Original: S CALING THE C ONVEX B ARRIER WITH A CTIVE S ETS
Revised: S CALING THE C ONVEX B ARRIER WITH A CTIVE S ETS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Tight and efﬁcient neural network bounding is of critical importance for the scaling of neural network veriﬁcation systems.
Revised: Tight and efﬁcient neural network bounding is of critical importance for the scaling of neural network veriﬁcation systems.

Original: A number of efﬁcient specialised dual solvers for neural network bounds have been presented recently, but they are often too loose to verify more challenging properties.
Revised: A number of efﬁcient specialised dual solvers for neural network bounds have been presented recently, but they are often too loose to verify more challenging properties.

Original: This lack of tightness is linked to the weakness of the employed relaxation, which is usually a linear program of size linear in the number of neurons.
Revised: This lack of tightness is linked to the weakness of the employed relaxation, which is usually a linear program of size linear in the number of neurons.

Original: While a tighter linear relaxation for piecewise linear activations exists, it comes at the cost of exponentially many constraints and thus currently lacks an efﬁcient customised solver.
Revised: While a tighter linear relaxation for piecewise linear activations exists, it comes at the cost of exponentially many constraints and thus currently lacks an efﬁcient customised solver.

Original: We alleviate this deﬁciency via a novel dual algorithm that realises the full potential of the new relaxation by operating on a small active set of dual variables.
Revised: We alleviate this deﬁciency via a novel dual algorithm that realises the full potential of the new relaxation by operating on a small active set of dual variables.

Original: Our method recovers the strengths of the new relaxation in the dual space: tightness and a linear separation oracle.
Revised: Our method recovers the strengths of the new relaxation in the dual space: tightness and a linear separation oracle.

Original: At the same time, it shares the beneﬁts of previous dual approaches for weaker relaxations: massive parallelism, GPU implementation, low cost per iteration and valid bounds at any time.
Revised: At the same time, it shares the beneﬁts of previous dual approaches for weaker relaxations: massive parallelism, GPU implementation, low cost per iteration and valid bounds at any time.

Original: As a consequence, we obtain better bounds than off-the-shelf solvers in only a fraction of their running time and recover the speed-accuracy trade-offs of looser dual solvers if the computational budget is small.
Revised: As a consequence, we obtain better bounds than off-the-shelf solvers in only a fraction of their running time and recover the speed-accuracy trade-offs of looser dual solvers if the computational budget is small.

Original: We demonstrate that this results in signiﬁcant formal veriﬁcation speed-ups.
Revised: We demonstrate that this results in signiﬁcant formal veriﬁcation speed-ups.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Veriﬁcation requires formally proving or disproving that a given property of a neural network holds over all inputs in a speciﬁed domain.
Revised: Veriﬁcation requires formally proving or disproving that a given property of a neural network holds over all inputs in a speciﬁed domain.

Original: We consider properties in their canonical form (Bunel et al., 2018), which requires us to either: (i) prove that no input results in a negative output (property is true); or (ii) identify a counter-example (property is false).
Revised: We consider properties in their canonical form (Bunel et al., 2018), which requires us to either: (i) prove that no input results in a negative output (property is true); or (ii) identify a counter-example (property is false).

Original: The search for counter-examples is typically performed by efﬁcient methods such as random sampling of the input domain (Webb et al., 2019), or projected gradient descent (Carlini & Wagner, 2017).
Revised: The search for counter-examples is typically performed by efﬁcient methods such as random sampling of the input domain (Webb et al., 2019), or projected gradient descent (Carlini & Wagner, 2017).

Original: In contrast, establishing the veracity of a property requires solving a suitable convex relaxation to obtain a lower bound on the minimum output.
Revised: In contrast, establishing the veracity of a property requires solving a suitable convex relaxation to obtain a lower bound on the minimum output.

Original: If the lower bound is positive, the given property is true.
Revised: If the lower bound is positive, the given property is true.

Original: If the bound is negative and no counter-example is found, either: (i) we make no conclusions regarding the property (incomplete veriﬁcation); or (ii) we further reﬁne the counter-example search and lower bound computation within a branch-and-bound framework until we reach a concrete conclusion (complete veriﬁcation).
Revised: If the bound is negative and no counter-example is found, either: (i) we make no conclusions regarding the property (incomplete veriﬁcation); or (ii) we further reﬁne the counter-example search and lower bound computation within a branch-and-bound framework until we reach a concrete conclusion (complete veriﬁcation).

Original: The main bottleneck of branch and bound is the computation of the lower bound for each node of the enumeration tree via convex optimization.
Revised: The main bottleneck of branch and bound is the computation of the lower bound for each node of the enumeration tree via convex optimization.

Original: While earlier works relied on off-the-shelf solvers (Ehlers, 2017; Bunel et al., 2018), it was quickly established that such an approach does not scale-up elegantly with the size of the neural network.
Revised: While earlier works relied on off-the-shelf solvers (Ehlers, 2017; Bunel et al., 2018), it was quickly established that such an approach does not scale-up elegantly with the size of the neural network.

Original: This has motivated researchers to design specialized dual solvers (Dvijotham et al., 2019; Bunel et al., 2020a), thereby providing initial evidence that veriﬁcation can be realised in practice.
Revised: This has motivated researchers to design specialized dual solvers (Dvijotham et al., 2019; Bunel et al., 2020a), thereby providing initial evidence that veriﬁcation can be realised in practice.

Original: However, the convex relaxation considered in the dual solvers is itself very weak (Ehlers, 2017), hitting what is now commonly referred to as the “convex barrier” (Salman et al., 2019).
Revised: However, the convex relaxation considered in the dual solvers is itself very weak (Ehlers, 2017), hitting what is now commonly referred to as the “convex barrier” (Salman et al., 2019).

Original: In practice, this implies that either several properties remain undecided in incomplete veriﬁcation, or take several hours to be veriﬁed exactly.
Revised: In practice, this implies that either several properties remain undecided in incomplete veriﬁcation, or take several hours to be veriﬁed exactly.

Original: Multiple works have tried to overcome the convex barrier for piecewise linear activations (Raghunathan et al., 2018; Singh et al., 2019).
Revised: Multiple works have tried to overcome the convex barrier for piecewise linear activations (Raghunathan et al., 2018; Singh et al., 2019).

Original: Here, we focus on the single-neuron Linear Programming (LP) relaxation by Anderson et al.
Revised: Here, we focus on the single-neuron Linear Programming (LP) relaxation by Anderson et al.

Original: Unfortunately, its tightness comes at the price of exponentially many (in the number of variables) constraints.
Revised: Unfortunately, its tightness comes at the price of exponentially many (in the number of variables) constraints.

Original: Therefore, existing dual solvers (Dvijotham et al., 2018; Bunel et al., 2020a) are not easily applicable, limiting the scaling of the new relaxation.
Revised: Therefore, existing dual solvers (Dvijotham et al., 2018; Bunel et al., 2020a) are not easily applicable, limiting the scaling of the new relaxation.

Original: We address this problem by presenting a specialized dual solver for the relaxation by Anderson et al.
Revised: We address this problem by presenting a specialized dual solver for the relaxation by Anderson et al.

Original: (2020), which realises its full potential by meeting the following desiderata:
Revised: (2020), which realises its full potential by meeting the following desiderata:

Original: • By keeping an active set of dual variables, we obtain a sparse dual solver
Revised: • By keeping an active set of dual variables, we obtain a sparse dual solver

Original: that recovers the strengths of the original primal problem (Anderson et al., 2020) in the dual domain.
Revised: that recovers the strengths of the original primal problem (Anderson et al., 2020) in the dual domain.

Original: In line with
Revised: In line with

Original: previous dual solvers, our approach yields valid bounds at anytime, leverages convolutional network structure and enjoys massive parallelism within a GPU implementation, resulting in better bounds in an order of magnitude less time than off-the-shelf solvers (Gurobi Optimization, 2020).
Revised: previous dual solvers, our approach yields valid bounds at anytime, leverages convolutional network structure and enjoys massive parallelism within a GPU implementation, resulting in better bounds in an order of magnitude less time than off-the-shelf solvers (Gurobi Optimization, 2020).

Original: • We present a uniﬁed dual treatment that includes both a linearly sized LP relaxation (Ehlers, 2017) and the tighter formulation.
Revised: • We present a uniﬁed dual treatment that includes both a linearly sized LP relaxation (Ehlers, 2017) and the tighter formulation.

Original: As a consequence, our solver provides a wide range of speedaccuracy trade-offs : (i) it is competitive with dual approaches on the looser relaxation (Dvijotham et al., 2018; Bunel et al., 2020a); and (ii) it yields much tighter bounds if a larger computational budget is available.
Revised: As a consequence, our solver provides a wide range of speedaccuracy trade-offs : (i) it is competitive with dual approaches on the looser relaxation (Dvijotham et al., 2018; Bunel et al., 2020a); and (ii) it yields much tighter bounds if a larger computational budget is available.

Original: Owing to this ﬂexibility, we show that our dual algorithm yields large complete veriﬁcation gains compared to primal approaches (Anderson et al., 2020) and previous dual algorithms.
Revised: Owing to this ﬂexibility, we show that our dual algorithm yields large complete veriﬁcation gains compared to primal approaches (Anderson et al., 2020) and previous dual algorithms.

Original:  P RELIMINARIES : N EURAL N ETWORK R ELAXATIONS
Revised:  P RELIMINARIES : N EURAL N ETWORK R ELAXATIONS

Original: We denote vectors by bold lower case letters (for example, x ) and matrices by upper case letters (for example, W ).
Revised: We denote vectors by bold lower case letters (for example, x ) and matrices by upper case letters (for example, W ).

Original: We use (cid:12) for the Hadamard product, (cid:74) · (cid:75) for integer ranges, 1 a for the indicator vector on condition a and brackets for intervals ( [ l k , u k ] ) and vector or matrix entries ( x [ i ] or W [ i, j ] ).
Revised: We use (cid:12) for the Hadamard product, (cid:74) · (cid:75) for integer ranges, 1 a for the indicator vector on condition a and brackets for intervals ( [ l k , u k ] ) and vector or matrix entries ( x [ i ] or W [ i, j ] ).

Original: Let C be the network input domain.
Revised: Let C be the network input domain.

Original: Similar to Dvijotham et al.
Revised: Similar to Dvijotham et al.

Original: ; Bunel et al.
Revised: ; Bunel et al.

Original: (2020a), we assume that linear minimisation over C can be performed in closed-form.
Revised: (2020a), we assume that linear minimisation over C can be performed in closed-form.

Original: Our goal is to compute bounds on the scalar output of a piecewise-linear feedforward neural network.
Revised: Our goal is to compute bounds on the scalar output of a piecewise-linear feedforward neural network.

Original: The tightest possible lower bound can be obtained by solving the following optimization problem:
Revised: The tightest possible lower bound can be obtained by solving the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: where the activation function σ ( ˆx k ) is piecewise-linear, ˆx k , x k ∈ R n k denote the outputs of the kth linear layer (fully-connected or convolutional) and activation function respectively, W k and b k denote its weight matrix and bias, n k is the number of activations at layer k. We will focus on the ReLU case ( σ ( x ) =
Revised: where the activation function σ ( ˆx k ) is piecewise-linear, ˆx k , x k ∈ R n k denote the outputs of the kth linear layer (fully-connected or convolutional) and activation function respectively, W k and b k denote its weight matrix and bias, n k is the number of activations at layer k. We will focus on the ReLU case ( σ ( x ) =

Original: max ( x , 0) ), as common piecewise-linear functions can be expressed as a composition of ReLUs (Bunel et al., 2020b).
Revised: max ( x , 0) ), as common piecewise-linear functions can be expressed as a composition of ReLUs (Bunel et al., 2020b).

Original: Problem (1) is non-convex due to the activation function’s non-linearity (1c).
Revised: Problem (1) is non-convex due to the activation function’s non-linearity (1c).

Original: As solving it is NPhard (Katz et al., 2017), it is commonly approximated by a convex relaxation (see § 4).
Revised: As solving it is NPhard (Katz et al., 2017), it is commonly approximated by a convex relaxation (see § 4).

Original: The quality of the corresponding bounds, which is fundamental in veriﬁcation, depends on the tightness of the relaxation.
Revised: The quality of the corresponding bounds, which is fundamental in veriﬁcation, depends on the tightness of the relaxation.

Original: Unfortunately, tight relaxations usually correspond to slower bounding procedures.
Revised: Unfortunately, tight relaxations usually correspond to slower bounding procedures.

Original: We ﬁrst review a popular ReLU relaxation in § 2.1).
Revised: We ﬁrst review a popular ReLU relaxation in § 2.1).

Original: We then consider a tighter one in § 2.2.
Revised: We then consider a tighter one in § 2.2.

Original: 2. P LANET R ELAXATION
Revised: 2. P LANET R ELAXATION

Original: The so-called Planet relaxation (Ehlers, 2017) has enjoyed widespread use due to its amenability to efﬁcient customised solvers (Dvijotham et al., 2018; Bunel et al., 2020a) and is the “relaxation of choice” for many works in the area (Bunel et al., 2020b; Lu & Kumar, 2020).
Revised: The so-called Planet relaxation (Ehlers, 2017) has enjoyed widespread use due to its amenability to efﬁcient customised solvers (Dvijotham et al., 2018; Bunel et al., 2020a) and is the “relaxation of choice” for many works in the area (Bunel et al., 2020b; Lu & Kumar, 2020).

Original: Here, we describe it in its non-projected form M k , the LP relaxation of the Big-M Mixed Integer Programming (MIP) formulation (Tjeng et al., 2019).
Revised: Here, we describe it in its non-projected form M k , the LP relaxation of the Big-M Mixed Integer Programming (MIP) formulation (Tjeng et al., 2019).

Original: Applying M k to problem (1) results in:
Revised: Applying M k to problem (1) results in:

Original: [Equation]
Revised: [Equation]

Original: ×
Revised: ×

Original: [Equation]
Revised: [Equation]

Original: where ˆ l k , ˆ u k and l k , u k are intermediate bounds respectively on pre-activation variables ˆx k and post-activation variables x k .
Revised: where ˆ l k , ˆ u k and l k , u k are intermediate bounds respectively on pre-activation variables ˆx k and post-activation variables x k .

Original: These constants play an important role in the structure of M k and, together with the relaxed binary constraints on z , deﬁne box constraints on the variables.
Revised: These constants play an important role in the structure of M k and, together with the relaxed binary constraints on z , deﬁne box constraints on the variables.

Original: We detail how to compute intermediate bounds in appendix E. Projecting out auxiliary variables z results in the Planet relaxation (cf.
Revised: We detail how to compute intermediate bounds in appendix E. Projecting out auxiliary variables z results in the Planet relaxation (cf.

Original: appendix B.1 for details), which replaces (1c) by its convex hull.
Revised: appendix B.1 for details), which replaces (1c) by its convex hull.

Original: Problem (2), which is linearly-sized, can be easily solved via commercial black-box LP solvers (Bunel et al., 2018).
Revised: Problem (2), which is linearly-sized, can be easily solved via commercial black-box LP solvers (Bunel et al., 2018).

Original: This does not scale-up well with the size of the neural network, motivating the need for specialised solvers.
Revised: This does not scale-up well with the size of the neural network, motivating the need for specialised solvers.

Original: Customised dual solvers have been designed by relaxing constraints (1b), (1c) (Dvijotham et al., 2018) or replacing (1c) by the Planet relaxation and employing Lagrangian Decomposition (Bunel et al., 2020a).
Revised: Customised dual solvers have been designed by relaxing constraints (1b), (1c) (Dvijotham et al., 2018) or replacing (1c) by the Planet relaxation and employing Lagrangian Decomposition (Bunel et al., 2020a).

Original: Both approaches result in bounds very close to optimality for problem (2) in only a fraction of the runtime of off-the-shelf solvers.
Revised: Both approaches result in bounds very close to optimality for problem (2) in only a fraction of the runtime of off-the-shelf solvers.

Original: 2. A T IGHTER R ELAXATION
Revised: 2. A T IGHTER R ELAXATION

Original: A much tighter approximation of problem (1) than the Planet relaxation ( § 2.1) can be obtained by representing the convex hull of the composition of (1b) and (1c) rather than the convex hull of (1c) alone.
Revised: A much tighter approximation of problem (1) than the Planet relaxation ( § 2.1) can be obtained by representing the convex hull of the composition of (1b) and (1c) rather than the convex hull of (1c) alone.

Original: A formulation of this type was recently introduced by Anderson et al.
Revised: A formulation of this type was recently introduced by Anderson et al.

Original: Let us deﬁne
Revised: Let us deﬁne

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: 1 as:
Revised: 1 as:

Original: [Equation]
Revised: [Equation]

Original: , and
Revised: , and

Original: [Equation]
Revised: [Equation]

Original: Additionally, let us introduce 2 W k = { 0 , 1 } n k × n k − 1 , the set of all possible binary masks of weight matrix W k , and
Revised: Additionally, let us introduce 2 W k = { 0 , 1 } n k × n k − 1 , the set of all possible binary masks of weight matrix W k , and

Original: E k := 2 W k \ { 0 , 1 } , which excludes the all-zero and all-one masks.
Revised: E k := 2 W k \ { 0 , 1 } , which excludes the all-zero and all-one masks.

Original: The new representation results in the following primal problem:
Revised: The new representation results in the following primal problem:

Original: [Equation]
Revised: [Equation]

Original: Both M k and A k yield valid MIP formulations for problem (1) when imposing integrality constraints on z .
Revised: Both M k and A k yield valid MIP formulations for problem (1) when imposing integrality constraints on z .

Original: However, the LP relaxation of A k will yield tighter bounds.
Revised: However, the LP relaxation of A k will yield tighter bounds.

Original: In the worst case, this tightness comes at the cost of exponentially many constraints: one for each I k ∈ E k .
Revised: In the worst case, this tightness comes at the cost of exponentially many constraints: one for each I k ∈ E k .

