SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\mathbf {w} _ {i} = \left\{ \begin{array}{l l} \mathbf {h} _ {i} & \text {i f} i \leq c m _ {J} \\ 0 & \text {o t h e r w i s e} \end{array} \right..
$$
We can also see that  $h'(\underline{\mathbf{x}} + \underline{\delta}) = h(\underline{\mathbf{x}} + \underline{\delta})$  for any  $\underline{\mathbf{x}} \in \mathbb{R}^{d \times 1 \times c}$  and any  $\underline{\delta}$  satisfying  $R_{\mathrm{a}}(\underline{\delta}) \leq \xi$ . Thus, we can say that the weight  $\underline{\mathbf{W}}_h$  of  $f(\underline{\mathbf{x}}; \mathbf{W}_h)$  is a feasible solution to Problem (14), i.e.,
$$
\min  _ {R _ {\mathrm {a}} (\underline {{\boldsymbol {\delta}}} _ {i}) \leq \xi} y _ {i} f (\underline {{\mathbf {x}}} _ {i} + \underline {{\boldsymbol {\delta}}} _ {i}; \underline {{\mathbf {W}}} _ {h}) \geq 1, \forall i = 1, \dots , N.
$$
Now consider the optimal solution  $\underline{\mathbf{W}}^{*} = (\mathbf{W}^{*(1)},\dots ,\underline{\mathbf{W}}^{*(L)},\underline{\mathbf{w}}^{*})$  to Problem (14). Then according to the optimality of  $\underline{\mathbf{W}}^{*}$  and the feasibility of  $\underline{\mathbf{W}}_h$  to Problem 14, we have
$$
\begin{array}{l} \left\| \underline {{\mathbf {W}}} ^ {*} \right\| _ {\mathrm {F}} ^ {2} \leq \left\| \underline {{\mathbf {W}}} _ {h} \right\| _ {\mathrm {F}} ^ {2} \leq \alpha^ {2} \cdot B _ {v} ^ {2} \cdot (J + 1) + \beta^ {2} \cdot (\operatorname {c m} _ {J}) \cdot (L - J) \tag {44} \\ = B _ {v} ^ {\frac {2 (J + 1)}{L + 1}} \left(K + 1 + \left(\operatorname {c m} _ {J}\right) (L - J)\right) \\ \end{array}
$$
$$
\min  _ {R _ {\mathrm {a}} (\underline {{\boldsymbol {\delta}}} _ {i}) \leq \xi} y _ {i} f \left(\underline {{\mathbf {x}}} _ {i} + \underline {{\boldsymbol {\delta}}} _ {i}; \underline {{\mathbf {W}}} ^ {*}\right) \geq 1, \forall i = 1, \dots , N. \tag {45}
$$
As there is an example  $(\underline{\mathbf{x}}^*, y^*)$  satisfying  $\| \underline{\mathbf{x}}^* \|_{\mathrm{F}} \leq 1$  in the training set  $S = \{(\underline{\mathbf{x}}_i, y_i)\}_{i=1}^{N} \subseteq \mathbb{R}^{d \times 1 \times c} \times \{\pm 1\}$ . Then according to Eq. (45), we have
$$
y ^ {*} f (\underline {{\mathbf {x}}} ^ {*}; \underline {{\mathbf {W}}} ^ {*}) = y ^ {*} f (\underline {{\mathbf {x}}} ^ {*} + \mathbf {0}; \underline {{\mathbf {W}}} ^ {*}) \geq \min  _ {R _ {\mathrm {a}} (\underline {{\boldsymbol {\delta}}}) \leq \xi} y ^ {*} f (\underline {{\mathbf {x}}} ^ {*} + \underline {{\boldsymbol {\delta}}}; \underline {{\mathbf {W}}} ^ {*}) \geq 1,
$$
$$
\begin{array}{l} 1 \leq f (\underline {{\mathbf {x}}} ^ {*}) \leq \| \underline {{\mathbf {x}}} ^ {*} \| _ {\mathrm {F}} \| \mathbf {w} ^ {*} \| _ {2} \prod_ {l = 1} ^ {L} \left\| \underline {{\mathbf {W}}} ^ {* (l)} \right\| _ {\mathrm {s p}} \leq \| \mathbf {w} ^ {*} \| _ {2} \prod_ {l = 1} ^ {L} \left\| \underline {{\mathbf {W}}} ^ {* (l)} \right\| _ {\mathrm {s p}} \\ \leq \left(\frac {1}{L + 1} \left(\| \mathbf {w} ^ {*} \| _ {2} + \sum_ {l = 1} ^ {L} \left\| \underline {{\mathbf {W}}} ^ {* (l)} \right\| _ {\mathrm {s p}}\right)\right) ^ {1 / (L + 1)} \\ \end{array}
$$
indicating that
$$
\frac {1}{L + 1} \left(\| \mathbf {w} ^ {*} \| _ {2} + \sum_ {l = 1} ^ {L} \left\| \underline {{\mathbf {W}}} ^ {* (l)} \right\| _ {\mathrm {s p}}\right) > 1.
