Original: Neural Abstractions
Revised: Neural Abstractions

Original: Abstract
Revised: Abstract

Original: We present a novel method for the safety verification of non-linear dynamical systems.
Revised: We present a novel method for the safety verification of non-linear dynamical systems.

Original: We train a neural network so as to approximate the system from sample states whilst ensuring an arbitrarily tight bound on the approximation error, which we formally certify using symbolic reasoning.
Revised: We train a neural network so as to approximate the system from sample states whilst ensuring an arbitrarily tight bound on the approximation error, which we formally certify using symbolic reasoning.

Original: If the latter step refutes the bound, then we augment the samples set with a counterexample and repeat training in a counterexample-guided inductive synthesis loop (CEGIS).
Revised: If the latter step refutes the bound, then we augment the samples set with a counterexample and repeat training in a counterexample-guided inductive synthesis loop (CEGIS).

Original: We show that, upon successful certification of the bound, this produces a neural ODE with bounded disturbances that constitutes a formal abstraction of the original system, which satisfies a fundamental property: if the abstract system is safe then the original system is safe.
Revised: We show that, upon successful certification of the bound, this produces a neural ODE with bounded disturbances that constitutes a formal abstraction of the original system, which satisfies a fundamental property: if the abstract system is safe then the original system is safe.

Original: Neural networks have extensively been used before as approximators; in this work we make a step further and use them for the first time as abstractions.
Revised: Neural networks have extensively been used before as approximators; in this work we make a step further and use them for the first time as abstractions.

Original: By using neural ODEs with ReLU activation functions as abstractions, we cast the verification problem for non-linear systems into that of hybrid automata with affine dynamics.
Revised: By using neural ODEs with ReLU activation functions as abstractions, we cast the verification problem for non-linear systems into that of hybrid automata with affine dynamics.

Original: We demonstrate that our overall approach is particularly effective for the verification of benchmarks that do not exhibit  Lipschitz continuity, which are out of reach to the existing technologies.
Revised: We demonstrate that our overall approach is particularly effective for the verification of benchmarks that do not exhibit local Lipschitz continuity, which are out of reach to the existing technologies.

Original: Moveover, we demonstrate that it performs comparably to the mature tool Flow* over Lipschitz-continuous non-linear models.
Revised: Moveover, we demonstrate that it performs comparably to the mature tool Flow* over Lipschitz-continuous non-linear models.

Original:  Introduction
Revised:  Introduction

Original: Dynamical models are ubiquitous in science and engineering, and describe a wide range of continuousor discrete-time real-world processes whose safety verification is often crucial [7,30,34,73].
Revised: Dynamical models are ubiquitous in science and engineering, and describe a wide range of continuousor discrete-time real-world processes whose safety verification is often crucial [7,30,34,74].

Original: The simplest of these models have linear dynamics, but most practical models contain nonlinear terms, which results in more involved or laborious safety analysis and formal verification [4,13,22–25,27, 33,35,36,38,50,51,53,57,67,68].
Revised: The simplest of these models have linear dynamics, but most practical models contain nonlinear terms, which results in more involved or laborious safety analysis and formal verification [4,13,22–25,27,33, 35,36,38,51,52,54,58,68,69].

Original: Indeed, whilst the analysis of linear models by and large boils down to linear algebraproblems [11], for nonlinear models analysis and verification problems are much harder, requiring ingenuity and explicitly leveraging the structure of the dynamics; as such results are bespoke to restricted classes of models,they often require parameter tuning, and in practice they rely on numerical implementation, which is bound to generate errors.
Revised: Whilst the analysis of linear models by and large boils down to linear algebra [11], for nonlinear models analysis and verification problems are much harder, requiring ingenuity and explicitly leveraging the structure of the dynamics; as such results are bespoke to restricted classes of models, often require parameter tuning, and in practice they rely on numerical implementation, which is bound to generate errors.

Original: Furthermore, the existence of models that do not exhibit local Lipschitz continuity causes further challenges for technologies that rely on Lipschitz-based assumptions.
Revised: Furthermore, the existence of models that do not exhibit local Lipschitz continuity causes further challenges for technologies that rely on Lipschitzbased assumptions.

Original: Despite this, dynamical models with vector fields that are not Lipschitz are abundant in literature, include in particular instances from natural phenomena, from fluid dynamics to n-body orbits and chaotic systems, as well as engineering, such as analogue and digital electrical circuits.
Revised: Despite this, dynamical models with vector fields that are not Lipschitz are abundant in literature, including instances from natural phenomena: from fluid dynamics to n-body orbits and chaotic systems, as well as engineering, such as analogue and digital electrical circuits.

Original: For a given nonlinear model, it may be desirable to construct an approximation of its nonlinear dynamics, resulting in a simpler model, e.g. one with linear, affine (linear, plus drift), or polynomial dynamics.
Revised: For a given nonlinear model, it may be desirable to construct an approximation of its nonlinear dynamics, resulting in a simpler model, e.g. one with linear, affine (linear, plus drift), or polynomial dynamics.

Original: One can then resort to the simpler model for analysis and/or verification [6, 65, 66].
Revised: One can then resort to the simpler model for analysis and/or verification [6, 66, 67].

Original: Evidently, such approximation often comes with an error: if one can bound the value of this error, then the approximated model can be cast as an abstraction , whereby one can sufficiently derive verification results that can be refined and thus applied to the original nonlinear model.
Revised: Evidently, such approximation often comes with an error: if one can bound the value of this error, then the approximated model can be cast as an abstraction , whereby one can sufficiently derive verification results that can be refined and thus applied to the original nonlinear model.

Original: In relevant literature, such abstractions can be either finite-state, such as finite transition systems, or alternatively can retain continuous dynamics: in the latter instance and for this work, we specifically refer to approximations that are structurally piecewise affine, namely affine within partitions of the state space, and where the abstraction procedure to generate them is called hybridisation [5,8–10,15,18, 31, 32, 39, 44, 49, 52, 55, 56, 58–60, 64, 72].
Revised: In relevant literature, such abstractions can be either finite-state, such as finite transition systems, or alternatively can retain continuous dynamics: in the latter instance and for this work, we specifically refer to approximations that are structurally piecewise affine, namely affine within partitions of the state space, and where the abstraction procedure to generate them is called hybridisation [5,8–10,15,18, 31, 32, 39, 45, 50, 53, 56, 57, 59–61, 65, 73].

Original: Hybridisations of general dynamical models relate to models known as hybrid automata or hybrid systems , whereby multiple modes are associated to the partitions and their corresponding dynamics.
Revised: Hybridisations of general dynamical models relate to models known as hybrid automata or hybrid systems , whereby multiple modes are associated to the partitions and their corresponding dynamics.

Original: Recently, models developed based on first-principles (also denoted as white-box models) are often replaced by generalistic, black-box architectures, namely models with a given general template that is successively best fit to data observed from the underlying physical process.
Revised: Recently, models developed based on first-principles (also denoted as white-box models) are often replaced by generalistic, black-box architectures, namely models with a given general template that is successively best fit to data observed from the underlying physical process.

Original: Examples of parametrised black-box models are linear regressors, (deep) nonlinear neural networks, or linearly-weighted combinations of nonlinear basis functions; alternatively, non-parametrised alternatives are Gaussian processes (GP) or models based on support vector machines (SVM) [61].
Revised: Examples of parametrised black-box models are linear regressors, (deep) nonlinear neural networks, or linearly-weighted combinations of nonlinear basis functions; alternatively, non-parametrised alternatives are Gaussian processes (GP) or models based on support vector machines (SVM) [62].

Original: In this work, we draw a formal connection from white-box, nonlinear dynamical models to black-box, neural dynamical models, showing that the latter structures can be built as sound abstractions of the concrete nonlinear models.
Revised: In this work, we draw a formal connection from white-box, nonlinear dynamical models to black-box, neural dynamical models, showing that the latter structures can be built as sound abstractions of the original nonlinear models.

