Invariance and Inverse Stability under ReLU

1 INTRODUCTION . Invariance and stability/robustness are two of the most important properties characterizing the behavior of a neural network . Due to growing requirements like robustness to adversarial examples ( Szegedy et al. , 2014 ) and the increasing use of deep learning in safety-critical applications , there has been a surge in interest in these properties . Invariance and stability are considered to be the key mechanisms in dealing with uninformative properties of the input ( Achille & Soatto , 2017 ; Mallat , 2016 ) and are studied from the information theoretical perspective in form of the loss of information about the input ( Tishby & Zaslavsky , 2015 ; Saxe et al. , 2018 ) . Invariance and stability are also tightly linked to robustness against adversarial attacks ( Cisse et al. , 2017 ; Tsuzuku et al. , 2018 ; Simon-Gabriel et al. , 2018 ) , generalization ( Sokolić et al. , 2017 ; Gouk et al. , 2018 ) and even the training of Generative Adversarial Networks ( Miyato et al. , 2018 ) . In general , stability is studied via two basic properties : 1 ) locally via a norm of the Jacobian ( Sokolić et al. , 2017 ; Simon-Gabriel et al. , 2018 ) , 2 ) globally via the Lipschitz constant ( Cisse et al. , 2017 ; Miyato et al. , 2018 ; Tsuzuku et al. , 2018 ) . From a high-level perspective , both of these approaches study an upper bound on stability as the Lipschitz constant and a Jacobian norm quantifies the highest possible change under a perturbation with a given magnitude . We , unlike the approaches above , aim to broaden our understanding by analyzing the lowest possible change under a perturbation . More formally , we study which perturbations ∆x do not ( or only little ) affect the outcome of a network F . Our analysis considers a given input data point x and investigates the ∆x ’ s , such that F ( x ) = F ( x+ ∆x ) ( invariant ) or ‖F ( x ) − F ( x+ ∆x ) ‖ ≤ ε ( stable ) , where a small ε > 0 is given . While these properties can be crucial for many discriminative tasks ( Mallat , 2016 ) , the model could be flawed if perturbations that alter the semantics have only a minor impact on the features . This is a reverse perspective on adversarial examples ( Szegedy et al. , 2014 ) , which commonly considers small input perturbations that lead to large changes and thus to arbitrary decisions of the network . This flipped view and the study of smallest changes calls for a different approach : we study the instabilities of the inverse instead of the stabilities of the forward mapping . In particular , if F is invariant to perturbations ∆x , then x and x+∆x lie in the preimage of the output z = F ( x ) , i.e . F is not uniquely invertible . Robustness towards large perturbations induces an instable inverse mapping as small changes in the output can be due to large changes in the input . Based on the piecewise linear nature of ReLU networks ( Montufar et al. , 2014 ) , we characterize the preimage of ReLU-activations as a single point , finite ( bounded ) or infinite ( unbounded ) . Further , we study the stability of the linearization of rectifier networks via its singular values . To illustrate these locally changing properties and to demonstrate their tight connection , we visualize the behavior on a synthetic problem in Figure 1 . Our contributions are as follows : • We derive conditions when the preimage of an output of a ReLU-layer has finite or infinite volume or is a single point . Based on these conditions , we derive an algorithm to check these conditions and exemplify its usability by applying it to investigate the preimages of a trained network . ( See Section 2 . ) • We study the stability of the inverse via analyzing the linearization at a point in input space , which is accurate within a polytope . We provide upper bounds on the smallest singular value of a linearization and prove how the removal of uncorrelated features could effect the stability of the inverse mapping . Based on these ideas , we experimentally demonstrate how singular values evolve over the different layers in rectifier networks . ( See Section 3 . ) • We introduce a reverse view on adversarial examples and connect it to invariance and robustness by leveraging our analysis of preimages . ( see Section 5 ) 1.1 RELATED WORK . While analyzing invariance and robustness properties is a major topic in theoretical treatments of deep networks ( Mallat , 2016 ) , studying it via the inverse is less common . Several works like Mahendran & Vedaldi ( 2015 ) , Mahendran & Vedaldi ( 2016 ) or Dosovitskiy & Brox ( 2016 ) focus on reconstructing inputs from features of convolutional neural networks ( CNNs ) to visualize the information content of features . Instead , we investigate potential mechanisms affecting the invertibility . Carlsson et al . ( 2017 ) gives a first geometrical view on the shape of preimages of outputs from ReLU layers , which is directly related to the question of injectivity of the mapping under ReLU . Shang et al . ( 2016 ) analyzes the reconstruction property of cReLU ( concatenated ReLU ) ; however , the more general situation of using the standard rectifier is not studied . A notable other line of work assumes random weights in order to derive guarantees for invertibility , see Gilbert et al . ( 2017 ) or Arora et