$$
On the other hand, according to Eq. (44) and Lemma 25, we have
$$
\left\| \underline {{\mathbf {W}}} ^ {* (1)} \right\| _ {\mathrm {F}} = \dots = \left\| \underline {{\mathbf {W}}} ^ {* (L)} \right\| _ {\mathrm {F}} = \| \mathbf {w} ^ {*} \| _ {2} \leq \left(\frac {1}{(L + 1)} B _ {v} ^ {\frac {2 (J + 1)}{L + 1}} \left(K + 1 + (\operatorname {c m} _ {J}) (L - J)\right)\right) ^ {1 / 2}.
$$
$$
\frac {1}{L + 1} \left(\frac {\| \mathbf {w} ^ {*} \| _ {2}}{\| \mathbf {w} ^ {*} \| _ {2}} + \sum_ {l = 1} ^ {L} \frac {\left\| \underline {{\mathbf {W}}} ^ {* (l)} \right\| _ {\mathrm {s p}}}{\left\| \underline {{\mathbf {W}}} ^ {* (l)} \right\| _ {\mathrm {F}}}\right) \geq \left(\frac {1}{B _ {v}}\right) ^ {\frac {J + 1}{L + 1}} \sqrt {\frac {L + 1}{(J + 1) + (\mathrm {c m} _ {J}) (L - J)}}.
$$
$$
\left\| \mathbf {W} ^ {(l)} \right\| _ {\mathrm {F}} = \left\| \widetilde {\mathbf {W}} _ {M} ^ {* (l)} \right\| _ {\mathrm {F}} \quad \text {a n d} \quad \left\| \mathbf {W} ^ {(l)} \right\| _ {\mathrm {s p}} = \left\| \widetilde {\mathbf {W}} _ {M} ^ {* (l)} \right\|,
$$
where  $\widetilde{\mathbf{W}}_M^{*(l)}$  denotes the  $M$ -block-diagonal matrix of weight tensor  $\underline{\mathbf{W}}^{*(l)}$ . Then, we have
$$
\frac {1}{L} \sum_ {l = 1} ^ {L} \frac {\left\| \widetilde {\mathbf {W}} _ {M} ^ {* (l)} \right\|}{\left\| \widetilde {\mathbf {W}} _ {M} ^ {* (l)} \right\| _ {\mathrm {F}}} \geq \left(1 + \frac {1}{L}\right) \left(\frac {1}{B _ {v}}\right) ^ {\frac {J + 1}{L + 1}} \sqrt {\frac {L + 1}{(J + 1) + (\mathbf {c m} _ {J}) (L - J)}} - \frac {1}{L}.
$$
Taking the reciprocal of both sides gives
$$
\frac {L}{\sum_ {l = 1} ^ {L} \left(r _ {\mathrm {s t b}} \left(\widetilde {\mathbf {W}} _ {M} ^ {* (l)}\right)\right) ^ {- 1 / 2}} \leq \frac {1}{\left(1 + \frac {1}{L}\right) \left(\frac {1}{B _ {v}}\right) ^ {\frac {J + 1}{L + 1}} \sqrt {\frac {L + 1}{(J + 1) + (c m _ {J}) (L - J)}} - \frac {1}{L}}.
$$
Lemma 25. For every  $1 \leq i, j \leq L$ , we have  $\left\| \underline{\mathbf{W}}^{*(i)} \right\|_{\mathrm{F}} = \left\| \underline{\mathbf{W}}^{*(j)} \right\|_{\mathrm{F}} = \| \mathbf{w}^{*} \|_2$ .
