🤖 AI

Neural Network Verification for Deep Joint Source-Channel Coding

This paper introduces the first bound-propagation framework for formally verifying Deep Joint Source-Channel Coding (DeepJSCC) decoders against adversarial and channel disturbances by extending verification techniques to handle specific decoder components like PReLU and Rayleigh fading, and by combining structural encoding with Lipschitz-regularized training to significantly tighten certified error bounds and validate them on real-world hardware.

Original authors: Thanh Le, Hai Duong, Takeshi Matsumura, ThanhVu Nguyen

Published 2026-10-09

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Thanh Le, Hai Duong, Takeshi Matsumura, ThanhVu Nguyen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where the way we send pictures over the air is no longer a rigid, two-step process of compressing an image and then protecting it from static. Instead, a single, intelligent system learns to do both at once, translating a photo directly into radio waves and back again. This is the promise of a technology called deep joint source-channel coding. It acts like a neural network that has learned the language of the air itself, adapting to noise and interference without needing a separate manual repair kit. But because these systems are built by learning rather than by strict engineering rules, they can behave unpredictably. If the radio signal gets distorted in a way the system hasn't seen before, the picture it reconstructs might not just be blurry; it could be dangerously wrong. For a self-driving car relying on a camera feed or a factory robot reading a sensor, a misinterpreted image could lead to a crash or a malfunction. The critical question for engineers is not just how well these systems work on average, but how badly they can fail in the worst possible scenario.

Until now, there has been no reliable way to answer that question for these neural radio systems. Traditional methods can test a system thousands of times to find individual failures, but they cannot prove that a failure will never happen under a specific type of interference. This is like testing a bridge by driving cars over it repeatedly; you might find a weak spot, but you cannot mathematically guarantee it will hold for every possible weight and wind speed. Researchers needed a way to formally verify the system, to calculate a hard limit on how much the picture quality could degrade, ensuring that even in the worst storm of static, the image remains safe enough to use.

A team of researchers has now built the first framework capable of performing this rigorous check on deep joint source-channel coding. They developed a method to trace the path of a distorted signal through the neural network and calculate a guaranteed upper limit on the error. This means they can now say with certainty that no matter how the signal is scrambled within a defined range, the reconstructed image will not be worse than a specific, measurable amount. To make this possible, the team had to solve three specific hurdles that had previously blocked standard verification tools. The first hurdle was a type of mathematical switch inside the network that behaves slightly differently than the standard switches used in most artificial intelligence. The second was a specific way the network expands small data points into larger images, a step that existing tools could not analyze directly. The third, and perhaps most complex, involved the nature of radio waves themselves. When a signal travels through the air, it often suffers from a phenomenon called fading, where the entire signal rotates slightly in phase, like a spinning top wobbling. Standard verification tools treated every part of the signal as if it were wobbling independently, which created a massive, overly pessimistic estimate of the error. The researchers realized that because the entire signal wobbles together as one unit, they could model this shared movement directly, drastically tightening the estimate of potential error.

To test their new approach, the researchers applied it to a system designed to transmit images, specifically using a dataset of ten common categories like airplanes, cats, and trucks. They first trained the system to be robust, adjusting its internal settings so that it was less sensitive to small changes in the signal. Then, they ran their verification framework to see if they could prove the system was safe. The results were striking. For a large version of the system, the method reduced the estimated worst-case error from a value that was too high to be useful down to a very small, manageable number. When they combined their new way of modeling the radio fading with the robust training, the system could certify that it was safe in nearly ten times more situations than before. In one specific test case involving a ten-degree uncertainty in the signal's phase, the new method found 192 safe scenarios where the old method could only find 19.

The team did not stop at computer simulations. To prove that their mathematical guarantees held up in the real world, they built a physical test using software-defined radios, which are devices that can transmit and receive radio signals using software rather than fixed hardware. They set up two of these devices to communicate over the air, sending images across a real radio link. They measured the actual interference and phase shifts on the link and then used their verification tool to calculate a safety bound for that specific environment. They then sent hundreds of images through the air and measured the actual errors. The results confirmed the theory: the worst error they observed in the real world was 0.082, which stayed comfortably below the certified safety limit of 0.128. The system performed exactly as the math predicted, never exceeding the bound.

