G ENERALIZED U NIVERSAL A PPROXIMATION FOR C ERTIFIED N ETWORKS
Anonymous authors
Paper under double-blind review
A BSTRACT
To certify safety and robustness of neural networks, researchers have successfully applied abstract interpretation , primarily using interval bound propagation .
To understand the power of interval bounds, we present the abstract universal approximation (AUA) theorem, a generalization of the recent result by Baader et al.
(2020) for ReLU networks to a large class of neural networks.
The AUA theorem states that for any continuous function f , there exists a neural network that (1) approximates f (universal approximation) and (2) whose interval bounds are an arbitrarily close approximation of the set semantics of f .
The network may be constructed using any activation function from a rich class of functions—sigmoid, tanh, ReLU, ELU, etc.—making our result quite general.
The key implication of the AUA theorem is that there always exists certiﬁably robust neural networks, which can be constructed using a wide range of activation functions
I NTRODUCTION
With wide adoption of neural networks, new safety and security concerns arose.
The most prominent property of study has been robustness (Goodfellow et al., 2015): small perturbations to the input of a network should not change the prediction.
For example, a small change to an image of a stop sign should not cause a classiﬁer to think it is a speed-limit sign.
A number of researchers have proposed the use of abstract interpretation (Cousot & Cousot, 1977) techniques to prove robustness of neural networks (Gehr et al., 2018; Wang et al., 2018; Anderson et al., 2019) and to train robust models (Mirman et al., 2018;
Gowal et al., 2018; Huang et al., 2019; Wong & Kolter, 2018; Wong et al., 2018; Balunovic & Vechev, 2020).
Suppose we want to verify robustness of a neural network to small changes in the brightness of an image.
We can represent a large set of images, with varying brightness, as an element of some abstract domain , and propagate it through the network, effectively executing the network on an intractably large number of images.
If all images lead to the same prediction, then we have a proof that the network is robust on the original image.
The simplest abstract interpretation technique that leads to practical veriﬁcation results is interval analysis —also referred to as interval bound propagation .
In our example, if each pixel in a monochrome image is a real number r , then the pixel can be represented as an interval [ r − (cid:15), r + (cid:15) ] , where (cid:15) denotes the range of brightness we wish to be robust on.
Then, the box representing the interval of each pixel is propagated through the network using interval arithmetic operations.
The interval domain has been successfully used for certifying properties of neural networks in vision (Gehr et al., 2018; Gowal et al., 2018), NLP (Huang et al., 2019), as well as cyber-physical systems (Wang et al., 2018).
Why does the interval domain work for certifying neural networks?
To begin understanding this question, Baader et al.
(2020) demonstrated a surprising connection between the universal approximation theorem and neural-network certiﬁcation using interval bounds.
Their theorem states that not only can neural networks approximate any continuous function f
(universal approximation) as we have known for decades, but we can ﬁnd a neural network, using rectiﬁed linear unit (ReLU) activation functions, whose interval bounds are an arbitrarily close approximation of the set semantics of f , i.e., the result of applying f to a set of inputs (e.g., set of similar images).
AUA theorem (semi-formally): For a continuous function f : R m → R that we wish to approximate and error δ > 0 , there is a neural network N that has the following behavior:
Let B ⊂ R m be a box.
The red interval (top) is the tightest interval that contains all outputs of f when applied to x ∈ B .
If we we interval
[Figure]
The theorem of Baader et al.
(2020) is restricted to networks that use rectiﬁed linear units (ReLU).
In this work, we present a general universal approximation result for certiﬁed networks using a rich class of well-behaved activation functions.
Speciﬁcally, we make the following contributions.
Abstract universal approximation (AUA) theorem.
We prove what we call the abstract universal approximation theorem , or AUA theorem for short: Let f be the function we wish to approximate, and let δ > 0 be the tolerated error.
Then, there exists a neural network N , built using any well-behaved activation function, that has the following behavior: For any box of inputs B , we can certify, using interval bounds, that the range of outputs of N is δ close to the range outputs of f .
If the box B of inputs is a single point in Euclidean space, the AUA theorem reduces to the universal approximation theorem; thus, AUA generalizes universal approximation.
Fig.
1 further illustrates the AUA theorem.
Existence of robust classiﬁers.
While the AUA theorem is purely theoretical, it sheds light on the existence of certiﬁable neural networks.
Suppose there is some ideal robust image classiﬁer f using the (cid:96) ∞ norm, which is typically used to deﬁne a set of images in the neighborhood of a given image.
The classical universal approximation theorem tells us that, for any desired precision, there is a neural network that can approximate f .
We prove that the AUA theorem implies us that there exists a neural network for which we can automatically certify robustness using interval bounds while controlling approximation error.
In addition, this neural network can be built using almost any activation function in the literature, and more.
Squashable functions.
We deﬁne a rich class of activation functions, which we call squashable functions, for which our abstract universal approximation theorem holds.
This class expands the functions deﬁned by Hornik et al.
(1989) for universal approximation
and includes popular activation functions, like ReLU, sigmoid, tanh, ELU, and other activations that have been shown to be useful for training robust neural networks (Xie et al., 2020).
The key feature of squashable activation functions is that they have left and right limits (or we can use them to construct functions with limits).
We exploit limits to approximate step (sign) functions, and therefore construct step-like approximations of f , while controlling approximation error δ .
Proof of AUA theorem.
We present a constructive proof of the AUA theorem.
Our construction is inspired by and synthesizes a range of results: (1) the work of Hornik et al.
(1989) on squashing functions for universal approximation, (2) the work of Csáji (2001) for using the sign (step) function to construct Haar (wavelet) functions, and (3) the work of Baader et al.
(2020) on the specialized
AUA theorem for ReLUs.
The key idea of Baader et al.
(2020) is to construct an indicator function for box-shaped regions.
We observe that squashable functions can approximate the sign function, and therefore approximate such indicator functions, while carefully controlling precision of abstract interpretation.
Our proof uses a simpler indicator construction compared to Baader et al.
(2020), and
as a result its analysis is also simpler.
R ELATED W ORK
The classical universal approximation (UA) theorem has been established for decades.
In contrast to
AUA, UA states that a neural network with one single hidden layer can approximate any continuous function on a compact domain.
One of the ﬁrst versions goes back to Cybenko (1989);
Hornik et al.
(1989), who showed that the standard feed-forward neural network with sigmoidal or squashing activations is a universal approximator.
The most general version of UA was discovered by Leshno et al.