Proof. Let  $1 \leq i < j \leq L$ . For  $\mu > 0$ , we define a t-NN  $f_{\mu}(\underline{\mathbf{x}}; \underline{\mathbf{V}})$  with weights  $\underline{\mathbf{V}} = (\underline{\mathbf{V}}^{(1)}, \dots, \underline{\mathbf{V}}^L, \mathbf{v})$  which are constructed from  $f(\underline{\mathbf{x}}; \underline{\mathbf{W}}^*)$  whose weights  $\underline{\mathbf{W}}^* = (\underline{\mathbf{W}}^{*(1)}, \dots, \underline{\mathbf{W}}^{*(L)}, \underline{\mathbf{w}}^*)$  is an optimal solution to Problem (14). Specifically, the construction of  $\underline{\mathbf{V}} = (\underline{\mathbf{V}}^{(1)}, \dots, \underline{\mathbf{V}}^L, \mathbf{v})$  is given as follows:
$$
\forall l = 1, \dots , L, \quad \underline {{\mathbf {V}}} ^ {(l)} = \left\{ \begin{array}{c l} \underline {{\mathbf {W}}} ^ {* (l)} & \text {i f} l \neq i \text {a n d} 1 \neq j \\ \mu \underline {{\mathbf {W}}} ^ {* (i)} & \text {i f} l = i \\ \mu^ {- 1} \underline {{\mathbf {W}}} ^ {* (j)} & \text {i f} 1 = j \end{array} \right..
$$
Note that for every input example  $\underline{\mathbf{x}}$  and perturbation  $\underline{\delta}$ ,  $f_{\mu}(\underline{\mathbf{x}} + \underline{\delta}; \underline{\mathbf{V}}) = f(\underline{\mathbf{x}} + \underline{\delta}; \underline{\mathbf{W}}^*)$ , then  $\underline{\mathbf{V}}$  is also feasible to Problem (14). Note that we have
$$
\frac {\mathrm {d}}{\mathrm {d} \mu} \left(\left\| \mu \underline {{\mathbf {W}}} ^ {* (i)} \right\| _ {\mathrm {F}} ^ {2} + \left\| \mu^ {- 1} \underline {{\mathbf {W}}} ^ {* (j)} \right\| _ {\mathrm {F}} ^ {2}\right) = 2 \mu \left\| \underline {{\mathbf {W}}} ^ {* (i)} \right\| _ {\mathrm {F}} ^ {2} - 2 \mu^ {- 3} \left\| \underline {{\mathbf {W}}} ^ {* (j)} \right\| _ {\mathrm {F}} ^ {2}.
$$
When  $\mu = 1$  the above expression equals  $2\left\| \underline{\mathbf{W}}^{*(i)}\right\|_{\mathrm{F}}^{2} - 2\left\| \underline{\mathbf{W}}^{*(j)}\right\|_{\mathrm{F}}^{2}$ . Hence, if  $\left\| \underline{\mathbf{W}}^{*(i)}\right\|_{\mathrm{F}} \neq \left\| \underline{\mathbf{W}}^{*(j)}\right\|_{\mathrm{F}}$ , then the derivative at  $\mu$  is non-zero, which leads to a contradiction to the optimality of  $\underline{\mathbf{W}}^{*}$  to Problem (14). Note that if we consider changing norms of  $\underline{\mathbf{W}}^{*(i)}$  and  $\mathbf{w}$  instead of  $\underline{\mathbf{W}}^{*(i)}$  and  $\underline{\mathbf{W}}^{*(j)}$ , the same conclusion also holds. Thus, the optimality of  $\underline{\mathbf{W}}^{*}$  strictly leads to  $\left\| \underline{\mathbf{W}}^{*(i)}\right\|_{\mathrm{F}} = \left\| \underline{\mathbf{W}}^{*(j)}\right\|_{\mathrm{F}} = \left\| \mathbf{w}^{*}\right\|_{2}$ .
