SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Theorem 3.1 gives a strong limitation on learning depth-3 networks in the smoothed-analysis framework. Motivated by existing positive results on smoothed-analysis in depth-2 networks, we now study whether learning depth-2 networks with smoothed parameters can be done under weak assumptions on the input distribution. Specifically, we consider the case where both the parameters and the input distribution are smoothed. We show that efficiently learning depth-2 networks may not be possible with smoothed parameters where the input distribution on  $\mathbb{R}^d$  is obtained by smoothing an i.i.d. Bernoulli distribution on  $\{0,1\}^d$ .
Theorem 3.2. Under Assumption 2.1, there is no efficient algorithm that learns depth-2 networks with smoothed parameters and inputs (in the sense of Definition 2.3), under the distribution  $\mathcal{D}$  on  $\{0,1\}^d$  where each coordinate is drawn i.i.d. from a Bernoulli distribution which takes the value 0 with probability  $\frac{1}{\sqrt{d}}$ .
We prove the theorem in Appendix C. The proof follows from similar ideas to the proof of Theorem 3.1, which we discuss in the next section.
The proof builds on a technique from Daniely and Vardi [16]. It follows by showing that an efficient algorithm for learning depth-3 neural networks with smoothed parameters under the Gaussian distribution can be used for breaking a local PRG. Intuitively, the main challenge in our proof in comparison to [16] is that our reduction must handle the random noise which is added to the parameters. Specifically, [16] define a certain examples oracle, and show that the examples returned by the oracle are realizable by some neural network which depends on the unknown  $\mathbf{x} \in \{0, 1\}^n$  used by the PRG. Since the network depends on this unknown  $\mathbf{x}$ , some of the parameters of the network are unknown, and hence it is non-trivial how to define an example oracle which is realizable by a perturbed network. Moreover, we need to handle this random perturbation without increasing the network's depth. For these reasons, our reduction is significantly different from [16].
We now provide the formal proof. The proof relies on several lemmas which we prove in Appendix A. For a sufficiently large  $n$ , let  $\mathcal{D}$  be the standard Gaussian distribution on  $\mathbb{R}^{n^2}$ . Assume that there is a poly(n)-time algorithm  $\mathcal{L}$  that learns depth-3 neural networks with at most  $n^2$  hidden neurons and parameter magnitudes bounded by  $n^3$ , with smoothed parameters, under the distribution  $\mathcal{D}$ , with  $\epsilon = \frac{1}{n}$ , and  $\tau = 1 / \mathrm{poly}(n)$  that we will specify later. Let  $m(n) \leq \mathrm{poly}(n)$  be the sample complexity of  $\mathcal{L}$ , namely,  $\mathcal{L}$  uses a sample of size at most  $m(n)$  and returns w.p. at least  $\frac{3}{4}$  a hypothesis  $h$  with  $\mathbb{E}_{\mathbf{z} \sim \mathcal{D}}\left[\left(h(\mathbf{z}) - N_{\hat{\theta}}(\mathbf{z})\right)^2\right] \leq \epsilon = \frac{1}{n}$ , where  $N_{\hat{\theta}}$  is the perturbed network. Let  $s > 1$  be a constant such that  $n^s \geq m(n) + n^3$  for every sufficiently large  $n$ . By Assumption 2.1, there exists a constant  $k$  and a predicate  $P: \{0,1\}^k \to \{0,1\}$ , such that  $\mathcal{F}_{P,n,n^s}$  is  $\frac{1}{3}$ -PRG. We will show an efficient algorithm  $\mathcal{A}$  with distinguishing advantage greater than  $\frac{1}{3}$  and thus reach a contradiction.