Original: On the other hand, given a set of primal assignments ( x , z ) that are not necessarily feasible for problem (3), one can efﬁciently compute the most violated constraint (if any) at that point.
Revised: On the other hand, given a set of primal assignments ( x , z ) that are not necessarily feasible for problem (3), one can efﬁciently compute the most violated constraint (if any) at that point.

Original: The mask associated to such constraint can be computed in linear-time (Anderson et al., 2020) as:
Revised: The mask associated to such constraint can be computed in linear-time (Anderson et al., 2020) as:

Original: [Equation]
Revised: [Equation]

Original: We point out that A k slightly differs from the original formulation of Anderson et al.
Revised: We point out that A k slightly differs from the original formulation of Anderson et al.

Original: (2020), which does not explicitly include pre-activation bounds ˆ l k , ˆ u k (which we treat via M k ).
Revised: (2020), which does not explicitly include pre-activation bounds ˆ l k , ˆ u k (which we treat via M k ).

Original: While this was implicitly addressed in practical applications (Botoeva et al., 2020), not doing so has a strong negative effect on bound tightness, possibly to the point of yielding looser bounds than problem (2).
Revised: While this was implicitly addressed in practical applications (Botoeva et al., 2020), not doing so has a strong negative effect on bound tightness, possibly to the point of yielding looser bounds than problem (2).

Original: In appendix F, we provide an example in which this is the case and extend the original derivation by Anderson et al.
Revised: In appendix F, we provide an example in which this is the case and extend the original derivation by Anderson et al.

Original: (2020) to recover A k as in problem (3).
Revised: (2020) to recover A k as in problem (3).

Original: Owing to the exponential number of constraints, problem (3) cannot be solved as it is.
Revised: Owing to the exponential number of constraints, problem (3) cannot be solved as it is.

Original: As outlined by Anderson et al.
Revised: As outlined by Anderson et al.

Original: (2020), the availability of a linear-time separation oracle (4) offers a natural primal cutting plane algorithm, which can then be implemented in off-the-shelf solvers: solve the
Revised: (2020), the availability of a linear-time separation oracle (4) offers a natural primal cutting plane algorithm, which can then be implemented in off-the-shelf solvers: solve the

Original: Big-M LP (2), then iteratively add the most violated constraints from A k at the optimal solution.
Revised: Big-M LP (2), then iteratively add the most violated constraints from A k at the optimal solution.

Original: When applied to the veriﬁcation of small neural networks via off-the-shelf MIP solvers, this leads to substantial gains with respect to the looser Big-M relaxation (Anderson et al., 2020).
Revised: When applied to the veriﬁcation of small neural networks via off-the-shelf MIP solvers, this leads to substantial gains with respect to the looser Big-M relaxation (Anderson et al., 2020).

Original:  A N E FFICIENT D UAL S OLVER FOR THE T IGHTER R ELAXATION
Revised:  A N E FFICIENT D UAL S OLVER FOR THE T IGHTER R ELAXATION

Original: Inspired by the success of dual approaches on looser relaxations (Bunel et al., 2020a; Dvijotham et al., 2019), we show that the formal veriﬁcation gains by Anderson et al.
Revised: Inspired by the success of dual approaches on looser relaxations (Bunel et al., 2020a; Dvijotham et al., 2019), we show that the formal veriﬁcation gains by Anderson et al.

Original: (2020) (see § 2.2) scale to larger networks if we solve the tighter relaxation in the dual space.
Revised: (2020) (see § 2.2) scale to larger networks if we solve the tighter relaxation in the dual space.

Original: Due to the particular structure of the relaxation, a customised solver for problem (3) needs to meet a number of requirements.
Revised: Due to the particular structure of the relaxation, a customised solver for problem (3) needs to meet a number of requirements.

Original: Fact 1.
Revised: Fact 1.

Original: In order to replicate the success of previous dual algorithms on looser relaxations, we need a solver for problem (3) with the following properties: (i) sparsity : a memory cost linear in the number of network activations in spite of exponentially many constraints, (ii) tightness : the bounds should reﬂect the quality of those obtained in the primal space, (iii) anytime : low cost per iteration and valid bounds at each step.
Revised: In order to replicate the success of previous dual algorithms on looser relaxations, we need a solver for problem (3) with the following properties: (i) sparsity : a memory cost linear in the number of network activations in spite of exponentially many constraints, (ii) tightness : the bounds should reﬂect the quality of those obtained in the primal space, (iii) anytime : low cost per iteration and valid bounds at each step.

Original: The anytime requirement motivates dual solutions: any dual assignment yields a valid bound due to weak duality.
Revised: The anytime requirement motivates dual solutions: any dual assignment yields a valid bound due to weak duality.

Original: Unfortunately, as shown in appendix A, neither of the two dual derivations by Bunel et al.
Revised: Unfortunately, as shown in appendix A, neither of the two dual derivations by Bunel et al.

Original: (2020a)
Revised: (2020a)

Original: ; Dvijotham et al.
Revised: ; Dvijotham et al.

Original: (2018) readily satisfy all desiderata at once.
Revised: (2018) readily satisfy all desiderata at once.

Original: Therefore, we need a completely different approach.
Revised: Therefore, we need a completely different approach.

Original: Let us introduce dual variables α , β and functions thereof:
Revised: Let us introduce dual variables α , β and functions thereof:

Original: [Equation]
Revised: [Equation]

Original: where (cid:80)
Revised: where (cid:80)

Original: I k is a shorthand for (cid:80) I k ∈ 2 Wk .
Revised: I k is a shorthand for (cid:80) I k ∈ 2 Wk .

Original: Starting from primal (3)
Revised: Starting from primal (3)

Original: [Equation]
Revised: [Equation]

Original: we relax all constraints in A k except box constraints (see § 2.1)
Revised: we relax all constraints in A k except box constraints (see § 2.1)

Original: [Equation]
Revised: [Equation]

Original: We obtain the following dual problem (derivation in appendix C), where functions f k , g k appear in inner products with primal variables x k , z k : max
Revised: We obtain the following dual problem (derivation in appendix C), where functions f k , g k appear in inner products with primal variables x k , z k : max

Original: [Equation]
Revised: [Equation]

Original: α , β ) ≥
Revised: α , β ) ≥

Original: [Equation]
Revised: [Equation]

Original: d ( α , β
Revised: d ( α , β

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: This is again a challenging problem: the exponentially many constraints in the primal (3) are now associated to an exponential number of variables.
Revised: This is again a challenging problem: the exponentially many constraints in the primal (3) are now associated to an exponential number of variables.

Original: Nevertheless, we show that the requirements of
Revised: Nevertheless, we show that the requirements of

Original: Fact 1 can be met by operating on a restricted version of dual (6).
Revised: Fact 1 can be met by operating on a restricted version of dual (6).

Original: To this end, we present Active Set, a specialised solver for the relaxation by Anderson et al.
Revised: To this end, we present Active Set, a specialised solver for the relaxation by Anderson et al.

Original: (2020) that is sparse, anytime and yields bounds reﬂecting the tightness of the new relaxation.
Revised: (2020) that is sparse, anytime and yields bounds reﬂecting the tightness of the new relaxation.

Original: Starting from the dual of problem (2), our solver iteratively adds variables to a small active set of dual variables β B and solves the resulting reduced version of problem (6).
Revised: Starting from the dual of problem (2), our solver iteratively adds variables to a small active set of dual variables β B and solves the resulting reduced version of problem (6).

Original: We ﬁrst describe our solver on a ﬁxed β B and then outline how to iteratively modify the active set ( § 3.2).
Revised: We ﬁrst describe our solver on a ﬁxed β B and then outline how to iteratively modify the active set ( § 3.2).

Original: Pseudo-code can be found in appendix D.
Revised: Pseudo-code can be found in appendix D.

Original: 3. A CTIVE S ET S OLVER
Revised: 3. A CTIVE S ET S OLVER

Original: We want to solve a version of problem (6) for which the sums over the I k masks of each layer k are restricted to B k ⊆ E k 1 , with B = ∪ k B k .
Revised: We want to solve a version of problem (6) for which the sums over the I k masks of each layer k are restricted to B k ⊆ E k 1 , with B = ∪ k B k .

Original: By keeping B = ∅ , we recover a novel dual solver for the Big-M relaxation (2) (explicitly described in appendix B), which is employed as initialisation.
Revised: By keeping B = ∅ , we recover a novel dual solver for the Big-M relaxation (2) (explicitly described in appendix B), which is employed as initialisation.

Original: Setting β k,I k
Revised: Setting β k,I k

Original: = 0 , ∀
Revised: = 0 , ∀

Original: I k ∈ E k \ B k in (5), (6) and removing these from the formulation, we obtain:
Revised: I k ∈ E k \ B k in (5), (6) and removing these from the formulation, we obtain:

Original: [Equation]
Revised: [Equation]

Original: along with the reduced dual problem:
Revised: along with the reduced dual problem:

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: We can maximize d B ( α , β B ) , which is concave and non-smooth, via projected supergradient ascent or variants thereof, such as Adam (Kingma & Ba, 2015).
Revised: We can maximize d B ( α , β B ) , which is concave and non-smooth, via projected supergradient ascent or variants thereof, such as Adam (Kingma & Ba, 2015).

Original: In order to obtain a valid supergradient, we need to perform the inner minimisation over the primals.
Revised: In order to obtain a valid supergradient, we need to perform the inner minimisation over the primals.

Original: Thanks to the structure of problem (8), the optimisation decomposes over the layers.
Revised: Thanks to the structure of problem (8), the optimisation decomposes over the layers.

Original: For k ∈ (cid:74) 1 , n − 1 (cid:75) , we can perform the minimisation in closed-form by driving the primals to their upper or lower bounds depending on the sign of their coefﬁcients:
Revised: For k ∈ (cid:74) 1 , n − 1 (cid:75) , we can perform the minimisation in closed-form by driving the primals to their upper or lower bounds depending on the sign of their coefﬁcients:

Original: [Equation]
Revised: [Equation]

Original: The subproblem corresponding to x 0 is different, as it involves a linear minimization over x 0 ∈ C :
Revised: The subproblem corresponding to x 0 is different, as it involves a linear minimization over x 0 ∈ C :

Original: [Equation]
Revised: [Equation]

Original: We assumed in § 2 that (10) can be performed efﬁciently.
Revised: We assumed in § 2 that (10) can be performed efﬁciently.

Original: We refer the reader to Bunel et al.
Revised: We refer the reader to Bunel et al.

Original: (2020a)
Revised: (2020a)

Original: for descriptions of the minimisation when C is a (cid:96) ∞ or (cid:96) 2 ball, as common for adversarial examples.
Revised: for descriptions of the minimisation when C is a (cid:96) ∞ or (cid:96) 2 ball, as common for adversarial examples.

Original: Given ( x ∗ , z ∗ ) as above, the supergradient of d B ( α , β B ) is a subset of the one for d ( α , β ) , given by:
Revised: Given ( x ∗ , z ∗ ) as above, the supergradient of d B ( α , β B ) is a subset of the one for d ( α , β ) , given by:

Original: [Equation]
Revised: [Equation]

Original: for each k ∈ (cid:74) 0 , n − 1 (cid:75) .
Revised: for each k ∈ (cid:74) 0 , n − 1 (cid:75) .

Original: At each iteration, after taking a step in the supergradient direction, the dual variables are projected to the non-negative orthant by clipping negative values.
Revised: At each iteration, after taking a step in the supergradient direction, the dual variables are projected to the non-negative orthant by clipping negative values.

Original: 3. E XTENDING THE A CTIVE S ET
Revised: 3. E XTENDING THE A CTIVE S ET

Original: We initialise the dual (6) with a tight bound on the Big-M relaxation by solving for d ∅ ( α , β ∅ ) in (8).
Revised: We initialise the dual (6) with a tight bound on the Big-M relaxation by solving for d ∅ ( α , β ∅ ) in (8).

Original: To satisfy the tightness requirement in Fact 1, we then need to include constraints (via their
Revised: To satisfy the tightness requirement in Fact 1, we then need to include constraints (via their

Original: Lagrangian multipliers) from the exponential family of A k into B k .
Revised: Lagrangian multipliers) from the exponential family of A k into B k .

Original: Our goal is to tighten them as much as possible while keeping the active set small to save memory and compute.
Revised: Our goal is to tighten them as much as possible while keeping the active set small to save memory and compute.

Original: The active set strategy is deﬁned by a selection criterion for the I ∗ k to be added 2 to B k , and the frequency of addition.
Revised: The active set strategy is deﬁned by a selection criterion for the I ∗ k to be added 2 to B k , and the frequency of addition.

Original: In practice, we add the variables maximising the entries of supergradient ∇ β k,Ik d ( α , β ) after a ﬁxed number of dual iterations.
Revised: In practice, we add the variables maximising the entries of supergradient ∇ β k,Ik d ( α , β ) after a ﬁxed number of dual iterations.

Original: We now provide motivation for both choices.
Revised: We now provide motivation for both choices.

Original: Selection criterion
Revised: Selection criterion

Original: The selection criterion needs to be computationally efﬁcient.
Revised: The selection criterion needs to be computationally efﬁcient.

Original: Thus, we proceed greedily and focus only on the immediate effect at the current iteration.
Revised: Thus, we proceed greedily and focus only on the immediate effect at the current iteration.

Original: Let us map a restricted set of dual variables β B to a set of dual variables β for the full dual (6).
Revised: Let us map a restricted set of dual variables β B to a set of dual variables β for the full dual (6).

Original: We do so by setting variables not in the active set to 0 :
Revised: We do so by setting variables not in the active set to 0 :

Original: β ¯ B = 0 , and β = β B ∪ β ¯ B .
Revised: β ¯ B = 0 , and β = β B ∪ β ¯ B .

Original: Then, for each layer k , we add the set of variables β k,I ∗ k maximising the corresponding entries of the supergradient of the full dual problem (6): β k,I ∗ k ∈ argmax β k,
Revised: Then, for each layer k , we add the set of variables β k,I ∗ k maximising the corresponding entries of the supergradient of the full dual problem (6): β k,I ∗ k ∈ argmax β k,

Original: Ik {∇ β k,Ik d ( α , β ) T 1 } .
Revised: Ik {∇ β k,Ik d ( α , β ) T 1 } .

Original: Therefore, we use the subderivatives as a proxy for short-term improvement on the full dual objective d ( α , β ) .
Revised: Therefore, we use the subderivatives as a proxy for short-term improvement on the full dual objective d ( α , β ) .

Original: Under a primal interpretation, our selection criterion involves a call to the separation oracle (4) by Anderson et al.
Revised: Under a primal interpretation, our selection criterion involves a call to the separation oracle (4) by Anderson et al.

Original: Proposition 1.
Revised: Proposition 1.

Original: β k,I ∗ k (as deﬁned above) represents the Lagrangian multipliers associated to the most violated constraints from A k at ( x ∗ , z ∗ ) ∈ argmin x , z L B ( x , z , α , β B ) , the primal minimiser of the current restricted Lagrangian.
Revised: β k,I ∗ k (as deﬁned above) represents the Lagrangian multipliers associated to the most violated constraints from A k at ( x ∗ , z ∗ ) ∈ argmin x , z L B ( x , z , α , β B ) , the primal minimiser of the current restricted Lagrangian.

Original: Proof.
Revised: Proof.

Original: See appendix D.1.
Revised: See appendix D.1.

Original: Frequency Finally, we need to decide the frequency at which to add variables to the active set.
Revised: Frequency Finally, we need to decide the frequency at which to add variables to the active set.

Original: Fact 2.
Revised: Fact 2.

Original: Assume we obtained a dual solution ( α † , β †B ) ∈ argmax d B ( α , β B ) using Active Set on the current B .
Revised: Assume we obtained a dual solution ( α † , β †B ) ∈ argmax d B ( α , β B ) using Active Set on the current B .

Original: Then ( x ∗ , z ∗ ) ∈ argmin x , z L B ( x , z , α † , β †B ) is not necessarily an optimal primal solution for the primal of the current restricted dual problem (Sherali & Choi, 1996).
Revised: Then ( x ∗ , z ∗ ) ∈ argmin x , z L B ( x , z , α † , β †B ) is not necessarily an optimal primal solution for the primal of the current restricted dual problem (Sherali & Choi, 1996).

Original: The primal of d B ( α , β B ) (restricted primal) is the problem obtained by setting E k ← B k in problem (3).
Revised: The primal of d B ( α , β B ) (restricted primal) is the problem obtained by setting E k ← B k in problem (3).

Original: While the primal cutting plane algorithm by Anderson et al.
Revised: While the primal cutting plane algorithm by Anderson et al.

Original: (2020) calls the separation oracle (4) at the optimal solution of the current restricted primal, Fact 2 shows that our selection criterion leads to a different behaviour even at dual optimality for d B ( α , β B ) .
Revised: (2020) calls the separation oracle (4) at the optimal solution of the current restricted primal, Fact 2 shows that our selection criterion leads to a different behaviour even at dual optimality for d B ( α , β B ) .

Original: Therefore, as we have no theoretical incentive to reach (approximate) subproblem convergence, we add variables after a ﬁxed tunable number of supergradient iterations.
Revised: Therefore, as we have no theoretical incentive to reach (approximate) subproblem convergence, we add variables after a ﬁxed tunable number of supergradient iterations.

Original: Furthermore, we can add more than one variable “at once” by running the oracle (4) repeatedly for a number of iterations.
Revised: Furthermore, we can add more than one variable “at once” by running the oracle (4) repeatedly for a number of iterations.

Original: 3. I MPLEMENTATION D ETAILS , T ECHNICAL C HALLENGES
Revised: 3. I MPLEMENTATION D ETAILS , T ECHNICAL C HALLENGES

Original: Analogously to previous dual algorithms (Dvijotham et al., 2018; Bunel et al., 2020a), our approach can leverage the massive parallelism offered by modern GPU architectures in three different ways.
Revised: Analogously to previous dual algorithms (Dvijotham et al., 2018; Bunel et al., 2020a), our approach can leverage the massive parallelism offered by modern GPU architectures in three different ways.

Original: First, we execute in parallel the computations of lower and upper bounds relative to all the neurons of a given layer.
Revised: First, we execute in parallel the computations of lower and upper bounds relative to all the neurons of a given layer.

