An Efficient Framework for Computing Tight Lipschitz Constants of Neural Networks
Anonymous Author(s)
AffiliationAddress email
Abstract
Lipschitz constants are connected to many properties of neural networks, such asrobustness, fairness, and generalization.
Existing methods for computing Lipschitzconstants either are computationally inefficient or produce loose upper bounds.
In this paper, we develop an efficient framework for computing the ℓ ∞ local
Lipschitz constant of a neural network by tightly upper bounding the norm of
Clarke Jacobian.
We view the computation for Clarke Jacobian by chain rule asa higher-order backward computational graph.
On this graph, we adopt boundpropagation with linear relaxation to obtain provable bounds, and we derive tightlinear relaxations for specific nonlinearities in Clarke Jacobian that previous workscould not tightly bound.
We further tighten our bounds by Branch-and-Bound(BaB) when time budget allows.
Experiments show that on tiny models, ourmethod produces comparable bounds compared to exact methods that cannot scaleto slightly larger models; on larger models, our method efficiently produces tighterresults than existing relaxed or naive methods, and our method scales to muchlarger practical models that previous works could not handle.
We also demonstratea potential application of our method for provable monotonicity analysis.
Introduction
Lipschitz constants are important for characterizing many properties of neural networks, includingrobustness [36, 16, 38, 48, 18], fairness [10, 21], generalization [2] and explanation [12].
In order tomore precisely characterize the local behavior of a network, we consider local Lipschitz constantswhich are only required to hold for a small local region.
Intuitively they characterize how fast theoutput of the network changes between any two input within the region.
It is challenging to exactly and efficiently compute local Lipschitz constants.
Naive approaches suchas computing the product of the induced norm for all layers cannot capture local information andtypically produce vacuous bound that are not useful in practice.
On the other hand, Jordan & Dimakis[20] used mixed-integer programming (MIP) to compute exact local Lipschitz constants for small
ReLU networks (e.g., up to a few hundred neurons), but solving a MIP is often too inefficient and thisapproach cannot scale to slightly larger networks.
Another line of works focus on computing a relaxedupper bound for better scalability compared to MIP.
Bound propagation methods [44, 47, 34] whichcan compute guaranteed lower or upper bounds for neural network verification have been appliedto bound the Jacobian [43, 48], which can produce local Lipschitz constant.
Bound propagationcomputes the linear relationship between layers, where nonlinearities in networks are relaxed intolinear bounds, e.g., nonlinear activations can be bounded by two lines.
However, when bounding thegradient of ReLU activation in the chain rule for computing Jacobian, in nontrivial cases, existingbound propagation methods [43, 48] degenerate to loose interval bounds [17, 29, 15] that only use bounding lines with zero slopes.
Moreover, most of these works only used small toy models andcannot feasibly handle larger practical networks.
In this paper, we aim to efficiently compute relatively tight ℓ ∞ local Lipschitz constants.
We formulatethe problem as upper bounding the norm of the Clarke Jacobian by the chain rule; and we viewthe computation for this norm as a higher-order backward computational graph augmented to theoriginal forward graph of the network, which allows us to develop a scalable and flexible frameworkfor practical neural networks.
Our contributions can be summarized as follows:
First, we generalize existing linear bound propagation methods, originally used for neural network verification, to a higher-order backward computational graph for bounding Clarke Jacobian.
Second, on the backward graph, we propose tightlinear relaxations for Clarke gradients in the chain rule, while previous works degenerate to looseinterval bounds in nontrivial cases.
When time budget allows, we further tighten our bounds via Branch-and-Bound, for a trade-off between tightness and time cost.
Lastly, our experiments showthat our method efficiently produces tightest ℓ ∞ local Lipschitz constants compared to other relaxedmethods, and is much more efficient than the exact MIP method.
Moreover, while previous workscommonly used small toy models, our method can scale to much larger models including practicalconvolutional neural networks (CNN) that previous works could not handle.
We also demonstrate anapplication of our method for provably analyzing the monotonicity of neural networks.
Related Work2.1 Computing Lipschitz Constants
For neural networks, a loose global Lipschitz constant (upper bound) can be computed by the productof layer-wise induced norms [36].
Based on this product, Virmaux & Scaman [39] considered theeffect of activation and approximated upper bounds which, however, are not guaranteed; Gouk et al.[14] used a power method for convolutional layers.