Throughout this proof, we will use the following notations. For a hyperedge  $S = (i_1, \ldots, i_k)$  we denote by  $\mathbf{z}^S \in \{0, 1\}^{kn}$  the following encoding of  $S$ : the vector  $\mathbf{z}^S$  is a concatenation of  $k$  vectors in  $\{0, 1\}^n$ , such that the  $j$ -th vector has 0 in the  $i_j$ -th coordinate and 1 elsewhere. Thus,  $\mathbf{z}^S$  consists of  $k$  size-  $n$  slices, each encoding a member of  $S$ . For  $\mathbf{z} \in \{0, 1\}^{kn}$ ,  $i \in [k]$  and  $j \in [n]$ , we denote  $z_{i,j} = z_{(i-1)n+j}$ . That is,  $z_{i,j}$  is the  $j$ -th component in the  $i$ -th slice in  $\mathbf{z}$ . For  $\mathbf{x} \in \{0, 1\}^n$ , let
$P_{\mathbf{x}}:\{0,1\}^{kn}\to \{0,1\}$  be such that for every hyperedge  $S$  we have  $P_{\mathbf{x}}(\mathbf{z}^S) = P(\mathbf{x}_S)$ . Let  $c$  be such that  $\operatorname*{Pr}_{t\sim \mathcal{N}(0,1)}[t\leq c] = \frac{1}{n}$ . Let  $\mu$  be the density of  $\mathcal{N}(0,1)$ , let  $\mu_{-}(t) = n\cdot \mathbb{1}[t\leq c]\cdot \mu (t)$  and let  $\mu_{+} = \frac{n}{n - 1}\cdot \mathbb{1}[t\geq c]\cdot \mu (t)$ . Note that  $\mu_{-},\mu_{+}$  are the densities of the restriction of  $\mu$  to the intervals  $t\leq c$  and  $t\geq c$  respectively. Let  $\Psi :\mathbb{R}^{kn}\to \{0,1\}^{kn}$  be a mapping such that for every  $\mathbf{z}'\in \mathbb{R}^{kn}$  and  $i\in [kn]$  we have  $\Psi (\mathbf{z}')_i = \mathbb{1}[z_i'\geq c]$ . For  $\tilde{\mathbf{z}}\in \mathbb{R}^{n^2}$  we denote  $\tilde{\mathbf{z}}_{[kn]} = (\tilde{z}_1,\dots ,\tilde{z}_{kn})$  namely, the first  $kn$  components of  $\tilde{\mathbf{z}}$  (assuming  $n^2\geq kn$ ).
4.1 Defining the target network for  $\mathcal{L}$
Since our goal is to use the algorithm  $\mathcal{L}$  for breaking PRGs, in this subsection we define a neural network  $\tilde{N}:\mathbb{R}^{n^2}\to \mathbb{R}$  that we will later use as a target network for  $\mathcal{L}$ . The network  $\tilde{N}$  contains the subnetworks  $N_{1},N_{2},N_{3}$  which we define below.
Let  $N_{1}$  be a depth-2 neural network with input dimension  $kn$ , at most  $n\log (n)$  hidden neurons, at most  $\log (n)$  output neurons (with activations in the output neurons), and parameter magnitudes bounded by  $n^3$  (all bounds are for a sufficiently large  $n$ ), which satisfies the following. We denote the set of output neurons of  $N_{1}$  by  $\mathcal{E}_{1}$ . Let  $\mathbf{z}' \in \mathbb{R}^{kn}$  be an input to  $N_{1}$  such that  $\Psi(\mathbf{z}') = \mathbf{z}^{S}$  for some hyperedge  $S$ , and assume that for every  $i \in [kn]$  we have  $z_i' \notin \left(c, c + \frac{1}{n^2}\right)$ . Fix some  $\mathbf{x} \in \{0,1\}^n$ . Then, for  $S$  with  $P_{\mathbf{x}}(\mathbf{z}^{S}) = 0$  the inputs to all output neurons  $\mathcal{E}_{1}$  are at most  $-1$ , and for  $S$  with  $P_{\mathbf{x}}(\mathbf{z}^{S}) = 1$  there exists a neuron in  $\mathcal{E}_{1}$  with input at least 2. Recall that our definition of a neuron's input includes the addition of the bias term. The construction of the network  $N_{1}$  is given in Lemma A.3. Intuitively, the network  $N_{1}$  consists of a layer that transforms w.h.p. the input  $\mathbf{z}'$  to  $\Psi(\mathbf{z}') = \mathbf{z}^{S}$ , followed by a layer that satisfies the following: Building on a lemma from [16] which shows that  $P_{\mathbf{x}}(\mathbf{z}^{S})$  can be computed by a DNF formula, we define a layer where each output neuron corresponds to a term in the DNF formula, such that if the term evaluates to 0 then the input to the neuron is at most  $-1$ , and otherwise it is at least 2. Note that the network  $N_{1}$  depends on  $\mathbf{x}$ . However, only the second layer depends on  $\mathbf{x}$ , and thus given an input we may compute the first layer even without knowing  $\mathbf{x}$ . Let  $N_{1}' : \mathbb{R}^{kn} \to \mathbb{R}$  be a depth-3 network with no activation in the output neuron, obtained from  $N_{1}$  by summing the outputs from all neurons  $\mathcal{E}_{1}$ .
