Breaking a Verified Certifier

Note: this post was heavily updated on March 22, 2026 with the inclusion of the counterexamples against the adversarially-biased MNIST model. It was updated again on July 14, 2026: the counterexample numbers throughout now match the latest version of our paper, in which counterexamples are judged against a fully IEEE-754-compliant execution of each model (see the aside on execution semantics…