Title: The Implicit Bias of Structured State Space  Models Can Be Poisoned With Clean Labels
Venue: NeurIPS 2025
Accepted: yes
Keywords: Neural Networks

Structured State Space Models

Generalization

Adversarial Machine Learning
Abstract: Neural networks are powered by an implicit bias: a tendency of gradient descent to fit training data in a way that generalizes to unseen data. A recent class of neural network models gaining increasing popularity is structured state space models (SSMs). Prior work argued that the implicit bias of SSMs leads to generalization in a setting where data is generated by a low dimensional teacher. In this paper, we revisit the latter setting, and formally establish a phenomenon entirely undetected by prior work on the implicit bias of SSMs. Namely, we prove that while implicit bias leads to generalization under many choices of training data, there exist special examples whose inclusion in training completely distorts the implicit bias, to a point where generalization fails. This failure occurs despite the special training examples being labeled by the teacher, i.e., having clean labels! We empirically demonstrate the phenomenon, with SSMs trained independently and as part of non-linear neural networks. In the area of adversarial machine learning, disrupting generalization with cleanly labeled training examples is known as clean-label poisoning. Given the proliferation of SSMs, we believe that delineating their susceptibility to clean-label poisoning, and developing methods for overcoming this susceptibility, are critical research directions to pursue.

The Implicit Bias of Structured State Space Models Can Be Poisoned With Clean Labels

Abstract

Neural networks are powered by an implicit bias: a tendency of gradient descent to fit training data in a way that generalizes to unseen data. A recent class of neural network models gaining increasing popularity is structured state space models (SSMs). Prior work argued that the implicit bias of SSMs leads to generalization in a setting where data is generated by a low dimensional teacher. In this paper, we revisit the latter setting, and formally establish a phenomenon entirely undetected by prior work on the implicit bias of SSMs. Namely, we prove that while implicit bias leads to generalization under many choices of training data, there exist special examples whose inclusion in training completely distorts the implicit bias, to a point where generalization fails. This failure occurs despite the special training examples being labeled by the teacher, i.e. , having clean labels! We empirically demonstrate the phenomenon, with SSMs trained independently and as part of non-linear neural networks. In the area of adversarial machine learning, disrupting generalization with cleanly labeled training examples is known as clean-label poisoning. Given the proliferation of SSMs, we believe that delineating their susceptibility to clean-label poisoning, and developing methods for overcoming this susceptibility, are critical research directions to pursue.

1 Introduction

Overparameterized neural networks can fit their training data in multiple ways, some of which generalize to unseen data, while others do not. Remarkably, when the training data is fit via gradient descent (or a variant thereof), generalization tends to occur. This phenomenon-one of the greatest mysteries in modern machine learning [91, 8]-is often viewed as stemming from an implicit bias : a tendency of gradient descent, when applied to neural network models, to fit training data in a way that complies with common data-generating distributions. The latter view was formalized for several neural network models and data-generating distributions [55, 77, 27, 64].

Arecent class of neural network models gaining significant popularity is structured state space models ( SSMs ). SSMs are often regarded as a computationally efficient alternative to transformers [85], and underlie prominent neural networks such as S4 [24], Mamba [22], LRU [58], Mega [48], S5 [75] and more [62, 14]. The implicit bias of SSMs, i.e. , of gradient descent over SSMs, was formally studied in prior works, e.g. , Emami et al. [16], Cohen-Karlik et al. [11, 12]. Notable among these is Cohen-Karlik et al. [12], which considered a setting where data is generated by a low dimensional teacher SSM, and gradient flow (gradient descent with infinitesimally small step size) over a high

dimensional student SSM fits training data comprising infinitely many sequences of a certain length. 1 In this setting, the student SSM can fit the training data in multiple ways, some of which generalize to sequences longer than those seen in training, while others do not. It was shown in Cohen-Karlik et al. [12] that under mild conditions, an implicit bias leads to generalization.

In this paper, we revisit the setting of Cohen-Karlik et al. [12], with one key exception: rather than training data comprising infinitely many sequences, we consider the realistic case where the number of sequences is finite. Surprisingly, our theory and experiments reveal a phenomenon entirely undetected by prior works on the implicit bias of SSMs. Namely, we find that while implicit bias leads the student SSM to generalize under many choices of training sequences, there exist special sequences which if included in training completely distort the implicit bias, resulting in the student SSM failing to generalize. This failure to generalize takes place despite the fact that the special sequences are labeled by the teacher SSM, i.e. , they have clean labels! In the area of adversarial machine learning, the phenomenon of generalization being disrupted by training instances with clean labels is known as clean-label poisoning , and has received significant attention, both empirically [71, 33] and theoretically [79, 6]. To our knowledge, the current paper is the first to formally prove susceptibility of SSMs to clean-label poisoning.

Our theoretical analysis comprises two contributions. First, is a dynamical characterization of gradient flow over an SSM, trained individually or as part of a non-linear neural network. The dynamical characterization reveals that greedy low rank learning [43, 78, 65, 66]-a sufficient condition for generalization with a low dimensional teacher SSM-is implicitly induced under many, but not all, choices of training sequences. Our second theoretical contribution builds on our dynamical characterization for a fine-grained analysis of gradient flow over an SSM, employing an advanced tool from dynamical systems theory: a non-resonance linearization theorem [70]. The analysis proves that there exist situations where: (i) training a student SSM on sequences labeled by a low dimensional teacher SSM exhibits an implicit bias that leads to generalization; and (ii) adding to the training set special sequences, also labeled by the teacher SSM ( i.e. , that also have clean labels), entirely distorts the implicit bias, to an extent where generalization fails.

We corroborate our theory via experiments spanning a wide range of settings: from those covered by our theory, to real-world (non-synthetic) settings comprising SSM-based S4 [24], Mamba-2 [14] and LRU [58] neural networks trained on the CIFAR-10 dataset [38]. The experiments validate both our dynamical characterization and the susceptibility of SSMs to clean-label poisoning. In light of the growing prominence of SSMs, particularly in large language models, we believe that delineating this susceptibility, and developing methods for overcoming it, are critical research directions to pursue.

2 Preliminaries

2.1 Notation

We use non-boldface lowercase letters for denoting scalars ( e.g. , α ∈ R , d ∈ N ), boldface lowercase letters for denoting vectors ( e.g. , x ∈ R d ), and non-boldface uppercase letters for denoting matrices ( e.g. , A ∈ R d,d ). Wedenote by 1 an all-ones vector and by 0 an all-zeros vector, with their dimensions to be inferred from context. For d ∈ N , we let [ d ] := { 1 , 2 , . . . , d } . For d ∈ N and i ∈ [ d ] , we denote by e i the i 'th standard basis vector ( i.e. , a vector holding one in entry i and zeros elsewhere) of dimension d , where the dimension is omitted from the notation and should be inferred from context. We identify scalar sequences of finite lengths with vectors.

2.2 Structured State Space Models (SSMs)

A structured state space model ( SSM ) of dimension d ∈ N is parameterized by three matrices: A ∈ R d,d , a state transition matrix , which conforms to a predefined structure ( e.g. , is constrained to be diagonal); B ∈ R d, 1 , an input matrix ; and C ∈ R 1 ,d , an output matrix . Given the values of A , B and C , the SSM realizes a mapping ϕ ( A,B,C ) ( · ) that receives as input a length k scalar sequence x ∈ R k , for any k ∈ N , and produces as output a scalar y ∈ R equal to the last element of the sequence y ∈ R k defined through the following recursive formula:

where ( s k ′ ∈ R d ) k ′ ∈ [ k ] ∪{ 0 } is a sequence of states , and s 0 = 0 . It is straightforward to show that the mapping ϕ ( A,B,C ) ( · ) is fully determined by the sequence ( CA k ′ B ) ∞ k ′ =0 , known as the impulse response of the SSM. In particular, for any k ∈ N and x ∈ R k :

For convenience, we often identify an SSM with the triplet ( A,B,C ) holding its parameter matrices, and regard the (single column) matrices B and C ⊤ as vectors.

Perhaps the most common form of structure imposed on SSMs is diagonality [25, 28, 58, 48, 22]. Accordingly, unless stated otherwise, we assume that the state transition matrix A of an SSM is diagonal.

Some of our results will account for SSMs that are part of non-linear neural networks, or more specifically, for SSMs whose output undergoes a transformation σ ( · , w ) , where: σ : R ×W → R is some differentiable mapping; W is some Euclidean space, regarded as a parameter space; and w ∈ W , regarded as a parameter vector. Given values for A , B , C and w , such a neural network realizes the mapping ϕ ( A,B,C ) , w ( · ) := σ ( ϕ ( A,B,C ) ( · ) , w ) . This architecture (namely, an SSM followed by a parametric transformation) is ubiquitous among SSM-based neural networks (see, for example, Gu et al. [24], Gupta et al. [28], Gu et al. [25]).

2.3 Teacher-Student Setting

We consider the teacher-student setting of Cohen-Karlik et al. [12], described hereinbelow. Data is labeled by a teacher SSM ( A ∗ , B ∗ , C ∗ ) of dimension d ∗ ∈ N , i.e. , the ground truth label of x ∈ R k , for any k ∈ N , is ϕ ( A ∗ ,B ∗ ,C ∗ ) ( x ) ∈ R . For some n ∈ N and κ ∈ N > 2 d ∗ , we are given a training set S comprising n labeled sequences of length κ , i.e. , S := ( ( x ( i ) , y ( i ) ) ) n i =1 , where x ( i ) ∈ R κ and y ( i ) = ϕ ( A ∗ ,B ∗ ,C ∗ ) ( x ( i ) ) for every i ∈ [ n ] . A student SSM ( A,B,C ) of dimension d ∈ N >κ is trained by minimizing the square loss over S , referred to as the training loss :

Optimization is implemented via gradient flow , which is formally equivalent to gradient descent with infinitesimally small step size (learning rate), and was shown to well-approximate gradient descent with moderately small step size [15]. The dynamics of gradient flow are, for t ∈ R ≥ 0 :

where ( ˙ A ( t ) , ˙ B ( t ) , ˙ C ( t )) := d dt ( A ( t ) , B ( t ) , C ( t )) , and ( A ( · ) , B ( · ) , C ( · )) is a curve representing the optimization trajectory. Generalization of the student at time t ∈ R ≥ 0 of optimization is measured by the extent to which ϕ ( A ( t ) ,B ( t ) ,C ( t )) ( · ) approximates ϕ ( A ∗ ,B ∗ ,C ∗ ) ( · ) , not only over input sequences of length κ as used for training, but also over input sequences of other lengths. This accounts not only for in-distribution generalization as considered in classical machine learning theory [72], but also for out-of-distribution generalization (extrapolation) as prevalent in modern machine learning [45]. Formally, in line with Equation (2), generalization is quantified by how close the first k elements of the student's impulse response are to the first k elements of the teacher's impulse response, for different values of k .

Definition 1. The generalization error of the student SSM over sequence length k is:

Clearly, there exist assignments for ( A,B,C ) with which the training loss ℓ S ( · ) is minimized ( i.e. , equals zero) and the student SSM perfectly generalizes over any sequence length k . 2 On the other hand, it was shown in Cohen-Karlik et al. [12] that, regardless of the size of the training set S ( i.e. , of n ) and the input sequences it comprises (namely, ( x ( i ) ) n i =1 ), there exist assignments for ( A,B,C ) with which the training loss ℓ S ( · ) is minimized, and yet the student has arbitrarily high generalization error over sequence lengths beyond κ , e.g. , over sequence length κ +1 (for completeness, we prove this fact in Appendix C). The latter two facts together imply that if minimization of the training

loss ℓ S ( · ) via gradient flow (Equation (4)) produces an assignment for ( A,B,C ) with which the student generalizes over sequence lengths beyond κ , it must be an outcome of implicit bias. The main result in Cohen-Karlik et al. [12] states that if the training set S is infinite and each entry of each input sequence x ( i ) is independently drawn from the standard normal distribution, 3 then under mild conditions the implicit bias of gradient flow is such that it convergences to a solution which generalizes over any sequence length k .

In this paper, we focus on the realistic case where the training set S is finite. Surprisingly, our theory and experiments (Sections 3 and 4, respectively) reveal a phenomenon completely undetected by Cohen-Karlik et al. [12], and any other work we are aware of on the implicit bias of SSMs.

3 Theoretical Analysis

3.1 Dynamical Characterization

In this subsection we derive a dynamical characterization of gradient flow over an SSM, trained individually or as part of a non-linear neural network. The dynamical characterization reveals that greedy low rank learning [69, 39, 4, 43, 65, 66]-a sufficient condition for generalization with a low dimensional teacher SSM-is implicitly induced under many, but not all, choices of training sequences. Section 3.2 will build on the dynamical characterization to prove that the implicit bias of SSMs can be poisoned with clean labels.

Our dynamical characterization applies to a setting more general than that laid out in Section 2.3. Specifically, it applies to the same setting, with two exceptions: (i) the student SSM is potentially embedded in a non-linear neural network, i.e. , the mapping ϕ ( A,B,C ) ( · ) is replaced by ϕ ( A,B,C ) , w ( · ) as defined in Section 2.2; and (ii) the training labels ( y ( i ) ) n i =1 need not be assigned by a teacher SSM, i.e. , they may be arbitrary. We denote the resulting training loss-a generalization of ℓ S ( · ) from Equation (3)-by ˜ ℓ S ( · ) :

Proposition 1 below establishes our dynamical characterization: equations of motion for the (diagonal) entries of A during gradient flow over ˜ ℓ S ( · ) .

Proposition 1. Consider optimization of the generalized loss ˜ ℓ S ( · ) defined in Equation (6) via gradient flow. That is, consider, for any t ∈ R ≥ 0 :

where ( ˙ A ( t ) , ˙ B ( t ) , ˙ C ( t ) , ˙ w ( t )) := d dt ( A ( t ) , B ( t ) , C ( t ) , w ( t )) , and ( A ( · ) , B ( · ) , C ( · ) , w ( · )) is a curve representing the optimization trajectory. For j ∈ [ d ] , denote by a j ( · ) the j 'th diagonal entry of A ( · ) , by b j ( · ) the j 'th entry of B ( · ) , and by c j ( · ) the j 'th entry of C ( · ) . Assume that the training sequence length κ is greater than or equal to two. For l ∈ [ κ ] and i ∈ [ n ] , denote the l 'th element of the i 'th training sequence x ( i ) by x ( i ) l . Then, for any j ∈ [ d ] and t ∈ R ≥ 0 :

where:

with:

Proof sketch (proof in Appendix D). The result readily follows from differentiation of ˜ ℓ S ( · ) (Equation (6)) with respect to each diagonal entry of A .

3.1.1 Interpretation

Proposition 1 implies that during gradient flow, the motion of a j ( · ) -the j 'th diagonal entry of the state transition matrix A ( · ) -is given by a degree κ -2 polynomial in a j ( · ) , where the coefficients of the polynomial are time-varying. In particular, at time t ∈ R ≥ 0 of optimization, the coefficient of the l 'th power in the polynomial, for l ∈ { 0 , 1 , . . . , κ -2 } , is a product of two factors: (i) γ ( l ) ( t ) , which depends on the power l but not on the entry index j ; and (ii) b j ( t ) c j ( t ) (the j 'th entry of the input matrix B ( · ) times the j 'th entry of the output matrix C ( · ) ), which does not depend on the power l but does depend on the entry index j .

Different training sets admit greedy learning. Consider the case where A ( · ) emanates from standard near-zero initialization [20, 30, 59], i.e. , where a j (0) ≈ 0 for all j . If the factor γ (0) ( · ) is small throughout-as is the case, e.g. , if the penultimate ( κ -1 'th) element of each training sequence x ( i ) is small (see Equation (8))-then the constant coefficient ( i.e. , the coefficient of the zeroth power) in the polynomial determining the motion of a j ( · ) is negligible. The dynamics of ( a j ( · )) d j =1 then exhibit greedy learning, similarly to the dynamics of various quantities in various types of neural networks [69, 39, 4, 43, 65, 66]. Namely, ( a j ( · )) d j =1 all progress slowly at first, following near-zero initialization, and then, whenever an entry reaches a critical threshold, it starts moving rapidly-see empirical demonstrations in Figure 2 and Appendix I.1. The greedy learning of ( a j ( · )) d j =1 implies a greedy low rank learning of the state transition matrix. More specifically, it implies a tendency to fit training data with A having low rank, meaning a tendency to generalize if data is generated by a low dimensional teacher SSM.

Certain training sequences impede greedy learning. In stark contrast to the above, if the training sequences ( x ( i ) ) n i =1 are such that the factor γ (0) ( · ) is not small-as can be the case, e.g. , if there is a training sequence x ( i ) in which the last elements are relatively large-then the polynomials determining the motions of ( a j ( · )) d j =1 have non-negligible constant coefficients, and greedy low rank learning will generally not take place-see empirical demonstrations in Figure 2 and Appendix I.1.

3.2 Clean-Label Poisoning

In this subsection we employ the dynamical characterization from Section 3.1 for a fine-grained analysis of gradient flow over an SSM. The analysis considers a teacher-student setting as in Section 2.3, and proves existence of situations where: (i) training a student SSM on sequences labeled by a low dimensional teacher SSM exhibits an implicit bias that leads to generalization; and (ii) adding to the training set certain sequences, also labeled by the teacher SSM ( i.e. , that also have clean labels), entirely distorts the implicit bias, to an extent where generalization fails. To our knowledge, this constitutes the first formal proof of susceptibility of SSMs to clean-label poisoning. Facilitating the analysis is an advanced tool from dynamical systems theory-a non-resonance linearization theorem [70]-which may be of independent interest.

The teacher-student setting considered in this subsection is characterized by Assumptions 1 and 2 below. While this setting is specific, it fulfills the purpose of proving existence of situations where SSMs are susceptible to clean-label poisoning. Moreover, as discussed in Appendix B, our theory can be adapted to account for different extensions of the setting, i.e. , for different relaxations of Assumptions 1 and 2. Empirically, we demonstrate in Section 4 that SSMs are susceptible to cleanlabel poisoning in a wide range of settings: from the specific setting considered in this subsection, to real-world (non-synthetic) settings comprising SSM-based S4 [24], Mamba-2 [14] and LRU [58] neural networks trained on the CIFAR-10 dataset [38].

Assumption 1. The teacher SSM is of dimension d ∗ = 2 , and its parameter matrices are given by:

Assumption 2. The input and output matrices of the student SSM, B and C , are respectively fixed at 1 and 1 ⊤ throughout training.

Under Assumptions 1 and 2, generalization is straightforward to attain: all that is needed in order for the student SSM to achieve low generalization error over any sequence length (Definition 1) is that one of the diagonal entries of its state transition matrix A be sufficiently close to one while the rest are sufficiently close to zero.

Proposition 2 below proves that generalization takes place in cases where: each training sequence has zeros in its last two elements and non-negative values elsewhere; and at least one training sequence is

not identically zero. Underlying the proof is the dynamical characterization from Section 3.1: with the last elements of each training sequence being small, the characterization establishes greedy low rank learning, which in turn implies generalization (see interpretation in Section 3.1.1).

̸

Proposition 2. Consider the teacher-student setting of Section 2.3, subject to Assumptions 1 and 2. Suppose that for every i ∈ [ n ] , the training sequence x ( i ) has zeros in its last two elements and non-negative values elsewhere. Suppose also that x ( i ) = 0 for some i ∈ [ n ] . Then, for any k ∈ N , ϵ ∈ R > 0 and δ ∈ R > 0 , there exists an open set I of arbitrarily small initializations for the student SSM, 4 and a corresponding time t ∈ R > 0 , such that gradient flow initialized in I reaches at time t a point where the training loss is at most δ and the generalization errors over sequence lengths 1 , 2 , . . . , k are at most ϵ .

Proof sketch (proof in Appendix E). The proof specializes the dynamical characterization from Section 3.1 per Assumptions 1 and 2, and per the conditions posed on the training sequences. Choosing the set I to be sufficiently concentrated around the origin, the specialized characterization implies that gradient flow initialized in I exhibits greedy low rank learning (see interpretation of the characterization in Section 3.1.1). The greedy low rank learning leads a single diagonal entry of the state transition matrix A to reach the vicinity of one while the rest of the diagonal entries remain near zero. As stated in the text following Assumptions 1 and 2, this ensures generalization.

As stated in the text following Assumptions 1 and 2, under these assumptions, generalization is straightforward to attain. Indeed, Proposition 2 above proves that generalization takes place even in cases where the training set S entails little information, e.g. , in the case where S includes e 1 (one followed by zeros) as a sole training sequence. Theorem 1 below proves that in this latter case, despite generalization being straightforward to attain, adding to S a single cleanly labeled example-or more specifically, a single carefully selected sequence x † of moderate (Euclidean) norm labeled by the teacher SSM-can entirely disrupt generalization.

In the context of Theorem 1, disrupting generalization requires preventing greedy low rank learning. This is achieved, in accordance with the dynamical characterization from Section 3.1 (see its interpretation in Section 3.1.1), by selecting a sequence x † whose last elements are relatively large. To prove that such selection indeed disrupts generalization, Theorem 1 relies on an advanced tool from dynamical systems theory-a non-resonance linearization theorem [70]-which may be of independent interest.

̸

Theorem 1, albeit specific, constitutes what is to our knowledge the first formal proof of susceptibility of SSMs to clean-label poisoning. In Appendix B we discuss different extensions of Theorem 1, including an extension that allows for any training set S permitted by Proposition 2 ( i.e. , for any choice of training sequences ( x ( i ) ) n i =1 where: for every i ∈ [ n ] , x ( i ) has zeros in its last two elements and non-negative values elsewhere; and x ( i ) = 0 for some i ∈ [ n ] ), at the expense of the added sequence x † potentially having large norm. Empirically, we demonstrate in Section 4 that the conclusion of Theorem 1 carries over to a wide range of settings, including ones where an SSM is part of a non-linear neural network.

Theorem 1. Consider the teacher-student setting of Section 2.3, subject to Assumptions 1 and 2. Suppose the training sequence length and the dimension of the student SSM respectively satisfy κ ∈ { 7 , 9 , 11 , . . . } and d ≥ 8 . Define the sequences x := e 1 ∈ R κ and x † := e κ -1 ∈ R κ . Denote by y and y † the labels respectively assigned to x and x † by the teacher SSM, i.e., y := ϕ ( A ∗ ,B ∗ ,C ∗ ) ( x ) and y † := ϕ ( A ∗ ,B ∗ ,C ∗ ) ( x † ) . Suppose the training set S includes ( x , y ) as a sole example. Let k ∈ N ≥ κ +2 and ϵ ∈ R > 0 . Then, there exists an open set I of arbitrarily small initializations for the student SSM, 4 such that with any initialization in I :

gradient flow converges to a point where the training loss is minimal (i.e., equals zero) and the generalization errors over sequence lengths 1 , 2 , . . . , k are at most ϵ ; and

appending to S the (cleanly labeled) example ( x † , y † ) leads gradient flow to converge to a point where the training loss is minimal and the generalization error over sequence length k is at least min { 0 . 1 , (9 d ) -1 (1 -(0 . 6) 1 / ( κ -1) ) } .

Trajectorywhen

Maintool:non-resonancelinearizationtheorem

training on(x,y)

Trajectorywhen

training on {(x, y), (xt,yt)

Reference trajectory

Saddlepoint

Non-generalizing

solutions

Generalizing

Initializations

solutions

工

Proof sketch (proof in Appendix F). Figure 1 illustrates the main ideas behind the proof. Below is a description of these ideas, along with an annotation of the figure.

As stated in the text following Assumptions 1 and 2, a sufficient condition for the student SSM to achieve low generalization errors is that one of the diagonal entries of its state transition matrix A be close to one while the rest are close to zero. The proof shows that this condition is also necessary, thus the set labeled 'generalizing solutions' in Figure 1 is a neighborhood of one-hot assignments for the diagonal entries of A . Next, similarly to the proof of Proposition 2, the dynamical characterization from Section 3.1 is used to establish that when training on ( x , y ) , under choices of I (set of initializations) sufficiently concentrated around the origin, a gradient flow trajectory emanating from I exhibits greedy low rank learning, and thus converges to the set of generalizing solutions-as illustrated in Figure 1.