Original: Second, in complete veriﬁcation, we can batch over the different Branch and
Revised: Second, in complete veriﬁcation, we can batch over the different Branch and

Original: Bound (BaB) subproblems.
Revised: Bound (BaB) subproblems.

Original: Third, as most of our solver relies on standard linear algebra operations employed during the forward and backward passes of neural networks, we can exploit the highly optimised implementations commonly found in modern deep learning frameworks.
Revised: Third, as most of our solver relies on standard linear algebra operations employed during the forward and backward passes of neural networks, we can exploit the highly optimised implementations commonly found in modern deep learning frameworks.

Original: An exception are what we call “masked” forward/backward passes: operations of the form ( W k (cid:12) I k ) x k or ( W k (cid:12)
Revised: An exception are what we call “masked” forward/backward passes: operations of the form ( W k (cid:12) I k ) x k or ( W k (cid:12)

Original: I k ) T x k +1 , which are needed whenever dealing with constraints from A k .
Revised: I k ) T x k +1 , which are needed whenever dealing with constraints from A k .

Original: In our solver, they appear if B k (cid:54)
Revised: In our solver, they appear if B k (cid:54)

Original: = ∅ (see equations (8), (11)).
Revised: = ∅ (see equations (8), (11)).

Original: Masked passes require a customised lower-level implementation for a proper treatment of convolutional layers, detailed in appendix G.
Revised: Masked passes require a customised lower-level implementation for a proper treatment of convolutional layers, detailed in appendix G.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: In addition to those described in § 2, many other relaxations have been proposed in the literature.
Revised: In addition to those described in § 2, many other relaxations have been proposed in the literature.

Original: In fact, all bounding methods are equivalent to solving some convex relaxation of a neural network.
Revised: In fact, all bounding methods are equivalent to solving some convex relaxation of a neural network.

Original: This holds for conceptually different ideas such as bound propagation (Gowal et al., 2018), speciﬁc dual assignments (Wong & Kolter, 2018), dual formulations based on Lagrangian Relaxation (Dvijotham et al., 2018) or Decomposition (Bunel et al., 2020a).
Revised: This holds for conceptually different ideas such as bound propagation (Gowal et al., 2018), speciﬁc dual assignments (Wong & Kolter, 2018), dual formulations based on Lagrangian Relaxation (Dvijotham et al., 2018) or Decomposition (Bunel et al., 2020a).

Original: The degree of tightness varies greatly: from looser relaxations associated to closed-form methods (Gowal et al., 2018;
Revised: The degree of tightness varies greatly: from looser relaxations associated to closed-form methods (Gowal et al., 2018;

Original: Weng et al., 2018;
Revised: Weng et al., 2018;

Original: Wong & Kolter, 2018) to tighter formulations based on Semi-Deﬁnite Programming (SDP) (Raghunathan et al., 2018).
Revised: Wong & Kolter, 2018) to tighter formulations based on Semi-Deﬁnite Programming (SDP) (Raghunathan et al., 2018).

Original: The speed of closed-form approaches results from simplifying the triangle-shaped feasible region of the Planet relaxation ( § 2.1) (Singh et al., 2018; Wang et al., 2018).
Revised: The speed of closed-form approaches results from simplifying the triangle-shaped feasible region of the Planet relaxation ( § 2.1) (Singh et al., 2018; Wang et al., 2018).

Original: On the other hand, tighter relaxations are more expressive than the linearly-sized LP by (Ehlers, 2017).
Revised: On the other hand, tighter relaxations are more expressive than the linearly-sized LP by (Ehlers, 2017).

Original: The SDP formulation by Raghunathan et al.
Revised: The SDP formulation by Raghunathan et al.

Original: (2018) can represent interactions between activations in the same layer.
Revised: (2018) can represent interactions between activations in the same layer.

Original: Similarly, Singh et al.
Revised: Similarly, Singh et al.

Original: (2019) tighten the Planet relaxation by considering the convex hull of the union of polyhedra relative to k ReLUs of a given layer at once.
Revised: (2019) tighten the Planet relaxation by considering the convex hull of the union of polyhedra relative to k ReLUs of a given layer at once.

Original: Alternatively, tighter LPs can be obtained by considering the ReLU together with the afﬁne operator before it: standard MIP techniques (Jeroslow, 1987) lead to a formulation that is quadratic in the number of variables (see appendix F.2).
Revised: Alternatively, tighter LPs can be obtained by considering the ReLU together with the afﬁne operator before it: standard MIP techniques (Jeroslow, 1987) lead to a formulation that is quadratic in the number of variables (see appendix F.2).

Original: The relaxation by Anderson et al.
Revised: The relaxation by Anderson et al.

Original: (2020) detailed in § 2.2 is a more convenient representation of the same set.
Revised: (2020) detailed in § 2.2 is a more convenient representation of the same set.

Original: By projecting out the auxiliary z variables, (Tjandraatmadja et al., 2020) recently introduced another formulation equivalent to the one by Anderson et al.
Revised: By projecting out the auxiliary z variables, (Tjandraatmadja et al., 2020) recently introduced another formulation equivalent to the one by Anderson et al.

Original: (2020), with half as many variables and a linear factor more constraints compared to what described in § 2.2.
Revised: (2020), with half as many variables and a linear factor more constraints compared to what described in § 2.2.

Original: Therefore, the relationship between the two formulations mirrors the one between the Planet and Big-M relaxations (see appendix B.1).
Revised: Therefore, the relationship between the two formulations mirrors the one between the Planet and Big-M relaxations (see appendix B.1).

Original: Our dual derivation and the Active Set algorithm can be adapted to operate on the projected relaxations.
Revised: Our dual derivation and the Active Set algorithm can be adapted to operate on the projected relaxations.

Original: Specialised dual solvers signiﬁcantly improve in bounding efﬁciency with respect to off-the-shelf solvers for both LP (Bunel et al., 2020a) and SDP formulations (Dvijotham et al., 2019).
Revised: Specialised dual solvers signiﬁcantly improve in bounding efﬁciency with respect to off-the-shelf solvers for both LP (Bunel et al., 2020a) and SDP formulations (Dvijotham et al., 2019).

Original: Therefore, the design of similar solvers for other tight relaxations is an interesting line of future research.
Revised: Therefore, the design of similar solvers for other tight relaxations is an interesting line of future research.

Original: We contribute with a specialised dual solver for the relaxation by Anderson et al.
Revised: We contribute with a specialised dual solver for the relaxation by Anderson et al.

Original: In what follows, we demonstrate empirically that by seamlessly transitioning from the Planet relaxation to the tighter formulation, we can obtain large incomplete and complete veriﬁcation improvements.
Revised: In what follows, we demonstrate empirically that by seamlessly transitioning from the Planet relaxation to the tighter formulation, we can obtain large incomplete and complete veriﬁcation improvements.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: We empirically demonstrate the effectiveness of our method under two settings.
Revised: We empirically demonstrate the effectiveness of our method under two settings.

Original: On incomplete veriﬁcation ( § 5.1), we assess the speed and quality of bounds compared to other bounding algorithms.
Revised: On incomplete veriﬁcation ( § 5.1), we assess the speed and quality of bounds compared to other bounding algorithms.

Original: On complete veriﬁcation ( § 5.2), we examine whether our speed-accuracy trade-offs correspond to faster exact veriﬁcation.
Revised: On complete veriﬁcation ( § 5.2), we examine whether our speed-accuracy trade-offs correspond to faster exact veriﬁcation.

Original: Our implementation is based on Pytorch (Paszke et al., 2017).
Revised: Our implementation is based on Pytorch (Paszke et al., 2017).

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: 4 BDD+ 400 steps 1.
Revised: 4 BDD+ 400 steps 1.

Original: B i g - M 850 s t e p s
Revised: B i g - M 850 s t e p s

Original: Timing (in s) 1010 1 BDD+ 400 steps 

Revised: Timing (in s) 1010 1 BDD+ 400 steps

Original: B i g - M 850 s t e p s
Revised: B i g - M 850 s t e p s

Original: Gap to Planet
Revised: Gap to Planet

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure] 
Revised: [Figure] [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: A c t i v e S e t 80 s t e p s
Revised: A c t i v e S e t 80 s t e p s

Original: Timing (in s) 0.
Revised: Timing (in s) 0.

Original: 0.4 Big-M 850 steps 0.
Revised: 0.4 Big-M 850 steps 0.

Original: A c t i v e S e t 80 s t e p s
Revised: A c t i v e S e t 80 s t e p s

Original: Improvement from Planet
Revised: Improvement from Planet

Original: [Figure]
Revised: [Figure]

Original: 5. I NCOMPLETE V ERIFICATION
Revised: I NCOMPLETE V ERIFICATION

Original: We evaluate incomplete veriﬁcation performance by upper bounding the robustness margin (the difference between the ground truth logit and the other logits) to adversarial perturbations (Szegedy et al., 2014) on the CIFAR-10 test set (Krizhevsky & Hinton, 2009).
Revised: We evaluate incomplete veriﬁcation performance by upper bounding the robustness margin (the difference between the ground truth logit and the other logits) to adversarial perturbations (Szegedy et al., 2014) on the CIFAR-10 test set (Krizhevsky & Hinton, 2009).

Original: If the upper bound is negative, we can certify the network’s vulnerability to adversarial perturbations.
Revised: If the upper bound is negative, we can certify the network’s vulnerability to adversarial perturbations.

Original: We replicate the experimental setting from Bunel et al.
Revised: We replicate the experimental setting from Bunel et al.

Original: (2020a).
Revised: (2020a).

Original: The networks correspond to the small network architecture from Wong & Kolter (2018).
Revised: The networks correspond to the small network architecture from Wong & Kolter (2018).

Original: Here, we present results for a network trained via standard SGD and cross entropy loss, with no modiﬁcation to the objective for robustness.
Revised: Here, we present results for a network trained via standard SGD and cross entropy loss, with no modiﬁcation to the objective for robustness.

Original: Perturbations for this network lie in a (cid:96) ∞ norm ball with radius (cid:15) ver = 5 / 255 (which is hence lower than commonly employed radii for robustly trained networks).
Revised: Perturbations for this network lie in a (cid:96) ∞ norm ball with radius (cid:15) ver = 5 / 255 (which is hence lower than commonly employed radii for robustly trained networks).

Original: In appendix I, we additionally show results on an adversarially trained network using the method by Madry et al.
Revised: In appendix I, we provide additional CIFAR-10 results on an adversarially trained network using the method by Madry et al.

Revised: (2018), and on MNIST (LeCun et al., 1998), for a network adversarially trained with the algorithm by Wong & Kolter (2018).

Original: We compare both against previous dual iterative methods and Gurobi (Gurobi Optimization, 2020), the commercial black-box solver employed by Anderson et al.
Revised: We compare both against previous dual iterative methods and Gurobi (Gurobi Optimization, 2020), the commercial black-box solver employed by Anderson et al.

Original: For Gurobi-based baselines,
Revised: For Gurobi-based baselines,

Original: Planet means solving the Planet Ehlers (2017) relaxation of the network, while Gurobi cut starts from the Big-M relaxation and adds constraints from A k in a cutting-plane fashion, as the original primal algorithm by Anderson et al.
Revised: Planet means solving the Planet Ehlers (2017) relaxation of the network, while Gurobi cut starts from the Big-M relaxation and adds constraints from A k in a cutting-plane fashion, as the original primal algorithm by Anderson et al.

Original: We run both on 4 CPU threads.
Revised: We run both on 4 CPU threads.

Original: Amongst dual iterative methods, run on an Nvidia Titan Xp GPU, we compare with BDD+ , the recent proximal-based solver by Bunel et al.
Revised: Amongst dual iterative methods, run on an Nvidia Titan Xp GPU, we compare with BDD+ , the recent proximal-based solver by Bunel et al.

Original: (2020a), operating on a Lagrangian Decomposition dual of the Planet relaxation.
Revised: (2020a), operating on a Lagrangian Decomposition dual of the Planet relaxation.

Original: As we operate on (a subset of) the data by Bunel et al.
Revised: As we operate on (a subset of) the data by Bunel et al.

Original: (2020a), we omit both their supergradientbased approach and the one by Dvijotham et al.
Revised: (2020a), we omit both their supergradientbased approach and the one by Dvijotham et al.

Original: (2018), as they both perform worse than BDD+ (Bunel et al., 2020a).
Revised: (2018), as they both perform worse than BDD+ (Bunel et al., 2020a).

Original: For the same reason, we omit cheaper (and looser) methods, like interval propagation Gowal et al.
Revised: For the same reason, we omit cheaper (and looser) methods, like interval propagation Gowal et al.

Original: (2018) and the one by Wong & Kolter (2018).
Revised: (2018) and the one by Wong & Kolter (2018).

Original: Active Set denotes our solver for problem (3), described in § 3.1.
Revised: Active Set denotes our solver for problem (3), described in § 3.1.

Original: By keeping B = ∅ , Active Set reduces to Big-M , a solver for the non-projected Planet relaxation (appendix B), which can be seen as Active Set’s initialiser.
Revised: By keeping B = ∅ , Active Set reduces to Big-M , a solver for the non-projected Planet relaxation (appendix B), which can be seen as Active Set’s initialiser.

Original: In line with previous bounding algorithms (Bunel et al., 2020a), we employ Adam updates (Kingma & Ba, 2015) for supergradient-type methods due to their faster empirical convergence.
Revised: In line with previous bounding algorithms (Bunel et al., 2020a), we employ Adam updates (Kingma & Ba, 2015) for supergradient-type methods due to their faster empirical convergence.

Original: Finally, we complement the comparison with Gurobi-based methods by running Active Set on 4 CPU threads ( Active Set CPU ).
Revised: Finally, we complement the comparison with Gurobi-based methods by running Active Set on 4 CPU threads ( Active Set CPU ).

Original: Further details, including hyper-parameters, can be found in appendix I.
Revised: Further details, including hyper-parameters, can be found in appendix I.

Original: Figure 1 shows the distribution of runtime and the bound improvement with respect to Gurobi cut for the SGD-trained network.
Revised: Figure 1 shows the distribution of runtime and the bound improvement with respect to Gurobi cut for the SGD-trained network.

Original: For Gurobi cut, we only add the single most violated cut from A k per neuron, due to the cost of repeatedly solving the LP.
Revised: For Gurobi cut, we only add the single most violated cut from A k per neuron, due to the cost of repeatedly solving the LP.

Original: We tuned BDD+ and Big-M, the dual methods operating on the weaker relaxation (2), to have the same average runtime.
Revised: We tuned BDD+ and Big-M, the dual methods operating on the weaker relaxation (2), to have the same average runtime.

Original: They obtain bounds comparable to Gurobi Planet in one order less time.
Revised: They obtain bounds comparable to Gurobi Planet in one order less time.

Original: Initialised from 500 Big-M iterations, atiterations Active Set already achieves better bounds on average than Gurobi cut in around 1 / 20 th of the time.
Revised: Initialised from 500 Big-M iterations, atiterations Active Set already achieves better bounds on average than Gurobi cut in around 1 / 20 th of the time.

Original: With a computational budget twice as large ( 1050 iterations) or four times as large ( 1650 iterations), the bounds signiﬁcantly improve over Gurobi cut in still a fraction of the time.
Revised: With a computational budget twice as large ( 1050 iterations) or four times as large ( 1650 iterations), the bounds signiﬁcantly improve over Gurobi cut in still a fraction of the time.

Original: As we empirically demonstrate in appendix I, the tightness of the Active Set bounds is strongly linked to our active set strategy ( § 3.2).
Revised: As we empirically demonstrate in appendix I, the tightness of the Active Set bounds is strongly linked to our active set strategy ( § 3.2).

Original: Remarkably, even if our method is speciﬁcally designed to take advantage of GPU acceleration, executing it on CPU proves to be strongly competitive with Gurobi cut, producing better bounds in less time for the benchmark of Figure 1.
Revised: Remarkably, even if our method is speciﬁcally designed to take advantage of GPU acceleration, executing it on CPU proves to be strongly competitive with Gurobi cut, producing better bounds in less time for the benchmark of Figure 1.

Original: Figure 2 shows pointwise comparisons for a subset of the methods of Figure 1, on the same data.
Revised: Figure 2 shows pointwise comparisons for a subset of the methods of Figure 1, on the same data.

Original: Figure 2a shows the gap to the (Gurobi) Planet bound for BDD+ and our Big-M solver.
Revised: Figure 2a shows the gap to the (Gurobi) Planet bound for BDD+ and our Big-M solver.

Original: Surprisingly, our Big-M solver is competitive with BDD+, achieving on average better bounds than BDD+, in the same time.
Revised: Surprisingly, our Big-M solver is competitive with BDD+, achieving on average better bounds than BDD+, in the same time.

Original: Figure 2b shows the improvement over Planet bounds for Big-M and Active Set.
Revised: Figure 2b shows the improvement over Planet bounds for Big-M and Active Set.

Original: The
Revised: The

Original: [Figure]
Revised: [Figure]

Original: latter achieves markedly better bounds than Big-M in the same time, demonstrating the beneﬁt of operating (at least partly) on the tighter dual (6).
Revised: latter achieves markedly better bounds than Big-M in the same time, demonstrating the beneﬁt of operating (at least partly) on the tighter dual (6).

Original: 5. C OMPLETE V ERIFICATION
Revised: 5. C OMPLETE V ERIFICATION

Original: We next evaluate the performance on complete veriﬁcation, verifying the adversarial robustness of a network to perturbations in (cid:96) ∞ norm on a subset of the dataset by Lu & Kumar (2020), replicating the experimental setting from Bunel et al.
Revised: We next evaluate the performance on complete veriﬁcation, verifying the adversarial robustness of a network to perturbations in (cid:96) ∞ norm on a subset of the dataset by Lu & Kumar (2020), replicating the experimental setting from Bunel et al.

Original: (2020a).
Revised: (2020a).

Original: The dataset associates a different perturbation radius (cid:15) verif to each CIFAR-10 image, so as to create challenging veriﬁcation properties.
Revised: The dataset associates a different perturbation radius (cid:15) verif to each CIFAR-10 image, so as to create challenging veriﬁcation properties.

