Original: L IPSCHITZ CONSTANT ESTIMATION FOR N EURAL N ETWORKS VIA SPARSE POLYNOMIAL OPTIMIZATION
Revised: L IPSCHITZ CONSTANT ESTIMATION FOR N EURAL N ETWORKS VIA SPARSE POLYNOMIAL OPTIMIZATION

Original: firstname.lastname@epfl.ch
Revised: firstname.lastname@epfl.ch

Original: A BSTRACT
Revised: A BSTRACT

Original: We introduce LiPopt, a polynomial optimization framework for computing increasingly tighter upper bounds on the Lipschitz constant of neural networks.
Revised: We introduce LiPopt, a polynomial optimization framework for computing increasingly tighter upper bounds on the Lipschitz constant of neural networks.

Original: The underlying optimization problems boil down to either linear (LP) or semideﬁnite (SDP) programming.
Revised: The underlying optimization problems boil down to either linear (LP) or semideﬁnite (SDP) programming.

Original: We show how to use the sparse connectivity of a network, to signiﬁcantly reduce the complexity of computation.
Revised: We show how to use the sparse connectivity of a network, to signiﬁcantly reduce the complexity of computation.

Original: This is specially useful for convolutional as well as pruned neural networks.
Revised: This is specially useful for convolutional as well as pruned neural networks.

Original: We conduct experiments on networks with random weights as well as networks trained on MNIST showing that in the particular case of the (cid:96) ∞ -Lipschitz constant, our approach yields superior estimates, compared to baselines available in the literature
Revised: We conduct experiments on networks with random weights as well as networks trained on MNIST showing that in the particular case of the (cid:96) ∞ -Lipschitz constant, our approach yields superior estimates, compared to baselines available in the literature

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: We consider a neural network f d deﬁned by the recursion:
Revised: We consider a neural network f d deﬁned by the recursion:

Original: [Equation]
Revised: [Equation]

Original: for an integer d larger than 1, matrices { W i } di =1 of appropriate dimensions and an activation function σ , understood to be applied element-wise.
Revised: for an integer d larger than 1, matrices { W i } di =1 of appropriate dimensions and an activation function σ , understood to be applied element-wise.

Original: We refer to d as the depth , and we focus on the case where f d has a single real value as output.
Revised: We refer to d as the depth , and we focus on the case where f d has a single real value as output.

Original: In this work, we address the problem of estimating the Lipschitz constant of the network f d .
Revised: In this work, we address the problem of estimating the Lipschitz constant of the network f d .

Original: A function f is Lipschitz continuous with respect to a norm (cid:107)·(cid:107) if there exists a constant L such that for all x, y we have | f ( x ) − f ( y ) | ≤ L (cid:107) x − y (cid:107) .
Revised: A function f is Lipschitz continuous with respect to a norm (cid:107)·(cid:107) if there exists a constant L such that for all x, y we have | f ( x ) − f ( y ) | ≤ L (cid:107) x − y (cid:107) .

Original: The minimum over all such values satisfying this condition is called the Lipschitz constant of f and is denoted by L ( f ) .
Revised: The minimum over all such values satisfying this condition is called the Lipschitz constant of f and is denoted by L ( f ) .

Original: The Lipschitz constant of a neural network is of major importance in many successful applications of deep learning .
Revised: The Lipschitz constant of a neural network is of major importance in many successful applications of deep learning .

Original: In the context of supervised learning, Bartlett et al.
Revised: In the context of supervised learning, Bartlett et al.

Original: (2017) show how it directly correlates with the generalization ability of neural network classiﬁers, suggesting it as model complexity measure.
Revised: (2017) show how it directly correlates with the generalization ability of neural network classiﬁers, suggesting it as model complexity measure.

Original: It also provides a measure of robustness against adversarial perturbations (Szegedy et al., 2014) and can be used to improve such metric (Cisse et al., 2017).
Revised: It also provides a measure of robustness against adversarial perturbations (Szegedy et al., 2014) and can be used to improve such metric (Cisse et al., 2017).

Original: Moreover, an upper bound on L ( f d ) provides a certiﬁcate of robust classiﬁcation around data points (Weng et al., 2018).
Revised: Moreover, an upper bound on L ( f d ) provides a certiﬁcate of robust classiﬁcation around data points (Weng et al., 2018).

Original: Another example is the discriminator network of the Wasserstein GAN (Arjovsky et al., 2017), whose Lipschitz constant is constrained to be at most 1.
Revised: Another example is the discriminator network of the Wasserstein GAN (Arjovsky et al., 2017), whose Lipschitz constant is constrained to be at most 1.

Original: To handle this constraint, researchers have proposed different methods like heuristic penalties (Gulrajani et al., 2017), upper bounds (Miyato et al., 2018), choice of activation function (Anil et al., 2019), among many others.
Revised: To handle this constraint, researchers have proposed different methods like heuristic penalties (Gulrajani et al., 2017), upper bounds (Miyato et al., 2018), choice of activation function (Anil et al., 2019), among many others.

Original: This line of work has shown that accurate estimation of such constant is key to generating high quality images.
Revised: This line of work has shown that accurate estimation of such constant is key to generating high quality images.

Original: Lower bounds or heuristic estimates of L ( f d ) can be used to provide a general sense of how robust a network is, but fail to provide true certiﬁcates of robustness to input perturbations.
Revised: Lower bounds or heuristic estimates of L ( f d ) can be used to provide a general sense of how robust a network is, but fail to provide true certiﬁcates of robustness to input perturbations.

Original: Such certiﬁcates require true upper bounds, and are paramount when deploying safety-critical deep reinforcement learning applications (Berkenkamp et al., 2017; Jin & Lavaei, 2018).
Revised: Such certiﬁcates require true upper bounds, and are paramount when deploying safety-critical deep reinforcement learning applications (Berkenkamp et al., 2017; Jin & Lavaei, 2018).

Original: The trivial upper bound given by the product of layer-wise Lipschitz constants is easy to compute but rather loose and overly pessimistic, providing poor insight into the true robustness of a network (Huster et al., 2018).
Revised: The trivial upper bound given by the product of layer-wise Lipschitz constants is easy to compute but rather loose and overly pessimistic, providing poor insight into the true robustness of a network (Huster et al., 2018).

Original: Indeed, there is a growing need for methods that provide tighter upper bounds on L ( f d ) , even at the expense of increased complexity.
Revised: Indeed, there is a growing need for methods that provide tighter upper bounds on L ( f d ) , even at the expense of increased complexity.

Original: For example Raghunathan et al.
Revised: For example Raghunathan et al.

Original: (2018a); Jin & Lavaei (2018); Fazlyab et al.
Revised: (2018a); Jin & Lavaei (2018); Fazlyab et al.

Original: (2019) derive upper bounds based on semideﬁnite programming (SDP) .
Revised: (2019) derive upper bounds based on semideﬁnite programming (SDP) .

Original: While expensive to compute, these type of certiﬁcates are in practice surprisingly tight.
Revised: While expensive to compute, these type of certiﬁcates are in practice surprisingly tight.

Original: Our work belongs in this vein of research, and aims to overcome some limitations in the current state-of-the-art.
Revised: Our work belongs in this vein of research, and aims to overcome some limitations in the current state-of-the-art.

Original: Our Contributions
Revised: Our Contributions

Original: (cid:46)
Revised: (cid:46)

Original: We present LiPopt , a general approach for upper bounding the Lipschitz constant of a neural network based on a relaxation to a polynomial optimization problem (POP) (Lasserre, 2015).
Revised: We present LiPopt , a general approach for upper bounding the Lipschitz constant of a neural network based on a relaxation to a polynomial optimization problem (POP) (Lasserre, 2015).

Original: This approach requires only that the unit ball be described with polynomial inequalities, which covers the common (cid:96) 2 - and (cid:96) ∞ -norms.
Revised: This approach requires only that the unit ball be described with polynomial inequalities, which covers the common (cid:96) 2 - and (cid:96) ∞ -norms.

Original: (cid:46)
Revised: (cid:46)

Original: Based on a theorem due to Weisser et al.
Revised: Based on a theorem due to Weisser et al.

Original: (2018), we exploit the sparse connectivity of neural network architectures to derive a sequence of linear programs (LPs) of considerably smaller size than their vanilla counterparts.
Revised: (2018), we exploit the sparse connectivity of neural network architectures to derive a sequence of linear programs (LPs) of considerably smaller size than their vanilla counterparts.

Original: We provide an asymptotic analysis of the size of such programs, in terms of the number of neurons, depth and sparsity of the network.
Revised: We provide an asymptotic analysis of the size of such programs, in terms of the number of neurons, depth and sparsity of the network.

Original: (cid:46)
Revised: (cid:46)

Original: Focusing on the (cid:96) ∞ -norm, we experiment on networks with random weights and networks trained on MNIST (Lecun
Revised: Focusing on the (cid:96) ∞ -norm, we experiment on networks with random weights and networks trained on MNIST (Lecun

Original: et al.,
Revised: et al.,

Original: We evaluate different conﬁgurations of depth, width and sparsity and we show that the proposed sequence of LPs can provide tighter upper bounds on L ( f d ) compared to other baselines available in the literature
Revised: We evaluate different conﬁgurations of depth, width and sparsity and we show that the proposed sequence of LPs can provide tighter upper bounds on L ( f d ) compared to other baselines available in the literature

Original: Notation.
Revised: Notation.

Original: We denote by n i the number of columns of the matrix W i in the deﬁnition (1) of the network.
Revised: We denote by n i the number of columns of the matrix W i in the deﬁnition (1) of the network.

Original: This corresponds to the size of the i -th layer, where we identify the input as the ﬁrst layer.
Revised: This corresponds to the size of the i -th layer, where we identify the input as the ﬁrst layer.

Original: We let n = n 1 + . . .
Revised: We let n = n 1 + . . .

Original: + n d be the total number of neurons in the network.
Revised: + n d be the total number of neurons in the network.

Original: For a vector x , Diag( x ) denotes the square matrix with x in its diagonal and zeros everywhere else.
Revised: For a vector x , Diag( x ) denotes the square matrix with x in its diagonal and zeros everywhere else.

Original: For an array X , vec( X ) is the ﬂattened array.
Revised: For an array X , vec( X ) is the ﬂattened array.