For analyzing the behavior of gradient flow when training on { ( x , y ) , ( x † , y † ) } , the proof makes use of the fact that the last elements of x † are relatively large. In accordance with the dynamical characterization from Section 3.1 (see its interpretation in Section 3.1.1), this fact implies that greedy low rank learning does not take place. The proof identifies reference trajectories of gradient flow (when training on { ( x , y ) , ( x † , y † ) } ) that converge to non-generalizing solutions; one such reference trajectory is illustrated in Figure 1. These reference trajectories emanate from near-zero initializations that cannot be included in I , since they lead gradient flow to converge to non-generalizing solutions even when training only on ( x , y ) . However, the proof shows that I can consist of initializations near those of reference trajectories, since gradient flow emanating from such I : (i) converges to a generalizing solution when training on ( x , y ) ; and (ii) closely tracks a reference trajectory when training on { ( x , y ) , ( x † , y † ) } , resulting in convergence to a non-generalizing solution-as illustrated in Figure 1. This concludes the proof.

The main technical challenge faced by the proof lies in item (ii) above, namely, in establishing that when training on { ( x , y ) , ( x † , y † ) } , an initialization near that of a reference trajectory leads gradient flow to closely track the reference trajectory. Since the training loss is non-convex, gradient flow trajectories may diverge from one another exponentially fast. Establishing that a reference trajectory is tracked thus requires sharp bounds on convergence times. The crux of the challenge is to derive such bounds, as trajectories pass near saddle points, and a-priori, may not escape these saddle points sufficiently fast. To show that saddle points are escaped swiftly, the proof employs an advanced tool from dynamical systems theory which may be of independent interest: a non-resonance linearization theorem [70]. Namely, rather than directly analyzing trajectories in the vicinity of a saddle point, the proof constructs linear approximations, and uses the non-resonance linearization theorem to show that the linear approximations are sufficiently accurate, which in turn implies that the trajectories escape the saddle point sufficiently fast. The non-resonance linearization theorem requires the spectrum of the Hessian of the training loss to be free of certain algebraic dependencies known as resonances. If these resonances are absent-which the proof shows to be the case-the non-resonance linearization theorem provides guarantees on the accuracy of linear approximations that are far better than guarantees attainable via standard smoothness arguments.

4 Experiments

This section presents experiments corroborating our theory. It is organized as follows. Section 4.1 demonstrates the dynamical characterization we derived (in Section 3.1), showcasing that optimization of an SSM implicitly induces greedy low rank learning (a sufficient condition for generalization with a low dimensional teacher SSM) under some, but not all, choices of training sequences. Section 4.2 then demonstrates the clean-label poisoning phenomenon we established (in Section 3.2), by showing

0.0

0.5

1.0

1.5

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM,

with special sequences

0

1

2

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

with special sequences

that adding special cleanly labeled sequences to the training set of an SSM can completely ruin its generalization. Code for reproducing our experiments can be found at https://github.com/ YoniSlutzky98/imp-bias-ssm-poison .

4.1 Dynamical Characterization

As discussed in Section 3.1.1, the dynamical characterization in Proposition 1 (Equations (7) to (9)) implies that optimization of an SSM-trained individually or as part of a non-linear neural networkimplicitly induces greedy learning of the diagonal entries of the state transition matrix A under some, but not all, choices of training sequences. For example, if the last elements of each training sequence are small then greedy learning takes place, and if there are training sequences in which the last elements are relatively large then greedy learning may not take place. Figure 2 empirically demonstrates this, for a standalone SSM as well as one included in a non-linear neural network. Further experiments are reported in Appendix I.1.

4.2 Clean-Label Poisoning

Theorem 1 proved existence of situations where clean-label poisoning of an SSM takes place, i.e. , situations where: (i) training a student SSM on sequences labeled by a low dimensional teacher SSM exhibits an implicit bias that leads to generalization; and (ii) adding to the training set special sequences, also labeled by the teacher SSM ( i.e. , that also have clean labels), entirely distorts the implicit bias, to an extent where generalization fails. Table 1 empirically demonstrates clean-label poisoning of SSMs in three different teacher-student settings: the setting of Theorem 1; a standalone SSM setting beyond Theorem 1 (meaning it does not satisfy the assumptions of Theorem 1, e.g. , it includes multiple training sequences, and learning of the input matrix B and output matrix C ); and a setting where an SSM is part of a non-linear neural network.

We further demonstrate clean-label poisoning of SSMs in real-world (non-synthetic) settings comprising SSM-based S4 [24], Mamba-2 [14] and LRU [58] neural networks trained on the CIFAR-10 dataset [38]. In these settings we do not have access to a teacher ( i.e. , to a ground truth labeling mapping), and accordingly, cleanly labeled poisonous examples are generated from CIFAR-10 examples by introducing human-imperceptible additive noise to input sequences, while keeping their labels intact. The noise added to an input sequence is rendered to have relatively large last elements-in line with our theory 5 -using an adapted version of the Gradient Matching method from Geiping et al. [18] (see Appendix J.3 for details). Adding to the training set cleanly labeled poisonous examples as described leads to significant deterioration in the generalization of the SSM-based neural networks-see Table 2.

We believe the susceptibility of SSMs to clean-label poisoning goes far beyond the demonstrations herein. In light of the growing prominence of SSMs, particularly in large language models, delineating this susceptibility, and developing methods for overcoming it, are of prime importance.

5 Limitations

It is important to acknowledge several limitations of this paper. First, while the dynamical characterization derived in Proposition 1 applies to a broad setting ( e.g. , it allows the SSM to be embedded in a non-linear neural network), the proof of generalization in Proposition 2 is restricted to a more specific setting ( e.g. , it requires Assumptions 1 and 2), and the proof of clean-label poisoning in Theorem 1 is restricted to an even more specific setting ( e.g. , it requires the original training set to include a single example, in addition to Assumptions 1 and 2). Appendix B extends the settings of Proposition 2 and Theorem 1, but even under such extension the settings remain fairly restricted. A second limitation of this paper relates to the guarantees provided by Proposition 2 and Theorem 1: each ensures existence of a set I of initializations with which a desired result holds, and while I has positive volume (it is open), this volume may be low. Third, except for the dynamical characterization derived in Proposition 1 and the real-world (non-synthetic) experiments reported in Section 4.2, our theory and experiments pertain to near-zero initialization, which is common for neural networks [20, 30], but does not account for modern SSM initializations designed to alleviate vanishing gradients [23, 25]. Fourth, due to vanishing gradients, maintaining reasonable run-times in experiments with near-zero

initialization necessitated a relatively small scale (in terms of, e.g. , SSM dimension and training sequence length). Addressing these limitations is an important set of directions for future work.

6 Conclusion

The proliferation of SSMs, particularly in large language models, renders it crucial to understand their implicit bias. In this paper, we revisited prior beliefs by which the implicit bias of SSMs leads to generalization when data is generated by a low dimensional teacher. We formally proved that, in stark contrast to these beliefs, there exist special examples whose addition to training data can completely distort the implicit bias, to a point where generalization with a low dimensional teacher fails. This failure occurs despite the special examples being labeled by the teacher, i.e. , having clean labels! We corroborated our theory via experiments spanning a wide range of settings: from those analyzed theoretically, to real-world settings comprising prominent SSM-based neural networks. The experiments confirmed that generalization in SSMs can be disrupted by cleanly labeled training examples, i.e. , that SSMs are susceptible to clean-label poisoning.

Our results point to significant challenges in both theory and practice of SSMs. On the theoretical front, our results suggest that generalization in SSMs cannot be explained via the traditional view of implicit complexity minimization [26, 77, 90], or through the nascent view by which generalization is typical [82, 53, 54, 7, 2]. Indeed, if generalization in SSMs was due to the implicit bias finding a solution which, among all solutions fitting training data, minimizes some (data-independent) complexity measure, then training with additional cleanly labeled examples would not change the solution found, and thus would not disrupt generalization. 6 Moreover, if generalization in SSMs was due to typicality, i.e. , to the majority of solutions fitting training data being ones that generalize, then additional cleanly labeled training examples would only improve generalization, as they enhance the dominance of such majority. We believe fundamentally new approaches may be needed in order to theoretically pinpoint the source of generalization in SSMs.

Moving to the practical side, the fact that SSMs are susceptible to clean-label poisoning raises significant concerns regarding safety, robustness and reliability. For example, large language models, which are becoming more and more reliant on SSMs [19, 61, 3], are often fine-tuned via supervised learning on public internet data [41, 40, 81], and in this process, it may be easy for a malicious actor to add cleanly labeled training examples, e.g. , by adding unlabeled training examples prior to label generation. We believe that delineating the susceptibility of SSMs to clean-label poisoning, and developing methods for overcoming this susceptibility, are critical research directions to pursue.

Our results suggest that learning dynamics may facilitate progress in the foregoing research directions. Indeed, in settings covered by our theory, clean-label poisoning correlates with a dynamical factor γ (0) ( · ) (defined in Proposition 1) being large during learning, i.e. , during optimization (see Section 3.1.1 as well as Figures 16 to 19 in Appendix I). By monitoring γ (0) ( · ) throughout learning, one may detect clean-label poisoning and take responsive action ( e.g. , prevent deployment of a poisoned model). Moreover, it is plausible that by adding to the training loss a penalty term that encourages γ (0) ( · ) to be small, one may improve resilience to clean-label poisoning. Investigating such methods, and extending them to settings beyond our theory, may promote safer, more robust and more reliable deployment of SSMs.

Acknowledgments and Disclosure of Funding

We thank Eshbal Hezroni for assistance in preparing the illustrative figure, and Itamar Zimerman for contributions to the real-world experiments. This work was supported by the European Research Council (ERC) grant NN4C 101164614, a Google Research Scholar Award, a Google Research Gift, Meta, the Yandex Initiative in Machine Learning, the Israel Science Foundation (ISF) grant 1780/21, the Tel Aviv University Center for AI and Data Science, the Adelis Research Fund for Artificial Intelligence, Len Blavatnik and the Blavatnik Family Foundation, and Amnon and Anat Shashua. NR is supported in part by the Zuckerman STEM Leadership Program.

References

Hojjat Aghakhani, Dongyu Meng, Yu-Xiang Wang, Christopher Kruegel, and Giovanni Vigna. Bullseye polytope: A scalable clean-label poisoning attack with improved transferability. In 2021 IEEE European symposium on security and privacy (EuroS&P) , pages 159-178. IEEE, 2021.

Yotam Alexander, Yonatan Slutzky, Yuval Ran-Milo, and Nadav Cohen. Do neural networks need gradient descent to generalize? a theoretical study. arXiv preprint arXiv:2506.03931 , 2025.

Carmen Amo Alonso, Jerome Sieber, and Melanie N Zeilinger. State space models as foundation models: A control theoretic overview. arXiv preprint arXiv:2403.16899 , 2024.

Sanjeev Arora, Nadav Cohen, Wei Hu, and Yuping Luo. Implicit regularization in deep matrix factorization. Advances in neural information processing systems , 32, 2019.

Shahar Azulay, Edward Moroshko, Mor Shpigel Nacson, Blake E Woodworth, Nathan Srebro, Amir Globerson, and Daniel Soudry. On the implicit bias of initialization shape: Beyond infinitesimal mirror descent. In International Conference on Machine Learning , pages 468-477. PMLR, 2021.

Avrim Blum, Steve Hanneke, Jian Qian, and Han Shao. Robust learning under clean-label attack. In Conference on Learning Theory (COLT) , pages 591-634. PMLR, 2021.

Gon Buzaglo, Itamar Harel, Mor Shpigel Nacson, Alon Brutzkus, Nathan Srebro, and Daniel Soudry. How uniform random weights induce non-uniform bias: Typical interpolating neural networks generalize with narrow teachers. arXiv preprint arXiv:2402.06323 , 2024.

Satrajit Chatterjee and Piotr Zielinski. On the generalization mystery in deep learning. arXiv preprint arXiv:2203.10036 , 2022.

Lenaic Chizat and Francis Bach. Implicit bias of gradient descent for wide two-layer neural networks trained with the logistic loss. In Conference on learning theory , pages 1305-1338. PMLR, 2020.

François Chollet et al. keras, 2015.

Edo Cohen-Karlik, Avichai Ben David, Nadav Cohen, and Amir Globerson. On the implicit bias of gradient descent for temporal extrapolation. In International Conference on Artificial Intelligence and Statistics , pages 10966-10981. PMLR, 2022.

Edo Cohen-Karlik, Itamar Menuhin-Gruman, Raja Giryes, Nadav Cohen, and Amir Globerson. Learning low dimensional state spaces with overparameterized recurrent neural nets. In International Conference on Learning Representations (ICLR) , 2023.

Alex Damian, Eshaan Nichani, and Jason D Lee. Self-stabilization: The implicit bias of gradient descent at the edge of stability. arXiv preprint arXiv:2209.15594 , 2022.

Tri Dao and Albert Gu. Transformers are ssms: Generalized models and efficient algorithms through structured state space duality. arXiv preprint arXiv:2405.21060 , 2024.

Omer Elkabetz and Nadav Cohen. Continuous vs. discrete optimization of deep neural networks. Advances in Neural Information Processing Systems (NeurIPS) , 34:4947-4960, 2021.

Melikasadat Emami, Mojtaba Sahraee-Ardakan, Parthe Pandit, Sundeep Rangan, and Alyson K Fletcher. Implicit bias of linear rnns. In International Conference on Machine Learning (ICML) , pages 2982-2992. PMLR, 2021.

Ji Gao, Amin Karbasi, and Mohammad Mahmoody. Learning and certification under instance-targeted poisoning. In Conference on Uncertainty in Artificial Intelligence , 2021.

Jonas Geiping, Liam Fowl, W Ronny Huang, Wojciech Czaja, Gavin Taylor, Michael Moeller, and Tom Goldstein. Witches' brew: Industrial scale data poisoning via gradient matching. arXiv preprint arXiv:2009.02276 , 2020.

Paolo Glorioso, Quentin Anthony, Yury Tokpanov, James Whittington, Jonathan Pilault, Adam Ibrahim, and Beren Millidge. Zamba: A compact 7b ssm hybrid model. arXiv preprint arXiv:2405.16712 , 2024.

Xavier Glorot and Yoshua Bengio. Understanding the difficulty of training deep feedforward neural networks. In Proceedings of the thirteenth international conference on artificial intelligence and statistics , pages 249-256. JMLR Workshop and Conference Proceedings, 2010.

T. H. Gronwall. Note on the derivatives with respect to a parameter of the solutions of a system of differential equations. Annals of Mathematics , 20:292, 1919.

Albert Gu and Tri Dao. Mamba: Linear-time sequence modeling with selective state spaces. arXiv preprint arXiv:2312.00752 , 2023.

Albert Gu, Tri Dao, Stefano Ermon, Atri Rudra, and Christopher Ré. Hippo: Recurrent memory with optimal polynomial projections, 2020.

Albert Gu, Karan Goel, and Christopher Ré. Efficiently modeling long sequences with structured state spaces. arXiv preprint arXiv:2111.00396 , 2021.

Albert Gu, Karan Goel, Ankit Gupta, and Christopher Ré. On the parameterization and initialization of diagonal state space models, 2022.

Suriya Gunasekar, Blake E Woodworth, Srinadh Bhojanapalli, Behnam Neyshabur, and Nati Srebro. Implicit regularization in matrix factorization. Advances in neural information processing systems (NeurIPS) , 30, 2017.

Suriya Gunasekar, Jason D Lee, Daniel Soudry, and Nati Srebro. Implicit bias of gradient descent on linear convolutional networks. Advances in neural information processing systems (NeurIPS) , 31, 2018.

Ankit Gupta, Albert Gu, and Jonathan Berant. Diagonal state spaces are as effective as structured state spaces, 2022.

Chirag Gupta, Sivaraman Balakrishnan, and Aaditya Ramdas. Path length bounds for gradient descent and flow. Journal of Machine Learning Research , 22(68):1-63, 2021.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the IEEE international conference on computer vision , pages 1026-1034, 2015.

A. C. Hindmarsh. ODEPACK, a systematized collection of ODE solvers. In R. S. Stepleman, editor, Scientific Computing , pages 55-64, Amsterdam, 1983. North-Holland.

Roger A. Horn and Charles R. Johnson. Hermitian and symmetric matrices , page 167-256. Cambridge University Press, 1985.

WRonny Huang, Jonas Geiping, Liam Fowl, Gavin Taylor, and Tom Goldstein. Metapoison: Practical general-purpose clean-label data poisoning. Advances in Neural Information Processing Systems (NeurIPS) , 33:12080-12091, 2020.

Ziwei Ji and Matus Telgarsky. Directional convergence and alignment in deep learning. Advances in Neural Information Processing Systems , 33:17176-17186, 2020.

Chi Jin, Rong Ge, Praneeth Netrapalli, Sham M Kakade, and Michael I Jordan. How to escape saddle points efficiently. In International Conference on Machine Learning (ICML) , pages 1724-1732. PMLR, 2017.

Diederik P Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 , 2014.

Yiwen Kou, Zixiang Chen, and Quanquan Gu. Implicit bias of gradient descent for two-layer relu and leaky relu networks on nearly-orthogonal data. Advances in Neural Information Processing Systems , 36: 30167-30221, 2023.

Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.

Andrew K Lampinen and Surya Ganguli. An analytic theory of generalization dynamics and transfer learning in deep linear networks. arXiv preprint arXiv:1809.10374 , 2018.

Teven Le Scao, Angela Fan, Christopher Akiki, Ellie Pavlick, Suzana Ili´ c, Daniel Hesslow, Roman Castagné, Alexandra Sasha Luccioni, François Yvon, Matthias Gallé, et al. Bloom: A 176b-parameter open-access multilingual language model. 2023.

Quentin Lhoest, Albert Villanova Del Moral, Yacine Jernite, Abhishek Thakur, Patrick Von Platen, Suraj Patil, Julien Chaumond, Mariama Drame, Julien Plu, Lewis Tunstall, et al. Datasets: A community library for natural language processing. arXiv preprint arXiv:2109.02846 , 2021.

Binghui Li, Zhixuan Pan, Kaifeng Lyu, and Jian Li. Feature averaging: An implicit bias of gradient descent leading to non-robustness in neural networks. arXiv preprint arXiv:2410.10322 , 2024.

Zhiyuan Li, Yuping Luo, and Kaifeng Lyu. Towards resolving the implicit bias of gradient descent for matrix factorization: Greedy low-rank learning. arXiv preprint arXiv:2012.09839 , 2020.

Soon Hoe Lim, N Benjamin Erichson, Liam Hodgkinson, and Michael W Mahoney. Noisy recurrent neural networks. Advances in Neural Information Processing Systems (NeurIPS) , 34:5124-5137, 2021.

Jiashuo Liu, Zheyan Shen, Yue He, Xingxuan Zhang, Renzhe Xu, Han Yu, and Peng Cui. Towards out-of-distribution generalization: A survey. arXiv preprint arXiv:2108.13624 , 2021.

Kaifeng Lyu and Jian Li. Gradient descent maximizes the margin of homogeneous neural networks. arXiv preprint arXiv:1906.05890 , 2019.

Kaifeng Lyu, Zhiyuan Li, Runzhe Wang, and Sanjeev Arora. Gradient descent on two-layer nets: Margin maximization and simplicity bias. Advances in Neural Information Processing Systems , 34:12978-12991, 2021.

Xuezhe Ma, Chunting Zhou, Xiang Kong, Junxian He, Liangke Gui, Graham Neubig, Jonathan May, and Luke Zettlemoyer. Mega: Moving average equipped gated attention. In International Conference on Learning Representations (ICLR) , 2023.

Saeed Mahloujifar and Mohammad Mahmoody. Can adversarially robust learning leverage computational hardness? In International Conference on Algorithmic Learning Theory , 2018.

Saeed Mahloujifar, Dimitrios I Diochnos, and Mohammad Mahmoody. The curse of concentration in robust learning: Evasion and poisoning attacks from concentration of measure. In Proceedings of the AAAI Conference on Artificial Intelligence , volume 33, pages 4536-4543, 2019.

Pierre Marion, Yu-Han Wu, Michael E Sander, and Gérard Biau. Implicit regularization of deep residual networks towards neural odes. arXiv preprint arXiv:2309.01213 , 2023.

Hancheng Min, Salma Tarmoun, René Vidal, and Enrique Mallada. On the explicit role of initialization on the convergence and implicit bias of overparametrized linear networks. In International Conference on Machine Learning , pages 7760-7768. PMLR, 2021.

Chris Mingard, Guillermo Valle-Pérez, Joar Skalse, and Ard A Louis. Is sgd a bayesian sampler? well, almost. Journal of Machine Learning Research , 22(79):1-64, 2021.

Chris Mingard, Henry Rees, Guillermo Valle-Pérez, and Ard A Louis. Do deep neural networks have an inbuilt occam's razor? arXiv preprint arXiv:2304.06670 , 2023.

Behnam Neyshabur. Implicit regularization in deep learning. arXiv preprint arXiv:1709.01953 , 2017.

Behnam Neyshabur, Ryota Tomioka, and Nathan Srebro. In search of the real inductive bias: On the role of implicit regularization in deep learning. arXiv preprint arXiv:1412.6614 , 2014.

Alan V. Oppenheim, Alan S. Willsky, and S. Hamid Nawab. Signals & systems (2nd ed.) . Prentice-Hall, Inc., USA, 1996. ISBN 0138147574.

Antonio Orvieto, Samuel L Smith, Albert Gu, Anushan Fernando, Caglar Gulcehre, Razvan Pascanu, and Soham De. Resurrecting recurrent neural networks for long sequences. In International Conference on Machine Learning (ICML) , pages 26670-26698. PMLR, 2023.

Rom N Parnichkun, Stefano Massaroli, Alessandro Moro, Jimmy TH Smith, Ramin Hasani, Mathias Lechner, Qi An, Christopher Ré, Hajime Asama, Stefano Ermon, et al. State-free inference of state-space models: The transfer function approach. arXiv preprint arXiv:2405.06147 , 2024.

Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. Advances in neural information processing systems , 32, 2019.

Maciej Pióro, Kamil Ciebiera, Krystian Król, Jan Ludziejewski, and Sebastian Jaszczur. Moe-mamba: Efficient selective state space models with mixture of experts. arXiv preprint arXiv:2401.04081 , 2024.

Michael Poli, Stefano Massaroli, Eric Nguyen, Daniel Y Fu, Tri Dao, Stephen Baccus, Yoshua Bengio, Stefano Ermon, and Christopher Ré. Hyena hierarchy: Towards larger convolutional language models. In International Conference on Machine Learning (ICML) , pages 28043-28078. PMLR, 2023.

Hrithik Ravi, Clay Scott, Daniel Soudry, and Yutong Wang. The implicit bias of gradient descent on separable multiclass data. Advances in Neural Information Processing Systems , 37:81324-81359, 2024.

Noam Razin and Nadav Cohen. Implicit regularization in deep learning may not be explainable by norms. Advances in neural information processing systems (NeurIPS) , 33:21174-21187, 2020.

Noam Razin, Asaf Maman, and Nadav Cohen. Implicit regularization in tensor factorization. In International Conference on Machine Learning (ICML) , pages 8913-8924. PMLR, 2021.

Noam Razin, Asaf Maman, and Nadav Cohen. Implicit regularization in hierarchical tensor factorization and deep convolutional neural networks. In International Conference on Machine Learning (ICML) , pages 18422-18462. PMLR, 2022.

Olivier Roy and Martin Vetterli. The effective rank: A measure of effective dimensionality. 2007 15th European Signal Processing Conference , 2007.

