An Efﬁcient Framework for Computing Tight Lipschitz Constants of Neural Networks
Anonymous Author(s)
AfﬁliationAddress email
Abstract
Lipschitz constants are connected to many properties of neural networks, such asrobustness, fairness, and generalization.
Existing methods for computing Lipschitzconstants either are computationally inefﬁcient or produce loose upper bounds.
In this paper, we develop an efﬁcient framework for computing the ` 1 local
Lipschitz constant of a neural network by tightly upper bounding the norm of
Clarke Jacobian.
We view the computation for Clarke Jacobian by chain rule asa higher-order backward computational graph.
On this graph, we adopt boundpropagation with linear relaxation to obtain provable bounds, and we derive tightlinear relaxations for speciﬁc nonlinearities in Clarke Jacobian that previous workscould not tightly bound.
We further tighten our bounds by Branch-and-Bound(BaB) when time budget allows.
Experiments show that on tiny models, ourmethod produces comparable bounds compared to exact methods that cannot scaleto slightly larger models; on larger models, our method efﬁciently produces tighterresults than existing relaxed or naive methods, and our method scales to muchlarger practical models that previous works could not handle.
We also demonstratea potential application of our method for provable monotonicity analysis.
Introduction
Lipschitz constants are important for characterizing many properties of neural networks, includingrobustness [36, 16, 38, 48, 18], fairness [10, 21], generalization [2] and explanation [12].
In order tomore precisely characterize the local behavior of a network, we consider local Lipschitz constantswhich are only required to hold for a small local region.
Intuitively they characterize how fast theoutput of the network changes between any two input within the region.
It is challenging to exactly and efﬁciently compute local Lipschitz constants.
Naive approaches suchas computing the product of the induced norm for all layers cannot capture local information andtypically produce vacuous bound that are not useful in practice.
On the other hand, Jordan & Dimakis[20] used mixed-integer programming (MIP) to compute exact local Lipschitz constants for small
ReLU networks (e.g., up to a few hundred neurons), but solving a MIP is often too inefﬁcient andthis approach cannot scale to slightly larger networks.
Another line of works focus on computinga relaxed upper bound for better scalability compared to MIP.
Weng et al.
[43], Zhang et al. [48]used bound propagation methods to bound the Jacobian and compute local Lipschitz bounds. Inneural network veriﬁcation, linear bound propagation [44, 47, 34] methods compute guaranteedoutput bounds for neural networks by propagating the linear relationship between layers, wherenonlinearities in networks are relaxed into linear bounds, e.g., activation functions can be bounded bytwo lines.
However, for nontrivial cases when bounding the gradient of ReLU activation in Jacobiancomputation, Weng et al. [43], Zhang et al. [48] essentially used loose interval bounds [17, 29, 15]that only take horizontal bounding lines with zero slopes, instead of tighter linear relaxation bounds.
Moreover, most of these works only used small toy models and cannot feasibly handle larger practicalnetworks.
In this paper, we aim to efﬁciently compute relatively tight ` 1 local Lipschitz constants.
We formulatethe problem as upper bounding the norm of the Clarke Jacobian by the chain rule; and we viewthe computation for this norm as a higher-order backward computational graph augmented to theoriginal forward graph of the network, which allows us to develop a scalable and ﬂexible frameworkfor practical neural networks.
Our contributions can be summarized as follows:
First, we generalize existing linear bound propagation methods, originally used for neural network veriﬁcation, to a higher-order backward computational graph for bounding Clarke Jacobian.
Second, on the backward graph, we propose tightlinear relaxations for Clarke gradients with an optimality guarantee, which is signiﬁcantly differentfrom relaxing activation functions in neural network veriﬁcation, while previous works used looseinterval bounds in nontrivial cases for local Lipschitz contants.
When time budget allows, we furthertighten our bounds via Branch-and-Bound, for a trade-off between tightness and time cost.
Lastly,our experiments show that our method efﬁciently produces tightest ` 1 local Lipschitz constantscompared to other relaxed methods, and is much more efﬁcient than the exact MIP method.
Moreover,while previous works commonly used small toy models, our method can scale to much larger modelsincluding practical convolutional neural networks (CNN) that previous works could not handle.
Wealso demonstrate an application of our method for provably analyzing the monotonicity of neuralnetworks.
