SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\mathcal {L} (\boldsymbol {x}, y, \epsilon) = \mathcal {L} _ {\mathrm {T A P S}} (\boldsymbol {x}, y, \epsilon) \cdot \mathcal {L} _ {\mathrm {I B P}} (\boldsymbol {x}, y, \epsilon).
$$
This expresses that every sample should be either certifiable with TAPS or IBP bounds<sup>1</sup>. Further, as by construction  $\mathcal{L}_{\mathrm{TAPS}} \leq \mathcal{L}_{\mathrm{IBP}}$ , we add a scaling term  $\alpha$  to the loss gradient:
$$
\frac {d \mathcal {L}}{d \boldsymbol {\theta}} := 2 \alpha \frac {d \mathcal {L} _ {\mathrm {T A P S}}}{d \boldsymbol {\theta}} \cdot \mathcal {L} _ {\mathrm {I B P}} + (2 - 2 \alpha) \frac {d \mathcal {L} _ {\mathrm {I B P}}}{d \boldsymbol {\theta}} \cdot \mathcal {L} _ {\mathrm {T A P S}}.
$$
Here,  $\alpha = 0.5$  recovers the standard gradient, obtained via the product rule (both sides weighted with 1), while  $\alpha = 0$  and  $\alpha = 1$  correspond to using only the (weighted) IBP and TAPS gradients, respectively. Henceforth, we express this as the regularization weight  $w_{\mathrm{TAPS}} = \frac{\alpha}{1 - \alpha}$ , which intuitively expresses the weight put on TAPS, using  $w_{\mathrm{TAPS}} = 5$  unless specified otherwise. Lastly, we reduce the variance of  $\mathcal{L}$  by averaging  $\mathcal{L}_{\mathrm{IBP}}$  and  $\mathcal{L}_{\mathrm{TAPS}}$  over a mini batch before multiplying (see App. A).
3.5 STAPS-Balancing Regularization by Combining TAPS with SABR
Recall that SABR (Müller et al., 2022a) reduces the over-regularization of certified training by propagating a small, adversarially selected Box through the whole network. However, as Box approximations grow exponentially with depth (Müller et al., 2022a; Shi et al., 2021; Mao et al., 2023), regardless of the input region size, SABR has to strike a balance between regularizing early layers too little and later layers too much. In contrast, TAPS's approach of propagating the full input region through the first part of the network (the feature extractor) before using PGD for the remainder reduces regularization only in later layers. Thus, we propose STAPS by replacing the IBP components of TAPS, for both propagation and regularization, with SABR to obtain a more uniform reduction of over-regularization throughout the whole network.
STAPS, identically to SABR, first conducts a PGD attack over the whole network to find an adversarial example  $\pmb{x}^{\prime} \in \mathcal{B}(\pmb{x}^{\prime}, \epsilon - \tau)$ . Then, it propagates Box-bounds for a small region  $\mathcal{B}(\pmb{x}^{\prime}, \tau) \subset \mathcal{B}(\pmb{x}, \epsilon)$  (with  $\tau < \epsilon$ ) around this adversarial example  $\pmb{x}^{\prime}$  through the feature extractor, before, identically to TAPS, conducting an adversarial attack in the resulting latent-space region over the classifier component of the network.
In this section, we evaluate TAPS empirically, first, comparing it to a range of state-of-the-art certified training methods, before conducting an extensive ablation study validating our design choices.
Experimental Setup We implement TAPS in PyTorch (Paszke et al., 2019) and use MN-BAB (Ferrari et al., 2022) for certification. We conduct experiments on MNIST (LeCun et al., 2010), CIFAR-10 (Krizhevsky et al., 2009), and TINYIMAGENET (Le and Yang, 2015) using  $\ell_{\infty}$  perturbations and the CNN7 architecture (Gowal et al., 2018). For more experimental details including hyperparameters and computational costs and an extended analysis see App. B and App. C, respectively.