P K Sahoo and T Riedel. Mean Value Theorems and Functional Equations . WORLD SCIENTIFIC, 1998. doi: 10.1142/3857.

Andrew M Saxe, James L McClelland, and Surya Ganguli. Exact solutions to the nonlinear dynamics of learning in deep linear neural networks. arXiv preprint arXiv:1312.6120 , 2013.

George R Sell. Smooth linearization near a fixed point. American Journal of Mathematics , pages 1035-1091, 1985.

Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! targeted clean-label poisoning attacks on neural networks. Advances in neural information processing systems (NeurIPS) , 31, 2018.

Shai Shalev-Shwartz and Shai Ben-David. Understanding Machine Learning: From Theory to Algorithms . Cambridge University Press, 2014.

L. Silverman. Realization of linear dynamical systems. IEEE Transactions on Automatic Control , 16(6): 554-567, 1971. doi: 10.1109/TAC.1971.1099821.

Alex Simpkins. System identification: Theory for the user, 2nd edition (ljung, l.; 1999) [on the shelf]. IEEE , 19(2):95-96, 2012. doi: 10.1109/MRA.2012.2192817.

Jimmy TH Smith, Andrew Warrington, and Scott W Linderman. Simplified state space layers for sequence modeling. In International Conference on Learning Representations (ICLR) , 2023.

Eduardo D. Sontag. Mathematical control theory : deterministic finite dimensional systems . Texts in applied mathematics ; 6. Springer-Verlag, New York, 1990. ISBN 0387973664.

Daniel Soudry, Elad Hoffer, Mor Shpigel Nacson, Suriya Gunasekar, and Nathan Srebro. The implicit bias of gradient descent on separable data. Journal of Machine Learning Research , 19(70):1-57, 2018.

Shih-Yu Sun, Vimal Thilak, Etai Littwin, Omid Saremi, and Joshua M Susskind. Implicit greedy rank learning in autoencoders via overparameterized linear networks. arXiv preprint arXiv:2107.01301 , 2021.

Fnu Suya, Saeed Mahloujifar, Anshuman Suri, David Evans, and Yuan Tian. Model-targeted poisoning attacks with provable convergence. In International Conference on Machine Learning (ICML) , pages 10000-10010. PMLR, 2021.

Gerald Teschl. Ordinary differential equations and dynamical systems , volume 140. American Mathematical Society, 2024.

Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971 , 2023.

Guillermo Valle-Pérez, Ard A Louis, and Chico Q Camargo. Deep learning generalizes because the parameter-function map is biased towards simple functions. In 7th International Conference on Learning Representations, ICLR 2019 , 2019.

Gal Vardi and Ohad Shamir. Implicit regularization in relu networks with the square loss. In Conference on Learning Theory (COLT) , pages 4224-4258. PMLR, 2021.

Pauli Virtanen, Ralf Gommers, Travis E Oliphant, Matt Haberland, Tyler Reddy, David Cournapeau, Evgeni Burovski, Pearu Peterson, Warren Weckesser, Jonathan Bright, et al. Scipy 1.0: fundamental algorithms for scientific computing in python. Nature methods , 17(3):261-272, 2020.

Junxiong Wang, Jing Nathan Yan, Albert Gu, and Alexander M Rush. Pretraining without attention. arXiv preprint arXiv:2212.10544 , 2022.

Zheng Wang, Geyong Min, and Wenjie Ruan. The implicit bias of gradient descent toward collaboration between layers: A dynamic analysis of multilayer perceptions. Advances in Neural Information Processing Systems , 37:74868-74898, 2024.

Johan S Wind, Vegard Antun, and Anders C Hansen. Implicit regularization in ai meets generalized hardness of approximation in optimization-sharp results for diagonal linear networks. arXiv preprint arXiv:2307.07410 , 2023.

Blake Woodworth, Suriya Gunasekar, Jason D Lee, Edward Moroshko, Pedro Savarese, Itay Golan, Daniel Soudry, and Nathan Srebro. Kernel and rich regimes in overparametrized models. In Conference on Learning Theory , pages 3635-3673. PMLR, 2020.

Jingfeng Wu, Vladimir Braverman, and Jason D Lee. Implicit bias of gradient descent for logistic regression at the edge of stability. Advances in Neural Information Processing Systems , 36:74229-74256, 2023.

Chulhee Yun, Shankar Krishnan, and Hossein Mobahi. A unifying view on implicit bias in training linear neural networks. arXiv preprint arXiv:2010.02501 , 2020.

Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Communications of the ACM , 64(3):107-115, 2021.

Shihao Zhao, Xingjun Ma, Xiang Zheng, James Bailey, Jingjing Chen, and Yu-Gang Jiang. Clean-label backdoor attacks on video recognition models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 14443-14452, 2020.

Chen Zhu, W Ronny Huang, Hengduo Li, Gavin Taylor, Christoph Studer, and Tom Goldstein. Transferable clean-label poisoning attacks on deep neural nets. In International conference on machine learning (ICML) , pages 7614-7623. PMLR, 2019.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: All of our theoretical claims and empirical results are clearly presented in Sections 2 to 4.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The limitations of our work are properly discussed in Section 5.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory assumptions and proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: All of our assumptions are clearly presented before each claim. All claims are rigorously proven in the appendix, with concise proof sketches in the main paper.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental result reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: We provide all implementation details in Appendix J. Code for reproducing the experiments will be made available at https://github.com/YoniSlutzky98/ imp-bias-ssm-poison .

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: We provide all implementation details in Appendix J. Code for reproducing the experiments will be made available at https://github.com/YoniSlutzky98/ imp-bias-ssm-poison .

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental setting/details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We provide all implementation details in Appendix J. Code for reproducing the experiments will be made available at https://github.com/YoniSlutzky98/ imp-bias-ssm-poison .

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment statistical significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: Tables 4 and 5 report the standard deviations for the synthetic clean-label poisoning experiments reported in Tables 1 and 3, respectively. Tables 7 and 8 report the standard deviations for the real-world clean-label poisoning experiments reported in Tables 2 and 6, respectively. Further demonstrations of the dynamical characterization (as shown in Figure 2), covering additional settings and random seeds, appear in Appendix I.1.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments compute resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We provide all implementation details in Appendix J. Code for reproducing the experiments will be made available at https://github.com/YoniSlutzky98/ imp-bias-ssm-poison .

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code of ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: This paper fully conforms with the NeurIPS Code of Ethics.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We explicitly discuss the broader impacts of our work in Section 6.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: The paper does not deal with data or models that have a high risk for misuse.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We properly cite the usages of the CIFAR-10 dataset [38], the S4 model [24] and the gradient matching method [18] in Section 4.2.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: We provide all implementation details in Appendix J. Code for reproducing the experiments will be made available at https://github.com/YoniSlutzky98/ imp-bias-ssm-poison .

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and research with human subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional review board (IRB) approvals or equivalent for research with human subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

16. Declaration of LLM usage

Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.

Answer: [NA]

Justification: The core method development in this research does not involve LLMs as any important, original, or non-standard components.

Guidelines:

The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.

Please refer to our LLM policy ( https://neurips.cc/Conferences/2025/LLM ) for what should or should not be described.

A Related Work

An SSM can be viewed as a special case of a linear dynamical system ( LDS ): a classic object of study in areas such as systems theory [57] and control theory [76]. The problem of learning from data an SSM that admits in-distribution and out-of-distribution generalization is an instance of what is known in the LDS literature as system identification [74]. Determination of whether a high dimensional SSM realizes a mapping that is also realizable by a low dimensional SSM (in our context, these are a student and a teacher, respectively) is considered in the LDS literature under the topic of minimal realization theory [73]. Despite these connections, our work is distinct from classic LDS literature: it studies the implicit bias of gradient descent, a phenomenon brought to light by the recent rise of overparameterized neural networks [55].

A significant line of research has characterized the implicit bias of gradient descent in overparameterized neural networks [69, 39, 56, 77, 27, 46, 34, 88, 9, 90, 5, 52, 47, 13, 89, 87, 51, 37, 86, 42, 63]. Several recent works formally studied the implicit bias of gradient descent in the context of recurrent neural networks [44, 16, 12]: a broad class of models that includes SSMs. Some of these works [16, 12] focus specifically on SSMs, in particular Cohen-Karlik et al. [12] which we extend (by lifting the unrealistic assumption of infinite training data-see Section 1). However, to our knowledge, none of the prior works on the implicit bias of gradient descent over SSMs or recurrent neural networks have formally established susceptibility to clean-label poisoning, as we do.

Since its demonstration in Shafahi et al. [71], clean-label poisoning has received significant empirical attention [93, 92, 33, 1]. It was also studied theoretically for convex models [79, 6]. 7 To our knowledge, none of the prior works on clean-label poisoning have formally established the phenomenon for SSMs, whose optimization is non-convex.

B Extensions of Theorem 1 and Proposition 2

In this appendix, we extend Theorem 1 to allow for additional training sets. Furthermore, we outline extensions of Theorem 1 and Proposition 2 to settings in which: (i) the teacher SSM is of arbitrary dimension d ∗ ≥ 2 ; (ii) the input and output matrices of the teacher SSM vary; and (iii) the input and output matrices of the student SSM are learned (as opposed to being fixed throughout training).

̸

Clean-label poisoning with additional training sets. Theorem 2 below extends Theorem 1 to allow for any training set S permitted by Proposition 2 ( i.e. , for any choice of training sequences ( x ( i ) ) n i =1 where: for every i ∈ [ n ] , x ( i ) has zeros in its last two elements and non-negative values elsewhere; and x ( i ) = 0 for some i ∈ [ n ] ), at the expense of the added (cleanly labeled poisonous) sequence x † potentially having large norm. 8

̸

Theorem 2. Consider the teacher-student setting of Section 2.3, subject to Assumptions 1 and 2. Suppose that for every i ∈ [ n ] the training sequence x ( i ) has zeros in its last two elements and non-negative values elsewhere. Suppose also that x ( i ) = 0 for some i ∈ [ n ] . Finally, suppose that the dimension of the student SSM satisfies d ≥ 5 . Then, for any k ∈ N ≥ 3 , δ ∈ R > 0 and ϵ ∈ R > 0 , there exists a scalar c ∈ R > 0 and an open set I of initializations for the student SSM, 4 such that with any initialization in I :

there exists a time t ∈ R > 0 at which gradient flow reaches a point where the training loss is at most δ , and the generalization errors over sequence lengths 1 , 2 , . . . , k are at most ϵ ; and

appending to S the (cleanly labeled) example ( x † , y † ) , where x † := c · e κ -1 ∈ R κ and y † := ϕ ( A ∗ ,B ∗ ,C ∗ ) ( x † ) , leads to the existence of a time t ∈ R > 0 at which gradient flow reaches a point where the training loss is at most δ , and the generalization error over sequence length k is at least 0 . 5 -2 /d .

Teacher of arbitrary dimension. For any d ∗ ≥ 2 , consider the following parameter assignments for the teacher SSM:

In this setting, the mapping ϕ ( A ∗ ,B ∗ ,C ∗ ) ( · ) realized by the teacher SSM is the same as the mapping realized by the teacher SSM defined in Equation (10) (where the teacher has dimension d ∗ = 2 ). Accordingly, Proposition 2 and Theorem 1 and their proofs apply as stated.

̸

Varying teacher input and output matrices. Given any teacher SSM ( A ∗ , B ∗ , C ∗ ) with which Proposition 2 and Theorem 1 hold (including a high dimensional teacher as described above), similar results hold with the teacher SSM ( A ∗ , α 1 B ∗ , α 2 C ∗ ) , where α 1 , α 2 ∈ R =0 are arbitrary. Indeed, if we likewise scale the values of the (fixed) student parameters B and C , i.e. we replace B by α 1 B and C by α 2 C , then for every sequence x :

The training loss and its derivatives thus scale by a positive factor, and so do generalization errors (Definition 1). Accordingly, the proofs of Proposition 2 and Theorem 1 carry through.

Learned student input and output matrices. Below we outline a modification of Proposition 2 and Theorem 1 that accounts for a setting in which the input and output matrices of the student SSM are learned. Suppose these input and output matricesB and C , respectively-are learned with a learning rate (step size) that may be different from the learning rate of the student's state transition matrix A . Formally, suppose the optimization trajectory ( A ( · ) , B ( · ) , C ( · )) is governed by the following dynamics:

where η > 0 represents the ratio between the learning rate of B and C , and the learning rate of A . Consider a trajectory induced by Equation (11), and a corresponding trajectory that emanates from the same initialization, but where only A is learned (or equivalently, where η in Equation (11) is replaced by zero). Arguments similar to those used in the proofs of Proposition 2 and Theorem 1 can be used to show that the divergence between these two trajectories is upper bounded by a quantity that depends on η , and in particular tends to zero as η does. Accordingly, if η is sufficiently small, generalization errors attained when A , B and C are learned jointly ( i.e. , when optimization is governed by Equation (11)), are close to those attained when only A is learned. Proposition 2 and Theorem 1-which apply to a setting where only A is learned-thus translate to results that apply to a setting where B and C are also learned.

C Low Training Loss with High Generalization Error

As stated in Section 2.3, it was shown in Cohen-Karlik et al. [12] that, regardless of the size of the training set S ( i.e. , of n ), and the length κ input sequences it comprises (namely, ( x ( i ) ∈ R κ ) n i =1 ), there exist assignments for the student SSM ( A,B,C ) which minimize the training loss ℓ S ( · ) , yet suffer from arbitrarily high generalization error over sequence lengths beyond κ , e.g. over sequence length κ +1 . For completeness, we prove this fact below.

and likewise:

Proposition 3. For any ϵ ∈ R > 0 there exist assignments for ( A,B,C ) with which the generalization error is zero over sequence length κ , 9 yet it is at least ϵ over sequence length κ +1 .

Proof. Let d > κ , which we will take as the dimension of our student SSM, and let

We we will consider the system of equations

where r ∈ R d . First, observe that our claim follows if a solution ( A,B,C ) exists for for every r . Indeed, take r such that its first κ entries coincide with ( C ∗ ( A ∗ ) i B ∗ ) 0 ≤ i ≤ κ -1 , and each of its final d -κ entries differs from the corresponding entry of ( C ∗ ( A ∗ ) i B ∗ ) κ ≤ i ≤ d -1 by ϵ or more. Then ( A,B,C ) solving these equations would provide the required assignment. To see that this system is indeed solvable for every r ∈ R d , note that it can be rewritten as V ⊤ g = r , where

and g = ( b 1 c 1 , . . . , b d c d ) ⊤ . V is a Vandermonde matrix, and it is well known that it is invertible as long as a 1 , . . . , a d are all distinct. Therefore for any such r , and fixed, distinct a 1 , . . . , a d , one can solve the equation by setting g = ( V ⊤ ) -1 r . To obtain ( B,C ) which satisfy g = ( V ⊤ ) -1 r , one can simply set B = 1 and C = g ⊤ .

D Proof of Proposition 1 (Dynamical Characterization)

Fix t ≥ 0 . We use the following shorthands for simplicity:

The objective ˜ ℓ S in time t takes the following form:

Fix j ∈ [ d ] . Deriving w.r.t a j ( t ) and consecutively applying the chain rule we obtain the following

Recalling that A is diagonal, we have that C ( t ) A ( t ) κ -l B ( t ) x ( i ) l = ∑ d j ′ =1 c j ′ ( t ) a j ′ ( t ) κ -l b j ′ ( t ) x ( i ) l . Hence,

Reversing the order of summation and reordering we receive the following:

The proof concludes by noting that ˙ a j ( t ) = -∂ ∂a j ( t ) ˜ ℓ S (( A ( t ) , B ( t ) , C ( t ))) .

E Proof of Proposition 2 (Generalization)

Proposition 2 follows from Proposition 4, which is identical up to allowing the non-zero diagonal element of A ∗ to be any positive value instead of 1 .

Proposition 4. Consider the teacher-student setting of Section 2.3, subject to Assumption 2 and the teacher SSM given by

̸

for some a ∗ > 0 . Suppose that for every i ∈ [ n ] the training sequence x ( i ) has zeros its last two elements and non-negative values elsewhere. Suppose also that x ( i ) = 0 for some i ∈ [ n ] . Then, for any k ∈ N , ϵ ∈ R > 0 and δ ∈ R > 0 , there exists a time t ∈ R > 0 and an open set I of initializations for the student SSM, such that gradient flow initialized in I reaches at time t a point at which the training loss ℓ S ( · ) is no greater than δ , and the generalization errors over sequence lengths 1 , 2 , . . . , k are no greater than ϵ .

Proof. For k ∈ N and A ∈ R d,d , we denote by Gen k ( A ) the generalization error over sequence length k (Definition 1). Note that B and C are omitted from this notation, as they are fixed to the values B = 1 , C = 1 ⊤ throughout the proof. With slight abuse of notation, we also denote ℓ S ( A ) := ℓ S ( A,B,C ) . Consider the point A 0 = ( a 0 , 0 , . . . , 0) where 0 < a 0 < a ∗ . We will first show that if we initialize at A 0 , gradient flow will converge to ( a ∗ , 0 , . . . , 0) , and therefore achieve perfect generalization. Indeed, writing 3 in terms of the entries of A we get:

The derivative of ℓ S ( A ) with respect to a p is therefore:

For j > 2 , a j (0) = 0 and thus ˙ a j (0) = -∂ ∂a j ℓ S ( A (0)) = 0 . Therefore for all j > 2 , a j ( t ) = 0 for all τ > 0 . Hence it suffices to show that a 1 ( τ ) converges to a ∗ as τ → ∞ . To see this, note that because a j ( τ ) = 0 for all t > 0 the dynamics simplify to

For all i ∈ [ n ] , at τ = 0 it holds that

by the non negativity of the entries of x ( i ) . Additionally, by the positivity of at least one of the entries of x ( i ) for some i ∈ [ n ] , at least one of the above expressions is positive. Furthermore, this expression can equal zero if and only if a 1 = a ∗ (in which case ˙ a 1 ( τ ) = 0 ). Therefore ˙ a 1 ( τ ) > 0 for all τ > 0 , and hence a 1 ( τ ) is monotonically increasing. It is also bounded from above (by a ∗ ), thus it converges. Furthermore, the limit must be a point where the derivative vanishes, and therefore it must equal a ∗ .

Because A ( τ ) converges to ( a ∗ , 0 , . . . , 0) when initialized at A 0 , for any ϵ, δ > 0 there exists t > 0 such that ℓ S ( A ( t )) < ϵ 2 , Gen k ( A ( t )) < δ 2 . Now by the continuity of ℓ S ( · ) , Gen k ( · ) and by Lemma 29, there exists an open set I such that, if we initialize gradient flow from ˜ A (0) ∈ I , resulting in the trajectory ˜ A ( τ ) , we get that ∥ A ( t ) -˜ A ( t ) ∥ 2 is sufficiently small to ensure that

as required.

F Proof of Theorem 1 (Clean-Label Poisoning)

The outline of the proof is as follows. Appendix F.1 details the setting and additional notation. Appendix F.2 analyzes gradient flow over ℓ S , where the dataset S does not include 'poisoned' samples, and shows that it converges to a generalizing solution. Appendix F.3 analyzes gradient flow after the addition of 'poisoned' samples, establishing that generalization degrades. Appendix F.4 proves that the different initialization sets considered in Appendix F.2 and Appendix F.3 intersect, and that one can construct an open set I such that both phenomena occur.

F.1 Setting and Additional Notation

We will slightly change our notation and use L to denote the sequence length, and k as an index. For any x ∈ R d and any r ≥ 0 we use B r ( x ) to denote

For any x ∈ R d and any V ⊆ R d we define the Euclidean distance between x and V as

We use W 1 and W 2 to respectively denote

Note that for any j ∈ { 2 , . . . , d } it holds that

Hence W 1 and W 2 are orthogonal. Additionally, it holds that

hence W 1 ∪ W 2 = R d . Finally, for any ψ ≥ 0 we use Diff ( ψ ) to denote

and B r ( x ) to denote and Diff ( ψ ) C to denote

Recall that the teacher SSM (Equation (10)) is given by ( A ∗ , B ∗ , C ∗ ) , where

We claim that the teacher is equivalent, i.e. has the same impulse response, as a d -dimensional SSM with A d = Diag(1 , 0 , . . . , 0) , B d = 1 and C d = 1 ⊤ .

Proposition 5. For all i ≥ 0

Proof. It is easy to see that both expressions evaluate to d when i = 0 , and to 1 when i ≥ 1 .

We will henceforth abuse notation slightly and redefine the teacher ( A ∗ , B ∗ , C ∗ ) to equal this d dimensional teacher, i.e. we set A ∗ := A d , B ∗ := B d , C ∗ := C d .

We denote the generalization error on sequences of length L (Definition 1) by Gen L ( A ) , i.e.

For a training set S = ( ( x ( i ) , y ( i ) ) ) n i =1 , we make a slight abuse of notation and denote the training error of a weight matrix A ∈ R d,d to be

Note that B and C are kept implicit in these notations, as they are fixed to the values B = 1 , C = 1 ⊤ throughout our analysis.

Examining the teacher weights ( A ∗ , B ∗ , C ∗ ) , one can note that for any j ∈ [ L -1] and any z ∈ R it holds that

To facilitate clearer distinction, we denote S 1 the training set considered in the first case, and S 2 the training set considered in the second case. We provide below an explicit description of the training sets and their induced losses.

Definition 2. The training sets S 1 , S 2 are defined as follows:

The objective ℓ S 1 ( · ) takes the following form:

For any time t ≥ 0 and any index j ∈ [ d ] the gradient flow update ˙ a j ( t ; S 1 ) takes the following form

The objective ℓ S 2 ( · ) takes the following form:

For any time t ≥ 0 and any index j ∈ [ d ] the gradient flow update ˙ a j ( t ; S 2 ) takes the following form

Note that by Lemma 23 the above flows are defined for all t ≥ 0 . We denote by I 0 a set of initial values for the matrix A which we will use throughout the proof: 10

Throughout Appendix F.2 and Appendix F.3 we will be concerned with subsets of I 0 for which the respective claims hold.

F.2 Gradient Flow Under S 1 Generalizes

Throughout this part, we omit the dependence on S 1 for simplicity. We begin by proving that when initializing at some A (0) ∈ I 0 , the parameters of A converge to a point where the training loss equals zero.

Lemma 1. Suppose we initialize at A (0) ∈ I 0 and evolve A ( t ) according to the gradient flow dynamics in Equation (19) . Then the limit lim t →∞ A ( t ) =: ̂ A 1 exists and satisfies

Proof. We first prove that for any j ∈ [ d ] and for any time t ≥ 0 it holds that

Hence, by Equation (23) it must hold that ˙ a j ( t ) ≥ 0 for any t ≥ 0 ; Since αζ j > 0 and since L -1 is even we have

Hence at time t = 0 we have ˙ a j (0) > 0 . For any t > 0 , if the derivative equals zero then either 1 -∑ d k =1 a k ( t ) L -1 = 0 or a j ( t ) = 0 , implying the derivative must remain equal to zero for t ′ > t . Hence, αζ j ≤ a j ( t ) for any t ≥ 0 . Additionally, for any time t ≥ 0 it holds that 1 -∑ d k =1 a k ( t ) L -1 ≥ 0 . At initialization it is positive by the above, and again if at some point it is equals zero then it must remain zero thereafter. Therefore, a j ( t ) can never reach 1 : since L -1 is even and since all entries are strictly positive, if it were to reach or cross 1 we would reach a contradiction to the previous argument. Thus, we have showed that the gradient flow trajectory is contained in the following open and bounded set:

Note that the teacher A ∗ is within V . Next, we claim that within V the objective ℓ satisfies the PL condition (see Definition 13) with PL coefficient 2( L -1) 2 ( αζ d 2 √ d ) 2 L -4 . Indeed, for any A ∈ V and any j ∈ [ d ] it holds that

Recall that

For any A ∈ V there must exist an index j ∗ ∈ [ d ] for which | a j ∗ | ≥ αζ d 2 √ d and thus

Finally, there exists some constant M > 0 such that within V the objective ℓ has M -Lipschitz gradients, since ℓ is analytic in R d and since V is contained within the compact and bounded B d ( 0 ) . The above conditions allows us to invoke Lemma 25 which states that the limit lim t →∞ A ( t ) =: ̂ A 1 exists and satisfies ℓ ( A ( t )) = 0 as required.