Related Work2.1 Computing Lipschitz Constants
For neural networks, a loose global Lipschitz constant (upper bound) can be computed by the productof layer-wise induced norms [36].
Based on this product, Virmaux & Scaman [39] considered theeffect of activation and approximated upper bounds which, however, are not guaranteed; Gouk et al.[14] used a power method for convolutional layers.
LipSDP [11] used semideﬁnite programming(SDP) to compute tighter bounds.
Global Lipschitz constants can be much looser than local Lipschitzconstants as they have to hold even for distinct input points, and they cannot characterize the localbehavior of neural networks.
Thus we focus on local Lipschitz constants in this paper.
On local Lipschitz constants, LipMIP [20] used mixed integer programming (MIP) to compute exactresults, which is costly and cannot scale to slightly larger models.
LipOpt [13] used polynomialoptimization but is still inefﬁcient and limited to smooth activations not including the widely used
ReLU.
Avant & Morgansen [1] derived layer-wise analytical bounds but only on a simpliﬁed deﬁnitionfor Lipschitz constants, which cannot characterize Lipschitzness in the entire local region.
Several other works used methods essentially based on interval bound propagation [17, 29, 15] whichcomputes an interval of lower and upper bounds for each element in the network or the chain rule for
Jacobian.
Among them, RecurJac [48], improved from FastLip [43], has a recursive procedure totighten bounds in some special cases but still uses interval bounds in nontrivial cases; and a concurrentwork [24] handled non-smooth input perturbations.
However, interval bounds are known to be veryloose [49].
Bhowmick et al.
[3] combined interval bounds with branch-and-bound to compute exactlocal Lipschitz constants, which is inefﬁcient due to loose interval bounds.
In contrast, we proposetight linear relaxation for computing local Lipschitz constants with bound propagation.
2.2 Certiﬁed Bounds for Neural Networks
Computing sound local Lipschitz constants is also closely related to neural network veriﬁcationwhich computes certiﬁed output bounds.
Some works computed exact bounds by satisﬁabilitymodulo theory [22] or mixed integer linear programming [37].
For more efﬁcient veriﬁcation, boundpropagation with convex relaxations has been proposed [44, 41, 47, 43, 34, 31].
In addition, Branchand-Bound can be used to compute tighter bounds [22, 5, 6, 40, 41, 46, 42] by branching activationsor input and bounding each smaller subdomain respectively.
Although bound propagation has beengeneralized to general computational graphs [45], they have not considered high-order computationalgraphs and did not provide necessary linear relaxation for nonlinearities in Clarke Jacobian.
Background 3.1 ReLU Network
Suppose f ( x ) is a neural network given input x 2 R d .
For the simplicity of presentation, we mainly assume the neural network is feedforward with ReLU activation throughout the paper, but our method can be applied to general network architectures and activations as will be discussed in Section 4.
Suppose the network has n layers, it takes input h 0 ( x ) =
x and then computes
[Equation]
where i 2 [ n ] means 1  i  n , z i ( x ) is the pre-activation output of the i -th linear layer with weight
W i and bias b i , and h i ( x ) is the output after activation  ( · ) .
This formulation also supports CNNssince convolutional layers are also linear.
3.2 Lipschitz Constant
The ( ↵ ,  ) -Lipschitz constant of a network f ( x ) over an open set X 2 R d is deﬁned as:
[Equation]
If f is smooth and ( ↵ ,  ) -Lipschitz continuous over X , the Lipschitz constant can be computedby upper bounding the norm of Jacobian, i.e., L ( ↵ ,  ) ( f, X ) =
sup x 2 X kr f ( x ) k ↵ ,  .
Since neuralnetworks with non-smooth ReLU activation are non-smooth functions, we consider Clarke Jacobian(generalized Jacobian) [7] instead, which is deﬁned as the convex hull of lim i ! 1 r f ( x i ) for anysequence { x i } {+
+} i =1 such that every f ( x i ) is differentiable at x i .
We denote the Clarke Jacobian at xas @ f ( x ) , and then L ( ↵ ,  ) ( f, X ) = sup x 2 X , J ( x ) 2 @ f
( x ) k J ( x ) k ↵ ,  .
Global Lipschitz constant, which considers the supremum over X = R d , needs to guarantee Eq.