Original: Its difﬁculty makes the dataset an appropriate testing ground for tighter relaxations like the one by Anderson et al.
Revised: Its difﬁculty makes the dataset an appropriate testing ground for tighter relaxations like the one by Anderson et al.

Original: Further details, including network architectures, can be found in appendix I.
Revised: Further details, including network architectures, can be found in appendix I.

Original: Here, we aim to solve the non-convex problem (1) directly, rather than an approximation like § 5.1.
Revised: Here, we aim to solve the non-convex problem (1) directly, rather than an approximation like § 5.1.

Original: In order to do so, we use BaSBR, a branch and bound algorithm from Bunel et al.
Revised: In order to do so, we use BaSBR, a branch and bound algorithm from Bunel et al.

Original: (2020b).
Revised: (2020b).

Original: Branch and Bound works by dividing the problem domain into subproblems (branching) and bounding the local minimum over those domains.
Revised: Branch and Bound works by dividing the problem domain into subproblems (branching) and bounding the local minimum over those domains.

Original: Any domain which cannot contain the global lower bound is pruned away, whereas the others are kept and branched over.
Revised: Any domain which cannot contain the global lower bound is pruned away, whereas the others are kept and branched over.

Original: In BaBSR, branching is carried out by splitting an unﬁxed ReLU into its passing and blocking phases.
Revised: In BaBSR, branching is carried out by splitting an unﬁxed ReLU into its passing and blocking phases.

Original: The ReLU which induces maximum change in the domain’s lower bound, when made unambiguous, is selected for splitting.
Revised: The ReLU which induces maximum change in the domain’s lower bound, when made unambiguous, is selected for splitting.

Original: A fundamental component of a BaB method is the bounding algorithm, which is, in general, the computational bottleneck (Lu & Kumar, 2020).
Revised: A fundamental component of a BaB method is the bounding algorithm, which is, in general, the computational bottleneck (Lu & Kumar, 2020).

Original: Therefore, we compare the effect on ﬁnal veriﬁcation time of using the different bounding methods in § 5.1 within BaBSR.
Revised: Therefore, we compare the effect on ﬁnal veriﬁcation time of using the different bounding methods in § 5.1 within BaBSR.

Original: In addition, we evaluate
Revised: In addition, we evaluate

Original: MIP A k , which encodes problem (1) as a Big-M MIP (Tjeng et al., 2019) and solves it in Gurobi by adding cutting planes from A k , analogously to the original experiments by Anderson et al.
Revised: MIP A k , which encodes problem (1) as a Big-M MIP (Tjeng et al., 2019) and solves it in Gurobi by adding cutting planes from A k , analogously to the original experiments by Anderson et al.

Original: Finally, we also compare against ERAN (Singh et al., 2020), a state-of-the-art complete veriﬁcation toolbox: results on the dataset by Lu & Kumar (2020) are taken from the recent VNN-COMP competition (VNN-COMP, 2020).
Revised: Finally, we also compare against ERAN (Singh et al., 2020), a state-of-the-art complete veriﬁcation toolbox: results on the dataset by Lu & Kumar (2020) are taken from the recent VNN-COMP competition (VNN-COMP, 2020).

Original: We use 100 iterations for Active Set, 100 iterations for BDD+ and 180 iterations for Big-M.
Revised: We use 100 iterations for Active Set, 100 iterations for BDD+ and 180 iterations for Big-M.

Original: For dual iterative algorithms, we solve 300 subproblems at once for the base network and 200 for the deep and wide networks (see § 3.3).
Revised: For dual iterative algorithms, we solve 300 subproblems at once for the base network and 200 for the deep and wide networks (see § 3.3).

Original: Additionally, dual variables are initialised from their parent node’s bounding computation.
Revised: Additionally, dual variables are initialised from their parent node’s bounding computation.

Original: As in Bunel et al.
Revised: As in Bunel et al.

Original: (2020a)
Revised: (2020a)

Original: , the time-limit is kept at one hour.
Revised: , the time-limit is kept at one hour.

Original: Due to the difference in computational cost between algorithms operating on the tighter relaxation by Anderson et al.
Revised: Due to the difference in computational cost between algorithms operating on the tighter relaxation by Anderson et al.

Original: (2020) and the other bounding algorithms 3 , we also experiment with a stratiﬁed version of the bounding within BaBSR.
Revised: (2020) and the other bounding algorithms 3 , we also experiment with a stratiﬁed version of the bounding within BaBSR.

Original: We devise a set of heuristics to determine whether a given subproblem is easy (therefore looser bounds are sufﬁcient) or whether we need to 3 For Active Set, this is partly due to the masked forward/backward pass described in appendix G
Revised: We devise a set of heuristics to determine whether a given subproblem is easy (therefore looser bounds are sufﬁcient) or whether we need to 3 For Active Set, this is partly due to the masked forward/backward pass described in appendix G

Original: [Table]
Revised: [Table]

Original: operate on the tighter relaxation.
Revised: operate on the tighter relaxation.

Original: Instances of this approach are Big-M + Active Set and Gurobi
Revised: Instances of this approach are Big-M + Active Set and Gurobi

Original: Planet + Gurobi 1 cut .
Revised: Planet + Gurobi 1 cut .

Original: Further details are provided in appendix H.
Revised: Further details are provided in appendix H.

Original: Figure 3 and Table 1 show that Big-M performs competitively with BDD+.
Revised: Figure 3 and Table 1 show that Big-M performs competitively with BDD+.

Original: Active Set veriﬁes a larger share of properties than the methods operating on the looser formulation (2), demonstrating the beneﬁt of tighter bounds ( § 5.1) in complete veriﬁcation.
Revised: Active Set veriﬁes a larger share of properties than the methods operating on the looser formulation (2), demonstrating the beneﬁt of tighter bounds ( § 5.1) in complete veriﬁcation.

Original: On the other hand, the poor performance of MIP + A k and of Gurobi Planet + Gurobi 1 cut, tied to scaling limitations of off-the-shelf solvers, shows that tighter bounds are effective only if they can be computed efﬁciently.
Revised: On the other hand, the poor performance of MIP + A k and of Gurobi Planet + Gurobi 1 cut, tied to scaling limitations of off-the-shelf solvers, shows that tighter bounds are effective only if they can be computed efﬁciently.

Original: Nevertheless, the difference in performance between the two Gurobi-based methods conﬁrms that customised Branch and Bound solvers (BaBSR) are preferable to generic MIP solvers, as observed by Bunel et al.
Revised: Nevertheless, the difference in performance between the two Gurobi-based methods conﬁrms that customised Branch and Bound solvers (BaBSR) are preferable to generic MIP solvers, as observed by Bunel et al.

Original: (2020b) on the looser Planet relaxation.
Revised: (2020b) on the looser Planet relaxation.

Original: Moreover, the stratiﬁed bounding system allows us to retain the speed of Big-M on easier properties, without excessively sacriﬁcing Active Set’s gains on the harder ones.
Revised: Moreover, the stratiﬁed bounding system allows us to retain the speed of Big-M on easier properties, without excessively sacriﬁcing Active Set’s gains on the harder ones.

Original: Finally, while ERAN veriﬁes 2% more properties than Active Set on two networks,
Revised: Finally, while ERAN veriﬁes 2% more properties than Active Set on two networks,

Original: BaBSR (with any dual bounding algorithm) is faster on most of the properties.
Revised: BaBSR (with any dual bounding algorithm) is faster on most of the properties.

Original: BaBSR-based results could be further improved by employing the learned branching strategy presented by Lu & Kumar (2020): in this work, we focused on the bounding component of branch and bound.
Revised: BaBSR-based results could be further improved by employing the learned branching strategy presented by Lu & Kumar (2020): in this work, we focused on the bounding component of branch and bound.

Original:  D ISCUSSION
Revised:  D ISCUSSION

Original: The vast majority of neural network bounding algorithms focuses on (solving or loosening) a popular triangle-shaped relaxation, referred to as the “convex barrier” for veriﬁcation.
Revised: The vast majority of neural network bounding algorithms focuses on (solving or loosening) a popular triangle-shaped relaxation, referred to as the “convex barrier” for veriﬁcation.

Original: Relaxations that are tighter than this convex barrier have been recently introduced, but their complexity hinders applicability.
Revised: Relaxations that are tighter than this convex barrier have been recently introduced, but their complexity hinders applicability.

Original: We have presented Active Set, a sparse dual solver for one such relaxation, and empirically demonstrated that it yields signiﬁcant formal veriﬁcation speed-ups.
Revised: We have presented Active Set, a sparse dual solver for one such relaxation, and empirically demonstrated that it yields signiﬁcant formal veriﬁcation speed-ups.

Original: Our results show that scalable tightness is key to the efﬁciency of neural network veriﬁcation and instrumental in the deﬁnition of a more appropriate “convex barrier”.
Revised: Our results show that scalable tightness is key to the efﬁciency of neural network veriﬁcation and instrumental in the deﬁnition of a more appropriate “convex barrier”.

Original: We believe that new customised solvers for similarly tight relaxations are a crucial avenue for future research in the area, possibly beyond piecewise-linear networks.
Revised: We believe that new customised solvers for similarly tight relaxations are a crucial avenue for future research in the area, possibly beyond piecewise-linear networks.

Original: Finally, as it is inevitable that tighter bounds will come at a larger computational cost, future veriﬁcation systems will be required to recognise a priori whether tight bounds are needed for a given property.
Revised: Finally, as it is inevitable that tighter bounds will come at a larger computational cost, future veriﬁcation systems will be required to recognise a priori whether tight bounds are needed for a given property.

Original: A possible solution to this problem could rely on learning algorithms
Revised: A possible solution to this problem could rely on learning algorithms

Original: A L IMITATIONS OF P REVIOUS D UAL A PPROACHES
Revised: A L IMITATIONS OF P REVIOUS D UAL A PPROACHES

Original: In this section, we show that previous dual derivations (Bunel et al., 2020a; Dvijotham et al., 2018) violate Fact 1.
Revised: In this section, we show that previous dual derivations (Bunel et al., 2020a; Dvijotham et al., 2018) violate Fact 1.

Original: Therefore, they are not efﬁciently applicable to problem (3), motivating our own derivation in section 3.
Revised: Therefore, they are not efﬁciently applicable to problem (3), motivating our own derivation in section 3.

Original: We start from the approach by Dvijotham et al.
Revised: We start from the approach by Dvijotham et al.

Original: (2018), which relies on relaxing equality constraints (1b), (1c) from the original non-convex problem (1).
Revised: (2018), which relies on relaxing equality constraints (1b), (1c) from the original non-convex problem (1).

Original: Dvijotham et al.
Revised: Dvijotham et al.

Original: (2018) prove that this relaxation corresponds to solving convex problem (2), which is equivalent to the Planet relaxation (Ehlers, 2017), to which the original proof refers.
Revised: (2018) prove that this relaxation corresponds to solving convex problem (2), which is equivalent to the Planet relaxation (Ehlers, 2017), to which the original proof refers.

Original: As we would like to solve tighter problem (3), the derivation is not directly applicable.
Revised: As we would like to solve tighter problem (3), the derivation is not directly applicable.

Original: Relying on intuition from convex analysis applied to duality gaps (Lemar´echal, 2001), we conjecture that relaxing the composition (1c) ◦ (1b) might tighten the primal problem equivalent to the relaxation, obtaining the following dual:
Revised: Relying on intuition from convex analysis applied to duality gaps (Lemar´echal, 2001), we conjecture that relaxing the composition (1c) ◦ (1b) might tighten the primal problem equivalent to the relaxation, obtaining the following dual:

Original: [Equation]
Revised: [Equation]

Original: Unfortunately dual (12) requires an LP (the inner minimisation over x , which in this case does not decompose over layers) to be solved exactly to obtain a supergradient and any time a valid bound is needed.
Revised: Unfortunately dual (12) requires an LP (the inner minimisation over x , which in this case does not decompose over layers) to be solved exactly to obtain a supergradient and any time a valid bound is needed.

Original: This is markedly different from the original dual by Dvijotham et al.
Revised: This is markedly different from the original dual by Dvijotham et al.

Original: (2018), which had an efﬁcient closed-form for the inner problems.
Revised: (2018), which had an efﬁcient closed-form for the inner problems.

Original: The derivation by Bunel et al.
Revised: The derivation by Bunel et al.

Original: (2020a), instead, operates by substituting (1c) with its convex hull and solving its Lagrangian Decomposition dual.
Revised: (2020a), instead, operates by substituting (1c) with its convex hull and solving its Lagrangian Decomposition dual.

Original: The Decomposition dual for the convex hull of (1c) ◦ (1b) (i.e., A k ) takes the following form:
Revised: The Decomposition dual for the convex hull of (1c) ◦ (1b) (i.e., A k ) takes the following form:

Original: [Equation]
Revised: [Equation]

Original: where A dec ,k corresponds to A k with the following substitutions: x k → x B,k , and ˆx k
Revised: where A dec ,k corresponds to A k with the following substitutions: x k → x B,k , and ˆx k

Original: →
Revised: →

Original: W n x A,n − 1 + b n .
Revised: W n x A,n − 1 + b n .

Original: It can be easily seen that the inner problems (the inner minimisation over x A,k , x B,k , for each layer k > 0 ) are an exponentially sized LP.
Revised: It can be easily seen that the inner problems (the inner minimisation over x A,k , x B,k , for each layer k > 0 ) are an exponentially sized LP.

Original: Again, this differs from the original dual on the Planet relaxation (Bunel et al., 2020a), which had an efﬁcient closed-form for the inner problems.
Revised: Again, this differs from the original dual on the Planet relaxation (Bunel et al., 2020a), which had an efﬁcient closed-form for the inner problems.

Original: B D UAL I NITIALISATION
Revised: B D UAL I NITIALISATION

Original: Algorithm
Revised: Algorithm

Original: 1: function BIGM COMPUTE BOUNDS ( { W k , b k , l k , u k , ˆ l k , ˆ u k } k =1 ..n ) 2:
Revised: 1: function BIGM COMPUTE BOUNDS ( { W k , b k , l k , u k , ˆ l k , ˆ u k } k =1 ..n ) 2:

Original: Initialise duals α 0 , β 0 M using interval propagation bounds (Gowal et al., 2018) 3: for t ∈ (cid:74) 1 , T − 1 (cid:75) do 4: x ∗ , z ∗ ∈ argmin x , z L M ( x , z , α t , β t M ) using (16)-(17) 5:
Revised: Initialise duals α 0 , β 0 M using interval propagation bounds (Gowal et al., 2018) 3: for t ∈ (cid:74) 1 , T − 1 (cid:75) do 4: x ∗ , z ∗ ∈ argmin x , z L M ( x , z , α t , β t M ) using (16)-(17) 5:

Original: Compute supergradient using (18) 6: α t +1 , β t +1 M ← Adam’s update rule (Kingma & Ba, 2015) 7: α t +1 , β t +1 M ← max( α t +1 , 0) , max( β t +1 M , 0) (dual projection) 8: end for 9: return min x , z L M ( x , z , α T , β T M ) 10: end function
Revised: Compute supergradient using (18) 6: α t +1 , β t +1 M ← Adam’s update rule (Kingma & Ba, 2015) 7: α t +1 , β t +1 M ← max( α t +1 , 0) , max( β t +1 M , 0) (dual projection) 8: end for 9: return min x , z L M ( x , z , α T , β T M ) 10: end function

Original: As shown in section 3, our Active Set solver yields a dual solver for the Big-M relaxation (2) if the active set B is kept empty throughout execution.
Revised: As shown in section 3, our Active Set solver yields a dual solver for the Big-M relaxation (2) if the active set B is kept empty throughout execution.

Original: As indeed B = ∅ for the ﬁrst Active Set iterations (see algorithm 2 in section D), the Big-M solver can be thought of as dual initialisation.
Revised: As indeed B = ∅ for the ﬁrst Active Set iterations (see algorithm 2 in section D), the Big-M solver can be thought of as dual initialisation.

Original: Furthermore, we demonstrate experimentally in § 5 that, when used as a stand-alone solver, our Big-M solver is competitive with previous dual algorithms for problem (2).
Revised: Furthermore, we demonstrate experimentally in § 5 that, when used as a stand-alone solver, our Big-M solver is competitive with previous dual algorithms for problem (2).

Original: The goal of this section is to explicitly describe the Big-M solver, which is summarised in algorithm 1.
Revised: The goal of this section is to explicitly describe the Big-M solver, which is summarised in algorithm 1.

Original: We point out that, in the notation of restricted variable sets from section 3.1, β M := β ∅ .
Revised: We point out that, in the notation of restricted variable sets from section 3.1, β M := β ∅ .

Original: We now describe the equivalence between the Big-M and Planet relaxations, before presenting the solver in section B.3 and the dual it operates on in section B.2.
Revised: We now describe the equivalence between the Big-M and Planet relaxations, before presenting the solver in section B.3 and the dual it operates on in section B.2.

Original: B. E QUIVALENCE TO P LANET
Revised: B. E QUIVALENCE TO P LANET

Original: As previously shown (Bunel et al., 2018), the Big-M relaxation ( M k , when considering the k -th layer only) in problem (2) is equivalent to the Planet relaxation by Ehlers (2017).
Revised: As previously shown (Bunel et al., 2018), the Big-M relaxation ( M k , when considering the k -th layer only) in problem (2) is equivalent to the Planet relaxation by Ehlers (2017).

Original: Then, due to strong duality, our Big-M solver (section B.2) and the solvers by Bunel et al.
Revised: Then, due to strong duality, our Big-M solver (section B.2) and the solvers by Bunel et al.

Original: (2020a)
Revised: (2020a)

Original: ; Dvijotham et al.
Revised: ; Dvijotham et al.

Original: (2018) will all converge to the bounds from the solution of problem (2).
Revised: (2018) will all converge to the bounds from the solution of problem (2).

Original: In fact, the Decompositionbased method (Bunel et al., 2020a) directly operates on the Planet relaxation, while Dvijotham et al.
Revised: In fact, the Decompositionbased method (Bunel et al., 2020a) directly operates on the Planet relaxation, while Dvijotham et al.