We now introduce a set I 1 ⊆ I 0 , under which we prove the rest of the claims in this section.

Definition 3. Let η 1 > 0 . We use I 1 ( η 1 ) to denote the following subset of I 0 :

We now prove that if A (0) ∈ I 1 , the first diagonal entry tends to 1 , while the rest of the entries must remain close to 0 .

Proposition 6. Let η 1 > 0 . Suppose we initialize at A (0) ∈ I 1 ( η 1 ) and evolve A ( t ) according to the gradient flow dynamics in Equation (19) . For any j ∈ { 2 , . . . , d } and for any time t ≥ 0 it holds that:

Additionally, there exists some time t ∗ ≥ 0 such that for any time t ≥ t ∗ it holds that:

Proof. Per the proof of Lemma 1, ˙ a j ( t ) ≥ 0 for any j ∈ [ d ] and t ≥ 0 and thus the entries a j ( t ) are positive and non-decreasing (as functions of t ). Reordering the dynamics, we have the following for any j ∈ { 2 , . . . , d } and for any time τ ≥ 0 :

Integrating both sides w.r.t time, we receive the following for any time t ≥ 0 :

Organizing the equation and plugging the initial values, we get that

Both sides are positive by our first argument and since αζ j < α , and so taking the 1 L -3 root yields

Since A (0) ∈ I 1 ( η 1 ) , we obtain that

as desired. We now show that there exists t ≥ 0 such that for any time t ≥ t it holds that

By Lemma 1, there exists time t ∗ ≥ 0 such that for any t ≥ t ∗ it holds that

Therefore, for any time t ≥ t ∗ we have

Focusing on the left hand side and plugging the bound on the rest of the entries, we receive

Rearranging yields

Additionally, a 1 ( t ) can never cross 1 - since L -1 is even and since all entries are strictly positive, if it were to cross 1 we would reach a contradiction to the argument in Lemma 1 stating that the residual 1 -∑ d k =1 a k ( t ) L -1 is always non-negative. With this we complete our proof.

An immediate result from Proposition 6 is the following corollary regarding the student's recovery of the teacher.

Corollary 1. Let η 1 > 0 . Suppose we initialize at A (0) ∈ I 1 ( η 1 ) and evolve A ( t ) according to the gradient flow dynamics in Equation (19) . The limit lim t →∞ A ( t ) =: ̂ A 1 satisfies

Proof. By Proposition 6, there exists time t ∗ ≥ 0 such that for any time t ≥ t ∗ it holds that

The argument follows from Lemma 1 and from continuity.

Remark 1. Note that the upper bound in corollary 1 satisfies the following

Hence, for any recovery threshold δ > 0 there exists η 1 ,δ > 0 such that if A (0) ∈ I 1 ( η 1 ,δ ) then ̂ A 1 recovers A ∗ with an error of no more than δ .

So far, we have argued that the parameters of A converge to a point which is close A ∗ . We conclude by showing that this leads to low generalization error.

Proposition 7. Let L ′ ≥ L +2 . For any ϵ > 0 there exists an open set of initializations I 1 := I 1 ( δ ϵ ) such that under S 1 , A converges to a point such that Gen L ′ ( A ) ≤ ϵ .

Proof. Under the dataset S 1 , we have shown above that for any δ > 0 there exists an open set of initializations I 1 ( δ ) such that GF will converge to a solution a whose parameters satisfy ∥ A -A ∗ ∥ 2 ≤ δ . It follows from the continuity of the length L ′ impulse response that there is an open set of initializations from which we converge to a point Gen L ′ ( A ) ≤ ϵ .

We abuse notation slightly and denote I 1 ( ϵ ) := I 1 ( η 1 ,δ 1 ) where δ 1 is the maximal δ that guarantees Gen L ′ ( ̂ A 1 ) ≤ ϵ .

F.3 Gradient Flow Over S 2 Converges but Does Not Generalize

In this section, we show that one can find a set of initializations I 2 such that gradient flow under S 2 converges to a point with high generalization error. The proof shows that gradient flow trajectories initialized in I 2 evolve similarly to reference trajectories which provably stays away from any permutation of A ∗ . 11 Since the training loss is non-convex, gradient flow trajectories can diverge from one another exponentially fast. Establishing that a reference trajectory is tracked thus requires sharp bounds on convergence times. The proof in this section is rather involved and is thus split into several parts.

Appendix F.3.1 defines the reference trajectories and shows their poor ability of generalization.

Appendix F.3.2 characterizes the critical points of the objective ℓ , focusing on a specific saddle point of interest (which we denote s ).

Appendix F.3.3 presents relevant background on dynamical systems, introducing a linearization result needed for the rest of the proof.

In Appendix F.3.4 we start analyzing the trajectories themselves, showing that they must pass near s .

Appendix F.3.5 shows that the trajectories must escape sufficiently fast from s using the tools presented in F.3.3.

Appendix F.3.6 proves that after escaping from s the trajectories converge to global minima.

Appendix F.3.7 shows that the overall divergence between trajectories emanating from I 2 and their corresponding reference trajectories can be bounded from above, implying the former trajectories have poor generalization.

Throughout this part, we omit the dependence on S 2 for simplicity.

F.3.1 Reference Trajectories

We begin by proving the following useful lemma which states that gradient flow maintains the order of the entries of A .

Lemma 2. Suppose we initialize at A (0) ∈ R d and evolve A ( t ) according to Equation (22) . Let π : [ d ] → [ d ] be a permutation such that for any j ∈ [ d -1] :

Then for any j ∈ [ d -1] and any t ≥ 0 it holds that

Proof. Recall the dynamics from Equation (22):

Fix j ∈ [ d -1] . By the linearity of the derivative, we obtain the following equality by plugging the above dynamics

Assume on the contrary there exists some time t 1 ≥ 0 for which a π ( j ) ( t 1 ) < a π ( j +1) ( t 1 ) . By the assumption, t 1 > 0 . By continuity, there must exist some time t 2 ∈ [0 , t 1 ) for which a π ( j ) ( t 2 ) = a π ( j +1) ( t 2 ) . This would imply that for any t ≥ t 2 , the derivative d dt ( a π ( j ) ( t ) -a π ( j +1) ( t ) ) is equal zero, which in turn would imply that

in contradiction to the assumption on t 1 .

In what follows, we define the notion of reference initialization .

Definition 4. Let A ∈ I 0 be some initialization of the parameters. The corresponding reference initialization A ref is defined as

.

We use A ref ( t ) to denote the gradient flow trajectories emanating from the reference initializations.

We now prove that any point with zero training loss which is sufficiently close to a reference trajecory has poor generalization.

Lemma 3. Let L ′ ≥ L +2 . There exists some δ 2 > 0 such that any point A = ( a 1 , a 2 , . . . , a d ) ∈ R d which satisfies:

ℓ ( A ) = 0

a 1 ≥ a 2 ≥ · · · ≥ a d

∥ A -A eq ∥ ≤ δ 2 for some point A eq = ( a eq 1 , . . . , a eq d ) ∈ R d such that a eq 1 = a eq 2

Proof. Let L ∗ ∈ { L +1 , . . . , L ′ } such that L ∗ is even. We now show that

for some constant c > 0 which is independent of L ′ . This in turn implies that

which gives us the desired lower bound. To do this, we write

First note that | a k | ≤ 1 for all k ∈ [ d ] - this follows from the fact that L -1 is even and from the fact that ℓ ( A ) = 0 and hence ∑ k a L -1 k = 1 . Therefore, for all k ∈ [ d ] we have

Assume first that a 1 = a 2 = a . Then clearly a L -1 1 + a L -1 2 = 2 a L -1 ≤ 1 and hence

Now by continuity it follows that for sufficiently small δ 2 > 0 , we have that if ∥ A -A eq ∥ ≤ δ 2 then

Let J := { r : a r ≤ 0 } . For such indices we have a L ∗ -1 r ≤ 0 . Suppose that

Then we have that

so we can take c = 0 . 1 . Otherwise we have that

so there exists some k ∗ / ∈ J such that a L -1 k ∗ ≥ 1 9 d . On the other hand, we have

Therefore, since k ∗ / ∈ J we have 0 ≤ a L ∗ -L k ∗ ≤ a k ∗ and so

This yields the following:

which gives us c = 1 9 d ( 1 -(0 . 6) 1 L -1 ) . In either case we can find a constant c > 0 proving the argument.

Lemma 3 motivates us to find an open subset of initializations under which the respective gradient flow trajectories remain close to their reference trajectory counterparts, as this would allow us to lower bound generalization error.

F.3.2 Characterization of Critical Points

In this section we characterize the critical points of the objective ℓ .

Lemma 4. Let A ∈ R d be a point such that

Then either A is a global minimum, i.e. ℓ ( A ) = 0 , or exists s ∈ R such that A = s · 1 .

Proof. By Equation (22), for any j ∈ [ d ] it holds that

If ∑ d k =1 a L -1 k -1 = 0 , then the above implies that ∑ d k =1 a k -1 = 0 . This in turn yields that

̸

i.e. A is a global minimum. Suppose ∑ d k =1 a L -1 k -1 = 0 . Then we obtain by rearranging that

L -2 is odd, and so taking the L -2 root on both sides we obtain that

completing our proof.

Lemma 4 establishes that critical points of ℓ which are not global minima must reside within W 1 = Span { 1 } (Equation (16)). These saddle points pose an obstacle to the convergence of gradient flow to a global minimum. The following lemma outlines the type of points gradient flow could encounter assuming we initialize at I 0 or at a reference initialization.

Lemma 5. Suppose we initialize at A (0) ∈ I 0 and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . Then for any time t ≥ 0 it holds that

Proof. Per Equation (23) the entries at initialization are arranged in descending order. Since L -1 is even we have that the initializations satisfy the inequalities

and

By Equation (23) it holds that αζ 1 < 1 2 d , thus we have that

and

On the other hand, by Equation (23) it also holds that αζ d > 0 , thus we have that

and

Therefore, the quantities

are all within the interval (0 , 1) . Thus, the objective at both initializations is no more than 1 since both satisfy

The proof is completed by the argument in Lemma 22 which states that under gradient flow the objective is non-increasing.

The following lemma shows that only a specific region of W 1 can contain critical points with loss lower than that of the initialization points we consider. This, along with Lemma 22, implies that only a specific region of W 1 is relevant.

̸

Lemma 6. Let A ∈ R d be a point for which there exists a ∈ R such that A = a · 1 . If a ̸∈ [ 1 d , 3 d ] then either ∇ ℓ ( A ) = 0 or ℓ ( A ) > 1

Proof. We begin by proving that for any a ∈ R , if a / ∈ (0 , 3 d ] then a · 1 must incur a loss greater than 1 . If a > 3 d then it holds that d · a > 3 , hence we obtain that

̸

The same argument applies when a < -1 d , since in that case d · a < -1 = ⇒ (1 -d · a ) 2 > 2 . Next, we show that if a ∈ [ -1 d , 1 d ) then ∇ ℓ ( a · 1 ) = 0 . Suppose a ∈ [ -1 d , 0] . L -1 is even and d ≥ 8 hence

The function f ( L ) := L -1 8 L -2 is decreasing for L ≥ 3 and acheives the value 0 . 25 when L = 3 , hence since L ≥ 3 we get f ( L ) ≤ 0 . 25 . Thus we have for any j ∈ [ d ] that the gradient's j th entry statisfies

Suppose a ∈ (0 , 1 d ) . In this case, we have that

Hence, since d · a -1 < 0 we have for any j ∈ [ d ] that the gradient's j th entry satisfies

Therefore, any critical point which is not a global minimum and has value in (0 , 1) cannot reside outside of [ 1 d , 3 d ] .

Having disqualified most of W 1 , we now identify the unique critical point on the non-disqualified region of W 1 and show that it is not a global minimum.

Lemma 7. There exists a unique s ∈ [ 1 d , 3 d ] for which ∇ ℓ ( s · 1 ) = 0 . Additionally, s satisfies

Proof. We focus on the following function:

Note that f ( a ) = ℓ ( a · 1 ) . It holds that

Note that f ′ ( a ) = ∇ ℓ ( a · 1 ) j for any j ∈ [ d ] , and so f ′ ( a ) = 0 if and only if ∇ ℓ ( a · 1 ) = 0 . We proceed to show that within [ -1 d , 3 d ] , f ′ ( a ) has a root and is monotonic. It holds that

Next, since d ≥ 8 it holds that

h ( L ) is a decreasing function for L ≥ 3 and achieves the value 0 . 75 when L = 3 , hence since L ≥ 3 we get h ( L ) ≤ 1 . Therefore,

Hence by continuity, f ′ ( a ) has a root within [ -1 d , 3 d ] . Note that by Lemma 4, f ′ ( a ) doesn't have a root within [ -1 d , 1 d ) , implying the root is actually achieved in [ 1 d , 3 d ] . Next, it holds that

Because d ≥ 8 and L -3 is even, we have for any a ∈ [ -1 d , 3 d ]

g ( L ) is a decreasing function for L ≥ 4 and achieves the value 2 . 25 when L = 4 , hence since L ≥ 4 we get g ( L ) ≤ 2 . 25 . Therefore

implying f ′ is monotonically increasing in [ -1 d , 3 d ] . Hence, there exists a unique s ∈ [ 1 d , 3 d ] such that f ′ ( s ) = 0 , which implies that ∇ ℓ ( s · 1 ) = 0 . Note that we showed that s is a minimizer of f over [ -1 d , 3 d ] , as f 's derivative is zero at s and the second derivative is positive along the interval. Finally, let a ∈ R \ [ -1 d , 3 d ] . By Lemma 4, it holds that

and

On the other hand, it also holds that

Thus, s is a minimizer of f over R , meaning that s := s · 1 is a minimizer of ℓ over W 1 as required. On the other hand, since d ≥ 8 and L ≥ 4 it holds that

Therefore,

completing the proof.

In the last two lemmas of this section, we explicitly compute an eigendecomposition of ℓ 's hessian in s and bound its eigenvalues.

Lemma 8. Consider s defined in Lemma 7. An eigendecomposition of the symmetric hessian matrix ∇ 2 ℓ ( s ) is the following:

The eigenvector 1 with the eigenvalue

For j ∈ { 2 , . . . , d } the eigenvector e 1 -e j with the eigenvalue

Proof. We begin by computing the hessian matrix ∇ 2 ℓ ( A ) for a general A ∈ R d , which is symmetric since ℓ ( A ) is analytic. by Equation (22), for any j ∈ [ d ] it holds that

Therefore, for any j ∈ [ d ] we have that

̸

Additionally, for any j, i ∈ [ d ] such that j = i we have that

Now we specialize to A = s . For j ∈ [ d ] , we obtain

̸

For j, i ∈ [ d ] such that j = i we obtain that

where 1 d,d is the d, d all ones matrix. Hence, by Lemma 26 we obtain that an eigendecomposition for ∇ 2 ℓ ( s ) is the following:

Observe that

̸

and

The eigenvector 1 with the eigenvalue λ + := ω 1 +( d -1) ω 2 .

For j ∈ { 2 , . . . , d } the eigenvector e 1 -e j with the eigenvalue λ -:= ω 1 -ω 2 .

λ + takes the following form:

λ -takes the following form:

We now turn to bounding λ + and λ -.

Lemma 9. The eigenvalues λ + and λ -from Lemma 8 statisfy

Proof. Since s ∈ [ 1 d , 3 d ] and since d ≥ 8 we obtain

f ( L ) is increasing for L ≥ 7 and achieves a value that is > -0 . 6 for L = 7 . Hence since L ≥ 7 we get f ( L ) ≥ -0 . 6 > -1 . Therefore,

Next, since s ∈ [ 1 d , 3 d ] and since d ≥ 8 we obtain

g ( L ) is decreasing and positive for L ≥ 7 and achieves a value that is < 0 . 6 for L = 7 . Hence since L ≥ 7 we get 0 ≤ g ( L ) ≤ 0 . 6 < 1 . Additionally, note that

Therefore, we obtain that

which completes our proof.

In the first half of F.3.2 we characterized the critical point s and established that it is the only critical point that is relevant in our case, since it is not a global minimum and since we cannot exclude the possibility that gradient flow would converge to it. In what follows, we give a closed form solution to the dynamics obtained under the linear approximation around s to our true dynamics. We will show that under these linearized dynamics, any gradient flow trajectory not initialized in W 1 will escape s at an exponential rate.

Lemma 10. The linear approximation around s of the gradient flow dynamics (see Equation (22) ) is defined by

The solution to the above linear differential equations system is given by

where λ + and λ -are the eigenvalues ∇ 2 ℓ ( s ) found in Lemma 8, and Q is an orthogonal matrix whose first column is 1 √ d 1 and the rest of its columns are an orthonormal basis of W 2 (defined in Equation (16) ).

Proof. First note that the first order Taylor's expansion around s of -∇ ℓ ( A ) is given by

Since s is a critical point of ℓ ( i.e. , ∇ ℓ ( s ) = 0 ), we obtain the following linear approximation

Per Lemma 8, an eigendecomposition of ∇ 2 ℓ ( s ) is given by the eigenvector 1 with the eigenvalue λ + , and the eigenvectors { e 1 -e 2 , . . . , e 1 -e d } with the eigenvalue λ -. Therefore, we may write ∇ 2 ℓ ( s ) as the orthogonal eigendecomposition

where the first column of Q is 1 √ d 1 , and the rest of its columns are an orthonormal basis of Span { e 1 -e 2 , . . . , e 1 -e d } = W 2 . The proof is completed by invoking Lemma 27 which yields the following solution to the linear system:

The following corollary computes the solution of the linear approximation as a function of the initialization's projections onto W 1 and W 2 (Equation (16)):

Corollary 2. Denote the projection of A lin (0) to W 1 by β 1 1 where β 1 ∈ R , and the projection of A lin (0) to W 2 by β 2 · v ∈ W 2 where v ∈ W 2 is a unit vector β 2 ∈ R . Then for any t ≥ 0 it holds that

Proof. Plugging the projections of A lin (0) to W 1 and W 2 , we can write the following:

Hence per Lemma 27 at time t ≥ 0 the solution A lin ( t ) takes the following form:

Q is a projection matrix to the respective eigenspaces of ∇ 2 ℓ ( s ) , hence since 1 ∈ W 1 and v ∈ W 2 we obtain

as required.

Remark 2. Note that if β 2 = 0 (i.e. the initialization A lin (0) was not in W 1 ), then the solution to the system diverges from s . Since λ -< 0 < λ + we obtain

̸

On the other hand, if β 2 = 0 then the solution to the system converges to s .

F.3.3 Linearization of Dynamical Systems

In F.3.2 we characterized the critical point s ∈ 1 and established that it is the only non global minimum that we could converge to given our initialization. We would now like to show that in fact gradient flow will escape s and converge rapidly towards a global minimum. Corollary 2 gives some indication why this may be the case-it shows that the local linearization of the dynanics near s will tend to repel any trajectory which is not on the line W 1 . Intuitively one expects that once we are sufficiently close to s , the linearized dynamics provide a sufficiently good approximation to ensure that the same conclusion will hold for the nonlinear system as well. Unfortunately, existing results from the optimization literature ( e.g. Jin et al. [35]) give escape times which do not suffice for our purposes 12 . To obtain the required bounds on the escape time we will require some results from dynamical systems theory. Informally, the idea is that if a non linear dynamical system satisfies certain conditions on the spectrum of its linearization (these are sometimes called 'non-resonance conditions'), then it is locally smoothly equivalent to its linearization. This will allow us to bound the escape time of gradient flow in terms of the closed form dynamics obtained for the linearization in Corollary 2.

We begin by defining the notions of smooth conjugation and smooth linearization of dynamical systems:

Definition 5. Let f, g : R d → R d be two C M vector fields with a common fixed point x 0 ∈ R d , i.e. , f ( x 0 ) = g ( x 0 ) = 0 . For any K ∈ [ M ] we say that f and g are C K -conjugate near x 0 when there exist neighborhoods V 1 , U 1 ⊆ R d such that x 0 ∈ V 1 , U 1 and there exist a C K -diffeomorphism H : V 1 →U 1 satisfying the following:

H ( x 0 ) = x 0 .

Whenever x ( t ) ∈ V 1 is a solution of ˙ x ( t ) = f ( x ( t ) ) for t in some interval I ⊆ R then y ( t ) = H ( x ( t ) ) is a solution of ˙ y ( t ) = g ( y ( t ) ) for t ∈ I .

Whenever y ( t ) ∈ U 1 is a solution of ˙ y ( t ) = g ( y ( t ) ) for t in some interval I ⊆ R then x ( t ) = H -1 ( y ( t ) ) is a solution of ˙ x ( t ) = f ( x ( t ) ) for t ∈ I .

The mapping H is referred to as the C K -conjugation between ˙ x ( t ) = f ( x ( t ) ) and ˙ y ( t ) = g ( y ( t ) ) . Consider the first order Taylor's expansion of f around x 0 given by

and

where A = Df ( x 0 ) , F ( 0 ) = 0 and DF ( 0 ) = 0 d,d is the d, d zero matrix. The associated linear equation is given by

We say that f admits a C K -linearization near x 0 when it is C K -conjugate near x 0 with its linear approximation.

We now introduce the Strict Hyperbolicity property and the Non-resonance condition (also known as the Sternberg condition). These are sufficient conditions for a dynamical system to admit a smooth linearization and we will later show our system satisfies them.

Definition 6. Let A ∈ R d,d be a matrix with eigenvalues λ 1 , . . . , λ d ∈ R repeated with multiplicities. We say that A is strictly hyperbolic when:

̸

For all j ∈ [ d ] it holds that λ j = 0 .

There exist j + , j -∈ [ d ] such that λ j + > 0 and λ j -< 0 .

Definition 7. Let A ∈ R d,d be a matrix with eigenvalues λ 1 , . . . , λ d ∈ R repeated with multiplicities. For any m ∈ N d ≥ 0 non-negative integers vector and any λ ∈ R we denote γ ( λ, m ) as the following quantity:

For any N ∈ N such that N ≥ 2 we say that A satisfies the non-resonance condition of order N when for all j ∈ [ d ] and all m ∈ N d ≥ 0 such that ∑ d k =1 m k ∈ { 2 , . . . , N } it holds that γ ( λ j , m ) = 0 .

Finally, we present the property of matrix Q -smoothness .

Definition 8. Let A ∈ R d,d be a matrix with eigenvalues λ 1 , . . . , λ d ∈ R repeated with multiplicities. Suppose A is strictly hyperbolic. Denote the following quantities:

Let Q ∈ N > 0 . We define the Q -smoothness of A to be the largest integer K ∈ N ≥ 0 for which there exist M,N ∈ N > 0 satisfying the following:

Q = M + N .

M -Kρ + ≥ 0 .

N -Kρ -≥ 0 .

We are now ready to present Theorem 1 of [70], which states conditions under which there exists a smooth linearization of a dynamical system. 13

Theorem 3 (Theorem 1 of [70] (adapted)) . Let Q ∈ N such that Q ≥ 2 . Let f : R d → R d be an analytic vector field with a fixed point x 0 . Consider the first order Taylor's expansion of f around x 0 given by

where A = Df ( x 0 ) , F ( 0 ) = 0 and DF ( 0 ) = 0 d,d . If A is strictly hyperbolic (Definition 6) and satisfies the non-resonance condition of order Q (Definition 7) then f admits a C K linearization near x 0 where K is the Q -smoothness of A (Definition 8).