Let  $N_{2}$  be a depth-2 neural network with input dimension  $kn$ , at most  $n\log (n)$  hidden neurons, at most  $2n$  output neurons, and parameter magnitudes bounded by  $n^3$  (for a sufficiently large  $n$ ), which satisfies the following. We denote the set of output neurons of  $N_{2}$  by  $\mathcal{E}_2$ . Let  $\mathbf{z}' \in \mathbb{R}^{kn}$  be an input to  $N_{2}$  such that for every  $i \in [kn]$  we have  $z_i' \notin \left(c, c + \frac{1}{n^2}\right)$ . If  $\Psi(\mathbf{z}')$  is an encoding of a hyperedge then the inputs to all output neurons  $\mathcal{E}_2$  are at most  $-1$ , and otherwise there exists a neuron in  $\mathcal{E}_2$  with input at least 2. The construction of the network  $N_{2}$  is given in Lemma A.5. Intuitively, each neuron in  $\mathcal{E}_2$  is responsible for checking whether  $\Psi(\mathbf{z}')$  violates some requirement that must hold in an encoding of a hyperedge. Let  $N_2': \mathbb{R}^{kn} \to \mathbb{R}$  be a depth-3 network with no activation in the output neuron, obtained from  $N_{2}$  by summing the outputs from all neurons  $\mathcal{E}_2$ .
Let  $N_{3}$  be a depth-2 neural network with input dimension  $kn$ , at most  $n\log (n)$  hidden neurons,  $kn \leq n\log (n)$  output neurons, and parameter magnitudes bounded by  $n^3$  (for a sufficiently large  $n$ ), which satisfies the following. We denote the set of output neurons of  $N_{3}$  by  $\mathcal{E}_3$ . Let  $\mathbf{z}' \in \mathbb{R}^{kn}$  be an input to  $N_{3}$ . If there exists  $i \in [kn]$  such that  $z_i' \in \left(c, c + \frac{1}{n^2}\right)$  then there exists a neuron in  $\mathcal{E}_3$  with input at least 2. Moreover, if for all  $i \in [kn]$  we have  $z_i' \notin \left(c - \frac{1}{n^2}, c + \frac{2}{n^2}\right)$  then the inputs to all neurons in  $\mathcal{E}_3$  are at most  $-1$ . The construction of the network  $N_{3}$  is straightforward and given in Lemma A.6. Let  $N_3': \mathbb{R}^{kn} \to \mathbb{R}$  be a depth-3 neural network with no activation function in the output neuron, obtained from  $N_{3}$  by summing the outputs from all neurons  $\mathcal{E}_3$ .
Let  $N^{\prime}:\mathbb{R}^{kn}\to \mathbb{R}$  be a depth-3 network obtained from  $N_1^\prime ,N_2^\prime ,N_3^\prime$  as follows. For  $\mathbf{z}'\in \mathbb{R}^{kn}$  we have  $N^{\prime}(\mathbf{z}^{\prime}) = [1 - N_{1}^{\prime}(\mathbf{z}^{\prime}) - N_{2}^{\prime}(\mathbf{z}^{\prime}) - N_{3}^{\prime}(\mathbf{z}^{\prime})]_{+}$ . The network  $N^{\prime}$  has at most  $n^2$  neurons, and parameter magnitudes bounded by  $n^3$  (all bounds are for a sufficiently large  $n$ ). Finally, let  $\tilde{N}:\mathbb{R}^{n^2}\rightarrow \mathbb{R}$  be a depth-3 neural network such that  $\tilde{N} (\tilde{\mathbf{z}}) = N^{\prime}\left(\tilde{\mathbf{z}}_{[kn]}\right)$ .