In Table 1, we compare TAPS to state-of-the-art certified training methods. Most closely related are IBP, recovered by TAPS if the classifier size is zero, and COLT, which also combines bound propagation with adversarial attacks but does not allow for joint training. TAPS dominates IBP, improving on its certified and natural accuracy in all settings and demonstrating the importance of avoiding over-regularization. Compared to COLT, TAPS improves certified accuracies significantly, highlighting the importance of joint optimization. In some settings, this comes at the cost of slightly reduced natural accuracy, potentially due to COLT's use of the more precise ZONOTOPE approximations. Compared to the recent SABR and IBP-R, TAPS often achieves higher certified accuracies at
See Fischer et al. (2019) for further discussion.
Table 1: Comparison of natural (Nat.) and certified (Cert.) accuracy on the full MNIST, CIFAR-10, and TINYIMAGENET test sets. We report results for other methods from the relevant literature.
Dataset	ε∞	Training Method	Source	Nat. [%]	Cert. [%]
MNIST	0.1	COLT	Balunovic and Vechev (2020)	99.2	97.1
IBP	Shi et al. (2021)	98.84	97.95
SORTNET	Zhang et al. (2022b)	99.01	98.14
SABR	Müller et al. (2022a)	99.23	98.22
TAPS	this work	99.19	98.39
STAPS	this work	99.15	98.37
0.3	COLT	Balunovic and Vechev (2020)	97.3	85.7
IBP	Shi et al. (2021)	97.67	93.10
SORTNET	Zhang et al. (2022b)	98.46	93.40
SABR	Müller et al. (2022a)	98.75	93.40
TAPS	this work	97.94	93.62
STAPS	this work	98.53	93.51
CIFAR-10	2/255	COLT	Balunovic and Vechev (2020)	78.4	60.5
IBP	Shi et al. (2021)	66.84	52.85
SORTNET	Zhang et al. (2022b)	67.72	56.94
IBP-R	Palma et al. (2022)	78.19	61.97
SABR	Müller et al. (2022a)	79.24	62.84
TAPS	this work	75.09	61.56
STAPS	this work	79.76	62.98
8/255	COLT	Balunovic and Vechev (2020)	51.7	27.5
IBP	Shi et al. (2021)	48.94	34.97
SORTNET	Zhang et al. (2022b)	54.84	40.39
IBP-R	Palma et al. (2022)	51.43	27.87
SABR	Müller et al. (2022a)	52.38	35.13
TAPS	this work	49.76	35.10
STAPS	this work	52.82	34.65
TINYIMAGENET	1/255	IBP	Shi et al. (2021)	25.92	17.87
SORTNET	Zhang et al. (2022b)	25.69	18.18
SABR	Müller et al. (2022a)	28.85	20.46
TAPS	this work	28.34	20.82
STAPS	this work	28.98	22.16
the cost of slightly reduced natural accuracies. Reducing regularization more uniformly with STAPS achieves higher certified accuracies in almost all settings and better natural accuracies in many, further highlighting the orthogonality of TAPS and SABR. Most notably, STAPS increases certified accuracy on TINYIMAGENET by almost  $10\%$  while also improving natural accuracy. SORTNET, a generalization of a range of recent architectures (Zhang et al., 2021, 2022c; Anil et al., 2019), introducing novel activation functions tailored to yield networks with high  $\ell_{\infty}$ -robustness, performs well on CIFAR-10 at  $\epsilon = 8/255$ , but is dominated by STAPS in every other setting.
Approximation Precision To evaluate whether TAPS yields more precise approximations of the worst-case loss than other certified training methods, we compute approximations of the maximum margin loss with IBP, PGD (50 steps, 3 restarts), SABR  $(\lambda = 0.4)$ , and TAPS on a small TAPS-trained CNN3 for all MNIST test set samples. We report histograms over the difference to the exact worst-case loss computed with a MILP encoding (Tjeng et al., 2019) in Figure 5. Positive values correspond to over-approximations while negative values correspond to under-approximation. We observe that the TAPS approximation is by far the most precise, achieving the smallest mean and mean absolute error as well as variance. We confirm these observations for other training methods in Figure 9 in App. C.
To isolate the under-approximation effect of the PGD propagation through the classifier, we visualize the distribution over pairwise bound differ
Figure 5: Distribution of the worst-case loss approximation errors over test set samples.