Original: Such abstractions are generated automatically by means of a counterexample-based inductive synthesis procedure, known as CEGIS [71] (cf.
Revised: Such abstractions are generated automatically by means of a counterexample-based inductive synthesis procedure, known as CEGIS [72] (cf.

Original: Figure 3, left): this procedure alternates between the training of a ReLU-based neural network approximation (learner), and the computation of a formal upper-bound on the error associated to it (certifier), which formalises it as an abstraction.
Revised: Figure 3, left): this procedure alternates between the training of a ReLU-based neural network approximation (learner), and the computation of a formal upper-bound on the error associated to it (certifier), which formalises it as an abstraction.

Original: In view of the placed emphasis on the usefulness of abstraction for formal verification goals, we employ our ReLU-based abstraction on safety verification tasks, over multiple dynamical models from the benchmark set utilised above.
Revised: In view of the placed emphasis on the usefulness of abstraction for formal verification goals, we employ our ReLU-based abstraction on safety verification tasks, over multiple dynamical models from the benchmark set utilised above.

Original: We compare our approach with a state-of-the-art, mature reachability verification software tool, Flow*, performing calculations of reachable states from a given set of initial states - this is known as flowpipe propagation [23]; our grid-based hybridisation reachability approach displays comparable results, and is thus deemed promising in view of recent literature that has started developing computational results and tools for such black-box dynamical models [21], [47], for instance to study their stability [29], their robustness [75], and to perform reachability analysis [14,42,43].
Revised: We compare our approach with a state-of-the-art, mature reachability verification software tool, Flow*, performing calculations of reachable states from a given set of initial states - this is known as flowpipe propagation [23]; our partition-based hybridisation reachability approach displays comparable results, and is thus deemed promising in view of recent literature that has started developing computational results and tools for such black-box dynamical models [21], [48], for instance to study their stability [29], their robustness [76], and to perform reachability analysis [14,42,43].

Original: The last problem is the focus of this work, and allows to perform safety verification, which is core to many theoretical results and practical problems in model-based engineering.
Revised: The last problem is the focus of this work, and allows to perform safety verification, which is core to many theoretical results and practical problems in model-based engineering.

Original: Notably, [14,42,43] do not calculate deterministic over-approximations of reachable states so are not suitable for use in the safety analysis described in this work.
Revised: Notably, [14,42,43] do not calculate deterministic over-approximations of reachable states so are not suitable for use in the safety analysis described in this work.

Original: We summarise our main contributions in the following three points:
Revised: We summarise our main contributions in the following three points:

Original: • we introduce the novel idea of leveraging neural networks to construct abstractions of continuous-time nonlinear dynamical systems, including those that do not exhibit local Lipschitz continuity; • we present a procedure for the synthesis of neural abstractions based on counterexampleguided inductive synthesis (CEGIS);and • we design a method to cast neural abstractions as models known as hybrid automata, and use existing tools to perform safety verification on them, to assert the safety of the original nonlinear dynamical models.
Revised: • we introduce the novel idea of leveraging neural networks to construct abstractions of continuous-time nonlinear dynamical systems, including those that do not exhibit local Lipschitz continuity; • we present a procedure for the synthesis of neural abstractions based on counterexampleguided inductive synthesis (CEGIS); • we design a method to cast neural abstractions as models known as hybrid automata, and use existing tools to perform safety verification on them, to assert the safety of the original nonlinear dynamical models.

Revised: We consider there to be no significant negative societal impact of our contributions.

Original:  Neural Abstraction of Dynamical Models
Revised:  Neural Abstractions of Dynamical Models

Original: We study the verification question of whether a continuous-time, autonomous dynamical model with uncertain disturbances is safe within a region of interest and a given time horizon, and with respect to a region of initial states and a region of bad states.
Revised: We study the verification question of whether a continuous-time, autonomous dynamical model with uncertain disturbances is safe within a region of interest and a given time horizon, and with respect to a region of initial states and a region of bad states.

Original: We define a dynamical model F in terms of an n -dimensional vector of real-valued variables x that take values over a compact set
Revised: We define a dynamical model F in terms of an n -dimensional vector of real-valued variables x that take values over a compact set

Original: X ⊂ R n which we call region of interest, a nonlinear function f : R n → R n , and a disturbance radius δ > 0 .
Revised: X ⊂ R n which we call region of interest, a nonlinear function f : R n → R n , and a disturbance radius δ > 0 .

Original: Its dynamics are given by the system of nonlinear ODEs
Revised: Its dynamics are given by the system of nonlinear ODEs

Original: [Equation]
Revised: [Equation]

Original: where ∥ · ∥ denotes a norm operator (unless explicitly stated, we assume all norms are given the same semantics across the paper).
Revised: where ∥ · ∥ denotes a norm operator (unless explicitly stated, we assume all norms are given the same semantics across the paper).

Original: A trajectory of F defined over time horizon T > 0 is a differentiable function ξ : [0 , T ] → R n such that, for all t ∈ [0 , T ] , it holds true that ξ ( t ) ∈ X and ˙ ξ ( t ) =
Revised: A trajectory of F defined over time horizon T > 0 is a differentiable function ξ : [0 , T ] → R n such that, for all t ∈ [0 , T ] , it holds true that ξ ( t ) ∈ X and ˙ ξ ( t ) =

Original: f ( ξ ( t ))
Revised: f ( ξ ( t ))

Original: + d for some ∥ d ∥ < δ .
Revised: + d for some ∥ d ∥ < δ .

Original: The symbol d can be interpreted as a non-deterministic disturbance, which at any time can take any possible value within the disturbance bound provided by δ .
Revised: The symbol d can be interpreted as a non-deterministic disturbance, which at any time can take any possible value within the disturbance bound provided by δ .

Original: Let the compact sets X 0 ⊂ X be a region of initial states and X B ⊂ X be a region of bad states. We say that the trajectory is safe with respect to X 0 and X B if ξ (0) ∈ X 0 and ξ ( t )
Revised: [Figure]

Original: ̸∈ X B for all

Original: [Figure]
Revised: [Figure]

Original: Original nonlinear system x ...
Revised: x ...

Original: ˙ x
Revised: ˙ x

Original: ReLU
Revised: ReLU

Original: Neural abstraction
Revised: Neural abstraction

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: Abstractionsynthesis
Revised: Abstractionsynthesis

Original: [Figure]
Revised: [Figure]

Original:  t ∈ [0 , T ] ; dually, we say that it is unsafe
Revised: Let the compact sets X 0 ⊂ X be a region of initial states and X B ⊂ X be a region of bad states. We say that the trajectory is safe with respect to X 0 and X B if ξ (0) ∈ X 0 and ξ ( t ) ̸∈ X B for all t ∈ [0 , T ] ; dually, we say that it is unsafe

Original: if ξ (0) ∈ X 0 and ξ ( t ) ∈
Revised: if ξ (0) ∈ X 0 and ξ ( t ) ∈

Original: X B for some t ∈ [0 , T ] .
Revised: X B for some t ∈ [0 , T ] .

Original: The safety verification question consists of determining whether all trajectories of F defined over a given time horizon are safe with respect to some given regions of initial and bad states.
Revised: The safety verification question consists of determining whether all trajectories of F defined over a given time horizon are safe with respect to some given regions of initial and bad states.

Original: If so, we say that the system is safe.
Revised: If so, we say that the system is safe.

Original: We tackle safety verification by abstractions, that is, we construct an abstract dynamical system that captures all behaviours the original system.
Revised: We tackle safety verification by abstractions, that is, we construct an abstract dynamical system that captures all behaviours the original system.

Original: In other words, if the original system is safe, then the abstraction is necessarily safe too [9].
Revised: In other words, if the original system is safe, then the abstraction is necessarily safe too [9].