4.2 Defining the noise magnitude  $\tau$  and analyzing the perturbed network
In order to use the algorithm  $\mathcal{L}$  w.r.t. some neural network with parameters  $\theta$ , we need to implement an examples oracle, such that the examples are labeled according to a neural network with parameters  $\theta + \xi$ , where  $\xi$  is a random perturbation. Specifically, we use  $\mathcal{L}$  with an examples oracle where the
labels correspond to a network  $\hat{N}:\mathbb{R}^{n^2}\to \mathbb{R}$ , obtained from  $\tilde{N}$  (w.r.t. an appropriate  $\mathbf{x}\in \{0,1\} ^n$  in the construction of  $N_{1}$ ) by adding a small perturbation to the parameters. The perturbation is such that we add i.i.d. noise to each parameter in  $\tilde{N}$ , where the noise is distributed according to  $\mathcal{N}(0,\tau^2)$ , and  $\tau = 1 / \mathrm{poly}(n)$  is small enough such that the following holds. Let  $f_{\theta}:\mathbb{R}^{n^2}\to \mathbb{R}$  be any depth-3 neural network parameterized by  $\pmb {\theta}\in \mathbb{R}^r$  for some  $r > 0$  with at most  $n^2$  neurons, and parameter magnitudes bounded by  $n^3$  (note that  $r$  is polynomial in  $n$ ). Then w.p. at least  $1 - \frac{1}{n}$  over  $\xi \sim \mathcal{N}(\mathbf{0},\tau^2 I_r)$ , we have  $|\xi_i|\leq \frac{1}{10}$  for all  $i\in [r]$ , and the network  $f_{\theta +\xi}$  is such that for every input  $\tilde{\mathbf{z}}\in \mathbb{R}^{n^2}$  with  $\| \tilde{\mathbf{z}}\| \leq 2n$  and every neuron we have: Let  $a,b$  be the inputs to the neuron in the computations  $f_{\theta}(\tilde{\mathbf{z}})$  and  $f_{\theta +\xi}(\tilde{\mathbf{z}})$  (respectively), then  $|a - b|\leq \frac{1}{2}$ . Thus,  $\tau$  is sufficiently small, such that w.h.p. adding i.i.d. noise  $\mathcal{N}(0,\tau^2)$  to each parameter does not change the inputs to the neurons by more than  $\frac{1}{2}$ . Note that such an inverse-polynomial  $\tau$  exists, since when the network size, parameter magnitudes, and input size are bounded by some poly(n), then the input to each neuron in  $f_{\theta}(\tilde{\mathbf{z}})$  is poly(n)-Lipschitz as a function of  $\pmb{\theta}$ , and thus it suffices to choose  $\tau$  that implies w.p. at least  $1 - \frac{1}{n}$  that  $\| \pmb {\xi}\| \leq \frac{1}{q(n)}$  for a sufficiently large polynomial  $q(n)$  (see Lemma A.7 for details).
Let  $\tilde{\pmb{\theta}}\in \mathbb{R}^p$  be the parameters of the network  $\tilde{N}$ . Recall that the parameters vector  $\tilde{\pmb{\theta}}$  is the concatenation of all weight matrices and bias terms. Let  $\hat{\pmb{\theta}}\in \mathbb{R}^{p}$  be the parameters of  $\hat{N}$ , namely,  $\hat{\pmb{\theta}} = \tilde{\pmb{\theta}} +\pmb {\xi}$  where  $\pmb {\xi}\sim \mathcal{N}(\mathbf{0},\tau^2 I_p)$ . By our choice of  $\tau$  and the construction of the networks  $N_{1},N_{2},N_{3}$ , w.p. at least  $1 - \frac{1}{n}$  over  $\pmb{\xi}$ , for every  $\tilde{\mathbf{z}}$  with  $\| \tilde{\mathbf{z}}\| \leq 2n$ , the inputs to the neurons  $\mathcal{E}_1,\mathcal{E}_2,\mathcal{E}_3$  in the computation  $\hat{N} (\tilde{\mathbf{z}})$  satisfy the following properties, where we denote  $\mathbf{z}' = \tilde{\mathbf{z}}_{[kn]}$ :
(P1) If  $\Psi(\mathbf{z}') = \mathbf{z}^S$  for some hyperedge  $S$ , and for every  $i \in [kn]$  we have  $z_i' \notin \left(c, c + \frac{1}{n^2}\right)$ , then the inputs to  $\mathcal{E}_1$  satisfy: If  $P_{\mathbf{x}}(\mathbf{z}^S) = 0$  then the inputs to all neurons in  $\mathcal{E}_1$  are at most  $-\frac{1}{2}$ , and if  $P_{\mathbf{x}}(\mathbf{z}^S) = 1$  then there exists a neuron in  $\mathcal{E}_1$  with input at least  $\frac{3}{2}$ .