Original: The support of a sequence supp( α ) is deﬁned as the set of indices j such that α j is nonzero.
Revised: The support of a sequence supp( α ) is deﬁned as the set of indices j such that α j is nonzero.

Original: For x = [ x 1 , . . .
Revised: For x = [ x 1 , . . .

Original: , x n ] and a sequence of nonnegative integers γ =
Revised: , x n ] and a sequence of nonnegative integers γ =

Original: [ γ 1 , . . . , γ n ] we denote by x γ the monomial x γ 1 1 x γ 2 2 . . .
Revised: [ γ 1 , . . . , γ n ] we denote by x γ the monomial x γ 1 1 x γ 2 2 . . .

Original: x γ n n .
Revised: x γ n n .

Original: The set of nonnegative integers is denoted by N .
Revised: The set of nonnegative integers is denoted by N .

Original: Remark.
Revised: Remark.

Original: The deﬁnition of network (1) covers typical architectures composed of dense and convolutional layers.
Revised: The deﬁnition of network (1) covers typical architectures composed of dense and convolutional layers.

Original: In general, our proposed approach can be readily extended with minor modiﬁcations to any directed acyclic computation graph e.g., residual network architectures (He et al., 2016).
Revised: In general, our proposed approach can be readily extended with minor modiﬁcations to any directed acyclic computation graph e.g., residual network architectures (He et al., 2016).

Original:  P OLYNOMIAL OPTIMIZATION FORMULATION
Revised:  P OLYNOMIAL OPTIMIZATION FORMULATION

Original: In this section we derive an upper bound on L ( f d ) given by the value of a POP, i.e. the minimum value of a polynomial subject to polynomial inequalities.
Revised: In this section we derive an upper bound on L ( f d ) given by the value of a POP, i.e. the minimum value of a polynomial subject to polynomial inequalities.

Original: Our starting point is the following theorem, which casts L ( f ) as an optimization problem:
Revised: Our starting point is the following theorem, which casts L ( f ) as an optimization problem:

Original: Theorem 1.
Revised: Theorem 1.

Original: Let f be a differentiable and Lipschitz continuous function on an open, convex subset
Revised: Let f be a differentiable and Lipschitz continuous function on an open, convex subset

Original: X of an euclidean space.
Revised: X of an euclidean space.

Original: Let (cid:107)·(cid:107) ∗ be the dual norm.
Revised: Let (cid:107)·(cid:107) ∗ be the dual norm.

Original: The Lipschitz constant of f is given by
Revised: The Lipschitz constant of f is given by

Original: [Equation]
Revised: [Equation]

Original: For completeness, we provide a proof in appendix A.
Revised: For completeness, we provide a proof in appendix A.

Original: In our setting, we assume that the activation function σ is Lipschitz continuous and differentiable.
Revised: In our setting, we assume that the activation function σ is Lipschitz continuous and differentiable.

Original: In this case, the assumptions of Theorem 1 are fulﬁlled because f d is a composition of activations and linear transformations.
Revised: In this case, the assumptions of Theorem 1 are fulﬁlled because f d is a composition of activations and linear transformations.

Original: The differentiability assumption rules out the common ReLU activation σ ( x ) = max { 0 , x } , but allows many others such as the exponential linear unit (ELU) (Clevert et al., 2015) or the softplus.
Revised: The differentiability assumption rules out the common ReLU activation σ ( x ) = max { 0 , x } , but allows many others such as the exponential linear unit (ELU) (Clevert et al., 2015) or the softplus.

Original: Using the chain rule, the compositional structure of f d yields the following formula for its gradient:
Revised: Using the chain rule, the compositional structure of f d yields the following formula for its gradient:

Original: [Equation]
Revised: [Equation]

Original: For every i = 1 , . . .
Revised: For every i = 1 , . . .

Original: , d − 1 we introduce a variable s i =
Revised: , d − 1 we introduce a variable s i =

Original: σ (cid:48) ( f i ( x )) corresponding to the derivative of σ at the i -th hidden layer of the network.
Revised: σ (cid:48) ( f i ( x )) corresponding to the derivative of σ at the i -th hidden layer of the network.

Original: For activation functions like ELU or softplus, their derivative is bounded between 0 and 1 , which implies that 

Revised: For activation functions like ELU or softplus, their derivative is bounded between 0 and 1 , which implies that

Original: ≤ s i ≤ 1 .
Revised: ≤ s i ≤ 1 .

Original: This bound together with the deﬁnition of the dual norm (cid:107) x (cid:107) ∗ := sup (cid:107) t (cid:107)≤ 1 t T x implies the following upper bound of L ( f d ) :
Revised: This bound together with the deﬁnition of the dual norm (cid:107) x (cid:107) ∗ := sup (cid:107) t (cid:107)≤ 1 t T x implies the following upper bound of L ( f d ) :

Original: [Equation]
Revised: [Equation]

Original: We will refer to the polynomial objective of this problem as the norm-gradient polynomial of the network f d , a central object of study in this work.
Revised: We will refer to the polynomial objective of this problem as the norm-gradient polynomial of the network f d , a central object of study in this work.

Original: For some frequently used (cid:96) p -norms, the constraint (cid:107) t (cid:107) p ≤ 1 can be written with polynomial inequalities.
Revised: For some frequently used (cid:96) p -norms, the constraint (cid:107) t (cid:107) p ≤ 1 can be written with polynomial inequalities.

Original: In the rest of this work, we use exclusively the (cid:96) ∞ -norm for which (cid:107) t (cid:107) ∞ ≤ 1 is equivalent to the polynomial inequalities − 1 ≤ t i ≤ 1 , for i = 1 , . . . , n 1 .
Revised: In the rest of this work, we use exclusively the (cid:96) ∞ -norm for which (cid:107) t (cid:107) ∞ ≤ 1 is equivalent to the polynomial inequalities − 1 ≤ t i ≤ 1 , for i = 1 , . . . , n 1 .

Original: However, note that when p ≥ 2 is a positive even integer, (cid:107) t (cid:107) p ≤ 1 is equivalent to a single polynomial inequality (cid:107) t (cid:107) pp ≤ 1 , and our proposed approach can be adapted with minimal modiﬁcations.
Revised: However, note that when p ≥ 2 is a positive even integer, (cid:107) t (cid:107) p ≤ 1 is equivalent to a single polynomial inequality (cid:107) t (cid:107) pp ≤ 1 , and our proposed approach can be adapted with minimal modiﬁcations.

Original: In such cases, the optimization problem in the right-hand side of (4) is a POP.
Revised: In such cases, the optimization problem in the right-hand side of (4) is a POP.

Original: Optimization of polynomials is a NP-hard problem and we do not expect to have efﬁcient algorithms for solving (4) in this general form.
Revised: Optimization of polynomials is a NP-hard problem and we do not expect to have efﬁcient algorithms for solving (4) in this general form.

Original: In the next sections we describe LiPopt : a systematic way of obtaining an upper bound on L ( f d ) via tractable approximation methods of the POP (4).
Revised: In the next sections we describe LiPopt : a systematic way of obtaining an upper bound on L ( f d ) via tractable approximation methods of the POP (4).

Original: Local estimation.
Revised: Local estimation.

Original: In many practical escenarios, we have additional bounds on the input of the network.
Revised: In many practical escenarios, we have additional bounds on the input of the network.

Original: For example, in the case of image classiﬁcation tasks, valid input is constrained in a hypercube.
Revised: For example, in the case of image classiﬁcation tasks, valid input is constrained in a hypercube.

Original: In the robustness certiﬁcation task, we are interested in all possible input in a (cid:15) -ball around some data point.
Revised: In the robustness certiﬁcation task, we are interested in all possible input in a (cid:15) -ball around some data point.

Original: In those cases, it is interesting to compute a local Lipschitz constant , that is, the Lipschitz constant of a function restricted to a subset.
Revised: In those cases, it is interesting to compute a local Lipschitz constant , that is, the Lipschitz constant of a function restricted to a subset.

Original: We can achieve this by deriving tighter bounds 0 ≤ l i ≤ s i ≤ u i ≤ 1 , as a consequence of the restricted input (see for example, Algorithm 1 in Wong & Kolter (2018)).
Revised: We can achieve this by deriving tighter bounds 0 ≤ l i ≤ s i ≤ u i ≤ 1 , as a consequence of the restricted input (see for example, Algorithm 1 in Wong & Kolter (2018)).

Original: By incorporating this knowledge in the optimization problem (4) we obtain bounds on local Lipschitz constants of f d .
Revised: By incorporating this knowledge in the optimization problem (4) we obtain bounds on local Lipschitz constants of f d .

Original: We study this setting and provide numerical experiments in section 7.3.
Revised: We study this setting and provide numerical experiments in section 7.3.

Original: Choice of norm.
Revised: Choice of norm.

Original: We highlight the importance of computing good upper bounds on L ( f d ) with respect to the (cid:96) ∞ -norm.
Revised: We highlight the importance of computing good upper bounds on L ( f d ) with respect to the (cid:96) ∞ -norm.

Original: It is one of the most commonly used norms to assess robustness in the adversarial examples literature.
Revised: It is one of the most commonly used norms to assess robustness in the adversarial examples literature.

Original: Moreover, it has been shown that, in practice, (cid:96) ∞ -norm robust networks are also robust in other more plausible measures of perceptibility, like the Wasserstein distance (Wong et al., 2019).
Revised: Moreover, it has been shown that, in practice, (cid:96) ∞ -norm robust networks are also robust in other more plausible measures of perceptibility, like the Wasserstein distance (Wong et al., 2019).

Original: This motivates our focus on this choice.
Revised: This motivates our focus on this choice.

Original:  H IERARCHICAL SOLUTION BASED ON A P OLYNOMIAL P OSITIVITY CERTIFICATE
Revised:  H IERARCHICAL SOLUTION BASED ON A P OLYNOMIAL P OSITIVITY CERTIFICATE

Original: For ease of exposition, we rewrite (4) as a POP constrained in [0 , 1] n using the substitution s 0 :
Revised: For ease of exposition, we rewrite (4) as a POP constrained in [0 , 1] n using the substitution s 0 :

Original: =
Revised: =

Original: ( t + 1) / 2 .
Revised: ( t + 1) / 2 .

Original: Denote by p the norm-gradient polynomial, and let x = [ s 0 , . .
Revised: Denote by p the norm-gradient polynomial, and let x = [ s 0 , . .