(1)even for distant x 1 , x 2 , and thus it can be loose and cannot capture the local behavior of the network.
We focus on local Lipschitz constants, where X is a small local region.
Speciﬁcally, we consider
X =
B p ( x 0 , ✏ ) :
= { x : k x  x 0 k p  ✏ } which is a small ` p -ball around x 0 , and then the local 104 Lipschitz constant only needs to hold for input near a clean data point x 0 .
We focus on ` 1 local 105 Lipschitz constants in this paper, where ↵ =  = 1 for the aforementioned deﬁnition.
3.3 Backward Bound Propagation
To bound the Clarke Jacobian, we will use bound propagation which is originally used to for certiﬁablybounding the output of neural networks.
We adopt a backward bound propagation [47, 44, 34, 45]which typically propagates the linear relationship between the output layer to be bounded and allthe previous layers it depends on.
Suppose we want to compute certiﬁed bounds for output layerh n ( x ) w.r.t.
all x from a small domain B p ( x 0 , ✏ ) .
Starting from the output layer, we take A n = I ,and then h n ( x ) =
A n h n ( x ) .
For every i 2 [ n ] , suppose h
i
x ) can be bounded by linear functionsw.r.t.
h i  1 ( x ) parameterized by P
i , P i , q i , q i (the bounds elementwise hold):
[Equation]
Then for every i = n, n  1 , · · · , 1 in order, A i h i ( x ) can be recursively bounded by substituting 115 h i ( x ) with Eq.
(2), and then A i h
i ( x )  A i  1 h
i  1 ( x ) + c i , with:
[Equation]
where [ · ] + stands for taking positive elements from the matrix or vector, and vice versa for [ · ]  .
A i  1 117 stands for the coefﬁcients of the linear relationship propagated from layer i to layer i  1 , and c i is a 118 bias term produced at this layer.
By this recursive procedure in a backward manner and accumulatingc i ( i 2 [ n ]) , eventually bounds are propagated to the input layer as h n ( x )  A 0 x +
P ni =1 c i , which 120 directly represents the linear relationship between the output layer and x .
We can eliminate x from
A 0 x to obtain ﬁnal bounds by considering the domain of x .
In particular, when x 2 B p ( x 0 , ✏ ) ( p  1) ,for every j -th dimension of h n ( x ) , we can use the fact that [ A 0 ] j, : x  [ A 0 ] j, : x 0 + ✏ k
[ A 0 ] j, : k q ,where [ A 0 ] j, : stands for the j -th row in A 0 , q =1 / (1  1 /p ) , and q -norm is the dual-norm of p -norm.
All the bounds here provably hold for any x 2 B p ( x 0 , ✏ ) , and lower bounds can also be obtained bya similar bound propagation.
Parameters in Eq.
(2) can be obtained by considering the relation between h i ( x ) and h i  1 ( x ) .
Wecan ﬁrst obtain bounds l i  z i ( x )  u i using bound propagation by viewing z i ( x ) as the output layer.
Then the linear relaxation bounds h
i ( x ) =
( z i ( x )) with linear functions of z i ( x ) :
[Equation]
For every neuron j , if [ l i ] j  0 or [ u i ] j  0 ,  ( z i ( x ))
=
z i ( x ) or  ( z i ( x ))
=
respectively isalready linear, and then we can simply take [ s i ]
j [ z i ( x )]
j +[ t i ] j
=
[ s i ] j [ z i ( x )]
j +[ t i ] j =  ( z i ( x )) .
Otherwise when [ l i ] j < 0 < [ u i ] j , as illustrated in Figure 1, the upper bound can be the line passing
ReLU activation at [ z i ( x )]
j = [ l i ] j and [ z i ( x )]
j = [ u i ] j respectively, i.e., [ s i ] j [ z i ( x )]
j + [ t i ] j =  ([ u i ] j )   ([ l i ] j )
[ u i ] j  [ l i ] j  ( z i ( x )  [ l i ] j ) +  ([ l i ] j ) ; the lower bound can be any line with a slope between0 and 1 and a bias of 0, i.e., 0  [ s i ] j  1 , [ t i ] j = 0 , where [ s i ]
j can be viewed as a parameteroptimized with an objective of tightening output bounds [28, 46, 30].
To satisfy Eq.
