Invariance and Inverse Stability under ReLU

1 INTRODUCTION . Invariance and stability/robustness are two of the most important properties characterizing the behavior of a neural network . Due to growing requirements like robustness to adversarial examples ( Szegedy et al. , 2014 ) and the increasing use of deep learning in safety-critical applications , there has been a surge in interest in these properties . Invariance and stability are considered to be the key mechanisms in dealing with uninformative properties of the input ( Achille & Soatto , 2017 ; Mallat , 2016 ) and are studied from the information theoretical perspective in form of the loss of information about the input ( Tishby & Zaslavsky , 2015 ; Saxe et al. , 2018 ) . Invariance and stability are also tightly linked to robustness against adversarial attacks ( Cisse et al. , 2017 ; Tsuzuku et al. , 2018 ; Simon-Gabriel et al. , 2018 ) , generalization ( Sokolić et al. , 2017 ; Gouk et al. , 2018 ) and even the training of Generative Adversarial Networks ( Miyato et al. , 2018 ) . In general , stability is studied via two basic properties : 1 ) locally via a norm of the Jacobian ( Sokolić et al. , 2017 ; Simon-Gabriel et al. , 2018 ) , 2 ) globally via the Lipschitz constant ( Cisse et al. , 2017 ; Miyato et al. , 2018 ; Tsuzuku et al. , 2018 ) . From a high-level perspective , both of these approaches study an upper bound on stability as the Lipschitz constant and a Jacobian norm quantifies the highest possible change under a perturbation with a given magnitude . We , unlike the approaches above , aim to broaden our understanding by analyzing the lowest possible change under a perturbation . More formally , we study which perturbations ∆x do not ( or only little ) affect the outcome of a network F . Our analysis considers a given input data point x and investigates the ∆x ’ s , such that F ( x ) = F ( x+ ∆x ) ( invariant ) or ‖F ( x ) − F ( x+ ∆x ) ‖ ≤ ε ( stable ) , where a small ε > 0 is given . While these properties can be crucial for many discriminative tasks ( Mallat , 2016 ) , the model could be flawed if perturbations that alter the semantics have only a minor impact on the features . This is a reverse perspective on adversarial examples ( Szegedy et al. , 2014 ) , which commonly considers small input perturbations that lead to large changes and thus to arbitrary decisions of the network . This flipped view and the study of smallest changes calls for a different approach : we study the instabilities of the inverse instead of the stabilities of the forward mapping . In particular , if F is invariant to perturbations ∆x , then x and x+∆x lie in the preimage of the output z = F ( x ) , i.e . F is not uniquely invertible . Robustness towards large perturbations induces an instable inverse mapping as small changes in the output can be due to large changes in the input . Based on the piecewise linear nature of ReLU networks ( Montufar et al. , 2014 ) , we characterize the preimage of ReLU-activations as a single point , finite ( bounded ) or infinite ( unbounded ) . Further , we study the stability of the linearization of rectifier networks via its singular values . To illustrate these locally changing properties and to demonstrate their tight connection , we visualize the behavior on a synthetic problem in Figure 1 . Our contributions are as follows : • We derive conditions when the preimage of an output of a ReLU-layer has finite or infinite volume or is a single point . Based on these conditions , we derive an algorithm to check these conditions and exemplify its usability by applying it to investigate the preimages of a trained network . ( See Section 2 . ) • We study the stability of the inverse via analyzing the linearization at a point in input space , which is accurate within a polytope . We provide upper bounds on the smallest singular value of a linearization and prove how the removal of uncorrelated features could effect the stability of the inverse mapping . Based on these ideas , we experimentally demonstrate how singular values evolve over the different layers in rectifier networks . ( See Section 3 . ) • We introduce a reverse view on adversarial examples and connect it to invariance and robustness by leveraging our analysis of preimages . ( see Section 5 ) 1.1 RELATED WORK . While analyzing invariance and robustness properties is a major topic in theoretical treatments of deep networks ( Mallat , 2016 ) , studying it via the inverse is less common . Several works like Mahendran & Vedaldi ( 2015 ) , Mahendran & Vedaldi ( 2016 ) or Dosovitskiy & Brox ( 2016 ) focus on reconstructing inputs from features of convolutional neural networks ( CNNs ) to visualize the information content of features . Instead , we investigate potential mechanisms affecting the invertibility . Carlsson et al . ( 2017 ) gives a first geometrical view on the shape of preimages of outputs from ReLU layers , which is directly related to the question of injectivity of the mapping under ReLU . Shang et al . ( 2016 ) analyzes the reconstruction property of cReLU ( concatenated ReLU ) ; however , the more general situation of using the standard rectifier is not studied . A notable other line of work assumes random weights in order to derive