(a) TAPS
(b) STAPS
Figure 6: Bound difference between IBP and PGD propagation through the classifier depending on the training method.
ences between TAPS and IBP and STAPS and SABR in Figure 6 for different training methods. We observe that the distributions for TAPS and STAPS are remarkably similar (up to scaling), highlighting the importance of reducing over-regularisation of the later layers, even when propagating only small regions (SABR/STAPS). Further, we note that larger bound differences indicate reduced regularisation of the later network layers. We thus observe that SABR still induces a much stronger regularisation of the later layers than TAPS and especially STAPS, again highlighting the complementarity of TAPS and SABR, discussed in Section 3.5.
IBP Regularization To analyze the effectiveness of the multiplicative IBP regularization discussed in Section 3.4, we train with IBP in isolation  $(\mathcal{L}_{\mathrm{IBP}})$ , IBP with TAPS weighted gradients  $(w_{\mathrm{TAPS}} = 0)$ , varying levels of gradient scaling for the TAPS component  $(w_{\mathrm{TAPS}} \in [1,20])$ , TAPS with IBP weighting  $(w_{\mathrm{TAPS}} = \infty)$  and TAPS loss in isolation, reporting results in Table 2. We observe that IBP in isolation yields comparatively low standard but moderate certified accuracies with fast certification times. Increasing the weight  $w_{\mathrm{TAPS}}$  of the TAPS gradients reduces regu
Table 2: Effect of IBP regularization and the TAPS gradient expanding coefficient  $\alpha$  for MNIST  $\epsilon  = {0.3}$  .
\(w_{TAPS}\)	Avg time (s)	Nat (%)	Adv. (%)	Cert. (%)
\(\mathcal{L}_{\text{IBP}}\)	2.3	97.6	93.37	93.15
0	2.7	97.37	93.32	93.06
1	4.5	97.86	93.80	93.36
5	6.9	97.94	94.01	93.62
10	15.7	98.25	94.43	93.02
\(15^{\dagger}\)	42.8	98.53	95.00	91.55
\(20^{\dagger}\)	73.7	98.75	94.33	82.67
\(\infty^{\dagger}\)	569.7	98.0	94.00	45.00
\(\mathcal{L}_{\text{TAPS}}^{\dagger}\)	817.1	98.5	94.50	17.50
† Only evaluated on part of the test set within a 2-day time limit.
larization, leading to longer certification times and higher standard accuracies. Initially, this translates to higher adversarial and certified accuracies, peaking at  $w_{\mathrm{TAPS}} = 15$  and  $w_{\mathrm{TAPS}} = 5$ , respectively, before especially certified accuracy decreases as regularization becomes insufficient for certification. We confirm these trends for TINYIMAGENET in Table 14 in App. C.
Split Location TAPS splits a given network into a feature extractor and classifier, which are then approximated using IBP and PGD, respectively. As IBP propagation accumulates over-approximation errors while PGD is an under-approximation, the location of this split has a strong impact on the regularization level induced by TAPS. To analyze this effect, we train multiple
(a)  $\epsilon = 2 / 255$
(b)  $\epsilon = 8 / 255$
MN-BAB
CROWN-IBP
IBP
Figure 7: Effect of split location on the standard and robust accuracy of TAPS trained networks, depending on the perturbation magnitude  $\epsilon$  for different certification methods for CIFAR-10. 0 ReLUs in the classifier recovers IBP training.
CNN7s such that we obtain classifier components with between 0 and 6 (all) ReLU layers and illustrate the resulting standard, adversarial, and certified (using different methods) accuracies in Figure 7 for CIFAR-10, and in App. C for MNIST and TINYIMAGENET in Tables 11 and 13 respectively.
For small perturbations  $(\epsilon = 2 / 255)$ , increasing classifier size and thus decreasing regularization yields increasing natural and adversarial accuracy. While the precise MN-BAB verification can translate this to rising certified accuracies up to large classifier sizes, regularization quickly becomes insufficient for the less precise IBP and CROWN-IBP certification. For larger perturbations  $(\epsilon = 8 / 255)$ , the behavior is more complex. An initial increase of all accuracies with classifier size is followed by a sudden drop and slow recovery, with certified accuracies remaining below the level achieved for 1 ReLU layer. We hypothesize that this effect is due to the IBP regularization starting to dominate optimization combined with increased training difficulty (see App. C for details). For both perturbation magnitudes, gains in certified accuracy can only be realized with the precise MN-BAB certification (Müller et al., 2022a), highlighting the importance of recent developments in neural network verification for certified training.
