Abstract
<title>Abstract</title> <p>Deep neural networks remain vulnerable to adversarial perturbations and backdoor attacks, yet repairing a deployed model without full retraining must balance interpretability, behavioral fidelity, and computational cost. We present a constraint-guided---but not formally certified---framework that uses DeepSHAP to localize a sparse set of fault-relevant weights, collects symbolic path constraints from benign and adversarial executions through concolic testing, and searches for weight updates with Max-SMT. Candidate repairs are always evaluated on the original deployed model, so reported accuracy and attack success rate reflect actual runtime behavior rather than simplified analysis models. Rather than committing to a single fixed recipe, we characterize a configurable repair design space---including which weights to modify, how constraints are collected, and how candidates are ranked---and study it through more than 4{,}700 runs on six benchmarks. Repair success depends critically on jointly choosing the weight direction, the surrogate model used for constraint collection, and the simplification strength. For backdoor benchmarks, outgoing-weight repair with an activation-gated surrogate achieves near-complete backdoor removal on Fashion-MNIST and MNIST-BD (attack success rate from above 98\% to below 8\%). For adversarial benchmarks, bias-only repair substantially reduces misbehavior on MNIST-6 (100\% to 5.81\%) and ResNet18 (85.51\% to 40.42\%). CIFAR-10 and GTSRB remain challenging under single-layer repair, highlighting a tractability--fidelity trade-off. These results show that bias-direction repair is a critical and previously underexplored option for adversarial correction, discoverable only through systematic design-space exploration.</p>