasible.
Revised: A given configuration C exists in the hybrid automaton if and only if the corresponding set X C , which is a convex polyhedron in R n , is nonempty; this consists of verifying that the linear program (LP) constructed from the polyhedron is feasible.

Original: Finding all modes of the hybrid automaton therefore consists of solving 2 H linear programs, where H = h 1 + · · · + h k is the total number of hidden neurons in the network.
Revised: Finding all modes of the hybrid automaton therefore consists of solving 2 H linear programs, where H = h 1 + · · · + h k is the total number of hidden neurons in the network.

Original: However, this exponential scaling with the number of neurons is limiting in terms of network size.
Revised: However, this exponential scaling with the number of neurons is limiting in terms of network size.

Original: Therefore, we propose an approach that works very well in practice to determine all valid neuron configurations.
Revised: Therefore, we propose an approach that works very well in practice to determine all valid neuron configurations.

Original: The approach relies on the observation that within a bounded polyhedron P , a given neuron has two modes ( ReLU enabled or disabled) only if the induced hyperplane intersects P .
Revised: The approach relies on the observation that within a bounded polyhedron P , a given neuron has two modes ( ReLU enabled or disabled) only if the induced hyperplane intersects P .

Original: If it does not, only one of the two possible half-spaces contributes to any possible active configuration, and the other neuron mode can be disregarded.
Revised: If it does not, only one of the two possible half-spaces contributes to any possible active configuration, and the other neuron mode can be disregarded.

Original: Therefore, this approach involves iterating through each neuron in turn and constructing two LPs—one for each halfspace intersected with the domain of interest
Revised: Therefore, this approach involves iterating through each neuron in turn and constructing two LPs—one for each halfspace intersected with the domain of interest

Original: X .
Revised: X .

Original: If only one LP is valid, we can fix the neuron to this mode, i.e., from this point onward only consider the intersection with the halfspace corresponding to the feasible LP, and construct a new polyhedron from the intersection of X and the feasible half-space.
Revised: If only one LP is valid, we can fix the neuron to this mode, i.e., from this point onward only consider the intersection with the halfspace corresponding to the feasible LP, and construct a new polyhedron from the intersection of X and the feasible half-space.

Original: In short, we consider the neurons of the network as a binary tree, with the branches representing the enabled and disabled state of this neuron.
Revised: In short, we consider the neurons of the network as a binary tree, with the branches representing the enabled and disabled state of this neuron.

Original: We perform a depth-first tree search through this tree by intersecting with the corresponding half-spaces.
Revised: We perform a depth-first tree search through this tree by intersecting with the corresponding half-spaces.

Original: Upon reaching an end node, we store this configuration (branches taken) and revert back to the most recent unexplored branch and continue.
Revised: Upon reaching an end node, we store this configuration (branches taken) and revert back to the most recent unexplored branch and continue.

Original: We include a more detailed description of this algorithm in Appendix C.2.
Revised: We include a more detailed description of this algorithm in Appendix C.2.

Original: This approach is inspired by that presented in [21], which similarly enumerates through the path of neurons using sets to determine the output range of a network.
Revised: This approach is inspired by that presented in [21], which similarly enumerates through the path of neurons using sets to determine the output range of a network.

Original:  Experimental Results 5.1 Safety Verification Using Neural Abstractions
Revised:  Experimental Results 5.1 Safety Verification Using Neural Abstractions

Original: We benchmark the results obtained by the safety verification algorithm proposed in Section 4 against
Revised: We benchmark the results obtained by the safety verification algorithm proposed in Section 4 against

Original: Flow* [33] (available under GPL), which is a mature tool for computing reachable regions of hybrid automata.
Revised: Flow* [33] (available under GPL), which is a mature tool for computing reachable regions of hybrid automata.

Original: It relies on computing flowpipes, i.e., sets of reachable states across time, which are propagated from a given set of initial states.
Revised: It relies on computing flowpipes, i.e., sets of reachable states across time, which are propagated from a given set of initial states.

Original: The flowpipes are generated from Taylor series approximations of the model’s vector field in (1), over subsequent discrete time steps.
Revised: The flowpipes are generated from Taylor series approximations of the model’s vector field in (1), over subsequent discrete time steps.

Original: Crucially, the use of a higher-order Taylor series, or of smaller time steps, leads to more precise computation of reachable sets.
Revised: Crucially, the use of a higher-order Taylor series, or of smaller time steps, leads to more precise computation of reachable sets.

Original: Since Flow*, like SpaceEx (available under GPLv3) is able to calculate overapproximations of flowpipes, it is suitable for use in safety verification, and is a state-of-the-art tool for verifying safety of nonlinear models.
Revised: Since Flow*, like SpaceEx (available under GPLv3) is able to calculate overapproximations of flowpipes, it is suitable for use in safety verification, and is a state-of-the-art tool for verifying safety of nonlinear models.

Original: Making a fair comparison around metrics for accuracy between Flow* and SpaceEx is challenging, as they represent flowpipes differently [36].
Revised: Making a fair comparison around metrics for accuracy between Flow* and SpaceEx is challenging, as they represent flowpipes differently [36].

Original: We ask them to perform safety verification for a given pair of initial and bad states, on a collection of different nonlinear models.
Revised: We ask them to perform safety verification for a given pair of initial and bad states, on a collection of different nonlinear models.

Original: These models, and their parameters, are detailed in Appendix A. As described in Section 2, the task of safety verification consists of ensuring that no trajectory starting within the set of initial states enters the set of bad states, within a given time horizon.
Revised: These models, and their parameters, are detailed in Appendix A. As described in Section 2, the task of safety verification consists of ensuring that no trajectory starting within the set of initial states enters the set of bad states, within a given time horizon.

Original: Our setup is as follows.
Revised: Our setup is as follows.

Original: Firstly, for a given benchmark model we define a finite time horizon T , a region of initial states X 0 and a region of bad states X B .
Revised: Firstly, for a given benchmark model we define a finite time horizon T , a region of initial states X 0 and a region of bad states X B .

Original: Then, we run flowpipe computations with Flow* using high-order Taylor models.
Revised: Then, we run flowpipe computations with Flow* using high-order Taylor models.

Original: Similarly we run the procedure described in Section 3, and construct a hybrid automaton as described in Section 4 to perform flowpipe computations using
Revised: Similarly we run the procedure described in Section 3, and construct a hybrid automaton as described in Section 4 to perform flowpipe computations using

Original: SpaceEx.
Revised: SpaceEx.

Original: We present the results in Table 1.
Revised: We present the results in Table 1.

Original: In the table, we show the Taylor model order (TM) and time step used within Flow*, as well as the structure of the neural networks used for neural abstractions.
Revised: In the table, we show the Taylor model order (TM) and time step used within Flow*, as well as the structure of the neural networks used for neural abstractions.

Original: For example, we denote a network with two hidden layers with h 1 neurons in the first layer and h 2 neurons in the second hidden layer as [ h 1 , h 2 ].
Revised: For example, we denote a network with two hidden layers with h 1 neurons in the first layer and h 2 neurons in the second hidden layer as [ h 1 , h 2 ].

Original: We note that while Flow*, much like
Revised: We note that while Flow*, much like

Original: SpaceEx, can perform flowpipe computation on the constructed hybrid automaton, it is not specialised to linear models like SpaceEx is and in practice struggles with the number of modes.
Revised: SpaceEx, can perform flowpipe computation on the constructed hybrid automaton, it is not specialised to linear models like SpaceEx is and in practice struggles with the number of modes.

Original: Notably, Flow* is unable to handle the two models that do not exhibit local Lipschitz continuity.
Revised: Notably, Flow* is unable to handle the two models that do not exhibit local Lipschitz continuity.

Original: Flow* constructs Taylor models that incorporate the derivatives of the dynamics: as expected, unbounded derivatives will cause issues for this approach.
Revised: Flow* constructs Taylor models that incorporate the derivatives of the dynamics: as expected, unbounded derivatives will cause issues for this approach.

Original: Meanwhile, Ariadne [22] a is an alternative tool for over-approximating flowpipes of nonlinear systems.
Revised: Meanwhile, Ariadne [22] a is an alternative tool for over-approximating flowpipes of nonlinear systems.

Original: While Ariadne does not explicitly require
Revised: While Ariadne does not explicitly require

Original: Lipschitz continuity, it is also unable to perform analysis on tools with nth root terms at zero, due to numerical instability.
Revised: Lipschitz continuity, it is also unable to perform analysis on tools with nth root terms at zero, due to numerical instability.

Original: Instead, our abstraction method works directly on the dynamics themselves, rather than their derivatives, in order to construct simpler, abstract models that are amenable to be verified.
Revised: Instead, our abstraction method works directly on the dynamics themselves, rather than their derivatives, in order to construct simpler, abstract models that are amenable to be verified.

Original: By formally quantifying how different an abstract model is through the approximation error, we are able to formally perform safety verification on such challenging concrete models.
Revised: By formally quantifying how different an abstract model is through the approximation error, we are able to formally perform safety verification on such challenging concrete models.

Original: [Table]
Revised: [Table]

Original: Notice that we additionally outperform Flow* on a Lipschitz-continuous model ( Exponential in Table 1)
Revised: Notice that we additionally outperform Flow* on a Lipschitz-continuous model ( Exponential in Table 1)

Original: [Table]
Revised: [Table]

Original: where the composition of functions that make up the model’s dynamics result in high errors in
Revised: where the composition of functions that make up the model’s dynamics result in high errors in

Original: Flow* before the flowpipe can be calculated across the given time horizon.
Revised: Flow* before the flowpipe can be calculated across the given time horizon.

Original: We highlight that despite relying on affine approximations (i
Revised: We highlight that despite relying on affine approximations (i

Original: [Table]
Revised: [Table]

Original: e., 1 st order models)
Revised: e., 1 st order models)

Original: [Table]
Revised: [Table]

Original: neural abstractions are able to compete with, and even outperform, methods that use much higher order functions (10 th and 30 th in the benchmarks) for approximation.
Revised: neural abstractions are able to compete with, and even outperform, methods that use much higher order functions (10 th and 30 th in the benchmarks) for approximation.

Original: 5.2 Limitations
Revised: 5.2 Limitations

Original: Our approach is limited in terms of scalability, both with regards to the dimension of the models and to the size of the utilised neural networks.
Revised: Our approach is limited in terms of scalability, both with regards to the dimension of the models and to the size of the utilised neural networks.

Original: The causes of this limitation are twofold: firstly we are bound by the computational complexity of SMT solving - known to be NP-hard - which can struggle with complex formaulae with many variables.
Revised: The causes of this limitation are twofold: firstly we are bound by the computational complexity of SMT solving - known to be NP-hard - which can struggle with complex formaulae with many variables.

Original: The certification step requires the largest amount of time (cf.
Revised: The certification step requires the largest amount of time (cf.

Original: Appendix B), indicating that improvements in the verification of neural networks can lead to a large performance increase for our abstractions.
Revised: Appendix B), indicating that improvements in the verification of neural networks can lead to a large performance increase for our abstractions.

Original: Secondly, we are limited in terms of the complexity of our abstractions by SpaceEx.
Revised: Secondly, we are limited in terms of the complexity of our abstractions by SpaceEx.

Original: While SpaceEx is a highly efficient implementation of LGG [85], the presence of a large number of discrete modes poses a significant computational challenge.
Revised: While SpaceEx is a highly efficient implementation of LGG [85], the presence of a large number of discrete modes poses a significant computational challenge.

Original: It future work, we hope to investigate the balance between abstraction complexity and accuracy.
Revised: It future work, we hope to investigate the balance between abstraction complexity and accuracy.

Original: The efficacy of neural abstraction on further tools for hybrid automata with affine dynamics also remains to be investigated [6,22,26,104].
Revised: The efficacy of neural abstraction on further tools for hybrid automata with affine dynamics also remains to be investigated [6,22,26,104].

Original:  Conclusion
Revised:  Conclusion

Original: We have proposed a novel technique that leverages the approximation capabilities of neural networks with ReLU activation functions to synthesise formal abstractions of dynamical models.
Revised: We have proposed a novel technique that leverages the approximation capabilities of neural networks with ReLU activation functions to synthesise formal abstractions of dynamical models.

Original: By combining machine learning and SMT solving algorthms in a CEGIS loop, our method computes abstract neural
Revised: By combining machine learning and SMT solving algorthms in a CEGIS loop, our method computes abstract neural

Original: ODEs with non-determinism that overapproximate the concrete models and therefore satisfy the property for which safety of the abstract model carries over to the concrete model.
Revised: ODEs with non-determinism that overapproximate the concrete nonlinear models. This guarantees the property for which safety of the abstract model carries over to the concrete model.

Original: Then, we cast these neural ODEs into hybrid automata with affine dynamics.
Revised: Our method casts these neural ODEs into hybrid automata with affine dynamics, which we have verified using SpaceEx.

Original: We have used SpaceEx to verify the abstraction, which has shown that our method is not only comparable to Flow* in safety verification on existing nonlinear benchmarks, but also shows superior effectiveness on models that do not exhibit local Lipschitz continuity, which is a hard problem in formal verification.
Revised: We have demonstrated that our method is not only comparable to Flow* in safety verification on existing nonlinear benchmarks, but also shows superior effectiveness on models that do not exhibit local Lipschitz continuity, which is a hard problem in formal verification.

Original: Yet, our experiments are limited to low-dimensional models and scalability remains an open challenge.
Revised: Yet, our experiments are limited to low-dimensional models and scalability remains an open challenge.

Original: Our approach has advanced the state of the art in terms of expressivity, which is the first step toward obtaining a general and efficient verifier based on neural abstraction.
Revised: Our approach has advanced the state of the art in terms of expressivity, which is the first step toward obtaining a general and efficient verifier based on neural abstraction.

Original: Obtaining scalability to higher dimensions will require a synergy of efficient SMT solvers for neural networks and safety verification of neural ODEs, which are both novel and actively researched questions in formal verification [65,66,73,76,89,92,111].
Revised: Obtaining scalability to higher dimensions will require a synergy of efficient SMT solvers for neural networks and safety verification of neural ODEs, which are both novel and actively researched questions in formal verification [65,66,73,76,89,92,111].

Original: Acknowledgements
Revised: Acknowledgements

Original: We thank the anonymous reviewers for their helpful suggestions.
Revised: We thank the anonymous reviewers for their helpful suggestions.

Original: Alec was supported by the EPSRC
Revised: Alec was supported by the EPSRC

Original: Centre for Doctoral Training in Autonomous Intelligent Machines and Systems (EP/S024050/1).
Revised: Centre for Doctoral Training in Autonomous Intelligent Machines and Systems (EP/S024050/1).

Original: Checklist
Revised: Checklist

Original: For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
Revised: For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?

Original: [Yes] (b) Did you describe the limitations of your work?
Revised: [Yes] (b) Did you describe the limitations of your work?

Original: [Yes] Please see Section 5.
Revised: [Yes] Please see Section 5.

Original: (c) Did you discuss any potential negative societal impacts of your work?
Revised: (c) Did you discuss any potential negative societal impacts of your work?

Original: [Yes] See(d)
Revised: [Yes] See(d)

Original: Have you read the ethics review guidelines and ensured that your paper conforms to them?
Revised: Have you read the ethics review guidelines and ensured that your paper conforms to them?

Original: [Yes] 2.
Revised: [Yes] 2.

Original: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
Revised: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes] See(b)
Revised: [Yes] See(b)

Original: Did you include complete proofs of all theoretical results?
Revised: Did you include complete proofs of all theoretical results?

Original: [Yes] See3.
Revised: [Yes] See3.

Original: If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
Revised: If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?

Original: [Yes] The code and data generation will be part of the supplementary material.
Revised: [Yes] The code and data generation will be part of the supplementary material.

Original: Reproducing the results will be possible from this but is not the intention of the authors.
Revised: Reproducing the results will be possible from this but is not the intention of the authors.

Original: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
Revised: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?

Original: [Yes] The hyper-parameters for the learning procedure are chosen heuristically, but we include the relevant configuration files in the supplementary material.
Revised: [Yes] The hyper-parameters for the learning procedure are chosen heuristically, but we include the relevant configuration files in the supplementary material.

Original: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
Revised: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?

Original: [N/A] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
Revised: [N/A] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?

Original: [Yes] See Table 1. 4.
Revised: [Yes] See Table 1. 4.

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?

Original: [Yes] We have cited all used tools.
Revised: [Yes] We have cited all used tools.

Original: (b) Did you mention the license of the assets?
Revised: (b) Did you mention the license of the assets?

Original: [Yes] See Section(c)
Revised: [Yes] See Section(c)

Original: Did you include any new assets either in the supplemental material or as a URL?
Revised: Did you include any new assets either in the supplemental material or as a URL?

Original: [Yes] The code will be included in the supplementary material.
Revised: [Yes] The code will be included in the supplementary material.

Original: (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
Revised: (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?

Original: [N/A] (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
Revised: [N/A] (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?

Original: [N/A] 5.
Revised: [N/A] 5.

Original: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
Revised: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?

Original: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
Revised: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?

Original: [N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
Revised: [N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?

Original: [N/A]
Revised: [N/A]

Original: A Benchmark Nonlinear Dynamical Models
Revised: A Benchmark Nonlinear Dynamical Models

Original: For each dynamical model, we report the vector field f : R n → R n and the spatial domain X over which the abstraction is performed and which, unless otherwise stated, is taken to be the hyper-rectangle [ − 1 , 1] n .
Revised: For each dynamical model, we report the vector field f : R n → R n and the spatial domain X over which the abstraction is performed and which, unless otherwise stated, is taken to be the hyper-rectangle [ − 1 , 1] n .

Original: Water Tank
Revised: Water Tank

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Jet Engine [16]
Revised: Jet Engine [16]

Original: [Equation]
Revised: [Equation]

Original: Steam Governor [107]  
Revised: Steam Governor [107]  

Original: [Equation]
Revised: [Equation]

Original: Exponential 
Revised: Exponential 

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Non-Lipschitz Vector Field 1 (NL1)  
Revised: Non-Lipschitz Vector Field 1 (NL1)  

Original: [Equation]
Revised: [Equation]

Original: ˙
Revised: ˙

Original: y
Revised: y

Original: [Equation]
Revised: [Equation]

Original: X =
Revised: X =

Original: [Equation]
Revised: [Equation]

Original: 1] × [ − 1 , 1]
Revised: 1] × [ − 1 , 1]

Original: [Equation]
Revised: [Equation]

Original: X 0 =
Revised: X 0 =

Original: [0 , 0 . 05] × [0 , 0 . 1]
Revised: [0 , 0 . 05] × [0 , 0 . 1]

Original: X B = [0 . 35 , 0 . 45] ×
Revised: X B = [0 . 35 , 0 . 45] ×

Original: Non-Lipschitz Vector Field
Revised: Non-Lipschitz Vector Field

Original: [Equation]
Revised: [Equation]

Original: B Additional Experimental Results and Figures B.1 Experimental Comparison Against Affine Simplical Meshes
Revised: B Additional Experimental Results and Figures B.1 Experimental Comparison Against Affine Simplical Meshes

Original: In this section, we present some supplementary empirical results on neural abstractions.
Revised: In this section, we present some supplementary empirical results on neural abstractions.

Original: Firstly, we note that hybridisation-based abstraction of nonlinear models have been studied previously, such as in [15], which describes a type of hybridisation-based abstractions that is similar to those constructed in this work.
Revised: Firstly, we note that hybridisation-based abstraction of nonlinear models have been studied previously, such as in [15], which describes a type of hybridisation-based abstractions that is similar to those constructed in this work.

Original: The approach relies first on partitioning the state space using a simplicial mesh grid, and
Revised: The approach relies first on partitioning the state space using a simplicial mesh grid, and

Original: [Table]
Revised: [Table]

Original: then allowing the dynamics in each mesh to be calculated from an affine interpolation between the vertices of the simplex.
Revised: then allowing the dynamics in each mesh to be calculated from an affine interpolation between the vertices of the simplex.

Original: This affine simplicial mesh (ASM) based approach constructs abstractions of the same expressivity as neural abstractions (first order approximations) with partitions defined by affine inequalities.
Revised: This affine simplicial mesh (ASM) based approach constructs abstractions of the same expressivity as neural abstractions (first order approximations) with partitions defined by affine inequalities.

Original: An approximation-error bound for ASM can be calculated for systems which have bounded second order derivatives using the model dynamics and the size of each simplex (all simplices are assumed to be the same size), as described in [15].
Revised: An approximation-error bound for ASM can be calculated for systems which have bounded second order derivatives using the model dynamics and the size of each simplex (all simplices are assumed to be the same size), as described in [15].

Original: In Table 2 we compare between abstractions constructed using an affine simplicial mesh and neural abstractions.
Revised: In Table 2 we compare between abstractions constructed using an affine simplicial mesh and neural abstractions.

Original: We run our procedure to synthesise certified abstractions using selected network structures and an initial target error of 0.5.
Revised: We run our procedure to synthesise certified abstractions using selected network structures and an initial target error of 0.5.

Original: If a successful abstraction is synthesised, we reduce the error by some multiplicative factor and repeat.
Revised: If a successful abstraction is synthesised, we reduce the error by some multiplicative factor and repeat.

Original: This iterative procedure continues until no success is reached within a time of 300s.
Revised: This iterative procedure continues until no success is reached within a time of 300s.

Original: We report the results from 10 repeated experiments over different initial random seeds for neural abstractions, reporting the average (mean), minimum and maximum results obtained.
Revised: We report the results from 10 repeated experiments over different initial random seeds for neural abstractions, reporting the average (mean), minimum and maximum results obtained.

Original: In contrast, we report the approximation-error bound for ASM for different numbers of partitions.
Revised: In contrast, we report the approximation-error bound for ASM for different numbers of partitions.

Original: The results reported in Table 2 illustrate that neural abstractions outperform ASM based abstractions in terms of error for similar numbers of partitions.
Revised: The results reported in Table 2 illustrate that neural abstractions outperform ASM based abstractions in terms of error for similar numbers of partitions.

Original: Furthermore, neural abstractions generally require significantly fewer partitions for significantly lower approximation-error bounds.
Revised: Furthermore, neural abstractions generally require significantly fewer partitions for significantly lower approximation-error bounds.

Original: In practice this means neural abstractions will outperform ASM-based abstractions for safety verification both in terms of speed and accuracy.
Revised: In practice this means neural abstractions will outperform ASM-based abstractions for safety verification both in terms of speed and accuracy.

Original: We also note the success ratio of our experiments, i.e., the ratio of all experiments which achieve an approximation-error bound of 0.5 or less.
Revised: We also note the success ratio of our experiments, i.e., the ratio of all experiments which achieve an approximation-error bound of 0.5 or less.

Original: These results suggest that in general or procedure is robust and terminates successfully with high probability for reasonable target errors.
Revised: These results suggest that in general or procedure is robust and terminates successfully with high probability for reasonable target errors.

Original: We note that since ASM based abstractions are constructive and are able to deterministically increase the number partitions and consequently reduce the error, for very large numbers of partitions they would achieve lower errors than neural abstractions.
Revised: We note that since ASM based abstractions are constructive and are able to deterministically increase the number partitions and consequently reduce the error, for very large numbers of partitions they would achieve lower errors than neural abstractions.

Original: However, in practice these abstractions would be too large in complexity to use with SpaceEx for safety verification.
Revised: However, in practice these abstractions would be too large in complexity to use with SpaceEx for safety verification.

Original: B.2 Computation Run-time Profiling
Revised: B.2 Computation Run-time Profiling

Original: In Table 3 we show a breakdown of the runtimes of our procedure shown in the main text.
Revised: In Table 3 we show a breakdown of the runtimes of our procedure shown in the main text.

Original: In particular, we present the total time spent during learning, certification of the abstraction and finally in safety verification.
Revised: In particular, we present the total time spent during learning, certification of the abstraction and finally in safety verification.

Original: [Table]
Revised: [Table]

Original: C Improved Translation from Neural Abstractions to Hybrid Automata C.1 Computing Invariant Conditions
Revised: C Improved Translation from Neural Abstractions to Hybrid Automata C.1 Computing Invariant Conditions

Original: Invariant conditions are computed from the configuration of a neural network denoted as the sequence
Revised: Invariant conditions are computed from the configuration of a neural network denoted as the sequence

Original: C =
Revised: C =

Original: ( c 1 , . . .
Revised: ( c 1 , . . .

Original: , c k ) of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . .
Revised: , c k ) of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . .

Original: . , c k ∈ { 0 , 1 } h k , where k denotes the number of hidden layers and h 1 , . . .
Revised: . , c k ∈ { 0 , 1 } h k , where k denotes the number of hidden layers and h 1 , . . .

Original: , h k denote the number neurons in each of them (cf.
Revised: , h k denote the number neurons in each of them (cf.

Original: Section 2).
Revised: Section 2).

Original: Every vector c i represents the configuration of the neurons at the i th hidden later, and its j th element c i,j represents the activation status of the j th neuron at the i th layer.
Revised: Every vector c i represents the configuration of the neurons at the i th hidden later, and its j th element c i,j represents the activation status of the j th neuron at the i th layer.

Original: Every mode of the hybrid automaton corresponds to exactly one configuration of neurons.
Revised: Every mode of the hybrid automaton corresponds to exactly one configuration of neurons.

Original: In turn, every configuration of neurons C restricts the neural network N into a linear function.
Revised: In turn, every configuration of neurons C restricts the neural network N into a linear function.

Original: More precisely, we inductively define the linear restriction at the i th hidden layer as follows:
Revised: More precisely, we inductively define the linear restriction at the i th hidden layer as follows:

Original: [Equation]
Revised: [Equation]

Original: We define the invariant of each mode as a restriction of the domain of interest to a region X C ⊆ X , which denotes the maximal set of states that enables configuration C .
Revised: We define the invariant of each mode as a restriction of the domain of interest to a region X C ⊆ X , which denotes the maximal set of states that enables configuration C .

Original: To construct X C , we begin with the observation that the activation configuration
Revised: To construct X C , we begin with the observation that the activation configuration

Original: c i at every i th hidden layer induces a halfspace on the vector space of the previous layer of the neural network.
Revised: c i at every i th hidden layer induces a halfspace on the vector space of the previous layer of the neural network.

Original: Then, the pre-image of this halfspace backward along the previous layers of the linear restriction of the network characterises a corresponding halfspace on its input neurons.
Revised: Then, the pre-image of this halfspace backward along the previous layers of the linear restriction of the network characterises a corresponding halfspace on its input neurons.

Original: Since the input neurons are equivalent to the state variables of the dynamical model, the halfspace induced by layer i projected onto state variables x is
Revised: Since the input neurons are equivalent to the state variables of the dynamical model, the halfspace induced by layer i projected onto state variables x is

Original: [Equation]
Revised: [Equation]

Original: The pre-image of a set Y under a function g is defined as { x | g ( x ) ∈ Y} and can be generally computed by quantifier elimination or, in the linear case, double description methods.
Revised: The pre-image of a set Y under a function g is defined as { x | g ( x ) ∈ Y} and can be generally computed by quantifier elimination or, in the linear case, double description methods.

Original: However, these methods have worst-case exponential time complexity.
Revised: However, these methods have worst-case exponential time complexity.

Original: To obtain X C efficiently, we can leverage the fact that the pre-image of any halfspace { y | c T y ≤ d } under any affine function g ( x ) =
Revised: To obtain X C efficiently, we can leverage the fact that the pre-image of any halfspace { y | c T y ≤ d } under any affine function g ( x ) =

Original: Ax + b equals to the set { x | c T y ≤ d ∧
Revised: Ax + b equals to the set { x | c T y ≤ d ∧

Original: y =
Revised: y =

Original: Ax + b } , which in turn defines the halfspace { x | c T Ax ≤ d − c T b } .
Revised: Ax + b } , which in turn defines the halfspace { x | c T Ax ≤ d − c T b } .

Original: Therefore, since N ( i − 1) C is an affine function, every halfspace can be projected backward through the affine functions N ( i − 1) C , . .
Revised: Therefore, since N ( i − 1) C is an affine function, every halfspace can be projected backward through the affine functions N ( i − 1) C , . .

Original: , N (1) C using O ( k ) linear algebra operations.
Revised: , N (1) C using O ( k ) linear algebra operations.

Original: Finally, the entire invariant condition for configuration C is defined as the following polyhedron:
Revised: Finally, the entire invariant condition for configuration C is defined as the following polyhedron:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: An invariant condition thus results in a polyhedron defined as the intersection of k halfspaces together with the constrains that define the domain of interest.
Revised: An invariant condition thus results in a polyhedron defined as the intersection of k halfspaces together with the constrains that define the domain of interest.

