  Formal verification has emerged as a promising method to ensure the safety
and reliability of neural networks. Naively verifying a safety property amounts
to ensuring the safety of a neural network for the whole input space
irrespective of any training or test set. However, this also implies that the
safety of the neural network is checked even for inputs that do not occur in
the real-world and have no meaning at all, often resulting in spurious errors.
To tackle this shortcoming, we propose the VeriFlow architecture as a flow
based density model tailored to allow any verification approach to restrict its
search to the some data distribution of interest. We argue that our
architecture is particularly well suited for this purpose because of two major
properties. First, we show that the transformation and log-density function
that are defined by our model are piece-wise affine. Therefore, the model
allows the usage of verifiers based on SMT with linear arithmetic. Second,
upper density level sets (UDL) of the data distribution take the shape of an
$L^p$-ball in the latent space. As a consequence, representations of UDLs
specified by a given probability are effectively computable in latent space.
This allows for SMT and abstract interpretation approaches with fine-grained,
probabilistically interpretable, control regarding on how (a)typical the inputs
subject to verification are.