(2), we can take:
P i =
diag( s i ) W
i , P i = diag( s i )
W
i , q i = diag( s i ) b i + t i , q i = diag( s i ) b i + t i .
Methodology
We present our method in this section.
We ﬁrst present a novel view to formulate the local Lipschitzconstant computation as a higher-order backward computational graph, and use bound propagation toobtain the bounds of the Clarke Jacobian.
We discuss our methods for tightly bounding non-linearitiesin Clarke Jacobian.
Finally, we use Branch-and-Bound to further tighten the bounds.
4.1 Clarke Jacobian for ReLU Networks
In ReLU networks, the ReLU activation for a single neuron is deﬁned as  ( x ) = max { x, 0 } .
It is nonsmooth at x =0 .
When computing the Lipschitz constant, we consider Clarke gradient [7] denotedas @ ( x ) : when x < 0 , @ ( x ) = { 0 } ; when x > 0 , @ ( x ) = { 1 } ; and when x = 0 , @ ( x ) =
For the i -th layer (1  i<n ) , we use a diagonal matrix  i ( x ) to denote a Clarke gradient of ReLUactivation for all the neurons in the layer, where  i ( x ) {+
 @+} ( z i ( x )) , [  i ( x )] jj 2 @ ([ z i ( x )] j ) , and@ ([ z i ( x )] j ) is the Clarke gradient of the j -th neuron.
Then a chain rule can be used to compute the
Clarke Jacobian for the whole network [19, 20].
Denote J i ( x ) 2 @ f ( x ) @
h i  1 ( x ) as a Clarke Jacobian w.r.t.the
( i  1) -th layer in the chain rule.
We have J n ( x ) =
W n , and for all i 2 [ n  1] , we have [Equation] i
[Equation]
Finally J 1 ( x ) 2 @ f ( x ) is a Clarke Jacobian of the entire network [20].
As we aim to compute the` 1 local Lipschitz constant, we upper bound k J 1 ( x ) k 1 ( J 1 ( x ) 2 @ f ( x )) w.r.t.
all x 2 X .
[Table]
The backward graph relies on the pre-activation values ( z 1 ( x ) , · · · , z n  1 ( x ) ) in the forward graph to compute the Clarke gradient of activations.
Linear relaxation for two categories of nonlinearities in the backward graph (nodes in purple), norm ( k J 1 ( x ) k ) and Clarke gradient (  0 ), are detailed in
Figure 2, Figure 4 and Figure 5.
We also perform branch-and-bound (BaB) to tighten the bounds by branching pre-activation nodes in the forward graph (nodes in green).
Given the forward pass computation of the original network, we can formulate a computational graphfor k J 1 ( x ) k in a backward pass accordingly as shown in Figure 3.
We augment the original forwardgraph with the backward graph, and the backward graph has a dependency on the output of theforward graph due to  1 ,  2 , · · · ,  n  1 .
We build the augmented graph by traversing the forward 156 graph, similar to automatic differentiation for neural network training.
The computational graphformulation for Clarke Jacobian allows our method to be easily generalized to different networkarchitectures, with a bound propagation framework for general neural networks [45], as long as thelinear relaxation for all the involved nonlinearities is well derived.
We use the bound propagation framework described in Section 3.3 to upper bound k J 1 ( x ) k 1 .
On thebackward graph, when bounds are propagated to J i ( x ) , we use e
A i to denote the coefﬁcient matrix,and we use e c i to denote the bias term (in contrast to A i and c i in Eq.
and then we have: 8 i 2[ n ] , k J
[Equation] x
[-A i J i ( x ) + (cid:80) i − 1 j =
 (cid:101) c-][Equation]
c j .
As intermediate bounds for z i ( x ) are needed for boundingthe forward graph, we also need intermediate bounds L i  J i ( x )  U i ( 8 x 2 X ) for the backward 165 graph.
And there are particularly two categories of nonlinearities to be tackled on the backwardgraph: 1) Norm in k J 1 ( x ) k 1 ; 2)
J i +1 ( x )  i ( 8 i 2 [ n  1]) in Eq.
(6), which applies the Clarke 167 gradient of ReLU on the later layer’s Clarke Jacobian.
We handle them in Section 4.2 and Section 4.3respectively.