(1993), who showed that the feed-forward neural network is a universal approximator if and only if the activation function is non-polynomial.
Because AUA implies UA, this means AUA cannot
Squashable activation functions that satisfy Eq.
(1) σ ( x ) = 1 + e − x tanh( x ) =
+ e − 2 x −softsign( x ) =
x 1 + | x |
Squashable activation functions that do not directly satisfy Eq.
ReLU( x ) = (cid:26) x, x (cid:62) 0 0 , x <
ELU( x ) = (cid:26) x, x (cid:62)
e x − 1 , x <softplus( x ) =
log(1 + e x ) smoothReLU a ( x ) =
(cid:26) x − 1 a log( ax + 1) , x (cid:62) 0 0 , x < hold beyond non-polynomial activation functions.
There are also other variants of UA.
Some of them study the expressiveness of neural networks with structural constraints, such as restricted width per layer Lu et al.
(2017); Kidger & Lyons (2019), or speciﬁc neural network architectures Lin &
Jegelka (2018).
Another line of work focuses on speciﬁc functions that one wants to approximate rather than arbitrary continuous functions, such as Anil et al.
; Cohen et al.
(2019), who study approximation of Lipschitz functions.
Neural-network veriﬁcation has received a lot of attention in recent years.
Most techniques are either based on decision procedures, like SMT solvers Ehlers (2017); Katz et al.
and integer linear programming (ILP) solvers Tjeng et al.
(2019), or abstract interpretation.
The former class can often provide sound and complete veriﬁcation on neural networks with piecewise-linear operations, like ReLU, but is not scalable due to the complexity of the problem and the size of the networks.
Abstract-interpretation-based techniques sacriﬁce completeness for efﬁcient veriﬁcation.
We have considered the simplest non-trivial numerical domain, intervals, that has been shown to produce strong results, both for robustness veriﬁcation and adversarial training Gehr et al.
; Anderson et al.
; Huang et al.
; Mirman et al.
; Wang et al.
; Zhang et al.
Researchers have considered richer domains Singh et al.
(2018; 2019), like zonotopes Ghorbal et al.
(2009) and forms of polyhedra Cousot & Halbwachs (1978).
Since such domains are strictly more precise than intervals, the AUA theorem holds for them.
F OUNDATIONS AND S QUASHABLE A CTIVATION F UNCTIONS 3. N EURAL NETWORKS AND SQAUSHABLE ACTIVATIONS
A neural network N is a function in R m → R .
We deﬁne a network N following a simple grammar, a composition of primitive arithmetic operations and activation functions .
Deﬁnition 3.1 (Neural network grammar) .
Let x ∈ R m be the input to the neural network.
A neural network N is deﬁned using the following grammar: N = c
| x i | N 1 + N 2 | c ∗ N 1 | t ( N 1 ) , where c ∈ R , x i is the i th element of x and t : R → R is an activation function .
We will always ﬁx a single activation function t to be used in the grammar.
We now present a general class of activation functions that we will call squashable activation functions.
Fig.
2 shows some examples.
Deﬁnition 3.2 (Squashable functions) .
t : R → R is squashable iff (1) there is a < b ∈ R such that
[Equation]
or (2) we can construct a function t (cid:48) that satisﬁes Eq.
(1) as afﬁne transformations and function compositions of copies of t , i.e., following the grammar in Def. 3.1.
E.g., t (cid:48) ( x ) =
t (1 − t ( x )) .
Informally, an activation function is in this class if we can use it to construct a monotonically increasing function that has limits in the left and right directions, −∞ and ∞ .
1 Squashable activation
[Figure]
functions extend the squashing functions used by Hornik et al.
All of the activation functions in Fig.
2 are squashable.
Fig.
2 (top) shows activation functions that satisfy Eq.
(1), and are therefore squashable.
For example, sigmoid and tanh easily satisfy Eq.
(1): both have limits and are monotonically increasing.
What about activation functions like ReLU, ELU, softplus, etc., shown in Fig.
2 (bottom)?
It is easy to see that they do not satisfy Eq.
(1): none of them have a right limit.
However, by point (2) of
Def. 3.2, given an activation function t , if we can construct a new activation function t (cid:48) that satisﬁes
Eq.
(1), using the operations in the grammar in Def. 3.1, then t is squashable.
We give a general and simple construction that works for all activation functions in Fig.
2 (bottom).
Proposition 3.3.
Let t ∈ { ReLU , softplus , smoothReLU a , ELU } .
The function t (cid:48)
( x ) =
t (1 − t ( − x )) satisﬁes Eq.
Therefore, ReLU, softplus, Smooth ReLU, and ELU, are squashable.
Example 3.4.
Fig.
3 shows t (1 − t ( − x )) , for t = ReLU and t = softplus .
Both have left/right limits and are monotonic.
Thus, they satisfy Eq.
(1) and therefore ReLU and softplus are squashable
. 3. I NTERVAL ANALYSIS OF NEURAL NETWORKS
Given f : R m → R and set S ⊆
R m , we will use f ( S ) to denote { f ( x ) | x ∈ S } .
We now deﬁne interval versions of the operations of a neural network, which are known as abstract transformers .
An m -dimensional box B is a tuple of intervals [ l 1 , u 1 ] × . . .
×
[ l m , u m ] .
All our operations are over scalars, so we deﬁne abstract transformers over 1D boxes.
Deﬁnition 3.5 (Arithmetic abstract transformers) .
Let B be an m -dimensional box input to the neural network.
We follow the grammar in Def.
3.1 to deﬁne the abstract transformers.
[Equation]
where l i , u i are the i th lower and upper bounds of B [ l 1 , u 1 ]
+ # [ l 2 , u 2 ] =
[ l 1 + l 2 , u 1 + u 2 ] [
[Equation]
[Equation] [Equation]
, max
[Equation]
Deﬁnition 3.6 (Abstract transformer for activations) .
Let B =
[ l, u ] .
Then, t # ( B ) =
[ t ( l ) , t ( u )] .
A BSTRACT U NIVERSAL A PPROXIMATION T HEOREM & I TS I MPLICATIONS
In this section, we state the abstract universal approximation (AUA) theorem and its implications.
Assume a ﬁxed continuous function f : C → R , with a compact domain C ⊂ R m , that we wish to approximate.
Deﬁnition 4.1 ( δ -abstract approximation) .
Let δ > 0 .