Gradient Connector In Figure 8, we illustrate the effect of our gradient connector's parameterization  $c$  (Section 3.2). We report TAPS accuracy (the portion of samples where all latent adversarial examples are classified correctly) as a proxy for the goodness of fit. Recall that  $c = 0$  corresponds to the binary connector and  $c = 1$  to the linear connector. We observe that the binary connector achieves poor TAPS and natural accuracy, indicating a less well-behaved optimization problem. TAPS accuracy peaks at  $c = 0.5$ , indicating
high goodness-of-fit and thus a well-behaved optimization problem. This agrees well with our theoretical considerations aiming to avoid sparsity ( $c < 0.5$ ) and contradicting gradients ( $c > 0.5$ ).
Figure 8: Effect of the gradient connector on TAPS (left) and natural (right) accuracy.
Single-Estimator vs Multi-Estimator PGD To evaluate the importance of our multi-estimator PGD variant, we compare it to single-estimator PGD across a range of split positions, reporting results in Table 3. We observe that across all split positions, multi-estimator PGD achieves better certified and better or equal natural accuracy. Further, training collapses reproducibly for single-estimator PGD for small classifiers, indicating that multi-estimator PGD additionally improves training stability.
Table 3: Comparison of single- and multiestimator PGD, depending on the split position for MNIST at  $\epsilon = 0.3$
#ReLU in Classifier	Single	Multi
Certified	Natural	Certified	Natural
1	-†	31.47†	93.62	97.94
3	92.91	98.56	93.03	98.63
6	92.41	98.88	92.70	98.88
$\dagger$  Training encounters mode collapse. Last epoch performance reported.
PGD Attack Strength To investigate the effect of the adversarial attack's strength, we use 1 or 3 restarts and vary the number of attack steps used in TAPS from 1 to 100 for MNIST at  $\epsilon = 0.3$ , reporting results in Table 4. Interestingly, even a single attack step and restart are sufficient to achieve good performance and outperform IBP. As we increase the strength of the attack, we can increase certified accuracy slightly
Table 4: Effect of different PGD attack strengths for MNIST at  $\epsilon  = {0.3}$  .
# Attack Steps	1 Restart	3_Restarts
Certified	Natural	Certified	Natural
1	93.36	98.22	93.47	98.22
5	93.15	97.90	93.55	97.90
20	93.62	97.94	93.52	97.99
100	93.46	97.94	93.55	97.99
while marginally reducing natural accuracy, agreeing well with our expectation of regularization strength increasing with attack strength.
Verification Methods In this work, we only consider deterministic verification methods, which analyze a given network as is. While complete (or exact) methods (Tjeng et al., 2019; Wang et al., 2021; Zhang et al., 2022a; Ferrari et al., 2022) can decide any robustness property given enough time, incomplete methods (Singh et al., 2018; Raghunathan et al., 2018; Zhang et al., 2018; Dathathri et al., 2020; Müller et al., 2022b) sacrifice some precision for better scalability. However, recent complete methods can be used with a timeout to obtain effective incomplete methods.
Certified Training Most certified training methods compute and minimize sound overapproximations of the worst-case loss using different approximation methods: DIFFAI (Mirman et al., 2018) and IBP (Gowal et al., 2018) use Box approximations, Wong et al. (2018) use DEEPZ relaxations (Singh et al., 2018), Wong and Kolter (2018) back-substitute linear bounds using fixed relaxations, Zhang et al. (2020) use dynamic relaxations (Zhang et al., 2018; Singh et al., 2019a) and compute intermediate bounds using Box relaxations. Shi et al. (2021) significantly shorten training schedules by combining IBP training with a special initialization. Some more recent methods instead compute and optimize more precise, but not necessarily sound, worst-case loss approximations: SABR (Müller et al., 2022a) reduce the regularization of IBP training by propagating only small but carefully selected subregions. IBP-R (Palma et al., 2022) combines adversarial training at large perturbation radii with an IBP-based regularization. COLT (Balunovic and Vechev, 2020) is conceptually most similar to TAPS and thus compared to in more detail below. While prior work
combined a robust and a precise network (Müller et al., 2021; Horváth et al., 2022a), to trade-off certified and standard accuracy, these unsound certified training methods can often increase both.