E Generalization bound of approximately low-tubal-rank t-NNs
Proof of Theorem 12. Given a  $(\delta, \mathbf{r})$ -approximately low-tubal-rank parameterized t-NN  $f(\underline{\mathbf{x}}; \underline{\mathbf{W}}) \in \mathfrak{F}_{\delta, \mathbf{r}} \subset \mathfrak{F}_{\delta, \mathbf{r}}$ , let  $g(\underline{\mathbf{x}}; \underline{\mathbf{W}}_{\mathbf{r}}) \in \mathfrak{F}_{\mathbf{r}}$  be its compressed version whose t-product layer weight tensors have tubal-ranks upper bounded by  $\mathbf{r}$ .
Step 1: Upper bound the adversarial empirical  $L_{2}$ -distance between  $f$  and  $g$ . Consider function  $g(\underline{\mathbf{x}}) = g(\underline{\mathbf{x}}; \underline{\mathbf{W}}_{\mathbf{r}})$  parameterized by  $\underline{\mathbf{W}}_{\mathbf{r}} = (\underline{\mathbf{W}}_{r_1}^{(1)}, \dots, \underline{\mathbf{W}}_{r_L}^{(L)}, \mathbf{w})$  as the function whose t-product layer weights are low-tubal-rank approximations of  $f(\underline{\mathbf{x}}; \underline{\mathbf{W}})$ . Let  $\tilde{f}(\underline{\mathbf{x}}, y) = \inf_{R_{\mathrm{a}}(\underline{\mathbf{x}} - \underline{\mathbf{x}}') \leq \xi} yf(\underline{\mathbf{x}}')$  and  $\tilde{g}(\underline{\mathbf{x}}, y) = \inf_{R_{\mathrm{a}}(\underline{\mathbf{x}} - \underline{\mathbf{x}}') \leq \xi} yg(\underline{\mathbf{x}}')$  denote the adversarial versions of  $f$  and  $g$ , respectively.
We first bound the adversarial empirical  $L_{2}$ -distance between  $f$  and  $g$  as follows.
$$
| \tilde {f} (\underline {{\mathbf {x}}} _ {i}, y _ {i}) - \tilde {g} (\underline {{\mathbf {x}}} _ {i}, y _ {i}) | = | \inf  _ {R _ {\mathrm {a}} (\underline {{\mathbf {x}}} _ {i} - \underline {{\mathbf {x}}} _ {i} ^ {\prime}) \leq \xi} y _ {i} f (\underline {{\mathbf {x}}} _ {i} ^ {\prime}) - \inf  _ {R _ {\mathrm {a}} (\underline {{\mathbf {x}}} _ {i} - \underline {{\mathbf {x}}} _ {i} ^ {\prime}) \leq \xi} y _ {i} g (\underline {{\mathbf {x}}} _ {i} ^ {\prime}) |.
$$
Letting  $\underline{\mathbf{x}}_i^f = \operatorname{arginf}_{R_{\mathrm{a}}(\underline{\mathbf{x}}_i - \underline{\mathbf{x}}_i') \leq \xi} y_i f(\underline{\mathbf{x}}_i')$  and  $\underline{\mathbf{x}}_i^g = \operatorname{arginf}_{R_{\mathrm{a}}(\underline{\mathbf{x}}_i - \underline{\mathbf{x}}_i') \leq \xi} y_i g(\underline{\mathbf{x}}_i')$ , we have  $|\tilde{f}(\underline{\mathbf{x}}_i, y_i) - \tilde{g}(\underline{\mathbf{x}}_i, y_i)| = |y_i f(\underline{\mathbf{x}}_i^f) - y_i g(\underline{\mathbf{x}}_i^g)|$ . By letting
$$
\underline {{\mathbf {x}}} _ {i} ^ {\xi} = \left\{ \begin{array}{l l} \underline {{\mathbf {x}}} _ {i} ^ {g} & \text {i f} y _ {i} f (\underline {{\mathbf {x}}} _ {i} ^ {f}) \geq y _ {i} g (\underline {{\mathbf {x}}} _ {i} ^ {g}) \\ \underline {{\mathbf {x}}} _ {i} ^ {f} & \text {o t h e r w i s e} \end{array} \right.,
$$
$$
| \tilde {f} (\underline {{\mathbf {x}}} _ {i}, y _ {i}) - \tilde {g} (\underline {{\mathbf {x}}} _ {i}, y _ {i}) | = | y _ {i} f (\underline {{\mathbf {x}}} _ {i} ^ {f}) - y _ {i} g (\underline {{\mathbf {x}}} _ {i} ^ {g}) | \leq | y _ {i} f (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) - y _ {i} g (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) | = | f (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) - g (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) |.