Original: (2018) prove that their dual is equivalent to doing so.
Revised: (2018) prove that their dual is equivalent to doing so.

Original: On the k -th layer, the Planet relaxation takes the following form:
Revised: On the k -th layer, the Planet relaxation takes the following form:

Original: [Equation]
Revised: [Equation]

Original: It can be seen that P k
Revised: It can be seen that P k

Original: =
Revised: =

Original: Proj x , ˆx ( M k ) , where Proj x , ˆx denotes projection on the x , ˆx hyperplane.
Revised: Proj x , ˆx ( M k ) , where Proj x , ˆx denotes projection on the x , ˆx hyperplane.

Original: In fact, as z k does not appear in the objective of the primal formulation (2), but only in the constraints, this means assigning it the value that allows the largest possible feasible region.
Revised: In fact, as z k does not appear in the objective of the primal formulation (2), but only in the constraints, this means assigning it the value that allows the largest possible feasible region.

Original: This is trivial for passing or blocking ReLUs.
Revised: This is trivial for passing or blocking ReLUs.

Original: For the ambiguous case, instead, Figure 4 (on a single ReLU) shows that z k
Revised: For the ambiguous case, instead, Figure 4 (on a single ReLU) shows that z k

Original: = ˆ x k − ˆ l k ˆ u k − ˆ l k is the correct assignment.
Revised: = ˆ x k − ˆ l k ˆ u k − ˆ l k is the correct assignment.

Original: B. B IG -M D UAL
Revised: B. B IG -M D UAL

Original: As evident from problem (3), A k ⊆ M k .
Revised: As evident from problem (3), A k ⊆ M k .

Original: If we relax all constraints in M k (except, again, the box constraints), we are going to obtain a dual with a strict subset of the variables in problem (6).
Revised: If we relax all constraints in M k (except, again, the box constraints), we are going to obtain a dual with a strict subset of the variables in problem (6).

Original: The
Revised: The

Original: Big-M dual is a speciﬁc instance of the Active Set dual (8) where B = ∅ , and it takes the following
Revised: Big-M dual is a speciﬁc instance of the Active Set dual (8) where B = ∅ , and it takes the following

Original: [Figure]
Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: B. B IG -M SOLVER
Revised: B. B IG -M SOLVER

Original: We initialise dual variables from interval propagation bounds (Gowal et al., 2018): this can be easily done by setting all dual variables except α n to 0 .
Revised: We initialise dual variables from interval propagation bounds (Gowal et al., 2018): this can be easily done by setting all dual variables except α n to 0 .

Original: Then, we can maximize d M ( α , β ) via projected supergradient ascent, exactly as described in section 3.1 on a generic active set B .
Revised: Then, we can maximize d M ( α , β ) via projected supergradient ascent, exactly as described in section 3.1 on a generic active set B .

Original: All the computations in the solver follow from keeping B = ∅ in § 3.1.
Revised: All the computations in the solver follow from keeping B = ∅ in § 3.1.

Original: We explicitly report them here for the reader’s convenience
Revised: We explicitly report them here for the reader’s convenience

Original: [Equation]
Revised: [Equation]

Original: Let us deﬁne the following shorthand for the primal coefﬁcients:
Revised: Let us deﬁne the following shorthand for the primal coefﬁcients:

Original: [Equation]
Revised: [Equation]

Original: The minimisation of the Lagrangian L M ( x , z , α , β ) over the primals for k ∈ (cid:74) 1 , n − 1 (cid:75) is as follows:
Revised: The minimisation of the Lagrangian L M ( x , z , α , β ) over the primals for k ∈ (cid:74) 1 , n − 1 (cid:75) is as follows:

Original: [Equation]
Revised: [Equation]

Original: For k = 0 , instead (assuming, as § 3.1 that this can be done efﬁciently):
Revised: For k = 0 , instead (assuming, as § 3.1 that this can be done efﬁciently):

Original: [Equation]
Revised: [Equation]

Original: The supergradient over the Big-M dual variables α , β k, 0 , β k, 1 is computed exactly as in § 3.1 and is again a subset of the supergradient of the full dual problem (6).
Revised: The supergradient over the Big-M dual variables α , β k, 0 , β k, 1 is computed exactly as in § 3.1 and is again a subset of the supergradient of the full dual problem (6).

Original: We report it for completeness.
Revised: We report it for completeness.

Original: For each k ∈ (cid:74) 0 , n − 1 (cid:75) :
Revised: For each k ∈ (cid:74) 0 , n − 1 (cid:75) :

Original: [Equation]
Revised: [Equation]

Original: C D UAL D ERIVATIONS
Revised: C D UAL D ERIVATIONS

Original: We now derive problem (6), the dual of the full relaxation by Anderson et al.
Revised: We now derive problem (6), the dual of the full relaxation by Anderson et al.

Original: (2020) described in equation (3).
Revised: (2020) described in equation (3).

Original: The Active Set (equation (8)) and Big-M duals (equation (15)) can be obtained by removing β k,I k ∀
Revised: The Active Set (equation (8)) and Big-M duals (equation (15)) can be obtained by removing β k,I k ∀

Original: I k ∈ E k \ B k and β k,I k ∀ I k ∈ E k ,
Revised: I k ∈ E k \ B k and β k,I k ∀ I k ∈ E k ,

Original: respectively.
Revised: respectively.

Original: We employ the following
Revised: We employ the following

Original: Lagrangian multipliers:
Revised: Lagrangian multipliers:

Original: [Equation]
Revised: [Equation]

Original: z k ⇒ β k, 0 , x k ≤ ˆx k − ˆ l k (cid:12) (1 − z k ) ⇒ β k, 1 , x k ≤   ( W k (cid:12) I k ) x
Revised: z k ⇒ β k, 0 , x k ≤ ˆx k − ˆ l k (cid:12) (1 − z k ) ⇒ β k, 1 , x k ≤   ( W k (cid:12) I k ) x

Original: k − 1 + z k (cid:12) b
Revised: k − 1 + z k (cid:12) b

Original: k − (cid:0) W k
Revised: k − (cid:0) W k

Original: (cid:12)
Revised: (cid:12)

Original: I k (cid:12)
Revised: I k (cid:12)

Original: ˇ L k − 1 (cid:1) (1 − z k ) + (cid:0) W k (cid:12) (1 − I k ) (cid:12) ˇ U k − 1 (cid:1)
Revised: ˇ L k − 1 (cid:1) (1 − z k ) + (cid:0) W k (cid:12) (1 − I k ) (cid:12) ˇ U k − 1 (cid:1)

Original: z k  
Revised: z k  

Original: ⇒ β k,I k ,
Revised: ⇒ β k,I k ,

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Let us use (cid:80) I k as shorthand for (cid:80) I
Revised: Let us use (cid:80) I k as shorthand for (cid:80) I

Original: k ∈E k ∪{
Revised: k ∈E k ∪{

Original: [Equation]
Revised: [Equation]

Original: If we collect the terms with respect to the primal variables and employ dummy variables α 0 = 0 , β
Revised: If we collect the terms with respect to the primal variables and employ dummy variables α 0 = 0 , β

Original: [Equation]
Revised: [Equation]

Original: = 0 , α n =
Revised: = 0 , α n =

Original: I , β n =
Revised: I , β n =

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: x k − (cid:80) n
Revised: x k − (cid:80) n

Original: [Equation]
Revised: [Equation]

Original: 1 k =   (cid:80)
Revised: 1 k =   (cid:80)

Original: I k ∈E k β k,I k (cid:12)
Revised: I k ∈E k β k,I k (cid:12)

Original: b k
Revised: b k

Original: [Equation]
Revised: [Equation]

Original: β k, 1 (cid:12) ˆ l k + β k, 0 (cid:12) ˆ u k + (cid:80)
Revised: β k, 1 (cid:12) ˆ l k + β k, 0 (cid:12) ˆ u k + (cid:80)

Original: I
Revised: I

Original: k ∈E k (cid:0) W k
Revised: k ∈E k (cid:0) W k

Original: (cid:12)
Revised: (cid:12)

Original: I k (cid:12)
Revised: I k (cid:12)

Original: ˇ L k − 1 (cid:1) β k,I k + (cid:80) I
Revised: ˇ L k − 1 (cid:1) β k,I k + (cid:80) I

Original: k ∈E k (cid:0) W k
Revised: k ∈E k (cid:0) W k

Original: (cid:12) (1 − I k ) (cid:12) ˇ
Revised: (cid:12) (1 − I k ) (cid:12) ˇ

Original: U k − 1 (cid:1) β k,I k  
Revised: U k − 1 (cid:1) β k,I k  

Original: T z k
Revised: T z k

Original: + (cid:80) n
Revised: + (cid:80) n

Original: [Equation]
Revised: [Equation]

Original: 1 k
Revised: 1 k

Original: [Equation]
Revised: [Equation]

Original: k
Revised: k

Original: [Equation]
Revised: [Equation]

Original: (cid:80) n
Revised: (cid:80) n

Original: [Equation]
Revised: [Equation]

Original: 1 k
Revised: 1 k

Original: [Equation]
Revised: [Equation]

Original: 1 (cid:80) I k ∈E k
Revised: 1 (cid:80) I k ∈E k

Original: ( W k (cid:12) I k (cid:12)
Revised: ( W k (cid:12) I k (cid:12)

Original: [Equation]
Revised: [Equation]

Original: L k
Revised: L k

Original: [Equation]
Revised: [Equation]

Original: 1 ) T β k,I k
Revised: 1 ) T β k,I k

Original: [Equation]
Revised: [Equation]

Original: β k, 1 (cid:12) (ˆ l k − b k ) which corresponds to the form shown in problem (6).
Revised: β k, 1 (cid:12) (ˆ l k − b k ) which corresponds to the form shown in problem (6).

Original: D I MPLEMENTATION D ETAILS FOR A CTIVE S ET M ETHOD
Revised: D I MPLEMENTATION D ETAILS FOR A CTIVE S ET M ETHOD

Original: From the high-level perspective, our Active Set solver proceeds by repeatedly solving modiﬁed instances of problem (6), where the exponential set E k is replaced by a ﬁxed (small) set of active variables B .
Revised: From the high-level perspective, our Active Set solver proceeds by repeatedly solving modiﬁed instances of problem (6), where the exponential set E k is replaced by a ﬁxed (small) set of active variables B .

Original: The full solver procedure is summarised in algorithm 2.
Revised: The full solver procedure is summarised in algorithm 2.

Original: Algorithm
Revised: Algorithm

Original: 1: function ACTIVESET COMPUTE BOUNDS ( { W k , b k , l k , u k , ˆ l k , ˆ u k } k =1 ..n ) 2:
Revised: 1: function ACTIVESET COMPUTE BOUNDS ( { W k , b k , l k , u k , ˆ l k , ˆ u k } k =1 ..n ) 2:

Original: Initialise duals α 0 , β 00 , β 01 using Algorithm (1) 3:
Revised: Initialise duals α 0 , β 00 , β 01 using Algorithm (1) 3:

Original: Set β k,I k
Revised: Set β k,I k

Original: = 0 , ∀
Revised: = 0 , ∀

Original: I k ∈ E k 4:
Revised: I k ∈ E k 4:

Original: B = ∅ 5: for nb additions do 6: for t ∈ (cid:74) 1 , T − 1 (cid:75) do 7: x ∗ , z ∗ ∈ argmin x , z L B ( x , z , α t , β t B ) using (9),(10) 8: if t ≤ nb vars to add then 9:
Revised: B = ∅ 5: for nb additions do 6: for t ∈ (cid:74) 1 , T − 1 (cid:75) do 7: x ∗ , z ∗ ∈ argmin x , z L B ( x , z , α t , β t B ) using (9),(10) 8: if t ≤ nb vars to add then 9:

Original: For each layer k , add output of (4) called at ( x ∗ , z ∗ ) to B k 10: end if 11:
Revised: For each layer k , add output of (4) called at ( x ∗ , z ∗ ) to B k 10: end if 11:

Original: Compute supergradient using (11) 12: α t +1 , β t +1 B ← Adam’s update rule (Kingma & Ba, 2015) 13: α t +1 , β t +1 B ← max( α t +1 , 0) , max( β t +1 B , 0) (dual projection) 14: end for 15: end for 16: return min x , z L B ( x , z , α T , β T B ) 17: end function
Revised: Compute supergradient using (11) 12: α t +1 , β t +1 B ← Adam’s update rule (Kingma & Ba, 2015) 13: α t +1 , β t +1 B ← max( α t +1 , 0) , max( β t +1 B , 0) (dual projection) 14: end for 15: end for 16: return min x , z L B ( x , z , α T , β T B ) 17: end function

Original: We conclude this section by proving the primal interpretation of the selection criterion for adding a new set of variables to B .
Revised: We conclude this section by proving the primal interpretation of the selection criterion for adding a new set of variables to B .

Original: D. A CTIVE S ET S ELECTION C RITERION
Revised: D. A CTIVE S ET S ELECTION C RITERION

Original: We map a restricted set of dual variables β B to a set of dual variables β for the full dual (6) by setting variables not in the active set to 0 : β ¯ B = 0 , and β = β B ∪ β ¯ B .
Revised: We map a restricted set of dual variables β B to a set of dual variables β for the full dual (6) by setting variables not in the active set to 0 : β ¯ B = 0 , and β = β B ∪ β ¯ B .

Original: Proposition.
Revised: Proposition.

Original: Let β k,I ∗ k be the set of dual variables maximising the corresponding entries of the supergradient of the full dual problem (6) : β k,I ∗ k ∈ argmax β k,Ik {∇ β k,Ik d
Revised: Let β k,I ∗ k be the set of dual variables maximising the corresponding entries of the supergradient of the full dual problem (6) : β k,I ∗ k ∈ argmax β k,Ik {∇ β k,Ik d

Original: ( α , β ) T 1 } .
Revised: ( α , β ) T 1 } .

Original: β k,I ∗ k represents the Lagrangian multipliers associated to the most violated constraints from A k at ( x ∗ , z ∗ ) ∈ argmin x , z L B ( x , z , α , β B ) , the primal minimiser of the current restricted Lagrangian.
Revised: β k,I ∗ k represents the Lagrangian multipliers associated to the most violated constraints from A k at ( x ∗ , z ∗ ) ∈ argmin x , z L B ( x , z , α , β B ) , the primal minimiser of the current restricted Lagrangian.

Original: Proof.
Revised: Proof.

Original: In the following, ( x ∗ , z ∗ ) denotes the points introduced in the statement.
Revised: In the following, ( x ∗ , z ∗ ) denotes the points introduced in the statement.

Original: Recall the deﬁnition of ∇ β k,Ik d
Revised: Recall the deﬁnition of ∇ β k,Ik d

Original: ( α , β ) in equation (9), which applies beyond the current active set:
Revised: ( α , β ) in equation (9), which applies beyond the current active set:

Original: [Equation]
Revised: [Equation]

Original: We want to compute I ∗ k ∈ argmax
Revised: We want to compute I ∗ k ∈ argmax

Original: I k {∇ β k,Ik d ( α , β ) T 1 }
Revised: I k {∇ β k,Ik d ( α , β ) T 1 }

Original: [Equation]
Revised: [Equation]

Original: that is:
Revised: that is:

Original: [Equation]
Revised: [Equation]

Original: By removing the terms that do not depend on I k
Revised: By removing the terms that do not depend on I k

Original: [Equation]
Revised: [Equation]

Original: we obtain:
Revised: we obtain:

Original: [Equation]
Revised: [Equation]

Original: Let us denote the i -th row of W k and I k by w i,k and i
Revised: Let us denote the i -th row of W k and I k by w i,k and i

Original: i,k , respectively, and deﬁne E k
Revised: i,k , respectively, and deﬁne E k

Original: [ i ] = 2 w i,k \ { 0 , 1 } .
Revised: [ i ] = 2 w i,k \ { 0 , 1 } .

Original: The optimisation decomposes over each such row: we thus focus on the optimisation problem for the supergradient’s
Revised: The optimisation decomposes over each such row: we thus focus on the optimisation problem for the supergradient’s

Original: i -th entry.
Revised: i -th entry.

Original: Collecting the mask, we get:
Revised: Collecting the mask, we get:

Original: [Equation]
Revised: [Equation]

Original: As the solution to the problem above is obtained by setting I ∗ k
Revised: As the solution to the problem above is obtained by setting I ∗ k

Original: [ i, j ] = 1 if its coefﬁcient is positive and I ∗ k
Revised: [ i, j ] = 1 if its coefﬁcient is positive and I ∗ k

Original: [ i, j ] = 

Revised: [ i, j ] =

Original: otherwise, we can see that the optimal I k corresponds to calling oracle (4) by
Revised: otherwise, we can see that the optimal I k corresponds to calling oracle (4) by

Original: Anderson et al.
Revised: Anderson et al.

Original: (2020) on ( x ∗ , z ∗ ) .
Revised: (2020) on ( x ∗ , z ∗ ) .

Original: Hence, in addition to being the mask associated to β k,I ∗ k , the variable set maximising the supergradient, I ∗ k corresponds to the most violated constraint from A k at ( x ∗ , z ∗ ) .
Revised: Hence, in addition to being the mask associated to β k,I ∗ k , the variable set maximising the supergradient, I ∗ k corresponds to the most violated constraint from A k at ( x ∗ , z ∗ ) .

Original: E I NTERMEDIATE B OUNDS
Revised: E I NTERMEDIATE B OUNDS

Original: A crucial quantity in both ReLU relaxations ( M k and A k ) are intermediate pre-activation bounds ˆ l k , ˆ u k .
Revised: A crucial quantity in both ReLU relaxations ( M k and A k ) are intermediate pre-activation bounds ˆ l k , ˆ u k .

Original: In practice, they are computed by solving a relaxation C k (which might be M k , A k , or something looser) of (1) over subsets of the network (Bunel et al., 2020a).
Revised: In practice, they are computed by solving a relaxation C k (which might be M k , A k , or something looser) of (1) over subsets of the network (Bunel et al., 2020a).