LipSDP [11] used semidefinite programming(SDP) to compute tighter bounds.
Global Lipschitz constants can be much looser than local Lipschitzconstants as they have to hold even for distinct input points, and they cannot characterize the localbehavior of neural networks.
Thus we focus on local Lipschitz constants in this paper.
On local Lipschitz constants, LipMIP [20] used mixed integer programming (MIP) to compute exactresults, which is costly and cannot scale to slightly larger models.
LipOpt [13] used polynomialoptimization but is still inefficient and limited to smooth activations not including the widely used ReLU.
Avant & Morgansen [1] derived layer-wise analytical bounds but only on a simplified definitionfor Lipschitz constants, which cannot characterize Lipschitzness in the entire local region.
Several other works used methods essentially based on interval bound propagation [17, 29, 15] whichcomputes an interval of lower and upper bounds for each element in the network or the chain rule for
Jacobian.
Among them, RecurJac [48], improved from FastLip [43], has a recursive procedure totighten bounds in some special cases but still uses interval bounds in nontrivial cases; and a concurrentwork [24] handled non-smooth input perturbations.
However, interval bounds are known to be veryloose [49].
Bhowmick et al.
[3] combined interval bounds with branch-and-bound to compute exactlocal Lipschitz constants, which is inefficient due to loose interval bounds.
In contrast, we proposetight linear relaxation for computing local Lipschitz constants with bound propagation.
2.2 Certified Bounds for Neural Networks
Computing sound local Lipschitz constants is also closely related to neural network verificationwhich computes certified output bounds.
Some works computed exact bounds by satisfiabilitymodulo theory [22] or mixed integer linear programming [37].
For more efficient verification, boundpropagation with convex relaxations has been proposed [44, 41, 47, 43, 34, 31].
In addition, Branchand-Bound can be used to compute tighter bounds [22, 5, 6, 40, 41, 46, 42] by branching activationsor input and bounding each smaller subdomain respectively.
Although bound propagation has beengeneralized to general computational graphs [45], they
Background3.1 ReLU Network
Suppose f ( x ) is a neural network given input x ∈ R d .
For the simplicity of presentation, we mainly assume the neural network is feedforward with ReLU activation throughout the paper, but our method can be applied to general network architectures and activations as will be discussed in Section 4.
Suppose the network has n layers, it takes input h 0 ( x ) =
x and then computes ∀ i ∈ [ n ] , z i ( x )
= W i h i − 1 ( x ) + b i , ∀ i ∈ [ n − 1] , h i ( x ) = σ ( z i ( x )) , h n ( x ) =
z n ( x ) , where i ∈ [ n ] means 1 ≤ i ≤ n , z i ( x ) is the pre-activation output of the i -th linear layer with weight
W i and bias b i , and h i ( x ) is the output after activation σ ( · ) .
This formulation also supports CNNssince convolutional layers are also linear.
3.2 Lipschitz Constant
The ( α, β ) -Lipschitz constant of a network f ( x ) over an open set X ∈ R d is defined as:
[Equation]
If f is smooth and ( α, β ) -Lipschitz continuous over X , the Lipschitz constant can be computedby upper bounding the norm of Jacobian, i.e., L ( α,β ) ( f, X ) =
sup x ∈X ∥∇ f ( x ) ∥ α,β .
Since neuralnetworks with non-smooth ReLU activation are non-smooth functions, we consider Clarke Jacobian(generalized Jacobian) [7] instead, which is defined as the convex hull of lim i →∞ ∇ f ( x i ) for anysequence { x i } [-
-]∞ i =1 such that every f ( x i ) is differentiable at x i .
We denote the Clarke Jacobian at xas ∂f ( x ) , and then L ( α,β ) ( f, X ) = sup x ∈X , J ( x ) ∈ ∂f ( x ) ∥
J ( x ) ∥ α,β .
Global Lipschitz constant, which considers the supremum over X = R d , needs to guarantee Eq.
(1)even for distant x 1 , x 2 , and thus it can be loose and cannot capture the local behavior of the network.
We focus on local Lipschitz constants, where X is a small local region.
Specifically, we consider
X =
B p ( x 0 , ϵ ) :
= { x : ∥ x − x 0 ∥ p ≤ ϵ } which is a small ℓ p -ball around x 0 , and then the local Lipschitz constant only needs to hold for input near a clean data point x 0 .