A neural network N δ -abstractly approximates f iff for every box B ⊆ C , we have [ l + δ, u − δ ] ⊆
N # ( B ) ⊆
[ l − δ, u + δ ] , where l = min f ( B ) and u = max f ( B ) .
δ -abstract approximation says that the box output of abstract interpretation N # ( B ) is up to δ away from the tightest bounding box around the set semantics f ( B ) .
Observe that the standard notions of approximation is a special case of δ -abstract approximation, when the box B is a point in C .
We now state our main theorem:
Theorem 4.2 (Abstract universal approximation) .
Let f : C
→ R be a continuous function on compact domain C ⊂ R m .
Let t be a squashable activation function.
Let δ > 0 .
There exists a neural network N , using only activations t , that δ -abstractly approximates f .
Informally, the theorem says that we can always ﬁnd a neural network whose abstract interpretation is arbitrarily close to the set semantics of the approximated function.
Note also that there exists such a neural network for any ﬁxed squashable activation function t .
In the appendix, we give a generalization of the AUA theorem to functions and networks with multiple outputs.
As we discuss next, the AUA theorem has very exciting implications: We can show that one can always construct provably robust neural networks using any squashable activation function (Thm. 4.5).
We begin by deﬁning a robust classiﬁer in (cid:96) ∞ norm.
We treat f : C
→ R as a binary classiﬁer, where an output < 0 .
5 represents one class and (cid:62) 0 .
5 represents another.
Deﬁnition 4.3 ( (cid:15) -Robustness) .
Let x ∈ R m , M ⊆ C and (cid:15) > 0 .
The (cid:15) - ball of x is R (cid:15) ( x ) = { z | (cid:107) z − x (cid:107) ∞ (cid:54) (cid:15) } .
We say that f is (cid:15) - robust on set M iff, for all x ∈ M and z ∈ R (cid:15) ( x ) , we have f ( x ) < 0 .
5 iff f ( z ) < 0 .
Deﬁnition 4.4 (Certiﬁably robust networks) .
A neural network N is (cid:15) -certiﬁably robust on M iff, for all x ∈ M , we have N # ( B ) ⊆
( −∞ , 0 . 5) or N # ( B ) ⊆
[0 . 5 , ∞ ) , where B = R (cid:15) ( x ) (Note that an (cid:15) -ball is a box in R m .).
From an automation perspective, the set M is typically a ﬁnite set of points, e.g., images.
For every x ∈ M , the veriﬁer abstractly interprets N on the (cid:15) -ball of x , deriving a lower bound and upper bound of the set of predictions N ( R (cid:15) ( x )) .
If the lower bound is (cid:62) 0 .
5 or the upper bound is < 0 .
5 , then we have proven that all images in the (cid:15) -ball have the same classiﬁcation using N .
Assuming there is some ideal robust classiﬁer, then, following the AUA theorem, we can construct a neural network, using any squashable activation function, that matches the classiﬁer’s predictions and is certiﬁably robust.
Refer to the supplementary materials for an extension to n -ary classiﬁers.
Theorem 4.5 (Existence of robust networks) .
Let f : C
→ R be (cid:15) -robust on set M ⊆ C .
Assume that ∀ x ∈ M, z ∈ R (cid:15) ( x ) .
f ( z ) (cid:54) = 0 .
2 Let t be a squashable activation function.
Then, there exists a neural network N , using activation functions t , that (1) agrees with f on M , i.e., ∀ x ∈ M. N ( x ) < 0 .
5 iff f ( x ) < 0 . 5 , and (2) is (cid:15) -certiﬁably robust on M .
P ROOF OF AUA T HEOREM : A N O VERVIEW
We now give an overview of our proof of the AUA theorem, focusing on its novelty.
Our proof is constructive: we show how to construct a neural network that δ -abstractly approximates a function f .
[Figure]
) + 1 with
[Figure]
Approximating indicator functions (Sec. 6).
The key element, and primary novelty of our proof, is the construction of indicator functions from squashable functions.
Our construction is motivated by Csáji (2001), who used sign functions to construct the Haar function, which can be used to uniformly approximate any continuous function.
See Fig.
5b for an example of the indicator function’s approximation with a sigmoid.
It is a classical idea to use indicator functions to approximate a continuous function in a piecewise fashion—see Nielsen (2015, Ch.4) for an interactive visualization of universal approximation.
However, for
AUA, the input to the function is a box, and therefore we need to make sure that our indicator-function approximations provide tight abstract approximations (Def. 4.1), as will be shown in Thm. 6.2.
Composing indicator functions (Sec. 7).
Once we have approximated indicator functions, we need to put them together to approximate the entire function f .
The remainder of the construction is an adaption of one by Baader et al.
(2020) for ReLU networks.
The construction starts by slicing f into a sequence of functions
f i such that f = (cid:80) i f i .
Each f i captures the behavior of f on a small interval of its range.
See Fig.
4 for an example of slicing.
Next, we approximate each f i using a neural network N i .
Slicing ensures that δ -abstract approximation is tight for large boxes.
Because f ( B ) =
(cid:80)
i f i ( B ) , when approximating f i ( B ) using N i ( B ) , we can show that for most i , f i ( B ) ≈ N i ( B ) .
The smaller the range of slice f i , the tighter the abstract approximation of f using indicator functions.
Our construction and analysis are different from Baader et al.
(2020) in the following ways: 1.
Baader et al.
(2020) focus exclusively on ReLU activations.
In our work, we consider squashable functions, which contain most commonly used activation functions.
Compared to ReLU, which has rigid values, we only know that squashable functions have limits at both sides.
This makes the class of functions more expressive but also harder to quantify.
When analyzing the interval bounds of the whole network construction, we need to take into account the extra imprecision, which propagates from the indicator function to the whole neural network.
The key construction of Baader et al.
(2020) is to build min( x 1 , x 2 , . . .
, x 2 m ) using ReLUs.
The depth of the construction depends on m , and the analysis of its interval bounds is rather complicated.
Our construction uses only two layers of activations, resulting in a much simpler analysis.
Because ReLU is a squashable function, a by-product is that if we only consider AUA for ReLU, our construction and its analysis are simpler than that of Baader et al.
A BSTRACTLY A PPROXIMATING I NDICATOR F UNCTIONS
We begin by showing the crux of our construction: how to approximate an indicator function.
Recall that our goal is to δ -abstractly approximate a continuous function f : C → R .
Grid of boxes.
Fix (cid:15) > 0 . Consider a standard grid of vertices over C , where any two neighboring vertices are axis-aligned and of distance (cid:15) ; we will call this an (cid:15) -grid.
3 Let [ a 1 , b 1 ] × . . .
× [ a m , b m ] be a box G on the grid, where [ a i , b i ] is the range of G at dimension i .
In other words, b i − a
i is a multiple of (cid:15) .
The neighborhood ν ( G ) of G is [ a 1 − (cid:15), b 1 + (cid:15) ] × . . .
× [ a m − (cid:15), b m + (cid:15) ] .
Our goal is to construct an indicator function whose value is close to 1 within G , and close to 0 outside G ’s neighborhood ν ( G ) .
Indicator-function approximation intuition.
Given any activation function t that satisﬁes Eq.
(1), a key observation is that if we dilate t properly, i.e., multiply the input with a large number µ to get t ( µx ) , we will obtain an approximation of the sign (or step) indicator function—a function that indicates whether an input is positive or negative: sign( x ) =
if x (cid:62) 0 and 0 otherwise.
A sign function can be used to construct an indicator function for 1-dimensional boxes.
For example, sign( x ) − sign( x − 1) returns 1 for x ∈ (0 , 1] , and 0 otherwise.
In what follows, we will use the above ideas to approximate the sign function and the indicator function for m -dimensional boxes.
6. A PPROXIMATING A ONE - DIMENSIONAL INDICATOR FUNCTION
We will ﬁrst show how to construct an indicator function for a 1D box, using a squashable function.
The main challenge is choosing the dilation factor that results in tight abstract approximation.
Without loss of generality, assume we are given a squashable function t that (1) satisﬁes Eq.
(1) and (2) has left and right limits of 0 and 1 , respectively.
Loss of precision from limits.
The activation function t has limits at both sides, but the function might never reach the limit.
For example, the right limit of the sigmoid function, σ , is 1 , but ∀ x. σ ( x ) (cid:54) = 1 .
This will lead to a loss of precision when we use t to model a sign function.
However, we can carefully apply mathematical analysis to rigorously bound this imprecision.
Dilation to approximate sign function.
We now discuss how to dilate t to get a sign-functionlike behavior.
By deﬁnition of limit, we know the following lemma, which states that ∀ θ > 0 by
[Figure] [Figure]
[Figure] [Figure]
− 4 −20 .
[Figure] [Figure]
[Figure] [Figure]
(10( x
[Figure]
1)) − 5 −
[Figure]
[Figure] [Figure]
of
G on using the σ µ = 10 , 2 θ = 0 .
= sufﬁciently increasing the input of t , we can get θ close to the right limit of 1 , and analogously for the left limit.
Figs.
5a and 5b show how sigmoid can approximate an indicator function.
Because the grid size is (cid:15) , we want the sign-function approximation to achieve a transition from ≈to ≈ 1 within (cid:15) .
Let µ be the dilation factor .
We would like the following (Fig.
illustrates the loss of precision θ incurred by our construction):
Lemma 6.1.
∀ θ > 0 , ∃ µ > 0 such that: (1) if x (cid:62) 0 .
5 (cid:15) , then t ( µx ) ∈ (1 − θ, 1] ; (2) if x (cid:54) − 0 .
5 (cid:15) , then t ( µx ) ∈ [0 , θ ) .
[Figure]
to use of squashable activation to approximate a sign function.
Length of red arrows is (cid:54) θ .
Indicator function on dimension i .
Recall that the projection of a box G on dimension i is [ a i , b i ] .
We want to build an indicator function that has value close to 1 on [ a i , b i ] , and value close toon R \ [ a i − (cid:15), b i + (cid:15) ] .
Notice that our approximation may not be able to exactly tell if we are in G or its neighborhood.
Inspired by how to construct an indicator function from a sign function, we will take the difference between two shifted sign functions.
Let
[Equation]
We choose the two points a i − 0 .
5 (cid:15) and b i + 0 .
5 (cid:15) , which lie in the middle of the [ a i , b i ] and its neighborhood, so that ˆ t i ’s value of is close to 1 within [ a i , b i ] , andoutside [ a i , b i ] ’s neighborhood.
6. A PPROXIMATING AN m - DIMENSIONAL INDICATOR
We saw how to construct an indicator approximation for a 1-dimensional box.
We will now show how to construct an indicator function approximation N G for an m -dimensional box.
Constructing N G .
We want to construct an indicator function whose value within a box G is close to 1 , and outside the neighborhood ν ( G ) is close to 0 .
In the multi-dimensional case, m (cid:62) 2 , we do not know at which, if any, dimension j of an input is outside the neighborhood of G .
The 1-dimensional indicator approximation, ˆ t , which we constructed earlier, can be used to tell us, for each dimension j , whether x j is within the bounds of the neighborhood of G .
Therefore we can construct a logical OR approximation that applies ˆ t to each dimension and takes the OR of the results.
Speciﬁcally: (1) we will construct a function that applies ˆ t to each dimension, and sums the results such that the answer is > 0 if x ∈ G , and < 0 if x (cid:54)∈ ν ( G ) .
(2) Then, we can use the sign-function approximation to indicate the sign of the answer.
Formally, we deﬁne the neural network N G as follows:
[Equation]
where H i ( x ) =
ˆ t i ( x ) − (1 − 2 θ ) .
The term (cid:80) mi =1 H i ( x i ) evaluates to a positive value if x ∈ G and to a negative value if x (cid:54)∈ ν ( G ) .
Observe that we need to shift the result of ˆ t by (1 − 2 θ ) to ensure a negative answer if one of the dimensions is outside the neighborhood.
Then, we use t to approximate the sign function, as we did in the 1-dimensional case, giving ≈ 1 if x ∈ G , and ≈ 0 if x (cid:54)∈ ν ( G ) .
Fig.
5c shows a plot of a two dimensional N G .
Abstract precision of indicator approximation.
The following key theorem states the precision of the abstract interpretation of N G : if the input box is in G , then the output box is within θ from 1 ; if
B is outside the neighborhood of G , then the output box is within θ from 0 .
Theorem 6.2 (Abstract interpretation of N G ) .
For any box B ⊆ C , the following is true:
N # G ( B ) ⊆
If B ⊆ G , then N # G ( B ) ⊆
(1 − θ, 1] .
If B ⊆ C \ ν ( G ) , then N # G ( B ) ⊆
[0 , θ ) .
Complexity of construction.
To construct a single indicator function, we use 2 m + 1 activation functions, with depth 2 and width 2 m .
If we restrict ourselves to ReLU neural network, we use 4 m + 2 neurons, with depth 4 and width 2 m ; in contrast, Baader et al.
(2020) used 10 m − 3 ReLu functions, with depth 3 + log 2 ( m ) , and width 4 m .
C OMPLETE P ROOF C ONSTRUCTION OF AUA T HEOREM
We have shown how to approximate an indicator function and how to control the precision of its abstract interpretation (Thm. 6.2).
We now complete the construction of the neural network N following the technique of Baader et al.
(2020) for ReLU networks.
Because we use an arbitrary squashable function to approximate the sign function, this introduces extra imprecision in comparison with ReLUs.
We thus need a ﬁner function slicing to accommodate it, i.e., we use a slicing size of δ/ 3 instead of δ/ 2 in Baader et al.
We provide the detailed analysis in the appendix.
In what follows, we outline on how to build the network N that satisﬁes the AUA theorem.
Slicing f .
Let f : C
→ R be the continuous function we need to approximate, and δ be the approximation tolerance, as per AUA theorem statement (Thm. 4.2).
Assume min f ( C ) = 0 .
5 Let u = max f ( C ) .
In other words, the range of f is [0 , u ] .
Let τ = δ 3 .
We will decompose f into a sequence of function slices f i , whose values are restricted to [0 , τ ] .
Let K = (cid:98) u/τ (cid:99) .
The sum of the sequence of function slices is f .
The sequence of functions f i : C → [0 , τ ] , for i ∈ { 0 , . . .
, K } , is:
[Equation]
Approximating f i .
We will use the indicator approximation N G (Eq.
(3)) to construct a neural network N i that approximates f i .
Let G be the set of boxes whose vertices are in the grid.
Because
C is compact, |G| is ﬁnite.
Consider 1 τ f i ( x ) ; it is roughly similar to an indicator function for the set S
= { x ∈ C | f ( x ) >
( i + 1) τ } , i.e., indicating when f ( x ) is greater than the upper bound of the i th slice.
To approximate 1 τ f i ( x ) , we will consider all boxes in G that are subsets of S , and construct an indicator function to tell us whether an input x is in those boxes.
Let
G i = { G ∈ G | f ( G ) >
( i + 1) τ } .
Now construct N i ( x ) that approximates 1 τ f i ( x ) as N i ( x ) =
t (cid:0) µ (cid:0)(cid:80) G ∈G
i N G ( x ) − 0 .
5 (cid:1)(cid:1) .
Sum all N i .
Because (cid:80) Ki =
f i ( x ) =
f
( x ) , and N i ( x ) approximates 1 τ f i ( x ) , we will construct the neural network N as N ( x ) =
τ (cid:80) Ki
=
N i ( x ) .
N δ -abstractly approximates f ; therefore, the AUA theorem holds.
C ONCLUSION
We have shown that the AUA theorem holds for most practical neural networks, and demonstrated that in theory interval analysis can certify the robustness of neural networks.
In the future, one might be interested in reducing the size of the neural network constructed in course of our proof, for example, by allowing the use of richer domains, like zonotopes and polyhedra
A V ECTOR - VALUED NETWORKS AND R OBUSTNESS
In this section we extend the AUA theorem to vector-valued functions.
We also extend our robustness results to n -ary classiﬁers.
A. H IGHER -D IMENSIONAL F UNCTIONS
Vector-valued neural networks.
So far we have considered scalar-valued neural networks.
We can generalize the neural-network grammar (Def. 3.1) to enable vector-valued neural networks.
Simply, we can compose a sequence of n scalar-valued neural networks to construct a neural network whose range is R n .
Formally, we extend the grammar as follows, where E i are the scalar-valued sub-neural networks.
Deﬁnition A.1 (Vector-valued neural network grammar) .
A neural network N : R m → R n is deﬁned as follows
[Equation]
where c ∈ R , x i is one of the m inputs to the network, and t is an activation function.
Example A.2.
Consider the following neural network N : R 2 → R 2 :
[Equation]
which we can pictorially depict as the following graph:
[Equation]
Generalized AUA theorem.
We now generalize the AUA theorem to show that we can δ -abstractly approximate vector-valued functions.
Theorem A.3.
Let f : C
→ R n be a continuous function with compact domain C ⊂ R m .
Let δ > 0 .
Then, there exists a neural network N : R n → R m such that for every box B ⊆ C , and for all i ∈ [1 , m ] ,
[Equation]
) where 1. N # ( B ) i is the i th interval in the box N # ( B ) , and 2.
l i = min S
i and u i = max S i , where S = f
( B ) (recall that S i is the set of i th element of every vector in S ).
Proof.
From the AUA theorem, we know that there exists a neural network N i that δ -abstractly approximates f i : C → R , which is like f but only returns the i th output.
We can then construct the network N =
( N 1 , . .
. , N n ) .
Since each N i satisﬁes Eq.
(4) separately, then N δ -abstractly approximates f .
A. R OBUSTNESS IN n - ARY CLASSIFICATION
We now extend the deﬁnition of (cid:15) -robustness to n -ary classiﬁers.
We use a function f : C → R n to denote an n -class classiﬁer.
f returns a value for each of the n classes; the class with the largest value is the result of classiﬁcation.
We assume there are no ties.
Formally, for a given x ∈ C , we denote classiﬁcation by f as class( f ( x )) , where
[Equation]
Deﬁnition A.4 ( n -ary robustness) .
Let M ⊂ C .
We say that f is (cid:15) -robust on M , where (cid:15) > 0 , iff for all x ∈ M and x (cid:48) ∈ R (cid:15) ( x ) , we have class( f ( x ))
=
class( f ( x (cid:48) )) .
We now extend the certiﬁably robust neural networks deﬁnition to the n -class case.
Recall that
R (cid:15) ( x ) = { x (cid:48) | || x − x (cid:48) ||
(cid:54) (cid:15) } .
Deﬁnition A.5 (Certiﬁbly robust networks) .
A neural network N is (cid:15) -certiﬁably robust on M iff, for all x ∈ M , for all y , y (cid:48) ∈
N # ( R (cid:15) ( x )) , we have class( y ) =
class( y (cid:48) ) .
Existence of robust networks.
We now show existence of robust networks that approximate some robust n -ary classiﬁer f .
Theorem A.6 (Existence of robust networks) .
Let f : C
→ R n be a continuous function that is (cid:15) -robust on set M .
Then, there exists a neural network that
1. agrees with f on M ,
i
e., ∀ x ∈ M. class( N ( x )) =
class( f ( x )) , and 2. is (cid:15) -provably robust on M .
Proof.
First, we need to post-process the results of f as follows:
For all x ∈ C ,
[Equation]
where y = f ( x ) and class( f ( x ))
=
i .
In other words, ˆ f is just like f , but it zeroes out the values of all but the output class i .
This is needed since the interval domain is non-relational, and therefore it cannot capture relations between values of different classes, namely, keeping track which one is larger.
Note that if f is continuous, then ˆ f is continuous.
Let δ (cid:48) be the smallest non-zero element of any vector in the set { ˆ f ( x ) | x ∈ C } .
Following the AUA theorem, let N be a neural network that δ -abstractly approximates ˆ f , where δ < 0 .
5 δ (cid:48) .
S TATEMENT (1): Pick any x ∈ M .
Let the i th element of ˆ f ( x ) (cid:54) = 0 ; call it c .
By construction i = class( f ( x )) .
Let N ( x ) =
( y 1 , . . .
, y n ) .
By AUA theorem, we know that 0 (cid:54) y
j < 0 .
5 δ (cid:48) , for j (cid:54) =
i , and y i (cid:62) c − 0 .
5 δ (cid:48) .
Since c (cid:62) δ (cid:48) , class( N ( x ))
=
class( f ( x ))
=
i .
S TATEMENT (2): Let x ∈ M .
Let S
=
ˆ f ( R (cid:15) ( x )) .
Let S i be the projection of all vectors in S on their i th element, where i = class
( ˆ f ( x )) .
We know that min S i (cid:62) δ (cid:48) .
min S i exists because R (cid:15) ( x ) is compact, so are S and S i .
By construction of ˆ f and the fact that f is robust, all other elements of vectors of S are zero, i.e., S j = { 0 } , for j (cid:54) = i .
Let N # ( R (cid:15) ( x ))
=
[ l j , u j ] .
By AUA theorem and its proof, for j (cid:54) =
i , we have [ l j , u j ] ⊂ [0 , 0 .
5 δ (cid:48) ) .
Similarly, [ l i , u i ] ⊆
[min S i − 0 .
5 δ (cid:48) , u i ] ⊆
5 δ (cid:48) , u i ] .
It follows that for all y , y (cid:48) ∈
N # ( R (cid:15) ( x )) , we have class( y ) =
class( y (cid:48) )
=
i .
This is because any value in [ δ (cid:48) − 0 .
5 δ (cid:48) , u i ] is larger than any value in [0 , 0 .
5 δ (cid:48) ) .
Notice that Thm.
4.5 is a special case, so it also holds.
B A PPENDIX : E LIDED P ROOFS B. P ROOF OF P ROPOSITION 3.
It is easy to see that all the activation functions t are monotonically increasing with
[Equation]
and
[Equation]
for some l ∈ R .
Because t is increasing, t ( − x ) and t (1 − x ) are both decreasing; thus, their composition t (1 − t ( − x )) is increasing.
[Equation]
(1 − t ( − x ))
=
t ( lim x →−∞ (1 − t ( − x )))
=
l lim x →∞ t (1 − t ( − x )) =
t (1 − lim x →∞ t ( − x ))
=
t (1 − l )
ReLU.
l = 0 , and t (1 − l ) = ReLU(1 − 0)
= 1 .
ELU.
l = − 1 , and t (1 − l ) = ELU(2)
= 2 .
softplus.
: l = 0 , and t (1 − l ) = softplus(1)
= log(1 + e ) .
smoothReLU.
: l = 0 , and t (1 − l ) = smoothReLU a (1) = 1 − 1 a log( a + 1) .
(One can easily verify that 1 a log( a + 1) < 1 for a (cid:54) = 0 ).
B. C HOICE OF P ARAMETERS θ AND (cid:15)
Because the our construction works for any ﬁxed θ and (cid:15) , we will choose θ = min( 1 K +1 , 1 4 m +2 , 14 |G| ) , where τ , K and G are deﬁned in Sec. 7; and (cid:15) < 0 .
5 be such that if (cid:107) x − y (cid:107) ∞ (cid:54) (cid:15) , then | f ( x ) − f
( y )
| < τ .
The latter is achievable from the Heine–Cantor Theorem (see Rudin (1986)), so f is uniformly continuous on C .
B. P ROPERTIES OF ˆ t i
The following lemmas show that ˆ t i roughly behaves like an indicator function: its value within a box’s
i th dimension [ a i , b i ] is ≈ 1 ; its value outside of the neighborhood is ≈ 0 ; its value globally is bounded by 1 .
We will analyze the values of the two terms in ˆ t i .
The following lemma states that if x is within the box’s i th dimension, then the ﬁrst term is close toand the second term is close to 0, resulting in ˆ t i ( x ) ≈ 1 .
Lemma B.1.
If x ∈ [ a i , b i ] , then the following is true:
t ( µ ( x + 0 .
5 (cid:15) − a i )
) ∈ (1 − θ, 1] .
t ( µ ( x − 0 .
5 (cid:15) − b i )) ∈ [0 , θ ) .
Proof.
S TATEMENT (1): Because x (cid:62) a i , x +0 .
5 (cid:15) − a i (cid:62) 0 .
5 (cid:15) .
From Lem.
6.1, t ( µ ( x +0 . 5 (cid:15) − a i )
) ∈ (1 − θ, 1] .
S TATEMENT (2): Because x (cid:54) b i , x − 0 .
5 (cid:15) −
b
i (cid:54) − 0 .
5 (cid:15) .
From Lem.
6.1, t ( µ ( x − 0 .
5 (cid:15) − b i )) ∈ [0 , θ ) .
The next two lemmas state that if x is outside the neighborhood, then the two terms are similar, resulting in a ˆ t i ( x ) ≈ 0 .
Lemma B.2.
If x (cid:54) a i − (cid:15) , then the following is true:
t ( µ ( x + 0 .
5 (cid:15) − a i ))
∈ [0 , θ ) .
t ( µ ( x − 0 .
5 (cid:15) − b i )) ∈ [0 , θ ) .
Proof.
S TATEMENT (1):
Because x (cid:54) a i − (cid:15) , x + 0 . 5 (cid:15) − a i (cid:54) − 0 .
5 (cid:15) .
From Lem.
6.1, t ( µ ( x + 0 .
5 (cid:15) − a i ))
∈ [0 , θ ) .
S TATEMENT (2): Because x (cid:54) a
i − (cid:15) and a i < b i , x (cid:54) b i − (cid:15) .
Then x − 0 .
5 (cid:15) −
b
i (cid:54) − 0 .
5 (cid:15) .
From Lem.
6.1, t ( µ ( x − 0 .
5 (cid:15) − b i )) ∈ [0 , θ ) .
Lemma B.3.
If x (cid:62) b i + (cid:15) , then the following is true:
t ( µ ( x + 0 .
5 (cid:15) − a i )
) ∈ (1 − θ, 1] .
t ( µ ( x − 0 .
5 (cid:15) − b i )) ∈ (1 − θ, 1] .
Proof.
S TATEMENT (1): Because x (cid:62) b i + (cid:15) and b i (cid:62) a i , x (cid:62) a i + (cid:15) .
Then x + 0 .
5 (cid:15) − a i (cid:62) 0 .
5 (cid:15) .
From Lem.
6.1, t ( µ ( x + 0 .
5 (cid:15) − a i )
) ∈ (1 − θ, 1] .
S TATEMENT (2): Because x (cid:62) b i + (cid:15) , x − 0 .
5 (cid:15) −
b
i (cid:62) 0 .
5 (cid:15) .
From Lem.
6.1, t ( µ ( x − 0 .
5 (cid:15) − b i )) ∈ (1 − θ, 1] .
B.3. A BSTRACT PRECISION OF ˆ t i
We are now ready to prove properties about the abstract interpretation of our 1-dimensional indicator approximation, ˆ t i .
The following lemma states that the abstract interpretation of ˆ t i , ˆ t # i ( B ) , is quite precise: if the 1-dimensional input box B is outside the neighborhood of G , on G ’s
i th dimension, then the output box is within θ from 0; if the input box B is within the i th dimension of G , then the output box is within 2 θ from 1.
Lemma B.4 (Abstract interpretation of ˆ t i ) .
For a 1-dimensional box B , the following is true:
ˆ t # i ( B ) ⊂ ( −∞ , 1] .
If B ⊆ ( −∞ , a i − (cid:15) ] or B ⊆ [ b i + (cid:15), ∞ ) , then ˆ t # i ( B ) ⊆
( − θ, θ ) .
If B
⊆
[ a i , b i ] , then ˆ t # i ( B ) ⊆
(1 − 2 θ, 1] .
Proof.
We begin the proof by simplifying the expression ˆ t # i ( B ) .
Recall that ˆ t ( x ) =
t ( µ ( x + 0 .
5 (cid:15) − a i ))
− t ( µ ( x − 0 .
5 (cid:15) − b i )) .
Let B =
[ a, b ] .
By applying abstract transformer t # (Def. 3.6) and subtracting the two terms, we get ˆ t
i
B ) =
[ T 1 − T 4 , T 2 − T 3 ] , where
[Equation]
We are now ready to prove the three statements.
S TATEMENT (1): By the deﬁnition of t , ∀ x. t ( x ) ∈ [0 , 1] , so T 1 , T 2 , T 3 , T 4 ∈ [0 , 1] .
Therefore, the upper bound of ˆ t # ( B ) is T 2 − T 3 (cid:54) 1 .
S TATEMENT (2):
Case 1: B
⊆ ( −∞ , a i − (cid:15) ] .
From Lem
B.2, T 1 , T 2 , T 3 , T 4 ∈ [0 , θ ) , then T 2 − T 3 < θ , and T 1 − T 4 > − θ
Case 2: B ⊆
[ b i + (cid:15), ∞ ) .
From Lem.
B.3, T 1 , T 2 , T 3 , T 4 ∈ (1 − θ, 1] ,
then
T
−
T
<
θ , and
T
−
T
4 > − θ
In either case, ˆ t # i ( B ) ⊆ ( − θ, θ ) .
S TATEMENT (3): If B ⊆
[ a i , b i ] , a, b
∈
[ a i , b i ] .
From
Lem
B
), T 1 , T 2 ∈ (1 − θ,
From
Lem.
B.1(
, T 3 , T 4 ∈
θ
Then
T 1 − T 4 > 1 − 2 θ
and T 2 − T 3 (cid:54)
Therefore, ˆ t # i ( B ) ⊆
(1 − 2 θ, 1] .
B. A BSTRACT PRECISION OF N G
We are now ready to analyze the abstract precision of N G .
We ﬁrst consider H i in the following lemma.
For any box B ⊆ C , let B i be its projection on dimension i , which is an interval.
The following lemma states that if B is in the box G , then (cid:80) i H
# i is positive; otherwise, if B is outside the neighborhood of G , then (cid:80)
i H
# i is negative.
Lemma B.5 (Abstract interpretation of H i ) .
For any box B ⊆ C , the following is true:
If B ⊆ G , then (cid:80) mi =1 H # i ( B i ) ⊆
(0 , ∞ ) .
If B ⊆ C \ ν ( G ) , then (cid:80) mi =1 H # i ( B i ) ⊆
( −∞ , − (cid:15) ) .
Proof.
S TATEMENT (1): If B ⊆ G , then ∀ i. B i ⊆
[ a i , b i ] .
From Lem.
B.4 (3), ˆ t # i ( B i ) ⊆
(1 − 2 θ, 1] ; thus,
[Equation]
Sum over all m dimensions, (cid:80) m i =1 H # i ( B i ) ⊆
(cid:80) m i =1 (0 , ∞ ) =
(0 , ∞ ) .
S TATEMENT (2): If B ⊆ C \ ν ( G ) , then there is a dimension j such that either B j ⊆ ( −∞ , a j − (cid:15) ] or B j ⊆
[ b j + (cid:15), ∞ ) .
From Lem.
B.4 (2), we know that ˆ t # ( B j ) ⊆
( − θ, θ ) .
Therefore,
H # j ( B j ) =
[Equation]
B j
[Equation]
⊆ ( θ
[Equation]
1 , 3 θ − 1) (5)
For the remaining m − 1 dimensions, from Lem.
B.4 (1), we know that ˆ t # ( B i ) ⊂ ( −∞ , 1]
when i (cid:54) =
j .
Therefore,
[Equation]
Take the sum of all the m − 1 dimensions,
[Equation]
[Equation] [Equation]
[Equation]
substitute Eq
[Equation]
turn sum into
[Equation]
apply ∗ #
[Equation]
Now, take sum over all the m dimensions,
[Equation]
decompose sum)
[Equation]
(substitute Eqs.
(5) and (7))
[Equation]
(apply ∗ # )
Because of our choice of θ , θ (cid:54) 1 4 m +2 (see Appendix B.2).