Original: We then apply a verification procedure over the abstraction, allowing us to conclude that the original nonlinear model is safe.
Revised: We then apply a verification procedure over the abstraction, allowing us to conclude that the original nonlinear model is safe.

Original: We define our abstract dynamical system in terms of a feed-forward neural network with ReLU activation functions, and endowed with an error bound (cf. Fig.
Revised: We define our abstract dynamical system in terms of a feed-forward neural network with ReLU activation functions, and endowed with an error bound (cf. Fig.

Original: 1): this model can be seen as a neural ODE [21] with the addition of a bounded disturbance.
Revised: 1): this model can be seen as a neural ODE [21] with the addition of a bounded disturbance.

Original: Our feed-forward neural network consists of an n -dimensional input layer y 0 , k hidden layers y 1 , . . .
Revised: Our feed-forward neural network consists of an n -dimensional input layer y 0 , k hidden layers y 1 , . . .

Original: , y k with dimensions
Revised: , y k with dimensions

Original: h 1 , . .
Revised: h 1 , . .

Original: , h k respectively, and an n -dimensional output layer
Revised: , h k respectively, and an n -dimensional output layer

Original: y k +1 .
Revised: y k +1 .

Original: Each hidden or output layer with index i are respectively associated matrices of weights
Revised: Each hidden or output layer with index i are respectively associated matrices of weights

Original: W i ∈
Revised: W i ∈

Original: R h i × h
Revised: R h i × h

Original: i −and a vectors of biases b
Revised: i −and a vectors of biases b

Original: i ∈ R h i as we depict in Fig.
Revised: i ∈ R h i .

Original: Upon a valuation of the input layer, the value of every subsequent hidden layer is given by the following equation:
Revised: Upon a valuation of the input layer, the value of every subsequent hidden layer is given by the following equation:

Original: [Equation]
Revised: [Equation]

Original: Whereas many activation functions exist, we focus our study on ReLU activation functions, applying function max { x, 0 } to every element x ∈ R of its h
Revised: Whereas many activation functions exist, we focus our study on ReLU activation functions, applying function max { x, 0 } to every element x ∈ R of its h

Original: i -dimensional argument.
Revised: i -dimensional argument.

Original: We emphasise that each neuron within a given hidden layer induces a hyperplane in the corresponding vector space of that layer, resulting in two half-spaces: when the ReLU is enabled and when it is disabled.
Revised: We emphasise that each neuron within a given hidden layer induces a hyperplane in the corresponding vector space of that layer, resulting in two half-spaces: when the ReLU is enabled and when it is disabled.

Original: For the jth neuron in the ith layer, this hyperplane is given by
Revised: For the jth neuron in the ith layer, this hyperplane is given by

Original: [Equation]
Revised: [Equation]

Original: x ∈ Px ∈ Px ∈ Px
Revised: [Figure] [Equation] [Figure]

Original: [Equation]
Revised: [Equation]

Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: where W i,j is the jth row of the weight matrix W i , and b i,j is the jth element of the bias b i .
Revised: where W i,j is the jth row of the weight matrix W i , and b i,j is the jth element of the bias b i .

Original: Finally, the value of the output layer is given by the affine map
Revised: Finally, the value of the output layer is given by the affine map

Original: y k +

Revised: y k +

Original: =
Revised: =

Original: W k +1 x k
Revised: W k +1 x k

Original: + b k +1 .
Revised: + b k +1 .

Original: Altogether, the network results in a function N whose output is N ( x ) =
Revised: Altogether, the network results in a function N whose output is N ( x ) =

Original: y k +1 for every given input y 

Revised: y k +1 for every given input y

Original: = x .
Revised: = x .

Original: We represent a configuration C

Original: = ( c 1 , . . .

Original: , c k ) as a sequence of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . . .

Original: , c k ∈ { 0 , 1 } h k , where C represents whether the hidden neurons in the network are enabled (1) or disabled (0).

Original: Here, an enabled neuron corresponds to the positive half-space induced by the hyperplane in (3), and a disabled neurons corresponds to the negative half-space.

Original: It is clear that a configuration of neurons corresponds to a convex polyhedron P m in R n , as depicted in Figure 1, which will be bounded when taken with the intersection of the compact domain of interest X .

Original: The polyhedra obtained from all possible neuron configurations induce a partitioning of the domain X , with each polyhedron representing a partition of X .

Original: The choice of ReLU activation functions also ensures that the dynamics (vector fields) in each partition are affine.

Original: A consequence of this, and an important observation of our work is that a feed-forward ReLU neural

Original: ODE therefore induces a hybrid automaton.

Original: Hybrid automata are useful objects that model systems that contain both continuous and discrete dynamics [69].

Original: They consist of a collection of (discrete) modes, each with their own dynamics describing the dynamics of continuous states, and rules for transitioning amongst discrete modes.

Original: We denote a hybrid automaton as H and represent an example in Figure 2, which illustrates the key constituent components relevant for this work.

Original: Definition 1 (Neural Abstraction) .
Revised: Definition 1 (Neural Abstraction) .

Original: A feed-forward neural network N : R n → R n together with an error bound ϵ > 0 define a neural abstraction A for the dynamical system F given by function f and disturbance radius δ , over a region of interest X , if it holds true that
Revised: A feed-forward neural network N : R n → R n together with an error bound ϵ > 0 define a neural abstraction A for the dynamical system F given by function f and disturbance radius δ , over a region of interest X , if it holds true that

Original: [Equation]
Revised: [Equation]

Original: Then, the neural abstraction A consists of the following dynamical systems defined by a neural ODE with bounded disturbances:
Revised: Then, the neural abstraction A consists of the following dynamical systems defined by a neural ODE with bounded disturbances:

Original: [Equation]
Revised: [Equation]

Original: Theorem 1.
Revised: Theorem 1.

Original: If A is a neural abstraction for a dynamical system F over a region of interest X ⊂ R n , then every trajectory of F is also a trajectory of A .
Revised: If A is a neural abstraction for a dynamical system F over a region of interest X ⊂ R n , then every trajectory of F is also a trajectory of A .

Original: Proof.
Revised: Proof.

Original: Let ξ be a trajectory of F and T be the time horizon over which ξ is defined.
Revised: Let ξ be a trajectory of F and T be the time horizon over which ξ is defined.

Original: Let t ∈ [0 , T ] and denote x t = ξ ( t ) and ˙ x t = ˙
Revised: Let t ∈ [0 , T ] and denote x t = ξ ( t ) and ˙ x t = ˙

Original: ξ ( t ) .
Revised: ξ ( t ) .

Original: By definition of trajectory we have that (i) x t ∈ X
Revised: By definition of trajectory we have that (i) x t ∈ X

Original: and there exists d t s.t.
Revised: and there exists d t s.t.

Original: (ii) ∥
Revised: (ii) ∥

Original: d t ∥ ≤ δ and (iii) ˙ x t = f ( x t )+ d t .
Revised: d t ∥ ≤ δ and (iii) ˙ x t = f ( x t )+ d t .

Original: By (i) and Eq.
Revised: By (i) and Eq.

Original: 4 we have that ∥ f ( x t ) −N ( x t ) ∥ + δ ≤
Revised: 4 we have that ∥ f ( x t ) −N ( x t ) ∥ + δ ≤

Original: ϵ
Revised: ϵ

Original: Then, by (ii) we have that ∥ f ( x t ) − N ( x t ) ∥ + ∥
Revised: Then, by (ii) we have that ∥ f ( x t ) − N ( x t ) ∥ + ∥

Original: d t ∥ ≤ ϵ which, by triangle inequality, implies that ∥ f ( x t ) + d t − N ( x t ) ∥ ≤ ϵ .
Revised: d t ∥ ≤ ϵ which, by triangle inequality, implies that ∥ f ( x t ) + d t − N ( x t ) ∥ ≤ ϵ .