$$
Let  $h_l(\underline{\mathbf{x}}^\xi) = \mathbf{w}^\top_{\mathrm{vec}}\left(\sigma(\underline{\mathbf{W}}_{r_l}^{(L)}) *_M \sigma(\underline{\mathbf{W}}_{r-1}^{(L-1)}) *_M \cdots *_M \sigma(\underline{\mathbf{W}}_r^{(l+1)}) *_M \sigma(\underline{\mathbf{W}}^ {(l)} *_M \cdots *_M \sigma(\underline{\mathbf{W}}^{(1)} *_M \right.$
$\left.\underline{\mathbf{x}}^{\xi}\right)\cdot \cdot \cdot \left.\right)$  ) and  $h_0(\underline{\mathbf{x}}^\xi) = g(\underline{\mathbf{x}}^\xi)$  . Then, we have
$$
| f (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) - g (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) | \leq \sum_ {l = 1} ^ {L} | h _ {l} (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) - h _ {l - 1} (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) |.
$$
We can see that for any  $l = 1,\dots ,L$
$$
\left\| \sigma (\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}) \dots)) \right\| _ {\mathrm {F}} \leq \prod_ {l ^ {\prime} = 1} ^ {l - 1} \left\| \underline {{\mathbf {W}}} ^ {(l ^ {\prime})} \right\| _ {\mathrm {F}} \left\| \underline {{\mathbf {x}}} _ {i} ^ {\xi} \right\| _ {\mathrm {F}} \leq \prod_ {l ^ {\prime} = 1} ^ {l - 1} \left\| \underline {{\mathbf {W}}} ^ {(l ^ {\prime})} \right\| _ {\mathrm {F}} B _ {x, R _ {\mathrm {a}}, \xi},
$$
$$
\begin{array}{l} \left\| \sigma (\underline {{\mathbf {W}}} _ {r _ {l}} ^ {(l)} * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(1 - 1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}) \dots)) - \sigma (\underline {{\mathbf {W}}} ^ {(l)} * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}) \dots)) \right\| _ {\mathrm {F}} \\ \leq \left\| \underline {{\mathbf {W}}} _ {r _ {l}} ^ {(l)} * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}) \dots) - \underline {{\mathbf {W}}} ^ {(l)} * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma (\underline {{\mathbf {W}}} ^ {(1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}) \dots)\right\| _ {\mathrm {F}} \\ = \left\| \left(\underline {{\mathbf {W}}} _ {r _ {l}} ^ {(l)} - \underline {{\mathbf {W}}} ^ {(l)}\right) * _ {M} \sigma \left(\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma \left(\underline {{\mathbf {W}}} ^ {(1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}\right) \dots\right) \right\| _ {\mathrm {F}} \\ \leq \left\| \underline {{\mathbf {W}}} _ {r _ {l}} ^ {(l)} - \underline {{\mathbf {W}}} ^ {(l)} \right\| _ {\mathrm {F}} \left\| \sigma \left(\underline {{\mathbf {W}}} ^ {(l - 1)} * _ {M} \dots * _ {M} \sigma \left(\underline {{\mathbf {W}}} ^ {(1)} * _ {M} \underline {{\mathbf {x}}} _ {i} ^ {\xi}\right) \dots\right) \right\| _ {\mathrm {F}} \\ \leq \delta_ {l} \prod_ {l ^ {\prime} = 1} ^ {l} \left\| \underline {{\mathbf {W}}} ^ {(l ^ {\prime})} \right\| _ {\mathrm {F}} B _ {x, R _ {\mathrm {a}}, \xi}. \\ \end{array}
$$
$$
\left| h _ {l} \left(\underline {{\mathbf {x}}} _ {i} ^ {\xi}\right) - h _ {l - 1} \left(\underline {{\mathbf {x}}} _ {i} ^ {\xi}\right) \right| \leq B _ {\mathbf {w}} \prod_ {j \neq l} B _ {j} \delta B _ {x, R _ {\mathrm {a}}, \xi} = \frac {\delta B _ {\tilde {f}}}{B _ {l}}.
$$
$$
| f (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) - g (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) | \leq \sum_ {l = 1} ^ {L} | h _ {l} (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) - h _ {l - 1} (\underline {{\mathbf {x}}} _ {i} ^ {\xi}) | \leq \sum_ {l = 1} ^ {L} \frac {\delta B _ {\tilde {f}}}{B _ {l}}.
$$
Then, we can set
$$
\hat {\mathfrak {r}} = \delta B _ {\tilde {f}} \sum_ {l = 1} ^ {L} B _ {l} ^ {- 1}. \tag {46}
$$
Step 2: Divide and conquer the adversarial gap. To upper bound the adversarial gap  $\mathcal{L}^{\mathrm{adv}}(f) - \hat{\mathcal{L}}^{\mathrm{adv}}(f)$  of  $f$  by using the properties of its compressed version  $g$ , we first decompose the adversarial gap into three terms as follows
$$
\begin{array}{l} \mathcal {L} ^ {\mathrm {a d v}} (f) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (f) \\ = \underbrace {\left[ \left(\mathcal {L} ^ {\mathrm {a d v}} (f) - \mathcal {L} ^ {\mathrm {a d v}} (g)\right) - \left(\hat {\mathcal {L}} ^ {\mathrm {a d v}} (f) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (g)\right) \right]} _ {\mathbf {I}} + \underbrace {\left(\mathcal {L} ^ {\mathrm {a d v}} (g) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (g)\right)} _ {\mathbf {I I}}. \tag {47} \\ \end{array}
$$
Step 2.1: Upper bound  $\mathbf{II}$ . We first consider the event  $\mathcal{E}_1$  in which term  $\mathbf{II}$  is upper bounded with high probability. As  $g\in \mathfrak{F}_{\mathbf{r}}$ , the term  $\mathbf{II}$  has already been upper bounded according to Theorem 6 as
$$
\mathbf {I I} \leq \frac {C ^ {\prime} L _ {\ell} B _ {\tilde {f}}}{\sqrt {N}} \sqrt {\mathrm {c} \sum_ {l = 1} ^ {L} r _ {l} \left(d _ {l - 1} + d _ {l}\right) \log (9 (L + 1))} + 3 B \sqrt {\frac {t}{2 N}}, \tag {48}
$$
with high probability  $1 - 2e^{-t}$
Step 2.2: Upper bound I. Note that term I can be written as
$$
\begin{array}{l} \mathcal {L} ^ {\mathrm {a d v}} (f) - \mathcal {L} ^ {\mathrm {a d v}} (g) - (\hat {\mathcal {L}} ^ {\mathrm {a d v}} (f) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (g)) \\ = \frac {1}{N} \sum_ {i = 1} ^ {N} \left(\ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) - \mathbb {E} [ \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) ]\right). \tag {49} \\ \end{array}
$$
Step (2.2.1): Characterize the concentration behavior of  $\ell \circ \tilde{f} -\ell \circ \tilde{g}$ . Given a constant  $\mathfrak{r} > 0$ , consider the event  $\mathcal{E}_2(\mathfrak{r})$  in which  $\left\| \tilde{f} -\tilde{g}\right\|_{L_2}\leq \mathfrak{r}$  already holds with high probability. Then, conditioned on Event  $\mathcal{E}_2(\mathfrak{r})$ , by using the  $L_{\ell}$ -Lipschitz continuity of the loss function  $\ell (\cdot ,\cdot)$  derived from Assumption 2, it can be proved that  $\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y)$  also has a small population  $L_{2}$ -norm with high probability.
Regarding Eq. (49), it is natural to characterize the concentration behavior of centered random variable  $\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y) - \mathbb{E}[\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y)]$ .
- First, its variance under event  $\mathcal{E}_2$  can be upper bounded by
$$
\begin{array}{l} \sup_{\| \tilde{f} -\tilde{g}\|_{L_{2}}\leq \mathfrak{r}}\operatorname {Var}\left(\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y) - \mathbb{E}[\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y)]\right) \\ = \sup  _ {\left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} \operatorname {V a r} \left(\ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y)\right) \\ = \sup  _ {\left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} \mathbb {E} _ {(\underline {{\mathbf {x}}}, y)} \left[ (\ell (\tilde {f} (\underline {{\mathbf {x}}}, y)) - \ell (\tilde {g} (\underline {{\mathbf {x}}}, y))) ^ {2} - \mathbb {E} _ {(\underline {{\mathbf {x}}}, y)} [ \ell (\tilde {f} (\underline {{\mathbf {x}}}, y)) - \ell (\tilde {g} (\underline {{\mathbf {x}}}, y)) ] \right] \\ \leq \sup  _ {\| \tilde {f} - \tilde {g} \| _ {L _ {2}} \leq \mathfrak {r}} \mathbb {E} _ {(\underline {{\mathbf {x}}}, y)} \left[ \ell (\tilde {f} (\underline {{\mathbf {x}}}, y)) - \ell (\tilde {g} (\underline {{\mathbf {x}}}, y)) \right] ^ {2} \\ \leq \sup _ {\left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} L _ {\ell} ^ {2} \mathbb {E} _ {(\underline {{\mathbf {x}}}, y)} \left[ \tilde {f} (\underline {{\mathbf {x}}}, y) - \tilde {g} (\underline {{\mathbf {x}}}, y) \right] ^ {2} \\ = \sup_{\| \tilde{f} -\tilde{g}\|_{L_{2}}\leq \mathfrak{r}}L_{\ell}^{2}\left\| \tilde{f} -\tilde{g}\right\|_{L_{2}}^{2} \\ \leq L _ {\ell} ^ {2} \mathfrak {r} ^ {2} \\ \end{array}
$$
- Second, we upper bound its  $L_{\infty}$ -norm. First, Lemma 39 indicates that for any  $h \in \mathfrak{F}$  with adversarial version  $\tilde{h} \in \mathfrak{F}^{\mathrm{adv}}$ , we have  $\left\| \tilde{h} \right\|_{L_{\infty}} \leq B_{\tilde{f}} := B_{\underline{\mathbf{W}}}B_{x,R_{\mathrm{a}},\xi}$ . Then, by  $\mathfrak{F}_{\mathbf{r}} \subset \mathfrak{F}_{\delta,\mathbf{r}} \subset \mathfrak{F}$ , we have  $\left\| \tilde{f} \right\|_{L_{\infty}} \leq B_{\tilde{f}}$  and  $\| \tilde{g} \|_{L_{\infty}} \leq B_{\tilde{f}}$ . Therefore, we can upper bound
the  $L_{\infty}$ -norm of  $\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y) - \mathbb{E}[\ell (\tilde{f} (\underline{\mathbf{x}}),y) - \ell (\tilde{g} (\underline{\mathbf{x}}),y)]$  as follows
$$