Then bounds can be propagated starting at k J 1 ( x ) k 1 , to J 1 ( x ) , J 2 ( x ) , · · · , J n ( x ) inorder.
Bounds are eventually propagated to J n ( x ) as k J 1 ( x ) k 1  e
A n J n ( x ) + P i  1 j [-=
 (cid:101)-]= e c j , where
J n ( x ) can be substituted by J n ( x ) =
W n (Eq.
(6)), which yields ﬁnal bounds on k J 1 ( x ) k 1 .
4.2 Norm of Clarke Jacobian
The ` 1 norm of Clarke Jacobian is the ﬁrst nonlinearity we would encounter during backward boundpropagation, as it is the last node in the backward graph (see Figure 3).
When f ( x ) is a K -wayclassiﬁer and f ( x ) 2 R k , we have J 1 ( x ) 2 R K ⇥ d , and its norm is computed as k J 1 ( x ) k 1 {+=max 
 +} k  K
P dj =
[ J 1 ( x )] kj  , where K rows in J 1 ( x ) can be bounded separately, and after that wecan aggregate results on K rows by taking the max .
For the simplicity of the following analysis,we assume K = 1 as we can handle one row in J 1 ( x ) at each time, but they can still be batched inimplementation.
Then Clarke Jacobian J i ( x ) ( i 2 [ n ]) and its bounds L i , U i can be viewed as rowvectors, and we will use [ · ] j to denote the j -th element.
By a tight linear relaxation for | · | as shown 180 in Figure 2 (only the upper bound is needed), we have the following bound for k J 1 ( x ) k 1 :
Proposition 1.
Suppose 8 j {+
+} [ d ] , [ L 1 ] j  [ J 1 ( x )] j  [ U 1 ] j ( 8 x 2 X ) , the following bound holds:k J 1 ( x ) k 1  e
A 1 J 1 ( x ) + e c 0 , where [ e A 1 ] j =
[ U 1 ] j
[ L 1 ] j  [ U 1 ] j  [ L 1 ] j , [ e c 0 ] j =  [ e A 1 ] j [ L 1 ] j +  [ L 1 ] j  .
4.3 Clarke Gradient of the Activation
For each layer i 2 [ n  1] in the chain rule for computing the Clarke Jacobian as Eq.
J i +1 ( x )  i ( x )is involved in addition to ﬁxed weight matrix W i .
i ( x ) is determined by pre-activation value z i ( x )from the forward graph.
For the j -th neuron in the layer, [ J i +1 ( x )  i ( x )]
j =
[ J i +1 ( x )]
j [  i ( x )] jj ,when [ u i ] j < 0 or [ l i ] j > 0 , we have [  i ( x )]
jj =0 and [  i ( x )]
jj =1 respectively ﬁxed, and thenfor these special cases [ J i +1 ( x )  i ( x )]
j is linear w.r.t.
[ J i +1 ( x )]
j .
Otherwise, [ J i +1 ( x )  i ( x )] j isnonlinear since both [ J i +1 ( x )]
j and [  ( x )]
jj may vary given different x 2 X .
We then focus onrelaxing the nonlinearity [ J i +1 ( x )]
j [  i ( x )]
jj given [  i ( x )]
jj = [0 , 1] .
In this example,  1 . 5  [ J i +1 ( x )] j  1 .
) is much tighter than bounds ( lines) by Zhang et al.
[Figure]
each Clarke gradient.
It is the internal computation for boxes in Figure 3.
Two ReLU nodes are inserted as per Proposition 2.
In bound propagation, the  0 node takes intermediate bounds from z i ( x ) to decide whether bounds are directly propagated from J i +1 ( x ) (no relaxation needed), or indirectly via  ( J i +1 ( x )) J +1 ( x ))
(with relaxation) for respectively.
As illustrated in Figure 4, the solid blue line and solid red line are the exact upper and lower boundrespectively for [ J i +1 (
x )  i ( x )] j , which are piecewise linear w.r.t.
[ J i +1 ( x )]
j .
The most nontrivialcase appears when [ L i +1 ( x )]
j < 0 <
[ U i +1 ( x )]
j , where exact bounds for [ J i +1 ( x )  i ( x )] j arenonlinear given the input region.
We relax the exact bounds into linear bounds that can be handledby bound propagation with linear relaxation.