al . ( 2015 ) , whereas we focus on the preimage of ReLU-activations without assumptions on the weights . Moreover , several reversible network structures were recently proposed ( Gomez et al. , 2017 ; Chang et al. , 2018 ; Jacobsen et al. , 2018 ) . Most notably , in Jacobsen et al . ( 2018 ) a bijective network , up to its last layer , was trained successfully on ImageNet which does not exhibit any invariance . However , the network is very robust towards many directions in the input which is reflected in a strongly instable inverse . Hence , even carefully designed network show at least one of the two effects ( invariance and robustness ) studied in this work . Especially stability has seen growing interest due to adversarial examples ( Szegedy et al. , 2014 ) , yet stability is mostly studied with respect to the forward mapping , see e.g . Cisse et al . ( 2017 ) . Two main resources for our view of rectifier networks as piecewise linear models are Montufar et al . ( 2014 ) and Raghu et al . ( 2017 ) . Closest to our approach is the work of Bruna et al . ( 2014 ) on global statements of injectivity and stability of a single layer including ReLU and pooling . The authors focus on global injectivity and stability bounds via combinatorial statements over all configurations attainable by ReLU and pooling . These conditions are valid on the entire input space , while the restriction to parts of the input space may be far from these worst-case conditions . Further works focus on applications like inverse problems with learned forward models ( Jensen et al. , 1999 ; Lu et al. , 1999 ) and parameter estimation problems ( Lähivaara et al. , 2018 ) , which are often formulated as inverse problems and require the inversion of networks . 1.2 NOTATION . In this section , we briefly state our notation as a reference : • Input : x = x0 ∈ Rd0 , sometimes shortened to d : = d0 . • Pre-activations : zl = Alxl−1 + bl ∈ Rdl , with weight matrix Al ∈ Rdl×dl−1 and bias bl ∈ Rdl . • Activation : xl = φ ( zl ) ∈ Rdl , where φ : R→ R the pointwise applied activation function , if not specified differently g : = ReLU . • Number of layers : L ∈ N • Entire network : F : Rd 3 x 7→ F ( x ) : = z : = zL ∈ RdL , sometimes short D : = dL . For matrices A ∈ Rm×n and I ⊂ [ m ] : = { 1 , . . . , m } , A|I denotes the matrix consisting of the rows of A whose index is in set I – analogously for vectors . Also A|y 0 describes the restriction to the index set { i : yi > 0 } for y ∈ Rm , analogously for ≺ , = , , . For vectors y ∈ Rm , y 0 is the elementwise relation , analogously for ≺ , = , , . Furthermore , we define N ( A ) as the null space of a matrix A . The Euclidean inner product is denoted by 〈· , ·〉 . For every matrix A ∈ Rm×n with the rows ai , i ∈ [ m ] , we associate the set A = { ai } mi=1 . Vice versa , we associate every finite set in Rn with a matrix ( only possible up to permutation of the indices ) . 2 PREIMAGES OF RELU LAYER . 2.1 THEORETICAL ANALYSIS . In this section , we analyze different kinds of preimages of a ReLU-layer and investigate under which conditions the inverse image of a given point is a singleton ( a set containing exactly one element ) or has finite/infinite volume . These conditions will yield a simple algorithm able to distinguish between these different preimages , which is applied in Section 2.2 . For the analysis of preimages of a given output one can study single layers separately or multiple layers at once . However , since the concatenation of two injective functions is again injective while a non-injective function followed by an injective function is non-injective , studying single layers is crucial . We therefore develop a theory for the case of single layers in this section . Notice that in case of multiple layers one is also required to investigate the image space of the previous layer . We will focus our study on the most common activation function , ReLU . One of its key features is the non-injectivity , caused by the constant mapping on the negative half space . It provides neural networks with an efficient way to deploy invariances . Basically all other common activation functions are injective , which would lead to a straightforward analysis of the preimages . However , injective activations like ELU ( Clevert et al. , 2016 ) and Leaky ReLU ( Maas et al. , 2013 ) only swap the invariance for robustness , which in turn leads to the problem of having instable inverses . This question of stability will be analyzed in more detail in Section 3 . We start by introducing one of our main tools – namely the omnidirectionality . Definition 1 ( Omnidirectionality ) i ) A ∈ Rm×n is called omnidirectional if every linear open halfspace in Rn contains a row of A , i.e . for every given x ∈ Rn \ { 0 } there exists an index i ∈ [ m ] , such that 〈ai , x〉 > 0. ii ) A ∈ Rm×n and b ∈ Rm are called omnidirectional for the point p ∈ Rn if A is omnidirectional and b = −Ap . Thus , if A is omnidirectional , for every direction of a hyperplane through the origin forming two halfspaces , there is a vector from the rows of A inside each open halfspace , hence the term omnidirectional ( see Figure 2 for an illustration ) . Note that the hyperplanes are due to ReLU as it maps the open halfspace to positive values and the closed halfspace to zero . A straightforward way