Original: We use (iii) and rewrite it into ∥ ˙ x t − N ( x t ) ∥ ≤ ϵ .
Revised: We use (iii) and rewrite it into ∥ ˙ x t − N ( x t ) ∥ ≤ ϵ .

Original: Finally, we define d ′ t = ˙
Revised: Finally, we define d ′ t = ˙

Original: x
Revised: x

Original: t − N ( x t ) .
Revised: t − N ( x t ) .

Original: As a result, we have that ∥ d ′ t ∥ ≤ ϵ and ˙ x t = N ( x t ) + d ′ t which, together with (i), show that ξ is a trajectory of A .
Revised: As a result, we have that ∥ d ′ t ∥ ≤ ϵ and ˙ x t = N ( x t ) + d ′ t which, together with (i), show that ξ is a trajectory of A .

Original: Corollary 1.
Revised: Corollary 1.

Original: With respect to every initial region X 0 ⊂ X , bad region X B ⊂ X , and time horizon, if
Revised: With respect to every initial region X 0 ⊂ X , bad region X B ⊂ X , and time horizon, if

Original: A is safe then F is safe.
Revised: A is safe then F is safe.

Original: Proof.
Revised: Proof.

Original: By Thm. 1, if there exists an unsafe trajectory of F then this is also an unsafe trajectory of A .
Revised: By Thm. 1, if there exists an unsafe trajectory of F then this is also an unsafe trajectory of A .

Original: The statement follows by contraposition.
Revised: The statement follows by contraposition.

Revised: Altogether, we define the neural abstraction of a non-linear dynamical system F as a neural ODE with additive disturbance A that approximates the dynamics while also accounting for the approximation error.

Original: Notably, we place no assumptions on the vector field f .
Revised: Notably, we place no assumptions on the vector field f .

Original: In particular, Thm. 1 does not require f to be Lipschitz continuous.
Revised: In particular, Thm. 1 does not require f to be Lipschitz continuous.

Original: This is because it relies on thestrong condition described by (4).
Revised: This is because the soundness of a neural abstraction relies on the condition described by (4), whose certification we offload to an SMT solver (see Sect. 3). Then, we cast the resulting neural abstraction to a hybrid automaton with affine dynamics and non-deterministic [Figure]

Original: We are not reliant on the Picard-Lindelof theorem to ensure uniqueness or existence of solutions asonce the abstraction is formed, the non-determinism introduced by the disturbance d ensures that solutions are not unique for a given initial condition.
Revised: disturbance (see Sect. 4), which does not rely on the Picard-Lindelof theorem to ensure uniqueness or existence of a solutions. We represent a configuration C = ( c 1 , . . . , c k ) as a sequence of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . . .

Revised: , c k ∈ { 0 , 1 } h k , where C represents whether the hidden neurons in the network are enabled (1) or disabled (0).

Revised: Here, an enabled neuron corresponds to the positive half-space induced by the hyperplane in (3), and a disabled neurons corresponds to the negative half-space.

Original: Formal Synthesis of Neural Abstractions
Revised: It is clear that a configuration of neurons corresponds to a convex polyhedron P m , which will be bounded when taken with the intersection of the compact domain of interest X . The polyhedra obtained from all possible neuron configurations induce a partitioning of the domain X , with each polyhedron representing a partition of X . The choice of ReLU activation functions also ensures that the dynamics (vector fields) in each partition are affine. A consequence of this, and an important observation of our work is that a feed-forward ReLU neural

Revised: ODE therefore induces a hybrid automaton.

Revised: Hybrid automata are useful objects that model systems that contain both continuous and discrete dynamics [44,70].

Revised: They consist of a collection of (discrete) modes, each with their own dynamics describing the dynamics of continuous states, and rules for transitioning amongst discrete modes.

Revised: We denote a hybrid automaton as H and represent an example in Figure 2, which illustrates the key constituent components relevant for this work.

Revised:  Formal Synthesis of Neural Abstractions

Original: The procedure presented leverages a counterexample-guided, inductive approach to synthesis, known as CEGIS.
Revised: The procedure presented leverages a counterexample-guided, inductive approach to synthesis, known as CEGIS.

Original: First introduced in [71] for program synthesis, CEGIS has found many uses ranging from synthesis of invariants, stability analysis or unbounded-time safety verification through the synthesis of barrier certificates [2,3,19,20,28,48,62,63].
Revised: First introduced in [72] for program synthesis, CEGIS has found many uses ranging from synthesis of invariants, stability analysis or unbounded-time safety verification through the synthesis of barrier certificates [2,3,19,20,28,49,63,64].

Original: CEGIS is an iterative procedure consisting of two opposing components: a numerical-based learner which seeks to learn a program or function that satisfies some conditions over a finite data set, and a formal certifier which seeks to certify the veracity of the learner’s solution.
Revised: CEGIS is an iterative procedure consisting of two opposing components: a numerical-based learner which seeks to learn a program or function that satisfies some conditions over a finite data set, and a formal certifier which seeks to certify the veracity of the learner’s solution.

Original: If the certifier determines this solution is invalid, it provides a counterexample - i.e., a point within the state space where the desired conditions are invalid.
Revised: If the certifier determines this solution is invalid, it provides a counterexample - i.e., a point within the state space where the desired conditions are invalid.

Original: As previously described, the learner in this procedure is a ReLU-based neural network; the certification role is performed by an SMT-solver.
Revised: As previously described, the learner in this procedure is a ReLU-based neural network; the certification role is performed by an SMT-solver.

Original: Several options exist for the selection of the SMT solver used, with the requirement that the solver should reason over quantifier-free nonlinear real arithmetic formulae.
Revised: Several options exist for the selection of the SMT solver used, with the requirement that the solver should reason over quantifier-free nonlinear real arithmetic formulae.

Original: The SMT-solver used in this work is dReal [41], which is advantageous in that it can be used to query satisfiability over non-polynomial formulae, including non-linear functions with transcendental terms.
Revised: The SMT-solver used in this work is dReal [41], which is advantageous in that it can be used to query satisfiability over non-polynomial formulae, including nonlinear functions with transcendental terms.

Original: We shall now consider each component of the CEGIS loop depicted in Figure 3 in turn.
Revised: We shall now consider each component of the CEGIS loop depicted in Figure 3 in turn.

Original: In Sect.
Revised: In Sect.

Original: we present the learning component and in Sect.
Revised: we present the learning component and in Sect.

Original: 3.2 we present the certification component used to certify the neural abstractions.[Figure] Safety Verification
Revised: 3.2 we present the certification component used to certify the neural abstractions.

Original: 3.1 Training of ReLU Network
Revised: 3.1 Training of ReLU Network

Original: As with any machine learning-based algorithm, learning neural abstractions hinges on the loss function used as part of the gradient descent scheme for optimising parameters.
Revised: As with any machine learning-based algorithm, learning neural abstractions hinges on the loss function used as part of the gradient descent scheme for optimising parameters.

Original: The task is that of a regression problem, so the choice of loss function to be minimised is simple, namely,
Revised: The task is that of a regression problem, so the choice of loss function to be minimised is simple, namely,

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: where ∥ · ∥ 2 represents the 2 − norm of its input, and S represents a finite set of data points that are sampled over X .
Revised: where ∥ · ∥ 2 represents the 2 − norm of its input, and S represents a finite set of data points that are sampled over X .

Original: In other words, the neural abstractions are synthesised using a scheme based on gradient descent, to find the parameters that minimise the mean square error over the sampled data.
Revised: In other words, the neural abstractions are synthesised using a scheme based on gradient descent, to find the parameters that minimise the mean square error over the sampled data.

Original: 3.2 Verification of the Error Bound of Neural Abstractions
Revised: 3.2 Verification of the Error Bound of Neural Abstractions

Original: As previously mentioned, certification of the accuracy of the neural abstractions is performed by dReal.
Revised: As previously mentioned, certification of the accuracy of the neural abstractions is performed by dReal.

