🤖 machine learning

Formal verification of tree-based machine learning models for lateral spreading

This paper introduces a formal verification framework using Satisfiability Modulo Theories (SMT) solvers to rigorously check and enforce physical consistency in tree-based machine learning models for geotechnical hazard prediction, revealing a persistent trade-off between prediction accuracy and adherence to safety specifications while demonstrating that post-hoc explanations cannot substitute for exhaustive formal guarantees.

Original authors: Krishna Kumar

Published 2026-03-19

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Krishna Kumar

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are hiring a brilliant but slightly reckless weather forecaster to predict when a flood will happen. This forecaster has studied thousands of past floods and is incredibly good at guessing the right answer most of the time. In fact, they get it right 82% of the time!

But here's the catch: sometimes, when the conditions are weird or rare (like a very deep underground water table), this forecaster starts making bizarre predictions. They might say, "Hey, even though the ground is soaked deep underground, there's zero chance of a flood," or conversely, "Even though the shaking is weak, a massive flood is coming!"

In the real world, geotechnical engineers need to know if their "forecaster" (a Machine Learning model) will ever make these dangerous, physics-breaking mistakes. The problem is that traditional ways of checking the model are like spot-checking a few random days. You might miss the one weird day where the model goes crazy.

This paper introduces a new, super-powerful way to check the model: Formal Verification.

The Analogy: The "Magic Rulebook" vs. The "Spot Check"

Think of the Machine Learning model as a black box robot that predicts lateral spreading (when the ground slides sideways during an earthquake).

The Old Way (Spot Checks & Explanations):
- Testing: You throw 1,000 random scenarios at the robot. It gets 999 right. You say, "Great, it works!" But you missed the 1 scenario where it failed.
- Explanations (SHAP/LIME): You ask the robot, "Why did you predict a flood?" It says, "Because the ground was close to a cliff." This sounds reasonable. But it doesn't tell you if the robot is secretly using a broken rule for other scenarios. It's like asking a liar why they lied; they give a plausible excuse, but you don't know if they are lying about the whole story.
The New Way (Formal Verification with SMT):
- Imagine you have a Magic Rulebook of physics.
  - Rule 1: If the water is deeper than 5 meters, there should be no flood.
  - Rule 2: If the earthquake gets stronger, the risk should never go down.
  - Rule 3: If you are far from a cliff and the shaking is weak, there should be no flood.
- Instead of testing random days, this new method takes the robot's entire brain (its code) and translates it into a giant math puzzle. It then asks a super-computer (called an SMT Solver) to check every single possible scenario in the universe at once.
- The Result: The super-computer either says:
  - "UNSAT" (Unsatisfiable): "I have checked every single possibility. The robot follows your rules perfectly. It is safe."
  - "SAT" (Satisfiable): "I found a specific scenario where the robot breaks the rules! Here is the exact input (e.g., Water depth = 5.001 meters) where it fails."

What the Researchers Found

The team tested two types of robots: XGBoost (a complex, powerful tree-based model) and EBM (a slightly simpler, more transparent model).

The "Unconstrained" Robots: Both were very accurate (around 80-82%), but they were dangerous. They broke all four of the physics rules. They would predict a flood even when the water was deep, or say a strong earthquake was safer than a weak one.
The "Constrained" Robots: The researchers forced the robots to follow the rules during training.
- The Good News: The robots stopped breaking the simple rules (like "stronger shaking = more risk").
- The Bad News: They still broke the complex rules. For example, even if they followed the "stronger shaking" rule, they still predicted floods in places where the water was too deep.
- The Trade-off: To make the robots follow the rules, their accuracy dropped from ~82% to ~67%. It's like a student who stops cheating on a test; they might get a slightly lower score, but their answers are now honest and reliable.

The "Verify-Fix-Verify" Loop

The paper suggests a new workflow for engineers, like a quality control loop:

Train: Build a model to be as accurate as possible.
Verify: Run the "Magic Rulebook" check. If it fails, the computer gives you a specific "counterexample" (a specific scenario where it fails).
Fix: Look at that specific failure. "Oh, it failed when the water was deep." Add a rule to fix that.
Re-Verify: Check again. Did we fix it? Did we break something else?
Repeat: Keep going until the model is safe enough for the real world.

Why This Matters

In safety-critical fields like earthquake engineering, being 99% right isn't enough if the 1% wrong answer causes a bridge to collapse.

This paper proves that we can't just trust a model because it has high accuracy or because an "explanation" looks nice. We need mathematical proof that the model will never do something physically impossible. It's the difference between hoping a parachute works and having a mathematical guarantee that it will open every single time, no matter how you jump.

In short: This paper gives engineers a "truth machine" to catch hidden, dangerous mistakes in AI models before they are ever used to protect our cities.

1. Problem Statement

Machine learning (ML) models, particularly tree ensembles like XGBoost and Explainable Boosting Machines (EBMs), are increasingly used to predict geotechnical hazards such as earthquake-induced lateral spreading. While these models achieve high accuracy, they often learn physically inconsistent relationships from sparse or biased training data.

The Core Issue: A model might predict that lateral spreading probability decreases as ground shaking (PGA) increases in certain data-sparse regions, contradicting fundamental physics.
Limitations of Current Remedies:
- Post-hoc Explainability (SHAP/LIME): These are approximate and can assign importance to irrelevant features or miss violations entirely. They diagnose individual predictions but cannot certify the absence of errors across the entire input domain.
- Training-time Constraints: Monotone constraints can enforce single-feature relationships (e.g., "risk increases with PGA") but cannot express compound conditions (e.g., "if far from a free face AND weak shaking, then no risk") or guarantee absolute output thresholds.
The Gap: There is a lack of exhaustive model-assurance tools that can mathematically prove whether a trained model satisfies specific physical consistency conditions across its entire continuous input domain, rather than just on sampled test points.

2. Methodology

The paper introduces a formal verification framework using Satisfiability Modulo Theories (SMT) solvers (specifically Z3) to verify tree-based ML models against geotechnical specifications.

A. Encoding Tree Ensembles as Logical Formulas

The authors encode trained XGBoost and EBM models into logical formulas:

Tree Structure: Each decision tree is recursively encoded as a nested If-Then-Else (ITE) expression over real-valued leaf weights.
Ensemble Sum: The total model output (logit) is the sum of these ITE expressions plus a base score ( $\beta_0$ ).
Input Space Partitioning: Tree ensembles partition the input space into a finite number of hyperrectangular regions, each with a constant output. This allows the solver to reason over the entire continuous domain symbolically.

B. Formalizing Physical Specifications

Four specific geotechnical specifications were formalized as universally quantified first-order logic formulas over the input domain $X$ :

Specification A (Water Table Depth): If groundwater depth > 5m, the model must not predict spreading. (Single-feature threshold).
Specification B (PGA Monotonicity): Increasing PGA must not decrease predicted risk. (Single-feature monotonicity).
Specification C (Distance Safety): If far from a free face (>2.5km) AND weak shaking (<0.35g), the model must not predict spreading. (Compound multi-feature condition).
Specification D (Flat-Ground Safety): A stricter version of C, adding the condition that the ground slope is near zero.

C. The Verification Process

Negation Strategy: To verify a specification $\forall x \in X : P(x)$ , the solver checks the negation: $\exists x \in X : \neg P(x)$ .
Solver Query: The negated specification is conjoined with the encoded model formula. The solver attempts to find a satisfying assignment (a counterexample).
- SAT: A counterexample exists; the specification is violated. The solver returns the concrete input vector causing the violation.
- UNSAT: No counterexample exists; the specification is mathematically proven to hold for all inputs in the domain.
Optimization: For monotonicity checks (Spec B), the authors use a per-tree decomposition strategy (Proposition 1), verifying monotonicity for each of the 100 trees individually rather than the full ensemble, reducing verification time from minutes to seconds.