to construct an omnidirectional matrix is by taking a matrix whose rows form a spanning set F and use the vertical concatenation of F and −F . This idea is related to cReLU ( Shang et al. , 2016 ) . The following Corollary gives several equivalent formulations of omnidirectionality , which will turn out to be useful for the proof of the subsequent Theorem 4 in this section . The short proofs of the statements are provided in Appendix A1 . Corollary 2 ( Equivalences of omnidirectionality ) The following statements are equivalent : i ) A ∈ Rm×n is omnidirectional . ii ) Ax 0 implies x = 0 , where x ∈ Rn . iii ) There exists a unique x ∈ Rn , such that Ax 0. iv ) There exist no x ∈ Rn \ { 0 } , such that Ax 0 . More importantly , omnidirectionality is directly related to the ReLU-layer preimages and will provide us with a method to characterize their volume ( see Theorem 4 ) . To analyze such inverse images , we consider y = ReLU ( Ax+ b ) for a given output y ∈ Rm with A ∈ Rm×n , b ∈ Rm and x ∈ Rn . If we know A , b and y , we can write the equation as the following mixed linear system : A|y 0x+ b|y 0 = y|y 0 ( 1 ) A|y=0x+ b|y=0 0 , ( 2 ) where A|y 0 denotes the restriction of the matrix A to the rows , which are specified by the index set { i : yi > 0 } ( see Section 1.2 for the used notation ) . Remark 3 It is possible to enrich the mixed system to include conditions/priors on x ( e.g . x ∈ Rn≥0 ) . The inequality system in equation 2 links its set of solutions and therefore the volume of the preimages of the ReLU-layer with the omnidirectionality of A and b . Defining A : = AOT , where O ∈ Rk×n denotes an orthonormal basis of N ( A|y 0 ) with k : = dimN ( A|y 0 ) and b : = b|y 0 + A|y 0 ( PN ( A|y 0 ) ⊥x ) , where PV denotes the orthogonal projection into the closed space V , leads to the following main theorem of this section , which is proven in Appendix A1 . Theorem 4 ( Preimages of ReLU-layers ) Let A , b and k = dimN ( A|y 0 ) be as above . The preimage of a point y under a ReLU-layer is i ) for k = 0 a singleton . ii ) for k > 0 a singleton , if and only if there exists an index set I for the rows of A and b , such that ( A|I , b|I ) is omnidirectional for some point p ∈ Rk . iii ) for k > 0 a compact polytope with finite volume , if and only if A is omnidirectional . Thus , omnidirectionality allows in theory to distinguish whether the inverse image of a ReLU-layer is a singleton , a compact polytope or has infinite volume . However , obtaining a method to check if a given matrix is omnidirectional is crucial for later numerical investigations . For this reason , we will go back to the geometrical perspective of omnidirectionality ( see Figure 2 ) . This will also help us to get a better intuition on the frequency of occurrence of the different preimages . The following Theorem 5 gives another geometrical interpretation of omnidirectionality , whose short proof is given in Appendix A1 . Theorem 5 ( Convex hull ) A matrix A ∈ Rm×n is omnidirectional if and only if 0 ∈ Conv ( A ) o , where Conv ( A ) o is the interior of the convex hull spanned by the rows of A ( see Definition 10 in Appendix A1 ) . Therefore , the matrix must contain a simplex in order to be omnidirectional , as the convex hull of the matrix A ∈ Rm×n has to have an interior . Hence , we have the following : Corollary 6 If A ∈ Rm×n is omnidirectional , then m > n. By considering the geometric perspective , a tuple ( A ∈ Rm×n , b ∈ Rm ) is omnidirectional for a point p ∈ Rn , if and only if the m hyperplanes generated by the rows of A with bias b intersect at p and their normal vectors ( rows of A ) form an omnidirectional set . We can use Corollary 6 to conclude that singleton preimages of ReLU-layers are very unlikely to happen in practice ( if we do not design for it ) , since a necessary condition is that n + 1 hyperplanes have to intersect in one point in Rn . Therefore we conclude , that singleton preimages of ReLU layers in practice only and exclusively occurs , if the mixed linear system already has sufficient linear equalities . Algorithm to check uniqueness : The above results can be used to derive an algorithm to check whether a preimage of a given output is finite , infinite or just a singleton . A singleton inverse image is obtained as long as rank ( A|y 0 ) = n holds true , which can be easily computed . To distinguish preimages with finite and infinite volumes , it is enough to check if A is omnidirectional ( see Theorem 4iii ) , which can be done numerically by using the definition of the convex hull , Theorem 5 and Corollary 6 . This leads to a linear programming problem , which is presented in Appendix A3 and was also used to create Figure 1 .

Summary: The paper has two distinct parts. In the first part (section 2) it studies the volume of preimage of a ReLU network’s activation at a certain layer as being singular, finite, or infinite. This part is an extension of the work in the study of (Carlsson et al. 2017). The second part (section 3) builds on the piecewise linearity of a ReLU network’s forward function. As a result, each point in the input space is in a polytope where the model acts linearly. In that respect, it studies the stability of the linearized model at a point in the input space. The study involves looking at the singular values of the linear mapping.