We focus on ℓ ∞ local Lipschitz constants in this paper, where α = β = ∞ for the aforementioned definition.
3.3 Backward Bound Propagation
To bound the Clarke Jacobian, we will use bound propagation which is originally used to for certifiablybounding the output of neural networks.
We adopt a backward bound propagation [47, 44, 34, 45]which typically propagates the linear relationship between the output layer to be bounded and allthe previous layers it depends on.
Suppose we want to compute certified bounds for output layerh n ( x ) w.r.t.
all x from a small domain B p ( x 0 , ϵ ) .
Starting from the output layer, we take A n = I ,and then h n ( x ) =
A n h n ( x ) .
For every i ∈ [ n ] , suppose h
i
x ) can be bounded by linear functionsw.r.t.
h i − 1 ( x ) parameterized by P
i , P i , q i , q i (the bounds elementwise hold):
[Equation]
Then for every i = n, n − 1 , · · · , 1 in order, A i h i ( x ) can be recursively bounded by substitutingh i ( x ) with Eq. (2), and then A i h i ( x ) ≤ A i − 1 h
i − 1 ( x )
+ c i , with:
[Equation]
where [ · ] + stands for taking positive elements from the matrix or vector, and vice versa for [ · ] − .
A i − 1stands for the coefficients of the linear relationship propagated from layer i to layer i − 1 , and c i is abias term produced at this layer.
By this recursive procedure in a backward manner and accumulatingc i ( i ∈ [ n ]) , eventually bounds are propagated to the input layer as h n ( x ) ≤ A 0 x + (cid:80) ni
=1 c i , whichdirectly represents the linear relationship between the output layer and x .
We can eliminate x from A 0 x to obtain final bounds by considering the domain of x .
In particular, when x ∈ B p ( x 0 , ϵ ) ( p ≥ 1) ,for every j -th dimension of h n ( x ) , we can use the fact that [ A 0 ] j, : x ≤ [ A 0 ] j, : x 0 + ϵ ∥ [ A 0 ] j, : ∥ q ,where [ A 0 ] j, : stands for the j -th row in A 0 , q =1 / (1 − 1 /p ) , and q -norm is the dual-norm of p -norm.
All the bounds here provably hold for any x ∈ B p ( x 0 , ϵ ) , and lower bounds can also be obtained bya similar bound propagation.
Parameters in Eq.
(2) can be obtained by considering the relation between h i ( x ) and h i − 1 ( x ) .
Wecan first obtain bounds l i ≤ z i ( x ) ≤ u i using bound propagation by viewing z i ( x ) as the output layer.
Then the linear relaxation bounds h
i ( x ) =
σ ( z i ( x )) with linear functions of z i ( x ) :
[Equation]
For every neuron j , if [ l i ] j ≥ 0 or [ u i ] j ≤ 0 , σ ( z i ( x ))
=
z i ( x ) or σ ( z i ( x ))
=
respectively isalready linear, and then we can simply take [ s i ]
j [ z i ( x )]
j +[ t i ] j
=
[ s i ] j [ z i ( x )]
j +[ t i ] j = σ ( z i ( x )) .
Otherwise when [ l i ] j < 0 < [ u i ] j , as illustrated in Figure 1, the upper bound can be the line passing
ReLU activation at [ z i ( x )]
j = [ l i ] j and [ z i ( x )]
j = [ u i ] j respectively, i.e., [ s i ] j [ z i ( x )]
j + [ t i ] j = 130 (cid:0) σ ([ u i ] j ) − σ ([ l i ] j ) [ u i ] j − [ l i ] j (cid:1)
( z i ( x ) − [ l i ] j ) + σ ([ l i ] j ) ; the lower bound can be any line with a slope between0 and 1 and a bias of 0, i.e., 0 ≤ [ s i ] j ≤ 1 , [ t i ] j = 0 , where [ s i ]
j can be viewed as a parameteroptimized with an objective of tightening output bounds [28, 46, 30].
To satisfy Eq.
(2), we can take:
P i =
diag( s i ) W
i , P i = diag( s i )
W
i , q i = diag( s i ) b i + t i , q i = diag( s i ) b i + t i .
[Figure] [Figure]
Methodology
We present our method in this section.
We first present a novel view to formulate the local Lipschitzconstant computation as a higher-order backward computational graph, and use bound propagation toobtain the bounds of the Clarke Jacobian.
