Search papers, labs, and topics across Lattice.
This paper investigates the exact verification of ReLU networks under an adversarial smoothed model where network parameters are perturbed by Gaussian noise. The authors prove that, assuming $\mathrm{NP}\not\subseteq\mathrm{BPP}$, no sound and complete verifier can achieve polynomial expected running time across network size, bit complexity, and inverse noise level for all instances, even at a fixed noise level. Their findings reveal that parameter nondegeneracy does not guarantee a universal smoothed-polynomial verification framework, highlighting significant limitations in current verification approaches for neural networks.
Exact verification of ReLU networks remains intractable even with random parameter noise, challenging assumptions about the feasibility of polynomial-time verification methods.
We study exact verification of ReLU networks in an adversarial smoothed model. Every network weight and bias is independently perturbed by Gaussian noise, clipped to $[-2,2]$, and rounded to the exact dyadic grid determined by the input bit complexity. We show that, under the standard assumption $\mathrm{NP}\not\subseteq\mathrm{BPP}$, there is no sound and complete verifier whose expected running time is polynomial in network size, bit complexity, and inverse noise level for every base instance. The conclusion already holds at the fixed noise level $\sigma_\star=2^{-11}$ for one-hidden-layer networks over a unit box, with hidden fan-in at most three and base coefficients in $[-1,1]$. The proof combines an exact gap embedding with a quantitative robustness argument. For every E3SAT formula $\Phi$ with $m$ clauses, a four-ReLU-per-clause construction satisfies $\max_{x\in[0,1]^n} g_\Phi(x)=(m-\operatorname{unsat}(\Phi))/3$, and coordinatewise threshold rounding never decreases the objective. A weighted parameter-sensitivity inequality and Gaussian concentration then show that a verification gap linear in $m$ survives the aggregate perturbation of all coefficients with probability at least $1-e^{-m/8}$. The proof includes clipping, exact dyadic rounding, output-layer perturbations, polynomial-bit sampling of the rounded Gaussian law, and the conversion from expected smoothed running time to a BPP algorithm. Computational checks test the exact identity and illustrate the different scaling of extensive and constant gaps; they are diagnostics rather than evidence for the complexity theorem. The result concerns worst-case base networks in the stated absolute-noise model, but it shows that parameter nondegeneracy alone does not yield a universal smoothed-polynomial guarantee for exact verification.