\begin{array}{l} \sup _ {\left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} \left\| \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) - \mathbb {E} [ \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) ] \right\| _ {L _ {\infty}} \\ \leq \sup _ {\left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} \left\| \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) \right\| _ {L _ {\infty}} + \left\| \mathbb {E} [ \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) ] \right\| _ {L _ {\infty}} \\ \leq \sup _ {\| \tilde {f} - \tilde {g} \| _ {L _ {2}} \leq \mathfrak {r}} \left\| \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) \right\| _ {L _ {\infty}} + \mathbb {E} \left[ \left\| \ell (\tilde {f} (\underline {{\mathbf {x}}}), y) - \ell (\tilde {g} (\underline {{\mathbf {x}}}), y) \right\| _ {L _ {\infty}} \right] \\ \leq \sup_{\| \tilde{f} -\tilde{g}\|_{L_{2}}\leq \mathfrak{r}}L_{\ell}\sup_{(\underline{\mathbf{x}},y)}|y\tilde{f} (\underline{\mathbf{x}})) - y\tilde{g} (\underline{\mathbf{x}})| + \mathbb{E}\big[L_{\ell}\sup_{(\underline{\mathbf{x}},y)}|y\tilde{f} (\underline{\mathbf{x}}) - y\tilde{g} (\underline{\mathbf{x}})|\big] \\ \leq \sup_{\| \tilde{f} -\tilde{g}\|_{L_{2}}\leq \mathfrak{r}}}4L_{\ell}B_{\tilde{f}}. \\ \end{array}
$$
Then, the Talagrand's concentration inequality (Lemma 35) yields that with probability at least  $1 - e^{-t}$ :
$$
\begin{array}{l} \sup  \quad \left(\mathcal {L} ^ {\mathrm {a d v}} (f) - \mathcal {L} ^ {\mathrm {a d v}} (g)\right) - \left(\hat {\mathcal {L}} ^ {\mathrm {a d v}} (f) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (g)\right) \\ \left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r} \\ \leq 2 \mathbb {E} \underbrace {\left[ \sup _ {\left\| \tilde {f} - \hat {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} (\mathcal {L} ^ {\mathrm {a d v}} (f) - \mathcal {L} ^ {\mathrm {a d v}} (g)) - (\hat {\mathcal {L}} ^ {\mathrm {a d v}} (f) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (g)) \right]} _ {(\mathbf {I})} + \frac {\sqrt {2 t} L _ {\ell} \mathfrak {r}}{\sqrt {N}} + \frac {8 t L _ {\ell} B _ {\tilde {f}}}{N}. \\ \end{array}
$$
Then, by the standard symmetrization argument [47], we obtain an upper bound on term (I) as follows:
$$
\begin{array}{l} \mathbb {E} \left[ \sup  _ {\left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r}} \left(\mathcal {L} ^ {\mathrm {a d v}} (f) - \mathcal {L} ^ {\mathrm {a d v}} (g)\right) - \left(\hat {\mathcal {L}} ^ {\mathrm {a d v}} (f) - \hat {\mathcal {L}} ^ {\mathrm {a d v}} (g)\right) \right] \\ \leq 2 \mathbb {E} _ {(\underline {{\mathbf {x}}} _ {i}, y _ {i}) _ {i = 1} ^ {N}} \mathbb {E} _ {(\varepsilon_ {i}) _ {i = 1} ^ {N}} \sup  _ {\| \tilde {f} - \tilde {g} \| _ {L _ {2}} \leq \mathrm {r}} \left[ \frac {1}{N} \varepsilon_ {i} \left(\ell (\tilde {f} (\underline {{\mathbf {x}}} _ {i}, y _ {i})) - \ell (\tilde {g} (\underline {{\mathbf {x}}} _ {i}, y _ {i}))\right) \right] \tag {50} \\ = 2 \Phi (\mathfrak {r}), \\ \end{array}
$$
where  $\Phi (\mathfrak{r})$  is defined as
$$
\Phi (\mathfrak {r}) := \bar {R} _ {N} \left(\left\{\ell \circ \tilde {f} - \ell \circ \tilde {g} \mid \tilde {f} \in \mathfrak {F} _ {\delta , \mathbf {r}} ^ {\mathrm {a d v}}, \tilde {g} \in \mathfrak {F} _ {\mathbf {r}} ^ {\mathrm {a d v}}, \left\| \tilde {f} - \tilde {g} \right\| _ {L _ {2}} \leq \mathfrak {r} \right\}\right).
$$