Previous works such as RecurJac [48] have not tightlybounded this linearity in the nontrivial case and commonly degenerate to interval bounds (dashedgreen lines with zero slopes in the ﬁgure, which are loose bounds).
In contrast, we propose a tight linear relaxation (dashed blue and red lines in Figure 4).
We observethat the exact upper bound is essentially a ReLU function of J i +1 ( x ) (solid blue line in Figure 4),and the exact lower bound can be viewed as a ReLU function ﬂipped both horizontally and vertically(solid red line in Figure 4).
Formally, we have:
Proposition 2.
For the j -th neuron in layer i ( i 2 [ n  1]) , if [  i ( x )] jj = [0 , 1] , we have:
[Equation]
which can be rewritten using ReLU activation:
[Equation]
Its correctness can be easily veriﬁed by considering the sign of [ J i +1 ( x )]
j as shown in Appendix C.2.
We then decompose [ J i +1 ( x )  i ( x )]
j into two ReLU activations (Eq.
(8)), as illustrated in Figure 5.
ReLU can be further relaxed by Eq.
(4), as derived in Appendix C.3, which yields:
Proposition 3.
For the j -th neuron in the i -th layer ( i 2 [ n  1] ), given [  i ( x )]
jj = [0 , 1] and[ L i +1 ]
j  [ J i +1 ( x )]
j  [ U i +1 ]
j , we have the following relaxation:
[Equation]
s i
+1 ]
j [ J i +1 ( x )]
j + [ e t i +1 ] j , [ J i +1 ( x )  i ( x )]
j  [ e s i
{++
+}
j [ J i +1 ( x )]
j + [ e t i +1 ] j ,where [ e s i +1 ]
[Equation]
U
[Equation]
i +1 ]
[Equation]
U [Equation] [ e [Equation]
[Equation] [Equation]
e
[Equation]
([ L
[Equation]
+1 ]
[Equation]
In the following theorem, we show that relaxation in Proposition 3 is the tightest linear relaxation:
Theorem 4.
For the j -th neuron in the i -th layer ( i 2 [ n  1] ), and any s, t, s, t satisfying
[Equation]
we have
[Equation]
where [ e s i +1 ]
j , [ e t i +1 ]
j , [ e s [Equation]
[Equation] [ e t i +1 ]
j are by Proposition 3.
This theorem states that our proposed linear relaxation is provably tighter than any other valid linearrelaxation.
We prove this theorem in Appendix C.4.
4.4 Branch and Bound
Formulating the backward computational graph also enables the use of Branch-andBound (BaB) to further tighten the bounds if time budget allows.
We denote C={ ( l 1 , u 1 ) , ( l 2 , u 2 ) , · · · ( l n  1 , u n  1 ) } as the domain of all pre-activation bounds of ReLU neurons 223 before BaB, not including ReLU from Eq.
We use C to denote a pool of domains that we currentlyhave, and initially C =
{C 0 } .
BaB aims to recursively split domains in C into smaller subdomains
C 1 , C 2 , · · · , where C 0 = C
S
C S · · · , and bounds for each domain can be computed respectively 226 using bound propagation, since linear relaxation can generally be tighter with smaller domains.
At each iteration, we take B domains in C with loosest bounds, where B is the batch size for BaB.
For each domains, we choose one layer
ˆ i and one ReLU neuron ˆ j in layer
ˆ i on the forward graph,such that the neuron has uncertain Clarke gradient ( [ l ˆ i ]
ˆ j  0  [ u ˆ i ] ˆ j ).
We branch this domain into twosubdomains with intermediate bounds ([ l ˆ i ] ˆ j ,  ˜ ✏ ) and (˜ ✏ , [ l ˆ i ] ˆ j ) respectively, where ˜ ✏ is a sufﬁcientlysmall value (e.g., 10  9 ).
Thereby, the Clarke gradient for ReLU becomes certain in each subdomain(0 and 1 respectively) with other neurons unchanged.
We compute the bounds for the new subdomains,and we repeat this process until reaching a time limit or there is no domain left to branch.
We use a heuristic score to decide which neuron to branch for a given domain, by estimating thepotential improvement to the bounds after the branching [5].
Here for branching a ReLU neuronon the forward graph, we estimate the potential improvement on the bounds of the backward graph.