Original: This certification step is described and performed as follows.
Revised: This certification step is described and performed as follows.

Original: The purpose of the certification is to check that at no point in the domain of interest X is the maximum error greater than some upper bound ϵ , as in the specification in equation (4).
Revised: The purpose of the certification is to check that at no point in the domain of interest X is the maximum error greater than some upper bound ϵ , as in the specification in equation (4).

Original: Therefore, the certifier is provided with the negation of the specification, namely
Revised: Therefore, the certifier is provided with the negation of the specification, namely

Original: [Equation]
Revised: [Equation]

Original: The certifier seeks an assignment cex of the variable x such that ϕ is true , namely that the specified bound ϵ is violated.
Revised: The certifier seeks an assignment cex of the variable x such that ϕ is true , namely that the specified bound ϵ is violated.

Original: If this search is successful, then the network N has not achieved the specified accuracy over X , and is thus not a valid neural abstraction.
Revised: If this search is successful, then the network N has not achieved the specified accuracy over X , and is thus not a valid neural abstraction.

Original: The corresponding assignment cex forms the counterexample that is provided back to the learner (the machine learning procedure from the previous subsection).
Revised: The corresponding assignment cex forms the counterexample that is provided back to the learner (the machine learning procedure from the previous subsection).

Original: Alternatively, if no assignment is found, then the specification in Eq.
Revised: Alternatively, if no assignment is found, then the specification in Eq.

Original: (4) is valid and the synthesis is soundly complete.
Revised: (4) is valid and the synthesis is soundly complete.

Original: 3.3 Summary of Synthesis Procedure for Neural Abstractions
Revised: 3.3 Summary of Synthesis Procedure for Neural Abstractions

Original: The procedure we use to synthesise neural abstractions is summarised as follows.
Revised: The procedure we use to synthesise neural abstractions is summarised as follows.

Original: The inputs to the procedure are the dynamical model to be abstracted f , the domain of interest X over which the abstraction is to be generated, and the parameters for the learning.
Revised: The inputs to the procedure are the dynamical model to be abstracted f , the domain of interest X over which the abstraction is to be generated, and the parameters for the learning.

Original: In addition to theusual learning rate, these include the stopping criterion for the learning procedure.
Revised: In addition to the learning rate, these include the stopping criterion for the learning procedure.

Original: For the latter, there are two possible options:either a target error which all data points must satisfy or a bound on the value of the loss function.
Revised: For the latter, there are two possible options: a target error which all data points must satisfy, or a bound on the value of the loss function.

Original: We sample a set of data points over X to construct a set of training data S .
Revised: We sample a set of data points over X to construct a set of training data S .

Original: Then, we train a feed-forward neural network N which seeks to regress the function f ( x ) by minimising the 2-norm error in Eq.
Revised: Then, we train a feed-forward neural network N which seeks to minimise the 2-norm error in Eq.

Original: The learning procedure terminates depending on the stopping condition.
Revised: The learning procedure terminates depending on the stopping condition.

Original: If a target error is provided, this is when all points in the data set S satisfy the specification given by ϕ and a target error.
Revised: If a target error is provided, this is when all points in the data set S satisfy the specification given by ϕ and a target error.

Original: If an alternative loss-based stopping criterion is provided then the learning terminates when this is met.
Revised: If an alternative loss-based stopping criterion is provided then the learning terminates when this is met.

Original: If the stopping criterion is not a target error, then an error bound on the approximation is estimated using the maximum approximation error over the data set S for use in certification.
Revised: If the stopping criterion is not a target error, then an error bound on the approximation is estimated using the maximum approximation error over the data set S for use in certification.

Original: After learning, the network N ( x ) is translated to symbolic form and passed to the certification block, which checks for the specification characterised by ϕ as mentioned.
Revised: After learning, the network N ( x ) is translated to symbolic form and passed to the certification block, which checks for the specification characterised by ϕ as mentioned.

Original: The certifier returns that either ϕ is false and thus no counterexample is generated, or that ϕ is true and a cex supporting this.
Revised: The certifier returns that either ϕ is false and thus no counterexample is generated, or that ϕ is true and a cex supporting this.

Original: In practice, such a generated counterexample is augmented by sampling for additional points nearby in order to maximise the efficiency of the CEGIS loop: this new set of counterexamples is then returned to the learning procedure.
Revised: In practice, such a generated counterexample is augmented by sampling for additional points nearby in order to maximise the efficiency of the CEGIS loop: this new set of counterexamples is then returned to the learning procedure.

Original: A successful verification processN allows for the full abstraction to be constructed using the achieved error ϵ  .
Revised: A successful verification process allows for the full abstraction to be constructed using the achieved error ϵ and neural network N ( x ) .

Original: CEGIS has been shown to perform well and terminate successfully across a wide variety of problems.
Revised: CEGIS has been shown to perform well and terminate successfully across a wide variety of problems.

Original: We demonstrate the robustness of our procedure Appendix B.
Revised: We demonstrate the robustness of our procedure Appendix B.

Original:  Safety Verification of Neural Abstractions
Revised:  Safety Verification of Neural Abstractions

Original: Neural abstractions are dynamical systems expressed in terms of neural ODEs with additive disturbances (see Eq. 5).
Revised: Neural abstractions are dynamical systems expressed in terms of neural ODEs with additive disturbances (see Eq. 5).

Original: Corollary 1 ensures that concluding that a neural abstraction is safe suffices to assert that the original dynamical model is also safe.
Revised: Corollary 1 ensures that concluding that a neural abstraction is safe suffices to assert that the original dynamical model is also safe.

Original: As a consequence, once a neural ODE is formally proven to be an abstraction for the original system, our method enables a generic procedure for the safety verification of neural ODEs with disturbances to be a valid safety verification procedure for the corresponding dynamical model.
Revised: Consequently, once a neural ODE is formally proven to be an abstraction for the original system, our method enables a generic procedure for the safety verification of neural ODEs with disturbances to be a valid safety verification procedure for the corresponding dynamical model.

Original: While formally reasoning about the concrete model in relation to the neural abstraction is delegated to our synthesis procedure (Sect. 3), the safety verification procedure needs only to reason about the dynamics of the neural ODE with disturbance.
Revised: While formally reasoning about the original model in relation to the neural abstraction is delegated to our synthesis procedure (Sect. 3), the safety verification procedure needs only to reason about the dynamics of the neural abstraction.

Original: Recent safety analysis approaches for dynamical systems controlled by neural networks solve a similar problem [12,37,45,46,70,74,76,77], yet with a subtle difference: neural network controllers take control actions at discrete points in time.
Revised: Recent safety analysis approaches for dynamical systems controlled by neural networks solve a similar problem [12,37,46,47,71,75,77,78], yet with a subtle difference: neural network controllers take control actions at discrete points in time.

Original: By contrast, neural ODEs characterise the dynamics over continuous time horizons.
Revised: By contrast, neural ODEs characterise the dynamics over continuous time horizons.

Original: Approaches for the verification of neural ODEs have been only recently introduced [42,43], however they are non-deterministic tools as they only provide a probabilistic bound on whether the generated flowpipes over-approximate reach sets.
Revised: Approaches for the verification of neural ODEs have been only recently introduced [42,43], however they are non-deterministic tools as they only provide a probabilistic bound on whether the generated flowpipes over-approximate reach sets.

Original: For the purpose ofverifying neural abstractions, we design aa procedure to construct aconcrete hybrid automaton from it, and rely on an existing tool for the safety verfication of hybrid automata: SpaceEx [40].
Revised: For the verification of neural abstractions, we design a procedure to construct a hybrid automaton from it, and rely on an existing tool for the safety verfication of hybrid automata: SpaceEx [40].

