Provable Gradient Editing of Deep Neural Networks
Authors: Zhe Tao
Aditya V. Thakur
Venue: NeurIPS 2025 spotlight ()
Keywords: Machine Learning
Deep Neural Network
Provable Editing
Explainable AI
Interpretability
Grad-CAM
Integrated Gradients
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: Efficient technique for enforcing hard constraints on the gradients of DNN by editing the DNN parameters.

Abstract: In explainable AI, DNN gradients are used to interpret the prediction; in safety-critical control systems, gradients could encode safety constraints; in scientific-computing applications, gradients could encode physical invariants. While recent work on provable editing of DNNs has focused on input-output constraints, the problem of enforcing hard constraints on DNN gradients remains unaddressed. We present ProGrad, the first efficient approach for editing the parameters of a DNN to provably enforce hard constraints on the DNN gradients. Given a DNN $\mathcal{N}$ with parameters $\theta$, and a set $\mathcal{S}$ of pairs $(\mathrm{x}, \mathrm{Q})$ of input $\mathrm{x}$ and corresponding linear gradient constraints $\mathrm{Q}$, ProGrad finds new parameters $\theta'$ such that $\bigwedge_{(\mathrm{x}, \mathrm{Q}) \in \mathcal{S}} \frac{\partial}{\partial \mathrm{x}}\mathcal{N}(\mathrm{x}; \theta') \in \mathrm{Q}$ while minimizing the changes $\lVert\theta' - \theta\rVert$. The key contribution is a novel *conditional variable gradient* of DNNs, which relaxes the NP-hard provable gradient editing problem to a linear program (LP), enabling ProGrad to use an LP solver to efficiently and effectively enforce the gradient constraints. We experimentally evaluated ProGrad via enforcing (i) hard Grad-CAM constraints on ImageNet ResNet DNNs; (ii) hard Integrated Gradients constraints on Llama 3 and Qwen 3 LLMs; (iii) hard gradient constraints in training a DNN to approximate a target function as a proxy for safety constraints in control systems and physical invariants in scientific applications. The results highlight the unique capability of ProGrad in enforcing hard constraints on DNN gradients.

Provable Gradient Editing of Deep Neural Networks
Zhe Tao University California, Davis Davis, CA 95616, USA zhetaoQucdavis edu zhe@zhe com
Aditya V. Thakur University of California, Davis Davis, CA 95616, USA
avthakur@@cdavvis.c
Abstract
explainable AI, DNN gradients are used to interpret the prediction; in safety- critical control systems, gradients could encode safety constraints; in scientifie- computing applications. gradients could encode physical invariants. While recent work on provable editing of DNNs has focused on input-output constraints, the problem of enforcing hard constraints on DNN gradients remains unaddressed. We present ProGrad, the first efficient approach for editing the parameters of DNN provably enforce hard constraints on the DNN gradients. Given a DNN N with pa- rameters 0, and a S of pairs (x, Q) of input and corresponding linear gradient constraints Q, ProGrad finds new parameters such that (x.Q)ES The N(x; 0) E Q
while minimizing the changes ||0 0|. The key contribution is a novel condi- tional variable gradient of DNNs, which relaxes the NP-hard provable gradient editing problem to a linear program (LP), enabling ProGrad to use an LP solver efficiently and effectively enforce the gradient constraints. We experimentally evaluated ProGrad via enforcing (i) hard Grad-CAM. constraints on IMAGENET ResNet DNNs; (ii) hard Integrated Gradients constraints on Llama and Qwen 3 DNN as proxy for safety constraints control systems and physical invariants in scientific applications. The results highlight the unique capability of ProGrad in enforcing hard constraints on DNN gradients.
LLMs; (iii) hard gradient constraints in training a
Introduction
Incorporating constraints into deep neural networks (DNNs) can enable learning with less data (e.g., in scientific domains) and provide guarantees about their behavior (e.g., in safety-critical applications). This has led to many recent works on provable editing of DNNs [41 40], which enforce hard constraints input-output behavior of DNNs. However, the problem of enforcing hard constraints on the gradients of DNNs remains unaddressed. This paper presents ProGrad, which addresses the provable gradient editing problem defined below:
Definition 1.1. Given DNN N T R with parameters 0, set S fx x E IR*) x
{Q QIQQ mx of pairs (x, Q). where x E. an input and Q def [J E mxx A Aeec(J b} is the corresponding linear constraints on the Jacobian A [xxx 0) E mmxn of the DNN N with respect to the input x. we use vec(J) to denote the Jacobian matrix flattened as a vector. The provable gradient editing problem is to find new parameters 0 such that
min
01
s.t.
N E Q
(1)
(x. (x.Q)ES
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

MSE; arrer: 4,25e-3
violation:4.300
MSE erro:: L.06-4
violation:O.000
5-
0-
analast din
gnalack d'/ik
banode
arudices dff.
loard
-15
vickokes
-1b
20
3F
(a) Target function f. whose gradient We is bounded.
(h) Unsafe DNN N1, whose gradient (c) Safe N2 repaired by ProGrad, whose gradient 4N is bounded.
dee Ni is not bounded.
Figure 1: Enforcing hard constraints on the gradient of DNN. (Left) I(a) shows the target
function f(x) - -x cos(r) + sin(x) over the input domain |0. 3r], whose gradient /(x) = sin(z) is bounded by (xr) = x and gi (a: -x. (Middle) I(b) shows DNN Ni trained on both the output and the gradient of f. Although N₁ has good (low) output and gradient errors, its gradient da Ni violates the hard constraints as shown in the zoom-ins, its gradient 4 N not bounded by Gu and 9t- (Right) [(c) shows DNN N2 edited by ProGrad to satisfy the hard gradient constraints
its gradient NN2 2 is bounded by gu and gt. DNN N2 also achieves better (lower) output and gradient errors. See Section 5.3 for more details.
clussc Ingeray
inseclassilid:: corul
Cos: 38.00%
ToU:4
Cos 100%
ToTT: 100%
(a) Original image.
(b) Reference Grad- (c) Misclassified
(d) Deviated Grad- (c) Edited Grad- CAM the cor- CAM
CAM on the original image.
Gaussian-noke corrupted image.
the
rupted image.
corrupted image.
Figure 2: Enforcing hard Grad-CAM constraints on an IMAGENET ResNet152 DNN. Figure 2(a) shows correctly-classifiet image with an appropriate Grad-CAM (2(b) focusing on the object of interest. Figure [(c) shows Gaussian-noise -orrrrpppe version of the original image, which is misclassified by the DNN, and the focus of its Grad-CAM (2(d) deviates from the object of interest.
We use ProGrad to edit the DNN enforce the reference Grad-CAM 2(b) the corrupted image (2(c). Figure 2 shows the Grad-CAM of the corrupted image on the edited DNN, which is now aligned with the reference Grad-CAM (bb)). See Section 5.1 for more details.
In other words, provable gradient editing aims to make minimal changes to the parameters of a DNN ensure that the DNN is guaranteed satisfy any affine constraints involving the gradients of the DNN with respect to its input. Hard constraints on the gradient of a function with respect its input are common in many scientific applications and safety-critical control systems. As an illustrative example, consider the function f(x) in Figure ((a) whose gradient d should be
bounded by 9,, (z) = x and (x()) = - Ø over the domain [0, 3T.. Prior regularization-Dass deaiiizatio-bassed training approaches be used enforce soft constraints on the gradient. However, shown in Figure [(b)
although such DNN Mi achieves good (low) output and gradient errors, its gradient d d-Ni exceeds the bounds gt, and gi and violates the hard gradient constraints, hence unsafe. In contrast, Figure [(c] shows safe DNN Nr edited by our method ProGrad to satisfy the hard constraints the gradient, which also achieves better (lower) output and gradient errors.
Another natural application of gradient constraints is to ensure that the DNN has the appropriate gradient-based interpretation for a given input, which important for explainable AL. Figure shows shows use case where we enforce expected Grad-CAM attribution (Definition 3.5) for an IMAGENET ResNet- 152 DNN: Figure 3 shows use case where we enforce an expected Integrated Gradients attribution (Definition 3.4 for Llama 3 LLM 99.

---

rich
veins
of
funny
stuff
this
movie
1.0
Reference IG positive
0.00
0.47
0.23
1.00
0.24
0.25
0.23
0.38
0.8
Taken Attributioo
Deviated IG negative
0.60
0.39
0.00
0.21
0.93
0.59
0.97
1.00
0.4
Edited IG positive
0.00
0.46
0.22
1.00
0.25
0.25
0.24
0.39
0.2
0.0
Figure 3: Enforcing hard Integrated Gradients (IG) constraints on a Llama LLM (). The
sentence is from the Stanford Sentiment Treebank 2 (SST-2) dataset [6). The first row shows the reference IG from a larger LLM, which correctly classifies the sentiment of the sentence as positive. The second row shows the deviated IG from the smaller LLM, which misclassifies the sentiment of the sentence as negative. The third row shows the edited IG from the repaired smaller LLM edited by ProGrad, whose IG is enforced to be close to the reference IG from the larger LLM, and correctly classifies the sentiment of the sentence as positive. See Section 5.2 for more details.
To the best of our knowledge, ProGrad is the first efficient approach for enforcing hard constraints the gradients of DNN that runs in polynomial time in the size of the edited layers (Theorem 4.3).
Our key contribution is a novel conditional variable gradient of DNNs (Definition 4.2) which relaxes the NP-hard provable gradient editing problem linear programming (LP) problem, enabling ProGrad to use an LP solver to efficiently and effectively enforce the gradient constraints.
We evaluate ProGrad by enforcing (i) hard Grad-CAM constraints on IMAGENET ResNet DNNs; (ii) hard Integrated Gradients constraints on Llama 3 and Qwen 3 LLMs; (iii) hard gradient constraints in training function-appen approximation DNN, which acts proxy for safety constraints in control systems and physical invariants scientific applications. The results highlight the unique capability of ProGrad in enforcing hard constraints DNN gradients and gradient-bac based explanations.
2 Related Work
There have been many recent works on incorporating constraints into deep learning. These can be categorized into four categories based on whether they treat constraints soft hard constraints, and whether they support input-outpi constraints or gradient constraints.
For soft constraints, regularized training modifies the loss function to incorporate constraints as regularization and does not guarantee constraint satisfaction. There have been many recent such approaches for incorporating input-output constraints [14, 45 23
38 Certified training 21 7 31 24 22 20 a type of regularized training geared towards adversarial robustness.
For gradient constraints, Park et al. [25] present technique for preserving the Grad-CAM attribution when performing network compression. They proposed new loss function that incorporates match between the attribution maps during the fine-tuning stage of compression, and present three variations of this matching loss function: EWA, SWA and SSWA. Similar approaches are also used in visual grounding for visual question answering tasks [30]. Physics-informed neural networks (PINNs) 22 B is another type of regularized training that incorporates DNN gradients to encode physics constraints to solve differential equations using DNNs.
For hard constraints, directly using an SMT solver to incorporate input-outpin constraints is inefficient and does not scale beyond small DNNs 66 19 8 More efficient approaches are based on relaxing the problem solving an LP problem [1 arbitrary affine output constraints for input points. The state-of-the-a provable editing approaches APRNN and PREPARED 440 are also able handle affine output constraints for input polytopes. However, they do not handle gradient constraints.
APRNN [41] efficient in enforcing

---

To the best of our knowledge, ours is the first approach to efficiently enforce hard constraints on the gradients of DNNs. Though the current work focuses on handling imput points, future work could enforce gradient constraints input polytopes by adapting ideas from APRNN and PREPARED
DNN verification aims to determine whether DNN satisfies given input-output
34
35
50
43
49 46 44 or gradient property such as monotonicity and Lipschitz robustness
15
16
32
3
Preliminaries
We use æ E R to denote a scalar, x E 12T to denote a column vector, and W E __xm to denote matrix. Variables in blue with hat denote LP decision variables, e.g., X, 2, W. Variables blue with tilde denote the conditional variables, e.g., x, Z.
Definition 3.1 (DNN), Consider an L-layer ferd-forward ReLU deep neural network (DNN) A with parameters 0 def (W))) W(1) ...., W(L-1), (()) b(a) b . For each layer S < L, we use
( W + (())
(2)
denote the pre-activation output z. after the affine transformation. For non-last layer < I.-1,
x (++1) def (tag((1(()))) (()
denotes the layer output x (f+1) after the ReLU activation, where diag (1ag((1(050)) is a diagonal matrix of the indicator vector 1 (0)00 whose i-th element is if ? O, or otherwise. For the last layer
ê = L-1, we assume ReLU activation and use x def
((L-1) denote the layer output. Given the DNN input x E I,,, we have the first-layer input x (0) x and the network output N 0) def (
Definition 3.2 (Gradient of DNNs). For an L-layer ReLU DNN N R" + R with parameters
W(xx 0) of the DNN output ((x: 0) R with respect the input x E R" is defined by the chain rule as
the gradient (Jacobian) 8x
Ox (f+1) Oz Oz(() 0x(()
N(x: 0)
(4)
Ox
E=
For the ReLU activation x (f+1) diag( 1,00)) (09) of non-last layer & < L-1, the gradient Txe (1+1)
oz!))
of the ê-th layer post-activation output x (f+1) with respect to the pre-activation output (f)
(f+++)) diag (12 100)))
Oz (2)
and for the last layer = L-1 without ReLU activation,
(x(1) def dgt4-1)
(1ag(() is the identity matrix.
For the affine transformation (5) def (+)) + ((), the gradient with respect to the ε-th layer input x (f-1) is defined as
( 2xt the pre-activation output (())
O2 del (
(6)
3.1 Conditional variable output of DNNs for provable output editing
Our method ProGrad extends the conditional variable output of DNNs, introduced by APRNN [41) to the conditional variable gradient of DNNs. We now present how APRNN focuses on the forward pass and constructs the conditional variable output of DNNs. For clarity, we assume the first-layer weight and all-layer biases are variables. In practice, APRNN can freeze the first few layers and only make the rest of the DNN have variable parameters.
Definition 3.3 (Conditional variable output of DNNs). Consider an L-layer fordarorward ReLU
DNN A with parameters 0 def (W("), w (L-1)) (10) 6o,..,, b(L-11), where the first-layer weight ( and aly-r biases (1)) variables. For an input x E R", the conditional variable

---

with constant weight output (x;;)) E IRm with linear activation condition e is linear expression over 0 that is sound if the condition satisfied. other words, for any assignment the variable parameters 0 that satisfies the activation condition qp, (x; x 0) = N (x 0). Next we define the conditional variable output and condition ( for each layer L.
The pre-activation conditional variable output ( for the first layer e = 0 with variable weight is
( del
W x()))) (()
The pre-activation conditional variable output ( for other layers
def +
(8)
The conditional variable layer output (+++1) for non-last layer e < L-1 is defined as
( diag (2m00)) z(1)
(9)
with the E-th layer activation condition (()
diag [1 (0)0)) こ00) > A diag (1 (00) S
(10)
The activation condition ( constraining the ReLU activation pattern of the pre-activation con- ditional variable output ()) to be the same as constant pre-activation output 2 so that p( satisfied, diag(1 g)) = diag sriag(1.ca) (12(900)- The choice the constant zx() arbitrary, the default choice is the pre-activation output of the original DNN W. For the last layer l = L-1 without ReLU activation, x(L) der ((L-1) and G(L-11 def
Given the DNN input (0) x, we have the conditional variable network output N(x: 0) ( with
the activation condition yp def A (1)
3.2 Gradient-based interpretation methods
Definition 3.4 (Integrated Gradients (39]). Given input and a baseline input L def +od be the linearly interpolated points between the baseline x" and the input x, where a E [0, 1] and
d def x The integrated gradients (IG) from x" is defined the integral of the gradients along the path, then multiplied by the difference vector d:
N(x"))
[x def d
N((x)) )do
(11)
a== Ox
where denotes the element-wise product. In practice, this integral is approximated by left- Riemann sum with m steps:
IG approx
N(x
(12)
Fx
Definition (Grad-CAM (21).. Given convolutional DNN N and input x, let E C denote the DNN output, and E R HXW denote the pre-activation output of the last convolutional layer of the DNN where K the number of channels, and H and W are the height and width the feature map. The Grad-CAM localization map L R # is defined
dy
L def
az
where
def
HxW ΣΣ
(13)
OzR.a.j
where the neuron importance weights af E R is the average gradient of the output class with respect each channel & of the pre-activation output Optionally, one can simplify the Grad-CAM localization map L by applying ReLU activation to ignore the negative attributions. this paper, consider the Grad-CAM attribution with any sign, hence don't apply the ReLU activation to L
5

---

4 Approach
This section presents ProGrad, which solves the provable gradient editing problem of DNNs using linear programming (LP). For ease of exposition, we consider the following provable gradient editing problem for a scalar-valued DNN N I + R with gradient 0x Nxx; f) E R", and assume the first-layer weight and all-layer biases are variables. In practice, ProGrad allows editing only the last few layers and freezing the rest of the DNN, enabling efficient editing because the size of the LP only depends on the edited layers instead of the entire DNN. We defer the extension to the general provable editing problem of Definition 1.1 for vector-valued DNNs, as well as handling multiple inputs and editing only the last few layers to Appendix B The proof's for all theorems can found in Appendix A
@
Definition 4.1. Given DNN N R + R with parameters 6, and an input x E R The provable gradient editing problem is to find new parameters 0 that
min |0 01 s.t.
O)x:0) EQ
(14)
where Nx(xx; E Rn denotes the gradient of the sealar output of Nix: 0) E R with respect the input x with new parameters 0. Q def
{z R
Az S b) is convex polytope denoting the linear
constraints for the gradient 0 Nx; 0).
4.1 Conditional variable gradient of DNNs
Consider a DNN N with variable parameters ô and input x. The exact variable gradient ix Vxx 0) of N is highly non-linear, involving quadratic terms from the multiplication between weights and disjunctions from the ReLU activation. Our key insight is relax the non-linear ~xx(xx: 0) to linear conditional variable gradient & Nxx 0)
that is sound under linear activation condition ş
Definition 4.2. The conditional variable gradient Tx
Nx:; 0) of a DNN N in terms of f with respect
to the input x, under a poly-size linear activation condition gp, is a poly-size linear expression that equals the exact variable gradient 0
xx Nx: 0) if the activation condition e is satisfied.
In other words, for any assignment θ to the variable parameters that satisfies the activation con- a
tx dition q a Nx; 0) ixx (x;(x; The size of the condition & and the expression 8x Nx:xx 0) is
0
polynomial in the size of the edited layers the DNN, i.e., the number of edited layers, parameters, and the input and output dimensions of each edited layer. In practice, ProGrad allows editing only the last few layers of DNN. We defer the construction of such conditional variable gradient ax Nx(x; 0) of M to Section 4.3, and first show how can be used to solve the provable gradient editing problem.
4.2 Provable gradient editing via conditional variable gradient of DNNs
The following theorem shows how the conditional variable gradient of DNNs can be used solve the provable gradient editing problem.
Theorem 4.3. Given a provable gradient editing problem (Definition 4.1 for DNN N and pa- Let a Nx: 8) be
rameters 0 with input x and a gradient constraint Q def E the conditional variable gradient of the DNN N with respect to the input x, under the activation condition Tp. The following linear program can be solved polynomial time in the size of the edited layers of the DNN N. and its solution is solution to the provable gradient editing problem.
A R. R.
min 10 011
S.t.
A
(15)
0x
4.3 Conditional variable gradient of fully-connected ReLU DNN
This section presents how ProGrad focuses on the backward pass and constructs the conditional variable gradient of fully-connected ReLU DNN A with respect to the input x and its parameters 0.

---

Definition 4.4. Consider an L-layer feed-forward ReLU DNN N (Definition
3.1 with parameters
0 def (W w ..... (. (())
B(r-))), where the first-layer weight W (0) and all-layer
biases ((0)) are variables. For an input x E Ik", the conditional variable gradient @ xx: 0) of a DNN
8x
N terms of f with respect to the input x is defined by the chain rule as
((+1) 82
(x;
0
def
(16)
xx
(x
E=L-1
with the activation condition ; def
N8 / (2) defined from each layer l.
For the conditional ReLU activation x(++1) de diag(I1(0)))) x of non-last layer & < L - 1, the
conditional variable gradient pre-activation output is
og((+1)
of the E-th layer post-activation output ((++1) with respect to the ogeey
(x(++1) de
diag(12(0>))
(17)
(2(()
with the 8-th layer activation condition ()()
diag (10000) 2(0>>> > A diag ((0))) (00
(18)
The activation condition (60) constraining the ReLU activation pattern of the pre-activation con- ditional variable output ( to be the same constant pre-activation output 20)), so that if ()()) is satisfied, diag diag(1 (1 = diag (diia((,())))) (1,(1)0)) The choice of the constant z (z)) is arbitrary, the default choice the pre-activation output of the original DNN N. For the last layer l L-1 without ReLU activation,
def diag(1 (1) is the identity matrix.
ProGrad and APRNN share the same idea of using activation condition to constrain each input in the edit set to lie on a specific linear piece of the edited DNN. Note that the linear piece is not fixed but variable, because it is expressed closed-form linear expression in terms of the editable DNN parameters.
As seen in Equations 18 and I0
For the conditional affine transformation 200) constant weight ( and conditional variable input (()) the conditional variable gradient pre-activation output z(() with respect to the layer input is) is
((((()) + ((0) of the non-first layer & O with
xg
the a
(
(19)
O
For the conditional affine transformation 20) del W ((0) of the first layer = 0 with variable weight W(O) and constant input (0), the conditional variable gradient output ((0) with respect to the layer input (0)
of the pre-activation (
Fz def
(0)
(20)
Ox
(0)
Theorem 4.5. The conditional variable gradient constructed in Definition 4.4 is valid and satisfies the conditions stated in Definition 4.2
5 Experimental Evaluation
have implemented ProGrad in PyTorch 26 and use Gurobi [10 as the LP solver. All experi- ments were run machine with dual Intel Xeon Platinum 8362 Processors, 32-Core 2.8GHz with 1.5 TB of memory, SSD, and NVIDIA H100 GPU with 80 GB of GPU memory running Ubuntu 22.04. Additional details can be found in Appendix C
7

---

Table Enforcing hard Grad-CAM constraints on ResNet DNNs. Comparison of the (pixel-level) Grad-CAM constraint satisfaction rate (Constr. Sat.), minimum cosine similarity (Min. Cos.) and minimum intersection over union (Min. IoU) between the expected and edited Grad-CAMs, and the top-1 accuracy (Acc.) of the edited DNNs on the ILSVRC 2012 IMAGENET validation set.
(a) Enforcing hard Grad-CAs CAM constraints on ResNet152
100 images with s=lc-2
1,000 images with s=5c-2
Method
Constr: Sat.
Min. Cos.
Min. IoU
Acc.
Constr. Sat.
Min. Cos.
Min. IoU
Acc.
Original
7.06%
34.66%
4.35%
78.31%
30.85%
24.51%
0.00%
78.31%
EWA
6.61%
73.53%
20.00%
77.27%
30.47%
26.31% 1%
0.00%
73.32%
SWA
6,27%
49.95%
71.43%
77.79%
34.34%
65.56%
4.35%
76.55%
SSWA
6.37%
56.54%
71.43%
77.79%
34.32%
65.36%
4.35%
76.56%
ProGrad
100.00% %
99.97% %
84.62
78.08% %
100.00% %
99.44 %
50.00%
77.43%
Enforcing hard Grad-CAM constraints ReaNett50
100 images with s=le-2
1,000 images with 6=Se-2
Method
Constr. Sat.
Min. Cos.
Min. loU
Acc.
Constr. Sat.
Min. Cos.
Min. IoU
Acc.
Original
7.35%
24.15%
0.00%
76.13%
31.21%
-68.81%
0.00%
76.13%
EWA
5.39%
65.44%
0.00%
73.42%
23.84%
37.95%
0.00%
65.86%
SWA
6.80%
83.25%
50.00%
75.24%
31.64%
-1.84%
4.35%
73.67%
SSWA
6.71%
83.01% %
41.18%
75.25%
31.67%
-1.00%
4.35%
73.72%
ProGrad
100.00%
99.96%
84.62%
75.38%
100.00%
99.31 %
50.00%
74.33%
5.1 Enforcing hard Grad-CAN CAM constraints on ResNet DNNs for IMAGENET
In this experiment, we edit ResNet152 and ResNet50 DNNs from torchvision [8] so that the
Grad-CAM attributions (29) for set of images e-close their expected attributions. We compare ProGrad to the state-of-the-art Grad-CAM fine-tuning methods EWA, SWA and SSWA (25).
Edit set. The edit set consists of misclassified images that have deviated Grad-CAr attributions for their expected class. These images are from the IMAGENET- dataset [I1] that are corrupted with Gaussian noise, whose original uncorrupted version correctly classified. For each misclassified image in the edit set, we take the Grad-CAM attribution of the corresponding original correctly- classified image the expected Grad-CAM. For each DNN, construct two such edit sets: (i) 100 images from the first 50 classes with E=le-2; (ii) 1,000 images from the first 200 classes with E=5e-2.
Grad-CAl constraints. For each image x in the edit sets and its expected Grad-CAM L for the expected class, L' denote the Grad-CAM on the edited DNN N'; let L,, and L' min-max-normalized expected and edited Grad-CAMs; we use [L,, 1o I as the constraint.
Results. As shown in Table I ProGrad is the only method able to enforce the hard Grad-CAIl constraints, achieving a 100% constraint satisfaction rate (Constr. Sat.), ), and it achieves the best accuracy (Acc.). ProGrad also achieves the best similarity between the edited and expected Grad- CAM as measured by cosine similarity (Min. Cos.) and intersection over union (Min. IoU). In the ResNet152 experiment, ProGrad took 22 minutes for 100 images and hours 51 minutes for 1,000 images; in the ResNet50 experiment, ProGrad took 25 minutes for 100 images and 3 hours 37 minutes for 1,000 images. For each baseline, we performed grid search over hyperparameters with a time limit of 12 hours, and report the best results with the highest constraint satisfaction rate (Constr. Sat.). Although the baselines (EWA, SWA and SSWA) can improve these similarity metrics, they are unable to enforce the hard constraints.

---

Table Enforcing hard Integrated Gradients (IG) constraints on Llama 3 and Qwen 3 LLMs. Comparison of the (token-level) IG constraint satisfaction rate (Constr. Sat.), cosine similarity (Cos.) and intersection over union (ToU) between the expected and edited IG, and the accuracy (Acc.) the edited L.MSs on the SST-2 validation set.
(a) Enforce hard IG constraints on Llama-3.2 1-2--b-10 Instruct
100 samples with 6=5c-2
200 samples with E=lc-1
Method
Constr. Sat.
Cos.
IoU
Acc.
Constr. Sat.
Cos.
IoU
Acc.
Original
25.45%
71.26%
32.34%
60.55%
38.15%
70.07%
30.83%
60.55%
SFT
52.67%
51.29%
32.17%
49.08%
67.07%
87.20%
37.14%
50.92%
DPO
51.70%
64.20%
23.73%
50.92%
65,88%
66.15%
35.81 %
50.92%
ProGrad
100.00%
99.69%
84.10%
60.67%
100.00%
98.82%
71.50%
59.63%
(b) Enforce hard IG constraints on Quen3-1.77 1.7BB
100 samples with 6=5c-2
200 samples with s=le-1
Method
Constr: Sat.
Cos.
IoU
Acc.
Constr. Sat.
Cos.
IoU
Acc.
Original
26.55%
64.70%
26.27%
85.89%
35.73%
64.81%
26.77%
85.89%
SFT
29.51 %
63. 63.09%
25.37%
89.22%
37.75%
58.64%
29.52%
51.03%
DPO
32.18%
56.52%
30. 18%
50.92%
37.72%
60.12%
31.18%
50.92%
ProGrad
100.00%
99.75%
84.59%
88.1%%
100.00%
99.05%
74.00%
88.07%
5.2 Enforcing hard Integrated Gradients constraints on LLMs for SST-2
In this experiment, we edit Llama-3.2-
LLMs so that the Integrated Gradients (IG) attributions (39 for set of sentences are e-close their expected IG attributions as determined by the corresponding teacher LLMs Llama-3.. 1..am-3..1-b-... Instruct and Qwen3-8B. We compare ProGrad against supervised fine-tuning (SFT) and direct preference opti- mization (DPO) (27) as baselines.
9 and Qwen3-1.78 48
Edit set. The edit set consists of misclassified sentences that have deviated IG attributions for the expected answer token. These sentences are misclassified samples from the Stanford Sentiment Treebank 2 (SST-2)(36 (36] training set, but correctly classified by the corresponding teacher LLM. For each sentence in the edit set, we take the corresponding IG from the teacher LLM as the expected IG attribution. For each LLM, we construct two such edit sets: (i) the first 100 misclassified sentences from SST-2 with 5=5e-2; (ii) the first 200 misclassified sentences from SST-2 with s=le-1.
IG constraints. For each sentence in the edit set and the corresponding expected IG L for the expected answer token, let L' denote the IG on the edited LLM N'; let L,, and L' denote the min-max-normaliza expected and edited IGs. We use IL. 1x S e as the IG constraint.
Results. As shown in Table 2 ProGrad the only method able to enforce the hard IG constraints and achieves the best accuracy in three out of four experiments. ProGrad also achieves the best similarity between the edited and expected IG measured by cosine similarity (Cos.) and intersection over union (IoU). In the Llama-3 3.2 2--1b-1 -o--nntruct experiment, ProGrad took 9 minutes for 100 samples, and 10 minutes for 200 samples. In the Qwen3-1.77 experiment, ProGrad took 28 minutes for 100 samples, and 32 minutes for 200 samples. For each baseline, we performed grid search over hyperparameters with a time limit of hours, and report the best results with the highest constraint satisfaction rate (Constr. Sat.). The baselines (SFT and DPO) failed to enforce the hard constraints, barely improved the similarity metrics, and in most cases decreased the accuracy of the edited L.LM on the SST-2 validation set.

---

Table Enforee hard gradient constraints on a function approximation DNN. Comparison of the gradient constraints violation rate (Grad. Violation), as well as the MSE error on the gradient training on both the
(Grad, Error) and output (Output Error). The GD baseline is regularization-basee DNN output and gradient. The GD + ProGrad method applies ProGrad after the eegulariaationbbase training to enforce the hard gradient constraints and minimize the gradient and output errors.
Method
Grad. Violation
Grad, Error
Output Error
GD
4.30%
4.25e-03
1.74e-03
GD ProGrad
0.00%
1.09e-04
1.50e-05
5.3 Enforce gradient constraints in training a DNN to approximate target function
In this experiment, we aim to enforce hard gradient constraints on a DNN that approximates target function. The gradient constraints are derived from the gradient of the target function. This experiment acts as a proxy for safety constraints in control systems and physical invariants in scientific applications. We compare ProGrad against regularized-biie training method, which incorporates the DNN gradients in the loss function.
Setup. We use 4-layer fully-connected DNN N : R - IR with 100 hidden neurons per layer and Tanh activation function. Over the domain [0, 3r). the DNN N trained to approximate the following function f: RR-
f(z = z cos + sin(x)
(21)
and the gradient
dNV' of DNN W approximates the gradient df IR + of the target function f: da
d di f(z)= x sin(2)
(22)
Gradient constraints. The target gradient function _ f(x) = x sin(x) is bounded by the upper bound function ghe
and the lower bound function gi (x = x, and we aim to enforce this hard constraint on the DNN gradient d N for all training samples Vor E D. - d(((x) S
Results. Table 3 presents the results of the experiment. Although regularization-baie based training on both the DNN output and gradient can achieve good (low) errors, the trained DNN is not free of the gradient constraints violations. Applying ProGrad after the regularization-bass training to enforce the hard gradient constraints as well as minimize the gradient and output errors can achieve 0% gradient constraints violation and further improve (decrease) the gradient and output errors. ProGrad took 10 seconds to edit this DNN.
Conclusion
We have presented ProGrad, the first efficient approach for provable gradient editing of DNNs that runs polynomial time in the size of the edited layers. We presented novel method for constructing conditional variable gradient of DNNs, enabling ProGrad an edit. To demonstrate the effectiveness of ProGrad, we evaluated ProGrad in enforcing hard Grad-CAM constraints ResNet DNNs for IMAGENET, enforcing hard Integrated Gradients constraints on Ilaama 3 and Qwen 3 L.LMs, and enforcing hard gradient constraints in training a function-approximatior DNN. The results highlight the unique capability of ProGrad in enforcing hard constraints on DNN gradients.
LP solver to find
Societal Impacts The use of hard constraints to edit DNNs enables learning with fewer data points, and guaranteeing the safety of DNNs. ProGrad can be used to make DNNs safer, trustworthy, and interpretable. However, because ProGrad is a general technique for editing the gradients of DNNs, it could also be misused, for instance, to tamper with the interpretation of a DNN.
Limitations ProGrad is currently limited to enforcing gradient constraints for (finite) set of input points. Future work could extend ProGrad to enforce gradient constraints for input polytopes by 40).
adapting ideas from APRNN 41 and
10

---

Acknowledgments and Disclosure of Funding
We would like thank the anonymous reviewers for their feedback and suggestions, which have greatly improved the quality of the paper. This work is supported in part by NSF grant CCF-2048123 and DOE Award DE-SC0022285.
References
[1] Mislav Balunovic and Martin Vechev. Adversarial training and provable defenses: Bridging the gap. In International Conference on Learning Representations, 2020. URL http:ttt//ppeereeiieee wwt/neet/fouree
id SJxDDDKr
[2] Gregory Bonaert, Dimitar I. Dimitrov, Maximilian Baader, and Martin T. Vechev. Fast and precise certification of transformers. In Stephen N. Freund and Eran Yahav, editors, PLDI '21: 42nd ACM SIGPIAN International Conference Progranmiigg Language Design and Implementation, Virtual Event. Canada, June 20-25, 2021, pages 466-481. ACM, 2021. doi: 10. 10.11455345348334554555 URL https://doi. org/ 10. 1145/ 333333343333333 3454056
[3] Salvatore Cuomo, Vincenzo Schiano Di Cola, Fabio Giampaolo, Gianluigi Rozza, Maziar Raissi, and Francesco Piccialli. Scientific machine learning through physics-informe informed neural networks: Where we are and what's next. Journal of Scientific Computing, 92(3):88, 2022.
[4] Claudio Ferrari, Mark Niklas Müller, Nikola Jovanović, and Martin Vechev, Complete verification via multi- neuron relaxation guided branch-and-houn International Conference on Learning Representations, 2022.
[5] Mare Fischer, Mislav Balunovic, Dana Drachsler-Coheet Timon Gehr, Ce Zhang, and Martin T. Vechev. DL2: training and querying neural networks with logic. In Proceedings of the 36th International Conference on Machine Learning (ICML), volume 97 of Proceedings of Muchine Learning Research. PMLR, 2019.
[6] Ben Goldberger, Guy Katz, Yossi Adi, and Joseph Keshet. Minimal modifications of deep neural networks using verification. In Elvira Albert and Laura Kovács, editors, LPAR 2020: 23rd International Conference Logic for Programming, Artificial Intelligence and Reasoning, Alicante, Spain, May 22-27, 2020, volume 73 of EPIC Series in Computing, pages 260-278. EasyChair, 2020. doi: 10.29007//999. URL
https://doi. org/rog/// 10. 29007/6994
[7] Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin. Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models, 2019.
[8] Kshitij Goyal, Sebastijan Dumancic, and Hendrik Blockeel. Deepsade: Learning neural networks that guarantee domain constraint satisfaction. Proceedings of the AAAI Conference on Artificial Intelligence, 38 (11):12199-1220, Mar. 2024. doi: 10. 16.19//aa v38i 11. 299.. URL htt.hhttt///oo// aaai. org// index
php/ TwA.AT/article/vieeee v299//9999//// 29109
[9] Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al- Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang. Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang. Archi Mitra, Archic Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava Spataru, Baptiste Roziere, Bethany Biron, Binh Tang, Bobbie Chern, Charlotte Caucheteux, Chaya Nayak, Chloe Bi, Chris Marra, Chris McConnell, Christian Keller, Christophe Touret, Chunyang Wu, Corinne Wong, Cristian Canton Ferrer, Cyrus Nikolaidis, Damien Allonsius, Daniel Song, Danielle Pintz, Danny Livshits, Danny Wyatt, David Esiobu, Dhruv Choudhary, Dhruv Mahajan, Diego Garcia-Olano, Diego Perino, Dieuwke Hupkes, Egor Lakomkin. Ehab AlBadawy, Elina Lobanova, Emily Dinan, Eric Michael Smith, Filip Radenovic. Francisco Guzmán, Frank Zhang, Gabriel Synnaeve, Gabrielle Lee, Georgia Lewis Anderson, Govind Thattai, Graeme Nail, Cregoire Mialon, Guan Pang. Guillem Cucurell, Hailey Nguyen. Hannah Korevaar, Hu Xu, Hugo Touvron, Iliyan Zarov, mmanol Arrieta Ibarra, Isabel Kloumann, Ishan Misra, Ivan Evtimov, Jack Zhang, Jade Copet, Jacwon Lee, Jan Geffert, Jana Vranes, Jason Park, Jay Mahadcokar, Jeet Shah, Jelmer van der Linde, Jennifer Billock, Jenny Hong Jenya Lec, Jeremy Fu, Jianfeng Chi, Jianyu Huang, Jiawen Liu, Jie Wang, Jiecao Yu, Joanna Bitton, Joe Spisak, Jongsoo Park, Joseph Rocca, Joshua Johnstun, Joshua Saxe, Junteng Jia, Kalyan Vasuden Alwala, Karthik Prasad, Kartikeya Upasani, Kate Plawiak, Ke Li, Kenneth Heafield, Kevin Stone, Khalid El-Arini, Krithika Iyer, Kshitiz Malik, Kuenley Chiu, Kunal Bhalla, Kushal Lakhotia, Lauren Rantala- Yeary, Laurens van der Maaten, Lawrence Chen, Liang Tan, Liz Jenkins, Louis Martin, Lovish Madaan, Lubo Malo, Lukas Blecher, Lukas Landzaat, Luke de Oliveira, Madeline Muzzi, Mahesh Pasupuleti, Mannat Singh, Manohar Paluri, Marcin Kardas. Maria Tsimpoukelli Mathew Oldham, Mathieu Rita, Maya Paylova, Melanie Kambadur, Mike Lewis, Min Si, Mitesh Kumar
11

---

Singh, Mona Hassan, Naman Goyal. Narjes Torabi, Nikolay Bashlykov, Nikolay Bogoychev, Niladri Chatterji, Ning Zhang, Olivier Duchenne, Onur Çelebi, Patrick Alrassy, Pengchuan Zhang. Pengwei Li, Petar Vasic, Peter Weng. Prajjwal Bhargava, Pratik Dubal. Praveen Krishnan. Punit Singh Koura. Puxin Xu, Qing Hc, Qingxiao Dong, Ragavan Srinivasan, Raj Ganapathy, Ramon Calderer, Ricardo Silveira Cabral, Robert Stojnic, Roberta Railcanu, Rohan Maheswari, Rohit Girdhar, Rohit Patel, Romain Sauvestre, Ronnic Polidoro, Roshan Sumbaly, Ross Taylor, Ruan Silva, Rui Hou, Rui Wang. Saghar Hosseini, Sahana Chennabasappa, Sanjay Singh, Sean Bell, Seohyun Sonia Kim, Sergey Edunov, Shaoliang Nie, Sharan Narang, Sharath Raparthy, Sheng Shen, Shengye Wan, Shruti Bhosale, Shun Zhang, Simon Vandenhende, Soumya Batra, Spencer Whitman, Sten Sootla, Stephane Collot, Suchin Gururangan, Sydney Borodinsky, Tamar Herman. Tara Fowler. Tarek Sheasha, Thomas Georgiou. Thomas Scialom. Tobias Speckbacher, Todor Mihaylov, Tong Xiao, Ujiwal Karn, Vedanuj Goswami. Vibhor Gupta, Vignesh Ramanathan, Viktor Kerkez, Vincent Gonguet, Virginie Do, Vish Vogeti, Vitor Albiero. Vladan Petrovic, Weiwei Chu, Wenhan Xiong, Wenyin Fu, Whitney Meers, Xavier Martinet, Xiaodong Wang, Xiaofang Wang, Xiaoqing Ellen Tan, Xide Xia, Xinfeng Xie, Xuchao Jia, Xuewei Wang, Yacllc Goldschlag, Yashesh Gaur, Yasmine Babaci, Yi Wen, Yiwen Song, Yuchen Zhang, Yue Li, Yuning Mao, Zacharie Delpierre Coudert, Zheng Yan, Zhengxing Chen, Zoe Papakipos, Aaditya Singh, Aayushi Srivastava, Abha Jain, Adam Kelsey, Adam Shajafeld, Adithya Gangidi, Adolfo Victoria, Ahuva Goldstand, Ajay Menon, Ajay Sharma, Alex Boesenberg, Alexei Baevski, Allie Feinstein, Amanda Kallet, Amit Sangani, Amos Teo, Anam Yunus, Andrei Lupu, Andres Alvarado, Andrew Caples, Andrew Gu, Andrew Ho, Andrew Poulton, Andrew Ryan, Ankit Ramchandani, Annie Dong. Annie Franco. Anuj Goyal, Aparajita Saraf. Arkabandhu Chowdhury, Ashley Gabriel, Ashwin Bharambe, Assaf Eisemman, Azadeh Yazdan, Beau James, Ben Maurer, Benjamin Leonhardi, Bernie Huang, Beth Loyd, Beto De Paola, Bhargavi Paranjape, Bing Liu, Bo Wu, Boyu Ni, Braden Hancock, Bram Wasti, Brandon Spence, Brani Stojkovie, Brian Gamido, Britt Montalvo, Carl Parker, Carly Burton, Catalina Mejia, Ce Liu, Changhan Wang, Changkyu Kim, Chao Zhou, Chester Hu. Ching-Hsiann Chu, Chris Cai, Chris Tindal, Christoph Feichtenhofer, Cynthia Gao, Damon Civin. Dana Beaty, Daniel Kreymer, Daniel Li, David Adkins, David Xu, Davide Testuggine. Delia David, Devi Parikh, Diana Liskovich, Didem Foss, Dingkang Wang, Duc Le, Dustin Holland, Edward Dowling, Eissa Jamil, Elaine Montgomery, Elconora Presani, Emily Hahn, Emily Wood, Tran Lc, Erik Brinkman, Esteban Arcaute, Evan Dunbar, Evan Smothers, Fei Sun, Felix Kreuk, Feng Tian, Filippos Kokkinos, Firat Ozgenel, Francesco Caggioni, Frank Kanayet, Frank Seide, Gabricla Medina Florez, Gabriella Schwarz, Gada Badeer, Georgia Swee, Gil Halpem, Grant Herman, Grigory Sizov, Guangyi. Zhang, Guna Lakshminarayanan, Hakan Inan, Hamid Shojamazeri, Han Zou, Hannah Wang, Hanwen Zha, Haroun Habeeb, Harrison Rudolph, Helen Suk, Henry Aspegren, Hunter Goldman, Hongyuan Zhan, Ibrahim Damlaj, Igor Molybog. Igor Tufanov, Ilias Leontiadis, trina-Elena Veliche, Itai Gat, Jake Weissman, James Geboski. James Kohli, Janice Lam, Japhet Asher. tean-Baptiste Gaya, Jeff Marcus. Jeff Tang. Jennifer Chan, Jenny Zhen, Jeremy Reizenstein, Jeremy Teboul, Jessica Zhong, Jian Jin, Jingyi Yang. Joe Cummings, Jon Carvill Jon Shepard, Jonathan McPhic, Jonathan Torres, Josh Ginsburg, Junjie Wang, Kai Wa, Kam Hou U, Karan Saxena, Kartikay Khandelwal, Katayoun Zand, Kathy Matosich Kaushik Vceraraghavan, Kelly Michelena, Keqian Li, Kiran Jagadcesh, Kun Huang, Kunal Chawla, Kyle Huang. Lailin Chen. Lakshya Garg. Lavender A. Leandro Silva, Lee Bell, Lei Zhang. Liangpeng Guo, Licheng Yu, Liron Moshkovich, Luca Wehrstedt, Madian Khabsa, Manay Avalani, Manish Bhatt, Martynas Mankus. Matan Hasson, Matthew Lennie, Matthias Reso, Maxim Groshev Maxim Naumov. Maya Lathi, Meghan Keneally, Miao Liu, Michael L. Seltzer, Michal Valko, Michelle Restrepo, Mihir Patel, Mik Vyatskov, Mikayel Samvelyan, Mike Clark, Mike Maccy, Mike Wang. Miquel Jubert Hermoso, Mo Metanat, Mohammad Rastegari, Munish Bansal, Nandhini Santhanam, Natascha Parks, Natasha White, Navyata Bawa, Nayan Singhal. Nick Egebo, Nicolas Usunier, Nikhil Mchta, Nikolay Pavlovich Laptev, Ning Dong, Norman Cheng. Oleg Chernoguz, Olivia Hart, Omkar Salpekar, Ozlem Kalinli, Parkin Kent, Parth Parekh, Paul Saab, Pavan Balaji. Pedro Rittner, Philip Bontrager, Pierre Roux, Piotr Dollar, Polina Zvyagina, Prashant Ratanchandani, Pritish Yuvraj, Qian Liang, Rachad Alao, Rachel Rodriguez, Raf Ayub, Raghotham Murthy, Raghu Nayani, Rahul Mitra, Rangaprabhu Parthasarathy, Raymond Li, Rebekkah Hogan, Robin Battey, Rocky Wang. Russ Howes. Ruty Rinott, Sachin Mehta, Sachin Siby. Sai Jayesh Bondu, Samyak Datta, Sara Chugh, Sara Hunt, Sargun Dhillon, Sasha Sidorov, Satadru Pan. Saurabh Mahajan, Saurabh Verma, Seiji Yamamoto, Sharadh Ramaswamy, Shaun Lindsay, Shaun I. Lindsay, Sheng Feng, Shenghao Lin, Shengxin Cindy Zha, Shishir Patil, Shiva Shankar, Shugiang Zhang, Shuqiang Zhang, Sinong Wang. Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanic Max, Stephen Chen, Steve Kehoe, Steve Satterfield. Sudarshan Govindaprasad, Sumit Gupta, Summer Deng, Sungmin Cho, Sunny Virk. Suraj Subramanian, Sy Choudhury. Sydney Goldman, Tal Remez, Tamar Glaser, Tamara Best, Thilo Koehler, Thomas Robinson, Tianhe Li, Tianjun Zhang, Tim Matthews, Timothy Chou, Tzook Shaked, Varun Vontimitta, Victoria Ajayi, Victoria Montancz, Vijai Mohan, Vinay Satish Kumar, Vishal Mangla, Vlad lonescu, Vlad Poenaru, Vlad Tiberiu Mihailescu, Vladimir Ivanov, Wei Li, Wenehen Wang. Wenwen Jiang, Wes Bouaziz, Will Constable. Xiaocheng Tang, Xiaojian Wu, Xiaolan Wang, Xilun Wu, Xinbo Gao, Yaniv Kleinman, Yanjun Chen, Ye Hu, Ye Jia, Ye Qi, Yenda Li, Yilin Zhang, Ying Zhang, Yossi Adi, Youngjin Nam, Yu, Wang, Yu Zhao, Yuchen Hao, Yundi Qian, Yunlu Li, Yuzi He, Zach Rait, Zachary Vito, 7ef Rosnbrick, Zhaoduo Wen, Zhenyu Yang, Zhiwei Zhao, and Zhiyu Ma. The lama herd of models, 2024. htLpst::: ///arxiv arxiiv org/ abs//40/ 21783
12

---

[10] Gurobi Optimization, LLC. Gurobi Optimizer Reference Manual, 2022. URL htlps: http:://wwwww http://www.g....bb.o com
[11] Dan Hendrycks and Thomas G. Dietterich. Benchmarking neural network robustmess to common corr tions and perturbations, In 7th International Conference on Learning Representaations, ICI,R 2019, New Orleans, LA, USA. May 6-9, 2019. OpenReview.net, 2019. URL BtKLlatpss//oppneeie.....eeeeee netfoorumm id=HDz6tiCqqm
[12] Nick Hoernle, Rafael Michael Karampatsis, Vaishak Belle, and Kobi Gal. Multiplexnet: Towards fully satisfied logical constraints in neural networks. Proceedings of the AAAI Conference Ar- tificial Intelligence, 36(5):5700-55
Jun. 2022. doi: 10.16699aaai..v3655..oooo //ojs. //jjsaaai. org/inexx php/ /AAAA///aartiic////e///25.....
URL https
[13] Hanjiang Hu, Yujie Yang, Tianhao Wei, and Changliu Liu. Verification of neural control barrier functions with symbolic derivative bounds propagation. In Pulkit Agrawal, Oliver Kroemer, and Wolfram Burgard, editors. Proceedings of The 8th Conference on Robot Learning, volume 270 of Proceedings of Machine Learning Revearch, pages 1797-1814. PMLR. 06 06-09 Nov 2025. URL https::/
mlr
press/ w2wp//2700//222 html
[14) Zhiting Hu, Xuezhe Ma, Zhengzhong Liu, Eduard Hovy, and Eric Xing. Harnessing deep neural networks with logic rules. In Proceedings of the 54th Annual Meeting of the Association for Compitational Linguis- tics (Volume I: Long Papers), pages 2410- 2420, Berlin. Germany, August 2016. Association for Computa- tional Linguistics. doi: 10.18653/v1/PH 1/P16/ 1228. URLAattps://ccaaattolllgg wwwpellyoyyooggggggg org/p16- 1228
[15] Jacob Laurel, Rem Yang. Shubham Ugare, Robert Nagel, Gagandeep Singh, and Sasa Misailovic. A general construction for abstract interpretation of higher-order automatic differentiation. Proceedings of the ACM on Programming Languages, 6(00PSLA2):1077 1035,113,,,,000 2022.
[16] Jacob Laurel, Siyuan Brant Qian, Gagandeep Singh, and Sasa Misailovic. Synthesizing precise static ana- lyzers for automatic differentiation. Proceedingy of the ACM on Programming Languages, 7(0OPSLA2): 1964-1992, 2023.
(17] Zenan Li, Zehua Liu, Yuan Yao, Jingwei Xu, Taolue Chen, Xiaoxing Ma, and Jian [X) Learning with logical constraints but without shortcut satisfaction. In The Eleventh International Conference on Learning Representations, 2023. URL /te[/ttts///peereviieee wttpeewweeeeeeeeeeeeeeee
[18] Vision maintainers and contributors. Torchvision: Pytorch's 's computer vision library. https
//github.com hatptubb.ccampptoorr///iissioa 2016.
[19] Dmitry Malioutov and Kuldeep S Meel. Mlic: A maxsat- based framework for learning interpretable classification rules. In International Conference on Principles and Practice of Constraint Prog ramming. pages 312-327. Springer, 2018
[20] Yuhao Mao, Mark Niklas Mueller, Mare Fischer, and Martin Vechev. Connecting certified and adversarial training. In Phirty--sventth Conference Neural Information Processing Systems, 2023. URL https //openreview.o wwt.///orrumndd-T2MMoooaaa.
[21] Matthew Mirman, Timon Gehr, and Martin T. Vechev. Differentiable abstract interpretation for provably robust neural networks. In Jennifer G. Dy and Andreas Krause, editors, Proceedings of the 35th Interna- tional Conference on Machine Learning, ICML 2018, Stockholmsmässan, Stockholm, Sweden, July 10-15, 2018, volume 80 of Proceedings of Machine Learning Research, pages 3575-3583. PMLR, 2018. URL http://a.mmmmppee.emeaeeeeeeee
http://procceeingg. mlr, wwwpppresssseeee veteaee///0mmiiii mimaan18mmmmmmmmbbmmmmmmmm.11mmm html
[22] Mark Niklas Mueller, Franziska Eckert, Mare Fischer, and Martin Vechev. Certified training: Small boxes are all you need. In The Eleventh International Conference on Learning Representations, 2023, URL https://openrevi.ce
net/forum? wdw.:iddddooPuoooupoo
[23] Yatin Nandwani, Abhishek Pathak, Mausam, and Parag Singla. primal dual formulation for deep learning with constraints. H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-But Buc, E. Fox, and R. Garnett, editors, Advances in Neural Information Processing Systems, volume 32. Curran As- sociates, Inc., 2019. URL hwt.:hhtt////t. //pp:e////c..c........mm nwwripsu.ccc.m wttppppp.ccppppppppppppppp https///eppppe...ees/epppeeeeeee htteeee/pppp//219///ee 177088/1.eec03337744444444553533 Paper. .pd
[24] Alessandro De Palma, Rudy Bunel, Krishnamurthy Dvijotham, M. Pawan Kumar, and Robert Stanforth. 1bp regularization for verified adversarial robustness via branch-and-bound, 2023.
[25] Geondo Park, June Yong Yang. Sung Ju Hwang, and Eunho Yang. Attribution preservation in network compression for reliable network interpretation. Advances in Neural Information Processing Systems, 33: 5093-5106 2020.
13

---

[26] Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan. Trevor Killeen, Zeming Lin, Natalia Gimelsheia, Luca Antiga, Alban Desmaison, Andreas Köpí, Edward Z. Yang. Zach Viti,o, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai. and Soumith Chintala. Pytorch: An imperative style, pirh--eeformance deep learning library. CoRR, abs/1912.01 703, 2019. http:/tt://aatt httt:::/aarxv..org//a///////// wwtps//91...000 1912.01703
[27] Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly reward model. Advonces in neural information processing systems, 36:53728-53741, 2023.
[28] Maziar Raissi, Paris Perdikaris, and George E Karniadakis, thysies-informed neural networks: A deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations. Journal of Computationall physics, 378:686-707, 2019.
[29] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-CAM visual explanations from deep networks via gradient- based localization. Interna- tional journal of computer vision, 128:336-359, 2020.
[30] Ramprasaath Ramasamy Selvaraju, Stefan Lee, Yilin Shen, Hongxia Jin, Shalini Ghosh, Larry P. Heck, Dhruv Batra, Devi Parikh. Taking a HINT: leveraging explanations to make vision and language models more grounded. In ICCV, pages 2591-2600. JEEE, 2019.
[31] Zhouxing Shi, Yihan Wang. Huan Zhang. Jinfeng Yi, and Cho-Jui Hsieh. Fast certified robust training with short warmup. In JCML 2021 Workshop on Adversurial Machine Leurning, 2021. URL https jUobmvki51
[32] Zhouxing Shi, Yihan Wang, Huan Zhang. J Zico Kolter, and Cho-Jui Hsieh. Efficiently computing local lipschitz constants of neural networks via bound propagation. Advances in Neural Information Processing Systems, 35:2350-2364, 2022.
[33] Zhouxing Shi, Qirui Jin, J Zico Kolter, Suman Jana, Cho-Jui Hsich, and Huan Zhang. Formal verification for neural networks with general nonlincaritics via branch-and-bound, 2023.
[34] Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus Püschel, and Martin T. Vechev. Fast and effective robustness certification. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicalò Cesa-Bianchi, and Roman Garnett, editors, Advances Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurlPS 2018, December 3-8, 2018, Montréal, Canada, pages 10825 10836, 2018. URL https: //pooeedd//oc Awtes--ttttttttteeeeeeeeeeeeeeee html
[35] Gagandeep Singh, Timon Gehr, Markus Ptischll, and Martin T. Vechev. An abstract domain for certifying neural networks. Proc. ACM Program. Lang., 3(POPL):4111 :::::::::::111::::: 11::300 2019. doi: 10.1145/3290354, URL
https://doi. orgg 10. 1245/329
[36] Richard Socher. Alex Perelygin, Jean Wu, Jason Chuang, Christopher D. Manning, Andrew Y. Ng, and Christopher Potts. Recursive deep models for semantic compositionality over a sentiment treebank. In Proceedings of the 2013 Conference on Empirical Methods in Natural Language Processing, EMNLP 2013, 18-21 October 2013, Grand Hyatt Seattle, Seatrle, Washington, USA, A meeting of SIGDAT, Special Interest Group of the ACL, pages 1631-1642. ACL, 2013. htppl/tttts//ccaaatooloooge org/ D13-11707
[37] Matthew Sotoudeh and Aditya Thakur. Prdnn. htttpe//giihhb..cc//55511//////
wtt.:///////////////0000 2021.
[38] Kaustubh Sridhar, Souradeep Dutta, James Weimer, and Insup Lec. Guaranteed conformance of neurosym- bolic models to natural constraints. In Learning for Dynamics and Control Conference, pages 76-89. PMLR, 2023.
[39] Mukund Sundararajan, Ankur Taly, and Qiqi Yan. Axiomatic attribution for deep networks. In International conference machine learning, pages 3319 3328. PMLR, 2017.
[40] Zhe Tao and Aditya Thakur. Provable editing of deep neural networks using parametric linear relaxation. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https // //openreview
[41] Zhe Tao. Stephanie Nawas, Jacqueline Mitchell, and Aditya V. Thakur. Architecture proeetrrrrrreeeeinngggg provable repair of deep neural networks. Proc. ACM Program. Lang.. 7(PLDI), jun 2023. doi: 10.1 10.1145/3992238 URL httpss :/dotp org/ 10. 1144//591128
14

---

[42] Leandro von Werra, Younes Belkada, Lewis Tunstall. Edward Beeching, Tristan Thrush, Nathan Lambert, Shengyi Huang, Kashif Rasul, and Quentin Gallouédec. TRL: Transformer Reinforcement Learning, 2025.
URL URLLhttps://githaan com/huggingface/tzz
[43] Shiqi Wang, Huan Zhang. Kaidi Xu, Xue Lin. Suman Jana, Cho-Jui Hsieh, and J. Zico Kolter. Beta- crown:
Efficient bound propagation with per-neuron split constraints for neural network robustness verification. In Marc Aurelio Ranzato, Alina Beygelzimer. Yann N. Dauphin. Percy Liang, and Jen- nifer Wortman Vaughan, editors, Advances in Neural Information Processing Systems 34: Annual Conference on Neural Information Processing Systems 2021, NeurIPS 2021, December 6-14, 2021, virtual, pages 29901, 2021. URL facTfeaddddarccaff0e1aaa www.:aaeeeaea--aaatttttt....a...
nww.nig....uuurs... http:/iw..nnnrr..ccppppppeeeeeee wwtppcpppp/p////eeeeeeeee /2211/hash/
[44] Tianhao Wei, Hanjiang Hu, Luca Marzari, Kai S Yun, Peizhi Niu, Xusheng Luo, and Changliu Liu. Mod- elverification. jl: comprehensive toolbox for formally verifying deep neural networks. In International Conference on Computer Aided Verification, pages 395-408. Springer, 2025.
[45] Jingyi Xu, Zilu Zhang, Friedman, Yitao Liang, and Guy Van den Broeck. A semantic function for deep learning with symbolic knowledge. In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning. volume 80 of Proceedings of Machine Learning Research. pages 5502-5511. PMLR, 10-15 15 Jul 2018. URL http:ttt/rocceeed/iiii
mmr. www.prressvvo
xu18h. html
[46] Kaidi Xu, Huan Zhang, Shiqi Wang, Yihan Wang. Suman Jana, Xue Lin, and Cho-Jui Hsieh. Fast and complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers. In 9th International Conference on Learning Representations, ICLR 2021, Virtual Event, Austria, May 3-7, 2021. OpenReview.net, 2021. httttt:::://prrr////// net.
[47] Ziwei Xu, Yogesh Rawat, Yongkang Wong, Mohan S Kankanhalli, and Mubarak Shah. Don't pour cercal into coffce: Differentiable temporal logic for temporal action segmentation. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors, Advances in Neural Information Processing Systems, volume 35, pages 14890- 14903. Curran Asso- ciates, Inc., 2022. URL httpps:/pproceedings neurips weerrpp..ccpaper. httplpapppealleaalllllppppa www.:fftweeeeeeeeeeeeeeeeeaeeeee (taper//022/flee.. Conference pdf
[48] An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report. arXiv preprint arXiv:2505.090 09388, 2025.
[49] Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsich, and Luca Daniel. Efficient neural network robustness certification with general activation functions. In Samy Bengio, Hanna M. Wallach, Hugo Larochelle, Kristen Grauman, Nicolò Cesa-Bianchi, and Roman Gar- nett, editors. Advances in Neural Information Processing Systems 31: Annual Conference on Neural Information Processing Systems 2018, NeurIPS 2018, December 3-8, 2018, Montréal, Canada, pages 4944 2018. URL htttps://proooooo http::///oooeeein....e neurigs.. www..ne..c..apppeee...e httpppppccccpppp////////ee//// 2aaer//208/hhhhh 00086f110055055e6aa111131333 -tw.:ebbbbbbbe--baaaaatttt httmtl
[50] Huan Zhang. Tsui-Wei Weng. Pin-Yu Yu Chen, Cho-Jui Hsich, and Luca Daniel. Efficient neural network robustness certification with general activation functions. Advances in neural information processing systems, 31, 2018
15

---

A Proofs
Theorem 4.3. Given a provable gradient editing problem (Definition 4.1 for DNN N and pa- a N(x: 0) be S Let The
rameters 0 with input and a gradient constraint QQ def {z R" the conditional variable gradient of the DNN N with respect to the input x, under the activation condition vp The following linear program can be solved in polynomial time in the size of the edited layers of the DNN N. and its solution is a solution to the provable gradient editing problem.
min 1|0
011
S.L.
A ÕX
X 0 Zb
(15)
Proof. We first show that Equation 15 is a linear program that can be solved in polynomial time in the size of the DNN. By the definition of conditional variable gradient (Definition (42).
(i) a N(x; 9) is a linear expression and v is a linear formula, hence Equation 15 is linear program; the
(ii) the sizes of both xx 2 Nx: 0) and e are polynomial the size of the DNN, i... the number of parameters, layers, and the input and output dimensions of each layer, hence Equation [3] can be
solved in polynomial time in the size of the DNN.
We then show that any solution to Equation 15 is a solution to the provable gradient editing problem (Equation in in Definition[A.1 By the definition of conditional variable gradient (Defi- nition 4.2 for any solution O' to the variable parameters 0 that satisfies the activation condition e Ox
8' Nx: 8¹), hence A a Nxx 8¹) < b holds and Equation 14 is satisfied.
Theorem 4.5. The conditional variable gradient constructed in Definition 4.4 is valid and satisfies
the conditions stated in Definition 4.2
Proof. We will recall Definition and prove this theorem step by step. Consider an L-layer feed-forward ReLU deep neural network (DNN) W with parameters (W W(), W (co) b( b(c-11), where the first-layer weight W(0) and all-layer bi- a
def
ases (0 are variables. For an input E R", the conditional variable gradient 8x NN(xx;) (x of a DNN N in terms of 0 with respect to the input x is defined by the chain rule as
(++1) (2())
N [ 0
(23)
Ox
O2( (
with the activation condition v0 def
defined from each layer l.
We will show below that (i) except for
og for the first layer é = 0 is a linear expression, are constant matrices (ii) (0)) for each layer E are linear formulas, and S
ox
all other D
og
O0 linear expression, and their sizes are polynomias in the number of input and output ag
neurons well parameters of the layer E; (iii) for each layer L,
and immiiiss Consequently, we can conclude that (i) xx_N Nx: 0) is linear expression, because (g((-1) and 86ee
2g
ogg++1)
ag(t-1) (
(5 Ox and many constant matrices (all other
it is product of one linear expression
201O : ) (ii) vp Ae ((())sss is linear formula, the sizes of & Nx; 0) and の are polynomial in the size of the DNN NS i.c.. the number of parameters, layers, and the input and output dimensions of each à
layer; (iii) by induction, T implies à (x; 0) exx (xx 0). Hence, the conditional variable gradient constructed in Definition 4.4 is valid and satisfies the conditions stated in Definition 4.2
3x
We first prove those conditions for the affine transformation. For the conditional affine transfor- mation ()) def W ((0) of the first layer é O with variable weight W(O and constant input
x ()) the conditional variable gradient (g(0) of the pre-activation output (()) with respect to the layer input x (0) is
del
W(
(24)
Ox
(0)
16

---

which (i) is matrix of variable weights whose size is the same as W hence linear; (ii) uncon- ditionally equals to the exact gradient ( del
W
O
For the conditional affine transformation 200 del
W ((0) of the non-firstllayer & with
constant weight ( and conditional variable input x the conditional variable gradient pre-activation output ( with respect to the layer input x
0g 2 of the
del
W
(25)
which (i) is a constant matrix, hence linear; (ii) unconditionally equals to the exact gradient Og W(
For the conditional ReLU activation ((++1) diag (12(050) ( non-last layer L 1, let be the number of output neurons of the layer We first show that (sg(e11)
ogeer is a constant matrix, and ( is a linear formula whose size is polynomial in the number of output neurons p of the layer é. Recall that the conditional variable gradient og(++1)
of the E-th layer post-activation output Oaeey
g(++1) with respect to the pre-activation output i
(b((++) de (iag(()(())))
(26)
(2
with the E-th layer activation condition (
( def diag (10000) (00) A (Lag())()))) 200) S
(27)
+1)+ (
E RPxP is a constant matrix of size p x p. and is a conjunction of p linear inequalities, (
hence ag(e) is a constant matrix, ( a linear formula whose size is polynomial the number of output neurons p of the layer
We then show that (0)) implies
(8-++1
(1+++1)
where (++1) def (e) The activation
condition ((() constrains the ReLU activation pattern of the pre-activation conditional variable output ( to be the same as constant pre-activation output z((), Hence, if ((() is satisfied, then (i) for
any z (f) 0, we have the conditional variable z(() >> 0, hence x (f++1) = and 1g,00 1; (ii) for
any 2; < O, we have the conditional variable z! < 0, hence x ((+1) 0 and 1 22>0 = 0. Therefore,
we proved that (0() implies diag (1 (0)))) diag (1205)), which is our goal (x
(2+)+))
00 (g
For the last layer L- without ReLU activation, (5
diag(1) is an identity
is a constant matrix, (L-1) is a linear formula of constant size, and (((-1) trivially implies 2g(4) 0214-11
matrix and ((L-1) T has constant size. Hence, for the last layer l L-1,
(5(6)
(g(L)
17

---

B General provable gradient editing of DNNs
In this section, we present the extension of our approach presented in Section solve the general provable gradient editing. which handles (i) efficient editing: our approach allows editing only the last few layers of the DNN while keeping the rest of the DNN unchanged, which enables efficient editing of large DNNs; (ii) general DNN architectures: the editing is not restricted to multi-layer perceptron (MLP) fully-connected ReLU DNNs, but applies to DNNs of any architecture with an MLP ReLU DNN as the last few layers; (iii) set of inputs: our approach can edit the DNN for a set of inputs at the same time, guaranteeing constraint satisfaction for all of them; (iv) general linear constraints: our approach allows any linear constraints over the set of inputs, well their corresponding DNN outputs and gradients, not restricted to constraints that only talk about individual inputs. The effectiveness and efficiency of our approach for solving the general provable gradient editing problem is demonstrated in our experiments (Section) 5
Definition B.1. Given a DNN N del N(up) (doww), which is a composition of a general DNN of any differentiable architecture, and an L-layer fully-connected ReLU DNN b((-1))
A((P); RPP RR
N (down): R Th' with parameters O (W W(1) ..... (((-1),b()) ((....,,,b(._)))) as defined in Definition 3.1 Let 0 def (W(") W(1), W ((0) ((2), b(4-1) be the new parameters of
x E R x {Q | Q S [R=x"] of pairs (x, Q), where x E IR" is a DNN input, and Q def [J R m A (J) S b) is the corresponding linear constraints on the Jacobian J def
A((oww)) Given a set S C {x
Nxx 0) Rm of the DNN / with respect to the input x R", we use J to denote the Jacobian matrix J flattened as vector. The provable gradient editing problem is to find new parameters 0 that
xx
min 00 011
s.t.
dx Nix; EQ
(28)
(x.Q)E
The problem above can be solved using conditional variable gradient of DNNs defined in Defini- tion 4.4
Oz. (up)
min 110 011
s.t.
(a(up) (up)
A A
V (down)
(2 (up), 0 S b
(29)
uup)
(x,Q)ES
where z ((P)) def (x(PP(()) denotes the input to (doww)) ( denotes the activation condition con- dz("r) denotes the Jacobian matrix of z (up) with respect to x.
straint for (x, Q) E S,
ox
B.1 Analysis of the LP Size
First, we would like to emphasize that the size of the formulated linear program (LP) does not necessarily depend on the size (depth and width) of the entire DNN; viz., the size of the LP does not necessarily grow with the size of the DNN. Because ProGrad does not require editing from the first layer; in practice, ProGrad allows editing only the last few layers (Af(dowu)) of the DNN, while keeping the rest of the DNN ("D) unchanged, enabling efficient editing of large DNNs.
In this section, analyze the size of the LP for formulating the conditional variable gradient for one input in terms of the depth and width of the non-frozen editing-layers A (ddow)) which are the the last L layers of an arbitrarily large DNN. For ease of presentation, we assume A is a feed-forward ReLU for 0 < << L be the input and output widths of DNN as defined in Definition 3.1 Let ne and fi++1
the ê-th layer, viz., (() E IR. 2 2 RR=++ ( E TR Xnæ and (( E Re++s We will show that the size of the formulated LP for each edited layer is polynomial in the input and output widths of that layer, hence the LP size for encoding the conditional variable gradient of large DNN A for one
input is polynomial only in the size of the last L edited layers A[dow))
LP size for encoding the pre-activation conditional variable output. For the first layer e 0. encoding the pre- mrcactivationn conditional variable output ( (Equation 7
(0) der Wi (0) x (0) + b((0)
18

---

2 + [ + |600| M07 -M -1gh1 + 2nh variables and less than [ x (1 + + 1) - n + 2n, non-zero entries in the formulated LP.
uses (2(0)
1 constraints,
For other layers 0 < & < L, encoding the pre-activation conditional variable output ( (Equation
の (() + (())
uses |
nig+1 constraints, ア + (1
B ne+1 + ne + R4+1 + 2me+1 variables +1) 7g + 2n1+1 non-zero entries in the formulated LP.
and less than [
|
LP size for encoding the post-activation conditional layer output. For any layer 0 L. encoding the ε-th layer post-activation conditional variable layer output ((++1) (Equation 9
g def diag (1(0))) 2(e)
uses [(+1)] = ne+1 constraints,
(x(++>| + こ ne+t + n8+1 = 2ng+1 variables and less than
2 x
[e+1]] 2ns+1 non-zero entries in the formulated LP.
LP size for encoding the activation condition. For any non-last layer S f< L encoding the f-th layer activation condition (Equation 10
(
(lag(11)))) 2
0 A diag(1_(gg))) 2 S
(10)
uses x x = 2n constraints, [ = 7i411 variables and less than x [ 2ng+1 non-zero
entries in the formulated LP.
For the last layer
1, there is no ReLU activation, hence no activation condition to encode.
LP size for encoding the conditional variable gradient. Encoding the conditional variable gradient
for the first editing layer tx(
ag (Equation 20
(0)
(20)
Ox
ni constraints,
(2)
(0)
non non variables, and less than 2
8x
(2 (x
(01)) 2mg 2n. non-zero entries in the formulated LP.
Because the gradient for / (ddown)(1:L)) is constant, encoding the variable gradient for 9 Adddowyy (x: 0)
dx uses Ny7l constraints, no7L + mi variables, and less than ny x n + nonz non-zero entries in the formulated LP.
Because the gradient for the frozen layers (((p)) is constant, let denote the input width N, encoding the variable gradient for N uses naz constraints, mng + ngnt variables, and less than nng nnz nnz non-zero entries in the formulated L.P.
Therefore, by induction, we have that the size the formulated LP for encoding the conditional variable gradient for one input is polynomial in the input and output widths of each edited layer, hence polynomial in the size of the last L edited layers Af(dww)) instead of the entire DNN A. When editing the DNN gradients for a set of inputs, the size of the formulated LP grows linearly with the number of inputs in the set.
19

---

C Evaluation Details
C.1 Enforcing hard Grad-CAM constraints on ResNet DNNs for IMAGENET.
In this section we present the experiment details for Section 5.1
Setup details. For the two edit sets, (i) the 100 images with g=le-2 edit set consists of the first 100 images from the first 50 classes of the IMAGENET-C dataset with Gaussian noise and severity 1, for which the original uncorrupted images are correctly classified, while the corrupted images are top-1 misclassified but top-5 correctly classified; (ii) the 1,000 images with E=Se-2 edit set consists of the first 1,000 images from the first 200 classes of the IMAGENET-C dataset with Gaussian noise and severity I, for which the original uncorrupted images are correctly classified, while the corrupted images are top-1 I misclassified but top-5 correctly classified. Both cosine similarity and IoU are computed on the min-max con-max-nonne normalznel Grad-CAM attributions, where IoU uses a 75% percentile threshold.
The ResNet152 DNN is from torchvision with the pre-trained weights https///dccssptttcc.hoom pytorch. arrtorch.org/viiioo/mm.... htt.::/i@...ttttttooossss...... models.
moelaa//eearaate//rrrvvvaaa... models https://doces
Restlet152_Weiightte The ResNet50 DNN is from torchvision with the pre-trained weights
RessletsO_KVeightt_MMMEEEEE
V1: http:://do...ptorrdooo/o///////s
generateet/torcavisiooo..c models. htt.://www.........moom.o......r htt.://rr..craaaoooooo.oo.eaaaaa ReaNet500_ Weights
For each guudient-descent-baae number of epochs, and transfer weight hyperparameters, with a time limit of 12 hours, and report the best results with the best constraint satisfaction rate.
baseline, we perform grid search over the learning rate, batch size,
Setup for EWA baseline. The hyperparameters are taken from the original EMA experiments. We use the SGD optimizer with learning rate le - 3, momentum 0.9 and weight decay le - 4. We fine-tune the last layer of ReaNet152 for 300 epochs with batch size of 100. For the 100 images with & = le - 2 experiment, we use the transfer weight le4; for the 1000 images with e = 5e - 2 experiment, we use the transfer weight 1e3.
Setup for SWA baseline. The hyperparameters are taken from the original SWA experiments. We use the SGD optimizer with learning rate 1e 3. momentum 0.9 and weight decay 1c - 4. We fine-tune the last layer of ResNet152 for 300 epochs with a batch size of 100. For the 100 images with 1e 2 experiment, experiment, we use the transfer weight 1e3.
the transfer weight le4; for the 1000 images with 5e
Setup for SSWA baseline. The hyperparameters are taken from the original SSWA experiments. We use the SGD optimizer with learning rate Ie - 3, momentum 0.9 and weight decay le - 4. We use the SSWA erase rate 0.3, and fine-tune the last layer of ResNet152 for 300 epochs with a batch size of 100. For the 100 images with e = le - experiment, we use the transfer weight 1e4; for the 1000 images with 5e 2 experiment, we use the transfer weight 1c3.
Setup for ProGrad. We edit the last layer of both ResNet DNNs, with the changes to the parameters bounded by [-3,3]
Additional statisties for Grad-CAM similarity metries. Figure shows the statistics of various Grad-CAM similarity metrics, viz., the constraint satisfaction rate (Constr. Sat.), cosine similarity (Cos.) and intersection over union (IoU) between the expected and edited Grad-CAM attributions for the ResNet152 experiments.
Additional generalization results. In Table 4 present additional generalization results for the ResNet 152 experiment on enforcing hard Grad-CAN constraints with 1000 samples in Section As evidenced by the results, ProGrad ad improves those metrics comparing the original model, and achieves the best generalization comparing to the baselines.
C.2 Enforce hard Integrated Gradients constraint for SST-2 Llama LLM.
In this section we present the experiment details for Section 5.2
20

---

Constraint Satisfaction
Cosine Similarity
Intersection over Union
1305
LiVE
3004
Mhxta XMY
404
900
300
3/0
69
Miwul 2015
Original
TAA
SWlt
SSW
ProGrad
Origina
FMA
52A
E5VA
Prodrad
Original
FSA
Prodrad
Statistics of the 100 images with 6= experiment ResNet152.
Coustraint Satisfaction
Cosine Sinilarily
Intersection over Union
2454
0Y5
0:1
4894
3-5
340
66c
Mix25505
Origina
ENA
39W
854A
ProOrod
Origina
EWA
87Ak
8BW
PeoOrod
Original
EVit
8MA
Prodrad
(b) Statistics of the 1,000 images with 6=5e-2 experiment ResNett552.
Figure 4: Additional statistics for Grad-CAM similarity metrics of Table [ in the main paper (Section 5. viz., the (pixel-level) Grad-CAM constraint satisfaction rate (Constr. Sat.), cosine similarity (Cos.) and intersection over union (IoU) between the expected and edited Grad-CAMs.
Table 4: Additional generalization results for the ResNit1152 experiment enforcing hard Grad-CAM constraints with 1000 samples in Section [.1 For a generalization set consisting of 4,000 images that's s similar to the 1,000-image edit set but with different corruption levels, present the constraint satisfaction rate (Constr. Sat.) with s=le- 1, cosine similarity (Cos.) and intersection over union (IoU) on the generalization set, as well as the top-1 accuracy (Acc.) of the edited DNN on the ILSVRC 2012 IM AGENET validation set. As evidenced by the results, ProGrad improves those metrics comparing the original model, and achieves the best generalization comparing the baselines.
Method
Constr. Sat.
Min. Cos.
Min. IoU
Acc.
Original
32.98%
77.53%
39.42%
78.31%
EWA
35.71%
82.41%
39.89%
73.32%
SWA
36.15%
84.74%
45.28%
76.55%
SSWA
36.16%
84.74%
45.26%
76.56%
ProGrad 42.35%
85.75%
47.43%
77.43%
Gauss- Setup details. For both constant and conditional variable integrated gradients, Legendre quadrature to approximate the integral with 25 steps in bfloat16 precision. Fol- lowing the common practice, we use the zero point in the token space as the baseline, i.c.. a vector of token ID O. We apply hard constraints and evaluate IG similarity metrics on the IG of the actual sentences from the SST-2 dataset, ignoring the template and special to- kens. Both cosine similarity and loU are computed on the min-maax-nrmallle tions, where IoU uses 50% percentile threshold. The Ll Llama-33 L1ama-3.2-11 3.2-1b 1.2--b-Insttucc LLM for edit- ing is from http:: https:/ -aama-3.1-bb-nnstte
IG attribu-
co/ too/meta--ie www.llaaaaaaaaamaaaaaae L1 ama 2- 2-1B- Instruct) The teacher LLM for computing the expected IG from wttphhttp:/ttt hhttps:/huuggiggface /ttp//aaallaamm/aaaaaaa.1.1----- Instruct The Qwen3-1.78 LLM for editing is from https:
The teacher Qwen3-8B L.LM computing the expected
IG is from woomtttp::/huugiiggeeee. co. Qwen/ http///een38B
21

---

For each gradient-deseee deeceett-bssee baseline, we perform grid search over the learning rate, batch size, number epochs, and trainable parameters, with time limit of 4 hours, and report the best results with the best constraint satisfaction rate.
42 with learning rate from {1e-3, le-4), epochs from {1, 2, 3, 4, 5), bfloat16 precision, and trainable parameters from the language modelling head (1m hem_h only or all layers. In Table we report the best results among all hyperparameter combinations with the highest constraint satisfaction rate. For the Llama 3 experiment with 100 samples, the best result uses learning rate of le-3, fine-tunes all layers for epoch; for the Llama 3 experiment with 200 samples, the best result uses learning rate of 1e-3, fine-tunes all layers for epochs; for the Qwen experiment with 100 samples, the best result uses a learning rate of le-4, fine-tunes all layers for epochs; for the Qwen 3 experiment with 200 samples, the best result uses learning rate of le-3, fine-tunes all layers for epochs.
Setup for SFT baselines. We use tr1
Setup for DPO baselines. We use trl 42 with a learning rate from {le-3, le-4), epochs from {1, 4, 5). bfloat16 precision, and trainable parameters from the language modelling head (lm_head) only or all layers. In Table 2 we report the best results among all hyperparameter combinations with the highest constraint satisfaction rate. For the Llama 3 experiment with 100 samples, the best result uses learning rate of le-3, fine-tunes all layers for epoch; for the Llama 3 experiment with 200 samples, the best result uses learning rate of le-3, fine-tunes all layers for 1 epoch; for the Qwen 3 experiment with 100 samples, the best result uses learning rate of Ie-3, fine-tunes 1m head for epoch; for the Qwen 3 experiment with 200 samples, the best result uses a learning rate of 1e-3, fine-tunes 1m head for epoch.
Setup for ProGrad. For both LLMs, edit the language modelling head (1m (1m_ head) with the changes to the parameters bounded by [-10, 10j.
C.3 Enforce gradient constraints in training a DNN to approximate target function
Setup. We use 4-layer fully-connected DNN N R R with 100 hidden neurons per layer and Tanh activation function. Over the domain [0, 3T]. we uniformly sample 2,048 points as the dataset D. The DNN N is trained to approximate the following function f R R
fx) = cor + sin(x:
(30)
and the gradient
d. der
DNN N approximates the gradient of : + of the target function f:
d
dr f(x) x sin(2)
(31)
Gradient constraint. The target gradient function यe [xx) x sin is bounded by the upper bound function gu (x) and the lower bound function gi (z) xx and we aim to enforce this hard constraint on the DNN gradient 4 N.V: for all training samples Vz E D.
de NN(x) S
Setup for GD baseline. We use the Adam optimizer with learning rate 0.01, and exponential learning rate decay with y 0.997. We train the DNN for 300 epochs with batch size of 64, using the following loss function to learn both the DNN output and the gradient:
((x) (S)(( f(z) MSE
Nxx,,
de f(x))
(32)
dx
Setup for ProGrad. We edit the last layer of the GD trained DNN, with the following hard constraints
Vx E D. -x S Nx 0) <
dx
while minimizing the difference between the DNN outputs and gradients with the reference outputs and gradients.
22

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The theoretical claims the abstract and introduction are presented in Section and proved in the appendix. The empirical claims in the abstract and introduction are justified in Section
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
The limitations are discussed in Section
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
23

---

Answer: [Yes]
Justification: The full set of assumptions and informal proof sketch are provided in Section complemented by formal proofs in the appendix.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: Section complemented by the appendix fully disclose all information needed to reproduce the technique, and Section complemented by the appendix fully disclose all information needed to reproduce the experimental results.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.

---

5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Answer: [No]
5.2 open-access. benchmarks. For the Justification: The experiments Section 5.1
implementation of our tool, we could not make the code open access due to ongoing IP restrictions.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
for more details.
While we encourage the release of code and data, we understand that this might be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The experimental settings presented in Section complemented by further details the appendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, or as supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [No]
Justification: Because the proposed algorithm is deterministic, we instead evaluate our approach on variety of benchmarks and setups to demonstrate its efficacy and efficiency.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by enror bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
25

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out range (e.g. negative еπτог rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: The evaluation platform and runtime are provided in Section 5 and the ap- pendix.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics httpus//neurips.. http://p....ppullltcccccccaataae
Answer: [Yes]
Justification: The research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., s if there is special consid- eration due to laws or regulations in their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: This is discussed in Sections and
Guidelines:
The answer NA means that there is no societal impact of the work performed.
26

---

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper proposes an efficient and provable gradient editing approach of DNNs, which does not involve releasing of data and models that have high risk for misuse.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model. for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: Section the appendix cites the original papers that produced the baselines, tools, models and benchmarks used in the paper.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
27

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the datasets.paperssiii paperswi thcode. www.coo//aaaaa datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not introduce new assets in the paper.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This paper does involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
28

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: The core method development in this research does not involve LLMS as any important, original, non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy hatt:p//eearrrppcc//ooofeeeeeee/ /ct/////oeeeeeecc//22////.. for what should or should not be described.
29


Reviews:
[{"review_id": "YNK90ca4D4", "reviewer": "Reviewer_eGW9", "summary": "This work proposes provable gradient editing using linear programming by relaxing nonlinear constant exact gradient of the deep neural networks (with ReLU activations) to linear variable gradients under constraint activation condition. While input/output constraint prior methods are available ProGrad is novel in applying constraints on gradients. Linear gradient expression and the activation condition is polynomial in the size and scales well.The authors present three applications: enforcing GradCAM constraints on ResNet152, Integrated Gradients (IG) on a Llama 3 LLM, and physical gradient constraints in scientific computation tasks. Their evaluation setting contains perturbed input which results in misclassification in the baseline  that is fixed by ProGrad by applying the constraints and solving with Linear Programming. Empirical evidence supports the author's claims about performance.", "questions": "I have main question in the evaluation\n1. LLM evaluation table (table 2) includes only generic term FT? Which method was tested here? Are all tested to average out the performance?\n2. Does not sufficiently evaluate the effects on “correctly classified” inputs. And overall accuracy not just edit sets. Is it applied to all the samples?\n3. Choice of the learned NN that is edited with ProGrad is not sufficiently explored. Please consider some ablations for readers to have more insights into the work.\n4. Can authors include real datasets from control system applications? Can authors talk more about the effect on required dataset size for training?", "limitations": "yes", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The paper introduces the previously unaddressed problem of provable gradient editing i.e. editing DNN parameters to satisfy hard constraints on input gradients, rather than just output constraints. This is a significant and timely contribution.\n2. Overall paper is clearly written with a well defined premise of definitions, theorems, proofs and overall mathematical rigor. Theorem 4.3 is the most fundamental one that is simple and elegant to follow and connects the relaxed problem to an LP, making what would otherwise be NP-hard tractable. This makes it to be solved by off the shelf LP solver in this case Gurobi.  \n3. Performance achieved as measured by Constraint satisfaction, Cosine similarity, IOU, Classification Accuracy beats other fine tuning based methods. In all the cases it achieves 100% constraint satisfaction which is the main aim of the paper. So the main claim is well supported in results.\n4. Wider domain coverage: Deep neural networks on image and language as well as control system proxy with simpler trigonometric function has been tested. \n5. Limitations are honestly acknowledged as the input is chosen to be constant unlike a polytope in most practical scenarios. Paper indicates some steps that can be taken from prior work to achieve this which is a good start.\n\n\nWeaknesses:\n\n1. Introduction lacks sufficient details about the motivation of adding constraints on gradients. It briefly explains grad cam attribution in fig.2, but lacks more details about other ways in which it can be used. For example it talks about requiring less data for training deep neural networks but does not sufficiently describe how or validate ProGrad indeed helps in this regard. \n2. Real-world LPs for large networks can still be computationally expensive. Therefore analysis of LP size and solve time as a function of network depth/width is required.\n3. It only simulates the Control system application using a simpler trigonometric function. Effect on real scientific and safety critical control systems remains unexplored.\n4. Lack of qualitative samples. Typically it is expected to provide more samples in supplementary but none other than a single sample in the main paper is provided. It would also help to showcase which samples are harder to be constrained and if there are any patterns.", "was_revised": true, "final_justification": "The authors clarified the fine-tuning methods used, confirmed that accuracy was measured on standard validation sets beyond just edited samples, and acknowledged computational aspects of the LP approach with plans for clearer analysis. Overall, their thorough responses and experimental evidence adequately address my review points.", "rebuttal": "> ## Question 1: LLM evaluation table (table 2) includes only generic term FT? Which method was tested here? Are all tested to average out the performance?\n\nIn Table 2 (Section 5.2) we evaluated supervised fine-tuning (SFT) on the `lm_head` layer for the IG constraint with a variety of hyperparameters, and presented the best result. The experiment details are included in the Appendix C.\n\nIn the revision, we will include the results for various FT methods and hyperparameters in the appendix. For example, below in the response to Question 3, we presented SFT and DPO results for editing an LLM (Qwen3-1.7B) with a variety hyperparameters.\n\n> ## Question 2: Does not sufficiently evaluate the effects on “correctly classified” inputs. And overall accuracy not just edit sets. Is it applied to all the samples?\n\nWe would like to clarify that the accuracy (Acc.) results in both Table 1 (Section 5.1) and Table 2 (Section 5.2), as stated in the table captions, are the *standard accuracy evaluated on the ImageNet/SST2 validation sets*. Note that the edit sets are not constructed from the validation sets, hence disjoint from the validation sets.\n\n> ## Question 3: Choice of the learned NN that is edited with ProGrad is not sufficiently explored. Please consider some ablations for readers to have more insights into the work.\n\nIn the revision, we will evaluate on more NNs and include new results. Below we present the Grad-CAM results on a (new) ResNet50 DNN, and IG results on a (new) Qwen3-1.7B LLM. The new results are consistent with the results in the submission.\n\n**Enforcing hard Grad-CAM constraints on a ImageNet ResNet50 DNN for an edit set of 100 samples with $\\epsilon=1e-2$.** The setup is the same as Table 1 (Section 5.1). The result is consistent with the results in paper: ProGrad is the only method that is able to enforce the hard Grad-CAM constraints as evidenced by the 100% constraint satisfaction rate (Constr. Sat.) and achieves the best accuracy (Acc.), Cos. and IoU, significantly outperforms all baselines.\n\n| Method   | Constr. Sat.|   Min. Cos.|    Min. IoU|        Acc.|\n|:---------|------------:|-----------:|-----------:|-----------:|\n| Original |       7.35% |     24.15% |      0.00% |     76.13% |\n| EWA      |       5.39% |     65.44% |      0.00% |     73.42% |\n| SWA      |       6.80% |     83.25% |     50.00% |     75.24% |\n| SSWA     |       6.71% |     83.01% |     41.18% |     75.25% |\n| ProGrad  | **100.00%** | **99.96%** | **84.62%** | **75.38%** |\n\n\n**Enforcing hard IG constraints on the Qwen3-1.7B LLM for an edit set of 200 samples with $\\epsilon=1e-1$.** The setup is the same as Table 2 (Section 5.2). For the FT baselines, we tested DPO and SFT, on either fine-tuning all parameters or just the `lm_head`, for 1 or 3 epochs, with a learning rate of 1e-3 or 1e-4. `DPO-all@1 lr=1e-3` denotes \"DPO on all parameters for 1 epochs with learning rate 1e-3\". The result is consistent with the results in paper: ProGrad is the only method that is able to enforce the hard Grad-CAM constraints as evidenced by the 100% constraint satisfaction rate (Constr. Sat.), also achieves great accuracy (Acc.), the best Cos. and IoU, significantly outperforms all baselines.\n\n| Method                  | Constr. Sat. |       Cos. |    IoU |   Acc. |\n|:------------------------|-------------:|-----------:|-------:|-------:|\n| Original                |       35.73% |     64.81% | 26.77% | 85.89% |\n| DPO-all@1 lr=1e-3       |       36.39% |     64.98% | 29.49% | 50.92% |\n| DPO-all@1 lr=1e-4       |       31.93% |     48.21% | 23.31% | 89.22% |\n| DPO-all@3 lr=1e-3       |       36.78% |     62.51% | 28.17% | 50.92% |\n| DPO-all@3 lr=1e-4       |       32.47% |     53.85% | 20.13% | 89.33% |\n| DPO-lm_head@1 lr=1e-3   |       37.72% |     60.12% | 31.18% | 50.92% |\n| DPO-lm_head@1 lr=1e-4   |       33.37% |     59.66% | 22.97% | 73.97% |\n| DPO-lm_head@3 lr=1e-3   |       37.06% |     62.29% | 32.40% | 50.92% |\n| DPO-lm_head@3 lr=1e-4   |       33.49% |     61.87% | 28.36% | 51.38% |\n| SFT-all@1 lr=1e-3       |       35.88% |     65.51% | 30.65% | 50.92% |\n| SFT-all@1 lr=1e-4       |       34.93% |     58.75% | 24.89% | **89.56%** |\n| SFT-all@3 lr=1e-3       |       37.75% |     58.64% | 29.52% | 51.03% |\n| SFT-all@3 lr=1e-4       |       34.64% |     57.01% | 29.90% | 89.22% |\n| SFT-lm_head@1 lr=1e-3   |       33.20% |     55.86% | 27.52% | 50.92% |\n| SFT-lm_head@1 lr=1e-4   |       32.56% |     60.14% | 24.66% | 86.81% |\n| SFT-lm_head@3 lr=1e-3   |       36.06% |     58.90% | 28.88% | 50.92% |\n| SFT-lm_head@3 lr=1e-4   |       33.02% |     57.53% | 23.84% | 72.02% |\n| ProGrad                 |  **100.00%** | **99.05%** | **74.00%** | 88.07% |\n\n> ## Weakness 2: Real-world LPs for large networks can still be computationally expensive. Therefore analysis of LP size and solve time as a function of network depth/width is required.\n\nWe would like to clarify that the LP size is (qualitatively) analyzed in the proof in Appendix A. In the revision, we will further clarify it and provide a detailed definition of the LP size as a function of the network depth/width.\n\n> ## Regarding example gradient constraints in real-world control systems and scientific applications (Question 4 and Weakness 1, 3).\n\nFor control systems, enforcing monotonicity for glucose-insulin dynamics [c1], bounding gradients to reduce action oscillations [c2] are examples of safety constraints that can be expressed in terms of gradients. For scientific applications such as density functional theory (DFT), the neural network approximating the density functional must satisfy hard gradient constraints [c3].\n\nIn this work we focus on enforcing hard Grad-CAM and IG constraints for real-world vision and natural language applications, demonstrating the real-world applicability of gradient editing in the context of explainable AI. We leave further investigation on control systems and scientific computation applications as our future work.\n\n[c1] Kushner, Taisa, Sriram Sankaranarayanan, and Marc Breton. \"Conformance verification for neural network models of glucose-insulin dynamics.\" Proceedings of the 23rd International Conference on Hybrid Systems: Computation and Control. 2020.\n\n[c2] Majd, Keyvan, et al. \"Safe Robot Learning in Assistive Devices through Neural Network Repair.\" Conference on Robot Learning. PMLR, 2023.\n\n[c3] Pokharel, Kanun, et al. \"Exact constraints and appropriate norms in machine-learned exchange-correlation functionals.\" The Journal of Chemical Physics 157.17 (2022).\n\n> ## Regarding \"learning with less data\" (Question 4 and Weakness 1).\n\nWe would like to clarify that we did not mean to imply that our technique can be used to train a DNN from scratch with less data. By \"learning with less data\" we mean \"learning constraints with less data\", that is, explicitly incorporating the constraints into the network, instead of relying on the network to \"infer\" these constraints implicitly from the data alone. In the revision we will clarify this.\n\nThe experiment in Figure 1 demonstrates how ProGrad can be used to get a network that satisfies hard gradient constraints that is not guaranteed by training with data alone. This is also evidenced by our experiments on real-world ResNet152 DNN and Llama LLM, where our technique is the only technique that can enforce hard complex Grad-CAM/IG constraints.\n\nSuch augmentation of data with constraints serves as a general motivation for constraint-based learning. Our primary contribution is a novel technique to enforce hard gradient constraints in DNNs, which we have evaluated on real-world data and networks in computer vision and natural language processing. Investigating how this new primitive could be used to reduce the need for training data would be an interesting future direction."}, {"review_id": "EjI7tgnaBJ", "reviewer": "Reviewer_9LsX", "summary": "ProGrad provides a helpful way to enforce constraints on the gradients of neural networks by editing their parameters. The experimental evaluations show how ProGrad can be used in interpretability (enforcing grad-cam constraints), editing weights of neural networks to fix hallucinations (llama 3), and in sys id and controls. The work shows significant improvement over just finetuning the models.", "questions": "Please see weaknesses", "limitations": "yes", "rating": 5, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 4, "strengths_and_weaknesses": "Strengths\n\n* Strong constraint enforcement is a great strength and the theory appears comprehensive.\n\n* The ability to maintain these constraints is impactful in a few domains (interpretability, editing, sys id)\n\n* The results show significant improvement in constraint satisfaction over just finetuning the models\n\nWeaknesses\n\n* I am uncertain if strictly enforcing gradients is helpful for some of the proposed applications. Example: does enforcing the gradient constraints on misclassified samples for LLama help reduce similar mistakes on held-out samples? Or is finetuning better in this case?  \n\nAnother example: in the system identification example in Section 5.3, what if the gradient of the function is not well behaved (such as it shooting to infinity at 0 or something else like that)? Will the system actually be approximated/identified accurately?\n\n* Missing reference and discussion of a highly relevant work on enforcing hard constraints in [1]\n\n[1] Sridhar et al, Guaranteed Conformance of Neurosymbolic (World) Models to Natural Constraints, L4DC 2023", "was_revised": true, "final_justification": "I raised my score", "rebuttal": "> ## Regarding \"strictly enforcing gradients\"\n\nWe would like to clarify that the hard gradient constraints in our experiments do not restrict the gradient to be an exact value. Instead, a hard gradient constraint is formula in terms of the gradients, defining a polytope in the gradient space that the edited gradient must lie in. For example, line 215 (Section 5.1) and line 236 (Section 5.2) defines the hard Grad-CAM and IG constraints we enforce.\n\n> ## Regarding how enforcing hard gradient constraints helps the proposed applications like reducing similar mistakes comparing to fine-tuning.\n\nFirstly, we would like to stress that our method (ProGrad) is the first and only method that is able to enforce the hard Grad-CAM and IG constraints on real-world ResNet152 and Llama3 LLM, significantly outperforms the baselines.\n\nRegarding reducing similar mistakes, *our method does help reducing similar mistakes, and also outperforms all baselines like fine-tuning in this regard.* For example, for the Grad-CAM experiment on ResNet152 with 1000 samples, here we present the constraint satisfaction rate (Constr. Sat.) with $\\epsilon$=1e-1, cosine similarity (Cos.) and intersection over union (IoU) results on a set of held-out samples that are similar to the edit samples (same corruption type but different severity). *As evidenced by the results, our method (ProGrad) improves those metrics comparing to the original model, and achieves the best results comparing to the fine-tuning baselines.*\n\n\n| Method   |   Constr. Sat. |       Cos. |        IoU |\n|:---------|---------------:|-----------:|-----------:|\n| Original |         32.98% |     77.53% |     39.42% |\n| EWA      |         35.71% |     82.41% |     39.89% |\n| SWA      |         36.15% |     84.74% |     45.28% |\n| SSWA     |         36.16% |     84.74% |     45.26% |\n| ProGrad  |     **42.35%** | **85.75%** | **47.43%** |\n\n\n> ## Regarding enforcing gradient constraints in function approximation networks.\n\nWe would like to clarify that our method can be used to enforce hard gradient constraints in the network as specified by the user. If a network can approximate the function, our method could be used to enforce the correct gradient behavior as specified by the user-provided gradient constraints.\n\n> ## Regarding the mentioned related work.\n\nIn the revision, we will include this related work on enforcing hard constraints. We would like to clarify that this related work does not focus on gradient constraints like us, hence we do not compare against it."}, {"review_id": "2nN6MsoriU", "reviewer": "Reviewer_2NCo", "summary": "The paper proposes to edit the gradient of deep neural networks to satisfy hard polytope constraints by solving linear programming. The method is rooted in the formal verification of neural networks and is well-suited for constraint satisfaction. The experiments show some examples of potential applications on vision, LLM and NN training.", "questions": "See weakness", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 4, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n- This paper is interesting. The topic of gradient satisfaction is important but challenging. The examples of the paper show potential applications in vision and LLMs. I believe it is also promising in formal methods and dynamical systems.\n\n- The method is solid and the math notation is self-contained. The paper is clearly written and easy to follow. I enjoy reading the paper.\n\nWeaknesses:\n\n- One concern is that the LP decision variables only include the weight of first layer and biases of other layers, which may harm the feasibility given some bounded constraints of NN parameters. One suggestion would be to relax it to involve another weight parameter to make the constraint quadratic, which is also tractable for Gurobi, I think. It would be interesting to see the comparison between QP and LP.\n\n- For the LLM example, I would like to know how scale the method can be. It is better to report the results and the required time for comparison of scalability. For NN training, it is interesting to see how this method can be applied to train Lipschitz NNs.\n\n- Some related work can be discussed. Incomplete neural network verification can also involve gradient [1] for Lipschitz and verification of neural control barrier function also involves the gradient of neural networks [2], both of which can be casted as a special case of gradient constraint satisfaction. A recent DNN verification toolbox [3] can also be discussed.\n\n- Minor: $\\tilde \\phi$ is not defined on Line 111 when it first appears.\n\n\n--- \n[1] Shi et al. Efficiently computing local lipschitz constants of neural networks via bound propagation. NeurIPS 2022\n\n[2] Hu et al. Verification of Neural Control Barrier Functions with Symbolic Derivative Bounds Propagation, CoRL 2024\n\n[3] Wei et al. Modelverification. jl: a comprehensive toolbox for formally verifying deep neural networks, CAV 2025", "was_revised": true, "final_justification": "Complex constraints and multiple-layer weights have been clarified. The comparison of run-time and discussion with some verification work is missing in the main text. Overall, the paper has good quality and I recommend acceptance.", "rebuttal": "> ## Regarding the layers we allow to edit.\n\nAs presented in the Appendix B in the supplementary material, we would like to clarify that our approach is able to edit the parameters of **any layer** and the biases of the subsequent layers for a piecewise-linear DNN. Our approach is not restricted to only modifying the weight of the first layer. For ease of exposition, the main paper presents our approach for editing the first layer weights and other layer biases.\n\n> ## Regarding the effectiveness of our approach on complex constraints.\n\nOur experiments demonstrates that our approach is effective and practical for real-world DNNs. The Grad-CAM and IG constraints we used in our experiments are complex, and our results on real-world ResNet and LLM demonstrate that editing the last few layers is sufficient for the (often over-parameterized) real-world DNNs to satisfy these complex constraints.\n\n> ## Regarding editing multiple layers' weights using Quadratic Programming (QP).\n\nYes our approach can naturally be extended to edit multiple layers' weights using Quadratic Programming (QP). In theory, this gives a larger solution space and could improve the feasibility. However, in practice, using QP could be significantly slower than LP, making the editing non-scalable. Consider the experiment in section 5.3 as an example, for a ReLU version of the 4-layer fully-connected DNN with 100 hidden neurons per layer, for the same constraints and objectives on 2048 input points:\n  - editing the last layer using LP takes 10 seconds;\n  - editing the second last layer's parameters and the last layer's bias using LP takes 1 minute;\n  - editing the last two layers using QP *timeouts in 2 hours*.\n\nFurthermore, as demonstrated in our experiments, using LP is sufficient to edit real-world models against complex gradient constraints like Grad-CAM and IG.\n\n> ## Regarding the runtime for the experiments.\n\nAs included in the Appendix C, for the ResNet Grad-CAM experiment (Section 5.1), ProGrad finished in under 4 hours for each of the two settings; for the LLM IG experiment (Section 5.2), ProGrad finished in under 600 seconds for each of the two settings. The runtime of ProGrad demonstrates the scalability of our approach.\n\nSpecifically, in the LLM IG experiment, ProGrad took 501 seconds for the 100 samples setting and 562 seconds for the 200 samples setting. In the revision, we will include the specific runtime results.\n\n> ## Regarding Lipschitz NN.\n\nWe believe this is an interesting and important direction and we leave it as our future work.\n\n> ## Regarding the related verification work.\n\nIn the revision we will include and discuss those related verification work."}, {"review_id": "C7sj70S8aj", "reviewer": "Reviewer_4aEA", "summary": "This paper introduces ProGrad , a method for editing the parameters of a deep neural network (DNN) to enforce hard constraints on its gradients. The key idea is to model DNN gradients using what the authors call a conditional variable gradient , which allows the originally non-linear and complex gradient constraint enforcement task to be reduced to solving a linear program (LP) . This makes it possible to efficiently find minimal parameter changes that ensure the DNN satisfies the desired gradient constraints.", "questions": "Does the method's restriction to editing only the final few layers affect its ability to enforce more complex or global gradient constraints? Could editing more layers improve constraint satisfaction, and what trade-offs might exist in terms of efficiency and performance?", "limitations": "- ProGrad edits only the last few layers (often just the final layer) of the neural network. This may limit the model’s ability to satisfy more complex or global gradient constraints that involve deeper layers.\n- As the author said, ProGrad currently enforces gradient constraints only on a finite set of input samples. It does not provide guarantees for broader input domains or structured input regions.", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "- Strengths:\n  - This is an important and valuable research topic.\n  - The paper is very well-written.\n  - This work proposes an algorithm capable of provably enforcing hard gradient constraints on DNNs, not just soft regularization or empirical fine-tuning.\n  - The conditional variable gradient formulation is mathematically well-grounded and allows for reducing the originally non-linear gradient editing problem into a linear programming one. This is a significant theoretical contribution.\n  - The method is tested on diverse architectures and tasks — CNNs, LLMs, and regression functions, showing consistent success in satisfying gradient constraints where baselines fail.\n- Weakness：\n  - The current implementation only enforces gradient constraints at individual input points , not over neighborhoods or polytopes. While the paper mentions future extensions inspired by APRNN and PREPARED, this severely limits applicability in robustness and generalization settings. In practice, real-world safety constraints must hold across regions, not just isolated samples.\n  - ProGrad’s \"conditional variable gradient\" (Def. 4.2) is an extension of APRNN’s conditional output. The chain rule (Eq. 16) directly applies APRNN’s framework to gradients, which seems to show little theoretical innovation beyond repurposing prior work.\n  - The paper focuses on editing only the last few layers (typically the final layer) of the neural network. While this enables efficient and scalable editing of large models, it may limit the model’s ability to satisfy more complex or global gradient constraints that involve deeper layers.", "was_revised": true, "final_justification": "After carefully considering both the original submission and the response, I maintain my rating.", "rebuttal": "> ## Regarding the layers we allow to edit.\n\nAs presented in the Appendix B in the supplementary material, we would like to clarify that our approach is able to edit the parameters of **any layer** and the biases of the subsequent layers for a piecewise-linear DNN. Our approach is not restricted to only modifying the weight of the first layer. For ease of exposition, the main paper presents our approach for editing the first layer weights and other layer biases.\n\n> ## Regarding effectiveness of our method on complex constraints.\n\nOur experiments demonstrates that our method is effective and practical for real-world DNNs. The Grad-CAM and IG constraints we used in our experiments are complex, and our results on real-world ResNet and LLM demonstrate that editing the last few layers is sufficient for the (often over-parameterized) real-world DNNs to satisfy these complex constraints.\n\n> ## Regarding the trade-off in editing more layers.\n\nIn terms of the feasibility, editing an earlier layers' parameters and the subsequent layers' biases does not necessarily improve feasibility comparing to editing a later layer's parameters and the the subsequent layers' biases. Because the set of editable parameters (the solution space) for editing from an earlier layer is not a super set of the set of the case of editing from a later layer. In practice, if the user is not satisfied with the result of editing from a later layer, the user could then try to edit from an earlier layer.\n\nIn terms of the efficiency, because editing from an earlier leads to more LP constraints compared to editing from a later layer, it is often expected to take a longer time.\n\n> ## Regarding polytope editing.\n\nAs stated in the limitation, our approach is not addressing enforcing gradient constraints over input polytopes, and cannot be directly applied to enforce robustness, for instance.\n\nHowever, we would like to stress that our experiments related to enforcing gradient-based attributions in computer vision and LLM-based natural language processing demonstrate the real-world applicability of pointwise gradient editing, in the context of explainable AI.\n\n> ## Regarding the novelty and contribution.\n\nTo the best of our knowledge, our approach (ProGrad) is the first efficient approach for enforcing hard gradient constraints on DNNs that runs in polynomial time (Theorem 4.3).\n\nOur key contribution is the novel *conditional variable gradient* of DNN, which generalizes the prior work (APRNN) to handle the gradient of DNN. We are the first to propose the construction of the conditional variable gradient for the backward pass of DNNs, and proved their soundness.\n\nWe also identified real-world applications of enforcing hard gradient constraints in the context of explainable AI (Grad-CAM and IG). We demonstrated the practicality and scalability of our approach on real-world DNNs in computer vision and natural language processing. We would like to stress that *our approach is the only approach that is able to enforce those complex gradient hard constraints*, significantly outperforms prior approaches."}, {"review_id": "L5Cfrvnfn7", "reviewer": "Reviewer_pAFR", "summary": "The paper introduces the problem of gradient editing wherein given a particular input to a network (here restricted to feed-forward networks with ReLU units), and a polyhedron within which the gradient  (or more accurately the Jacobian) of the network should lie, the approach computes changes to a subset of parameters, chosen so that the network is locally linear in these parameters. The approach builds upon similar ideas such as ARPNN that have appeared in the past (PLDI 2023), but extends to the problem of satisfying constraints\non the gradients rather than the outputs. The key idea is to formulate this as a linear program assuming that the change in the weights do not change the \"activation patterns\" of the various neurons in the network. The solution is applied to some very interesting case studies including enforcing \"Grad-CAM\" constraints on images wherein \"Grad-CAM\" refers to an approach to explainable classification wherein the gradient information is used to study some sort of sensitivity of the pixels to a classification. The paper uses the proposed gradient editing techniques to update weights of CNNs to make them robust to input perturbations. Other experimental evaluations include those on large language models and a place holder for a physical model with a gradient constraint.", "questions": "- Please comment on the issue of how do you treat multiple inputs/multiple layers in your approach.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 4, "significance": 3, "originality": 3, "strengths_and_weaknesses": "I enjoyed reading the paper for the most part. The writing and presentation were clear to me and the ideas were easy to see. I do have a few minor issues that I report at the end. \n\n+ The main strength of the paper lies in the applications. Although I am not an expert in the areas of computer vision or natural language processing, I found the applications to be well motivated and natural. I do not quite get the application to provably safe control systems: that application was illustrated by a rather artificial example that did not seem credible.\n\nMy key issues here are mostly about originality and some technical issues.\n\n- Originality: I am not very sure about the  intellectual depth here. The idea that (i) fixing the activation patterns of the neuron linearizes a network is at the core of the paper and is hardly novel/original; (ii) the idea that one can modify a single layer's weights and the biases of the layers is also natural and has been explored by many authors even in the context of neural network repair. Nevertheless, a simple idea that can have practical impact is quite welcome.\n\n- Technical applicability: I am not really sold that editing gradients at one input suffices. Clearly, it does not for most applications. However, the approach is limited to one layer at a time. I have been thinking about how one handles multiple inputs to the network whose gradients all need to lie within different polyhedra?  \n   - It is not clear if editing a single layer at a time suffices. One imagines that multiple neurons across different layers may need to be modified. \n   - Editing more than one layer yields nonlinear (multilinear) constraints and approaches such as iterating between layers are well known not to be very good at solving these problems. \n   - Treating the inputs one by one is not going to work. Fixing for one input may invalidate a fix made for a previous input. \n\nOverall, interesting paper but I get the sense that the difficult problem has not been properly addressed here. Rather, a  simpler version is presented and it is unclear that ideas extend readily.", "was_revised": true, "final_justification": "I found the author's justification to be convincing and am raising my score to accept.", "rebuttal": "> ## Regarding editing multiple inputs and layers.\n\nWe would like to clarify that, as presented in Appendix B, our approach edits ***a finite set of inputs*** for one layer's parameters and the subsequent layers' biases altogether, but not edit one input and and one layer at a time. For ease of exposition, the main paper presents our approach for editing one input.\n\nAs presented and proved in Appendix B, our approach can enforce gradient constraints on a finite set of inputs where the DNN gradient for each input is constrained to lie within different polyhedra in the input gradient space. Our approach would solve the collection of LP constraints for all input altogether to find an edit to satisfy all of them.\n\nAs evidenced in our experiments, all the experiments involve enforcing complex gradient constraints for a set of inputs, and the results demonstrate that our approach is practical for (often over-parameterized) real-world DNNs.\n\n> ## Regarding the novelty and contribution.\n\nTo the best of our knowledge, our approach (ProGrad) is the first efficient approach for enforcing hard gradient constraints on DNNs that runs in polynomial time (Theorem 4.3).\n\nOur key contribution is the novel *conditional variable gradient* of DNN, which generalizes the prior work (APRNN) to handle the gradient of DNN. We are the first to propose the construction of the conditional variable gradient for the backward pass of DNNs, and proved their soundness.\n\nWe also identified real-world applications of enforcing hard gradient constraints in the context of explainable AI (Grad-CAM and IG). We demonstrated the practicality and scalability of our approach on real-world DNNs in computer vision and natural language processing. We would like to stress that *our approach is the only approach that is able to enforce those complex gradient hard constraints*, significantly outperforms prior approaches."}]

Author rebuttal:

Meta-review: The committee reached a consensus by which this is a strong manuscript that should be accepted. The work presents a novel and well-formulated theoretical perspective on gradient editing, with clear exposition and solid arguments. While reviewers initially raised some concerns, the authors provided thoughtful clarifications and additional points during the rebuttal that addressed these points satisfactorily. Overall, the combination of novelty, clarity, and potential applicability makes this a valuable contribution to the NeurIPS community. I recommend acceptance.
Decision: Accept (spotlight)