(P2) If for every  $i \in [kn]$  we have  $z_i' \notin (c, c + \frac{1}{n^2})$ , then the inputs to  $\mathcal{E}_2$  satisfy: If  $\Psi(\mathbf{z}')$  is an encoding of a hyperedge then the inputs to all neurons  $\mathcal{E}_2$  are at most  $-\frac{1}{2}$ , and otherwise there exists a neuron in  $\mathcal{E}_2$  with input at least  $\frac{3}{2}$ .
(P3) The inputs to  $\mathcal{E}_3$  satisfy: If there exists  $i\in [kn]$  such that  $z_i^\prime \in \left(c,c + \frac{1}{n^2}\right)$  then there exists a neuron in  $\mathcal{E}_3$  with input at least  $\frac{3}{2}$ , and if for all  $i\in [kn]$  we have  $z_i^\prime \notin \left(c - \frac{1}{n^2},c + \frac{2}{n^2}\right)$  then the inputs to all neurons in  $\mathcal{E}_3$  are at most  $-\frac{1}{2}$ .
4.3 Stating the algorithm  $\mathcal{A}$
Given a sequence  $(S_1, y_1), \ldots, (S_{n^s}, y_{n^s})$ , where  $S_1, \ldots, S_{n^s}$  are i.i.d. random hyperedges, the algorithm  $\mathcal{A}$  needs to distinguish whether  $\mathbf{y} = (y_1, \ldots, y_{n^s})$  is random or that we have  $\mathbf{y} = (P(\mathbf{x}_{S_1}), \ldots, P(\mathbf{x}_{S_{n^s}})) = (P_{\mathbf{x}}(\mathbf{z}^{S_1}), \ldots, P_{\mathbf{x}}(\mathbf{z}^{S_{n^s}}))$  for a random  $\mathbf{x} \in \{0, 1\}^n$ . We let  $\mathcal{S} = ((\mathbf{z}^{S_1}, y_1), \ldots, (\mathbf{z}^{S_{n^s}}, y_{n^s}))$ .
We use the efficient algorithm  $\mathcal{L}$  in order to obtain distinguishing advantage greater than  $\frac{1}{3}$  as follows. Let  $\xi$  be a random perturbation, and let  $\hat{N}$  be the perturbed network as defined above, w.r.t. the unknown  $\mathbf{x} \in \{0,1\}^n$ . Note that given a perturbation  $\xi$ , only the weights in the second layer of the subnetwork  $N_1$  in  $\hat{N}$  are unknown, since all other parameters do not depend on  $\mathbf{x}$ . The algorithm  $\mathcal{A}$  runs  $\mathcal{L}$  with the following examples oracle. In the  $i$ -th call, the oracle first draws  $\mathbf{z} \in \{0,1\}^{kn}$  such that each component is drawn i.i.d. from a Bernoulli distribution which takes the value 0 w.p.  $\frac{1}{n}$ . If  $\mathbf{z}$  is an encoding of a hyperedge then the oracle replaces  $\mathbf{z}$  with  $\mathbf{z}^{S_i}$ . Then, the oracle chooses  $\mathbf{z}' \in \mathbb{R}^{kn}$  such that for each component  $j$ , if  $z_j = 1$  then  $z_j'$  is drawn from  $\mu_+$ , and otherwise  $z_j'$  is drawn from  $\mu_-$ . Let  $\tilde{\mathbf{z}} \in \mathbb{R}^{n^2}$  be such that  $\tilde{\mathbf{z}}_{[kn]} = \mathbf{z}'$ , and the other  $n^2 - kn$  components of  $\tilde{\mathbf{z}}$  are drawn i.i.d. from  $\mathcal{N}(0,1)$ . Note that the vector  $\tilde{\mathbf{z}}$  has the distribution  $\mathcal{D}$ , due to the definitions of the densities  $\mu_+$  and  $\mu_-$ , and since replacing an encoding of a random hyperedge by an encoding of another random hyperedge does not change the distribution of  $\mathbf{z}$ . Let  $\hat{b} \in \mathbb{R}$  be the bias term of the output neuron of  $\hat{N}$ . The oracle returns  $(\tilde{\mathbf{z}},\tilde{y})$ , where the labels  $\tilde{y}$  are chosen as follows:
- If  $\Psi(\mathbf{z}')$  is not an encoding of a hyperedge, then  $\tilde{y} = 0$ .