Original: For ˆ l i , this means solving the following problem (separately, for each entry
Revised: For ˆ l i , this means solving the following problem (separately, for each entry

Original: ˆ l i [ j ] ):
Revised: ˆ l i [ j ] ):

Original: [Equation]
Revised: [Equation]

Original: As (19) needs to be solved twice for each neuron (lower and upper bounds, changing the sign of the last layer’s weights) rather than once as in (3), depending on the computational budget, C k might be looser than the relaxation employed for the last layer bounds (in our case, A k ).
Revised: As (19) needs to be solved twice for each neuron (lower and upper bounds, changing the sign of the last layer’s weights) rather than once as in (3), depending on the computational budget, C k might be looser than the relaxation employed for the last layer bounds (in our case, A k ).

Original: In all our experiments, we compute intermediate bounds as the tightest bounds between the method by Wong & Kolter (2018) and Interval Propagation (Gowal et al., 2018).
Revised: In all our experiments, we compute intermediate bounds as the tightest bounds between the method by Wong & Kolter (2018) and Interval Propagation (Gowal et al., 2018).

Original: Once pre-activation bounds are available, post-activation bounds can be simply computed as l k = max(ˆ l k , 0) , u k = max(ˆ u k , 0) .
Revised: Once pre-activation bounds are available, post-activation bounds can be simply computed as l k = max(ˆ l k , 0) , u k = max(ˆ u k , 0) .

Original: F P RE - ACTIVATION B OUNDS IN A k
Revised: F P RE - ACTIVATION B OUNDS IN A k

Original: We now highlight the importance of an explicit treatment of pre-activation bounds in the context of the relaxation by Anderson et al.
Revised: We now highlight the importance of an explicit treatment of pre-activation bounds in the context of the relaxation by Anderson et al.

Original: In § F.1 we will show through an example that, without a separate pre-activation bounds treatment, A k could be looser than the less computationally expensive M k relaxation.
Revised: In § F.1 we will show through an example that, without a separate pre-activation bounds treatment, A k could be looser than the less computationally expensive M k relaxation.

Original: We then ( § F.2) justify our speciﬁc pre-activation bounds treatment by extending the original proof by Anderson et al.
Revised: We then ( § F.2) justify our speciﬁc pre-activation bounds treatment by extending the original proof by Anderson et al.

Original: The original formulation by Anderson et al.
Revised: The original formulation by Anderson et al.

Original: (2020) is the following:
Revised: (2020) is the following:

Original: [Equation]
Revised: [Equation]

Original: The difference with respect to A k as deﬁned in equation (3) exclusively lies in the treatment of pre-activation bounds.
Revised: The difference with respect to A k as deﬁned in equation (3) exclusively lies in the treatment of pre-activation bounds.

Original: While A k explicitly employs generic ˆ l k , ˆ u k in the constraint set via M k , A (cid:48)
Revised: While A k explicitly employs generic ˆ l k , ˆ u k in the constraint set via M k , A (cid:48)

Original: k implicitly sets ˆ l k , ˆ u k to the value dictated by interval propagation bounds (Gowal et al., 2018) via the constraints in I k
Revised: k implicitly sets ˆ l k , ˆ u k to the value dictated by interval propagation bounds (Gowal et al., 2018) via the constraints in I k

Original: = 

Revised: =

Original: and I k
Revised: and I k

Original: = 1 from the exponential family.
Revised: = 1 from the exponential family.

Original: In fact, setting I k = 

Revised: In fact, setting I k =

Original: and I k
Revised: and I k

Original: = 1 , we obtain the following two constraints:
Revised: = 1 , we obtain the following two constraints:

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: which correspond to the upper bounding ReLU constraints in M k if we set ˆ l k → M − k , ˆ u k → M
Revised: which correspond to the upper bounding ReLU constraints in M k if we set ˆ l k → M − k , ˆ u k → M

Original: [Equation]
Revised: [Equation]

Original: k .
Revised: k .

Original: While ˆ l k , ˆ u k are (potentially) computed solving an optimisation problem over the entire network (problem 19), the optimisation for M − k , M + k involves only the layer before the current.
Revised: While ˆ l k , ˆ u k are (potentially) computed solving an optimisation problem over the entire network (problem 19), the optimisation for M − k , M + k involves only the layer before the current.

Original: Therefore, the constraints in (21) might be much looser than those in M k .
Revised: Therefore, the constraints in (21) might be much looser than those in M k .

Original: In practice, the effect of ˆ l k
Revised: In practice, the effect of ˆ l k

Original: [ i ] , ˆ u k
Revised: [ i ] , ˆ u k

Original: [ i ] on the resulting set is so signiﬁcant that M k might yield better bounds than A (cid:48)
Revised: [ i ] on the resulting set is so signiﬁcant that M k might yield better bounds than A (cid:48)

Original: k , even on very small networks.
Revised: k , even on very small networks.

Original: We now provide a simple example.
Revised: We now provide a simple example.

Original: F. M OTIVATING E XAMPLE
Revised: F. M OTIVATING E XAMPLE

Original: [Equation]
Revised: [Equation]

Original: Output
Revised: Output

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: 1) (1) +
Revised: 1) (1) +

Original: [Figure]
Revised: [Figure]

Original: ( − 1) ( − 1)
Revised: ( − 1) ( − 1)

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: ) ( −
Revised: ) ( −

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: ) ( − 1)
Revised: ) ( − 1)

Original: Figure 5 illustrates the network architecture.
Revised: Figure 5 illustrates the network architecture.

Original: The size of the network is the minimal required to reproduce the phenomenon.
Revised: The size of the network is the minimal required to reproduce the phenomenon.

Original: M k and A k coincide for single-neuron layers (Anderson et al., 2020), and ˆ l k
Revised: M k and A k coincide for single-neuron layers (Anderson et al., 2020), and ˆ l k

Original: =
Revised: =

Original: M − k , ˆ u k = M + k on the ﬁrst hidden layer (hence, a second layer is needed).
Revised: M − k , ˆ u k = M + k on the ﬁrst hidden layer (hence, a second layer is needed).

Original: Let us write the example network as a (not yet relaxed, as in problem (1)) optimization problem for the lower bound on the output node x 3 .
Revised: Let us write the example network as a (not yet relaxed, as in problem (1)) optimization problem for the lower bound on the output node x 3 .

Original: [Equation]
Revised: [Equation]

Original: 22a
Revised: 22a

Original: [Equation]
Revised: [Equation]

Original: (22b
Revised: (22b

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: max
Revised: max

Original: [Equation]
Revised: [Equation]

Original: ) (22c)
Revised: ) (22c)

Original: [Equation]
Revised: [Equation]

Original: ) (22d)
Revised: ) (22d)

Original: [Equation]
Revised: [Equation]

Original: (22e)
Revised: (22e)

Original: Let us compute pre-activation bounds with C k
Revised: Let us compute pre-activation bounds with C k

Original: = M k (see problem (19)).
Revised: = M k (see problem (19)).

Original: For this network, the ﬁnal output lower bound is tighter if the employed relaxation is M k rather than A k (hence, in this case,
Revised: For this network, the ﬁnal output lower bound is tighter if the employed relaxation is M k rather than A k (hence, in this case,

Original: M k ⊂ A (cid:48) k ).
Revised: M k ⊂ A (cid:48) k ).

Original: Speciﬁcally: ˆ l 3 , A (cid:48)
Revised: Speciﬁcally: ˆ l 3 , A (cid:48)

Original: k
Revised: k

Original: = − 1 .
Revised: = − 1 .

Original: ˆ l 3 , M k = − 1 . 2273 .
Revised: ˆ l 3 , M k = − 1 . 2273 .

Original: In fact:
Revised: In fact:

Original: • In order to compute l 1 and u 1 , the post-activation bounds of the ﬁrst-layer, it sufﬁces to solve a box-constrained linear program for ˆ l 1 and ˆ u 1 , which at this layer coincide with interval propagation bounds, and to clip them to be non-negative.
Revised: • In order to compute l 1 and u 1 , the post-activation bounds of the ﬁrst-layer, it sufﬁces to solve a box-constrained linear program for ˆ l 1 and ˆ u 1 , which at this layer coincide with interval propagation bounds, and to clip them to be non-negative.

Original: This yields l 1 = [0 0] T , u 1 = [1 3] T .
Revised: This yields l 1 = [0 0] T , u 1 = [1 3] T .

Original: • Computing M + 2 [1] = max x 1 ∈
Revised: • Computing M + 2 [1] = max x 1 ∈

Original: [ l 1 , u 1 ] [ − 2 1] x 1 = 3 we are assuming that x 1 [0] =
Revised: [ l 1 , u 1 ] [ − 2 1] x 1 = 3 we are assuming that x 1 [0] =

Original: l 1 [0] and x 1 [1] = u 1 [1] .
Revised: l 1 [0] and x 1 [1] = u 1 [1] .

Original: These two assignments are in practice conﬂicting, as they imply different values for x 0 .
Revised: These two assignments are in practice conﬂicting, as they imply different values for x 0 .

Original: Speciﬁcally, x 1 [1] = u 1 [1] requires x 0 =
Revised: Speciﬁcally, x 1 [1] = u 1 [1] requires x 0 =

Original: [ u 0 [0] l 0 [1]]
Revised: [ u 0 [0] l 0 [1]]

Original: =
Revised: =

Original: [1 − 1] , but this would also imply x 1 [0]
Revised: [1 − 1] , but this would also imply x 1 [0]

Original: = u 1 [0] , yielding ˆx 2 [1] = 1 (cid:54) = 3 .
Revised: = u 1 [0] , yielding ˆx 2 [1] = 1 (cid:54) = 3 .

Original: Therefore, explicitly solving a LP relaxation of the network for the value of ˆ u 2 [1] will tighten the bound.
Revised: Therefore, explicitly solving a LP relaxation of the network for the value of ˆ u 2 [1] will tighten the bound.

Original: Using M k , the LP for this intermediate pre-activation bound is:
Revised: Using M k , the LP for this intermediate pre-activation bound is:

Original: [Equation]
Revised: [Equation]

Original: Yielding ˆ u 2 [1] = 2 .
Revised: Yielding ˆ u 2 [1] = 2 .

Original: 25 < 3 =
Revised: 25 < 3 =

Original: M +2 [1] .
Revised: M +2 [1] .

Original: An analogous reasoning holds for M − 2 [1] and
Revised: An analogous reasoning holds for M − 2 [1] and

Original: ˆ
Revised: ˆ

Original: l 2 [1]
Revised: l 2 [1]

Original: • In M k , we therefore added the following two constraints:
Revised: • In M k , we therefore added the following two constraints:

Original: [Equation]
Revised: [Equation]

Original: that in A (cid:48)
Revised: that in A (cid:48)

Original: k correspond to the weaker:
Revised: k correspond to the weaker:

Original: [Equation]
Revised: [Equation]

Original: As the last layer weight corresponding to x 2 [1] is negative ( W 3 [0 , 1] = − 1 ), these constraints are going to inﬂuence the computation of ˆ l 3 .
Revised: As the last layer weight corresponding to x 2 [1] is negative ( W 3 [0 , 1] = − 1 ), these constraints are going to inﬂuence the computation of ˆ l 3 .

Original: In fact, the constraints in (24) are both active when optimizing for ˆ l 3 , M k , whereas their counterparts for ˆ l 3 , A (cid:48) k in (25) are not
Revised: In fact, the constraints in (24) are both active when optimizing for ˆ l 3 , M k , whereas their counterparts for ˆ l 3 , A (cid:48) k in (25) are not

Original: The only active upper constraint at neuron x 2 [1] for the Anderson relaxation is x 2 [1] ≤ x 1 [1] , corresponding to the constraint from A (cid:48) 2 with
Revised: The only active upper constraint at neuron x 2 [1] for the Anderson relaxation is x 2 [1] ≤ x 1 [1] , corresponding to the constraint from A (cid:48) 2 with

Original: I 2 [1 , · ] =
Revised: I 2 [1 , · ] =

Original: Evidently, its effect is not sufﬁcient to counter-balance the effect of the tighter constraints (24) for I 2 [1 , · ] =
Revised: Evidently, its effect is not sufﬁcient to counter-balance the effect of the tighter constraints (24) for I 2 [1 , · ] =

Original: [1 1] and I 2 [1 , · ] =
Revised: [1 1] and I 2 [1 , · ] =

Original: [0 0] , yielding a weaker lower bound for the network output.
Revised: [0 0] , yielding a weaker lower bound for the network output.

Original: F. D ERIVATION OF A k
Revised: F. D ERIVATION OF A k

Original: Having motivated an explicit pre-activation bounds treatment for the relaxation by Anderson et al.
Revised: Having motivated an explicit pre-activation bounds treatment for the relaxation by Anderson et al.

Original: (2020), we now extend the original proof for A (cid:48) k
Revised: (2020), we now extend the original proof for A (cid:48) k

Original: (equation (20)) to obtain our formulation A k (as deﬁned in equation (3)).
Revised: (equation (20)) to obtain our formulation A k (as deﬁned in equation (3)).

Original: For simplicity, we will operate on a single neuron x k
Revised: For simplicity, we will operate on a single neuron x k

Original: [ i ] .
Revised: [ i ] .

Original: A self-contained way to derive A (cid:48)
Revised: A self-contained way to derive A (cid:48)

Original: k is by applying Fourier-Motzkin elimination on a standard MIP formulation referred to as the multiple choice formulation (Anderson et al., 2019), which is deﬁned as follows:
Revised: k is by applying Fourier-Motzkin elimination on a standard MIP formulation referred to as the multiple choice formulation (Anderson et al., 2019), which is deﬁned as follows:

Original: [Equation]
Revised: [Equation]

Original: Where w i,k denotes the i -th row of W k , and x 1 k − 1 and x 0 k − 1 are copies of the previous layer variables.
Revised: Where w i,k denotes the i -th row of W k , and x 1 k − 1 and x 0 k − 1 are copies of the previous layer variables.

Original: Applying (26) to the entire neural network results in a quadratic number of variables (relative to the number of neurons).
Revised: Applying (26) to the entire neural network results in a quadratic number of variables (relative to the number of neurons).

Original: The formulation can be obtained from well-known techniques from the
Revised: The formulation can be obtained from well-known techniques from the

Original: MIP literature (Jeroslow, 1987)
Revised: MIP literature (Jeroslow, 1987)

Original: (it is the union of the two polyhedra for a passing and a blocking
Revised: (it is the union of the two polyhedra for a passing and a blocking

Original: ReLU, operating in the space of x k − 1 ).
Revised: ReLU, operating in the space of x k − 1 ).

Original: Anderson et al.
Revised: Anderson et al.

Original: (2019) show that A (cid:48) k
Revised: (2019) show that A (cid:48) k

Original: = Proj x
Revised: = Proj x

Original: [Equation]
Revised: [Equation]

Original: If pre-activation bounds ˆ l k , ˆ u k (computed as described in section E) are available, we can naturally add them to (26) as follows:
Revised: If pre-activation bounds ˆ l k , ˆ u k (computed as described in section E) are available, we can naturally add them to (26) as follows:

Original: [Equation]
Revised: [Equation]

Original: We now prove that this formulation yields A k when projecting out the copies of the activations.
Revised: We now prove that this formulation yields A k when projecting out the copies of the activations.

Original: Proposition.
Revised: Proposition.

Original: Sets S k from equation (27) and A k from problem (3) are equivalent, in the sense that
Revised: Sets S k from equation (27) and A k from problem (3) are equivalent, in the sense that

Original: A k =
Revised: A k =

Original: Proj x k − 1 , x k , z k ( S k ) .
Revised: Proj x k − 1 , x k , z k ( S k ) .

Original: Proof.
Revised: Proof.

Original: In order to prove the equivalence, we will rely on Fourier-Motzkin elimination as in the original Anderson relaxation proof (Anderson et al., 2019).
Revised: In order to prove the equivalence, we will rely on Fourier-Motzkin elimination as in the original Anderson relaxation proof (Anderson et al., 2019).

Original: Going along the lines of the original proof, we start from (26) and eliminate x 1 k − 1 , x 0 k
Revised: Going along the lines of the original proof, we start from (26) and eliminate x 1 k − 1 , x 0 k

Original: [ i ] and x 1 k [ i ] exploiting the equalities.
Revised: [ i ] and x 1 k [ i ] exploiting the equalities.

Original: We then re-write all the inequalities as upper or lower bounds on x 0 k − 1 [0] in order to eliminate this variable.
Revised: We then re-write all the inequalities as upper or lower bounds on x 0 k − 1 [0] in order to eliminate this variable.

Original: As Anderson et al.
Revised: As Anderson et al.

Original: (2019), we assume w i,k [0] > 0 .
Revised: (2019), we assume w i,k [0] > 0 .

Original: The proof generalizes by using ˇ L and ˇ U for w i,k [0] < 0 , whereas if the coefﬁcient is 0 the variable is easily eliminated.
Revised: The proof generalizes by using ˇ L and ˇ U for w i,k [0] < 0 , whereas if the coefﬁcient is 0 the variable is easily eliminated.

Original: We get the following system:
Revised: We get the following system:

Original: [Equation]
Revised: [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: 28b
Revised: 28b

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: 28c
Revised: 28c

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [ i ]
Revised: [ i ]

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: [ i ])
Revised: [ i ])

Original: [Equation]
Revised: [Equation]

Original: 28d)
Revised: 28d)

Original: [Equation]
Revised: [Equation]

Original: k
Revised: k

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: 1 [0] − l
Revised: 1 [0] − l

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [ i ]
Revised: [ i ]

Original: [Equation]
Revised: [Equation]

Original: 28e)
Revised: 28e)

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [0] ≥
Revised: [0] ≥

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: [ i ]
Revised: [ i ]

Original: [Equation]
Revised: [Equation]

Original: 28f)
Revised: 28f)

Original: [Equation]
Revised: [Equation]

Original: ] 
Revised: ] 

Original: 
Revised: 

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: 
Revised: 

Original: [Equation]
Revised: [Equation]

Original: 
Revised: 

Original: [Equation]
Revised: [Equation]

Original: 
Revised: 

Original: [Equation]
Revised: [Equation]

Original: j
Revised: j

Original: [Equation]
Revised: [Equation]

Original: [ j ] 
Revised: [ j ] 

Original: 
Revised: 

Original: [Equation]
Revised: [Equation]

Original: j
Revised: j

Original: [Equation]
Revised: [Equation]

Original: [ j ] 
Revised: [ j ] 

Original: 
Revised: 

Original: [Equation]
Revised: [Equation]

Original: 28j) where only inequalities (28g) to (28j) are not present in the original proof.
Revised: 28j) where only inequalities (28g) to (28j) are not present in the original proof.