Original: SpaceEx performs computation of over-approximations of reachable sets for hybrid automata with affine dynamics and additive non-determinism (disturbances).
Revised: SpaceEx performs computation of over-approximations of reachable sets for hybrid automata with affine dynamics and additive non-determinism (disturbances).

Original: In this section we describe how we construct a hybrid automaton from a neural abstraction: by doing so, the neural abstraction is tailored to be compatible with SpaceEx.
Revised: We now describe how we construct a hybrid automaton from a neural abstraction: by doing so, the neural abstraction is tailored to be compatible with SpaceEx.

Original: 4.1 Casting Neural Abstractions as Hybrid Automata
Revised: 4.1 Casting Neural Abstractions as Hybrid Automata

Original: We begin with the observation that a neural ODE with ReLU activation functions induces a hybrid automaton (cf.
Revised: We begin with the observation that a neural ODE with ReLU activation functions induces a hybrid automaton (cf.

Original: Fig. 2), where every mode is determined by a configuration of the hidden neurons (active or inactive), and each of these configurations induces a system of affine ODEs.
Revised: Fig. 2), where every mode is determined by a configuration of the hidden neurons (active or inactive), and each of these configurations induces a system of affine ODEs.

Original: We seek to automatically generate such hybrid automaton that is induced by the neural abstraction.
Revised: We seek to automatically generate such hybrid automaton that is induced by the neural abstraction.

Original: A hybrid automaton H consists of a finite number of locations (or modes).
Revised: A hybrid automaton H consists of a finite number of locations (or modes).

Original: Each mode is associated with a corresponding partition of the state space, and with dynamics described by a vector field.
Revised: Each mode is associated with a corresponding partition of the state space, and with dynamics described by a vector field.

Original: Transitions represent allowed changes in the discrete location from one mode to another.
Revised: Transitions represent allowed changes in the discrete location from one mode to another.

Original: Notably, for the hybrid automata in this work the state remains in a given mode until the dynamics leave the corresponding partition, whereby the discrete state is reset to whichever mode corresponds to the new partition that the continuous state enters in.
Revised: Notably, for the hybrid automata in this work the state remains in a given mode until the dynamics leave the corresponding partition, whereby the discrete state is reset to whichever mode corresponds to the new partition that the continuous state enters in.

Original: Next, we describe the procedures to determine each of these constituent components, in order to construct the hybrid automaton that corresponds to a neural abstraction.
Revised: Next, we describe the procedures to determine each of these constituent components, in order to construct the hybrid automaton that corresponds to a neural abstraction.

Original: Modes A mode corresponds to a configuration of neurons of the neural network.
Revised: Modes A mode corresponds to a configuration of neurons of the neural network.

Original: We represent a configuration C
Revised: We represent a configuration C

Original: = ( c 1 , . . .
Revised: = ( c 1 , . . .

Original: , c k ) as a sequence of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . . .
Revised: , c k ) as a sequence of Boolean vectors c 1 ∈ { 0 , 1 } h 1 , . . .

Original: , c k ∈ { 0 , 1 } h k , where k denotes the number of hidden layers and h 1 , . . .
Revised: , c k ∈ { 0 , 1 } h k , where k denotes the number of hidden layers and h 1 , . . .

Original: , h k denote the number neurons in each of them (see Sect. 2).
Revised: , h k denote the number neurons in each of them (see Sect. 2).

Original: We restrict the state space of the mode to a region X C ⊆ X , which denotes the maximal set of states that enables configuration C .
Revised: We restrict the state space of the mode to a region X C ⊆ X , which denotes the maximal set of states that enables configuration C .

Original: This is defined as follows:
Revised: This is defined as follows:

Original: [Equation]
Revised: [Equation]

Original: where the diag operator denotes the square diagonal matrix whose coefficients are those of its argument.
Revised: where the diag operator denotes the square diagonal matrix whose coefficients are those of its argument.

Original: It is clear that a given configuration C is active if and only if the corresponding set X C , which is in fact a convex polyhedron in R n , is nonempty. Checking if a polyhedron is nonempty consists of verifying that the linear program (LP) constructed from the polyhedron is feasible.
Revised: It is clear that a given configuration C is active if and only if the corresponding set X C , which is in fact a convex polyhedron in R n , is nonempty; this consists of verifying that the linear program (LP) constructed from the polyhedron is feasible.

Original: Finding all modes of the hybrid automaton therefore consists of solving 2 H linear programs, where H is the total number of neurons in the network.
Revised: Finding all modes of the hybrid automaton therefore consists of solving 2 H linear programs, where H is the total number of neurons in the network.

Original: However, this exponential scaling with the number of neurons is limiting in terms of network size.
Revised: However, this exponential scaling with the number of neurons is limiting in terms of network size.

Original: Therefore, we propose an approach that works very well in practice to determine all valid neuron configurations.
Revised: Therefore, we propose an approach that works very well in practice to determine all valid neuron configurations.

Original: Tree search / path enumeration to characterise the Modes
Revised: Tree search / path enumeration to characterise the Modes

Original: The approach relies on the observation that within a bounded polyhedron P , a given neuron has two modes  only if the induced hyperplane intersects P .
Revised: The approach relies on the observation that within a bounded polyhedron P , a given neuron has two modes ( ReLU enabled or disabled) only if the induced hyperplane intersects P .

Original: If it does not, only one of the two possible half-spaces contributes to any possible active configuration, and this neuron  can be fixed.
Revised: If it does not, only one of the two possible half-spaces contributes to any possible active configuration, and the other neuron mode can be disregarded.

Original: Therefore, this approach involves iterating through each neuron in turn and constructing two LPs - one for each halfspace intersected with the domain of interest X .
Revised: Therefore, this approach involves iterating through each neuron in turn and constructing two LPsone for each halfspace intersected with the domain of interest X .

Original: If only one LP is valid, we can fix this neuron to this mode, i.e., from this point onward only consider the intersection with the halfspace corresponding to the feasible LP, andand construct a new polyhedron fromconstructed from the intersection of X and the feasible half-space.
Revised: If only one LP is valid, we can fix the neuron to this mode, i.e., from this point onward only consider the intersection with the halfspace corresponding to the feasible LP, and construct a new polyhedron from the intersection of X and the feasible half-space.

Original: If both LPs are valid, then we add it to a first-in first-out queue of non-fully explored neurons.
Revised: If both LPs are valid, then we add it to a last-in first-out queue of non-fully explored neurons.

Original: Next, we choose one of the half-spaces, take the intersection with the current polyhedron and continue.
Revised: Next, we choose one of the half-spaces, take the intersection with the current polyhedron and continue.

Original: Once all neurons have been iterated through, we have an enabled configuration.
Revised: Once all neurons have been iterated through, we have an enabled configuration.

Original: In order to obtain another configuration, we take a neuron from the queue of non-fully explored neurons and choose the opposite half-space to before, then continue iterating through the successive neurons.
Revised: In order to obtain another configuration, we take a neuron from the queue of non-fully explored neurons and choose the opposite half-space to before, then continue iterating through the successive neurons.

Original: We must re-compute both LPs for any previous ‘fixed‘ neurons that succeed the non-fully explored neuron in the configuration.
Revised: We must re-compute both LPs for any previous ‘fixed‘ neurons that succeed the non-fully explored neuron in the configuration.

Original: Once this queue is empty and the final configuration is obtained then the procedure terminates with all valid configurations found.
Revised: Once this queue is empty and the final configuration is obtained then the procedure terminates with all valid configurations found.

Original: In short, we consider the neurons of the network as a binary tree, with the branches representing the enabled and disabled state of this neuron.
Revised: In short, we consider the neurons of the network as a binary tree, with the branches representing the enabled and disabled state of this neuron.

Original: We walk through this tree by intersecting with the corresponding half-spaces.
Revised: We walk through this tree by intersecting with the corresponding half-spaces.