- If  $\Psi(\mathbf{z}^{\prime})$  is an encoding of a hyperedge:
- If  $\mathbf{z}'$  does not have components in the interval  $(c - \frac{1}{n^2}, c + \frac{2}{n^2})$ , then if  $y_i = 0$  we set  $\tilde{y} = \hat{b}$  and if  $y_i = 1$  we set  $\tilde{y} = 0$ .
- If  $\mathbf{z}'$  has a component in the interval  $(c, c + \frac{1}{n^2})$ , then  $\tilde{y} = 0$ .
- If  $\mathbf{z}'$  does not have components in the interval  $(c, c + \frac{1}{n^2})$ , but has a component in the interval  $(c - \frac{1}{n^2}, c + \frac{2}{n^2})$ , then the label  $\tilde{y}$  is determined as follows: If  $y_i = 1$  then  $\tilde{y} = 0$ . If  $y_i = 0$ , we have: Let  $\hat{N}_3$  be the network  $\hat{N}$  after omitting the neurons  $\mathcal{E}_1, \mathcal{E}_2$  and their incoming and outgoing weights. Then, we set  $\tilde{y} = [\hat{b} - \hat{N}_3(\tilde{\mathbf{z}})]_+$ . Note that since only the second layer of  $N_1$  depends on  $\mathbf{x}$ , then we can compute  $\hat{N}_3(\tilde{\mathbf{z}})$  without knowing  $\mathbf{x}$ .
Let  $h$  be the hypothesis returned by  $\mathcal{L}$ . Recall that  $\mathcal{L}$  uses at most  $m(n)$  examples, and hence  $\mathcal{S}$  contains at least  $n^3$  examples that  $\mathcal{L}$  cannot view. We denote the indices of these examples by  $I = \{m(n) + 1, \dots, m(n) + n^3\}$ , and the examples by  $S_I = \{(\mathbf{z}^{S_i}, y_i)\}_{i \in I}$ . By  $n^3$  additional calls to the oracle, the algorithm  $\mathcal{A}$  obtains the examples  $\tilde{S}_I = \{(\tilde{\mathbf{z}}_i, \tilde{y}_i)\}_{i \in I}$  that correspond to  $S_I$ . Let  $h'$  be a hypothesis such that for all  $\tilde{\mathbf{z}} \in \mathbb{R}^{n^2}$  we have  $h'(\tilde{\mathbf{z}}) = \max \{0, \min \{\hat{b}, h(\tilde{\mathbf{z}})\}\}$ , thus, for  $\hat{b} \geq 0$  the hypothesis  $h'$  is obtained from  $h$  by clipping the output to the interval  $[0, \hat{b}]$ . Let  $\ell_I(h') = \frac{1}{|I|} \sum_{i \in I} (h'(\tilde{\mathbf{z}}_i) - \tilde{y}_i)^2$ . Now, if  $\ell_I(h') \leq \frac{2}{n}$ , then  $\mathcal{A}$  returns 1, and otherwise it returns 0. We remark that the decision of our algorithm is based on  $h'$  (rather than  $h$ ) since we need the outputs to be bounded, in order to allow using Hoeffding's inequality in our analysis, which we discuss in the next subsection.
4.4 Analyzing the algorithm  $\mathcal{A}$
Note that the algorithm  $\mathcal{A}$  runs in  $\mathrm{poly}(n)$  time. We now show that if  $\mathcal{S}$  is pseudorandom then  $\mathcal{A}$  returns 1 w.p. greater than  $\frac{2}{3}$ , and if  $\mathcal{S}$  is random then  $\mathcal{A}$  returns 1 w.p. less than  $\frac{1}{3}$ .
We start with the case where  $S$  is pseudorandom. In Lemma A.8, we prove that if  $S$  is pseudorandom then w.h.p. (over  $\xi \sim \mathcal{N}(\mathbf{0},\tau^2 I_p)$  and the i.i.d. inputs  $\tilde{\mathbf{z}}_i \sim \mathcal{D}$ ) the examples  $(\tilde{\mathbf{z}}_1,\tilde{y}_1),\ldots, (\tilde{\mathbf{z}}_{m(n) + n^3},\tilde{y}_{m(n) + n^3})$  returned by the oracle are realized by  $\hat{N}$ . Thus,  $\tilde{y}_i = \hat{N} (\tilde{\mathbf{z}}_i)$  for all  $i$ . As we show in the lemma, this claim follows by considering the definition of the oracle for the different cases of  $(\tilde{\mathbf{z}}_i)_{[kn]}$ , and using Properties (P1)-(P3) to show that  $\hat{N}$  behaves similarly.