We discuss our methods for tightly bounding non-linearitiesin Clarke Jacobian.
Finally, we use Branch-and-Bound to further tighten the bounds.
4.1 Clarke Jacobian for ReLU Networks
In ReLU networks, the ReLU activation for a single neuron is defined as σ ( x ) = max { x, 0 } .
It is nonsmooth at x =0 .
When computing the Lipschitz constant, we consider Clarke gradient [7] denotedas ∂σ ( x ) : when x < 0 , ∂σ ( x ) = { 0 } ; when x > 0 , ∂σ ( x ) = { 1 } ; and when x = 0 , ∂σ ( x ) =
For the i -th layer (1 ≤ i<n ) , we use a diagonal matrix ∆ i ( x ) to denote a Clarke gradient of ReLUactivation for all the neurons in the layer, where ∆ i ( x ) ∈ ∂σ ( z i ( x )) , [∆ i ( x )] jj ∈ ∂σ ([ z i ( x )] j ) , and∂σ ([ z i ( x )] j ) is the Clarke gradient of the j -th neuron.
Then a chain rule can be used to compute the Clarke Jacobian for the whole network [19, 20].
Denote J i ( x )
∈ ∂f ( x ) ∂h i − 1 ( x ) as a Clarke Jacobian w.r.t.the
( i − 1) -th layer in the chain rule. We have J n ( x ) =
W n , and for all i ∈ [ n − 1] , we have
[Equation]
Finally J 1 ( x ) ∈ ∂f ( x ) is a Clarke Jacobian of the entire network [20].
As we aim to compute theℓ ∞ local Lipschitz constant, we upper bound ∥
J 1 ( x ) ∥ ∞ ( J 1 ( x ) ∈ ∂f ( x )) w.r.t.
all x ∈ X .
x z 1 ( x ) h 1 ( x ) z n-1 ( x ) h n-1 ( x ) h n ( x ) σ … σ
W n, b n
J n ( x ) J n-1 ( x ) σ’ Δ n-1 W n-1 J 1 ( x ) …
W n-1, b nǁJ 1 ( x ) ǁ
Norm
Backward graph (norm of Clarke Jacobian) Forward graph (original neural network computation) [Figure] The relies on values ( z 1 ( x ) , the gradient of activations.
Linear relaxation for two categories of nonlinearities in the
(nodes in
Clarke gradient ( σ
), are detailed in
Figure 2, Figure 4 and Figure 5.
also
Given the forward pass computation of the original network, we can formulate a computational graphfor ∥
J 1 ( x ) ∥ in a backward pass accordingly as shown in Figure 3.
We augment the original forwardgraph with the backward graph, and the backward graph has a dependency on the output of theforward graph due to ∆ 1 , ∆ 2 , · · · , ∆ n − 1 .
We build the augmented graph by traversing the forwardgraph, similar to automatic differentiation for neural network training.
The computational graphformulation for Clarke Jacobian allows our method to be easily generalized to different networkarchitectures, with a bound propagation framework for general neural networks [45], as long as thelinear relaxation for all the involved nonlinearities is well derived.
We use the bound propagation framework described in Section 3.3 to upper bound ∥ J 1 ( x ) ∥ ∞ .
On thebackward graph, when bounds are propagated to J i ( x ) , we use (cid:101)
A i to denote the coefficient matrix,and we use (cid:101) c i to denote the bias term (in contrast to A i and c i in Eq.
and then we have: ∀ i ∈[ n ] , ∥ J 1 ( x ) ∥ ∞ ≤ (cid:101)
A i J i ( x ) + (cid:80) i − 1 j {+=
 (cid:101)+} c j .
As intermediate bounds for z i ( x ) are needed for boundingthe forward graph, we also need intermediate bounds L i ≤ J i ( x ) ≤ U i ( ∀ x ∈X ) for the backwardgraph.
And there are particularly two categories of nonlinearities to be tackled on the backwardgraph: 1) Norm in ∥ J 1 ( x ) ∥ ∞ ; 2) J i +1 ( x )
∆ i ( ∀ i ∈ [ n − 1]) in Eq.
(6), which applies the Clarkegradient of ReLU on the later layer’s Clarke Jacobian.
We handle them in Section 4.2 and Section 4.3respectively.
Then bounds can be propagated starting at ∥ J 1 ( x ) ∥ ∞ , to J 1 ( x ) , J 2 ( x ) , · · · , J n ( x ) inorder.