Original: We therefore focus on the part of the Fourier-Motzkin elimination that deals with them, and invite the reader to refer to Anderson et al.
Revised: We therefore focus on the part of the Fourier-Motzkin elimination that deals with them, and invite the reader to refer to Anderson et al.

Original: for the others.
Revised: for the others.

Original: The combination of these new inequalities yields trivial constraints.
Revised: The combination of these new inequalities yields trivial constraints.

Original: For instance:
Revised: For instance:

Original: [Equation]
Revised: [Equation]

Original: which holds by the deﬁnition of pre-activation bounds.
Revised: which holds by the deﬁnition of pre-activation bounds.

Original: Let us recall that x k [ i ] ≥ 0 and x k [ i ] ≥ ˆ x k
Revised: Let us recall that x k [ i ] ≥ 0 and x k [ i ] ≥ ˆ x k

Original: [ i ] , the latter constraint resulting from (28a) + (28b).
Revised: [ i ] , the latter constraint resulting from (28a) + (28b).

Original: Then, it can be easily veriﬁed that the only combinations of interest (i.e., those that do not result in constraints that are obvious by deﬁnition or are implied by other constraints) are those containing the equality (28a).
Revised: Then, it can be easily veriﬁed that the only combinations of interest (i.e., those that do not result in constraints that are obvious by deﬁnition or are implied by other constraints) are those containing the equality (28a).

Original: In particular, combining inequalities (28g) to (28j) with inequalities (28d) to (28f) generates constraints that are (after algebraic manipulations) superﬂuous with respect to those in (30).
Revised: In particular, combining inequalities (28g) to (28j) with inequalities (28d) to (28f) generates constraints that are (after algebraic manipulations) superﬂuous with respect to those in (30).

Original: We are now ready to show the system resulting from the elimination:
Revised: We are now ready to show the system resulting from the elimination:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: l k − 1 [0] ≤ x k [ i ] ≤ u k − 1 [0]
Revised: l k − 1 [0] ≤ x k [ i ] ≤ u k − 1 [0]

Original: [Equation]
Revised: [Equation]

Original: x k [ i ] ≥ ˆ l k
Revised: x k [ i ] ≥ ˆ l k

Original: [ i ] z k [ i ] (30h) x
Revised: [ i ] z k [ i ] (30h) x

Original: [Equation]
Revised: [Equation]

Original: i ] ≤
Revised: i ] ≤

Original: [Equation]
Revised: [Equation]

Original: ] z
Revised: ] z

Original: [Equation]
Revised: [Equation]

Original: i ] (30i) x
Revised: i ] (30i) x

Original: [Equation]
Revised: [Equation]

Original: ≤
Revised: ≤

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: (30j) x
Revised: (30j) x

Original: [Equation]
Revised: [Equation]

Original: ] ≥ ˆx
Revised: ] ≥ ˆx

Original: [Equation]
Revised: [Equation]

Original: ] −
Revised: ] −

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: ]) (30k)
Revised: ]) (30k)

Original: Constraints from (30a) to (30g) are those resulting from the original derivation of A (cid:48)
Revised: Constraints from (30a) to (30g) are those resulting from the original derivation of A (cid:48)

Original: k
Revised: k

Original: (see (Anderson et al., 2019)).
Revised: (see (Anderson et al., 2019)).

Original: The others result from the inclusion of pre-activation bounds in (27).
Revised: The others result from the inclusion of pre-activation bounds in (27).

Original: Of these, (30h) is implied by (30a) if ˆ l k
Revised: Of these, (30h) is implied by (30a) if ˆ l k

Original: [ i ] ≤ 0 and by the deﬁnition of pre-activation bounds (together with (30b))
Revised: [ i ] ≤ 0 and by the deﬁnition of pre-activation bounds (together with (30b))

Original: if ˆ l k [ i ] > 0 .
Revised: if ˆ l k [ i ] > 0 .

Original: Analogously, (30k) is implied by (30b) if ˆ u k [ i ] ≥ 0 and by (30a) otherwise.
Revised: Analogously, (30k) is implied by (30b) if ˆ u k [ i ] ≥ 0 and by (30a) otherwise.

Original: By noting that no auxiliary variable is left in (30i) and in (30j), we can conclude that these will not be affected by the remaining part of the elimination procedure.
Revised: By noting that no auxiliary variable is left in (30i) and in (30j), we can conclude that these will not be affected by the remaining part of the elimination procedure.

Original: Therefore, the rest of the proof
Revised: Therefore, the rest of the proof

Original: (the elimination of x 0 k − 1 [1] , x 0 k − 1 [2] , . . . )
Revised: (the elimination of x 0 k − 1 [1] , x 0 k − 1 [2] , . . . )

Original: proceeds as in (Anderson et al., 2019), leading to A k,i .
Revised: proceeds as in (Anderson et al., 2019), leading to A k,i .

Original: Repeating the proof for each neuron i at layer k , we get A k
Revised: Repeating the proof for each neuron i at layer k , we get A k

Original: =
Revised: =

Original: Proj x k − 1 , x k , z k ( S k ) .
Revised: Proj x k − 1 , x k , z k ( S k ) .

Original: G M ASKED F ORWARD AND B ACKWARD P ASSES
Revised: G M ASKED F ORWARD AND B ACKWARD P ASSES

Original: Crucial to the practical efﬁciency of our solvers is to represent the various operations as standard forward/backward passes over a neural network.
Revised: Crucial to the practical efﬁciency of our solvers is to represent the various operations as standard forward/backward passes over a neural network.

Original: This way, we can leverage the engineering efforts behind popular deep learning frameworks such as PyTorch (Paszke et al., 2017).
Revised: This way, we can leverage the engineering efforts behind popular deep learning frameworks such as PyTorch (Paszke et al., 2017).

Original: While this can be trivially done for the Big-M solver (appendix B), the Active Set method ( § 3.1) requires a specialised operator that we call “masked” forward/backward pass.
Revised: While this can be trivially done for the Big-M solver (appendix B), the Active Set method ( § 3.1) requires a specialised operator that we call “masked” forward/backward pass.

Original: Here, we provide the details to our implementation.
Revised: Here, we provide the details to our implementation.

Original: The masked forward and backward passes respectively take the following forms: ( W k (cid:12) I k ) x k , ( W k (cid:12)
Revised: The masked forward and backward passes respectively take the following forms: ( W k (cid:12) I k ) x k , ( W k (cid:12)

Original: I k ) T x k +

Revised: I k ) T x k +

Original: and they are needed when dealing with the exponential family of constraints from the relaxation by Anderson et al.
Revised: and they are needed when dealing with the exponential family of constraints from the relaxation by Anderson et al.

Original: A crucial property of the operator is that the I k mask may take on a different value for each input/output combination.
Revised: A crucial property of the operator is that the I k mask may take on a different value for each input/output combination.

Original: While this is straightforward to implement for fully connected layers, we need to be more careful when handling convolutional operators, which rely on re-applying the same weights (kernel) to many different parts of the image.
Revised: While this is straightforward to implement for fully connected layers, we need to be more careful when handling convolutional operators, which rely on re-applying the same weights (kernel) to many different parts of the image.

Original: A naive solution is to convert convolutions into equivalent linear operators, but this has a high cost in terms of performance, as it involves much redundancy.
Revised: A naive solution is to convert convolutions into equivalent linear operators, but this has a high cost in terms of performance, as it involves much redundancy.

Original: A convolutional operator can be represented via a matrix-matrix multiplication if the input is unfolded and the ﬁlter is appropriately reshaped.
Revised: A convolutional operator can be represented via a matrix-matrix multiplication if the input is unfolded and the ﬁlter is appropriately reshaped.

Original: The multiplication output can then be reshaped to the correct convolutional output shape.
Revised: The multiplication output can then be reshaped to the correct convolutional output shape.

Original: Given a ﬁlter w ∈ R c × k 1 × k 2 , an input x ∈ R i 1 ×
Revised: Given a ﬁlter w ∈ R c × k 1 × k 2 , an input x ∈ R i 1 ×

Original: i 2 ×
Revised: i 2 ×

Original: i 3 and the convolutional output conv w ( x ) =
Revised: i 3 and the convolutional output conv w ( x ) =

Original: y ∈ R c ×
Revised: y ∈ R c ×

Original: o 2 × o 3 , we need the following deﬁnitions:
Revised: o 2 × o 3 , we need the following deﬁnitions:

Original: [Equation]
Revised: [Equation]

Original: where the brackets simply reshape the vector from shape I to O
Revised: where the brackets simply reshape the vector from shape I to O

Original: [Equation]
Revised: [Equation]

Original: while the braces sum over the j -th dimension.
Revised: while the braces sum over the j -th dimension.

Original: unfold decomposes the input image into the (possibly overlapping) o 2 o 3 blocks the sliding kernel operates on, taking padding and striding into account.
Revised: unfold decomposes the input image into the (possibly overlapping) o 2 o 3 blocks the sliding kernel operates on, taking padding and striding into account.

Original: fold brings the output of unfold to the original input space
Revised: fold brings the output of unfold to the original input space

Original: [Equation]
Revised: [Equation]

Original: Let us deﬁne the following reshaped versions of the ﬁlter and the convolutional output:
Revised: Let us deﬁne the following reshaped versions of the ﬁlter and the convolutional output:

Original: [Equation]
Revised: [Equation]

Original: The standard forward/backward convolution (neglecting the convolutional bias, which can be added at the end of the forward pass) can then be written as:
Revised: The standard forward/backward convolution (neglecting the convolutional bias, which can be added at the end of the forward pass) can then be written as:

Original: [Equation]
Revised: [Equation]

Original: We need to mask the convolution with a different mask for each input-output pair.
Revised: We need to mask the convolution with a different mask for each input-output pair.

Original: This means employing a mask
Revised: This means employing a mask

Original: I ∈ R c × k 1 k 2 ×
Revised: I ∈ R c × k 1 k 2 ×

Original: o 2 o 3 .
Revised: o 2 o 3 .

Original: Therefore, assuming vectors are broadcast to the correct output shape 4 , we can write the masked forward and backward passes as:
Revised: Therefore, assuming vectors are broadcast to the correct output shape 4 , we can write the masked forward and backward passes as:

Original: [Equation]
Revised: [Equation]

Original: Owing to the avoided redundancy with respect to the equivalent linear operation (e.g., copying of the kernel matrix, zero-padding in the linear weight matrix), this implementation of the masked for- ward/backward pass reduces both the memory footprint and the number of ﬂoating point operations (FLOPs) associated to the passes computations by a factor ( i 1 i 2 i 3 ) /
Revised: Owing to the avoided redundancy with respect to the equivalent linear operation (e.g., copying of the kernel matrix, zero-padding in the linear weight matrix), this implementation of the masked for- ward/backward pass reduces both the memory footprint and the number of ﬂoating point operations (FLOPs) associated to the passes computations by a factor ( i 1 i 2 i 3 ) /

Original: ( k 1 k 2 ) .
Revised: ( k 1 k 2 ) .

Original: In practice, this ratio might be signiﬁcant: on the incomplete veriﬁcation networks § 5.1) it ranges from 16 to 64 .
Revised: In practice, this ratio might be signiﬁcant: on the incomplete veriﬁcation networks § 5.1) it ranges from 16 to 64 .

Original: H S TRATIFIED B OUNDING FOR B RANCH AND B OUND
Revised: H S TRATIFIED B OUNDING FOR B RANCH AND B OUND

Original: As seen in the complete veriﬁcation results in Figure 3 ( § 5.2), the use of a tighter bounding algorithm results in the veriﬁcation of a larger number of properties.
Revised: As seen in the complete veriﬁcation results in Figure 3 ( § 5.2), the use of a tighter bounding algorithm results in the veriﬁcation of a larger number of properties.

Original: In general, tighter bounds come at a larger computational cost, which might negatively affect performance on “easy” veriﬁcation properties, where a small number of domain splits with loose bounds sufﬁces to verify the property (hence, the tightness is not needed).
Revised: In general, tighter bounds come at a larger computational cost, which might negatively affect performance on “easy” veriﬁcation properties, where a small number of domain splits with loose bounds sufﬁces to verify the property (hence, the tightness is not needed).

Original: As a general complete veriﬁcation system needs to be efﬁcient a priori, on both easy and hard properties, we employ a stratiﬁed bounding system for use within Branch and
Revised: As a general complete veriﬁcation system needs to be efﬁcient a priori, on both easy and hard properties, we employ a stratiﬁed bounding system for use within Branch and

Original: Bound-like complete veriﬁcation algorithms.
Revised: Bound-like complete veriﬁcation algorithms.

Original: We design a set of heuristics to determine whether the children (i.e., the subproblems arising after splitting on it) of a given subproblem will require tight bounds or not.
Revised: We design a set of heuristics to determine whether the children (i.e., the subproblems arising after splitting on it) of a given subproblem will require tight bounds or not.

Original: The graph describing parentchild relations between sub-problems is referred to as the BaB search tree.
Revised: The graph describing parentchild relations between sub-problems is referred to as the BaB search tree.

Original: Given a problem p , we individually mark it as difﬁcult (with all its future offspring) if it meets all the conditions in the following set:
Revised: Given a problem p , we individually mark it as difﬁcult (with all its future offspring) if it meets all the conditions in the following set:

Original: • The lower bound on the minimum over the subproblem, p LB , should be relatively “close” to the decision threshold ( 0 , in the standard form by Bunel et al.
Revised: • The lower bound on the minimum over the subproblem, p LB , should be relatively “close” to the decision threshold ( 0 , in the standard form by Bunel et al.

Original: That is, p LB ≤ c LB .
Revised: That is, p LB ≤ c LB .

Original: We argue that tighter bounds are worth computing only if they are likely to result in a crossing of the decision threshold, thus cutting away a part of the BaB search tree.
Revised: We argue that tighter bounds are worth computing only if they are likely to result in a crossing of the decision threshold, thus cutting away a part of the BaB search tree.

Original: • The depth p depth in the BaB search tree should not be below a certain threshold c depth .
Revised: • The depth p depth in the BaB search tree should not be below a certain threshold c depth .

Original: This is a way to ensure a certain number of splits is performed before adopting tighter bounds.
Revised: This is a way to ensure a certain number of splits is performed before adopting tighter bounds.

Original: The
Revised: The

Original: running average of the lower bound improvement from parent to child p impr should fall below a threshold c impr .
Revised: running average of the lower bound improvement from parent to child p impr should fall below a threshold c impr .

Original: This reﬂects the idea that if splitting seems to be effective on a given section of the BaB tree, it is perhaps wiser to invest computational budget in more splits (with cheaper bounding computations, more splits can be performed in a given time) than tighter bounds.
Revised: This reﬂects the idea that if splitting seems to be effective on a given section of the BaB tree, it is perhaps wiser to invest computational budget in more splits (with cheaper bounding computations, more splits can be performed in a given time) than tighter bounds.

Original: Empirically, this is the criterion with the largest effect on performance.
Revised: Empirically, this is the criterion with the largest effect on performance.

Original: Additionally, we do not employ tighter bounds unless the veriﬁcation problem itself (in addition to the individual subproblems) is marked as “hard”.
Revised: Additionally, we do not employ tighter bounds unless the veriﬁcation problem itself (in addition to the individual subproblems) is marked as “hard”.

Original: We do so when the size of the un-pruned domains reaches a certain threshold c hard .
Revised: We do so when the size of the un-pruned domains reaches a certain threshold c hard .

Original: The set of criteria above needs to address the following decision trade-off: one should postpone the use of tighter bounds until sure the difﬁculty of the veriﬁcation task requires it.
Revised: The set of criteria above needs to address the following decision trade-off: one should postpone the use of tighter bounds until sure the difﬁculty of the veriﬁcation task requires it.

Original: At the same time, if the switch to tighter bounds is excessively delayed, one might end up computing tight bounds on a large number of subproblems (as sections of the BaB tree were not pruned in time), hurting performance for harder tasks.
Revised: At the same time, if the switch to tighter bounds is excessively delayed, one might end up computing tight bounds on a large number of subproblems (as sections of the BaB tree were not pruned in time), hurting performance for harder tasks.

Original: In practice, we set the criteria as follows for all our experiments: c depth = 0 , c LB = 0 .
Revised: In practice, we set the criteria as follows for all our experiments: c depth = 0 , c LB = 0 .

Original: 5 , c impr = 10 − 1 , c
Revised: 5 , c impr = 10 − 1 , c

Original: hard
Revised: hard

Original: = 200 .
Revised: = 200 .

Original: As seen in Figure 3, this resulted in a reasonable trade-off between losing efﬁciency on the harder properties (wide model) and gaining it on the easier ones (base and deep models).
Revised: As seen in Figure 3, this resulted in a reasonable trade-off between losing efﬁciency on the harder properties (wide model) and gaining it on the easier ones (base and deep models).

Original: I E XPERIMENTAL A PPENDIX
Revised: I E XPERIMENTAL A PPENDIX

Original: We conclude the appendix by presenting supplementary experiments and additional details with respect to the presentation in the main paper.
Revised: We conclude the appendix by presenting supplementary experiments and additional details with respect to the presentation in the main paper.

Original: I. E XPERIMENTAL S ETTING , H YPER - PARAMETERS
Revised: I. E XPERIMENTAL S ETTING , H YPER - PARAMETERS

Original: All the experiments and bounding computations (including intermediate bounds) were run on a single Nvidia Titan Xp GPU, except Gurobi-based methods and “Active Set CPU”.
Revised: All the experiments and bounding computations (including intermediate bounds) were run on a single Nvidia Titan Xp GPU, except Gurobi-based methods and “Active Set CPU”.