Proof. See proof of Theorem 1 in [70].

Having introduced these general results on local linearization, we now show that the dynamical system induced by gradient flow admits a smooth linearization near s . We begin by showing that -∇ 2 ℓ ( s ) is strictly hyperbolic and satisfies the non-resonance condition.

̸

Proposition 8. Consider s defined in Lemma 7. The hessian matrix -∇ 2 ℓ ( s ) is strictly hyperbolic and satisfies the non-resonance condition of order d -2 .

Proof. Per Lemma 9, it holds that and

Hence by Definition 6, ∇ 2 ℓ ( s ) is strictly hyperbolic. Additionally, for any m ∈ { 0 , . . . , d -2 } we have that

Let m ∈ N d ≥ 0 such that ∑ d k =1 m k ∈ { 2 , . . . , d -2 } . Per definition Definition 7 we have that

If m 1 ∈ { 0 , 1 } then since λ -< 0 < λ + and ∑ d k =2 m k ∈ { 1 , . . . , d -2 } we obtain

Otherwise, since ∑ d k =2 m k ∈ { 0 , . . . , d -4 } we obtain by the above that

̸

Hence γ ( λ + , m ) = 0 . Next, per Definition 7 we have that

If m 1 = 0 then since 1 -∑ d k =2 m k ∈ {-1 , . . . , -d +3 } we obtain

If m 1 = d -2 then 1 -∑ d k =2 m k = 1 and so

Otherwise, since ∑ d k =2 m k -1 ∈ { 0 , . . . , d -3 } we obtain by the above that

̸

Hence γ ( λ -, m ) = 0 . Therefore by Definition 7, -∇ 2 ℓ ( s ) satisfies the non-resonance condition of order d -2 .

Next, we turn to lower bound the Q -smoothness of -∇ 2 ℓ ( s ) .

Proposition 9. For any Q ∈ N > 0 , the Q -smoothness of -∇ 2 ℓ ( s ) is at least ⌊ Q 2 ⌋ .

Proof. Per Lemma 9, we have the following:

Therefore per Definition 8 and since ∇ 2 ℓ ( s ) is strictly hyperbolic, the Q -smoothness of -∇ 2 ℓ ( s ) is the largest K ∈ N ≥ 0 for which there exist M,N ∈ N > 0 such that

Q = M + N .

M -K ≥ 0 .

N -K ≥ 0 .

One can easily verify this implies that the Q -smoothness of -∇ 2 ℓ ( s ) is at least ⌊ Q 2 ⌋ .

Finally, we are ready to prove the following proposition which shows that our dynamical system induced by gradient flow admits a linearization which is at least C 3 .

Proposition 10. The dynamical system induced by gradient flow (see Equation (22) ) admits a linearization near s that is at least C 3 .

Proof. First note that the vector field -∇ ℓ ( A ) which gradient flow follows is analytic. Next, per Propositions 8 and 9 it holds that -∇ 2 ℓ ( s ) is strictly hyperbolic, satisfies the non-resonance condition of order at least d -2 , and has Q -smoothness of at least ⌊ Q 2 ⌋ for any Q ∈ N > 0 . Hence, by Theorem 3 the vector field -∇ ℓ ( A ) admits a C ⌊ d -2 2 ⌋ -linearization near s . The proof concludes by noting that d ≥ 8 hence ⌊ d -2 2 ⌋ ≥ 3 .

We denote the above linearization by H : V 1 →U 1 , where the neighborhoods V 1 , U 1 ⊆ R d are such that s ∈ V 1 , U 1 . To set the stage for the rest of the proof, we prove the following proposition that considers a restriction of H to a smaller domain that satisfies a few additional conditions which we will require later.

Proposition 11. There exists r 1 > 0 which satisfies the following:

r 1 ≤ 1 2 d .

For any A ∈ B r 1 ( s ) it holds that

H | B r 1 ( s ) is Lipschitz and there exist r 2 ∈ (0 , r 1 ) and r 3 > 0 such that H -1 | B r 3 ( s ) is Lipschitz and it holds that

Proof. We show there exist three non empty intervals of the form (0 , b i ] for i ∈ [3] , such that if r 1 ∈ (0 , b i ] then it satisfies the corresponding requirement above. This would imply that the minimal upper limit r 1 := min { b 1 , b 2 , b 3 } satisfies all requirements. The first condition is trivial, with b 1 = 1 2 d . Next, since ∇ ℓ ( A ) is analytic it holds that ∇ 2 ℓ ( A ) is symmetric for any A ∈ R d . Since λ -< 0 , by the continuity of the eigenvalues of ∇ 2 ℓ ( A ) around s there exists b 2 > 0 such that the second requirement is satisfied for all (0 , b 2 ] . Lastly, since H : V 1 →U 1 is C 3 and since V 1 , U 1 are neighborhoods of s , we can invoke Lemma 28 which states that there exists b 3 > 0 such that for any b ∈ (0 , b 3 ] the third and fourth requirements are satisfied.

F.3.4 Movement Towards the Saddle s

Having established key properties of the loss landscape, we are ready to begin the dynamical analysis of the gradient flow trajectories over time. We first give a simple bound on the magnitude of the entries of A ( t ) .

Lemma 11. Suppose we initialize at A (0) ∈ I 0 and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . For any t ≥ 0 and any j ∈ [ d ] it holds that

Proof. First, we have shown in Lemma 5 that the initialization I 0 guarantees all points encountered by gradient flow have loss no larger than 1 . Assume on the contrary that there exist t ≥ 0 and j ∈ [ d ] for which

Since L -1 is even, we obtain that a j ( t ) L -1 ≥ 3 L -1 > 3 and that any k ∈ [ d ] , k = j satisfies a k ( t ) L -1 ≥ 0 . Hence, we obtain that

̸

in contradiction to Lemma 22. The proof is identical when we consider the reference trajectory.

The above yields the following useful corollary.

Corollary 3. There exists N > 0 such if we initialize at A (0) ∈ I 0 and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) then for any t ≥ 0 the functions -∇ ℓ ( A ( t ) ) and -∇ ℓ ( A ref ( t ) ) are N -Lipschitz.

Proof. As shown in Lemma 11, all points encountered by gradient flow are contained in the compact set [ -3 , 3] d . The claim thus follows from the fact that ℓ ( A ) is analytic.

We continue to prove the following lemma which analyzes the trajectories when initializing in an interval of points on the line W 1 (Equation (16)).

̸

Lemma 12. Let a 1 , a 2 ∈ [ -1 d , 4 d ] \ { s } such that a 1 = a 2 . Suppose we initialize at A 1 (0) = a 1 · 1 and A 2 (0) = a 2 · 1 , and evolve A 1 ( t ) and A 2 ( t ) according to Equation (22) . It holds that:

There exist functions a 1 , a 2 : R ≥ 0 → R such that

For any t ≥ 0 it holds that a 2 ( t ) < a 1 ( t ) ⇐⇒ a 2 < a 1 .

For any r > 0 there exists t 1 ≥ 0 such that for any t ≥ t 1 it holds that A 1 ( t ) , A 2 ( t ) ∈ B r ( s ) .

Proof. When initializing at A (0) = a · 1 and evolving A ( t ) according to the gradient flow dynamics, all entries evolve according to the same dynamics and therefore must stay equal throughout the optimization. Concretely, all entries obey the following dynamics:

Hence, the first claim holds. Rewriting the above in terms of Lemma 7, we have

In Lemmas 6 and 7, we showed that the above expression is positive for a ( t ) ∈ [ -1 d , s ) and equals zero at s . We now show that the above expression is negative for a ( t ) ∈ ( s, 4 d ] . Indeed, since d ≥ 8

we have that

where the second to last inequality stems from the fact that h ( L ) is decreasing for L ≥ 4 , that h (4) = 0 . 75 , and that L ≥ 7 . Next, we also have for any a ∈ ( s, 4 d ] that

where the second to last inequality stems from the fact that g ( L ) is decreasing for L ≥ 7 , that g (7) = 15 8 , and that L ≥ 7 . Therefore, since -1 d f ′ ( s ) = 0 and from monotonicity we obtain that -1 d f ′ ( a ( t ) ) is negative for a ( t ) ∈ ( s, 4 d ] . We continue by noting that per Lemma 30, trajectories of the same system of ODEs with different initalizations must never meet, hence by continuity it must hold that a 2 ( t ) < a 1 ( t ) ⇐⇒ a 2 < a 1 for all t ≥ 0 . Finally, since s is a critical point in the interval and since a 1 ( t ) , a 2 ( t ) evolve monotonically (increase if initialized < s and decrease otherwise), we get by Lemma 30 that a 1 ( t ) and a 2 ( t ) cannot reach s in any finite time. However, since s is the unique critical point in the interval, a 1 ( t ) and a 2 ( t ) must converge to s as t →∞ . Hence, there exists some time t 1 ≥ 0 such that for any t ≥ t 1 the entries of both A 1 ( t ) and A 2 ( t ) are within B r ( s ) .

Weuse A Z ( t ) and A -( t ) to denote the trajectories generated by initializing at 0 and -1 d · 1 respectively and evolving according to Equation (22). Additionally, for any r > 0 we use t 1 ( r ) ≥ 0 to denote the minimal time which satisfies

Note this means that for r ∈ (0 , s ) we have A Z ( t 1 ( r ) ) = r √ d · 1 + s .

We denote the following projections of the trajectory A ( t ) and the reference trajectory A ref ( t ) , which will be used in the rest of the proof.

Definition 9. Suppose we initialize at A (0) ∈ I 0 and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22). For any t ≥ 0 , we denote the projections of A ( t ) and A ref ( t ) to the subspace W 1 using

where β 1 ( t ) , β ref 1 ( t ) ∈ R . Additionally, we denote the projections of A ( t ) and A ref ( t ) to the subspace W 2 using

where β 2 ( t ) , β ref 2 ( t ) ∈ R and v ( t ) , v ref ( t ) ∈ W 2 are unit vectors. Per Equation (16), W 1 and W 2 are orthogonal and span R d , hence we may write

Remark 3. Per Equation (16) , W 1 and W 2 are orthogonal therefore since ( β 1 ( t ) · 1 ) ⊤ ( β 2 ( t ) · v ( t )) = 0 and ( β ref 1 ( t ) · 1 ) ⊤ ( β 2 ( t ) ref · v ref ( t )) = 0 , we obtain

and

Before proving the main claim of this section, we introduce another condition on the initialization which we denote I 3 .

Definition 10. Let r > 0 . We use I 3 ( r ) to denote the following subset of I 0 :

for N of Corollary 3 and for A Z ( t ) , A -( t ) and t 1 ( r ) of Lemma 12.

We are now ready to prove the main claim of this section, which states that under the above on the initalization, both the original and reference trajectories must enter a sufficiently small sphere around s and furthermore they arrive at points that are sufficiently faraway from W 1 .

Proposition 12. Let r ∈ (0 , s ) . Suppose we initialize at A (0) ∈ I 3 ( r 4 ) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . There exist constants D + ( r ) , D -( r ) > 0 such that:

Proof. Consider the trajectories A Z ( t ) and A -( t ) introduced in Lemma 12. Per Lemma 12, for any time t ≥ 0 and any index j ∈ [ d ] we have

We begin by showing that for A (0) ∈ I 3 ( r 4 ) , the distance between A Z ( t 1 ( r 4 ) ) and A ( t 1 ( r 4 ) ) is at most r 24 . First note that per Lemma 12, A Z ( t ) never leaves B s ( s ) ⊆ [ -3 , 3] d . Thus per Corollary 3, both A Z ( t ) and A ( t ) are always contained in a compact domain where the vector field -∇ ℓ ( A ) is N -Lipschitz. Therefore, we can invoke Lemma 29 which results in the following:

Per Definition 10, α satisfies

Hence, we obtain that

Therefore, using the triangle inequality we obtain

Hence, A ( t 1 ) ∈ B r 2 ( s ) . Next, by Remark 3 we obtain that

By Lemma 12 we have A Z ( t 1 ( r 4 ) ) ∈ W 1 , hence

Thus, denoting D + ( r ) := d · exp ( N · t 1 ( r 4 ) ) we get the first part of the second claim. We now show that β 1 ( t 1 ( r 4 ) ) ∈ ( -1 d , s ) . Per Lemma 12, we get by definition of t 1 that

and so since ∥ A Z ( t 1 ( r 4 ) ) -A ( t 1 ( r 4 ) ) ∥ 2 ≤ r 24 and r < s it must hold that β 1 ( t 1 ( r 4 ) ) < s . Since

it must hold that

where A -( t 1 ( r 4 ) ) = a -( t 1 ( r 4 ) ) · 1 . Note that by Lemma 12 we obtain

as a -( t ) is monotonically increasing. Therefore by Lemma 12 and by continuity, there must exist some point a ∈ ( -1 d , β 1 ( t 1 ( r 4 ) ) ) such that if we initialize A a (0) = a · 1 and evolve A a ( t ) according to the gradient flow dynamics, then it holds that

Per Lemma 12, A a ( t ) never leaves [ -3 , 3] d where the vector field -∇ ℓ ( A ) is N -Lipschitz. Thus, invoking Lemma 29 we obtain

As A a (0) ∈ W 1 , we can lower bound the right hand side by the distance between A (0) and W 1 and obtain

Next, observe that ζ d ≤ 1 2 since A (0) ∈ I 3 ( r 4 ) , hence

Hence, we meet the second part of the second claim with D -( r ) defined as

Note that the proof for the reference case is identical.

We note the following remark which deals with the value of points in a sufficiently small sphere around s .

Remark 4. Let µ > 0 . The objective ℓ is continuous and ℓ ( s ) > 0 there exists r ( µ ) > 0 such that any A ∈ B r ( µ ) ( s ) satisfies

We conclude this section by proving the following corollary, which states that when A (0) ∈ I 3 , a set of additional properties are satisfied.

Corollary 4. Let µ > 0 . Consider ˜ r ( µ ) := min { r 2 , r ( µ ) } for the respective r 2 and r ( µ ) of Proposition 11 and Remark 4. Suppose we initialize at A (0) ∈ I 3 ( ˜ r 4 ) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . There exist constants D + ( µ ) , D -( µ ) > 0 such that:

Therefore,

and or

Proof. We consider the constants D + ( µ ) := D + ( ˜ r ( µ )) and D -( µ ) := D -( ˜ r ( µ )) from Proposition 12. Per Proposition 12 and since A (0) ∈ I 3 ( ˜ r ( µ ) 4 ) , we have that:

As ˜ r ( µ ) ≤ r 2 , r ( µ ) , we immediately obtain that

Finally, recall Remark 4 which combined with the latter argument results in

as required.

F.3.5 Escape From the Saddle s

In the previous section, we showed that the gradient flow trajectories must reach a sufficiently small sphere around s . Our goal in this section is showing that not only do both trajectories escape it, but they also do it fast enough 14 . To begin this section, we prove the following three lemmas regarding the diffeomorphism H from Proposition 10. The following lemma proves that W 1 is mapped into itself under H .

Lemma 13. Let A ∈ B r 2 ( s ) \ { s } and denote ˜ A := H ( A ) . If A ∈ W 1 then ˜ A ∈ W 1 .

Proof. Since A ∈ W 1 there exists a ∈ B r 2 ( s ) such that A = a · 1 . Per Proposition 11 and Lemma 7, it holds that r 2 < r 1 ≤ 1 2 d and s ∈ [ 1 d , 3 d ] . Thus we obtain that a ∈ [0 , 4 d ] . Assume on the contrary that ˜ A / ∈ W 1 . On the one hand, if we initialize at A (0) = a · 1 and evolve A ( t ) according to Equation (22), then per Lemma 12 A ( t ) ∈ B r 2 ( s ) for all t ≥ 0 , and furthermore lim t →∞ A ( t ) = s . By continuity H ( A ( t )) converges to s as well. On the other hand, if we initialize at ˜ A (0) = ˜ A and evolve ˜ A ( t ) according to the linear approximation around s of the gradient flow dynamics (see Lemma 10), then per Remark 2 the solution ˜ A ( t ) diverges away from s (since the projection of ˜ A to W 2 is not zero). This contradicts our assumption that H is a conjugation (see Definition 5).

The following lemma proves the existence of two points in W 1 that are mapped by H to 'opposite sides' of s .

Lemma 14. There exists a 1 , a 2 ∈ [ s -r 2 2 √ d , s + r 2 2 √ d ] \ { s } such that there exist ˜ a 1 ∈ [ s -r 3 √ d , s ) and ˜ a 2 ∈ ( s, s + r 3 √ d ] for which either

̸

Proof. Consider a 1 = s -r 2 4 √ d and a 2 = s + r 2 4 √ d . Both a 1 · 1 and a 2 · 1 are within W 1 ∩ B r 2 ( s ) and so by Proposition 11 and Lemma 13 it holds that H ( a 1 · 1 ) , H ( a 2 · 1 ) ∈ W 1 ∩ B r 3 ( s ) . Thus we can denote H ( a 1 · 1 ) = ˜ a 1 · 1 and ( a 2 · 1 ) = ˜ a 2 · 1 for some ˜ a 1 , ˜ a 2 ∈ [ s -r 3 √ d , s + r 3 √ d ] . ˜ a 1 , ˜ a 2 are distinct and different than s since a 1 , a 2 = s are distinct and since H is a homeomorphism with H ( s ) = s . Assume WLOG that ˜ a 1 < ˜ a 2 (otherwise we flip the indices). Assume on the contrary that ˜ a 1 , ˜ a 2 > s (the case where ˜ a 1 , ˜ a 2 < s is symmetric). Per Remark 2, if we initialize at ˜ A (0) = ˜ a 2 · 1 and evolve ˜ A ( t ) according to the linear approximation around s of the gradient flow dynamics, then our trajectory (which converges to s ) must reach ˜ a 1 · 1 after some finite time t 2 , i.e. we obtain ˜ A ( t 2 ) = ˜ a 1 · 1 . Thus we obtain that

Hence, per Proposition 10 if we initialize at A (0) = a 2 · 1 and evolve A ( t ) according to the gradient flow dynamics, we would get that

The proof concludes by noting that the above is a contradiction to Lemma 12.

The following lemma proves that W 1 is mapped into itself under H -1 .

Lemma 15. Let ˜ A ∈ B r 3 ( s ) \ { s } and denote A := H -1 ( ˜ A ) . If ˜ A ∈ W 1 then A ∈ W 1 .

Proof. Since ˜ A ∈ W 1 ∩ B r 3 ( s ) there exists ˜ a ∈ [ s -r 3 , s + r 3 ] \ { s } such that ˜ A = ˜ a · 1 . Assume WLOG that ˜ a ∈ [ s -r 3 , s ) (the opposite case is symmetric). Per Lemma 14, there exists a ′ ∈ [ s -r 2 2 √ d , s + r 2 2 √ d ] \ { s } such that there exists ˜ a ′ ∈ [ s -r 3 √ d , s ) for which

Assume that ˜ a ≤ ˜ a ′ . By Lemma 10, if we initialize at ˜ A (0) = ˜ A and evolve ˜ A ( t ) according to the linear approximation around s of the gradient flow dynamics, then our trajectory (which converges to s ) must reach ˜ a ′ · 1 after some finite time t 2 , i.e. we obtain ˜ A ( t 2 ) = ˜ a ′ · 1 . Thus we obtain that

Hence, per Proposition 10 if we initialize at A (0) = A = H -1 ( ˜ A ) and evolve A ( t ) according to the gradient flow dynamics, we would get that

Invoking Lemma 2 we conclude that A ∈ W 1 . Assume that ˜ a > ˜ a ′ . By Lemma 10, if we initialize at ˜ A ′ (0) = ˜ A ′ and evolve ˜ A ′ ( t ) according to the linear approximation around s of the gradient flow dynamics, then our trajectory (which converges to s ) must reach ˜ a · 1 after some finite time t 2 , i.e. we obtain ˜ A ′ ( t 2 ) = ˜ a · 1 = ˜ A . On the one hand, note that H -1 ( ˜ A ) = A . On the other hand, if we initialize at A ′ (0) = a ′ · 1 and evolve A ′ ( t ) according to the gradient flow dynamics (defined in Equation (21)), we get by Proposition 10 that A ′ ( t 2 ) = H -1 ( ˜ A ′ ( t 2 ) ) . Thus, A ′ ( t 2 ) = A . The proof concludes by invoking Lemma 12 which states that A ′ ( t ) ∈ W 1 for any t ≥ 0 .

The following two lemmas give bounds on the original dynamics in terms of the linearized ones.

Lemma 16. Let A ∈ B r 2 ( s ) \ { s } . It holds that

where ˜ G is the Lipschitz coefficient of H -1 | B r 3 ( s ) .

Proof. First note that per Proposition 11, H -1 | B r 3 ( s ) is indeed Lipschitz. Let ˜ G > 0 be its Lipschitz coefficient. Next, by definition of the Dist measure (Equation (15)) we have that

Since A ∈ B r 2 ( s ) , it holds by Proposition 11 that H ( A ) ∈ B r 3 ( s ) . Thus, since B r 3 ( s ) is a ball it must hold that

As H is onto B r 3 ( s ) , by Proposition 11 there exists A ′ ∈ B r 1 ( s ) such that

Hence by the Lipschitz property of of H -1 we obtain

Since A ′ = H -1 ( ˜ A ) for some ˜ A ∈ W 1 ∩ B r 3 ( s ) , it holds by Lemma 15 that A ′ ∈ W 1 . Thus,

Combining the above inequalities and multiplying by ˜ G we obtain overall that

as required.

Lemma 17. Let A ∈ B r 1 ( s ) . It holds that

where G is the Lipschitz coefficient of H | B r 1 ( s ) .

Proof. First note that per Proposition 11, H | B r 1 ( s ) is indeed Lipschitz. Let G > 0 be its Lipschitz coefficient . Next, by definition of the Dist measure we have that

Since A ∈ B r 1 ( s ) and B r 1 ( s ) is a ball, it must hold that

By the Lipschitz property of H we obtain

where the last inequality follows from Lemma 13. Multiplying by G gives the result.

Before proving the main claims of this section, we introduce another condition on the initialization which we denote I 4 .

Definition 11. Let µ > 0 . We denote G ′ := max { 1 , G, ˜ G } for ˜ G and G from Lemmas 16 and 17. We use I 4 ( µ ) to denote the following subset of I 0 :

for r 3 , λ -and D + from Proposition 11, Lemma 8, , and Corollary 4 respectively.

In the next two propositions, we bound the time it takes to escape the sphere around s under the linearized dynamics, and prove an additional claim that will be utilized later to show that the trajectory never returns to a certain sphere around s .

We introduce notation which will be used in both propositions; Let µ > 0 . Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ ) 4 ) ∩ I 4 ( µ ) (for ˜ r of Corollary 4) and at A ref (0) , and evolve A ( t ) and A ref ( t according to Equation (22). Suppose we initialize ˜ A (0) = H ( A ( t 1 ( ˜ r ( µ ) 4 ) ) ) and at ˜ A ref (0) =

) H ( A ref ( t 1 ( ˜ r ( µ ) 4 ) ) ) (for t 1 of Lemma 12), and evolve ˜ A ( t ) and ˜ A ref ( t ) according to the linearized dynamics (see Lemma 10). For any time t ≥ 0 , denote the representations of ˜ A ( t ) and ˜ A ref ( t ) with the orthogonal subspaces W 1 and W 2 to be

where ˜ v ( t ) , ˜ v ref ( t ) ∈ W 2 are unit vectors.

The following proposition give quantitative bounds on the rate of exponential escape from s of trajectories under the lineaarized dynamics.

Proposition 13. There exist times t 2 ( µ ) , t ref 2 ( µ ) ≥ 2 for which it holds

∣ ∣ ∣ ∣ ˜ β 2 ( t 2 ( µ ) ) ∣ ∣ ∣ ∣ , ∣ ∣ ∣ ∣ ˜ β ref 2 ( t 2 ( µ ) ) ∣ ∣ ∣ ∣ = r 3 2 √ d .

For G ′ := max { 1 , G, ˜ G } it holds that

For any t ∈ [0 , t 2 ( µ )] it holds that ˜ A ( t ) ∈ B r 3 ( s ) .

For any t ∈ [0 , t ref 2 ( µ )] it holds that ˜ A ref ( t ) ∈ B r 3 ( s ) .

Proof. We prove the argument for ˜ A (the proof is identical for ˜ A ref ). Recall Corollary 4 which states that

Thus, applying Lemmas 16 and 17 we obtain

Per Lemma 10, for any t ≥ 0 the solution at time t to the linear dynamics initialized at ˜ A (0) is given by

As noted in Remark 2, the coefficient | ˜ β 1 ( t ) -s | tends to zero as t grows, while the coefficient | ˜ β 2 ( t ) | tends to ∞ as t grows. We first bound the time t 2 ( µ ) for which ∣ ∣ ∣ ∣ ˜ β 2 ( t 2 ( µ ) ) ∣ ∣ ∣ ∣ = r 3 2 √ d . Since A (0) ∈ I 4 ( µ ) , it holds that

and

Therefore since λ -< 0 (by Lemma 9) we obtain the following positive time t -:

Thus, at time t -the solution to the linear dynamics satisfies the following:

where the last two inequalities stem from the fact that G ′ ≥ G, 1 . Hence, t -is a lower bound on t 2 ( µ ) . On the other hand, note that

and so since λ -< 0 we obtain the following positive time t + :

Thus, at time t + the solution to the linear dynamics statisfies the following:

where the last two inequalities stem from the fact that G ′ ≥ ˜ G, 1 . Hence, t + is an upper bound on t 2 ( µ ) . Next, we show that | ˜ β 1 ( t -) -s | ≤ r 3 2 √ d . This will allow us to claim by monotonicity that ˜ A ( t 2 ( µ ) ) ∈ B r 3 ( s ) , since then we'll have the following:

Since ˜ A (0) ∈ B r 3 ( s ) it holds that | ˜ β 1 (0) -s | ≤ r 3 √ d . Hence, since λ + λ -< -1 (by Lemma 9) it holds that

where the last inequality stems from the fact that 2 ≤ r 3 4 G ′ 2 √ dαD + ( µ ) . Finally, since under the linear dynamics | ˜ β 2 ( t ) | monotonically grows and | ˜ β 1 ( t ) | monotonically tends to s , it must hold that for any t ∈ [0 , t 2 ( µ )] we have ˜ A ( t ) ∈ B r 3 ( s ) .

The next proposition shows that ˜ β 2 ( t ) must be larger than some constant throughout a time interval of length 1 before t 2 ( µ ) .

Proposition 14. For any τ ∈ [0 , 1] it holds that

Proof. We prove the argument for ˜ A (the proof is identical for ˜ A ref ). In Proposition 13 we've established that t 2 ( µ ) ≥ 2 . Thus, per Lemma 10, for any τ ∈ [0 , 1] the solution at the positive time t 2 ( µ ) -τ ≥ 1 to the linear dynamics initialized at ˜ A (0) is given by

Hence, since ∣ ∣ ∣ ∣ ˜ β 2 ( t 2 ( µ ) ) ∣ ∣ ∣ ∣ = r 3 2 √ d we obtain that

The above established that there exists a time which is O (ln( 1 α )) where at least one of the linearized trajectories is at a constant distant from W 1 . We complete this section by proving the following corollary, which states that the corresponding non linear dynamics trajectory must also be at a constant distance from W 1 during a time interval of length 1 . This will eventually allow us to claim that the trajectory must remain trapped within a set where the objective ℓ satistfies satisfies the PL condition (see Definition 13), which in turn ensures a rapid convergence to a global minimum (discussed in the next section).

Corollary 5. Let µ > 0 . Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ ) 4 ) ∩I 4 ( µ ) (for ˜ r of Corollary 4) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . For any τ ∈ [0 , 1] it holds that

Proof. We prove the argument for A (the proof is identical for A ref ). In Proposition 14 we have shown that for any τ ∈ [0 , 1] it holds that ˜ A ( t 2 ( µ ) -τ ) ∈ B r 3 ( s ) , and so the mapping H is a conjugation to the original dynamics. Therefore since we've initialized ˜ A (0) at H ( A ( t 1 ( ˜ r ( µ ) 4 ) ) ) , it must hold that for any τ ∈ [0 , 1]

Since H -1 [ B r 3 ] ⊆ B r 1 we obtain that A ( t 1 ( ˜ r ( µ ) 4 ) + t 2 ( µ ) -τ ) ∈ B r 1 , and thus by Lemma 17 we obtain

Note that by orthgonoality ∣ ∣ ∣ ∣ ˜ β 2 ( t 2 ( µ ) -τ ) ∣ ∣ ∣ ∣ = Dist ( ˜ A ( t 2 ( µ ) -τ ) , W 1 ) , hence plugging Proposition 14 we receive

where the last inequality is due to λ -< 0 . The proof is complete by observing that

F.3.6 Convergence to a Global Minimum

We begin this section by proving the following corollary regarding the difference between different coordinates of the points reached by the gradient flow trajectories. We will later show that this ensures the objective satisfies the PL condition (Definition 13).

Corollary 6. Let µ > 0 . Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ ) 4 ) ∩ I 4 ( µ ) (for ˜ r of Corollary 4) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . For any τ ∈ [0 , 1] it holds that there exist i, j, i ref , j ref ∈ [ d ] such that

and

Proof. The claim follows from invoking Lemma 31 and plugging the lower bound on | β 2 | and | β ref 2 | provided in Corollary 5.

We continue by proving that ℓ satisfies the PL condition (Definition 13) on the subset of points Diff ( b ) C (Equation (18)):

Lemma 18. Let b > 0 . The function ℓ | Diff ( b ) C ∩ [ -3 , 3] d satisfies the PL condition with PL coefficient

or

Therefore, if res 2 l ≥ res 2 s we get that

̸

and

̸

Proof. Let A ∈ Diff ( b ) C ∩ [ -3 , 3] d . Recalling the definition of Diff ( b ) C (Equation (18)) there exist i, j ∈ [ d ] such that | a i -a j | ≥ b . Since a i = a j , at least one is non-zero. Assume WLOG that a j = 0 . Hence, since 0 < L -2 ∈ N odd we get per proposition 20 that

Denote res s := 1 -∑ d k =1 a k and res l := 1 -∑ d k =1 a L -1 k . If res s = 0 , then it holds that

By the triangle inequality, either | a L -2 i | ≥ ˜ b 2 or | a L -2 j | ≥ ˜ b 2 . In either case,

i.e. the PL condition is satisfied with µ = 1 2 · ( ( L -1) ˜ b ) 2 4 . If res l = 0 , then it holds that

̸

i.e. the PL condition is satisfied with µ = 1 2 · 2 d . Assume res l , res s = 0 and denote χ := -res s ( L -1) res l = 0 . For any k ∈ [ d ] we have

̸

∇ ℓ ( A ) k = ( L -1) a L -2 k res l + res s = ( L -1) a L -2 k res l -( L -1) res l · χ = ( L -1)( a L -2 k -χ ) res l or equivalently

Squaring the above identities we obtain

By the triangle inequality we have that either

i.e. the PL condition is satisfied with µ = 1 2 ( ( L -1) ˜ b ) 2 4 . On the other hand if res 2 l < res 2 s , then by proposition 21 either

or and therefore

i.e. the PL condition is satisfied with µ = 1 2 ( ̂ b ̂ b +2 ) 2 . Overall, we get that whenever A ∈ Diff ( b ) C ∩ [ -3 , 3] d , the PL condition is satisfied with µ = 1 2 min { 2 d, ( ( L -1) ˜ b ) 2 4 , ( ̂ b ̂ b +2 ) 2 } , as required.

The above results in the following corollary regarding the PL condition satisfied by ℓ at a certain set of points reached by the gradient flow trajectories.

Corollary 7. Let µ > 0 . Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ ) 4 ) ∩ I 4 ( µ ) (for ˜ r of Corollary 4) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . For any τ ∈ [0 , 1] it holds that ℓ satisfies the PL condition (Definition 13) at the points

and with PL coefficient

for

Proof. The claim follows from invoking Lemma 18 and plugging the bound on the coordinate difference provided in Corollary 6.

For the rest of the proof, we let µ = µ 1 from Corollary 7. We are now ready to prove the following proposition, which states that at time t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) , the trajectory is at a point whose value improves upon the value of ℓ at s by a constant:

Proposition 15. Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) (for ˜ r of Corollary 4) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . it holds that

and

Proof. We prove the argument for A (the proof is identical for A ref ). First, suppose that ℓ ( A ( t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) ) ) ≤ ℓ ( s ) 2 . Then it holds that

Next, suppose that ℓ ( A ( t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) ) ) > ℓ ( s ) 2 . Thus per Lemma 22, for any τ ∈ [0 , 1] it holds that

Next, per Corollary 7 for any τ ∈ [0 , 1] it also holds that ℓ satisfies the PL condition in the point A ( t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) -τ ) with PL coefficient µ 1 . Thus, by Lemma 32 it holds that the difference

is lower bound by

On the other hand, recall that by Corollary 4 and since gradient flow is non-increasing we have that

Thus, we obtain the following:

Reorganizing thus yields as required.

We continue to prove the following proposition, which states that after time t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) , the points reached by the gradient flow trajectory are ones where ℓ satisfies the PL condition with a certain PL coefficient.

Proposition 16. Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) (for ˜ r of Corollary 4) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . There exists ν > 0 such that for any time t it holds that:

Additionally, it holds that ℓ satistfies the PL condition at Diff ( ν ) C with coefficient µ 2 for

where

Proof. We prove the argument for A (the proof is identical for A ref ). Let t ≥ t 1 ( ˜ r ( µ 1 ) 4 ) + t ref 2 ( µ 1 ) . Denote for any ψ ≥ 0 the function

for Diff ( ψ ) defined in Equation (17). Per Lemma 7 and since s ∈ [ -3 , 3] d it holds that

Invoking Lemma 33, it holds that f is right side continuous in 0 . Hence by continuity, we obtain that there exists ν such that for any ψ ∈ [0 , ν ] it holds that

On the other hand, per Proposition 15 and since the objective is non-increasing under gradient flow (see Lemma 22), we obtain the following:

Rearranging we thus obtain

Note that per Lemma 33, f is non increasing w.r.t ψ , thus it must hold that A ( t ) ̸∈ Diff ( ψ ) (since it is in [ -3 , 3] d ). As this holds for any ψ ∈ [0 , ν ] , we obtain that A ( t ) ∈ Diff ( ν ) C . Hence, the argument follows from Lemma 18.

The final proposition of this section proves that the gradient flow trajectory converges to a global minimum ̂ A 2 .

Proposition 17. Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) (for ˜ r of Corollary 4) and evolve A ( t ) according to Equation (22) . There exists ̂ A 2 ∈ R d such that

Proof. Per Corollary 7, there exists ν > 0 such that for any t ≥ t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) it holds that A ( t ) ∈ Diff ( ν ) C where ℓ satisfies the PL condition with coefficient µ 2 (defined in Corollary 7). Next, note that per Lemma 11 and Corollary 3, A ( t ) is always contained in [ -3 , 3] d , where ℓ 's gradient is N Lipschitz. Therefore, the claim follows from Lemma 25.

F.3.7 Overall Divergence From Reference Trajecory

In this section we show that one can choose a set of initializations such that the divergence between ̂ A 2 and some point on the reference trajectory is arbitrarily small. This shows that ̂ A 2 must not recover the teacher (per Lemma 3). We begin by proving the following lemma which gives explicit times at which the gradient flow trajectories reach points of arbitrary small value.

Lemma 19. Let η 2 ∈ (0 , 1) . Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) (for ˜ r of Corollary 4) and evolve A ( t ) according to Equation (22) . Denote

It holds that

Proof. First, note that since λ -< 0 < G ′ and 0 < D -( µ 1 ) < D + ( µ 1 ) we obtain that

The right term is positive as 0 < η 2 < 1 and µ 2 > 0 . Next per Proposition 13 it holds that

which results in

Hence, per Lemma 22 we obtain that

Per Proposition 16 there exists ν > 0 such that for any t ≥ t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) it holds that A ( t ) ∈ Diff ( ν ) C where ℓ satisfies the PL condition with coefficient µ 2 (defined in Corollary 7). Thus, per Lemma 24 it holds that

where the second to last inequality stems from Lemma 22. The proof follows by noting that at initialization ℓ 's value is no more than 1 .

We continue to the following lemma which proves that there exist times at which the distance between the gradient flow trajectory and ̂ A 2 (defined in Proposition 17) is arbitrarily small.

Lemma 20 (Distance between gradient flow trajectory and ̂ A 2 ) . Let δ ∈ (0 , 1) . Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) (for ˜ r of Corollary 4). Denote t ∗ 2 ( µ 1 ) := min { t 2 ( µ 1 ) , t ref 2 ( µ 1 ) } . Then there exists η 2 ,δ > 0 such that

Proof. Denote A ∗ := { A ∈ R d : ℓ ( A ) = 0 } . Per Corollary 7, there exists µ 2 > 0 such that for any t ≥ t 1 ( ˜ r ( µ 1 ) 4 ) + t 2 ( µ 1 ) it holds that ℓ satisfies the PL condition in A ( t ) with PL coefficient µ 2 . Next, note that per Lemma 11 and Corollary 3 it holds that ℓ 's gradient is N Lipschitz in A ( t ) . Therefore by Lemma 25 for any t ≥ 0 it holds that

Additionally, note that since ℓ is continuous and non-negative, when considering its restriction to [ -3 , 3] d we obtain that its 1 sub-level set is compact. Therefore we obtain by Lemma 35 that there

exists η 2 ,δ ∈ (0 , 1) such that for any A ∈ [ -3 , 3] d if ℓ ( A ) ≤ η 2 ,δ then Dist ( A, A ∗ ) ≤ √ µ 2 N δ . It was shown in Lemma 19 that

and so we obtain that

It was also shown that

and so we obtain

as required.

Before proving the last proposition of this section, we introduce another condition on the initialization which we denote I 5 .

Definition 12. Let δ, η > 0 . We use I 5 ( δ, η ) to denote the following subset of I 0 :

for r 3 , D -, G ′ and µ 1 from Proposition 11, Corollaries 4 and 7, , and Definition 11 respectively.

We proceed to proving the following proposition which upper bounds the divergence between A ( t ) and A ref ( t ) .

Proposition 18. Let δ > 0 . Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) ∩ I 5 ( δ 2 , η 2 ,δ ) (for η 2 ,δ of Lemma 20) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . Denote t ∗ 2 ( µ 1 ) := min { t 2 ( µ 1 ) , t ref 2 ( µ 1 ) } . It holds that

for η 2 ,δ described in Lemma 20.

Proof. Per Lemma 11 and Corollary 3 for any t ≥ 0 it holds that A ( t ) , A ref ( t ) are contained in [ -3 , 3] d , where ℓ 's gradient is N Lipschitz . Thus per Lemma 29 it holds that

Next, since t ∗ 2 ( µ 1 ) ≤ t 2 ( µ 1 ) , t ref 2 ( µ 1 ) we obtain by Proposition 13 that for any t ∈ [ t 1 ( ˜ r ( µ 1 ) 4 ) , t 1 ( ˜ r ( µ 1 ) 4 ) + t ∗ 2 ( µ 1 )] it holds that

Invoking Proposition 11, the above results in

By definitions of r 1 and B r 1 ( s ) (Proposition 11), the above yields the following for any t in the interval [ t 1 ( ˜ r ( µ 1 ) 4 ) , t 1 ( ˜ r ( µ 1 ) 4 ) + t ∗ 2 ( µ 1 )] and k ∈ [0 , 1] :

Next, it holds that λ min ( ∇ 2 ℓ ( A ) ) = -λ max ( - ∇ 2 ℓ ( A ) ) for any A ∈ R d . Therefore, invoking Lemma 34 and plugging the above we obtain that

Note that λ -< 0 and so | λ -| = -λ -. Thus, recalling Proposition 13 we upper bound t ∗ 2 ( µ 1 ) and obtain that

Applying Lemma 29 once more, we obtain that

Finally, by Equation (23) and Definition 4 we have at initalization that

Altogether we obtain the following bound on the divergence:

The proof concludes by recalling that the initialization satisfies A (0) ∈ I 5 ( δ 2 , η 2 ,δ ) and so since α > 0 we can rewrite and obtain that

and so

We finish this section by proving the following corollary bounding the distance between ̂ A 2 (the point to which the gradient flow trajecory converges to) and A ref ( t 1 ( ˜ r ( µ 1 ) 4 ) + t ∗ 2 ( µ 1 ) + t 3 ( η 2 ,δ ) ) , a point which by Lemma 3 is far away from the teacher.

Corollary 8. Let δ > 0 . Consider µ 1 from Corollary 7. Suppose we initialize at A (0) ∈ I 3 ( ˜ r ( µ 1 ) 4 ) ∩ I 4 ( µ 1 ) ∩I 5 ( δ , η 2 ,δ ) (for η 2 ,δ of Lemma 20) and at A ref (0) , and evolve A ( t ) and A ref ( t ) according to Equation (22) . Denote t ∗ 2 ( µ 1 ) := min { t 2 ( µ 1 ) , t ref 2 ( µ 1 ) } . It holds that

where A ( t ) converges to ̂ A 2 (see Proposition 17).

Proof. Per Lemma 20, it holds that

Per Proposition 18, it holds that

The claim thus follows from the triangle inequality.

Let I 2 ( δ 2 ) be the initialization subset defined above, i.e.

for δ 2 of Lemma 3. Invoking the lemma we obtain that for any L ′ ≥ L +2 it holds that

which concludes our proof of the fact that gradient flow under S 2 converges to a non-generalizing solution when initialized at I 2 ( δ ) .

F.4 Initialization Subsets Intersect

In Proposition 7 we showed that when initializing at I 1 ( ϵ ) gradient flow converges to a point ̂ A 1 which satisfies Gen L ′ ( ̂ A 1 ) ≤ ϵ . In Corollary 8 we showed that when initializing at I 2 ( δ 2 ) gradient flow converges to a point ̂ A 2 which satisfies Gen L ′ ( ̂ A 2 ) ≥ 1 2 min { 0 . 1 , 1 / (9 d ) · (1 -(0 . 6) 1 / ( L -1) ) } .

In this section we show that not only do the initialization subsets I 1 ( ϵ ) and I 2 ( δ 2 ) intersect but also that their intersection contains an open subset. For convenience of the reader, we rewrite the full requirements as they appear in the statements of Appendices F.1 to F.3 and state their respective arguments. The base initialization set (Equation (23)) we consider is

I 1 ( ϵ ) (Definition 3) was defined as

for η 1 ,δ 1 of Remark 1. I 3 ( ˜ r ( µ 1 ) 4 ) (Definition 10) was defined as

2

for ˜ r ( · ) and µ 1 of Corollaries 4 and 7 respectively. I 4 ( µ 1 ) (Definition 11) was defined as

I 5 ( δ 2 , η 2 ,δ 2 ) (Definition 12) was defined as

for η 2 ,δ 2 of Lemma 20. We begin by observing the following simplication:

since the right hand side is monotonically decreasing in ζ and since ζ 2 > ζ j for any j ∈ { 3 , . . . d } . Next, we also require that 1 2 ≥ ζ 3 . Note that this requirement satisfies the requirement of I 3 on the magnitude of ζ d (since ζ 3 > ζ 4 > · · · > ζ d ). Moreover, note that I 3 and I 4 impose upper bounds on α which are not related to ζ 2 , . . . , ζ d . Therefore, there exists some α ∗ > 0 such that if α ∈ (0 , α ∗ ) then all of these conditions are satisfied. Moving on to the conditions that involve α and ζ 2 we first observe that there exists constants S, T > 0 such that

is equivalent to the condition from I 1 and

is equivalent to the condition from I 5 . Invoking Lemma 36 we obtain that there exist constants q 1 , w 1 ∈ (0 , 1) and q 2 , w 2 ∈ ( 1 2 , 1) such that taking α ∈ ( q 1 , w 1 ) and ζ 2 ∈ ( q 2 , w 2 ) satisfies the two conditions involving α and ζ 2 . The above discussion is summarized in the following proposition.

Proposition 19. For any ϵ > 0 there exist constants q 1 , w 1 ∈ (0 , 1) and q 2 , w 2 ∈ ( 1 2 , 1) such that the set

is contained in the intersection of initialization subsets given by

Now that we have characterized a set of initializations which satisfy all our requirements, we will show that this set contains an open subset.

Lemma 21. The set of initializations satisfying all our requirements, namely

contains an open set, namely a set of the form ( a 1 , b 1 ) × ( a 2 , b 2 ) ×··· × ( a d , b d ) .

Proof. We begin by restricting ζ 3 , . . . , ζ d by requiring that for 3 ≤ j ≤ d , ζ j ∈ [ e j , f j ] where the closed intervals { [ e j , f j ] } 2 ≤ j ≤ d satisfy

We can restrict α further, by requiring that α ∈ ( a 1 , b 1 ) , where a 1 , b 1 are chosen such that for all 2 ≤ j ≤ d we have

We now claim that for all 2 ≤ j ≤ d

Indeed, for any α ∈ ( a 1 , b 1 ) we have b 1 e j > αe j and a 1 f j < αf j . It follows that we can take a j = b 1 e j , b j = a 1 f j and obtain that the set ( a 1 , b 1 ) × ( a 2 , b 2 ) ×··· × ( a d , b d ) is contained within

as required.

G Proof of Theorem 2

The first part of the Theorem is a special case of Proposition 2. We present below the proof for the second part.

For k ∈ N and A ∈ R d,d , we denote by Gen k ( A ) the generalization error over sequence length k (Definition 1). Note that B and C are omitted from this notation, as they are fixed to the values B = 1 , C = 1 ⊤ throughout the proof. With slight abuse of notation, we also denote ℓ S ( A ) := ℓ S ( A,B,C ) .

Our proofs considers an augmented objective, given for the training set S ′′ obtained by scaling all sequences by 1 c :

Since SSMs realize linear mappings, for any A ∈ R d,d we have that

We prove the required statement for the gradient flow dynamics (Equation (4)) obtained for the set S ′′ , from which it follow that it also holds when we revert back to the set S ′ , since the two systems of ODEs differ only by a positive scale.

First, consider the objective when the training set consists solely of the sequence

The corresponding training loss (Equation (3)) is given by

and the corresponding gradient flow dynamics (Equation (4)) for τ ∈ R ≥ 0 are given by

For any initialization of the student SSM A 0 = ( α 1 , . . . , α d ) , it is straightforward to show that the solution to the above system of ODEs A ( τ ) is given by

Specifically, as τ →∞ the solution A ( τ ) converges exponentially fast to the point ˜ A 0 given by

which satisfies

Consider the open set I of initializations for the student SSM given by

Note that for any ϵ > 0 , the corresponding set of initializations from Proposition 2 and the set I intersect, and moreover the intersection contains an open set sufficient for our needs. We next prove that for any initialization A 0 = ( α 1 , . . . , α d ) ∈ I , the point ˜ A 0 that the system converges to as τ →∞ satisfies Gen k ( ˜ A 0 ) > 1 -4 d . For any index i ∈ [ d ] it holds that

The latter implies that which results in

Overall, since d ≥ 5 and k ≥ 3 we obtain that

By the continuity of ℓ { ( e κ -1 , 1) } ( A ) and Gen k ( A ) , the above implies that for any initialization A 0 ∈ I there exists a time t ∈ R > 0 such that when initializing at A (0) = A 0 and evolving A ( τ ) according to the above dynamics it holds that

Now consider the objective for the full set S ′′

and

whose corresponding gradient flow dynamics (Equation (4)) for τ ∈ R ≥ 0 are given by

Observe that the left terms of both the objective and the dynamics all vanish as c →∞ . Additionally, note that when the left terms of the dynamics vanish, the dynamics differ by a positive scale from those discussed above when the training set consists solely of the sequence ( e κ -1 , 1) . Therefore by continuity, for any initialization A 0 ∈ I and any time t ′ ∈ R > 0 there exists c ∈ R > 0 such that when initializing A (0) = A 0 = A ′ (0) , evolving A ( τ ) according to the dynamics given when the left terms vanish, and evolving A ′ ( τ ) according to the full dynamics, it holds that ∥ A ( t ′ ) -A ′ ( t ′ ) ∥ 2 is sufficiently small to ensure that both

The proof follows by invoking the last claim for the time t obtained previously.

H Auxiliary Theorems and Lemmas

In this section we provide additional Theorems and Lemmas used throughout our proofs.

Lemma 22. Let f : R d → R be some differentiable function. Suppose we optimize over f by initializing x (0) := x 0 for some x 0 ∈ R d and updating using gradient flow, i.e.:

Then the objective is non-increasing w.r.t time, i.e. for any t ≥ 0 it holds that

Proof. Applying the chain rule, we obtain the following:

Lemma 23. Let f : R d → R be some continuously differentiable function, which is also coercive, namely

Suppose we optimize over f by initializing x (0) := x 0 for some x 0 ∈ R d and updating using gradient flow, i.e.:

Then there exists a global solution to the above ODE, namely a curve x ( t ) which satisfies the above equation for all t ≥ 0 .

Proof. By Lemma 22 and the coercivity of f , the trajectories of gradient flow cannot escape from some compact set K := K ( x 0 ) . Because f is continuously differentiable ∇ f has some finite Lipschitz constant on K . Existence of the solution for all t ≥ 0 now follows from the Picard-Lindelöf theorem (see [80]).

Theorem 4. Let V ⊆ R d be an open set. Let f : V → R be a non-negative differentiable function satisfying the following conditions:

and

The set X ∗ := { x ∈ V : f ( x ) = 0 } is not empty.

There exists µ > 0 such that for any x ∈ V it holds that

There exists M > 0 such that ∇ f ( x ) is M -Lipschitz in V .

Suppose we optimize over f by initializing x (0) := x 0 for some x 0 ∈ V and evolving via gradient flow, i.e. via the update rule

Assume the set V is not escaped, i.e. for any time t ≥ 0 it holds that x ( t ) ∈ V . Then it holds that

Proof. The theorem is a restatement of theorem 9 in [29].

Definition 13. Let V ⊆ R d be an open set. Let f : V → R be a differentiable function. We say that f satisfies the Polyak-Lojasiewicz condition with coefficient µ > 0 at x ∈ V

If the above holds for all x ∈ V we say that f satisfies the PL condition in V .

Lemma 24. Let V ⊆ R d be an open set. Let f : V → R be a non-negative differentiable function satisfying the following conditions:

The set x ∗ := { x ∈ V : f ( x ) = 0 } is not empty.

PL condition (Definition 13) - there exists µ > 0 such that for any x ∈ V it holds that

Suppose we optimize over f by initializing x (0) := x 0 for some x 0 ∈ V and evolving via gradient flow, i.e. via the update rule

Assume the set V is not escaped, i.e. for any time t ≥ 0 it holds that x ( t ) ∈ V . Then for any t ≥ 0 it holds that

Proof. Let t ≥ 0 . By the chain rule, it holds that

By the PL condition and since V is not escaped, we have that

Therefore, by Grönwall's inequality [21] we have that

Taking the limit as t →∞ completes the proof.

Namely, it holds that

Lemma 25. Let V ⊆ R d be an open set. Let f : V → R be a non-negative differentiable function satisfying the following conditions:

The set X ∗ := { x ∈ V : f ( x ) = 0 } is not empty.

f satisfies the PL condition with coefficient µ > 0 (see Definition 13).

Lipschitz gradient - there exists M > 0 such that ∇ f ( x ) is M -Lipschitz in V .

Suppose we optimize over f by initializing x (0) := x 0 for some x 0 ∈ V and evolving via gradient flow, i.e. via the update rule

Assume the set V is not escaped, i.e. for any time t ≥ 0 it holds that x ( t ) ∈ V . Then the limit lim t →∞ x ( t ) = x ∗ exists and satisfies f ( x ∗ ) = 0 and

Proof. Let ϵ > 0 . By theorem 4, it holds that

which is finite since X ∗ is not empty. Hence, there exists t ∗ ≥ 0 such that for any t ≥ t ∗ it holds that

Therefore, for any t 2 ≥ t 1 ≥ t ∗ it holds by the fundamental theorem of calculus and by the triangle inequality that

Thus, the Cauchy convergence criterion is met and so the limit lim t →∞ x ( t ) = x ∗ exists. Plugging f 's continuity and lemma 24 yields the following

Finally, by continuity and by the triangle inequality it holds that

as required.

Lemma 26. Let a, b ∈ R . An eigendecomposition of the matrix ( a -b ) I d + b 1 d,d , where 1 d,d is the d, d all ones matrix, is the following:

The eigenvector 1 with the eigenvalue a +( d -1) b .

For j ∈ { 2 , . . . , d } the eigenvector e 1 -e j with the eigenvalue a -b .

Proof. First, it holds that

hence 1 is an eigenvector with the eigenvalue a +( d -1) b . Next, note that for any j ∈ { 2 , . . . , d } we have

hence e 1 -e j is an eigenvector with the eigenvalue a -b . Finally, note that the set { 1 , e 1 -e 2 , . . . , e 1 -e d } is linearly independent and thus spans R d . Therefore, the above eigenvectors and eigenvalues constitute and eigendecomposition of ( a -b ) I d + b 1 d,d .

Lemma 27. Let W ∈ R d,d be a symmetric matrix and b ∈ R d be a vector. The solution of the linear dynamical system

is given by

where W = Q Λ Q ⊤ is any orthogonal eigendecomposition of W .

Proof. Using the change of variables z ( t ) = y ( t ) -b , the given system simplifies to

Reversing the change of variables and reorganizing yields

Let W = Q Λ Q ⊤ be an orthogonal eigendecomposition of the symmetric W . Then we have by the definition of matrix exponential that

whose solution is given by as required.

Lemma 28. Let x 0 ∈ R d . Let V 1 , U 1 ⊆ R d be neighborhoods of x 0 . Let H : V 1 → U 1 be a C 3 diffeomorphism. There exists r > 0 such that for any r 1 ∈ (0 , r ] there exist r 2 ∈ (0 , r 1 ) and r 3 > 0 for which

H [ B r 2 ( s )] ⊆ B r 3 ( s ) ⊆ H [ B r 1 ( s )] .

H | B r 1 ( s ) is Lipschitz.

H -1 | B r 3 ( s ) is Lipschitz.

Proof. V 1 and U 1 are neighborhoods of x 0 and so there exist r ′ , r ′′ > 0 for which B r ′ ( x 0 ) ⊆ V 1 and B r ′′ ( x 0 ) =: U 2 ⊆ U 1 . Hence, by H 's continuity there exists some small enough r > 0 for which B r ( x 0 ) ⊆ V 1 is mapped by H to H [ B r ( x 0 )] ⊆ U 2 . Fix r 1 ∈ (0 , r ] . Then it holds that B r 1 ( x 0 ) satisfies

and is mapped by H to

Since B r 1 ( x 0 ) is a compact ball and since H is C 3 , we obtain that H is Lipschitz over B r 1 ( x 0 ) , i.e. H | B r 1 ( x 0 ) is Lipschitz. Similarly, we obtain that H -1 is Lipschitz over U 2 , i.e. H -1 | U 2 is Lipschitz. Therefore since H [ B r 1 ( x 0 )] ⊆ U 2 we obtain that H -1 | H [ B r 1 ( x 0 )] is Lipschitz. Next, note that for any r 2 ∈ (0 , r 1 ) the compact ball B r 2 ( x 0 ) satisfies H [ B r 2 ( x 0 )] ⊆ H [ B r 1 ( x 0 )] . Hence, by taking a small enough r 2 we can guarantee by H 's continuity that there exists some r 3 > 0 for which B r 3 ( x 0 ) satisfies

Since H -1 | H [ B r 1 ( x 0 )] is Lipschitz and B r 3 ( x 0 ) ⊆ H [ B r 1 ( x 0 )] we obtain that H -1 | B r 3 ( x 0 ) is Lipschitz.

Lemma 29. Let f : R d → R d be a vector field and let B ⊆ R d be a bounded and compact space. Suppose f is N -Lipschitz within B for some constant N > 0 . Consider the following system of ODEs:

Consider two initialization points x 1 (0) , x 2 (0) ∈ B . Suppose we evolve x 1 ( t ) , x 2 ( t ) according to the above system. If for any t ≥ 0 it holds that x 1 ( t ) , x 2 ( t ) ∈ B , then

Proof. Let t ≥ 0 . Applying the chain rule, we obtain the following:

Thus, applying the Cauchy Schwarz inequality we obtain

f is N -Lipschitz within B , and so since x 1 ( t ) , x 2 ( t ) ∈ B we obtain

Finally, plugging Grönwall's inequality [21] results in

Next, consider the following system of ODEs which we coin the reversal of f :

Consider the initialization points x 1 (0) = x 1 ( t ) and x 2 (0) = x 2 ( t ) . Suppose we evolve x 1 ( t ) , x 2 ( t ) according to the reversal of f . Then it holds that for any time t ∈ [0 , t ] and any i ∈ [2] we have

hence x i ( t ) ∈ B . As Lipschitz continuity is invariant to sign, -f is N -Lipschitz within B . Therefore, we can apply the above claim on the reversal of f , and obtain that

The proof concludes by rearranging of the left and right hand side.

Lemma 30. Let f : R d → R d be a Lipschitz continuous vector field. Consider the following system of ODEs:

Consider two initialization points x 1 (0) , x 2 (0) ∈ R d . Suppose we evolve x 1 ( t ) , x 2 ( t ) according to the above system. If x 1 (0) = x 2 (0) then for any t ∈ R it holds that x 1 ( t ) = x 2 ( t ) .

̸

̸

Proof. The argument follows from the Picard-Lindelöf existence and uniqueness theorem, which states that for a given initialization x (0) , there exists a unique solution x ( t ) to the ODE system

where v ∈ W 2 is a unit vector. There exist i, j ∈ [ d ] such that

Proof. Denote v 's representation with the basis vectors of W 2 to be

where λ 2 , . . . , λ d ∈ R . Denote Λ := ( λ 2 , . . . , λ d ) ⊤ ∈ R d -1 . As v is a unit vector, it holds that

Hence,

Applying the Cauchy-Schwartz inequality we obtain the following:

Therefore, we obtain that

Therefore, there exists i ∗ ∈ { 2 , . . . , d } for which λ 2 i ∗ ≥ 1 d ( d -1) and thus | λ i ∗ | ≥ 1 √ d ( d -1) . If there exists j ∈ { 2 , . . . , d } for which λ j has a distinct sign than λ i ∗ , then it holds that

Otherwise, all entries of Λ share the same sign, and so it holds that for any j ∈ { 2 , . . . , d }

Therefore, there must exist i, j ∈ [ d ] for which | v i -v j | ≥ 1 √ d ( d -1) , resulting in the following:

Hence, we get that

Rearranging we obtain

which implies | x -1 | < ̂ b y , contradicting our assumption.

Lemma 32. Let f : R d → R be a differentiable function. Consider the gradient flow dynamics induced by f , namely:

initialized at some x 0 ∈ R d . Let t 1 < t 2 be times such that

for some c ≥ 0 and f satisfies the PL condition with some coefficient µ > 0 in { x ( t ) : t ∈ [ t 1 , t 2 ] } . Then

̸

Proposition 20. Let x, y ∈ [ -s, s ] for some s > 0 such that | x -y | ≥ b for some b > 0 . Then for any k ∈ N odd it holds that | x k -y k | ≥ ( b 2 ) k . Additionally, if y = 0 then | 1 -x k y k | ≥ ( b 2 s ) k .

Proof. Suppose WLOG that x ≥ y . By the triangle inequality it holds that max {| x | , | y |} ≥ b 2 . If x ≥ 0 ≥ y , then since k ∈ N odd it holds that

Now suppose that x, y ≥ 0 . Then we have that

̸

The case of x, y ≤ 0 is identical. As for the second inequality, If y = 0 , we get

Since y ∈ [ -s, s ] we get that | y k | ≤ s k and so

̸

Proposition 21. Let x, y, z ∈ R such that y, x.z = 0 , and let ̂ b > 0 . If | 1 -x y | ≥ ̂ b then either | 1 -x z | ≥ ̂ b ̂ b +2 or | 1 -y z | ≥ ̂ b ̂ b +2 .

Proof. Assume to the contrary that both | 1 -x z | < ̂ b ̂ b +2 and | 1 -y z | < ̂ b ̂ b +2 . This implies that

Proof. By the fundamental theorem for line integrals we have

applying the PL condition and Equation (24) we get the required result.

Lemma 33. Let g : R d → R be a continuous function and let r > 0 and let B be a compact set such that 0 ∈ B . For any ψ ≥ 0 denote the minimum value of g over Diff ( ψ ) ∩ B as

It holds that f is right side continuous in ψ = 0 .

Proof. Recalling the definition of Diff ( ψ ) (Equation (17)), we have that for any ψ ≥ 0 the set Diff ( ψ ) ∩ B is compact, thus f ( ψ ) is properly defined for any ψ ≥ 0 (as by continuity g attains a minimum over the set). Next, note that f is non-increasing since for any ψ 2 ≥ ψ 1 ≥ 0 it holds that

Let { ψ n } ∞ n =1 be a non-increasing sequence of non-negative reals for which

As f is non-increasing, the sequence { f ( ψ n ) } ∞ n =1 is monotonically non-decreasing and upper bounded by f (0) . Hence, the limit R := lim n →∞ f ( ψ n ) exists and satisfies R ≤ f (0) . For any ψ ≥ 0 we let x ψ be a minimizer of g over Diff ( ψ ) ∩ B , i.e.

The set B is compact and so the sequence { x ψ n } ∞ n =1 has a convergent subsequence { x ψ n k } ∞ k =1 . Denote its limit

Assume on the contrary that x ∗ ̸∈ Diff (0) . Hence by definition of Diff (0) it holds that

However, since lim n →∞ ψ n = 0 there exists ˜ k ∈ N such that for any k ∈ N such that k ≥ ˜ k it holds that ψ n k ≤ ˜ ψ 2 and thus

̸

This results in lim k →∞ x ψ n k = x ∗ in contradiction. Therefore we obtain x ∗ ∈ Diff (0) ∩ B . By g 's continuity and f 's definition we thus obtain the following

Per x ψ 's definition and since lim n →∞ f ( ψ n ) = R we also obtain

i.e. , R ≥ f (0) . Overall we obtain that R ≤ f (0) ≤ R , hence R = f (0) . The above result is satisfied for any sequence { ψ n } ∞ n =1 , hence lim ψ → 0 + f ( ψ ) = f (0) as required.

Lemma 34. Let f : R d → R d be a C 1 and Lipschitz vector field. Consider the system of ODEs given by

Consider two initialization points x 1 (0) , x 2 (0) ∈ R d . For any t ≥ 0 we use λ max ( t ) to denote the maximum over the line segment between x 1 ( t ) and x 2 ( t ) of the maximal eigenvalue of the Jacobian of f , i.e.

For any t ≥ 0 it holds that

̸

Proof. First note that since f is Lipschitz, λ max ( t ) is defined for any t ≥ 0 . Next, if x 1 (0) = x 2 (0) then the trajectories coincide and so the claim trivially follows. Suppose x 1 (0) = x 2 (0) . By definition, we have that

As f is C 1 , we obtain by the mean value theorem (see [68]) that there exists k ∈ [0 , 1] for which

Additionally, by the chain rule we also have

Plugging the above yields

The right term is bound by the Rayleigh quotient (see [32]), and so the above can be bound by

where the last inequality stems from λ max ( t ) 's definition. Dividing both sides by ∥ x 1 ( t ) -x 2 ( t ) ∥ 2 and integrating w.r.t time yields the following

Reorganizing the inequality and taking exponents yields

as required.

Lemma 35. Let f : R d → R be a continuous non-negative function with min x ∈ R d f ( x ) = 0 . Denote X ∗ := { x ∈ R d : f ( x ) = 0 } . Suppose that the 1 sub-level set of f defined as L 1 ( f ) := { x ∈ R d : f ( x ) ≤ 1 } is compact. Then for any δ > 0 there exists η > 0 such that for any x ∈ R d if f ( x ) ≤ η then Dist ( x , X ∗ ) ≤ δ .

Proof. Assume on the contrary that there exists δ > 0 such that for any ϵ > 0 there exists x η ∈ R d for which f ( x η ) ≤ δ and Dist ( x η , X ∗ ) > δ . Consider the sequence { x 1 n } ∞ n =1 . For any n ∈ N it holds that f ( x 1 n ) ≤ 1 n and Dist ( x 1 n , X ∗ ) > δ , therefore it holds that

The sub-level set L 1 ( f ) is compact and satisfies x 1 n ∈ L 1 ( f ) for any n ∈ N , hence the sequence { x 1 n } ∞ n =1 is bounded. Therefore, the sequence has a convergent subsequence { x 1 n k } ∞ k =1 with some limit x ∗ := lim k →∞ x n k . By f 's continuity we get that

i.e. , x ∗ ∈ X ∗ . This is a contradiction since all x 1 n must remain at distance at least δ from x ∗ on the one hand, and x 1 n k converges to x ∗ on the other hand.

Lemma 36. Let T, S > 0 , n ∈ N and x ∗ ∈ (0 , 1) . There exist q 1 , w 1 ∈ (0 , x ∗ ) and q 2 , w 2 ∈ ( 1 2 , 1) such that for any x ∈ ( q 1 , w 1 ) and y ∈ ( q 2 , w 2 ) it holds that

Proof. First note that since T > 0 , the first requirement is equivalent to having

and

Let y ∈ (0 , 1) . It holds that

Therefore, there exists y ′ ∈ (0 , 1) such that for any y ∈ [ y ′ , 1) it holds that

On the other hand, it also holds that

Hence, taking the limit as y → 1 -we obtain that

Therefore, there exists y ′′ ∈ (0 , 1) such that for any y ∈ [ y ′′ , 1) it holds that

and so 1 -y T < S y +1 2 ( 1 -( y +1 2 ) n ) 1 n . Thus, setting y ∗ = max { 1 2 , y ′ , y ′′ } we obtain that the interval ( 1 -y ∗ T , S y ∗ +1 2 ( 1 -( y ∗ +1 2 ) n ) 1 n ) is not empty and upper bounded by x ∗ . Additionally, for any y ∈ ( y ∗ , y ∗ +1 2 ) the following holds:

1

Hence the interval ( 1 -y ∗ T , S y ∗ +1 2 ( 1 -( y ∗ +1 2 ) n ) n ) is contained within the interval ( 1 -y T , S y (1 -( y n ) 1 n ) . Noting that y ∗ +1 2 < 1 , we complete the proof by setting

I Further Experimental Results

In this appendix we provide additional experimental results omitted from Section 4.

I.1 Dynamical Characterization

The experiments in Section 4.1 corroborate our dynamical characterization (Section 3.1) by demonstrating that greedy low rank learning of the state transition matrix A occurs under some, but not all, choices of training sequences. This appendix reports the following additional experiments.

Figure 3 extends the experiments reported in Figure 2 to longer training sequences.

Figures 4 to 6 include experiments similar to those in Figure 2, where the training sequences are labeled by teachers of higher dimensions.

Figures 7 and 8 report the results achieved with different random seeds in the settings of Figures 2 and 3, respectively.

A classical continuous surrogate for the matrix rank is the effective rank [67]. Figures 9 to 15 present the effective rank of the transition matrix A throughout optimization in the settings of Figures 2 to 8, respectively, underlining the low effective rank caused by greedy low rank learning.

Figures 16 to 19 report the values of γ (0) ( t ) (as defined in Proposition 1) observed during optimization in the settings of Figures 2, 3, 7, and 8, respectively, showcasing that larger absolute values of γ (0) ( t ) do not correspond to greedy low rank learning, whereas lower absolute values do.

and

0

2

4

6

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM,

with special sequences

0

2

4

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

without special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

with special sequences

0.0

2.5

5.0

7.5

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 6,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 6,

with special sequences

0

1

2

3

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 10,

without special sequences

0

1

2

3

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 10,

with special sequences

I.2 Synthetic Clean-Label Poisoning

The experiments in Table 1 corroborate the theoretical results of Section 3.2 by showcasing synthetic regimes in which SSMs are susceptible to clean-label poisoning. Table 3 supplements the experiments of Table 1 by including results in which the SSMs were trained on longer sequences. Tables 4 and 5 report the standard deviations of the quantities presented in Tables 1 and 3 respectively.

I.3 Real-World Clean-Label Poisoning

The experiments in Table 2 corroborate the theoretical results of Section 3.2 by demonstrating cleanlabel poisoning of SSM-based neural networks in real-world settings. Table 6 provides additional context to the experiments of Table 2 by reporting the training performance of the trained models, before and after the inclusion of cleanly labeled poisonous examples. Tables 7 and 8 report the standard deviations of the quantities presented in Tables 2 and 6 respectively.

J Implementation Details

We provide implementation details omitted from Section 4 and Appendix I. Code for reproducing our experiments can be found at https://github.com/YoniSlutzky98/imp-bias-ssm-poison .

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM length 6,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 6,

with special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 10,

without special sequences

0

1

2

3

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 10,

with special sequences

0

2

4

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM length 6,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 6,

with special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 10,

without special sequences

0

1

2

3

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM length 10,

with special sequences

J.1 Dynamical Characterization

In this appendix we provide implementation details for the experiments of Section 4.1 and Appendix I.1. All experiments were implemented using Keras [10] and carried out on a single Nvidia RTX 2080 Ti GPU.

J.1.1 Standalone SSM

Models. In the experiments reported in Figures 2, 3, 7, and 8 where a standalone SSM was trained, we used a teacher SSM of dimension d ∗ = 1 with parameters

All parameters of the student SSM ( i.e. , A , B and C ) were trained. We set the student SSM dimension to d = 10 for Figures 2 and 7 and to d = 20 for Figures 3 and 8.

Next, we detail the models used in the experiments with teachers of higher dimensions (Figures 4 to 6). In the experiments reported in Figure 4 we used a teacher SSM model of dimension 2 that was set with the parameters:

In the experiments reported in Figure 5 we used a teacher SSM model of dimension 3 that was set with the parameters

In the experiments reported in Figure 6 we used a teacher SSM model of dimension 3 that was set with the parameters

We used student SSM models whose input and output matrices B ( · ) and C ( · ) were fixed at 1 and 1 ⊤ respectively (due to computational limitations). The student models had dimension d = 10 in the

0

2

4

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM,

with special sequences

0.0

0.5

1.0

Iteration

×10 5

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

with special sequences

0.00

0.25

0.50

0.75

1.00

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Entry magnitude

SSM,

with special sequences

0

1

2

3

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

without special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

0.0

0.5

1.0

Entry magnitude

SSM + MLP,

with special sequences

experiments of shorter sequence length and dimension d = 20 in the experiments of longer sequence length.

Data. In all experiments we used the respective teachers to generate the labels for training sequences. Additionally, we used training sequences of one of two types, referred to as 'baseline' and 'special', where each type had designated indices of non-zero entries. Table 9 specifies which non-zero indices were present in each sequence type for each experiment. Training sequences of both types had their non-zero entries sampled i.i.d. from N (0 , 1) . Table 10 specifies how many training sequences of each type were used in each experiment.

Initialization. In all experiments we initialized the student's A , B and C parameter matrices in a manner that was inspired by the initialization set I of Theorem 1.

To initialize (the diagonal) A in each experiment we first sampled d i.i.d. entries from N (0 , sd_A ) , took their absolute values and then arranged them in descending order. Then, we set the second entry to have the first entry's value minus a constant diff . This was done to reflect the near zero initialization on the one hand and the proximity to the reference trajectory on the other hand. In the experiments reported in Figures 5 and 6 we naturally extended this procedure by setting the third entry to have the first entry's value minus 1 . 01 · diff in both experiments, and the fourth entry to have the first entry's value minus 1 . 05 · diff in the latter. Table 11 report the values of sd_A and diff used in each experiment.

To initialize B in each experiment we first sampled d i.i.d. entries from N (0 , sd_B_C ) , took their absolute values and then arranged them in descending order. Then, we set the second entry to have the first entry's value minus a constant diff . This was done to reflect the near zero initialization on the one hand and the proximity to the reference trajectory on the other hand. In the experiments reported in Figures 5 and 6 we naturally extended this procedure by setting the third entry to have the first entry's value minus 1 . 01 · diff in both experiments, and the fourth entry to have the first entry's value minus 1 . 05 · diff in the latter. To initialize C we followed the same procedure, without modifying the second to potentially fourth entries. Note that in the experiments reported in Figures 4 to 6 the input and output matrices B ( · ) and C ( · ) were not trained. Table 11 report the values of sd_B_C used in each experiment.

Optimization. In all of the experiments we trained using the empirical mean squared error as a loss function and optimized over full batches of the training sets. In order to facilitate more efficient experimentation in the experiments where a standalone SSM is trained, we optimized using gradient descent with an adaptive learning rate scheme, where at each iteration a base learning rate is divided by the square root of an exponential moving average of squared gradient norms (see appendix D.2 in Razin et al. [66] for more details). We used a weighted average coefficient of β = 0 . 8 and a softening constant of 10 -6 . Note that only the learning rate (step size) is affected by this scheme, not the direction of movement. Comparisons between the adaptive scheme and optimization with a fixed

0.0

0.5

1.0

1.5

Iteration

×10 4

0

2

4

6

Effective rank

SSM,

without special sequences

0

2

4

Iteration

×10 3

0

2

4

6

Effective rank

SSM,

with special sequences

0

1

2

Iteration

×10 4

0.0

2.5

5.0

7.5

Effective rank

SSM + MLP,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

Effective rank

SSM + MLP,

with special sequences

0

2

4

Iteration

×10 4

0

2

4

6

Effective rank

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

2.5

5.0

7.5

Effective rank

SSM,

with special sequences

0.0

0.5

1.0

Iteration

×10 5

0.0

2.5

5.0

7.5

Effective rank

SSM + MLP,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

Effective rank

SSM + MLP,

with special sequences

learning rate showed no significant difference in terms of the dynamics, while run times of the former were considerably shorter. Table 12 specifies the base learning rate used in each experiment.

J.1.2 SSM in a Non-Linear Neural Network

Models. In the experiments reported in Figures 2, 3, 7, and 8 where an SSM was trained as a part of a non-linear neural network, we used neural networks comprised of an SSM module whose output was fed to a 2 hidden layers MLP module. Overall, the models used realize the following function:

where d h ∈ N is the hidden MLP width, D in ∈ R d h , 1 , D hidden ∈ R d h ,d h and D out ∈ R 1 ,d h are the MLP's parameter matrices, σ ( x ) := max { 0 , x } is the MLP's activation function and ϕ A,B,C ( x ) is the output of an SSM with the parameter matrices A,B,C . All teacher models used had SSM modules of dimension d ∗ = 1 that were set with the parameters

The teacher models in Figures 2 and 7 had hidden MLP width of d ∗ h = 15 while the teacher models in Figures 3 and 8 had hidden MLP width of d ∗ h = 25 . In both cases, the teacher models had MLP modules that were set with the following parameter matrices:

We trained all of the SSM and MLP parameter matrices of our student models. The student models in Figures 2 and 7 had SSM dimension of d = 10 and hidden MLP width of d h = 15 , while the student models in Figures 3 and 8 had SSM dimension of d = 20 and hidden MLP width of d h = 25 .

Data. Data for the experiments were generated in the same manner as in Appendix J.1.1. Table 9 specifies which non-zero indices were present in each sequence type for each experiment. Training sequences of both types had their non-zero entries sampled i.i.d. from N (0 , 1) . Table 10 specifies how many training sequences of each type were used in each experiment.

Initialization. In all experiments we initialized the student's A , B and C parameter matrices identically to the standalone SSM experiments (Appendix J.1.1). Table 11 report the values of sd_A , sd_B_C and diff used in each experiment.

To initialize the MLP layers, we initialized all parameter matrices by sampling i.i.d. values from N (0 , sd_D ) . We used sd_D = 0 . 03 in the original experiments (Figures 2 and 7) and sd_D = 0 . 1 in the experiments with longer sequences (Figures 3 and 8).

0

2

4

6

Iteration

×10 3

0

5

10

15

Effective rank

SSM,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

15

Effective rank

SSM,

with special sequences

0

2

4

Iteration

×10 4

0

5

10

15

Effective rank

SSM + MLP,

without special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

0

10

20

Effective rank

SSM + MLP,

with special sequences

0.00

0.25

0.50

0.75

1.00

Iteration

×10 4

0

5

10

15

Effective rank

SSM,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

15

Effective rank

SSM,

with special sequences

0

1

2

3

Iteration

×10 4

0

5

10

15

Effective rank

SSM + MLP,

without special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

0

10

20

Effective rank

SSM + MLP,

with special sequences

Optimization. To speed up the optimization we trained using the default Keras implementation of Adam [36] with its default hyperparameters. Table 12 report the base learning rates used in each of the experiments.

J.2 Synthetic Clean-Label Poisoning

In this appendix we provide implementation details for the synthetic experiments provided in Section 4.2 and Appendix I.2. All experiments were implemented using Keras [10] and were carried out using a single Nvidia RTX 2080 Ti GPU.

J.2.1 SSM Per Theorem 1

The main goal of the experiments in the first poisoning setting (standalone SSM per Theorem 1) was to approximate the solution to the system of ODEs induced by gradient flow (Equation (4)) in order to demonstrate the results of Theorem 1. To do so we employed the use of the odeint function of SciPy [84] which is a numerical solver for systems of ODEs based on lsoda from the FORTRAN library odepack [31]. odeint 's arguments are the initial point in parameter space A (0) , the timestamps at which the solution is required, and a function which specifies the system by intaking a timestamp t and a point in parameter space A and outputting the derivative in time t at A . odeint outputs a set of numerical approximations for the solution of the system at the required timestamps.

Models. We use teacher and student models according to the setting described in Section 3.2. We used a teacher SSM of dimension d ∗ = 2 that was set with the parameters

We used student SSM models whose input and output matrices B ( · ) and C ( · ) were fixed at 1 and 1 ⊤ respectively. The student models had dimension d = 10 in the original poisoning experiments (Table 1), and dimension d = 20 when training over longer sequences (Table 3).

Data. In all experiments we used the respective teachers to generate the labels for all training sequences. Per Theorem 1, we trained using a single 'baseline' sequence of the form e 1 ∈ R κ and a single 'special' sequence of the form e κ -1 ∈ R κ . The relevant experiments reported in Tables 1 and 3 were trained using sequences of lengths 7 and 9 respectively.

Initialization. We initialized the student's diagonal matrix A in a manner that was inspired by the initialization set I of Theorem 1. In each experiment we first sampled d i.i.d. entries from N (0 , sd_A ) and then arranged them in descending order. We then set the second entry to have the first's value minus a constant diff . This was done to reflect the near zero initialization on the one hand and the

0.0

2.5

5.0

7.5

Iteration

×10 3

0.0

2.5

5.0

7.5

Effective rank

SSM length 6,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

Effective rank

SSM length 6,

with special sequences

0

1

2

3

Iteration

×10 3

0

5

10

15

Effective rank

SSM length 10,

without special sequences

0

1

2

3

4

Iteration

×10 3

0

10

20

Effective rank

SSM length 10,

with special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

0.0

2.5

5.0

7.5

Effective rank

SSM length 6,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

Effective rank

SSM length 6,

with special sequences

0

2

4

Iteration

×10 3

0

5

10

15

Effective rank

SSM length 10,

without special sequences

0

1

2

3

4

Iteration

×10 3

0

10

20

Effective rank

SSM length 10,

with special sequences

proximity to the reference trajectory on the other hand. Table 13 reports the values of sd_A and diff used in each experiment.

Optimization. We input odeint a custom function which computes -∇ ℓ S ( A ) (Equation (4)) given the point A to be used for derivative computations. Table 14 reports the timestamps simulated in each experiment. All experiments reached training loss values of less than 10 -5 and stable generalization errors.

Generalization evaluation. Generalization errors were measured via impulse responses of length 40 as defined in Definition 1, divided by the ℓ ∞ norm of the teacher's length 40 impulse response (such that the zero mapping has error of one). The same evaluation procedures were used in both the original experiments (Table 1) and in the longer experiments (Table 3).

J.2.2 SSM Beyond Theorem 1

Models. We used the same teacher models as described in Appendix J.1.1. We used student SSM models that were trained end to end ( i.e. B ( · ) and C ( · ) were not fixed). The student models had dimension d = 10 in the original poisoning experiments (Table 1), and dimension d = 20 in the experiments with longer sequences (Table 3).

Data. Data for the experiments were generated in the same manner as in Appendix J.1.1. Table 15 specifies which non-zero indices were present in each sequence type for each experiment. Training sequences of both types had their non-zero entries sampled i.i.d. from N (0 , 1) . Table 16 specifies how many training sequences of each type were used in each experiment.

Initialization. To speed up optimization we modified the initialized employed in Appendix J.1.1 by adding a small constant of 10 -1 to all entries of A and B at initialization. This modification showed no significant differences in terms of the generalization error achieved by the models when compared to without it, while run times of the former were considerably shorter. Table 17 report the values of sd_A , sd_B_C and diff used in each experiment.

Optimization. We followed a training scheme identical to Appendix J.1.1. Table 18 report the base learning rates used in each of the experiments.

We optimized all models to reach a training loss under 0 . 01 . To verify the generalization errors we report were stable, we trained for additional iterations after reaching sub 0 . 01 training loss. We trained the standalone SSM models for 1500 more iterations, and the models with additional layers for 5000 more iterations.

Generalization evaluation. Generalization errors were measured via impulse responses of length 40 as defined in Definition 1, divided by the ℓ ∞ norm of the teacher's length 40 impulse response

0

2

4

Iteration

×10 4

0.0

2.5

5.0

7.5

Effective rank

SSM length 6,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

Effective rank

SSM length 6,

with special sequences

0

2

4

Iteration

×10 3

0

5

10

15

Effective rank

SSM length 10,

without special sequences

0

1

2

3

4

Iteration

×10 3

0

10

20

Effective rank

SSM length 10,

with special sequences

0.0

0.5

1.0

1.5

Iteration

×10 4

0.05

0.00

0.05

Gamma magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Gamma magnitude

SSM,

with special sequences

0

1

2

Iteration

×10 4

0.05

0.00

0.05

Gamma magnitude

SSM + MLP,

without special sequences

0

2

4

Iteration

×10 3

2

0

2

4

Gamma magnitude

SSM + MLP,

with special sequences

(such that the zero mapping has error of one). The same evaluation procedures were used in both the original experiments (Table 1) and in the longer experiments (Table 3).

J.2.3 SSM in Non-Linear Neural Network

Models. We used the same teacher models as described in Appendix J.1.2. We used student SSM models that were trained end to end ( i.e. B ( · ) and C ( · ) were not fixed). The student models had dimension d = 10 in the original poisoning experiments (Table 1), and dimension d = 20 in the experiments with longer sequences (Table 3).

Data. The data used is identical to that of Appendix J.2.2. Table 16 specify how many training sequences of each type were used in each experiment.

Initialization. We initialized the student models identically to Appendix J.1.2. To speed up optimization we modified the initialized employed in Appendix J.1.2 by adding a small constant of 10 -3 to all entries of A and B at initialization. This modification showed no significant differences in terms of the generalization error achieved by the models when compared to without it, while run times of the former were considerably shorter. Table 17 report the values of sd_A , sd_B_C and diff used in each experiment.

Optimization. We followed a training scheme identical to Appendix J.1.2. Table 18 report the base learning rates used in each of the experiments.

We optimized all models to reach a training loss under 0 . 01 . To verify the generalization errors we report were stable, we trained for additional iterations after reaching sub 0 . 01 training loss. We trained the standalone SSM models for 1500 more iterations, and the models with additional layers for 5000 more iterations.

Generalization evaluation. Generalization errors were measured via the root mean square error of a held-out test set of 2000 correctly labeled sequences of length 40 , divided by the ℓ 2 norm of the teacher's outputs vector (such that the zero mapping has error of one). The same evaluation procedures were used in both the original experiments (Table 1) and in the longer experiments (Table 3).

J.3 Real-World Clean-Label Poisoning

In this appendix we provide implementation details for the real-world experiments provided in Section 4.2 and Appendix I.3. All experiments were implemented using PyTorch [60] and were carried out using a cluster of 8 Nvidia RTX A6000 GPUs. All experiments consist of three stages: (i)

0

2

4

Iteration

×10 4

0.05

0.00

0.05

Gamma magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.2

0.4

0.6

0.8

Gamma magnitude

SSM,

with special sequences

0.0

0.5

1.0

Iteration

×10 5

0.05

0.00

0.05

Gamma magnitude

SSM + MLP,

without special sequences

0

2

4

Iteration

×10 3

0

5

10

Gamma magnitude

SSM + MLP,

with special sequences

0

2

4

6

Iteration

×10 3

0.05

0.00

0.05

Gamma magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

1.5

2.0

Gamma magnitude

SSM,

with special sequences

0

2

4

Iteration

×10 4

0.05

0.00

0.05

Gamma magnitude

SSM + MLP,

without special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

20

0

20

40

Gamma magnitude

SSM + MLP,

with special sequences

training the attacked model from scratch on a set of 20000 randomly chosen CIFAR-10 train examples, (ii) generating poisonous noise added to a random subset of 10000 train examples using an adapted version of the Gradient Matching method [18] provided in https://github.com/JonasGeiping/ poisoning-gradient-matching , and (iii) retraining the model on the 30000 -examples poisoned train set consisting of the original 10000 examples used for poison generation in their clean form and in their poisoned form, as well as the remaining 10000 original examples. Due to computational limitations, the poison generation process was targeted to disrupt the classification of 3000 randomly chosen test instances, and the poisoning effect carried over to the entire CIFAR-10 test set.

To allow for poisoning of the entirety of the test set, we adapted the Gradient Matching method by strategically partitioning the poisoning budget-namely, 5000 examples were used to poison the 1000 correctly-classified test instances for which the original model's loss was the highest, and the remaining 5000 examples were used to poison the remaining 2000 test instances. Additionally, in order to make poisoning more precise we further split the poisoning examples into groups such that the noise trained for each group's examples targets 50 test instances and ignores the rest. Our adapted approach also included: (a) reshaping the CIFAR-10 image input into a compatible sequence format, (b) introducing regularization that encourages the last elements of an injected noise sequence to be relatively large 15 , and (c) using the untargeted-cross-entropy target criterion and a pbatch value of 500 . Apart from the above adaptations, all hyperparameters were kept at their default values.

The SSM-based S4 neural network adheres to the implementation provided in https://github. com/state-spaces/s4 , utilizing the 'minimalist S4' configuration available in s4d.py and s4.py . The SSM-based Mamba-2 neural network is an adaptation of the minimal implementation provided in https://github.com/tommyip/mamba2-minimal . The SSM-based LRU neural network is a python adaptation of the JAX-implementation provided in https://github.com/ NicolasZucchet/minimal-LRU . We trained all models using the AdamW optimizer and the CosineAnnealingLR scheduler over 100 epochs. To ensure the models before and after poisoning were comparable, we kept training the latter until reaching the training loss of the former (but no longer than 300 total epochs). Table 19 details the hyperparameters used for each of the models.

0.00

0.25

0.50

0.75

1.00

Iteration

×10 4

0.05

0.00

0.05

Gamma magnitude

SSM,

without special sequences

0

2

4

Iteration

×10 3

0.0

0.5

1.0

Gamma magnitude

SSM,

with special sequences

0

1

2

3

Iteration

×10 4

0.05

0.00

0.05

Gamma magnitude

SSM + MLP,

without special sequences

0.0

0.5

1.0

1.5

2.0

Iteration

×10 4

50

25

0

25

Gamma magnitude

SSM + MLP,

with special sequences

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper proves that a single, correctly-labeled “special” sequence can force a structured state-space model trained with gradient descent to memorize rather than generalize, revealing a provable clean-label poisoning vulnerability. It derives this result via a novel polynomial-ODE analysis of the training dynamics and corroborates it with S4 experiments on CIFAR-10 showing a >40× error spike when <12 % of the data are poisoned.\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n1. **Fills a theoretical gap** – extends clean-label poisoning theory to non-convex SSMs.  \n2. **Mechanistic insight** – ODE factorization offers an intuitive, entry-wise view of dynamics.  \n3. **Finite-sample realism** – avoids infinite-data assumptions of earlier implicit-bias work.  \n4. **Balanced analysis** – provides both success and failure results under the same framework.  \n5. **Concrete experiments** – ties theory to measurable failure on a real SSM benchmark.\n\n### Weaknesses \n- Low-dimensional teacher & diagonal \\(A\\) may not reflect practical high-dim/banded SSMs.  \n- Fixed \\(B,C\\) matrices – real models usually learn these.  \n- Near-zero initialization – differs from HiPPO/identity inits.  \n- Special input padding (trailing zeros) – unnatural for real data.  \n- Gradient-flow analysis – ignores discrete optimizers, momentum, Adam, etc.  \n- Experiments are small-scale; no language or large data regimes.\n\nQUESTIONS:\n### Questions for the Authors\n1. Does the attack persist under HiPPO or identity initializations?  \n2. What happens when \\(B,C\\) are learned with separate learning rates?  \n3. How does the phenomenon change with SGD + momentum or Adam?  \n4. Minimum poison fraction needed for million-sample datasets?  \n5. Can analogous “suffix-heavy” inputs poison language/audio tasks without trailing zeros?  \n6. Do weight decay or spectral-norm regularization mitigate the effect?  \n7. Are attention-plus-SSM hybrids (e.g., Mamba) equally vulnerable?  \n8. Could monitoring the low-rank signal \\(\\gamma^{(0)}(t)\\) act as an early-warning defense?\n\nLIMITATIONS:\nNA", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents an interesting theoretical study stating the susceptibility of clean-label poisoning in distilling structured state space models. The study starts by analyzing and stating the gradient flow convergence in Proposition.1, known as the analysis of dynamical characterization of SSM . Furthermore in Theorem.1, this study shows both bright and down side of distilling from a low-rank teacher model: training a student SSM with a low dimensional teacher SSM can improve implicit bias, which leads to generalization. However if we further add a training time series sample with its last entries carrying large norms, the distilled SSM may end up with being overfitted to the training data and show poor generalization performances.\n\nSTRENGTHS AND WEAKNESSES:\n**Strong points of this paper**\nThis paper presents a novel and interesting finding: distilled SSM can present poor generalization performances if teacher SSMs have a low-ranked structure, even though the training data samples used are free from poisoning. This study shows the generalization limitation of knowledge distillation in SSMs. I really appreciate the solid theoretical reasoning step by step presented in this paper. \n\n**Weakness of this paper**\n\nIt seems this paper focuses on exclusively on SSMs. I don't know if the conclusion made in this paper can be also applied to other model architectures like transformers (probably it can, but needs further discussions). This, somehow, may limit the practical impact of this work.\nFurthermore, I'd be curious, if the findings unveiled in this paper can be also used to improve the generalization performance. For example, what should we do to ensure the generalization capability of distilled model? Do we need to choose a high-rank teacher or we need to check the training data samples for distillation?\n\nQUESTIONS:\nPlease discuss if the findings can be used over other model architectures like SSM. Please also provide discussions about how the findings can be used to improve generalization performances.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-02"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper prove that while implicit bias leads to generalization under many choices of training data, there exist special examples whose inclusion in training completely distorts the implicit bias, to a point where generalization fails.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1) This paper proposes a formal proof of clean-label poisoning in SSMs, extending the understanding of implicit bias in overparameterized models.\n2) The use of advanced tools such as the non-resonance linearization theorem brings fresh insights into training dynamics.\n3) The dynamical characterization of gradient flow for SSMs is carefully derived and shows under what conditions greedy low-rank learning occurs.\n4) Theorems clearly illustrate the existence of cases where adding cleanly labeled sequences induces severe generalization failures.\n5) Experiments range from controlled synthetic setups to real-world settings (e.g., CIFAR-10 with S4 models), confirming the theoretical claims.\n\nWeaknesses and Suggestions:\n1) While theoretically elegant, it is not always clear how easily an attacker could craft or inject sequences with the required properties in practice. I suggest including more concrete examples or algorithmic procedures to illustrate the feasibility and cost of such attacks in realistic scenarios.\n\n2) While the experiments are diverse, most are conducted with small SSM dimensions and short sequence lengths due to computational challenges. It remains unclear whether the observed phenomena would persist in large-scale SSMs used for long-context language modeling. \nI understand the author said \"due to vanishing gradients, maintaining reasonable run-times in experiments with near-zero initialization necessitated a relatively small scale (in terms of, e.g., SSM dimension and training sequence length). Addressing these limitations is an important set of directions for future work.\"  I suggest add some experiments using other initialization methods to experiment on large-scale SSMs.\n\n3) Although the paper establishes the existence of clean-label poisoning vulnerabilities, it does not propose mitigation strategies or even partial defenses. For practitioners, it is unclear what safeguards could be applied to SSM training pipelines.\nInclude at least a short discussion of potential countermeasures or research directions for making SSMs more robust in practice.\n\nQUESTIONS:\nSee Strengths And Weaknesses*\n\nLIMITATIONS:\nSee Strengths And Weaknesses*", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-13"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe highlights a challenge in the generalization of an SSM model. The paper demonstrates that the conventional argument of SSM can be generalized, and that implicit bias can be challenged, while also illustrating how clean label poisoning can compromise the model's generalization capabilities. The paper's conclusions are supported by rigorous theoretical analysis.\n\nSTRENGTHS AND WEAKNESSES:\nStrength:\n\n1. The paper provides a detailed theoretical analysis behind each of the hypotheses and backs them with proofs.\n2. This is the first work to highlight an essential problem of SSM by successfully showing a clean-label poisoning attack on SSM.\n3. The proposed method, backed by each theorem, is novel. A non-resonant linearization theorem yields two critical observations that facilitate the successful creation of a clean label poisoning attack.\n\nWeakness:\n\n1. While the paper is theoretically solid, it indeed has several experimental limitations. I appreciate the author being upfront about the scope of the work being limited; however, without further experimental validation, it is challenging to thoroughly stress-test the proposed theoretical analysis. \n\n2. Two core challenges to the generalization of the proposed method, which the authors have not mentioned, are the choice of architecture and dataset. The evaluation is only conducted on one architecture and one dataset. The experimental setting is minimal. Why not evaluate on a few state space models to show the conclusion holds true across the board, such as Mambas?\n\n3. Even with the current choice, there is no rationale behind the options presented in the result section. First, why only the SSM-S4 model? Second, in Table 2, why are only 10/20 instances being attacked? What is the challenge in attacking all the test samples, similar to any conventional adversarial attack evaluation? Also, this is not a standard way to present results. It is very confusing to look at Table 2 and see the fourth column accuracy without poison to be that low. It takes a lot of work on the reader's part to understand that these are accuracies only on the # of test samples. Furthermore, the actual accuracy of the model is not at all reported in the paper. I would appreciate more results with clarity in the presentation.\n\nQUESTIONS:\nPlease refer to the weakness section.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 1, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-18"}