Bounds are eventually propagated to J n ( x ) as ∥ J 1 ( x ) ∥ ∞ ≤ (cid:101)
A n J n ( x ) + {+(cid:80) i − 1 j =
+}
(cid:101) c j , where J n ( x ) can be substituted by J n ( x ) =
W n (Eq.
(6)), which yields final bounds on ∥ J 1 ( x ) ∥ ∞ .
4.2 Norm of Clarke Jacobian
The ℓ ∞ norm of Clarke Jacobian is the first nonlinearity we would encounter during backward boundpropagation, as it is the last node in the backward graph (see Figure 3).
When f ( x ) is a K -wayclassifier and f ( x ) ∈ R k , we have J 1 ( x ) ∈ R K × d , and its norm is computed as ∥ J 1 ( x ) ∥ ∞ =max 1 [-= max 
-]≤ k ≤ K (cid:80) dj
=1 (cid:12)(cid:12)
[ J 1 ( x )] kj (cid:12)(cid:12) , where K rows in J 1 ( x ) can be bounded separately, and after that wecan aggregate results on K rows by taking the max .
For the simplicity of the following analysis,we assume K = 1 as we can handle one row in J 1 ( x ) at each time, but they can still be batched inimplementation.
Then Clarke Jacobian J i ( x ) ( i ∈ [ n ]) and its bounds L i , U i can be viewed as rowvectors, and we will use [ · ] j to denote the j -th element.
By a tight linear relaxation for | · | as shownin Figure 2 (only the upper bound is needed), we have the following bound for ∥ J 1 ( x ) ∥ ∞ :
Proposition 1.
Suppose ∀ j [-
-]∈ [ d ] , [ L 1 ] j ≤ [ J 1 ( x )] j ≤ [ U 1 ] j ( ∀ x ∈ X ) , the following bound holds:∥
[Equation]
, where [ (cid:101)
[Equation]
We prove it in Appendix C.1, and this propagates bounds from the norm of Clarke Jacobian to J 1 ( x ) .
Clarke Gradient of the Activation
For each layer i ∈ [ n − 1] in the chain rule for computing the Clarke Jacobian as Eq.
(6), J i +1 ( x )∆ i ( x )is involved in addition to fixed weight matrix W i .
∆ i ( x ) is determined by pre-activation value z i ( x )from the forward graph.
For the j -th neuron in the layer, [ J i +1 ( x )∆ i ( x )]
j =
[ J i +1 ( x )]
j [∆ i ( x )] jj ,when [ u i ] j < 0 or [ l i ] j > 0 , we have [∆ i ( x )]
jj =0 and [∆ i ( x )]
jj =1 respectively fixed, and thenfor these special cases [ J i +1 ( x )∆ i ( x )]
j is linear w.r.t.
[ J i +1 ( x )]
j .
Otherwise, [ J i +1 ( x )∆ i ( x )] j isnonlinear since both [ J i +1 ( x )]
j and [∆( x )]
jj may vary given different x ∈ X .
We then focus onrelaxing the nonlinearity [ J i +1 ( x )]
j [∆ i ( x )]
jj given [∆ i ( x )]
jj = [0 , 1] .
[Figure]
much tighter bounds (
[Figure]
) -J i+1 ( x ) -σ(-
J i+1 ( x ))
σ’ J i ( x ) Δ i
z i (x) each Clarke gradient.
It is the internal computation for boxes in Figure 3.
Two ReLU nodes are inserted as per Proposition 2.
In bound propagation, the σ ′ node takes intermediate bounds from z i ( x ) to decide whether bounds are directly propagated from J i +1 ( x ) (no relaxation needed), or indirectly via σ ( J i +1 ( x )) and − σ ( − J i +1 ( x )) (with relaxation), for each neuron respectively.
As illustrated in Figure 4, the solid blue line and solid red line are the exact upper and lower boundrespectively for [ J i +1 ( x )
∆ i ( x )] j , which are piecewise linear w.r.t.
[ J i +1 ( x )]
j .
The most nontrivialcase appears when [ L i +1 ( x )]
j < 0 <
[ U i +1 ( x )]
j , where exact bounds for [ J i +1 ( x )∆ i ( x )] j arenonlinear given the input region.
We relax the exact bounds into linear bounds that can be handledby bound propagation with linear relaxation.