Original: , s d − 1 ] be the concatenation of all variables.
Revised: , s d − 1 ] be the concatenation of all variables.

Original: Polynomial optimization methods (Lasserre, 2015) start from the observation that a value λ is an upper bound for p over a set K if and only if the polynomial λ − p is positive over K .
Revised: Polynomial optimization methods (Lasserre, 2015) start from the observation that a value λ is an upper bound for p over a set K if and only if the polynomial λ − p is positive over K .

Original: In LiPopt , we will employ a well-known classical result in algebraic geometry, the so-called Krivine’s positivity certiﬁcate 1 , but in theory we can use any positivity certiﬁcate like sum-of-squares (SOS).
Revised: In LiPopt , we will employ a well-known classical result in algebraic geometry, the so-called Krivine’s positivity certiﬁcate 1 , but in theory we can use any positivity certiﬁcate like sum-of-squares (SOS).

Original: The following is a straightforward adaptation of Krivine’s certiﬁcate to our setting:
Revised: The following is a straightforward adaptation of Krivine’s certiﬁcate to our setting:

Original: Theorem 2.
Revised: Theorem 2.

Original: (Adapted from Krivine (1964); Stengle (1974); Handelman (1988))
Revised: (Adapted from Krivine (1964); Stengle (1974); Handelman (1988))

Original: If the polynomial λ − p is strictly positive on [0 , 1] n , then there exist ﬁnitely many positive weights c αβ such that
Revised: If the polynomial λ − p is strictly positive on [0 , 1] n , then there exist ﬁnitely many positive weights c αβ such that

Original: [Equation]
Revised: [Equation]

Original: By truncating the degree of Krivine’s positivity certiﬁcate (Theorem 2) and minimizing over all possible upper bounds λ we obtain a hierarchy of LP problems (Lasserre, 2015, Section 9):
Revised: By truncating the degree of Krivine’s positivity certiﬁcate (Theorem 2) and minimizing over all possible upper bounds λ we obtain a hierarchy of LP problems (Lasserre, 2015, Section 9):

Original: [Equation]
Revised: [Equation]

Original: where N 2 nk is the set of nonnegative integer sequences of length 2 n adding up to at most k .
Revised: where N 2 nk is the set of nonnegative integer sequences of length 2 n adding up to at most k .

Original: This is indeed a sequence of LPs as the polynomial equality constraint can be implemented by equating coefﬁcients in the canonical monomial basis.
Revised: This is indeed a sequence of LPs as the polynomial equality constraint can be implemented by equating coefﬁcients in the canonical monomial basis.

Original: For this polynomial equality to be feasible, the degree of the certiﬁcate has to be at least that of the norm-gradient polynomial p , which is equal to the depth d .
Revised: For this polynomial equality to be feasible, the degree of the certiﬁcate has to be at least that of the norm-gradient polynomial p , which is equal to the depth d .

Original: This implies that the ﬁrst nontrivial bound ( θ k < ∞ ) corresponds to k = d .
Revised: This implies that the ﬁrst nontrivial bound ( θ k < ∞ ) corresponds to k = d .

Original: The sequence { θ k } ∞ k =1 is non-incresing and converges to the maximum of the upper bound (4).
Revised: The sequence { θ k } ∞ k =1 is non-incresing and converges to the maximum of the upper bound (4).

Original: Note that for any level of the hierarchy, the solution of the LP (6) provides a valid upper bound on L ( f d ) .
Revised: Note that for any level of the hierarchy, the solution of the LP (6) provides a valid upper bound on L ( f d ) .

Original: An advantage of using Krivine’s positivity certiﬁcate over SOS is that one obtains an LP hierarchy (rather than SDP), for which commercial solvers can reliably handle a large instances.
Revised: An advantage of using Krivine’s positivity certiﬁcate over SOS is that one obtains an LP hierarchy (rather than SDP), for which commercial solvers can reliably handle a large instances.

Original: Other positivity certiﬁcates offering a similar advantage are the DSOS and SDSOS hierarchies (Ahmadi &
Revised: Other positivity certiﬁcates offering a similar advantage are the DSOS and SDSOS hierarchies (Ahmadi &

Original: Majumdar, 2019), which boil down to LP or second order cone programming (SOCP), respectively.
Revised: Majumdar, 2019), which boil down to LP or second order cone programming (SOCP), respectively.

Original: Drawback.
Revised: Drawback.

Original: The size of the LPs given by Krivine’s positivity certiﬁcate can become quite large.
Revised: The size of the LPs given by Krivine’s positivity certiﬁcate can become quite large.

Original: The dimension of the variable c is |
Revised: The dimension of the variable c is |

Original: N 2 nk | =
Revised: N 2 nk | =

Original: O ( n k ) .
Revised: O ( n k ) .

Original: For reference, if we consider the MNIST dataset and a one-hidden-layer network with 100 neurons we have (cid:12)(cid:12) N 2 n 2 (cid:12)(cid:12) ≈ 1 .
Revised: For reference, if we consider the MNIST dataset and a one-hidden-layer network with 100 neurons we have (cid:12)(cid:12) N 2 n 2 (cid:12)(cid:12) ≈ 1 .

Original: 5 × 10 6 while (cid:12)(cid:12) N 2 n 3 (cid:12)(cid:12)
Revised: 5 × 10 6 while (cid:12)(cid:12) N 2 n 3 (cid:12)(cid:12)

Original: ≈ 9 .
Revised: ≈ 9 .

Original: 3 × 10 8 .
Revised: 3 × 10 8 .

Original: To make this approach more scalable, in the next section we exploit the sparsity of the polynomial p to ﬁnd LPs of drastically smaller size than (6), but with similar approximation properties.
Revised: To make this approach more scalable, in the next section we exploit the sparsity of the polynomial p to ﬁnd LPs of drastically smaller size than (6), but with similar approximation properties.

Original: Remark.
Revised: Remark.

Original: In order to compute upper bounds for local Lipschitz constants, ﬁrst obtain tighter bounds 0 ≤ l i ≤ s i ≤ u i and then perform the change of variables (cid:101) s i
Revised: In order to compute upper bounds for local Lipschitz constants, ﬁrst obtain tighter bounds 0 ≤ l i ≤ s i ≤ u i and then perform the change of variables (cid:101) s i

Original: = ( s i − l i ) / ( u i − l i ) to rewrite the problem (4) as a POP constrained on [0 , 1] n .
Revised: = ( s i − l i ) / ( u i − l i ) to rewrite the problem (4) as a POP constrained on [0 , 1] n .

Original:  R EDUCING THE NUMBER OF VARIABLES
Revised:  R EDUCING THE NUMBER OF VARIABLES

Original: Many neural network architectures, like those composed of convolutional layers, have a highly sparse connectivity between neurons.
Revised: Many neural network architectures, like those composed of convolutional layers, have a highly sparse connectivity between neurons.

Original: Moreover, it has been empirically observed that up to 90% of network weights can be pruned (set to zero) without harming accuracy (Frankle & Carbin, 2019).
Revised: Moreover, it has been empirically observed that up to 90% of network weights can be pruned (set to zero) without harming accuracy (Frankle & Carbin, 2019).

Original: In such cases their norm-gradient polynomial has a special structure that allows polynomial positivity certiﬁcates of smaller size than the one given by Krivine’s positivity certiﬁcate (Theorem 2).
Revised: In such cases their norm-gradient polynomial has a special structure that allows polynomial positivity certiﬁcates of smaller size than the one given by Krivine’s positivity certiﬁcate (Theorem 2).

Original: In this section, we describe an implementation of LiPopt (Algorithm 1) that exploits the sparsity of the network to decrease the complexity of the LPs (6) given by the Krivine’s positivity certiﬁcate.
Revised: In this section, we describe an implementation of LiPopt (Algorithm 1) that exploits the sparsity of the network to decrease the complexity of the LPs (6) given by the Krivine’s positivity certiﬁcate.

Original: In this way, we obtain upper bounds on L ( f d ) that require less computation and memory.
Revised: In this way, we obtain upper bounds on L ( f d ) that require less computation and memory.

Original: Let us start with the deﬁnition of a valid sparsity pattern :
Revised: Let us start with the deﬁnition of a valid sparsity pattern :

Original: Deﬁnition 1.
Revised: Deﬁnition 1.

Original: Let I = { 1 , . . . , n } and p be a polynomial with variable x ∈ R n .
Revised: Let I = { 1 , . . . , n } and p be a polynomial with variable x ∈ R n .

Original: A valid sparsity pattern of p is a sequence { I i } mi =1 of subsets of I , called cliques, such that (cid:83) mi
Revised: A valid sparsity pattern of p is a sequence { I i } mi =1 of subsets of I , called cliques, such that (cid:83) mi

Original: =

Revised: =

Original: I i
Revised: I i

Original: =
Revised: =

Original: I and: (cid:46) p
Revised: I and: (cid:46) p

Original: = (cid:80) mi =1 p i where p i is a polynomial that depends only on the variables { x j : j ∈ I i } (cid:46) for all i = 1 , . . .
Revised: = (cid:80) mi =1 p i where p i is a polynomial that depends only on the variables { x j : j ∈ I i } (cid:46) for all i = 1 , . . .

Original: , m − 1 there is an l ≤ i such that
Revised: , m − 1 there is an l ≤ i such that

Original: ( I i +1 ∩ (cid:83) ir =

Revised: ( I i +1 ∩ (cid:83) ir =

Original: I r ) ⊆
Revised: I r ) ⊆

Original: I l
Revised: I l

Original: When the polynomial objective p in a POP has a valid sparsity pattern, there is an extension of
Revised: When the polynomial objective p in a POP has a valid sparsity pattern, there is an extension of

Original: Theorem 2 due to Weisser et al.
Revised: Theorem 2 due to Weisser et al.

Original: (2018), providing a smaller positivity certiﬁcate for λ − p over [0 , 1] n .
Revised: (2018), providing a smaller positivity certiﬁcate for λ − p over [0 , 1] n .

Original: We refer to it as the sparse Krivine’s certiﬁcate and we include it here for completeness:
Revised: We refer to it as the sparse Krivine’s certiﬁcate and we include it here for completeness:

Original: Theorem 3 (Adapted from Weisser et al.
Revised: Theorem 3 (Adapted from Weisser et al.