Original: Notably, under the definition in this appendix, the dynamics of mode C given in Equation 10 correspond to the affine dynamical model
Revised: Notably, under the definition in this appendix, the dynamics of mode C given in Equation 10 correspond to the affine dynamical model

Original: [Equation]
Revised: [Equation]

Original: 22) whose dynamics are governed by the affine function
Revised: 22) whose dynamics are governed by the affine function

Original: [Equation]
Revised: [Equation]

Original: N
Revised: N

Original: N 2 X = ∅
Revised: N 2 X = ∅

Original: N 3 N
Revised: N 3 N

Original: End End
Revised: End End

Original: End
Revised: End

Original: X = ∅
Revised: X = ∅

Original: C = (1 , 0 , 1 ) C = (1 , 1 , 1 ) C
Revised: C = (1 , 0 , 1 ) C = (1 , 1 , 1 ) C

Original: = (1 , 0 , 0 )
Revised: = (1 , 0 , 0 )

Original: X ← X ∩
Revised: X ← X ∩

Original: h
Revised: h

Original: +1 ,
Revised: +1 ,

Original: X ̸ = ∅ X ← X ∩ h −
Revised: X ̸ = ∅ X ← X ∩ h −

Original: X ← X ∩ h +2 ,
Revised: X ← X ∩ h +2 ,

Original: X ̸ = ∅
Revised: X ̸ = ∅

Original: X ← X ∩ h +3 ,
Revised: X ← X ∩ h +3 ,

Original: X ̸ = ∅ X ← X ∩ h −
Revised: X ̸ = ∅ X ← X ∩ h −

Original: X ← X ∩ h − 2 ,
Revised: X ← X ∩ h − 2 ,

Original: X ̸ = ∅
Revised: X ̸ = ∅

Original: [Figure]
Revised: [Figure]

Original: C.2 Enumerating Feasible Modes
Revised: C.2 Enumerating Feasible Modes

Original: Determining whether a mode C exists in the hybrid automaton amounts to determining the linear program (LP) associated to polyhedron X C is feasible.
Revised: Determining whether a mode C exists in the hybrid automaton amounts to determining the linear program (LP) associated to polyhedron X C is feasible.

Original: Finding all modes therefore consists of solving 2 H linear programs, where H = h 1 + · · · + h k is the total number of neurons.
Revised: Finding all modes therefore consists of solving 2 H linear programs, where H = h 1 + · · · + h k is the total number of neurons.

Original: This scales exponentially in the number of neurons.
Revised: This scales exponentially in the number of neurons.

Original: Here, we elaborate on the tree search algorithm described in
Revised: Here, we elaborate on the tree search algorithm described in

Original: Section 4.2 using a diagram; the purpose of this algorithm is to efficiently determine all active neuron configurations within a bounded domain of interest X .
Revised: Section 4.2 using a diagram; the purpose of this algorithm is to efficiently determine all active neuron configurations within a bounded domain of interest X .

Original: We consider an example tree in Figure 4, which depicts an example search for a neural network with a single hidden layer consisting of three neurons.
Revised: We consider an example tree in Figure 4, which depicts an example search for a neural network with a single hidden layer consisting of three neurons.

Original: The tree illustrates the construction of X C through repeated intersections of half-spaces as paths are taken through the tree structure.
Revised: The tree illustrates the construction of X C through repeated intersections of half-spaces as paths are taken through the tree structure.

Original: Nodes represent each neuron, labelled N i , i = 1 , 2 , 3 and each edge represents one of two possible half-spaces for the neuron it leaves from ( ReLU enabled, solid line, and disabled, dashed line).
Revised: Nodes represent each neuron, labelled N i , i = 1 , 2 , 3 and each edge represents one of two possible half-spaces for the neuron it leaves from ( ReLU enabled, solid line, and disabled, dashed line).

Original: This approach allows us to prune neurons and overall solve significantly fewer linear programs than simply enumerating through all possible configurations.
Revised: This approach allows us to prune neurons and overall solve significantly fewer linear programs than simply enumerating through all possible configurations.