Previous works such as RecurJac [48] have not tightlybounded this linearity in the nontrivial case and commonly degenerate to interval bounds (dashedgreen lines with zero slopes in the figure, which are loose bounds).
In contrast, we propose a tight linear relaxation (dashed blue and red lines in Figure 4).
We observethat the exact upper bound is essentially a ReLU function of J i +1 ( x ) (solid blue line in Figure 4),and the exact lower bound can be viewed as a ReLU function flipped both horizontally and vertically(solid red line in Figure 4).
Formally, we have:
Proposition 2.
For the j -th neuron in layer i ( i ∈ [ n − 1]) , if [∆ i ( x )] jj = [0 , 1] , we have:[ J i +1 ( x
[Equation]
which can be rewritten using ReLU activation:
[Equation]
Its correctness can be easily verified by considering the sign of [ J i +1 ( x )]
j as shown in Appendix C.2.
We then decompose [ J i +1 ( x )∆ i ( x )]
j into two ReLU activations (Eq.
(8)), as illustrated in Figure 5.
ReLU can be further relaxed by Eq.
(4), as derived in Appendix C.3, which yields:
Proposition 3.
For the j -th neuron in the i -th layer ( i ∈ [ n − 1] ), given [∆ i ( x )]
jj = [0 , 1] and[ L i +1 ]
j ≤ [ J i +1 ( x )]
j ≤ [ U i +1 ]
j , we have the following relaxation:[ J
[Equation]
[Equation]
[Equation]
[Equation]
[ (cid:101) s i +1 ] j [ J i +1 ( x )] j
[Equation]
[ (cid:101)
[Equation]
i +1 ] j , [ J i +1 [-] j ) = ) 
 [ L-]( x )∆ i ( x )]
j ≤ [ (cid:101) s i
+1 ]
j [ J i +1 ( x )] j + [ (cid:101) t i +1 ] j ,where [ (cid:101)
s i
+1 ]
j = − σ ( − [ U i +1 ] j ) [-= ) 
-]+ σ ( − [ L i +1 ]
j )
[ U i +1 ]
j − [ L i +1 ]
j , [ (cid:101) t i +1 ] j = − [ (cid:101) s i
+1 ]
j [ L i +1 ]
j [Equation]
[Equation]
[ L i +1 ] j ) , [
[Equation]
i +1 ] [Equation] +1 ] [Equation]
[Equation]
+1 ]
[Equation]
[ U i +1 ]
[Equation]
[Equation]
+1 ] j
[Equation]
[Equation]
t i +1 ]
[Equation]
i +1 ]
[Equation]
[ L i +1 ]
[Equation]
+
[Equation]
([ L i +1 ] j ) .
In the following theorem, we show that relaxation in Proposition 3 is the tightest linear relaxation:
Theorem 4.
For the j -th neuron in the i -th layer ( i ∈ [ n − 1] ), and any s, t, s, t satisfying
[Equation]
we have
[Equation]
where [ (cid:101) s i
+1 ]
j , [ (cid:101) t i +1 ]
j , [ (cid:101) s i
+1 ] j , [ (cid:101) t i +1 ] j are by Proposition 3. This theorem states that our proposed linear relaxation is provably tighter than any other valid linearrelaxation.
We prove this theorem in Appendix C.4.
4.4 Branch and Bound
Formulating the backward computational graph also enables the use of Branch-andBound (BaB) to further tighten the bounds if time budget allows.
We denote C={ ( l 1 , u 1 ) , ( l 2 , u 2 ) , · · · ( l n − 1 , u n − 1 ) } as the domain of all pre-activation bounds of ReLU neuronsbefore BaB, not including ReLU from Eq.
We use C to denote a pool of domains that we currentlyhave, and initially C =
{C 0 } .
BaB aims to recursively split domains in C into smaller subdomains
C 1 , C 2 , · · · , where C 0 = C 1 (cid:83) C 2 (cid:83) · · · , and bounds for each domain can be computed respectivelyusing bound propagation, since linear relaxation can generally be tighter with smaller domains.
At each iteration, we take B domains in C with loosest bounds, where B is the batch size for BaB.
For each domains, we choose one layer
ˆ i and one ReLU neuron ˆ j in layer
ˆ i on the forward graph,such that the neuron has uncertain Clarke gradient ( [ l ˆ i ]
ˆ j ≤ 0 ≤ [ u ˆ i ] ˆ j ).