D. The "Verify-Fix-Verify" Loop

The paper proposes an engineering workflow:

Train an unconstrained model.
Verify against specifications to generate counterexamples.
Analyze counterexamples to identify specific failure modes.
Apply targeted constraints (e.g., monotone constraints, shape function editing).
Re-verify to confirm compliance or identify residual failures.

3. Key Contributions

First Application of SMT to Geotechnical ML: Demonstrates that XGBoost and EBM models trained on lateral spreading data can be encoded as logical formulas and formally checked against domain-specific physical rules.
Formalization of Diverse Specifications: Defines a taxonomy of specifications including thresholds, monotonicity, and compound multi-feature conditions, showing that only monotonicity can be enforced via standard training constraints.
Iterative Verification Loop: Establishes a workflow where SMT counterexamples guide the application of constraints, progressively improving physical consistency.
Pareto Analysis: Quantifies the trade-off between accuracy and physical consistency across 33 model variants.

4. Key Results

The study evaluated models on the 2011 Christchurch earthquake dataset (7,291 sites, 4 features).

Model Type	Accuracy	Spec A (Depth)	Spec B (Monotonicity)	Spec C (Distance)	Spec D (Flat)
Unconstrained XGBoost	82.5%	✗ Violated	✗ Violated	✗ Violated	✗ Violated
Monotone XGBoost	69.3%	✗ Violated	✓ Proven	✗ Violated	✗ Violated
Unconstrained EBM	80.1%	✗ Violated	✗ Violated	✗ Violated	✗ Violated
PGA-Monotone EBM	70.5%	✗ Violated	✓ Proven	✗ Violated	✗ Violated
Fully Constrained EBM	67.2%	✗ Violated (marginal)	✓ Proven	✓ Proven	✓ Proven

Accuracy vs. Consistency Trade-off: A persistent trade-off exists. No model achieved both >80% accuracy and full compliance with all four specifications. The "fully constrained" EBM achieved the highest compliance (3/4 specs) but suffered a ~13% drop in accuracy.
Limitations of Monotone Constraints: While monotone constraints successfully fixed Specification B (PGA monotonicity), they failed to fix Specifications A, C, and D. This proves that single-feature constraints cannot enforce compound logic or absolute output thresholds.
Counterexample Insights: The SMT solver found violations in data-sparse regions (e.g., deep groundwater with high shaking) that grid-based testing (even with 1.6 billion points) missed because the violation regions were thinner than a single grid step.
SHAP vs. Formal Verification: In a counterexample where the model violated the "Deep Water" rule, SHAP ranked the groundwater feature as the least important driver (ranked 4th). This demonstrates that post-hoc explanations cannot substitute for formal verification; a model can make a physically wrong prediction that appears locally reasonable to an engineer relying on SHAP.

5. Significance and Conclusion

Safety-Critical Assurance: This work provides a path toward formal certification of ML models in geotechnical engineering. It moves beyond "testing" (which can only show failure) to "proving" (which can guarantee safety within defined bounds).
Actionable Diagnostics: Unlike black-box constraints, SMT verification provides concrete counterexamples, allowing engineers to pinpoint exactly where and why a model fails physically.
Engineering Workflow: The paper establishes a rigorous "Verify-Fix-Verify" loop, suggesting that physical consistency is a quantifiable cost that must be managed alongside accuracy.
Future Impact: As ML models are deployed in safety-critical infrastructure, this framework offers a necessary layer of assurance, ensuring that models respect established physical laws before field deployment.

Conclusion: The paper demonstrates that while tree-based ML models can achieve high predictive accuracy, they often fail fundamental physical consistency checks. Formal verification via SMT solvers is the only method capable of exhaustively detecting these failures and guiding the creation of physically consistent models, albeit at a quantifiable cost to predictive accuracy.