Original: Upon reaching an end node, we store this configuration (branches taken) and revert back to the most recent unexplored branch and continue.
Revised: Upon reaching an end node, we store this configuration (branches taken) and revert back to the most recent unexplored branch and continue.

Original: We include a more detailed description of this algorithm in Appendix B.
Revised: We include a more detailed description of this algorithm in Appendix B.

Original: This approach is inspired by that presented in [16], which similarly enumerates through the path of neurons using sets to determine the output range of a network.
Revised: This approach is inspired by that presented in [16], which similarly enumerates through the path of neurons using sets to determine the output range of a network.

Original: Partitions For each mode, the associated invariant is defined by the affine conditions that construct the set X C , as described in equation (8).
Revised: Partitions For each mode in the automaton, the associated partition is defined by the affine conditions that construct the set X C , as described in equation (8).

Original: In other words, for a given mode m corresponding to a configuration C , P m = X C .
Revised: In other words, for a given mode m corresponding to a configuration C , P m = X C .

Original: Dynamics The dynamics of each mode can be seen itself as a dynamical system with bounded disturbance:
Revised: Dynamics The dynamics of each mode can be seen itself as a dynamical system with bounded disturbance:

Original: [Equation]
Revised: [Equation]

Original: The matrix A C ∈ R n × n and the vector of drifts b C ∈ R n determine the linear ODE of the mode, whereas ϵ > 0 is the error bound derived from the neural abstraction.
Revised: The matrix A C ∈ R n × n and the vector of drifts b C ∈ R n determine the linear ODE of the mode, whereas ϵ > 0 is the error bound derived from the neural abstraction.

Original: The coefficients of the system are given by the weights and biases of the neural network as follows:
Revised: The coefficients of the system are given by the weights and biases of the neural network as follows:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Transitions A transition exists between any two given modes m, m ′ if and only if the two polyhedra that define their partitions share a facet and the dynamics pass through at some point along the facet (this can be checked by considering the inner product between the dynamics and the corresponding normal vector to the facet).
Revised: Transitions A transition exists between any two given modes m, m ′ if and only if the two polyhedra that define their partitions share a facet and the dynamics pass through at some point along the facet (this can be checked by considering the inner product between the dynamics and the corresponding normal vector to the facet).

Original: In practice, we take a faster but more conservative approach by considering that a transition exists when any two partitions share a vertex.
Revised: In practice, we take a faster but more conservative approach by considering that a transition exists when any two partitions share a vertex.

Original:  Experimental Results 5.1 Safety Verification using Neural Abstractions
Revised:  Experimental Results 5.1 Safety Verification using Neural Abstractions

Original: We benchmark the results obtained by the safety verification algorithm proposed in Sectionagainst Flow* [23] (available under GPL), which is a mature tool for computing reachable regions of hybrid automata.
Revised: We benchmark the results obtained by the safety verification algorithm proposed in Section 4 against Flow* [23] (available under GPL), which is a mature tool for computing reachable regions of hybrid automata.

Original: It relies on computing flowpipes, i.e., sets of reachable states across time, which are propagated from a given set of initial states.
Revised: It relies on computing flowpipes, i.e., sets of reachable states across time, which are propagated from a given set of initial states.

Original: Flowpipes are generated from Taylor series approximations of the model’s vector field in (1), over discrete time steps.
Revised: The flowpipes are generated from Taylor series approximations of the model’s vector field in (1), over discrete time steps.

Original: Crucially, the use of a higher-order Taylor series, or of smaller time steps, leads to more precise computation of reachable sets.
Revised: Crucially, the use of a higher-order Taylor series, or of smaller time steps, leads to more precise computation of reachable sets.

Original: Since Flow* (like SpaceEx) is able to calculate over-approximations of flowpipes, it is suitable for use in safety verification, and is a state-of-the-art tool for verifying safety of nonlinear models.
Revised: Since Flow* (like SpaceEx) is able to calculate over-approximations of flowpipes, it is suitable for use in safety verification, and is a state-of-the-art tool for verifying safety of nonlinear models.

Original: Making a fair comparison around metrics for accuracy between Flow* and SpaceEx is challenging, as they represent flowpipes differently [26].
Revised: Making a fair comparison around metrics for accuracy between Flow* and SpaceEx is challenging, as they represent flowpipes differently [26].

Original: We therefore ask them to perform safety verification for a given set of initial and bad states, on a collection of nonlinear models.
Revised: We therefore ask them to perform safety verification for a given set of initial and bad states, on a collection of nonlinear models.

Original: These models, and their parameters, are detailed in Appendix A. As described in Section 2, the task of safety verification consists of ensuring the no trajectory starting within the set of initial states enters the set of bad states, within a given time horizon.
Revised: These models, and their parameters, are detailed in Appendix A. As described in Section 2, the task of safety verification consists of ensuring that no trajectory starting within the set of initial states enters the set of bad states, within a given time horizon.

Original: Our setup is as follows.
Revised: Our setup is as follows.

Original: Firstly, for a given benchmark model we define a finite time horizon T , a region of initial states X 0 and a region of bad states X B .
Revised: Firstly, for a given benchmark model we define a finite time horizon T , a region of initial states X 0 and a region of bad states X B .

Original: Then, we run flowpipe computations with Flow* using high-order Taylor models.
Revised: Then, we run flowpipe computations with Flow* using high-order Taylor models.

Original: Similarly we run the procedure described in Section 3.3, and construct a hybrid automaton as described in section 4 to perform flowpipe computationsusing SpaceEx (available under GPLv3).
Revised: Similarly we run the procedure described in Section 3.3, and construct a hybrid automaton as described in section 4 to perform flowpipe computations

Original: We present the results of these in Table 1.

Original: In the table, we show the Taylor model (TM) and time-step used within Flow*, as well as the structure of the neural

Original: Model
Revised: Model

Original: T
Revised: [Table]

Original: Flow*
Revised: Flow*

Original: Neural Abstractions
Revised: Neural Abstractions

Original: TM δ
Revised: TM δ

Original: Safety Verif.
Revised: Safety Verif.

Original: t
Revised: t

Original: W
Revised: W

Revised: M

Original: Safety Verif.
Revised: Safety Verif.

Original: t
Revised: t

Original: [Table]
Revised: [Table]

Original:  network used for neural abstractions.
Revised: using SpaceEx (available under GPLv3). We present the results of these in Table 1. In the table, we show the Taylor model (TM) and time-step used within Flow*, as well as the structure of the neural network used for neural abstractions.

Original: For example, we denote a network with two hidden layers with h 1 neurons in the first layer and h 2 neurons in the second hidden layer as [ h 1 , h 2 ].
Revised: For example, we denote a network with two hidden layers with h 1 neurons in the first layer and h 2 neurons in the second hidden layer as [ h 1 , h 2 ].

Original: Notably, Flow* is unable to handle the two models that do not exhibit local Lipschitz continuity.
Revised: Notably, Flow* is unable to handle the two models that do not exhibit local Lipschitz continuity.

Original: This makes sense, as it constructs Taylor models the incorporate the derivatives of the dynamics: unbounded derivatives will expectedly cause issues for this approach.
Revised: This makes sense, as it constructs Taylor models that incorporate the derivatives of the dynamics: unbounded derivatives will expectedly cause issues for this approach.

Original: Meanwhile, Ariadne [17] a is further tool for over-approximating flowpipes of nonlinear systems.
Revised: Meanwhile, Ariadne [17] a is further tool for over-approximating flowpipes of nonlinear systems.

Original: While Ariadne does not explicitly require Lipschitz continuity, it is also unable to perform analysis on tools with nth root terms at zero due to numerical instability.
Revised: While Ariadne does not explicitly require Lipschitz continuity, it is also unable to perform analysis on tools with nth root terms at zero due to numerical instability.