We branch this domain into twosubdomains with intermediate bounds ([ l ˆ i ] ˆ j , − ˜ ϵ ) and (˜ ϵ, [ l ˆ i ] ˆ j ) respectively, where ˜ ϵ is a sufficientlysmall value (e.g., 10 − 9 ).
Thereby, the Clarke gradient for ReLU becomes certain in each subdomain(0 and 1 respectively) with other neurons unchanged.
We compute the bounds for the new subdomains,and we repeat this process until reaching a time limit or there is no domain left to branch.
We use a heuristic score to decide which neuron to branch for a given domain, by estimating thepotential improvement to the bounds after the branching [5].
Here for branching a ReLU neuronon the forward graph, we estimate the potential improvement on the bounds of the backward graph.
In particular, suppose neuron ˆ j in layer
ˆ
i is branched, the gap between the upper and lower boundin the liner relaxation is eliminated, which can tighten the final bound.
We estimate the area of thegap before branching (the gap between the blue dashed line and the red dashed line in Figure 4)as 12 ([ U ˆ
i +1 ]
ˆ j − [ L ˆ i +1 ] ˆ j ) 2 , multiplied by the coefficient [ (cid:101)
A ˆ i ] ˆ j from the bound propagation as theheuristic score.
We thereby branch neurons with highest scores.
Experiments
In our experiments, we focus on evaluating the tightness of ℓ ∞ local Lipschitz constant bounds andthe efficiency of computation.
There are three parts: 1) We compare the tightness and efficiency onrelatively small models and synthetic data, to accommodate slow baselines; 2) We also use practicalimage datasets with larger models.
3) Finally, we demonstrate an application of our method onanalyzing the monotonicity of neural networks.
Additional experimental details are provided in Appendix B.
Baselines We compare our methods to the following baselines: NaiveUB upper bounds Lipschitzconstants simply by multiplying the induced norm of each layer, which can scale to arbitrarily largemodels but the bound is often vacuous; LipMIP [20] computes exact local Lipschitz constants using
MIP, which compute the exact (tightest) bound but can only work for very small models.
LipSDP [11]computes upper bounds of ℓ 2 local Lipschitz constants using SDP, and we convert their ℓ 2 results intoupper bounds for the ℓ ∞ -case by a √ d factor.
Since LipSDP by itself does not support the ℓ ∞ casewhich may not be the intended use of LipSDP, the results converted from the ℓ 2 case are for reference only.
LipBaB
[3] uses loose interval bounds with branch-and-bound.
RecurJac [48] uses boundpropagation with interval bounds in nontrivial cases but has tightened bounds for some special cases.
All the baselines do not support CNN in their implementation, and we convert the CNN models toequivalent MLP models for baselines.
[Table]
5.1 Comparison on a Synthetic Dataset
We follow Jordan & Dimakis [20] and train several small models on a synthetic dataset.
We comparedifferent methods on models with varying width as shown in Table 1, and we also show results withvarying depth and ϵ in Appendix A.1.
Since some of these models are already large for LipMIP, weset a time limit of 1000 seconds, and we report the upper bound it returns at timeout.
For our BaB,we set a timeout of 60 seconds and stop further branching at timeout.
Without BaB, our method is very efficient while it already outperforms baselines on tightness exceptfor LipMIP on the smallest MLP.
Compared to LipMIP, for the smallest MLP on which LipMIP doesnot timeout, our result without BaB is very close to their exact result; and for other relatively largermodels, LipMIP cannot produce exact results within the timeout and our result is much tighter thanthe upper bounds by LipMIP.
And LipSDP fails to yield results within the timeout on many models.
Although LipBaB has BaB to tighten bounds, their results are still loose within the time budget,since their BaB is based on loose interval bounds and is thus inefficient.
RecurJac is a relativelyefficient baseline but still returns looser bounds compared to our method.
Our BaB further improvesthe tightness of our bounds, and our method with BaB consistently produces tightest results within areasonable time budget, compared to all the baselines.
[Table]
To further evaluate the scalability of different methods to relatively large models, we then conductexperiments on image datasets including MNIST [26], CIFAR-10 [23] [Table] and TinyImagenet [25].
Weuse a 3-layer MLP and a 4-layer CNN on MNIST, and we use 4-layer and 6-layer CNN models on
CIFAR-10 and TinyImageNet.