This work demonstrates that it is possible to bring the same level of safety assurance to neural network-based wireless systems that exists for traditional engineering. By finding a way to model the shared nature of radio fading and adapting the verification tools to handle the specific components of these networks, the researchers have opened the door to using these powerful, adaptive systems in safety-critical applications. They have shown that we can now know, with mathematical certainty, the limits of these systems, ensuring that even when the air is full of noise, the message gets through clearly enough to be trusted.

Technical Summary: Neural Network Verification for Deep Joint Source-Channel Coding

1. Problem Statement

Deep Joint Source-Channel Coding (DeepJSCC) utilizes neural encoder-decoder pairs to transmit data end-to-end over wireless channels, replacing traditional separate compression and coding stages. While effective for average performance, DeepJSCC systems lack formal guarantees regarding reconstruction quality under worst-case channel disturbances. In mission-critical applications (e.g., autonomous vehicles, industrial IoT), a corrupted reconstruction can lead to catastrophic downstream decisions.

Current Neural Network Verification (NNV) tools, which formally bound worst-case behavior, cannot verify DeepJSCC decoders due to three specific architectural and environmental mismatches:

PReLU Activations: DeepJSCC decoders employ Parametric Rectified Linear Units (PReLU) to learn negative-side slopes. Standard verifiers support only ReLU (fixed zero slope). Replacing PReLU with ReLU degrades reconstruction quality by 1.78–2.22 dB.
Transposed Convolutions: The decoder uses transposed convolutions for upsampling, a layer type not natively supported by state-of-the-art bound-propagation tools like $\alpha$ -Crown.
Rayleigh Fading Structure: Under Rayleigh fading, all latent symbols share a single residual phase rotation. Standard interval verification treats each symbol's noise independently, causing the input interval to expand to a $2k$ -dimensional hypercube. This "interval blow-up" renders the verification bounds vacuous (useless) for high-dimensional latent spaces.

Furthermore, existing DeepJSCC models are trained only to minimize average error, lacking the Lipschitz continuity required to produce tight, certifiable bounds.

2. Methodology

The authors propose a bound-propagation framework specifically adapted for DeepJSCC, combining structural modifications to the decoder with a robustness-aware training procedure.

A. Verification Adaptations

To make the DeepJSCC decoder compatible with existing bound-propagation verifiers (specifically $\alpha$ -Crown), the authors introduce three technical reforms:

PReLU Relaxation: The authors extend the linear relaxation optimization of $\alpha$ -Crown to accommodate PReLU. Instead of fixing the lower bound slope at 0 (as in ReLU), the relaxation allows the slope $\alpha$ to vary within $[a, 1]$ , where $a$ is the learned negative slope of the PReLU layer. This preserves the soundness of the bound without sacrificing the reconstruction quality gained by learning $a$ .
Transposed Convolution Substitution: The authors prove that a transposed convolution with stride $s$ is mathematically equivalent to a nearest-neighbor upsampling followed by a standard convolution with a specific kernel. They substitute the transposed convolution layers with this "upsample-then-convolution" structure. This allows the use of standard convolution relaxation rules, incurring a negligible loss in Peak Signal-to-Noise Ratio (PSNR) of at most 0.35 dB.
Structural Rayleigh Input Property: To address the interval blow-up caused by shared fading, the authors model the fading channel as a linear layer prepended to the decoder. Instead of bounding $k$ independent complex symbols, the verifier bounds the two real coordinates of the single complex fading coefficient $h$ (where $\hat{s} = hs + n$ ). This reduces the input dimensionality from $2k$ intervals to just 2 degrees of freedom, allowing the verifier to track the structural constraint of the shared phase rotation exactly.

B. GloRo Instantiation

To ensure the bounds are tight enough to be useful, the authors apply GloRo (Global Robustness) training. They add a Lipschitz regularization penalty to the training loss function, targeting the decoder's Lipschitz constant ( $K_D$ ).

The penalty is derived from the input property radius, which accounts for both Additive White Gaussian Noise (AWGN) and the residual phase uncertainty in Rayleigh fading.
This fine-tuning process shrinks the decoder's global sensitivity, ensuring that small input perturbations (channel noise) do not result in disproportionately large output errors.

3. Key Contributions

The paper claims four primary contributions:

PReLU Relaxation: A sound extension of $\alpha$ -Crown linear relaxation that generalizes ReLU verification to PReLU, preserving the 1.78–2.22 dB PSNR gain of PReLU over ReLU.
Upsample-then-Convolution Substitution: A proof that transposed convolutions can be replaced by a restricted upsampling-convolution form, enabling native support in $\alpha$ -Crown with minimal performance loss (<0.35 dB).
Structural Rayleigh Input: A method to formulate Rayleigh fading as a structural perturbation (a linear layer), reducing the verification input dimension from $2k$ to 2, thereby significantly tightening certified bounds.
GloRo for DeepJSCC: The first instantiation of Lipschitz-regularized training for DeepJSCC decoders, providing closed-form radii for both AWGN and Rayleigh channels, enabling the certification of models that were previously un-verifiable.

4. Experimental Results

The authors evaluated their framework on DeepJSCC models (Small, Medium, Large) trained on CIFAR-10, using both AWGN and Rayleigh fading channels.

Reconstruction Quality: The verifier-compatibility changes (PReLU relaxation and upsample-conv substitution) preserved reconstruction quality. Replacing PReLU with ReLU caused a 1.78–2.22 dB drop, whereas the proposed PReLU relaxation maintained the original performance. The upsample-conv substitution resulted in a PSNR change of less than 0.35 dB.
Lipschitz Reduction: GloRo training reduced the Lipschitz constant of the large decoder from 215.6 to 25.5. This reduction was critical; without it, the certified Mean Absolute Error (MAE) bound remained above 1.0 for all Signal-to-Noise Ratios (SNRs), rendering the model un-certifiable. With GloRo, the bound dropped to 0.08 at 30 dB SNR.
Structural Encoding Impact: Structural encoding of the fading coefficient significantly improved certification success. At a 10-degree phase uncertainty ( $\delta=10^\circ$ ), structural encoding lowered the median certified bound by up to 41% compared to interval encoding. It certified 192 safe cases compared to only 19 for interval encoding (a 10 $\times$ gain).
Over-the-Air Validation: The authors validated the certificates on real hardware using two ADALM-PlutoSDR transceivers.
- Conditions: Operating SNR of 27.4 dB and residual phase $\delta=5.4^\circ$ .
- Result: The worst observed MAE across 300 frames (10 CIFAR-10 classes $\times$ 30 transmissions) was 0.082. The certified upper bound was 0.128.
- Conclusion: The real-world error remained strictly within the theoretical bound, confirming the certificate holds on physical radio links.

5. Significance and Claims

The paper positions itself as the first bound-propagation framework capable of formally verifying DeepJSCC decoders under physical wireless channel models.

Reliability: It addresses the "black box" reliability concern of DeepJSCC in safety-critical scenarios by providing formal guarantees on worst-case reconstruction error, rather than relying on finite-sample testing which cannot guarantee the absence of faults.
Feasibility: The work demonstrates that formal verification is feasible for complex, non-standard neural architectures (PReLU, transposed convolutions) and physical channel models (Rayleigh fading) without sacrificing the performance benefits of the original architecture.
Hardware Validity: The over-the-air validation is a significant claim, bridging the gap between theoretical verification and physical reality. The authors assert that the certificate derived from the channel model accurately constrains the behavior of the hardware implementation.
Complementarity: The results highlight that robustness training (GloRo) and structural encoding are complementary; GloRo addresses the decoder's amplification of errors, while structural encoding addresses the channel's input expansion. Both are necessary for effective certification in high-dimensional, fading environments.

The authors conclude that while their approach currently applies to convolutional DeepJSCC, future work must address attention-based successors (e.g., WITT) which require abstract domains beyond current PReLU/ReLU relaxations.