Original: These were run on i7-6850K CPUs, utilising 4 cores for the incomplete veriﬁcation experiments, and 6 cores for the more demanding complete veriﬁcation experiments.
Revised: These were run on i7-6850K CPUs, utilising 4 cores for the incomplete veriﬁcation experiments, and 6 cores for the more demanding complete veriﬁcation experiments.

Original: The experiments were run under Ubuntu 16.04.2 LTS.
Revised: The experiments were run under Ubuntu 16.04.2 LTS.

Original: Complete veriﬁcation results for ERAN, the method by Singh et al.
Revised: Complete veriﬁcation results for ERAN, the method by Singh et al.

Original: (2020), are taken from the recent VNN-COMP competition (VNN-COMP, 2020).
Revised: (2020), are taken from the recent VNN-COMP competition (VNN-COMP, 2020).

Original: These were executed by Singh et al.
Revised: These were executed by Singh et al.

Original: (2020) on a 2.6 GHz Intel Xeon CPU E5-2690 with 512 GB of main memory, utilisingcores.
Revised: (2020) on a 2.6 GHz Intel Xeon CPU E5-2690 with 512 GB of main memory, utilisingcores.

Original: Gurobi-based methods make use of LP incrementalism (warm-starting) when possible.
Revised: Gurobi-based methods make use of LP incrementalism (warm-starting) when possible.

Original: In the experiments of § 5.1, where each image involves the computation of 9 different output upper bounds, we warm-start each LP from the LP of the previous neuron.
Revised: In the experiments of § 5.1, where each image involves the computation of 9 different output upper bounds, we warm-start each LP from the LP of the previous neuron.

Original: For “Gurobi 1 cut”, which involves two
Revised: For “Gurobi 1 cut”, which involves two

Original: LPs per neuron, we ﬁrst solve all Big-M LPs, then proceed with the LPs containing a single cut.
Revised: LPs per neuron, we ﬁrst solve all Big-M LPs, then proceed with the LPs containing a single cut.

Original: Hyper-parameter tuning for incomplete veriﬁcation was done on a small subset of the CIFAR-10 test set, on the SGD-trained network from Figures 1, 2.
Revised: Hyper-parameter tuning for incomplete veriﬁcation was done on a small subset of the CIFAR-10 test set, on the SGD-trained network from Figures 1, 2.

Original: BDD+ is run with the hyper-parameters found by Bunel et al.
Revised: BDD+ is run with the hyper-parameters found by Bunel et al.

Original: (2020a) on the same datasets, for both incomplete and complete veriﬁcation.
Revised: (2020a) on the same datasets, for both incomplete and complete veriﬁcation.

Original: For all supergradient-based methods (Big-M, Active Set), we employed the Adam update rule (Kingma &
Revised: For all supergradient-based methods (Big-M, Active Set), we employed the Adam update rule (Kingma &

Original: Ba, 2015), which showed stronger empirical convergence.
Revised: Ba, 2015), which showed stronger empirical convergence.

Original: For Big-M, replicating the ﬁndings by
Revised: For Big-M, replicating the ﬁndings by

Original: Bunel et al.
Revised: Bunel et al.

Original: (2020a) on their supergradient method, we linearly decrease the step size from 10 −to 10 − 4 .
Revised: (2020a) on their supergradient method, we linearly decrease the step size from 10 −to 10 − 4 .

Original: Active Set is initialized with 500 Big-M iterations, after which the step size is reset and linearly scaled from 10 − 3 to 10 − 6 .
Revised: Active Set is initialized with 500 Big-M iterations, after which the step size is reset and linearly scaled from 10 − 3 to 10 − 6 .

Original: We found the addition of variables to the active set to be effective before convergence: we add variables every 450 iterations, without re-scaling the step size again.
Revised: We found the addition of variables to the active set to be effective before convergence: we add variables every 450 iterations, without re-scaling the step size again.

Original: Every addition consists of 2 new variables (see pseudo-code in appendix D), which was found to be a good compromise between fast bound improvement and computational cost.
Revised: Every addition consists of 2 new variables (see pseudo-code in appendix D), which was found to be a good compromise between fast bound improvement and computational cost.

Original: On complete veriﬁcation, we re-employed the same hyper-parameters for both Big-M and Active Set, except the number of iterations.
Revised: On complete veriﬁcation, we re-employed the same hyper-parameters for both Big-M and Active Set, except the number of iterations.

Original: For Big-M, this was tuned to employ roughly the same time per bounding computation as BDD+.
Revised: For Big-M, this was tuned to employ roughly the same time per bounding computation as BDD+.

Original: As the complete veriﬁcation problem is formulated as a minimisation (as in problem (1)), in Branch and Bound we need a lower and an upper bound to the minimum of each sub-problem.
Revised: As the complete veriﬁcation problem is formulated as a minimisation (as in problem (1)), in Branch and Bound we need a lower and an upper bound to the minimum of each sub-problem.

Original: The lower bound is computed by running the bounding algorithm, while the upper bound on the minimum is obtained by evaluating the network at the last primal output by the bounding algorithm in the lower bound computation (running the bounding algorithm to get an upper bound would result in a much looser bound, as it would imply having an upper bound on a version of problem (1) with maximisation instead of minimisation).
Revised: The lower bound is computed by running the bounding algorithm, while the upper bound on the minimum is obtained by evaluating the network at the last primal output by the bounding algorithm in the lower bound computation (running the bounding algorithm to get an upper bound would result in a much looser bound, as it would imply having an upper bound on a version of problem (1) with maximisation instead of minimisation).

Original: I. D ATASET D ETAILS
Revised: I. D ATASET D ETAILS

Original: We now provide further details on the employed datasets.
Revised: We now provide further details on the employed datasets.

Original: For incomplete veriﬁcation, the architecture was introduced by Wong & Kolter (2018) and re-employed by Bunel et al.
Revised: For incomplete veriﬁcation, the architecture was introduced by Wong & Kolter (2018) and re-employed by Bunel et al.

Original: (2020a).
Revised: (2020a).

Original: It corresponds to the “Wide” complete veriﬁcation architecture, found in Table 2 .
Revised: It corresponds to the “Wide” complete veriﬁcation architecture, found in Table 2 .

Original: Due to the additional computational cost of bounds obtained via the tighter relaxation (3), we restricted the experiments to the ﬁrst 2335 CIFAR-10 test set images for the experiments on the SGD-trained network (Figures 1, 2), and to the ﬁrst 3087 images for the network trained via the method by Madry et al.
Revised: Due to the additional computational cost of bounds obtained via the tighter relaxation (3), we restricted the experiments to the ﬁrst 2335 CIFAR-10 test set images for the experiments on the SGD-trained network (Figures 1, 2), and to the ﬁrst 3087 images for the network trained via the method by Madry et al.

Original: (Figures 6, 7).
Revised: (Figures 6, 7).

Original: For complete veriﬁcation, we employed a subset of the adversarial robustness dataset presented by
Revised: For complete veriﬁcation, we employed a subset of the adversarial robustness dataset presented by

Original: Lu & Kumar (2020) and used by Bunel et al.
Revised: Lu & Kumar (2020) and used by Bunel et al.

Original: (2020a), where the set of properties per network has been restricted to 100 .
Revised: (2020a), where the set of properties per network has been restricted to 100 .

Original: The dataset provides, for a subset of the CIFAR-10 test set, a veriﬁcation radius (cid:15) ver deﬁning the small region over which to look for adversarial examples (input points for which the output of the network is not the correct class) and a (randomly sampled) non-correct class to verify against.
Revised: The dataset provides, for a subset of the CIFAR-10 test set, a veriﬁcation radius (cid:15) ver deﬁning the small region over which to look for adversarial examples (input points for which the output of the network is not the correct class) and a (randomly sampled) non-correct class to verify against.

Original: The veriﬁcation problem is formulated as the search for an adversarial example, carried out by minimizing the difference between the ground truth logit and the target logit.
Revised: The veriﬁcation problem is formulated as the search for an adversarial example, carried out by minimizing the difference between the ground truth logit and the target logit.

Original: If the minimum is positive, we have not succeeded in ﬁnding a counter-example, and the network is robust.
Revised: If the minimum is positive, we have not succeeded in ﬁnding a counter-example, and the network is robust.

Original: The (cid:15) ver radius was tuned to meet a certain “problem difﬁculty” via binary search, employing
Revised: The (cid:15) ver radius was tuned to meet a certain “problem difﬁculty” via binary search, employing

Original: [Table]
Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Revised: [Table]

Revised: [Figure]

Original:  [Figure]
Revised: [Table] [Figure] [Table] [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table] 
Revised: [Table] [Figure] [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table][Figure] [Table] [Figure]
Revised: [Table]

Original: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: a Gurobi-based bounding algorithm (Lu & Kumar, 2020).
Revised: a Gurobi-based bounding algorithm (Lu & Kumar, 2020).

Original: The networks are robust on all the properties we employed.
Revised: The networks are robust on all the properties we employed.

Original: Three different network architectures of different sizes are used.
Revised: Three different network architectures of different sizes are used.

Original: A “Base” network with 3172 ReLU activations, and two networks with roughly twice as many activations: a “Deep” network, and a “Wide” network.
Revised: A “Base” network with 3172 ReLU activations, and two networks with roughly twice as many activations: a “Deep” network, and a “Wide” network.

Original: Details can be found in Table
Revised: Details can be found in Table

Original: [Figure]
Revised: [Figure]

Original: I. A DVERSARIALLY -T RAINED I NCOMPLETE V ERIFICATION
Revised: I. A DVERSARIALLY -T RAINED I NCOMPLETE V ERIFICATION

Original: [Figure]
Revised: [Figure]

Original: I m p r
Revised: I m p r

Original: o v e m e n t
Revised: o v e m e n t

Original: f r o m 1 c u t
Revised: f r o m 1 c u t

Original: In addition to the SGD-trained network in § 5.1, we now present results relative to the same architecture, trained with the adversarial training method by Madry et al.
Revised: In addition to the SGD-trained network in § 5.1, we now present results relative to the same architecture, trained with the adversarial training method by Madry et al.

Original: (2018) for robustness to perturbations of (cid:15) train = 8 / 255 .
Revised: (2018) for robustness to perturbations of (cid:15) train = 8 / 255 .

Original: Each adversarial sample for the training was obtained using 50 steps of projected gradient descent.
Revised: Each adversarial sample for the training was obtained using 50 steps of projected gradient descent.

Original: For this network, we measure the robustness margin to perturbations with (cid:15) ver = 12 / 255 .
Revised: For this network, we measure the robustness margin to perturbations with (cid:15) ver = 12 / 255 .

Original: Figures 6, 7 conﬁrm most of the observations carried out for the SGD-trained network in § 5.1, with fewer variability around the bounds returned by Gurobi cut.
Revised: Figures 6, 7 conﬁrm most of the observations carried out for the SGD-trained network in § 5.1, with fewer variability around the bounds returned by Gurobi cut.

Original: Big-M is competitive with BDD+, and switching to Active Set after 500 iterations results in much better bounds in the same time.
Revised: Big-M is competitive with BDD+, and switching to Active Set after 500 iterations results in much better bounds in the same time.

Original: Increasing the computational budget for Active Set still results in better bounds than Gurobi cut in
Revised: Increasing the computational budget for Active Set still results in better bounds than Gurobi cut in

Original: 4 BDD+ 400 steps 1.
Revised: 4 BDD+ 400 steps 1.

Original: B i g - M 850 s t e p s
Revised: B i g - M 850 s t e p s

Original: Timing (in s) 1010 1 BDD+ 400 steps 

Revised: Timing (in s) 1010 1 BDD+ 400 steps

Original: B i g - M 850 s t e p s
Revised: B i g - M 850 s t e p s

Original: Gap to Planet
Revised: Gap to Planet

Original: [Figure]
Revised: [Figure]

Original: 4 Big-M 850 steps 1.
Revised: 4 Big-M 850 steps 1.

Original: A c t i v e S e t 80 s t e p s
Revised: A c t i v e S e t 80 s t e p s

Original: Timing (in s) 0.
Revised: Timing (in s) 0.

Original: 0.4 Big-M 850 steps 0.
Revised: 0.4 Big-M 850 steps 0.

Original: A c t i v e S e t 80 s t e p s
Revised: A c t i v e S e t 80 s t e p s

Original: Improvement from Planet
Revised: Improvement from Planet

Original: [Figure]
Revised: [Figure]

Original: a fraction of its running time, even though the performance gap is on average smaller than on the

Original: SGD-trained network

Original: I. S ENSITIVITY TO SELECTION CRITERION AND FREQUENCY
Revised: I. S ENSITIVITY TO SELECTION CRITERION AND FREQUENCY

Original: In section 3.2, we describe how to iteratively modify B , the active set of dual variables on which our Active Set solver operates.
Revised: In section 3. we describe how to iteratively modify B , the active set of dual variables on which our Active Set solver operates.

Original: In short, Active Set adds the variables corresponding to the output 
Revised: In short, Active Set adds the variables corresponding to the output see § 3.2)

Original: [Figure]
Revised: [Figure]

Original: I
Revised: e m

Original: [Figure]
Revised: [Figure]

Original: r o v e m e n t f r o m 1 c u t 
Revised: n t f [Figure] o m 1 c u t to

Original: [Figure]
Revised: [Figure]

Original: of oracle
Revised: of oracle

Original: (4) invoked at the primal minimiser of L B ( x , z , α , β B ) , at a ﬁxed frequency ω .
Revised: (4) invoked at the primal minimiser of L B ( x , z , α , β B ) , at a ﬁxed frequency ω .

Original: We now investigate the empirical sensitivity of Active Set to both the selection criterion and the frequency of addition.
Revised: We now investigate the empirical sensitivity of Active Set to both the selection criterion and the frequency of addition.

Original: We test against Ran.
Revised: We test against Ran.

Original: Selection , a version of Active Set for which the variables to add are selected at random by uniformly sampling from the binary I k masks.
Revised: Selection , a version of Active Set for which the variables to add are selected at random by uniformly sampling from the binary I k masks.

Original: As expected, Figure 8 shows that a good selection criterion is key to the efﬁciency of Active Set.
Revised: As expected, Figure 8 shows that a good selection criterion is key to the efﬁciency of Active Set.

Original: In fact, random variable selection only marginally improves upon the Planet relaxation bounds, whereas the improvement becomes signiﬁcant with our selection criterion from § 3.2.
Revised: In fact, random variable selection only marginally improves upon the Planet relaxation bounds, whereas the improvement becomes signiﬁcant with our selection criterion from § 3.2.

Original: In addition, we investigate the sensitivity of Active Set (AS) to variable addition frequency ω .
Revised: In addition, we investigate the sensitivity of Active Set (AS) to variable addition frequency ω .

Original: In order to do so, we cap the maximum number of cuts at 7 for all runs, and vary ω while keeping the time budget ﬁxed (we test on three different time budgets).
Revised: In order to do so, we cap the maximum number of cuts at 7 for all runs, and vary ω while keeping the time budget ﬁxed (we test on three different time budgets).

Original: Figure 9 compares the results for ω = 450 (Active Set), which were presented in § 5.1, with the bounds obtained by setting ω =and ω = 600 (respectively AS ω = 300 and AS ω = 600 ).
Revised: Figure 9 compares the results for ω = 450 (Active Set), which were presented in § 5.1, with the bounds obtained by setting ω =and ω = 600 (respectively AS ω = 300 and AS ω = 600 ).

Original: Our solver proves to be relatively robust to ω across all the three budgets, with the difference in obtained bounds decreasing with the number of iterations.
Revised: Our solver proves to be relatively robust to ω across all the three budgets, with the difference in obtained bounds decreasing with the number of iterations.

Original: Moreover, early cut addition tends to yield better bounds in the same time, suggesting that our selection criterion is effective before subproblem convergence.
Revised: Moreover, early cut addition tends to yield better bounds in the same time, suggesting that our selection criterion is effective before subproblem convergence.

Revised: I. MNIST I NCOMPLETE V ERIFICATION

Revised: We conclude the experimental appendix by presenting incomplete veriﬁcation results (the experimental setup mirrors the one employed in section 5.1 and appendix I.3) on the MNIST dataset (LeCun et al., 1998).

Revised: We report results on the “wide” MNIST network from Lu & Kumar (2020), whose architecture is identical to the “wide” network in Table 2 except for the ﬁrst layer, which has only one input channel to reﬂect the MNIST speciﬁcation (the total number of ReLU activation units is 4804 ).

Revised: As

Revised: [Figure]

Revised: I m p r

Revised: o v e m e n t

Revised: f r o m 1 c u t

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Original: {+those employed for the complete veriﬁcation experiments ( § 5.2), and differently from the incomplete veriﬁcation experiments in section 5.
+}
Revised: {+those employed for the complete veriﬁcation experiments ( § 5.2), and differently from the incomplete veriﬁcation experiments in section 5.
+}

Revised: and

Revised: appendix I.3, the network was adversarially trained with the method by Wong & Kolter (2018).

Revised: We compute the robustness margin to (cid:15) ver = 0 .

Revised: 15 on the ﬁrst 820 images of the MNIST test set.

Revised: All hyper-parameters are kept to the values employed for the

Revised: CIFAR-10 networks, except the Big-M step size, which was linearly decreased from 10 − 1 to 10 − 3 , and the weight of the proximal terms for BDD+, which was linearly increased from 1 to 50 .

Revised: As seen on the CIFAR-10 networks, Figures 10, 11 show that Active Set yields comparable or better bounds than Gurobi 1 cut in less average runtime.

Revised: However, more iterations are required to reach the same relative bound improvement over Gurobi 1 cut ( 2500 as opposed to 600 in Figures 1, 6).

Revised: Furthermore, the smaller average gap between the bounds of Gurobi Planet and Gurobi 1 cut (especially with respect to Figure 1) suggests that the relaxation by Anderson et al.

Revised: (2020) is less effective on this MNIST benchmark.