In particular, suppose neuron ˆ j in layer
ˆ
i is branched, the gap between the upper and lower boundin the liner relaxation is eliminated, which can tighten the ﬁnal bound.
We estimate the area of thegap before branching (the gap between the blue dashed line and the red dashed line in Figure 4)as 12 ([ U ˆ
i +1 ]
ˆ j  [ L ˆ i +1 ] ˆ j ) 2 , multiplied by the coefﬁcient [ e
A ˆ i ] ˆ j from the bound propagation as theheuristic score.
We thereby branch neurons with highest scores.
Experiments
In our experiments, we focus on evaluating the tightness of ` 1 local Lipschitz constant bounds andthe efﬁciency of computation.
There are three parts: 1) We compare the tightness and efﬁciency onrelatively small models and synthetic data, to accommodate slow baselines; 2) We also use practicalimage datasets with larger models.
3) Finally, we demonstrate an application of our method onanalyzing the monotonicity of neural networks.
Additional experimental details are provided in
Appendix B.
Baselines We compare our methods to the following baselines: NaiveUB upper bounds Lipschitzconstants simply by multiplying the induced norm of each layer, which can scale to arbitrarily largemodels but the bound is often vacuous; LipMIP [20] computes exact local Lipschitz constants using
MIP, which compute the exact (tightest) bound but can only work for very small models.
LipSDP [11]computes upper bounds of ` 2 local Lipschitz constants using SDP, and we convert their ` 2 results intoupper bounds for the ` 1 -case by a p d factor.
Since LipSDP by itself does not support the ` 1 casewhich may not be the intended use of LipSDP, the results converted from the ` 2 case are for reference only.
LipBaB
[3] uses loose interval bounds with branch-and-bound.
RecurJac [48] uses boundpropagation with interval bounds in nontrivial cases but has tightened bounds for some special cases.
All the baselines do not support CNN in their implementation, and we convert the CNN models toequivalent MLP models for baselines.
[Table]
5.1 Comparison on a Synthetic Dataset
We follow Jordan & Dimakis [20] and train several small models on a synthetic dataset.
We comparedifferent methods on models with varying width as shown in Table 1, and we also show results withvarying depth and ✏ in Appendix A.1.
Since some of these models are already large for LipMIP, weset a time limit of 1000 seconds, and we report the upper bound it returns at timeout.
For our BaB,we set a timeout of 60 seconds and stop further branching at timeout.
Without BaB, our method is very efﬁcient while it already outperforms baselines on tightness exceptfor LipMIP on the smallest MLP.
Compared to LipMIP, for the smallest MLP on which LipMIP doesnot timeout, our result without BaB is very close to their exact result; and for other relatively largermodels, LipMIP cannot produce exact results within the timeout and our result is much tighter thanthe upper bounds by LipMIP.
And LipSDP fails to yield results within the timeout on many models.
Although LipBaB has BaB to tighten bounds, their results are still loose within the time budget,since their BaB is based on loose interval bounds and is thus inefﬁcient.
RecurJac is a relativelyefﬁcient baseline but still returns looser bounds compared to our method.
Our BaB further improvesthe tightness of our bounds, and our method with BaB consistently produces tightest results within areasonable time budget, compared to all the baselines.
5.2 Comparison on Image Datasets
[Table]
To further evaluate the scalability of different methods to relatively large models, we then conductexperiments on image datasets including MNIST [26], CIFAR-10 [23], and TinyImagenet [25].
Weuse a 3-layer MLP and a 4-layer CNN on MNIST, and we use 4-layer and 6-layer CNN models on
CIFAR-10 and TinyImageNet.
All the models here are too large for LipSDP.
LipMIP and LipBaBcan only handle the MLP model on MNIST, and they cannot return any valid upper bound for the
CNN models within a reasonable time budget.
RecurJac can handle the CNN model on MNIST, butother CNN models on CIFAR-10 and TinyImageNet are still too large for RecurJac after converted toequivalent MLP models.
In
[Table] [Table]
We show results on MNIST in Table 2.
Our results are much tighter compared to the baselines even ifwe do not enable BaB, and BaB can further tighten results.
On CIFAR-10 and TinyImageNet, wedo not enable BaB on to save time cost on relatively larger models and we show results in Table 3.
Our method can scale to these larger CNNs that previous works could not handle.
In addition, weimplement RecurJac’s looser relaxation in our framework and report its results which are much worsethan our results.
We present additional results in Appendix.
5.3 An Application on Monotonicity Analysis
We further use an application to demonstrate that our proposed method can be used to check themonotonicity of neural networks.
Given a network, we aim to check whether the network’s output isa monotonic function w.r.t.
each input feature.
Monotonicity can be preferred properties in somereal-world scenarios [33, 8, 27, 35].
In this experiment, we adopt the Adult dataset [4], with a binaryclassiﬁcation task about predicting income level.
There are only several continuous features, and weaim to check the monotonicity of income level w.r.t.
age, education number, capital gain, capitalloss, and hours per week.
We train an MLP model on this dataset and verify its monotonicity on theﬁrst 100 test examples.
Signs of Clarke Jacobian can be used to check monotonicity [32], and weachieve this by checking the bounds of Clarke Jacobian.
For each continuous feature j we concern,we set an input domain X j where only this particular feature can be varied between the minimumand maximum possible values of this feature in the dataset, while we keep other features ﬁxed.
And then we obtain bounds on the Clarke Jacobian of the output class for high income level, as
L 1  J 1 ( x )  U 1 ( 8 x 2 X j ) .
Then if [ L 1 ] j > 0 , the predicted conﬁdence on high income level 306 is monotonically increasing w.r.t.
feature j , and vice versa.
We count the percentage of examplesthat satisfy each type of monotonicity respectively.
We show results in Table 4.
It suggests that thepredicted conﬁdence on high income level tends to be monotonically increasing w.r.t.
age, educationnumber on at least part of the examples, and hours per week, which is reasonable.
Results alsosuggest that the models learn little monotonicity on capital gain or loss features.
We also compareours results with those by RecurJac, and our method veriﬁes more monotonicity than RecurJac.
Weexpect the gap to be larger if the models and datasets are larger.
Conclusion
In this paper, we propose an efﬁcient framework to compute tight ` 1 local Lipschitz constants forneural networks by upper bounding the norm of Clarke Jacobian.
We model the computation for the
Clarke Jacobian as a backward computational graph.
On the backward graph, we conduct boundpropagation and propose tight linear relaxation for nonlinearities in Clarke Jacobian.
We furthertighten bounds with branch-and-bound when time budget allows.
Experiments show that our methodefﬁciently produces much tighter results compared to existing relaxed methods and can scale to largerconvolutional networks on which previous works cannot handle.
We also use our method to analyzethe monotonicity of neural networks as a potential application.
However, it remains challenging tohandle even more large-scale models such as those for ImageNet [9], and it will be interesting forfuture work to further extend the scalability.
In addition, we have focused on the ` 1 case only, andfuture work may investigate and solve challenges in extending this work to other norms.
Checklist
For all authors
(a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’s contributions and scope?
[Yes] (b) Did you describe the limitations of your work?
[Yes]
(c) Did you discuss any potential negative societal impacts of your work?
[N/A] Our work will potentially enable users to better verify and understand the properties of neural networks, for more reliable and trustworthy deployment in the future.
We believe there is no negative social impact.
(d) Have you read the ethics review guidelines and ensured that your paper conforms to
them?
[Yes]
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[Yes]
(b) Did you include complete proofs of all theoretical results?
[Yes]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes]
(b) Did you specify all the training details (e
g., data splits, hyperparameters,
how they
were chosen)?
[Yes]
(c) Did you report error bars (e g., with respect to the random seed after running exper-
iments multiple times)?
[N/A]
There is no randomness in our computation for local
Lipschitz constants.
(d) Did you include the total amount of compute and the type of resources used (e
g., type
of GPUs, internal cluster, or cloud provider)?
[Yes]
If you are using existing assets (e
g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes](b) Did you mention the license of the assets?
[Yes]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
using/curating?
[Yes]
(e) Did you discuss whether the data you are using/curating contains personally identiﬁable
information or offensive content?
[Yes]
If you used crowdsourcing or conducted research with human subjects...
(a) Did you include the full text of instructions given to participants and screenshots, if
applicable?
[N/A]
(b) Did you describe any potential participant risks, with links to Institutional Review Board , if hourly wage paid participants amount spent compensation