guarantees for invertibility , see Gilbert et al . ( 2017 ) or Arora et al . ( 2015 ) , whereas we focus on the preimage of ReLU-activations without assumptions on the weights . Moreover , several reversible network structures were recently proposed ( Gomez et al. , 2017 ; Chang et al. , 2018 ; Jacobsen et al. , 2018 ) . Most notably , in Jacobsen et al . ( 2018 ) a bijective network , up to its last layer , was trained successfully on ImageNet which does not exhibit any invariance . However , the network is very robust towards many directions in the input which is reflected in a strongly instable inverse . Hence , even carefully designed network show at least one of the two effects ( invariance and robustness ) studied in this work . Especially stability has seen growing interest due to adversarial examples ( Szegedy et al. , 2014 ) , yet stability is mostly studied with respect to the forward mapping , see e.g . Cisse et al . ( 2017 ) . Two main resources for our view of rectifier networks as piecewise linear models are Montufar et al . ( 2014 ) and Raghu et al . ( 2017 ) . Closest to our approach is the work of Bruna et al . ( 2014 ) on global statements of injectivity and stability of a single layer including ReLU and pooling . The authors focus on global injectivity and stability bounds via combinatorial statements over all configurations attainable by ReLU and pooling . These conditions are valid on the entire input space , while the restriction to parts of the input space may be far from these worst-case conditions . Further works focus on applications like inverse problems with learned forward models ( Jensen et al. , 1999 ; Lu et al. , 1999 ) and parameter estimation problems ( Lähivaara et al. , 2018 ) , which are often formulated as inverse problems and require the inversion of networks . 1.2 NOTATION . In this section , we briefly state our notation as a reference : • Input : x = x0 ∈ Rd0 , sometimes shortened to d : = d0 . • Pre-activations : zl = Alxl−1 + bl ∈ Rdl , with weight matrix Al ∈ Rdl×dl−1 and bias bl ∈ Rdl . • Activation : xl = φ ( zl ) ∈ Rdl , where φ : R→ R the pointwise applied activation function , if not specified differently g : = ReLU . • Number of layers : L ∈ N • Entire network : F : Rd 3 x 7→ F ( x ) : = z : = zL ∈ RdL , sometimes short D : = dL . For matrices A ∈ Rm×n and I ⊂ [ m ] : = { 1 , . . . , m } , A|I denotes the matrix consisting of the rows of A whose index is in set I – analogously for vectors . Also A|y 0 describes the restriction to the index set { i : yi > 0 } for y ∈ Rm , analogously for ≺ , = , , . For vectors y ∈ Rm , y 0 is the elementwise relation , analogously for ≺ , = , , . Furthermore , we define N ( A ) as the null space of a matrix A . The Euclidean inner product is denoted by 〈· , ·〉 . For every matrix A ∈ Rm×n with the rows ai , i ∈ [ m ] , we associate the set A = { ai } mi=1 . Vice versa , we associate every finite set in Rn with a matrix ( only possible up to permutation of the indices ) . 2 PREIMAGES OF RELU LAYER . 2.1 THEORETICAL ANALYSIS . In this section , we analyze different kinds of preimages of a ReLU-layer and investigate under which conditions the inverse image of a given point is a singleton ( a set containing exactly one element ) or has finite/infinite volume . These conditions will yield a simple algorithm able to distinguish between these different preimages , which is applied in Section 2.2 . For the analysis of preimages of a given output one can study single layers separately or multiple layers at once . However , since the concatenation of two injective functions is again injective while a non-injective function followed by an injective function is non-injective , studying single layers is crucial . We therefore develop a theory for the case of single layers in this section . Notice that in case of multiple layers one is also required to investigate the image space of the previous layer . We will focus our study on the most common activation function , ReLU . One of its key features is the non-injectivity , caused by the constant mapping on the negative half space . It provides neural networks with an efficient way to deploy invariances . Basically all other common activation functions are injective , which would lead to a straightforward analysis of the preimages . However , injective activations like ELU ( Clevert et al. , 2016 ) and Leaky ReLU ( Maas et al. , 2013 ) only swap the invariance for robustness , which in turn leads to the problem of having instable inverses . This question of stability will be analyzed in more detail in Section 3 . We start by introducing one of our main tools – namely the omnidirectionality . Definition 1 ( Omnidirectionality ) i ) A ∈ Rm×n is called omnidirectional if every linear open halfspace in Rn contains a row of A , i.e . for every given x ∈ Rn \ { 0 } there exists an index i ∈ [ m ] , such that 〈ai , x〉 > 0. ii ) A ∈ Rm×n and b ∈ Rm are called omnidirectional for the point p ∈ Rn if A is omnidirectional and b = −Ap . Thus , if A is omnidirectional , for every direction of a hyperplane through the origin forming two halfspaces , there is a vector from the rows of A inside each open halfspace , hence the term omnidirectional ( see Figure 2 for an illustration ) . Note that the hyperplanes are due to ReLU as it maps the open halfspace to positive values and the closed halfspace to zero . A straightforward way to construct an omnidirectional matrix is by taking a matrix whose rows form a spanning set F and use the vertical concatenation of F and −F . This idea is related to cReLU ( Shang et al. , 2016 ) . The following Corollary gives several equivalent formulations of omnidirectionality , which will turn out to be useful for the proof of the subsequent Theorem 4 in this section . The short proofs of the statements are provided in Appendix A1 . Corollary 2 ( Equivalences of omnidirectionality ) The following statements are equivalent : i ) A ∈ Rm×n is omnidirectional . ii ) Ax 0 implies x = 0 , where x ∈ Rn . iii ) There exists a unique x ∈ Rn , such that Ax 0. iv ) There exist no x ∈ Rn \ { 0 } , such that Ax 0 . More importantly , omnidirectionality is directly related to the ReLU-layer preimages and will provide us with a method to characterize their volume ( see Theorem 4 ) . To analyze such inverse images , we consider y = ReLU ( Ax+ b ) for a given output y ∈ Rm with A ∈ Rm×n , b ∈ Rm and x ∈ Rn . If we know A , b and y , we can write the equation as the following mixed linear system : A|y 0x+ b|y 0 = y|y 0 ( 1 ) A|y=0x+ b|y=0 0 , ( 2 ) where A|y 0 denotes the restriction of the matrix A to the rows , which are specified by the index set { i : yi > 0 } ( see Section 1.2 for the used notation ) . Remark 3 It is possible to enrich the mixed system to include conditions/priors on x ( e.g . x ∈ Rn≥0 ) . The inequality system in equation 2 links its set of solutions and therefore the volume of the preimages of the ReLU-layer with the omnidirectionality of A and b . Defining A : = AOT , where O ∈ Rk×n denotes an orthonormal basis of N ( A|y 0 ) with k : = dimN ( A|y 0 ) and b : = b|y 0 + A|y 0 ( PN ( A|y 0 ) ⊥x ) , where PV denotes the orthogonal projection into the closed space V , leads to the following main theorem of this section , which is proven in Appendix A1 . Theorem 4 ( Preimages of ReLU-layers ) Let A , b and k = dimN ( A|y 0 ) be as above . The preimage of a point y under a ReLU-layer is i ) for k = 0 a singleton . ii ) for k > 0 a singleton , if and only if there exists an index set I for the rows of A and b , such that ( A|I , b|I ) is omnidirectional for some point p ∈ Rk . iii ) for k > 0 a compact polytope with finite volume , if and only if A is omnidirectional . Thus , omnidirectionality allows in theory to distinguish whether the inverse image of a ReLU-layer is a singleton , a compact polytope or has infinite volume . However , obtaining a method to check if a given matrix is omnidirectional is crucial for later numerical investigations . For this reason , we will go back to the geometrical perspective of omnidirectionality ( see Figure 2 ) . This will also help us to get a better intuition on the frequency of occurrence of the different preimages . The following Theorem 5 gives another geometrical interpretation of omnidirectionality , whose short proof is given in Appendix A1 . Theorem 5 ( Convex hull ) A matrix A ∈ Rm×n is omnidirectional if and only if 0 ∈ Conv ( A ) o , where Conv ( A ) o is the interior of the convex hull spanned by the rows of A ( see Definition 10 in Appendix A1 ) . Therefore , the matrix must contain a simplex in order to be omnidirectional , as the convex hull of the matrix A ∈ Rm×n has to have an interior . Hence , we have the following : Corollary 6 If A ∈ Rm×n is omnidirectional , then m > n. By considering the geometric perspective , a tuple ( A ∈ Rm×n , b ∈ Rm ) is omnidirectional for a point p ∈ Rn , if and only if the m hyperplanes generated by the rows of A with bias b intersect at p and their normal vectors ( rows of A ) form an omnidirectional set . We can use Corollary 6 to conclude that singleton preimages of ReLU-layers are very unlikely to happen in practice ( if we do not design for it ) , since a necessary condition is that n + 1 hyperplanes have to intersect in one point in Rn . Therefore we conclude , that singleton preimages of ReLU layers in practice only and exclusively occurs , if the mixed linear system already has sufficient linear equalities . Algorithm to check uniqueness : The above results can be used to derive an algorithm to check whether a preimage of a given output is finite , infinite or just a singleton . A singleton inverse image is obtained as long as rank ( A|y 0 ) = n holds true , which can be easily computed . To distinguish preimages with finite and infinite volumes , it is enough to check if A is omnidirectional ( see Theorem 4iii ) , which can be done numerically by using the definition of the convex hull , Theorem 5 and Corollary 6 . This leads to a linear programming problem , which is presented in Appendix A3 and was also used to create Figure 1 .

Summary: This paper presents an analysis of the inverse invariance of ReLU networks. It makes the observation that one can describe the pre-image of an image point z = F(x) using linear algebra arguments. They provide necessary conditions for the pre-image to be a singleton or a finite volume polytope. They also provide upper-bounds on the singular values of a train network and measure those in standard CNNs.