Original: However, our abstraction method works directly on the dynamics themselves, rather than their derivatives, in order to construct a much simpler model, amenable to be verified.
Revised: However, our abstraction method works directly on the dynamics themselves, rather than their derivatives, in order to construct a much simpler model, amenable to be verified.

Original: Since we quantify how different this simpler model is through the approximation error, we are able to formally perform safety verification on such challenging models.
Revised: Since we quantify how different this simpler model is through the approximation error, we are able to formally perform safety verification on such challenging models.

Original: We also outperform Flow* for a Lipschitz-continuous model ( Exponential in Table 1), where the composition of functions that make up the model’s dynamics result in high errors in Flow* before the flowpipe can be calculated across the given time horizon.
Revised: We also outperform Flow* for a Lipschitz-continuous model ( Exponential in Table 1), where the composition of functions that make up the model’s dynamics result in high errors in Flow* before the flowpipe can be calculated across the given time horizon.

Original: It is worth highlighting that despite relying on affine approximations (i.e., 1 st order models), neural abstractions are able to compete with, and even outperform, methods that use much higher order functions (10 th and 30 th in the benchmarks) for approximation.
Revised: It is worth highlighting that despite relying on affine approximations (i.e., 1 st order models), neural abstractions are able to compete with, and even outperform, methods that use much higher order functions (10 th and 30 th in the benchmarks) for approximation.

Original: 5.2 Limitations
Revised: 5.2 Limitations

Original: Our approach is limited in terms of scalability, both with regards to the dimension of the models and the size of the neural networks.
Revised: Our approach is limited in terms of scalability, both with regards to the dimension of the models and the size of the neural networks.

Original: The causes of this limitation are twofold: firstly we are bound by the computational complexity of SMT-solving - known to be at least NP-complete - which can struggle with complex formaulae with many variables.
Revised: The causes of this limitation are twofold: firstly we are bound by the computational complexity of SMT-solving - known to be NP-hard - which can struggle with complex formaulae with many variables.

Original: Secondly, we are limited in terms of the complexity of our abstractions by SpaceEx.
Revised: Secondly, we are limited in terms of the complexity of our abstractions by SpaceEx.

Original: While SpaceEx is a highly efficient implementation of LGG [54], the presence of a large number of modes poses a significant challenge.
Revised: While SpaceEx is a highly efficient implementation of LGG [55], the presence of a large number of modes poses a significant challenge.

Original: It future work, we hope to investigate the balance between abstraction complexity and accuracy.
Revised: It future work, we hope to investigate the balance between abstraction complexity and accuracy.

Original:  Conclusions
Revised:  Conclusion

Original: We have proposed a novel abstraction technique for nonlinear dynamical models using ReLU -based neural networks: neural abstractions .
Revised: We have proposed a novel abstraction technique for nonlinear dynamical models using ReLU -based neural networks: neural abstractions .

Original: These neural structures simplify nonlinear dynamical models by abstracting them toa piecewise affine models, which can be interpreted as hybrid systems consisting of modes with affine dynamics.
Revised: These neural structures simplify nonlinear dynamical models by abstracting them to piecewise affine models, which can be interpreted as hybrid automata consisting of modes with affine dynamics.

Original: By casting a neural ode as a hybrid automaton and constructing an abstraction by bounding the approximation error, we can conduct safety verification.
Revised: By casting a neural ode as a hybrid automaton and constructing an abstraction by bounding the approximation error, we can conduct safety verification.

Original: Empirically we show that for safety verification our abstractions, despite consisting of only affine dynamics, are competitive with state-of-art methods (and a corresponding mature software tool) that depend on higher-order Taylor models of the underlying dynamics, and that it is able to perform safety verification on models that do not exhibit  Lipschitz continuity.
Revised: Empirically we show that for safety verification our abstractions, despite consisting of only affine dynamics, are competitive with state-of-art methods (and a corresponding mature software tool) that depend on higher-order Taylor models of the underlying dynamics, and that they are able to perform safety verification on models that do not exhibit local Lipschitz continuity.

Original: Checklist
Revised: Checklist

Original: For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?
Revised: For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?

Original: [Yes] (b) Did you describe the limitations of your work?
Revised: [Yes] (b) Did you describe the limitations of your work?

Original: [Yes] Please see section 5.
Revised: [Yes] Please see section 5.

Original: (c) Did you discuss any potential negative societal impacts of your work?
Revised: (c) Did you discuss any potential negative societal impacts of your work?

Original: [TODO] (d) Have you read the ethics review guidelines and ensured that your paper conforms to them?
Revised: [Yes] See(d) Have you read the ethics review guidelines and ensured that your paper conforms to them?

Original: [TODO]
Revised: [Yes] 2.

Original: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?
Revised: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes] See(b)
Revised: [Yes] See(b)

Original: Did you include complete proofs of all theoretical results?
Revised: Did you include complete proofs of all theoretical results?

Original: [Yes] See3.
Revised: [Yes] See3.

Original: If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?
Revised: If you ran experiments... (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?

Original: [Yes] The code and data will be part of the supplementary material.
Revised: [Yes] The code and data will be part of the supplementary material.

Original: Reproducing the results will be possible from this but is not the intention of the authors.
Revised: Reproducing the results will be possible from this but is not the intention of the authors.

Original: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?
Revised: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how they were chosen)?

Original: [Yes] The hyper-parameters for the learning procedure are chosen heuristically, but we include the relevant configuration files in the supplementary material.
Revised: [Yes] The hyper-parameters for the learning procedure are chosen heuristically, but we include the relevant configuration files in the supplementary material.

Original: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
Revised: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?

Original: [N/A] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?
Revised: [N/A] (d) Did you include the total amount of compute and the type of resources used (e.g., type of GPUs, internal cluster, or cloud provider)?

Original: [Yes] See Table 1. 4.
Revised: [Yes] See Table 1. 4.

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?
Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators?

Original: [Yes] We have cited all used tools.
Revised: [Yes] We have cited all used tools.

Original: (b) Did you mention the license of the assets?
Revised: (b) Did you mention the license of the assets?

Original: [Yes] See section(c)
Revised: [Yes] See section(c)

Original: Did you include any new assets either in the supplemental material or as a URL?
Revised: Did you include any new assets either in the supplemental material or as a URL?

Original: [Yes] The code will be included in the supplementary material (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?
Revised: [Yes] The code will be included in the supplementary material. (d) Did you discuss whether and how consent was obtained from people whose data you’re using/curating?

Original: [N/A] (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?
Revised: [N/A] (e) Did you discuss whether the data you are using/curating contains personally identifiable information or offensive content?

Original: [N/A] 5.
Revised: [N/A] 5.

Original: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?
Revised: If you used crowdsourcing or conducted research with human subjects... (a) Did you include the full text of instructions given to participants and screenshots, if applicable?

Original: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?
Revised: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable?

Original: [N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?
Revised: [N/A] (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation?

Original: [N/A]
Revised: [N/A]

Original:  Appendix A: Benchmarks of NonLinear Dynamical Systems
Revised:  Appendix A: Benchmarks of NonLinear Dynamical Systems

Original: For each dynamical model, we report the vector field f : R n → R n and the spatial domain X over which the abstraction is performed and which, unless otherwise stated, is taken to be the hyper-rectangle [ − 1 , 1] n .
Revised: For each dynamical model, we report the vector field f : R n → R n and the spatial domain X over which the abstraction is performed and which, unless otherwise stated, is taken to be the hyper-rectangle [ − 1 , 1] n .

Original: Jet Engine [1]
Revised: Jet Engine [1]

Original: [Equation]
Revised: [Equation]

Original: Steam Governor [1]
Revised: Steam Governor [1]

Original: [Equation]
Revised: [Equation]

Original: [Table] [Equation] [Equation] [Table]
Revised: Exponential

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: Non-Lipschitz Vector Field 1 (NL1)

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: Non-Lipschitz Vector Field 2 (NL2)

Original: [Equation]
Revised: [Equation]