Recall that the algorithm  $\mathcal{L}$  is such that w.p. at least  $\frac{3}{4}$  (over  $\xi \sim \mathcal{N}(\mathbf{0},\tau^2 I_p)$ , the i.i.d. inputs  $\tilde{\mathbf{z}}_i\sim \mathcal{D}$  and its internal randomness), given a size- $m(n)$  dataset labeled by  $\hat{N}$ , it returns a hypothesis  $h$  such that  $\mathbb{E}_{\tilde{\mathbf{z}}\sim \mathcal{D}}\left[(h(\tilde{\mathbf{z}}) - \hat{N} (\tilde{\mathbf{z}}))^2\right]\leq \frac{1}{n}$ . By the definition of  $h^\prime$  and the construction of  $\hat{N}$ , if  $h$  has small error then  $h^\prime$  also has small error, namely, we have  $\mathbb{E}_{\tilde{\mathbf{z}}\sim \mathcal{D}}\left[(h'(\tilde{\mathbf{z}}) - \hat{N} (\tilde{\mathbf{z}}))^2\right]\leq \frac{1}{n}$ . In Lemma A.9 we use the above arguments and Hoeffding's inequality over  $\tilde{S}_I$ , and prove that w.p. greater than  $\frac{2}{3}$  we have  $\ell_I(h')\leq \frac{2}{n}$ .
Next, we consider the case where  $S$  is random. Let  $\tilde{\mathcal{Z}}\subseteq \mathbb{R}^{n^2}$  be such that  $\tilde{\mathbf{z}}\in \tilde{\mathcal{Z}}$  iff  $\tilde{\mathbf{z}}_{[kn]}$  does not have components in the interval  $(c - \frac{1}{n^2},c + \frac{2}{n^2})$ , and  $\Psi (\tilde{\mathbf{z}}_{[kn]}) = \mathbf{z}^S$  for a hyperedge  $S$ . If  $S$  is random, then by the definition of our examples oracle, for every  $i\in [m(n) + n^3 ]$  such that  $\tilde{\mathbf{z}}_i\in \tilde{\mathcal{Z}}$ , we have  $\tilde{y}_i = \hat{b}$  w.p.  $\frac{1}{2}$  and  $\tilde{y}_i = 0$  otherwise. Also, by the definition of the oracle,  $\tilde{y}_i$  is independent of  $S_{i}$  and independent of the choice of the vector  $\tilde{\mathbf{z}}_i$  that corresponds to  $\mathbf{z}^{S_i}$ . Hence, for such  $\tilde{\mathbf{z}}_i\in \tilde{\mathcal{Z}}$  with  $i\in I$ , any hypothesis cannot predict the label  $\tilde{y}_i$ , and the expected loss for the example is at least  $\left(\frac{\hat{b}}{2}\right)^2$ . Moreover, in Lemma A.11 we show that  $\operatorname*{Pr}\left[\tilde{\mathbf{z}}_i\in \tilde{\mathcal{Z}}\right]\geq \frac{1}{2\log(n)}$  for a sufficiently large  $n$ . In Lemma A.12 we use these arguments to prove a lower bound on  $\mathbb{E}_{\tilde{S}_I}[\ell_I(h')]$ , and by Hoeffding's inequality over  $\tilde{S}_I$  we conclude that w.p. greater than  $\frac{2}{3}$  we have  $\ell_I(h') > \frac{2}{n}$ .
Overall, if  $S$  is pseudorandom then w.p. greater than  $\frac{2}{3}$  the algorithm  $\mathcal{A}$  returns 1, and if  $S$  is random then w.p. greater than  $\frac{2}{3}$  it returns 0. Thus, the distinguishing advantage is greater than  $\frac{1}{3}$ .
Understanding the computational complexity of learning neural networks is a central question in learning theory. Our results imply that the assumptions which allow for efficient learning in one-hidden-layer networks might not suffice in deeper networks. Also, in depth-2 networks we show that it is not sufficient to assume that both the parameters and the inputs are smoothed. We hope that our hardness results will help focus on assumptions that may allow for efficient learning.