SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Suhas Kotha*
suhask@andrew.cmu.edu
Christopher Brix*
brix@cs.rwth-aachen.de
Zico Kolter
Krishnamurthy (Dj) Dvijotham†
dvijothamcs@gmail.com
Huan Zhang†
huan@huan-zhang.com
Most work on the formal verification of neural networks has focused on bounding the set of outputs that correspond to a given set of inputs (for example, bounded perturbations of a nominal input). However, many use cases of neural network verification require solving the inverse problem, or over-approximating the set of inputs that lead to certain outputs. We present the INVPROP algorithm for verifying properties over the preimage of a linearly constrained output set, which can be combined with branch-and-bound to increase precision. Contrary to other approaches, our efficient algorithm is GPU-accelerated and does not require a linear programming solver. We demonstrate our algorithm for identifying safe control regions for a dynamical system via backward reachability analysis, verifying adversarial robustness, and detecting out-of-distribution inputs to a neural network. Our results show that in certain settings, we find over-approximations over  $2500 \times$  tighter than prior work while being  $2.5 \times$  faster. By strengthening robustness verification with output constraints, we consistently verify more properties than the previous state-of-the-art on multiple benchmarks, including a large model with 167k neurons in VNN-COMP 2023. Our algorithm has been incorporated into the  $\alpha, \beta$ -CROWN verifier, available at https://abcrown.org.
Applying neural networks to safety-critical settings often requires reasoning about constraints on the inputs and outputs of a neural network. For example, for a physical system controlled by a neural network policy, it is of interest to understand which initial states will lead to an unsafe state such as colliding with an obstacle. Formal verification of neural networks seeks to provide provable guarantees demonstrating that networks satisfy formal specifications on their inputs and outputs. Most work to date has focused on developing algorithms that can bound the outputs of a neural network given constraints on the inputs, which can be used for applications such as analyzing the robustness of a neural network to perturbations of a given input [Wong and Kolter, 2018, Dvijotham et al., 2018, Zhang et al., 2018a, Raghunathan et al., 2018, Gehr et al., 2018].
In this work, we address the inverse problem of over-approximating a neural network's preimage: given a set of outputs  $S_{\mathrm{out}}$  (described by linear constraints on the network output), we seek to find a set that provably contains all inputs that lead to such outputs. For example, for our neural network policy, this would correspond to the states that collide with an obstacle one step in the future. Though the verification problem is already challenging due to non-convexity and high dimensionality, this new problem is even more difficult since neural networks are generally not invertible.
* Equal contribution, † Equal advising
Instructions for reproducing our results are available at https://github.com/kothasuhas/verify-input-37th Conference on Neural Information Processing Systems (NeurIPS 2023).
Specifically, representative efficient verifiers (such as state-of-the-art bound-propagation-based methods [Zhang et al., 2022]) can only compute bounds utilizing constraints on the input and critically depend on having tight bounds on intermediate activations. In the setting of this paper, however, the bounds derived from the input constraints are almost vacuous, since the only constraints on the input are that it should be from the valid input domain. We efficiently solve this problem by significantly generalizing the existing bound propagation-based verification framework, allowing one to leverage output constraints when tightening the intermediate activations. Our contributions are as follows:
- We develop an effective bound propagation framework, Inverse Propagation for Neural Network Verification (INVPROP), for the inverse verification problem for neural networks, i.e., the problem of over-approximating the set of inputs that leads to a given set of outputs. Importantly, INVPROP requires no linear programming solver and can compute bounds on any intermediate layer.
- We unify INVPROP and traditional bound propagation into a more general verification framework, allowing us to connect our method to standard tools, such as the state-of-the-art bound propagation tool  $\alpha, \beta$ -CROWN [Zhang et al., 2018a, Xu et al., 2021, Wang et al., 2021, Zhang et al., 2022, Brix et al., 2023, Muller et al., 2023]. Our contribution allows  $\alpha, \beta$ -CROWN to tighten intermediate bounds with respect to output constraints, which could not be done by the original tool.
- We demonstrate that tight inverse verification requires multiple iterative refinements of intermediate bounds. While layer bounds in standard bound propagation only depend on the bounds of their predecessors, INVPROP incorporates bounds of all layers in the network.
- We improve the state of the art on a control benchmark [Rober et al., 2022a,b] by providing  $2500 \times$  tighter bounds,  $2.5 \times$  faster, for a Double Integrator and  $257 \times$  tighter bounds,  $3.29 \times$  faster, for a 6D Quadrotor. Furthermore, we demonstrate that INVPROP can strengthen robustness verification with output constraints and verify more robustness properties in less time compared to existing tools. Finally, we demonstrate its applicability in OOD detection.
We use  $[L]$  for  $L\in \mathbb{N}$  to refer to the set  $\{1,2,\dots ,L\}$ ,  $\mathbf{W}_{\vdots,j}^{(i)}$  to refer to column  $j$  of the matrix  $\mathbf{W}^{(i)}$ ,  $[\cdot ]_{+}$  to refer to  $\max (0,\cdot)$ , and  $[\cdot ]_{-}$  to refer to  $-\min (0,\cdot)$ . We use boldface symbols for vectors and matrices (such as  $\pmb{x}^{(i)}$  and  $\mathbf{W}^{(i)}$ ) and regular symbols for scalars (such as  $x_j^{(i)}$ ). We use  $\pmb{x}\odot \pmb{y}$  to denote element-wise multiplication of vectors  $\pmb{x},\pmb{y}$ .
We define an  $L$  layer ReLU neural network by its weight matrices  $\mathbf{W}^{(i)}$  and bias vectors  $\mathbf{b}^{(i)}$  for  $i\in [L]$ . The output of the neural network for the input  $\hat{\pmb{x}}^{(0)}$  from a bounded input domain  $\mathcal{X}$  is computed by alternately applying linear layers  $\pmb{x}^{(i)} = \mathbf{W}^{(i)}\hat{\pmb{x}}^{(i - 1)} + \mathbf{b}^{(i)}$  and ReLU layers  $\hat{\pmb{x}}^{(i)} = \max (\mathbf{0},\pmb{x}^{(i)})$  until we receive the output  $\pmb{x}^{(L)}$  (which we refer to as the logits). Note that we treat softmax as a component of the loss function, not the neural network.
Given a neural network  $f: \mathcal{X} \subseteq \mathbb{R}^{\mathrm{in}} \to \mathbb{R}^{\mathrm{out}}$  and an output constraint  $S_{\mathrm{out}} \subseteq \mathbb{R}^{\mathrm{out}}$ , we want to compute  $f^{-1}(S_{\mathrm{out}}) \subseteq \mathcal{X}$ . Since precisely computing or expressing  $f^{-1}(S_{\mathrm{out}})$  is an intractable problem in general, we strive to compute a tight over-approximation  $S_{\mathrm{over}}$  such that  $f^{-1}(S_{\mathrm{out}}) \subseteq S_{\mathrm{over}}$ . In particular, we target the convex hull of the preimage via a cutting-plane representation.  $S_{\mathrm{out}}$  will be defined by a set of linear constraints parameterized by  $\mathbf{H}f(\mathbf{x}) + \mathbf{d} \leq \mathbf{0}$  in this work.
2.3 Applications
Backward Reachability Analysis for Neural Feedback Loops. Establishing safety guarantees for neural network policies is a challenging task. One problem of interest is to find a set of initial states that does not reach a particular set of future states under the neural network policy. This can be helpful in collision avoidance or control with safety constraints. For example, consider a discrete-time double integrator controller [Hu et al., 2020] where the state at time  $t + 1$  can be directly computed based on state at time  $t$  following the equation
$$
\boldsymbol {x} _ {t + 1} = f (\boldsymbol {x} _ {t}) = \left[ \begin{array}{c c} 1 & 1 \\ 0 & 1 \end{array} \right] \boldsymbol {x} _ {t} + \left[ \begin{array}{c} 0. 5 \\ 1 \end{array} \right] \pi (\boldsymbol {x} _ {t})
$$
with policy  $\pi : \mathbb{R}^2 \to \mathbb{R}$ . If there is an obstacle in the room covering the region  $[4.5, 5.0] \times [-0.25, 0.25]$ , it is of interest to understand which states will enter the unsafe region in the next time-step. We can represent this obstacle set with linear constraints that define  $S_{\mathrm{out}}$ .
$f^{-1}(\mathcal{S}_{\mathrm{out}})$  denotes the set of states  $\pmb{x}_t$  such that  $\pmb{x}_{t + 1}$  lies in the unsafe region given the control policy  $\pi$ . Overapproximating this set allows us to define the set of states to avoid one timestep in advance. We can compose  $f^{-1}$  with itself  $t$  times to obtain the set of initial states where  $\pi$  would drive the system to the unsafe set after  $t$  steps.
Robustness Verification Adversarial robustness is one classic problem for neural network verification where verifiers assess whether all perturbations of an input yield the same classification. INVPROP can be used to speed up this verification by exploiting an implicit output constraint. We follow Wang et al. [2021] and use the canonical form of verifying a property by proving that  $\min_{x\in \mathcal{X}}f(x) > 0$ .  $f(x)$  will be negative if and only if  $x$  is an adversarial example. This minimization problem can be rewritten as  $\inf_{x\in X\land f(x)\leq 0}f(x)$  [Yang et al., 2021b]. If no adversarial example exists, the infimum is computed over an empty set and returns positive infinity, indicating local robustness. If at least one adversarial example exists, the result is guaranteed to be negative. With the output constraint  $f(x)\geq 0$ , we only analyze inputs that yield an incorrect classification, reducing the search space and tightening verification bounds.
Determining what inputs lead to confident predictions. It is challenging to train a classifier that knows when it doesn't know. A simple and effective approach is to train with an additional logit representing OOD abstention. Labeled data for this additional class is generated via outlier exposure, or adding synthetic training data known to be OOD [Hendrycks et al., 2018, Chen et al., 2021].
Consider the logits  $y$  produced by a binary classifier trained in this manner. The classifier can classify in-distribution data by comparing  $y_{0}$  and  $y_{1}$ , the logits corresponding to the two in-distribution labels. The quantity  $\max(y_{0}, y_{1}) - y_{2}$ , known as the logit gap, can be used to identify out-of-distribution data (Fig. 7 in Appendix A). Can the logit gap correctly identify data far from the training data as being OOD? To answer this question, we can compute the preimage of the set
$$
\mathcal {S} _ {\text {o u t}} = \left\{\boldsymbol {y}: \max  \left(y _ {0}, y _ {1}\right) \geq y _ {2} \right\}
$$
We detail how to model this set with linear constraints in Appendix F.1. INVPROP enables us to over-approximate  $f^{-1}(S_{\mathrm{out}})$ , answering whether the classifier learned to correctly identify OOD data.
3.1 Convex over-approximation
Suppose we want to find a convex over-approximation of  $f^{-1}(\mathcal{S}_{\mathrm{out}})$ . The tightest such set is its convex hull, which is the intersection of all half-spaces that contain  $f^{-1}(\mathcal{S}_{\mathrm{out}})$  [Boyd et al., 2004]. This intersection is equivalent to  $\bigcap_{c \in \mathbb{R}^{\mathrm{in}}} \{x : c^\top x \geq \min_{f(x') \in \mathcal{S}_{\mathrm{out}}} c^\top x'\}$ , which means that we can build an over-approximation by taking this intersection for finitely many  $c$ . Furthermore, replacing the minimization problem with a lower bound to its value still yields a valid half-space, where a tighter bound yields a tighter approximation.
We focus on convex over-approximations for two reasons: First, checking that the preimage satisfies a linear constraint  $c^\top x + d \geq 0$  is equivalent to minimizing the linear function  $x \mapsto c^\top x$  over the preimage, which is in turn equivalent to minimizing the linear function over CONV  $(f^{-1}(S_{\mathrm{out}}))$  [Boyd et al., 2004]. Second, the convex hull and its tractable over-approximations are conveniently represented as intersections of linear constraints on the preimage, each of which can be quickly computed after a single precomputation phase to tighten bounds on intermediate neurons using the INVPROP algorithm outlined in the next section.
For the above reasons, we will focus on solving the following constrained optimization problem.
$$
\min  _ {\boldsymbol {x}} \quad \boldsymbol {c} ^ {\top} \boldsymbol {x}; \quad \text {s . t .} \boldsymbol {x} \in \mathcal {X}; \quad f (\boldsymbol {x}) \in S _ {\text {o u t}} \tag {1}
$$
Note that this differs from the widely studied forward verification problem, which can be phrased as
$$
\min  _ {\boldsymbol {x} \in S _ {\text {i n}}} \boldsymbol {c} ^ {\top} f (\boldsymbol {x})
$$
where  $S_{\mathrm{in}}$  is a set representing constraints on the input, and the goal of the verification is to establish that the output  $f(\pmb{x})$  satisfies a linear constraint of the form  $\pmb{c}^{\top}f(\pmb{x}) \geq d$  for all  $x \in S_{\mathrm{in}}$ .
Figure 1: Visualization of relaxations. The inner green region depicts the true  $f^{-1}(S_{\mathrm{out}})$ , the blue relaxation depicts the intersection of finite half-spaces solved via MILP, the red relaxation displays the same via LP, and the purple relaxation displays the same via INVPROP. Though this diagram displays looseness, we provide a comprehensive methodology to reduce the error in all three relaxations up to arbitrary precision (Section 3.3).
3.2 The INVPROP Algorithm
As a brief overview of our method, we first construct the Mixed Integer Linear Program (MILP) for solving this optimization problem, which generates the over-approximation  $S_{\mathrm{MILP}}$  when solved for finitely many  $c$ . Then, we relax the MILP to a Linear Program (LP), which can construct the over-approximation  $S_{\mathrm{LP}}$ . Finally, we relax the LP via its Lagrangian dual, which will be used to construct our over-approximation  $S_{\mathrm{over}}$ . This chain of relaxations is visualized in Figure 1.
The Mixed Integer Linear Programming (MILP) Formulation For feed-forward ReLU neural networks, the non-linearities from the max operator can be encoded via integer variables, and this problem admits a MILP encoding similar to prior work in adversarial robustness [Tjeng et al., 2017]. Problem (1) is equivalent to:
$$
\min  _ {\boldsymbol {x}, \hat {\boldsymbol {x}}} \quad \boldsymbol {c} ^ {\top} \boldsymbol {x} \tag {2a}
$$
$$
\text {s . t .} \quad \boldsymbol {x} \in \mathcal {X}; \quad \hat {\boldsymbol {x}} ^ {(0)} = \boldsymbol {x}; \quad \mathbf {H} \boldsymbol {x} ^ {(L)} + \mathbf {d} \leq \mathbf {0}; \tag {2b}
$$
$$
\boldsymbol {x} ^ {(i)} = \mathbf {W} ^ {(i)} \hat {\boldsymbol {x}} ^ {(i - 1)} + \mathbf {b} ^ {(i)} \quad i \in [ L ]; \tag {2c}
$$
$$
\hat {\boldsymbol {x}} ^ {(i)} = \max  \left(0, \boldsymbol {x} ^ {(i)}\right); \quad i \in [ L - 1 ] \tag {2d}
$$
The Linear Programming (LP) Formulation Unfortunately, finding an exact solution to this MILP is NP-complete [Katz et al., 2017]. To sidestep the intractability of exact verification, we can compute lower bounds for this program via its convex relaxation. We consider bounds on the outputs of intermediate layers:
$$
l _ {j} ^ {(i)} \leq x _ {j} ^ {(i)} \leq u _ {j} ^ {(i)}
$$
Based on these bounds, we can take the ReLU triangle relaxation [Ehlers, 2017] to get the LP
$$
\min  _ {\boldsymbol {x}, \hat {\boldsymbol {x}}} \quad \boldsymbol {c} ^ {\top} \boldsymbol {x} \tag {3a}
$$
$$
\text {s . t .} \quad \boldsymbol {x} \in \mathcal {X}; \quad \boldsymbol {l} ^ {(0)} \leq \boldsymbol {x} \leq \boldsymbol {u} ^ {(0)}; \quad \hat {\boldsymbol {x}} ^ {(0)} = \boldsymbol {x}; \quad \mathbf {H} \boldsymbol {x} ^ {(L)} + \mathbf {d} \leq \mathbf {0} \tag {3b}
$$
$$
\boldsymbol {x} ^ {(i)} = \mathbf {W} ^ {(i)} \hat {\boldsymbol {x}} ^ {(i - 1)} + \mathbf {b} ^ {(i)} \tag {3c}
$$
$$
\mathbf {0} \leq \hat {\boldsymbol {x}} ^ {(i)}; \quad \boldsymbol {x} ^ {(i)} \leq \hat {\boldsymbol {x}} ^ {(i)}; \quad \hat {\boldsymbol {x}} ^ {(i)} \leq \frac {\boldsymbol {u} ^ {(i)}}{\boldsymbol {u} ^ {(i)} - \boldsymbol {l} ^ {(i)}} \odot (\boldsymbol {x} ^ {(i)} - \boldsymbol {l} ^ {(i)}); \quad i \in [ L ] \tag {3d}
$$
where the bounds  $l^{(0)} \leq x \leq u^{(0)}$  are either the bounds implicit in  $\mathcal{X}$ , or a refinement of these obtained via previous rounds of bound propagation or input branching (see Algorithm 1 for details). Most efficient neural network verifiers do not solve an LP formulation of verification directly because LP solvers are often slow for problem instances involving neural networks. Instead, the bound propagation framework [Zhang et al., 2018a, Wang et al., 2021, Zhang et al., 2022] is a practical and efficient way to lower bound the LP relaxation of the forward verification problem. However, there are two major roadblocks to applying existing methods here: Typical bound-propagation cannot directly handle the output constraints (Eq. 3b) and the objective involving input layer variables (Eq. 3a). This is true for optimizing bounds on the input, intermediate layers, and the output layer, all of which need to be iteratively tightened as demonstrated later.
The Inverse Propagation (INVPROP) Formulation By changing the LP above to optimize the quantity  $\hat{x}_j^{(0)}$  (input layer) or  $x_j^{(i)}$  (intermediate layers) for  $i\in [L - 1]$ , the bounds for the  $j$ -th neuron of layer  $i$  can be tightened in separate LP calls. However, this program is too expensive to be run multiple times for each neuron.
Inspired by the success of CROWN-family neural network verifiers [Zhang et al., 2018a, Xu et al., 2021, Wang et al., 2021, Zhang et al., 2022], we efficiently lower bound the solution of the LP by optimizing its Lagrangian dual. This dual is highly structured [Wong and Kolter, 2018], allowing us to bound input half-spaces  $\pmb{c}^{\top}\pmb{x}$  and intermediate bounds  $l_{j}^{(i)}, u_{j}^{(i)}$  by closed-form expressions of the dual variables. Our main generalization is the ability to optimize input or intermediate layer bounds with the output constraints after them in the neural network, as shown in the following theorem.
Theorem 1 (Bounding input half-spaces). Given an output set  $S_{out} = \{\pmb{y} : \mathbf{H}\pmb{y} + \mathbf{d} \leq \mathbf{0}\}$  and vector  $c, g_c(\alpha, \gamma)$  is a lower bound to the linear program in (3) for  $\mathbf{0} \leq \alpha \leq \mathbf{1}, \gamma \geq \mathbf{0}$ , and  $g_c$  defined via
$$
\begin{array}{l} g _ {\boldsymbol {c}} (\boldsymbol {\alpha}, \boldsymbol {\gamma}) = \left[ \boldsymbol {c} ^ {\top} - \boldsymbol {\nu} ^ {(1) \top} \mathbf {W} ^ {(1)} \right] _ {+} \boldsymbol {l} ^ {(0)} - \left[ \boldsymbol {c} ^ {\top} - \boldsymbol {\nu} ^ {(1) \top} \mathbf {W} ^ {(1)} \right] _ {-} \boldsymbol {u} ^ {(0)} \\ - \sum_ {i = 1} ^ {L} \pmb {\nu} ^ {(i) \top} \mathbf {b} ^ {(i)} + \sum_ {i = 1} ^ {L - 1} \sum_ {j \in \mathcal {I} ^ {\pm (i)}} \left[ \frac {u _ {j} ^ {(i)} l _ {j} ^ {(i)} [ \hat {\nu} _ {j} ^ {(i)} ] _ {+}}{u _ {i} ^ {(j)} - l _ {i} ^ {(j)}} \right] \\ \end{array}
$$
where every term can be directly recursively computed via
$$
\mathcal {I} ^ {- (i)} = \{j: u _ {j} ^ {(i)} \leq 0 \}; \quad \mathcal {I} ^ {+ (i)} = \{j: l _ {j} ^ {(i)} \geq 0 \}; \quad \mathcal {I} ^ {\pm (i)} = \{j: l _ {j} ^ {(i)} <   0 <   u _ {j} ^ {(i)} \}
$$
$$
\boldsymbol {\nu} ^ {(L)} = - \boldsymbol {\gamma}; \quad \hat {\nu} _ {j} ^ {(i)} = \boldsymbol {\nu} ^ {(i + 1) \top} \mathbf {W} _ {:, j} ^ {(i + 1)} \quad \forall i \in [ L - 1 ]
$$
$$
\nu_ {j} ^ {(i)} = \left\{ \begin{array}{l l} \hat {\nu} _ {j} ^ {(i)}, & j \in \mathcal {I} ^ {+ (i)} \\ 0, & j \in \mathcal {I} ^ {- (i)} \\ \frac {u _ {j} ^ {(i)}}{u _ {i} ^ {(j)} - l _ {i} ^ {(j)}} [ \hat {\nu} _ {j} ^ {(i)} ] _ {+} - \alpha_ {j} ^ {(i)} [ \hat {\nu} _ {j} ^ {(i)} ] _ {-}, & j \in \mathcal {I} ^ {\pm (i)} \end{array} \right. \quad \forall i \in [ L - 1 ]
$$
Proof. Full proof is presented in Appendix D.
In Appendix C, we show how to bound intermediate neurons in the network using a similar approach. Since the intermediate bounds might depend on bounds on neurons in subsequent layers (due to the output constraint), we cannot simply optimize bounds in a single forward pass layer by layer, unlike prior work such as  $\alpha$ -CROWN [Xu et al., 2021]. Instead, we must iteratively tighten intermediate layer bounds with respect to the tightest bounds on all neurons computed thus far. This iterative approach can tighten the initially loose bounds by several orders of magnitude, as shown in Figure 2. After performing this procedure once, the intermediate bounds can be used to tightly lower bound  $c^\top x$  for any  $c$  via Theorem 1. Therefore, this computation can be shared across all the constraints  $c$  we use to describe  $S_{\mathrm{over}}$ . Our algorithm can be expressed in terms of forward/backward passes through layers of the neural network and implemented via standard deep learning modules in libraries like PyTorch [Paszke et al., 2019]. Since all of the operations are auto-differentiable, we can tighten our lower bound using standard gradient ascent (projected by the dual variable constraints).
Figure 2: Necessity of Iterative Tightening. Our approach enables us to iteratively tighten the bounds of all layers, with each iteration allowing for a smaller approximation ratio with respect to the true preimage. Green: Sum of bound intervals for all neurons in the third layer (second hidden layer); Blue: ratio between volumes of overapproximation and preimage. Measured for step  $t = 10$  of the control benchmark defined in Section 4.1. Note that the improvement from iterative tightening is two orders of magnitude for intermediate bounds, and four orders of magnitude for the volume of the over-approximation.
Algorithm 1 INVPROP. Can be applied to branches for non-convex overapproximations. Lower and upper bound of all neurons and all constraints are optimized using distinct  $\alpha$  and  $\gamma$  values in  $g$ .
Initialize  $l^{(i)},\pmb{u}^{(i)}$  via cheap bound propagation methods for the forward verification problem while lower bounds for  $\pmb{c}^{\top}\hat{\pmb{x}}^{(0)}$  are improving do for  $i\in \{L - 1,L - 2,\dots ,1,0\}$  do for  $j\in$  layer  $i$  neurons,  $b\in$  {lower, upper} do Optimize  $g_{ij}^{b}$  from Theorem 2 via gradient ascent to improve bound on neuron  $j$  in layer i with sense  $b$  (lower/upper) if  $b =$  upper then update  $u_{j}^{(i)}$  else update  $l_j^{(i)}$  Optimize  $g_{e}$  from Theorem 2 via gradient ascent to improve lower bound on  $\pmb{c}^{\top}\pmb{x}$  for all  $\pmb{c}$
Connection to forward verification Our bound in Theorem 1 introduces the dual variable  $\gamma$ , which enforces the output constraint during optimization. In fact, we can use this variable to get a better conceptual interpretation of our result. For the optimization problem in (1), taking the dual with respect to the constraint  $\mathbf{H}f(\mathbf{x}) + \mathbf{d} \leq \mathbf{0}$  yields the lower bound
$$
\max  _ {\boldsymbol {\gamma}} \min  _ {\boldsymbol {x}} \quad \boldsymbol {c} ^ {\top} \boldsymbol {x} + \boldsymbol {\gamma} ^ {\top} \left(\mathbf {H} f \left(\boldsymbol {x}\right) + \mathbf {d}\right)
$$
$$
\begin{array}{l l} \text {s . t .} & \boldsymbol {x} \in \mathcal {X}; \quad \gamma \geq 0 \end{array}
$$