COLT (Balunovic and Vechev, 2020), similar to TAPS, splits the network into a feature extractor and classifier, computing bounds on the feature extractor's output (using the ZONOTOPE (Singh et al., 2019a) instead of BOX domain) before conducting adversarial training over the resulting region. Crucially, however, COLT lacks a gradient connector and, thus, does not enable gradient flow between the latent adversarial examples and the bounds on the feature extractor's output. Therefore, gradients can only be computed for the weights of the classifier but not the feature extractor, preventing the two components from being trained jointly. Instead, a stagewise training process is used, where the split between feature extractor and classifier gradually moves through the network starting with the whole network being treated as the classifier. This has several repercussions: not only is the training very slow and limited to relatively small networks (a four-layer network takes almost 2 days to train) but more importantly, the feature extractor (and thus the whole network) is never trained specifically for precise bound propagation. Instead, only the classifier is trained to become robust to the incurred imprecisions. As this makes bound propagation methods ineffective for certification, Balunovic and Vechev (2020) employ precise but very expensive mixed integer linear programming (MILP (Tjeng et al., 2019)), further limiting the scalability of COLT.
In our experimental evaluation (Section 4.1), we compare TAPS in detail to the above methods.
Robustness by Construction Li et al. (2019), Lécuyer et al. (2019), and Cohen et al. (2019) construct probabilistic classifiers by introducing randomness into the inference process of a base classifier. This allows them to derive robustness guarantees with high probability at the cost of significant (100x) runtime penalties. Salman et al. (2019) train the base classifier using adversarial training and Horváth et al. (2022b) ensemble multiple base models to improve accuracies at a further runtime penalty. Zhang et al. (2021, 2022c) introduce  $\ell_{\infty}$ -distance neurons, generalized to SORTNET by Zhang et al. (2022b) which inherently exhibits  $\ell_{\infty}$ -Lipschitzness properties, yielding good robustness for large perturbation radii, but poor performance for smaller ones.
We propose TAPS, a novel certified training method that reduces over-regularization by constructing and optimizing a precise worst-case loss approximation based on a combination of IBP and PGD training. Crucially, TAPS enables joint training over the IBP and PGD approximated components by introducing the gradient connector to define a gradient flow through their interface. Empirically, we confirm that TAPS yields much more precise approximations of the worst-case loss than existing methods and demonstrate that this translates to state-of-the-art performance in certified training in many settings.
We would like to thank our anonymous reviewers for their constructive comments and insightful questions.
This work has been done as part of the EU grant ELSA (European Lighthouse on Secure and Safe AI, grant agreement no. 101070617) and the SERI grant SAFEAI (Certified Safe, Fair and Robust Artificial Intelligence, contract no. MB22.00088). Views and opinions expressed are however those of the authors only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the European Commission can be held responsible for them.
The work has received funding from the Swiss State Secretariat for Education, Research and Innovation (SERI).
M. Z. Horváth, M. N. Müller, M. Fischer, and M. T. Vechev, “Boosting randomized smoothing with variance reduced classifiers,” in Proc. of ICLR, 2022.
C. Brix, M. N. Müller, S. Bak, T. T. Johnson, and C. Liu, "First three years of the international verification of neural networks competition (VNN-COMP)," STTT ExPLAIn, 2023.
M. N. Müller, C. Brix, S. Bak, C. Liu, and T. T. Johnson, "The third international verification of neural networks competition (VNN-COMP 2022): Summary and results," CoRR, vol. abs/2212.10376, 2022.
G. Singh, R. Ganvir, M. Puschel, and M. T. Vechev, "Beyond the single neuron convex barrier for neural network certification," in Proc. of NeurIPS, 2019.