Original: Let a polynomial p have a valid sparsity pattern { I i } mi =1 .
Revised: Let a polynomial p have a valid sparsity pattern { I i } mi =1 .

Original: Deﬁne N i as the set of sequences ( α, β ) ∈ N 2 n where the support of both α and β is contained in I i .
Revised: Deﬁne N i as the set of sequences ( α, β ) ∈ N 2 n where the support of both α and β is contained in I i .

Original: If λ − p is strictly positive over K = [0 , 1] n , there exist ﬁnitely many positive weights c αβ such that
Revised: If λ − p is strictly positive over K = [0 , 1] n , there exist ﬁnitely many positive weights c αβ such that

Original: [Equation]
Revised: [Equation]

Original: where the polynomials h αβ are deﬁned as in (5) .
Revised: where the polynomials h αβ are deﬁned as in (5) .

Original: The sparse Krivine’s certiﬁcate can be used like the general version (Theorem 2) to derive a sequence of LPs approximating the upper bound on L ( f d ) stated in (4).
Revised: The sparse Krivine’s certiﬁcate can be used like the general version (Theorem 2) to derive a sequence of LPs approximating the upper bound on L ( f d ) stated in (4).

Original: However, the number of different polynomials h αβ of degree at most k appearing in the sparse certiﬁcate can be drastically smaller, the amount of which determines how good the sparsity pattern is.
Revised: However, the number of different polynomials h αβ of degree at most k appearing in the sparse certiﬁcate can be drastically smaller, the amount of which determines how good the sparsity pattern is.

Original: We introduce a graph that depends on the network f d , from which we will extract a sparsity pattern for the norm-gradient polynomial of a network.
Revised: We introduce a graph that depends on the network f d , from which we will extract a sparsity pattern for the norm-gradient polynomial of a network.

Original: Deﬁnition 2.
Revised: Deﬁnition 2.

Original: Let f d be a network with weights { W i } di =1 .
Revised: Let f d be a network with weights { W i } di =1 .

Original: Deﬁne a directed graph G d
Revised: Deﬁne a directed graph G d

Original: =
Revised: =

Original: ( V, E ) as:
Revised: ( V, E ) as:

Original: [Equation]
Revised: [Equation]

Original: which we call the computational graph of the network f d .
Revised: which we call the computational graph of the network f d .

Original: In the graph G d the vertex s ( i,j ) represents the j -th neuron in the i -th layer.
Revised: In the graph G d the vertex s ( i,j ) represents the j -th neuron in the i -th layer.

Original: There is a directed edge between two neurons in consecutive layers if they are joined by a nonzero weight in the network.
Revised: There is a directed edge between two neurons in consecutive layers if they are joined by a nonzero weight in the network.

Original: The following result shows that for fully connected networks we can extract a valid sparsity pattern from this graph.
Revised: The following result shows that for fully connected networks we can extract a valid sparsity pattern from this graph.

Original: We relegate the proof to appendix B.
Revised: We relegate the proof to appendix B.

Original: Proposition 1.
Revised: Proposition 1.

Original: Let f d be a dense network (all weights are nonzero).
Revised: Let f d be a dense network (all weights are nonzero).

Original: The following sets, indexed by i = 1 , . . . , n d , form a valid sparsity pattern for the norm-gradient polynomial of the network f d :
Revised: The following sets, indexed by i = 1 , . . . , n d , form a valid sparsity pattern for the norm-gradient polynomial of the network f d :

Original: I i := (cid:8) s ( d − 1 ,i ) } ∪ { s ( j,k ) : there exists a directed path from s ( j,k ) to s ( d − 1 ,i ) in G d (cid:9) (9)
Revised: I i := (cid:8) s ( d − 1 ,i ) } ∪ { s ( j,k ) : there exists a directed path from s ( j,k ) to s ( d − 1 ,i ) in G d (cid:9) (9)

Original: We refer to this as the sparsity pattern induced by G d .
Revised: We refer to this as the sparsity pattern induced by G d .

Original: An example is depicted in in Figure 1.
Revised: An example is depicted in in Figure 1.

Original: Remark.
Revised: Remark.

Original: When the network is not dense, the the second condition (Deﬁnition 1) for the sparsity pattern (9) to be valid might not hold.
Revised: When the network is not dense, the the second condition (Deﬁnition 1) for the sparsity pattern (9) to be valid might not hold.

Original: In that case we lose the guarantee that the values of the corresponding LPs converge to the maximum of the POP (4).
Revised: In that case we lose the guarantee that the values of the corresponding LPs converge to the maximum of the POP (4).

Original: Nevertheless, it still provides a valid positivity certiﬁcate that we use to upper bound L ( f d ) .
Revised: Nevertheless, it still provides a valid positivity certiﬁcate that we use to upper bound L ( f d ) .

Original: In Section 7 we show that in practice it provides upper bounds of good enough quality.
Revised: In Section 7 we show that in practice it provides upper bounds of good enough quality.

Original: If needed, a valid sparsity pattern can be obtained via a chordal completion of the correlative sparsity graph of the POP (Waki et al., 2006).
Revised: If needed, a valid sparsity pattern can be obtained via a chordal completion of the correlative sparsity graph of the POP (Waki et al., 2006).

Original: We now quantify how good this sparsity pattern is.
Revised: We now quantify how good this sparsity pattern is.

Original: Let s be the size of the largest clique in a sparsity pattern, and let N i,k be the subset of N i (deﬁned in Theorem 3) composed of sequences summing up to k .
Revised: Let s be the size of the largest clique in a sparsity pattern, and let N i,k be the subset of N i (deﬁned in Theorem 3) composed of sequences summing up to k .

Original: The number of different polynomials for the k -th LP in the hierarchy given by the sparse
Revised: The number of different polynomials for the k -th LP in the hierarchy given by the sparse

Original: Krivine’s certiﬁcate can be bounded as follows:
Revised: Krivine’s certiﬁcate can be bounded as follows:

Original: [Equation]
Revised: [Equation]

Original: We immediately see that the dependence on the number of cliques m is really mild (linear) but the size of the cliques as well as the degree of the hierarchy can really impact the size of the optimization problem.
Revised: We immediately see that the dependence on the number of cliques m is really mild (linear) but the size of the cliques as well as the degree of the hierarchy can really impact the size of the optimization problem.

Original: Nevertheless, this upper bound can be quite loose; polynomials h αβ that depend only on variables in the intersection of two or more cliques are counted more than once.
Revised: Nevertheless, this upper bound can be quite loose; polynomials h αβ that depend only on variables in the intersection of two or more cliques are counted more than once.

Original: The number of cliques given in the sparsity pattern induced by G d is equal to the size of the last layer m = n d and the size of each clique depends on the particular implementation of the network.
Revised: The number of cliques given in the sparsity pattern induced by G d is equal to the size of the last layer m = n d and the size of each clique depends on the particular implementation of the network.

Original: We now study different architectures that could arise in practice, and determine the amount of polynomials in their sparse Krivine’s certiﬁcate.
Revised: We now study different architectures that could arise in practice, and determine the amount of polynomials in their sparse Krivine’s certiﬁcate.

Original: Fully connected networks.
Revised: Fully connected networks.

Original: Even in the case of a network with all nonzero connections, the sparsity pattern induced by G d decreases the size of the LPs when compared to Krivine’s certiﬁcate.
Revised: Even in the case of a network with all nonzero connections, the sparsity pattern induced by G d decreases the size of the LPs when compared to Krivine’s certiﬁcate.

Original: In this case the cliques have size n 1 + . . .
Revised: In this case the cliques have size n 1 + . . .

Original: + n d − 1 +

Revised: + n d − 1 +

Original: but they all have the same common intersection equal to all neurons up to the second-to-last hidden layer.
Revised: but they all have the same common intersection equal to all neurons up to the second-to-last hidden layer.

Original: A straightforward counting argument shows that the total number of polynomials is O ( n ( n 1 + . . .
Revised: A straightforward counting argument shows that the total number of polynomials is O ( n ( n 1 + . . .

Original: + n d − 1 +1) k − 1 ) , improving the upper bound (10).
Revised: + n d − 1 +1) k − 1 ) , improving the upper bound (10).

Original: Unstructured sparsity.
Revised: Unstructured sparsity.

Original: In the case of networks obtained by pruning (Hanson & Pratt, 1989) or generated randomly from a distribution over graphs (Xie et al., 2019), the sparsity pattern can be arbitrary.
Revised: In the case of networks obtained by pruning (Hanson & Pratt, 1989) or generated randomly from a distribution over graphs (Xie et al., 2019), the sparsity pattern can be arbitrary.

Original: In this case the size of the resulting LPs varies at runtime.
Revised: In this case the size of the resulting LPs varies at runtime.

Original: Under the layer-wise assumption that any neuron is connected to at most r neurons in the previous layer, the size of the cliques in (9) is bounded as s =
Revised: Under the layer-wise assumption that any neuron is connected to at most r neurons in the previous layer, the size of the cliques in (9) is bounded as s =

Original: O ( r d ) .
Revised: O ( r d ) .

Original: This estimate has an exponential dependency on the depth but ignores that many neurons might share connections to the same inputs in the previous layer, thus being potentially loose.
Revised: This estimate has an exponential dependency on the depth but ignores that many neurons might share connections to the same inputs in the previous layer, thus being potentially loose.

Original: The bound (10) implies that the number of different polynomials is O ( n d r dk ) .
Revised: The bound (10) implies that the number of different polynomials is O ( n d r dk ) .

Original: 2D Convolutional networks.
Revised: 2D Convolutional networks.

Original: The sparsity in the weight matrices of convolutional layers has a certain local structure ; neurons are connected to contiguous inputs in the previous layer.
Revised: The sparsity in the weight matrices of convolutional layers has a certain local structure ; neurons are connected to contiguous inputs in the previous layer.

Original: Adjacent neurons also have many input pixels in common (see Figure 2).
Revised: Adjacent neurons also have many input pixels in common (see Figure 2).

Original: Assuming a constant number of channels per layer, the size of the cliques in (9) is O
Revised: Assuming a constant number of channels per layer, the size of the cliques in (9) is O

Original: ( d 3 ) .
Revised: ( d 3 ) .

Original: Intuitively, such number is proportional to the volume of the pyramid depicted in Figure 2 where each dimension depends linearly on d .
Revised: Intuitively, such number is proportional to the volume of the pyramid depicted in Figure 2 where each dimension depends linearly on d .

Original: Using (10) we get that there are O ( n d d 3 k ) different polynomials in the sparse Krivine’s certiﬁcate.
Revised: Using (10) we get that there are O ( n d d 3 k ) different polynomials in the sparse Krivine’s certiﬁcate.

Original: This is a drastic decrease in complexity when compared to the unstructured sparsity case.
Revised: This is a drastic decrease in complexity when compared to the unstructured sparsity case.

Original: The use of sparsity in polynomial optimization preceeds Theorem 3 (Weisser et al., 2018).
Revised: The use of sparsity in polynomial optimization preceeds Theorem 3 (Weisser et al., 2018).

Original: First studied in the context of sum-of-squares by Kojima et al.
Revised: First studied in the context of sum-of-squares by Kojima et al.

Original: and further reﬁned in Waki et al.
Revised: and further reﬁned in Waki et al.

Original: Lasserre (2006) (and references therein), it has found applications in safety veriﬁcation (Yang et al., 2016; Zhang et al., 2018), sensor localization Wang et al.
Revised: Lasserre (2006) (and references therein), it has found applications in safety veriﬁcation (Yang et al., 2016; Zhang et al., 2018), sensor localization Wang et al.

Original: (2006), optimal power ﬂow (Ghaddar et al., 2015) and many others.
Revised: (2006), optimal power ﬂow (Ghaddar et al., 2015) and many others.

Original: Our work ﬁts precisely into this set of important applications.
Revised: Our work ﬁts precisely into this set of important applications.

Original: Input:
Revised: Input:

Original: [Table]
Revised: [Table]

Original: { W i } di =1 , sparsity pattern { I i } mi =1 , hierarchy degree k .
Revised: { W i } di =1 , sparsity pattern { I i } mi =1 , hierarchy degree k .

Original: 1: p ← (2 s 0 − 1) T W T 1 (cid:81) d − 1 i =
Revised: 1: p ← (2 s 0 − 1) T W T 1 (cid:81) d − 1 i =

Original: Diag( s i ) W Ti + (cid:46) compute norm-gradient polynomial 2: x ← [ s 0 , . .
Revised: Diag( s i ) W Ti + (cid:46) compute norm-gradient polynomial 2: x ← [ s 0 , . .

Original: , s d − 1 ] 3: b ← [ b γ : γ ∈ N nk ] where p ( x ) =
Revised: , s d − 1 ] 3: b ← [ b γ : γ ∈ N nk ] where p ( x ) =

Original: (cid:80) γ ∈ N
Revised: (cid:80) γ ∈ N

Original: nk b γ x γ (cid:46) compute coefﬁcients of p in basis 4: for i = 1 , . .
Revised: nk b γ x γ (cid:46) compute coefﬁcients of p in basis 4: for i = 1 , . .

Original: , m do 5:
Revised: , m do 5:

Original: N i,k ← { ( α, β ) ∈ N 2 nk : supp( α ) ∩ supp( β ) ⊆
Revised: N i,k ← { ( α, β ) ∈ N 2 nk : supp( α ) ∩ supp( β ) ⊆

Original: I i } 6: (cid:101) N k ← ∪ mi =1 N i,k 7: h ← (cid:80) ( α,β ) ∈ (cid:101) N c
Revised: I i } 6: (cid:101) N k ← ∪ mi =1 N i,k 7: h ← (cid:80) ( α,β ) ∈ (cid:101) N c

Original: αβ
Revised: αβ

Original: h
Revised: h

Original: αβ (cid:46) compute positivity certiﬁcate 8: c ← [ c αβ : ( α, β ) ∈ (cid:101) N k ] ; y ← [ λ, c ] (cid:46) linear program variables 9: Z ← [ z γ ] γ ∈ N nk where λ − h ( x ) =
Revised: αβ (cid:46) compute positivity certiﬁcate 8: c ← [ c αβ : ( α, β ) ∈ (cid:101) N k ] ; y ← [ λ, c ] (cid:46) linear program variables 9: Z ← [ z γ ] γ ∈ N nk where λ − h ( x ) =

Original: (cid:80) γ ∈ N nk
Revised: (cid:80) γ ∈ N nk

Original: ( z Tγ y ) x γ (cid:46) compute coefﬁcients of λ − h in basis return min { λ : b =
Revised: ( z Tγ y ) x γ (cid:46) compute coefﬁcients of λ − h in basis return min { λ : b =

Original: Zy, y =
Revised: Zy, y =

Original: [ λ, c ] , c ≥ 0 } (cid:46) solve LP
Revised: [ λ, c ] , c ≥ 0 } (cid:46) solve LP

Original:  QCQP REFORMULATION AND S HOR ’ S SDP RELAXATION
Revised:  QCQP REFORMULATION AND S HOR ’ S SDP RELAXATION

Original: Another way of upper bounding L ( f d ) comes from a further relaxation of (4) to an SDP.
Revised: Another way of upper bounding L ( f d ) comes from a further relaxation of (4) to an SDP.

Original: We consider the following equivalent formulation where the variables s i are normalized to lie in the interval [ − 1 , 1] , and we rename t = s 0 :
Revised: We consider the following equivalent formulation where the variables s i are normalized to lie in the interval [ − 1 , 1] , and we rename t = s 0 :

Original: [Equation]
Revised: [Equation]

Original: Any polynomial optimization problem like (11) can be cast as a (possibly non-convex) quadratically constrained quadratic program (QCQP) by introducing new variables and quadratic constraints.
Revised: Any polynomial optimization problem like (11) can be cast as a (possibly non-convex) quadratically constrained quadratic program (QCQP) by introducing new variables and quadratic constraints.

Original: This is a well-known procedure described in Park & Boyd (2017, Section 2.1).
Revised: This is a well-known procedure described in Park & Boyd (2017, Section 2.1).

Original: When d = 2 problem (11) is already a QCQP (for the (cid:96) ∞ and (cid:96) 2 -norm cases) and no modiﬁcation is necessary.
Revised: When d = 2 problem (11) is already a QCQP (for the (cid:96) ∞ and (cid:96) 2 -norm cases) and no modiﬁcation is necessary.

Original: QCQP reformulation.
Revised: QCQP reformulation.

Original: We illustrate the case d = 3 where we have the variables s 1 , s 2 corresponding to the ﬁrst and second hidden layer and a variable s 0 corresponding to the input.
Revised: We illustrate the case d = 3 where we have the variables s 1 , s 2 corresponding to the ﬁrst and second hidden layer and a variable s 0 corresponding to the input.

Original: The norm-gradient polynomial in this case is cubic, and it can be rewritten as a quadratic polynomial by introducing new variables corresponding to the product of the ﬁrst and second hidden layer variables.
Revised: The norm-gradient polynomial in this case is cubic, and it can be rewritten as a quadratic polynomial by introducing new variables corresponding to the product of the ﬁrst and second hidden layer variables.

Original: More precisely the introduction of a variable s 1 , 2 with quadratic constraint s 1 , 2 = vec( s 1 s T 2 ) allows us to write the objective (11) as a quadratic polynomial.
Revised: More precisely the introduction of a variable s 1 , 2 with quadratic constraint s 1 , 2 = vec( s 1 s T 2 ) allows us to write the objective (11) as a quadratic polynomial.

Original: The problem then becomes a QCQP with variable y =
Revised: The problem then becomes a QCQP with variable y =

Original: [1 , s 0 , s 1 , s 2 , s 1 , 2 ] of dimension 1 + n + n 1 n 2 .
Revised: [1 , s 0 , s 1 , s 2 , s 1 , 2 ] of dimension 1 + n + n 1 n 2 .

Original: SDP relaxation.
Revised: SDP relaxation.

Original: Any quadratic objective and constraints can then be relaxed to linear constraints on the positive semideﬁnite variable yy T
Revised: Any quadratic objective and constraints can then be relaxed to linear constraints on the positive semideﬁnite variable yy T

Original: = X (cid:60) 0 yielding the so-called Shor’s relaxation of (11) (Park & Boyd, 2017, Section 3.3).
Revised: = X (cid:60) 0 yielding the so-called Shor’s relaxation of (11) (Park & Boyd, 2017, Section 3.3).

Original: When d = 2 the resulting SDP corresponds precisely to the one studied in Raghunathan et al.
Revised: When d = 2 the resulting SDP corresponds precisely to the one studied in Raghunathan et al.

Original: (2018a).
Revised: (2018a).

Original: This resolves a common misconception (Raghunathan et al., 2018b) that this approach is only limited to networks with one hidden layer.
Revised: This resolves a common misconception (Raghunathan et al., 2018b) that this approach is only limited to networks with one hidden layer.

Original: Note that in our setting we are only interested in the optimal value rather than the optimizers, so there is no need to extract a solution for (11) from that of the SDP relaxation.
Revised: Note that in our setting we are only interested in the optimal value rather than the optimizers, so there is no need to extract a solution for (11) from that of the SDP relaxation.

Original: Drawback.
Revised: Drawback.

Original: This approach includes a further relaxation step from (11), thus being fundamentally limited in how tightly it can upper bound the value of L ( f d ) .
Revised: This approach includes a further relaxation step from (11), thus being fundamentally limited in how tightly it can upper bound the value of L ( f d ) .

Original: Moreover when compared to LP solvers, off-the-shelf semideﬁnite programming solvers are, in general, much more limited in the number of variables they can efﬁciently handle.
Revised: Moreover when compared to LP solvers, off-the-shelf semideﬁnite programming solvers are, in general, much more limited in the number of variables they can efﬁciently handle.

Original: In the case d = 2 this relaxation provides a constant factor approximation to the original QCQP (Ye, 1999).
Revised: In the case d = 2 this relaxation provides a constant factor approximation to the original QCQP (Ye, 1999).

Original: Further approximation quality results for such hierarchical optimization approaches to
Revised: Further approximation quality results for such hierarchical optimization approaches to

Original: NP-hard problems are out of the scope of this work.
Revised: NP-hard problems are out of the scope of this work.

Original: Relation to sum-of-squares.
Revised: Relation to sum-of-squares.

Original: The QCQP approach might appear fundamentaly different to the hierarchical optimization approaches to POPs, like the one described in Section 3.
Revised: The QCQP approach might appear fundamentaly different to the hierarchical optimization approaches to POPs, like the one described in Section 3.

Original: However, it is known that Shor’s SDP relaxation corresponds exactly to the ﬁrst degree of the SOS hierarchical
Revised: However, it is known that Shor’s SDP relaxation corresponds exactly to the ﬁrst degree of the SOS hierarchical

Original: SDP solution to the QCQP relaxation (Lasserre, 2000).
Revised: SDP solution to the QCQP relaxation (Lasserre, 2000).

Original: Thus, the approach in section 3 and the one in this section are, in essence, the same; they only differ in the choice of polynomial positivity certiﬁcate.
Revised: Thus, the approach in section 3 and the one in this section are, in essence, the same; they only differ in the choice of polynomial positivity certiﬁcate.

Original:  R ELATED WORK
Revised:  R ELATED WORK

Original: Estimation of L ( f d ) with (cid:96) 2 -norm is studied by Virmaux & Scaman (2018); Combettes & Pesquet (2019); Fazlyab et al.
Revised: Estimation of L ( f d ) with (cid:96) 2 -norm is studied by Virmaux & Scaman (2018); Combettes & Pesquet (2019); Fazlyab et al.

Original: ; Jin & Lavaei (2018).
Revised: ; Jin & Lavaei (2018).

Original: The method SeqLip proposed in Virmaux &
Revised: The method SeqLip proposed in Virmaux &

Original: Scaman (2018) has the drawback of not providing true upper bounds.
Revised: Scaman (2018) has the drawback of not providing true upper bounds.

Original: It is in fact a heuristic method for solving (4) but which provides no guarantees and thus can not be used for robustness certiﬁcation.
Revised: It is in fact a heuristic method for solving (4) but which provides no guarantees and thus can not be used for robustness certiﬁcation.

Original: In contrast the LipSDP method of Fazlyab et al.
Revised: In contrast the LipSDP method of Fazlyab et al.

Original: (2019) provides true upper bounds on L ( f d ) and in practice shows superior performance over both SeqLip and CPLip (Combettes & Pesquet, 2019).
Revised: (2019) provides true upper bounds on L ( f d ) and in practice shows superior performance over both SeqLip and CPLip (Combettes & Pesquet, 2019).

Original: Despite the accurate estimation of LipSDP , its formulation is limited to the (cid:96) 2 -norm.
Revised: Despite the accurate estimation of LipSDP , its formulation is limited to the (cid:96) 2 -norm.

Original: The only estimate available for other (cid:96) p -norms comes from the equivalence of norms in euclidean spaces.
Revised: The only estimate available for other (cid:96) p -norms comes from the equivalence of norms in euclidean spaces.

Original: For instance, we can obtain an upper bound for the (cid:96) ∞ -norm after multiplying the (cid:96) 2 Lipschitz constant upper bound by the square root of the input dimension.
Revised: For instance, we can obtain an upper bound for the (cid:96) ∞ -norm after multiplying the (cid:96) 2 Lipschitz constant upper bound by the square root of the input dimension.

Original: The resulting bound can be rather loose and our experiments in section 7 conﬁrm the issue.
Revised: The resulting bound can be rather loose and our experiments in section 7 conﬁrm the issue.

Original: In contrast, our proposed approach LiPopt can acommodate any norm whose unit ball can be described via polynomial inequalities.
Revised: In contrast, our proposed approach LiPopt can acommodate any norm whose unit ball can be described via polynomial inequalities.

Original: Let us point to one key advantage of LiPopt , compared to LipSDP (Jin & Lavaei, 2018; Fazlyab et al., 2019).
Revised: Let us point to one key advantage of LiPopt , compared to LipSDP (Jin & Lavaei, 2018; Fazlyab et al., 2019).

Original: In the context of robustness certiﬁcation we are given a sample x (cid:92) and a ball of radius (cid:15) around it.
Revised: In the context of robustness certiﬁcation we are given a sample x (cid:92) and a ball of radius (cid:15) around it.

Original: Computing an upper bound on the local Lipschitz constant in this subset, rather than a global one, can provide a larger region of certiﬁed robustness.
Revised: Computing an upper bound on the local Lipschitz constant in this subset, rather than a global one, can provide a larger region of certiﬁed robustness.

Original: Taking into account the restricted domain we can reﬁne the bounds in our POP (see remark in section 1).
Revised: Taking into account the restricted domain we can reﬁne the bounds in our POP (see remark in section 1).

Original: This potentially yields a tighter estimate of the local Lipschitz constant.
Revised: This potentially yields a tighter estimate of the local Lipschitz constant.

Original: On the other hand, it is not clear how to include such additional information in LipSDP , which only computes one global bound on the Lipschitz constant for the unconstrained network.
Revised: On the other hand, it is not clear how to include such additional information in LipSDP , which only computes one global bound on the Lipschitz constant for the unconstrained network.

Original: Raghunathan et al.
Revised: Raghunathan et al.

Original: (2018a)
Revised: (2018a)

Original: ﬁnd an upper bound for L ( f d ) with (cid:96) ∞ metric starting from problem (4) but only in the context of one-hidden-layer networks ( d = 2 ).
Revised: ﬁnd an upper bound for L ( f d ) with (cid:96) ∞ metric starting from problem (4) but only in the context of one-hidden-layer networks ( d = 2 ).

Original: To compute such bound they use its corresponding Shor’s relaxation and obtain as a byproduct a differentiable regularizer for training networks.
Revised: To compute such bound they use its corresponding Shor’s relaxation and obtain as a byproduct a differentiable regularizer for training networks.

Original: They claim such approach is limited to the setting d = 2 but, as we remark in section 5, it is just a particular instance of the SDP relaxation method for QCQPs arising from a polynomial optimization problem.
Revised: They claim such approach is limited to the setting d = 2 but, as we remark in section 5, it is just a particular instance of the SDP relaxation method for QCQPs arising from a polynomial optimization problem.

Original: We ﬁnd that this method ﬁts into the LiPopt framework, using
Revised: We ﬁnd that this method ﬁts into the LiPopt framework, using

Original: SOS certiﬁcates instead of Krivine
Revised: SOS certiﬁcates instead of Krivine

Original: ’s.
Revised: ’s.

Original: We expect that the SDP-based bounds described in 5 can also be used as regularizers promoting robustness.
Revised: We expect that the SDP-based bounds described in 5 can also be used as regularizers promoting robustness.

Original: Weng et al.
Revised: Weng et al.

Original: (2018) provide an upper bound on the local Lipschitz constant for networks based on a sequence of ad-hoc bounding arguments, which are particular to the choice of ReLU activation function.
Revised: (2018) provide an upper bound on the local Lipschitz constant for networks based on a sequence of ad-hoc bounding arguments, which are particular to the choice of ReLU activation function.

Original: In contrast, our approach applies in general to activations whose derivative is bounded.
Revised: In contrast, our approach applies in general to activations whose derivative is bounded.

Original:  E XPERIMENTS
Revised:  E XPERIMENTS

Original: We consider the following estimators of L ( f d ) with respect to the (cid:96) ∞ norm:
Revised: We consider the following estimators of L ( f d ) with respect to the (cid:96) ∞ norm:

Original: Name Description SDP Upper bound arising from the solution of the SDP relaxation described in SectionLipOpt-k Upper bound arising from the k -th degree of the LP hierarchy (6) based on the sparse Krivine Positivstellenstatz.
Revised: Name Description SDP Upper bound arising from the solution of the SDP relaxation described in SectionLipOpt-k Upper bound arising from the k -th degree of the LP hierarchy (6) based on the sparse Krivine Positivstellenstatz.

Original: Lip-SDP Upper bound from Fazlyab et al.
Revised: Lip-SDP Upper bound from Fazlyab et al.

Original: (2019) multiplied √ d where d is the input dimension of the network.
Revised: (2019) multiplied √ d where d is the input dimension of the network.

Original: UBP Upper bound determined by the product of the layer-wise Lipschitz constants with (cid:96) ∞ metric LBS Lower bound obtained by sampling 50000 random points around zero, and evaluating the dual norm of the gradient
Revised: UBP Upper bound determined by the product of the layer-wise Lipschitz constants with (cid:96) ∞ metric LBS Lower bound obtained by sampling 50000 random points around zero, and evaluating the dual norm of the gradient

Original: 7. E XPERIMENTS ON RANDOM NETWORKS
Revised: 7. E XPERIMENTS ON RANDOM NETWORKS

Original: We compare the bounds obtained by the algorithms described above on networks with random weights and either one or two hidden layers.
Revised: We compare the bounds obtained by the algorithms described above on networks with random weights and either one or two hidden layers.

Original: We deﬁne the sparsity level of a network as the maximum number of neurons any neuron in one layer is connected to in the next layer.
Revised: We deﬁne the sparsity level of a network as the maximum number of neurons any neuron in one layer is connected to in the next layer.

Original: For example, the network represented on Figure 1 has sparsity 2 .
Revised: For example, the network represented on Figure 1 has sparsity 2 .

Original: The non-zero weights of network
Revised: The non-zero weights of network

Original: ’s i -th layer are sampled uniformly in [ − 1 √ n i , 1 √ n i ] where n i is the number of neurons in layer i .
Revised: ’s i -th layer are sampled uniformly in [ − 1 √ n i , 1 √ n i ] where n i is the number of neurons in layer i .

Original: For different conﬁgurations of width and sparsity, we generate 10 random networks and average the obtained Lipschitz bounds.
Revised: For different conﬁgurations of width and sparsity, we generate 10 random networks and average the obtained Lipschitz bounds.

Original: For better comparison, we plot the relative error.
Revised: For better comparison, we plot the relative error.

Original: Since we do not know the true Lipschitz constant, we cannot compute the true relative error.
Revised: Since we do not know the true Lipschitz constant, we cannot compute the true relative error.

Original: Instead, we take as reference the lower bound given by LBS .
Revised: Instead, we take as reference the lower bound given by LBS .

Original: Figures 3 and 5 show the relative error, i.e., (ˆ L − L LBS ) /L
Revised: Figures 3 and 5 show the relative error, i.e., (ˆ L − L LBS ) /L

Original: LBS where L LBS is the lower bound computed by LBS and ˆ L is the estimated upper bound.
Revised: LBS where L LBS is the lower bound computed by LBS and ˆ L is the estimated upper bound.

Original: Figuresand 10 in Appendix C we show the values of the computed Lipschitz bounds for 1 and 2 hidden layers respectively.
Revised: Figuresand 10 in Appendix C we show the values of the computed Lipschitz bounds for 1 and 2 hidden layers respectively.

Original: When the chosen degree for LiPopt-k is the smallest as possible, i.e., equal to the depth of the network, we observe that the method is already competitive with the SDP method, especially in the case of 2 hidden layers.
Revised: When the chosen degree for LiPopt-k is the smallest as possible, i.e., equal to the depth of the network, we observe that the method is already competitive with the SDP method, especially in the case of 2 hidden layers.

Original: When we increment the degree by 1 , LiPopt-k becomes uniformly better than SDP over all tested conﬁgurations.
Revised: When we increment the degree by 1 , LiPopt-k becomes uniformly better than SDP over all tested conﬁgurations.

Original: We remark that the upper bounds given by UBP are too large to be shown in the plots.
Revised: We remark that the upper bounds given by UBP are too large to be shown in the plots.

Original: Similarly, for the 1 -hidden layer networks, the bounds from LipSDP are too large to be plotted.
Revised: Similarly, for the 1 -hidden layer networks, the bounds from LipSDP are too large to be plotted.

Original: Finally, we measured the computation time of the different methods on each tested network (Figures 4 and 6).
Revised: Finally, we measured the computation time of the different methods on each tested network (Figures 4 and 6).

Original: We observe that the computation time for LiPopt-k heavily depends on the network sparsity, which reﬂects the fact that such structure is exploited in the algorithm.
Revised: We observe that the computation time for LiPopt-k heavily depends on the network sparsity, which reﬂects the fact that such structure is exploited in the algorithm.

Original: In contrast, the time required for SDP does not depend on the sparsity, but only on the size of the network.
Revised: In contrast, the time required for SDP does not depend on the sparsity, but only on the size of the network.

Original: Therefore as the network size grows (with ﬁxed sparsity level), LipOpt-k obtains a better upper bound and runs faster.
Revised: Therefore as the network size grows (with ﬁxed sparsity level), LipOpt-k obtains a better upper bound and runs faster.

Original: Also, with our method, we see that it is possible to increase the computation power in order to compute tighter bounds when required, making it more ﬂexible than SDP in terms of computation/accuracy tradeoff.
Revised: Also, with our method, we see that it is possible to increase the computation power in order to compute tighter bounds when required, making it more ﬂexible than SDP in terms of computation/accuracy tradeoff.

Original: LiPopt uses the Gurobi LP solver, while SDP uses Mosek.
Revised: LiPopt uses the Gurobi LP solver, while SDP uses Mosek.

Original: All methods run on a single machine with Core i7 2.8Ghz quad-core processor and 16Gb of RAM.
Revised: All methods run on a single machine with Core i7 2.8Ghz quad-core processor and 16Gb of RAM.

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: c h
Revised: c h

Original: i t
Revised: i t

Original: z
Revised: z

Original: e
Revised: e

Original: [Table]
Revised: [Table]

Original: o r
Revised: o r

Original: [Table]
Revised: [Table]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: C o m p u t a t i o n t i m e
Revised: C o m p u t a t i o n t i m e

Original: LiPopt_3LiPopt_4SDP (a) 5 × 5 ×  8 10 12 14 Sparsity 0.
Revised: LiPopt_3LiPopt_4SDP (a) 5 × 5 ×  8 10 12 14 Sparsity 0.

Original: C o m p u t a t i o n t i m e (b)
Revised: C o m p u t a t i o n t i m e (b)

Original: [Figure]
Revised: [Figure]

Original: C o m p u t a t i o n t i m e (
Revised: C o m p u t a t i o n t i m e (

Original: [Figure]
Revised: [Figure]

Original: C
Revised: C

Original: [Figure]
Revised: [Figure]

Original: m p
Revised: m p

Original: [Figure]
Revised: [Figure]

Original: t a t
Revised: t a t

Original: i
Revised: i

Original: [Figure]
Revised: [Figure]

Original: n t
Revised: n t

Original: i
Revised: i

Original: [Figure]
Revised: [Figure]

Original: e
Revised: e

Original: [Figure]
Revised: [Figure]

Original: 7. E XPERIMENTS ON TRAINED NETWORKS
Revised: 7. E XPERIMENTS ON TRAINED NETWORKS

Original: Similarly, we compare these methods on networks trained on MNIST.
Revised: Similarly, we compare these methods on networks trained on MNIST.

Original: The architecture we use is a fully connected network with two hidden layers with 300 and 100 neurons respectively, and with one-hot output of size 10 .
Revised: The architecture we use is a fully connected network with two hidden layers with 300 and 100 neurons respectively, and with one-hot output of size 10 .

Original: Since the output is multi-dimensional, we restrict the network to a single output, and estimate the Lipschitz constant with respect to label 8 .
Revised: Since the output is multi-dimensional, we restrict the network to a single output, and estimate the Lipschitz constant with respect to label 8 .

Original: Moreover, in order to improve the scalability of our method, we train the network using the pruning strategy described in Han et al.
Revised: Moreover, in order to improve the scalability of our method, we train the network using the pruning strategy described in Han et al.

Original: After training the full network using a standard technique, the weights of smallest magnitude are set to zero.
Revised: After training the full network using a standard technique, the weights of smallest magnitude are set to zero.

Original: Then, the network is trained for additional iterations, only updating the nonzero parameters.
Revised: Then, the network is trained for additional iterations, only updating the nonzero parameters.

Original: Doing so, we were able to remove 95% of the weights, while preserving the same test accuracy.
Revised: Doing so, we were able to remove 95% of the weights, while preserving the same test accuracy.

Original: We recorded the Lipschitz bounds for various methods in
Revised: We recorded the Lipschitz bounds for various methods in

Original: Table 7.2.
Revised: Table 7.2.

Original: We observe clear improvement of the Lipschitz bound obtained from LiPopt-k compared to SDP method, even when using k = 3 .
Revised: We observe clear improvement of the Lipschitz bound obtained from LiPopt-k compared to SDP method, even when using k = 3 .

Original: Also note that the input dimension is too large for the method Lip-SDP to provide competitive bound, so we do not provide the obtained bound for this method.
Revised: Also note that the input dimension is too large for the method Lip-SDP to provide competitive bound, so we do not provide the obtained bound for this method.

Original: [Table]
Revised: [Table]

Original: 7. E STIMATING LOCAL L IPSCHITZ CONSTANTS WITH L I P OPT
Revised: 7. E STIMATING LOCAL L IPSCHITZ CONSTANTS WITH L I P OPT

Original: In the of section 7.1, we study the improvement on the upper bound obtained by LiPopt , when we incorporate tighter upper and lower bounds on the variables s i of the polynomial optimization problem (4).
Revised: In the of section 7.1, we study the improvement on the upper bound obtained by LiPopt , when we incorporate tighter upper and lower bounds on the variables s i of the polynomial optimization problem (4).

Original: Such bounds arise from the limited range that the pre-activation values of the network can take, when the input is limited to an (cid:96) ∞ -norm ball of radius (cid:15) centered at an arbitrary point x 0 .
Revised: Such bounds arise from the limited range that the pre-activation values of the network can take, when the input is limited to an (cid:96) ∞ -norm ball of radius (cid:15) centered at an arbitrary point x 0 .

Original: The algorithm that computes upper and lower bounds on the pre-activation values is fast (it has the same complexity as a forward pass) and is described, for example, in Wong & Kolter (2018).
Revised: The algorithm that computes upper and lower bounds on the pre-activation values is fast (it has the same complexity as a forward pass) and is described, for example, in Wong & Kolter (2018).

Original: The variables s i correspond to the value of the derivative of the activation function.
Revised: The variables s i correspond to the value of the derivative of the activation function.

Original: For activations like
Revised: For activations like

Original: ELU or ReLU, their derivative is monotonically increasing, so we need only evaluate it at the upper and lower bounds of the pre-activation values to obtain corresponding bounds for the variables s i .
Revised: ELU or ReLU, their derivative is monotonically increasing, so we need only evaluate it at the upper and lower bounds of the pre-activation values to obtain corresponding bounds for the variables s i .

Original: We plot the local upper bounds obtained by LiPopt-3 for increasing values of the radius (cid:15) , the bound for the global constant (given by LiPopt-3 ) and the lower bound on the local Lipschitz constant obtained by sampling in the (cid:15) -neighborhood (LBS).
Revised: We plot the local upper bounds obtained by LiPopt-3 for increasing values of the radius (cid:15) , the bound for the global constant (given by LiPopt-3 ) and the lower bound on the local Lipschitz constant obtained by sampling in the (cid:15) -neighborhood (LBS).

Original: We sample 15 random networks and plot the average values obtained.
Revised: We sample 15 random networks and plot the average values obtained.

Original: We observe clear gap between both estimates, which shows that larger certiﬁed balls could be obtained with such method in the robustness certiﬁcation applications.
Revised: We observe clear gap between both estimates, which shows that larger certiﬁed balls could be obtained with such method in the robustness certiﬁcation applications.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original:  C ONCLUSION AND FUTURE WORK
Revised:  C ONCLUSION AND FUTURE WORK

Original: In this work
Revised: In this work

Original: [Figure]
Revised: [Figure]

Original: we have introduced a general approach for computing an upper bound on the Lipschitz constant of neural networks.
Revised: we have introduced a general approach for computing an upper bound on the Lipschitz constant of neural networks.

Original: This approach is based on polynomial positivity certiﬁcates and generalizes some existing methods available in the literature.
Revised: This approach is based on polynomial positivity certiﬁcates and generalizes some existing methods available in the literature.

Original: We have empirically demonstrated that it can tightly upper bound such constant.
Revised: We have empirically demonstrated that it can tightly upper bound such constant.

Original: The resulting optimization problems are computationally expensive but the sparsity of the network can reduce this burden.
Revised: The resulting optimization problems are computationally expensive but the sparsity of the network can reduce this burden.

Original: In order to further scale such methods to larger and deeper networks
Revised: In order to further scale such methods to larger and deeper networks

Original: [Figure]
Revised: [Figure]

Original: we are interested in several possible directions: ( i ) divide-and-conquer approaches splitting the computation on sub-networks in the same spirit of Fazlyab et al.
Revised: we are interested in several possible directions: ( i ) divide-and-conquer approaches splitting the computation on sub-networks in the same spirit of Fazlyab et al.

Original: (2019), ( ii ) exploiting parallel optimization algorithms leveraging the structure of the polynomials, ( iii ) custom optimization algorithms with low-memory costs such as Frank-wolfe-type methods for SDP (Yurtsever et al., 2019) as well as stochastic handling of constraints (Fercoq et al., 2019) and ( iv ), exploting the symmetries in the polynomial that arise from weight sharing in typical network architectures to further reduce the size of the problems.
Revised: (2019), ( ii ) exploiting parallel optimization algorithms leveraging the structure of the polynomials, ( iii ) custom optimization algorithms with low-memory costs such as Frank-wolfe-type methods for SDP (Yurtsever et al., 2019) as well as stochastic handling of constraints (Fercoq et al., 2019) and ( iv ), exploting the symmetries in the polynomial that arise from weight sharing in typical network architectures to further reduce the size of the problems.

Original: A CKNOWLEDGMENTS
Revised: A CKNOWLEDGMENTS

Original: This project has received funding from the European Research Council (ERC) under the European
Revised: This project has received funding from the European Research Council (ERC) under the European

Original: Union’s Horizon 2020 research and innovation programme (grant agreement 725594 - time-data) and from the Swiss National Science Foundation (SNSF) under grant number 200021 178865.
Revised: Union’s Horizon 2020 research and innovation programme (grant agreement 725594 - time-data) and from the Swiss National Science Foundation (SNSF) under grant number 200021 178865.

Original: FL is supported through a PhD fellowship of the Swiss Data Science Center, a joint venture between
Revised: FL is supported through a PhD fellowship of the Swiss Data Science Center, a joint venture between

Original: EPFL and ETH Zurich.
Revised: EPFL and ETH Zurich.

Original: VC acknowledges the 2019 Google Faculty Research Award.
Revised: VC acknowledges the 2019 Google Faculty Research Award.

Original: A P ROOF OF T HEOREM
Revised: R

Revised: A P ROOF OF T HEOREM

Original: Theorem.
Revised: Theorem.

Original: Let f be a differentiable and Lipschitz continuous function on an open, convex subset X of a euclidean space.
Revised: Let f be a differentiable and Lipschitz continuous function on an open, convex subset X of a euclidean space.

Original: Let (cid:107) · (cid:107) be the dual norm.
Revised: Let (cid:107) · (cid:107) be the dual norm.

Original: The Lipschitz constant of f is given by
Revised: The Lipschitz constant of f is given by

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: First we show that L ( f ) ≤ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ .
Revised: First we show that L ( f ) ≤ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ .

Original: [Equation]
Revised: [Equation]

Original: were we have used the convexity of X .
Revised: were we have used the convexity of X .

Original: Now we show the reverse inequality L ( f ) ≥ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ .
Revised: Now we show the reverse inequality L ( f ) ≥ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ .

Original: To this end, we show that for any positive (cid:15) , we have that L ( f ) ≥ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ − (cid:15) .
Revised: To this end, we show that for any positive (cid:15) , we have that L ( f ) ≥ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ − (cid:15) .

Original: Let z ∈
Revised: Let z ∈

Original: X be such that (cid:107)∇ f ( z ) (cid:107) ∗ ≥ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ − (cid:15) .
Revised: X be such that (cid:107)∇ f ( z ) (cid:107) ∗ ≥ sup x ∈X (cid:107)∇ f ( x ) (cid:107) ∗ − (cid:15) .

Original: Because X is open, there exists a sequence { h k } ∞ k =1 with the following properties:
Revised: Because X is open, there exists a sequence { h k } ∞ k =1 with the following properties:

Original: 1. (cid:104) h k , ∇ f ( z ) (cid:105) = (cid:107) h k
Revised: 1. (cid:104) h k , ∇ f ( z ) (cid:105) = (cid:107) h k

Original: (cid:107)(cid:107)∇ f ( z ) (cid:107) ∗ 2.
Revised: (cid:107)(cid:107)∇ f ( z ) (cid:107) ∗ 2.

Original: z + h k ∈ X 3.
Revised: z + h k ∈ X 3.

Original: lim k →∞ h k
Revised: lim k →∞ h k

Original: = 0 .
Revised: = 0 .

Original: By deﬁnition of the gradient
Revised: By deﬁnition of the gradient

Original: [Equation]
Revised: [Equation]

Original: there exists a function δ such that lim h
Revised: there exists a function δ such that lim h

Original: → 0 δ ( h ) = 

Revised: → 0 δ ( h ) =

Original: and the following holds:
Revised: and the following holds:

Original: [Equation]
Revised: [Equation]

Original: For our previously deﬁned iterates h k we then have
Revised: For our previously deﬁned iterates h k we then have

Original: [Equation]
Revised: [Equation]

Original: Dividing both sides by (cid:107) h k (cid:107) and using the deﬁnition of L ( f ) we ﬁnally get
Revised: Dividing both sides by (cid:107) h k (cid:107) and using the deﬁnition of L ( f ) we ﬁnally get

Original: [Equation]
Revised: [Equation]

Original: B P ROOF OF P ROPOSITION
Revised: B P ROOF OF P ROPOSITION

Original: Proposition.
Revised: Proposition.

Original: Let f d be a dense network (all weights are nonzero).
Revised: Let f d be a dense network (all weights are nonzero).

Original: The following sets, indexed by i = 1 , . . . , n d , form a valid sparsity pattern for the norm-gradient polynomial of the network f d :
Revised: The following sets, indexed by i = 1 , . . . , n d , form a valid sparsity pattern for the norm-gradient polynomial of the network f d :

Original: I i := (cid:8) s ( d − 1 ,i ) } ∪ { s ( j,k ) : there exists a directed path from s ( j,k ) to s ( d − 1 ,i ) in G d (cid:9) (13)
Revised: I i := (cid:8) s ( d − 1 ,i ) } ∪ { s ( j,k ) : there exists a directed path from s ( j,k ) to s ( d − 1 ,i ) in G d (cid:9) (13)

Original: Proof.
Revised: Proof.

Original: First we show that ∪ mi =

Revised: First we show that ∪ mi =

Original: I
Revised: I

Original: i
Revised: i

Original: = I .
Revised: = I .

Original: This comes from the fact that any neuron in the network is connected to at least one neuron in the last layer.
Revised: This comes from the fact that any neuron in the network is connected to at least one neuron in the last layer.

Original: Otherwise such neuron could be removed from the network altogether.
Revised: Otherwise such neuron could be removed from the network altogether.

Original: Now we show the second property of a valid sparsity pattern.
Revised: Now we show the second property of a valid sparsity pattern.

Original: Note that the norm-gradient polynomial is composed of monomials corresponding to the product of variables in a path from input to a ﬁnal neuron.
Revised: Note that the norm-gradient polynomial is composed of monomials corresponding to the product of variables in a path from input to a ﬁnal neuron.

Original: This imples that if we let p i be the sum of all the terms that involve the neuron s ( d − 1 ,i ) we have that p = (cid:80) i p i , and p i only depends on the variables in I i .
Revised: This imples that if we let p i be the sum of all the terms that involve the neuron s ( d − 1 ,i ) we have that p = (cid:80) i p i , and p i only depends on the variables in I i .

Original: We now show the last property of the valid sparsity pattern.
Revised: We now show the last property of the valid sparsity pattern.

Original: This is the only part where we use that the network is dense.
Revised: This is the only part where we use that the network is dense.

Original: For any network architecture the ﬁrst two conditions hold.
Revised: For any network architecture the ﬁrst two conditions hold.

Original: We will use the fact that the maximal cliques of a chordal graph form a valid sparsity pattern (see for example Lasserre (2006)).
Revised: We will use the fact that the maximal cliques of a chordal graph form a valid sparsity pattern (see for example Lasserre (2006)).

Original: Because the network is dense, we see that the clique
Revised: Because the network is dense, we see that the clique

Original: I
Revised: I

Original: i is composed of the neuron in the last layer s
Revised: i is composed of the neuron in the last layer s

Original: ( d − 1 ,i ) and all neurons in the previous layers.
Revised: ( d − 1 ,i ) and all neurons in the previous layers.

Original: Now consider the extension of the computational graph ˆ G d
Revised: Now consider the extension of the computational graph ˆ G d

Original: =
Revised: =

Original: ( V, ˆ E )
Revised: ( V, ˆ E )

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: which consists of adding all the edges between the neurons that are not in the last layer.
Revised: which consists of adding all the edges between the neurons that are not in the last layer.

Original: We show that this graph is chordal.
Revised: We show that this graph is chordal.

Original: Let ( a 1 , . . .
Revised: Let ( a 1 , . . .

Original: , a r , a 1 ) be a cycle of length at least 4 ( r ≥ 4 ).
Revised: , a r , a 1 ) be a cycle of length at least 4 ( r ≥ 4 ).

Original: notice that because neurons in the last layer are not connected between them in ˆ G , no two consecutive neurons in this cycle belong to the last layer.
Revised: notice that because neurons in the last layer are not connected between them in ˆ G , no two consecutive neurons in this cycle belong to the last layer.

Original: This implies that in the subsequence ( a 1 , a 2 , a 3 , a 4 , a 5 ) at most three belong to the last layer.
Revised: This implies that in the subsequence ( a 1 , a 2 , a 3 , a 4 , a 5 ) at most three belong to the last layer.

Original: A simple analysis of all cases implies that it contains at least two nonconsecutive neurons not in the last layer.
Revised: A simple analysis of all cases implies that it contains at least two nonconsecutive neurons not in the last layer.

Original: Neurons not in the last layer are always connected in ˆ
Revised: Neurons not in the last layer are always connected in ˆ

Original: G .
Revised: G .

Original: This constitutes a chord.
Revised: This constitutes a chord.

Original: This shows that ˆ G d is a chordal graph.
Revised: This shows that ˆ G d is a chordal graph.

Original: Its maximal cliques correspond exactly to the sets in proposition.
Revised: Its maximal cliques correspond exactly to the sets in proposition.

Original: C E XPERIMENTS ON RANDOM NETWORKS
Revised: C E XPERIMENTS ON RANDOM NETWORKS

Original: [Figure] [Figure]
Revised: [Figure] [Figure]