All the models here are too large for LipSDP. LipMIP and LipBaBcan only handle the MLP model on MNIST, and they cannot return any valid upper bound for the
CNN models within a reasonable time budget. RecurJac can handle the CNN model on MNIST, butother CNN models on CIFAR-10 and TinyImageNet are still too large for RecurJac after converted toequivalent MLP models.
In contrast, our formulation for the backward computational graph allowsus to utilize the efficient bound propagation for convolutional layers from Xu et al. [Table]
[Table]
We show results on MNIST in Table 2.
Our results are much tighter compared to the baselines even ifwe do not enable BaB [Table] and BaB can further tighten results.
On CIFAR-10 and TinyImageNet, wedo not enable BaB on to save time cost on relatively larger models
[Table] and we show results in Table 3. Our method can scale to these larger CNNs that previous works could not handle. In addition, weimplement RecurJac’s looser relaxation in our framework and report its results which are much worsethan our results.
We present additional results in Appendix.
5.3 An Application on Monotonicity Analysis
We further use an application to demonstrate that our proposed method can be used to check themonotonicity of neural networks.
Given a network, we aim to check whether the network’s output isa monotonic function w.r.t.
each input feature.
Monotonicity can be preferred properties in somereal-world scenarios [33, 8, 27, 35].
In this experiment, we adopt the Adult dataset [4], with a binaryclassification task about predicting income level.
There are only several continuous features, and weaim to check the monotonicity of income level w.r.t.
age, education number, capital gain, capitalloss, and hours per week.
We train an MLP model on this dataset and verify its monotonicity on thefirst 100 test examples.
Signs of Clarke Jacobian can be used to check monotonicity [32], and weachieve this by checking the bounds of Clarke Jacobian.
For each continuous feature j we concern,we set an input domain X j where only this particular feature can be varied between the minimumand maximum possible values of this feature in the dataset, while we keep other features fixed.
And then we obtain bounds on the Clarke Jacobian of the output class for high income level, as
L 1 ≤ J 1 ( x ) ≤ U 1 ( ∀ x ∈ X j ) .
Then if [ L 1 ] j > 0 , the predicted confidence on high income levelis monotonically increasing w.r.t.
feature j , and vice versa.
We count the percentage of examplesthat satisfy each type of monotonicity respectively.
We show results in Table 4.
It suggests that thepredicted confidence on high income level tends to be monotonically increasing w.r.t.
age, educationnumber on at least part of the examples, and hours per week, which is reasonable.
Results alsosuggest that the models learn little monotonicity on capital gain or loss features.
We also compareours results with those by RecurJac, and our method verifies more monotonicity than RecurJac.
Weexpect the gap to be larger if the models and datasets are larger.
Conclusion
In this paper, we propose an efficient framework to compute tight ℓ ∞ local Lipschitz constants forneural networks by upper bounding the norm of Clarke Jacobian.
We model the computation for the
Clarke Jacobian as a backward computational graph.
On the backward graph, we conduct boundpropagation and propose tight linear relaxation for nonlinearities in Clarke Jacobian.
We furthertighten bounds with branch-and-bound when time budget allows.
Experiments show that our methodefficiently produces much tighter results compared to existing relaxed methods and can scale to largerconvolutional networks on which previous works cannot handle.
We also use our method to analyzethe monotonicity of neural networks as a potential application.
However, it remains challenging tohandle even more large-scale models such as those for ImageNet [9], and it will be interesting forfuture work to further extend the scalability. In addition, we have focused on the ℓ ∞ case only, andfuture work may investigate and solve challenges in extending this work to other norms. Checklist For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’scontributions and scope?
[Yes](b) Did you describe the limitations of your work?
[Yes](c) Did you discuss any potential negative societal impacts of your work? [N/A] Our workwill potentially enable users to better verify and understand the properties of neuralnetworks, for more reliable and trustworthy deployment in the future. We believe thereis no negative social impact.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e
g., data splits, hyperparameters,
how they
were chosen)?
[Yes]
(c) Did you report error bars (e.g., with respect to the random seed after running exper-
iments multiple times)?
[N/A]
There is no randomness in our computation for local
Lipschitz constants.
(d) Did you include the total amount of compute and the type of resources used (e
g., type
of GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes]
(b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[Yes]
(e) Did you discuss whether the data you are using/curating contains personally identifiable
information or offensive content?
[Yes]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential