Title: Enforcing Hard Linear Constraints in Deep Learning Models with Decision Rules
Venue: NeurIPS 2025
Accepted: yes
Keywords: constrained deep learning

physics-informed neural networks

safe machine learning
Abstract: Deep learning models are increasingly deployed in safety-critical tasks where predictions must satisfy hard constraints, such as physical laws, fairness requirements, or safety limits. However, standard architectures lack built-in mechanisms to enforce such constraints, and existing approaches based on regularization or projection are often limited to simple constraints, computationally expensive, or lack feasibility guarantees. This paper proposes a model-agnostic framework for enforcing input-dependent linear equality and inequality constraints on neural network outputs. The architecture combines a task network trained for prediction accuracy with a safe network trained using decision rules from the stochastic and robust optimization literature to ensure feasibility across the entire input space. The final prediction is a convex combination of the two subnetworks, guaranteeing constraint satisfaction during both training and inference without iterative procedures or runtime optimization. We prove that the architecture is a universal approximator of constrained functions and derive computationally tractable formulations based on linear decision rules. Empirical results on benchmark regression tasks show that our method consistently satisfies constraints while maintaining competitive accuracy and low inference latency.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes to enforce linear constraints on the outputs of ML models by forming the convex combination of the predictions of a pre-trained \"task network\" with a learned \"safe network.\" The role of the task network is to optimize prediction accuracy, whereas the role of the safe network is to ensure that the final predictions satisfy the problem's underlying constraints. The infinite-dimensional safe network training problem is shown to reduce to either an SDP or an LP, in the special cases where the support of the data distribution is either defined by an intersection of ellipsoids, or by a polytope. Numerical experiments on optimal power flow and portfolio optimization benchmark tasks are conducted, and it is shown that the proposed method yields predictions that always satisfy the desired constraints, while achieving prediction performance on par with state-of-the-art constrained optimization solvers.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths: The paper is well-written, and proposes an interesting idea. The proposed method is theoretically justified by a universal approximation result with constraint satisfaction guarantees. The reformulation of the paper's primary training problem into finite-dimensional forms is also rigorously justified. The performance in the numerical experiments shows very promising results compared to the baseline methods compared to.\n\nWeaknesses: See my \"Questions\" below.\n\nQUESTIONS:\n1. Last sentence of Section 3.1: In the notations section, you mentioned that $A_\\ell$ is used to represent the $\\ell$th row of a matrix $A$, but here, you are using $A_\\ell$ to represent a matrix. This might be a little bit confusing, so I'd suggest using consistent notation choices throughout the paper.\n2. \"Let $s^\\text{TN}(x)$ and $s^\\text{SN}(x)$ denote the predicted slack variables\" These slack variables don't seem to be very well defined. Up until this point, the only slack variables mentioned were in $s(x)$, appearing in (2), to combine the inequality constraints into an equivalent equality constrint. Those slack variables don't appear to be \"predicted,\" but rather they are prespecified by the problem at hand. So, what exactly are these \"predicted slack variables\"?\n3. \"Thus, the optimal $\\alpha$ can be computed as:\" Can you clarify precisely what this $\\alpha$ is optimizing?\n4. Is there a reason why you formulate the safe network training in the specific form of (5) in which you are essentially maximizing the amount of slack in the constraints? The intuition behind the particular design of the optimization problem (5) would be good to include in the manuscript.\n5. Minor formatting issue: In the heading of Section 3.4 (and in other sections), you capitalize the second word, whereas elsewhere in the paper, you only capitalize the first word. It would be best to remain consistent.\n6. In Section 3.5, you use the overline notation $\\bar{G}$, but you haven't defined it.\n7. What is $C_\\text{TN}$ in Table 1?\n8. \"Note that set $\\mathcal{X}$ corresponds to the intersection of $l$ ellipsoids...\" Wouldn't you need to assume that all $P_j$ are also negative (semi-)definite.\n9. Notation in (8): Do you mean to say that $S\\in (\\mathbb{S}^k)^m$ rather than $S\\in\\mathbb{S}^m$? Also, why must the slack variable function $s(\\cdot)$ be purely quadratic? It seems to me that the assumptions you outlined result in the constraint becoming $s_l(x) = b_l^\\top x- x^\\top A_l F x$ for $\\mathbb{P}$-almost every $x$, indicating that $s_l$ should have both a quadratic and a linear term.\n10. Notation in (10): Shouldn't $\\Lambda$ also be listed as a decision variable under \"maximize\"?\n11. Proposition 1: I think you mean $S\\in\\mathbb{S}^k$ again, rather than $S\\in\\mathbb{S}$.\n12. Proposition 1: It would help the reader if you clarified exactly what $W_j$ are here. Are these the same as the $P_j$ matrices in the main body of the paper, i.e., the matrices defining the quadratic constraints of the support set $\\mathcal{X}$ over which the semi-infinite quadratic inequality constraints is to hold almost surely? Also, when you employ this result to rewrite (8) into the SDP (10), it seems to me like you are actually tightening the feasible set (i.e., obtaining a lower bound on (8)), assuming that $l\\ne 1$ in general. The way the development is currently worded makes seems to suggest that (8) and (10) are equivalent reformulations, which might be misleading if in fact (10) only lower-bounds (8) in general.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proposes a new method to enforce linear input-output (i.e. input dependent) constraints for ML models. The key idea is to split the task of prediction subject to constraints into two halves, one half is represented by a task network which tries to output the best prediction, and the other half is represented by a “safe” network which always outputs a feasible point. The key insight is that the “best” (i.e. closest to the task network output) feasible point on the line segment between the task and safe outputs can be calculated in closed form, which is cheaper than e.g. projecting the task network output onto the feasible region. Compared to existing work, the inference and training costs are very low while maintaining good accuracy and zero constraint violations.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths \n\n1. The method achieves a favorable tradeoff between optimality gap and inference speed. Inference is very fast while producing high quality solutions. Competitors are either 1-2 orders of magnitude slower to achieve better results or are 2-3x faster while achieving significantly worse results. \n2. The evaluation is thorough with four baselines, including an exact solution obtained with Gurobi.\n3. The paper also includes an approximation theorem showing that the proposed architecture is a universal approximate of constrained functions, which is a neat result. \n\n## Weaknesses\n\n1. Training may be expensive. Training requires solving a semidefinite program to form the safe network. SDPs are harder in general than projection onto the feasible set of linear constraints, so it is not clear if training is more or less expensive than the alternatives. \n2. The functional form restrictions in the decision rules formulation may be too strong. It is possible that the linear functional class may not be expressive enough to solve more complex problems, but it is difficult to tell without experimental results. (This is acknowledges in the conclusion)\n3. Relatively few datasets are tested. Results are given for portfolio optimization and DC-OPF, but more variety would be ideal. I understand it may be difficult to find good datasets in this area. Perhaps the synthetic instances used in the DC3 paper could be used to give further evidence of the method’s effectiveness?\n\nQUESTIONS:\n1. What would happen if the constraints are infeasible? (Potentially for specific inputs)\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes a framework to enforce linear equality and inequality constraints in neural networks. It combines a task network for accuracy with a safe network trained using optimization principles, producing feasible predictions through convex combination.\n\nFor the task network, the authors use the Euclidean projection to project the neural network outputs onto the region of linear constraints. Since only linear constraints are involved in this part, closed-form expressions can be derived. In addition, the authors reformulate the training of the safe network as an optimization problem and reformulate the corresponding problem as an SDP or LP when the safe network are confined to linear functions.\n\nCase studies on DCOPF and portfolio optimization demonstrate certain advantages of the proposed method over some existing approaches.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\nThe authors present their ideas clearly, with well-written content and detailed mathematical derivations.\n\nWeaknesses:\nThe authors used a small-scale case study and compared with weak baselines, making it difficult to fully demonstrate the advantages of the proposed method. The results in Table 2 do not show an order-of-magnitude improvement in solution time for the proposed method compared to Gurobi. It seems that using the proposed method does not provide much value.\n\nQUESTIONS:\nQ1. Separating the constraint set into equality and inequality subsets for individual treatment is a common approach in optimization algorithms. For example, OSQP employs the Alternating Direction Method of Multipliers (ADMM), where equality constraints are transformed into a quadratic equality-constrained problem to obtain a closed-form solution (similar to the method described in Appendix A of the paper). Since this step involves solving a complex system of linear equations, both approaches have a computational complexity of $O(m^3)$. For inequality constraints, OSQP uses Euclidean projection. Through alternating iterations between these two steps, OSQP gradually converges from an initial point toward feasibility and optimality. The reviewer wants to point out that the APM used in the numerical experiments in Section 5 appears to differ significantly from ADMM as used in OSQP, because ADMM also includes additional Lagrangian multipliers and quadratic penalty terms that enhance convergence performance. Therefore, it is possible that the authors may have employed a relatively weak baseline.\n\nQ2. Considering that a linear system with complexity $O(m^3)$ needs to be solved anyway, instead of using the proposed method, would it be faster to use an unconstrained neural network to predict an initial value and then perform a warm start in Gurobi Simplex by setting its `PStart` or in OSQP by setting its initial values?\n\nQ3. DCOPF on small-scale systems can be easily solved by commercial solvers, so applying the proposed method offers limited value, especially considering that the method may also introduce optimality gaps. How does the proposed method perform on large-scale systems, such as power grids with several thousands or even ten thousand buses?\n\nQ4. The solution times for APM and DC3 shown in Table 2 are quite long, which seems difficult to understand for a small-scale DCOPF problem. Have the authors compared with other optimization-based constrained learning methods, such as CvxpyLayers or OptNet?\n\nQ5. Based on Eq. (4), it seems that $\\alpha$ is related to $s_i^{\\rm{TN}}(x)$ and $s_i^{\\rm{SN}}(x)$, and $s_i^{\\rm{TN}}(x)$ and $s_i^{\\rm{SN}}(x)$ are related to $\\theta$ and $\\phi$, namely the parameters of the task network and safe network. Should $\\alpha$ be denoted as $\\alpha(\\theta,\\phi)$ and participate in backpropagation? It seems that currently $\\alpha$ participates in backpropagation according to `alpha = torch.max(masked_alphas, dim=-1).values` in line 331 of `models.py`.\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

comments: SUMMARY:
This paper presents a framework to enforce linear input-output constraints during neural neural network training. The idea is to use two separate components: the task network, trained to minimize prediction loss, and a "safe" network, designed to ensure feasibility of the constraints. The output is a convex combination of the two. The approach is evaluated on benchmark regression tasks.

STRENGTHS AND WEAKNESSES:
Pros:

* Interesting paper that achieves safety constraints at a seemingly low cost.

* Interesting theoretical analysis of the properties of the framework.

* Practical evaluation on regression tasks.

Cons:

* Although the authors claim scalability, it is unclear if the approach would scale to large networks and large input domains. Also it is unclear if it extends beyond regression.

* It is unclear if the proposed approach does indeed guarantee absence of violations of constraints.

QUESTIONS:
Please comment on the sizes of the neural network.

How woudl the approach apply to ACAS-Xu (https://arxiv.org/abs/1702.01135) which has a set of input-output constraints.

LIMITATIONS:
no
TITLE: Official Review
CLARITY: 4
IMPACT: 4
ORIGINALITY: 4
DATE: 2025-07-03