A Averaging Multipliers Makes Gradients Efficient
Theorem 1. Let  $x_{i}$  be i.i.d. drawn from the dataset and define  $f_{i} = f_{\theta}(x_{i})$  and  $g_{i} = g_{\theta}(x_{i})$ , where  $f_{\theta}$  and  $g_{\theta}$  are two functions. Further, define  $L_{1} = \left(\sum_{i=1}^{n} \frac{1}{n} f_{i}\right) \cdot \left(\sum_{i=1}^{n} \frac{1}{n} g_{i}\right)$  and  $L_{2} = \sum_{i=1}^{n} \frac{1}{n} f_{i} g_{i}$ . Then, assuming the function value and the gradient are independent,  $\mathbb{E}_{x}\left(\frac{\partial L_{1}}{\partial \theta}\right) = \mathbb{E}_{x}\left(\frac{\partial L_{2}}{\partial \theta}\right)$  and  $\operatorname{Var}_{x}\left(\frac{\partial L_{1}}{\partial \theta}\right) \leq \operatorname{Var}_{x}\left(\frac{\partial L_{2}}{\partial \theta}\right)$ .
Proof. A famous result in stochastic optimization is that stochastic gradients are unbiased. For completeness, we give a short proof of this property: Let  $L = \mathbb{E}_x f(x) = \int_{-\infty}^{+\infty} f(x) dP(x)$ , thus  $\nabla_x L = \nabla_x (\int_{-\infty}^{+\infty} f(x) dP(x)) = \int_{-\infty}^{+\infty} \nabla_x f(x) dP(x) = \mathbb{E}_x (\nabla_x f(x))$ . Therefore,  $\nabla f(x_i)$  is an unbiased estimator of the true gradient.
Applying that the stochastic gradients are unbiased, we can write  $\nabla_{\theta}f_{i} = \nabla_{\theta}f + \eta_{i}$ , where  $\nabla_{\theta}f$  is the expectation of the gradient and  $\eta_{i}$  is the deviation such that  $\mathbb{E}\eta_{i} = 0$  and  $\mathrm{Var}(\eta_i) = \sigma_1^2$ . Since  $x_{i}$  is drawn independently,  $f_{i}$  are independent and thus  $\eta_{i}$  are independent. Similarly, we can write  $\nabla_{\theta}g_{i} = \nabla_{\theta}g + \delta_{i}$ , where  $\mathbb{E}\delta_i = 0$  and  $\mathrm{Var}(\delta_i) = \sigma_2^2$ .  $\eta_{i}$  and  $\delta_{i}$  may be dependent.
Define  $\bar{f} = \sum_{i}\frac{1}{n} f_{i}$  and  $\bar{g} = \sum_{i}\frac{1}{n} g_{i}$ . Explicit computation gives us that  $\nabla L_1 = \bar{g}\cdot \left(\sum_i\frac{1}{n}\nabla f_i\right) + \bar{f}\cdot \left(\sum_i\frac{1}{n}\nabla g_i\right)$ , and  $\nabla L_2 = \sum_i\frac{1}{n}\left(f_i\nabla g_i + g_i\nabla f_i\right)$ . Therefore,
$$
\mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {1} \mid f _ {i}, g _ {i}\right) = \bar {g} \nabla_ {\theta} f + \bar {f} \nabla_ {\theta} g = \mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {2} \mid f _ {i}, g _ {i}\right).
$$
By the law of total probability,
$$
\begin{array}{l} \mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {1}\right) = \mathbb {E} _ {f _ {i}, g _ {i}} \left(\mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {1} \mid f _ {i}, g _ {i}\right)\right) \\ = \mathbb {E} _ {f _ {i}, g _ {i}} \left(\mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {2} \mid f _ {i}, g _ {i}\right)\right) \\ = \mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {2}\right). \\ \end{array}
$$
Therefore, we have got the first result: the gradients of  $L_{1}$  and  $L_{2}$  have the same expectation.
To prove the variance inequality, we will use variance decomposition formula:
$$
\begin{array}{l} \operatorname {V a r} _ {x} \left(\nabla_ {\theta} L _ {k}\right) = \mathbb {E} _ {f _ {i}, g _ {i}} \left(\operatorname {V a r} _ {x} \left(\nabla_ {\theta} L _ {k} \mid f _ {i}, g _ {i}\right)\right) + \\ \operatorname {V a r} _ {f _ {i}, g _ {i}} \left(\mathbb {E} _ {x} \left(\nabla_ {\theta} L _ {k} \mid f _ {i}, g _ {i}\right)\right), \\ \end{array}
$$