Then (2 m + 1) θ (cid:54) 2 m +1 4 m +
= 0 .
5 , and therefore m (cid:88)
[Equation]
Also we have assumed that (cid:15) < 0 .
5 (see Appendix B.2); therefore
[Equation]
B.4. P ROOF OF T HM . 6.
Proof.
S TATEMENT (1): See deﬁnition of N G in Eq.
The outer function of N G is t , whose range is [0 , 1] by the deﬁnition of squashable functions and our assumption that the left and right limits areand 1 .
Therefore, N # G ( B ) ⊆
S TATEMENT (2): If B ⊆ G , from Lem.
B.5, we know that (cid:80) mi
=1 H # i ( B i ) ⊆
(0 , ∞ ) .
Then, m (cid:88)
i
H # i ( B i ) + # (0 .
5 (cid:15) )
# ⊆ (0 , ∞ ) + # (0 .
5 (cid:15) )
# ⊆ (0 . 5 (cid:15), ∞ )
From Lem.
6.1, we know that if x (cid:62) 0 .
5 (cid:15) , then 1 − θ < t ( µx ) (cid:54) 1 .
Therefore,
N # G ( B ) =
t # ( µ # ∗ # (0 . 5 (cid:15), ∞ )) ⊆
(1 − θ, 1]
S TATEMENT (3): If B ⊆ C \ ν ( G ) , from Lem.
B.5, we know that (cid:80) mi
=1 H # i ( B i ) ⊆
( −∞ , − (cid:15) ) .
Then, (cid:80) mi =1 H # i
( B i ) + # (0 .
5 (cid:15) )
# ⊆ ( −∞ , − (cid:15) )
+ # (0 . 5 (cid:15) )
# ⊆ ( −∞ , − 0 .
5 (cid:15) )
From Lem.
6.1, we know that if x (cid:54) − 0 .
5 (cid:15) , then 0 (cid:54) t ( µx ) < θ .
Therefore,
[Equation]
⊆ [0 ,
[Equation]
B. A BSTRACT INTERPRETATION OF N i
Observe how for any box B ⊆ C from the abstract domain, it is overapproximated by a larger box
G ⊇ B from the ﬁnitely many boxes in the (cid:15) -grid.
Intuitively, our abstract approximation of N i incurs an error when the input B is not in the grid.
We formalize this idea by extending the notion of neighborhood (Sec. 6) to boxes from the abstract domain.
For a box B ⊆ C , if B ∈ G , then B ’s neighborhood G B
= ν ( B ) ; otherwise, let G B be the smallest G ∈ G , by volume, such that B ⊆ G .
Note that G B is uniquely deﬁned.
The following lemma says that considering the neighborhood of B only adds up to τ of imprecision to the collecting semantics of f .
Lemma B.6 (Properties of G B ) .
The following is true:
If f ( B ) (cid:62) β , then f ( G B ) (cid:62) β − τ . 2.
If f ( B ) (cid:54) β , then f ( G B ) (cid:54) β + τ .
Proof.
Both of the statements follow from our choice of (cid:15) in constructing the grid (see Appendix B.2).
If (cid:107) x − x (cid:107) ∞ (cid:54) (cid:15) , then | f ( x ) − f ( y ) | < τ .
Consider the B and its neighborhood G B .
By deﬁnition of neighborhood, ∀ x ∈ G B , ∃ y ∈ B , such that (cid:107) x − y (cid:107) ∞ (cid:54) (cid:15) .
S TATEMENT (1) Because f ( B ) (cid:62) β , then f ( y ) (cid:62) β , so f ( x ) (cid:62) f
( y ) − τ (cid:62) β − τ .
Then ∀ x ∈ G B , f ( x ) (cid:62) β − τ .
S TATEMENT (2)
Because f ( B ) (cid:54) β , then f ( y ) (cid:54) β , so f
( x ) (cid:54) f
( y ) + τ (cid:54) β
+ τ .
Then ∀ x ∈ G B , f ( x ) (cid:54) β
+ τ .
Theorem B.7 (Abstract interpretation of N i ) .
For any box B ⊆ C , let u = max f ( B ) , and l = min f ( B ) .
The following is true:
N # i ( B ) ⊆
If l (cid:62) ( i + 2) τ , then ∃ u i ∈ (1 − θ, 1] such that [ u i , u i ] ⊆
N #
i
B ) ⊆
(1 − θ, 1] .
If u (cid:54) ( i − 1) τ , then ∃ l i ∈ [0 , θ ) such that [ l i , l i ] ⊆
N #
i ( B ) ⊆
[0 , θ ) .
Proof.
We begin by noting that in Statement (2), [ u i , u i ] ⊆
N #
i ( B ) for some u i ∈ (1 − θ, 1] is a direct corollary of N # i ( B ) ⊆
(1 − θ, 1] .
Because if N # i ( B ) ⊆ (1 − θ, 1] , and N # i ( B ) (cid:54) = ∅ , then
N # i ( B ) contains at least one point in (1 − θ, 1] .
Similarly, in Statement (3), [ l i , l i ] ⊆
N #
i ( B ) for some l i ∈ [0 , θ ) is a direct corollary of N # i ( B ) ⊆
[0 , θ ) .
In Appendix B.2, we have chosen that θ (cid:54) 14 |G| , a fact we will use later in the proof.
S TATEMENT (1): The outer function of N i is t , whose range is [0 , 1] , by the deﬁnition of squashable function and our construction, so N # i ( B ) ⊆
S TATEMENT (2): Because f ( B ) (cid:62) ( i + 2) τ , by Lem.
B.6, f ( G B ) (cid:62) ( i + 1) τ , so G B ∈ G i .
Thus, we can break up the sum as follows:
[Equation]
From Thm.
6.2, N # G B ( B ) ⊆
(1 − θ, 1] , and N # G ( B ) ⊆
[0 , 1] for G ∈ G i \ { G B } .
Therefore, we can conclude the following two facts:
[Equation]
The second inequality follows from the fact that we assumed θ (cid:54) 14 |G| (cid:54) 0 .
25 (above) and (cid:15) <
.(see Appendix B.2).
Therefore, 0 . 5 − θ > 0 . 25 > 0 .
5 (cid:15) .
It follows from Lem.
6.1 that
[Equation]
⊆
[Equation]
1 −
[Equation]
S TATEMENT (3): If u (cid:54) ( i − 1) τ , we will show that ∀ G ∈ G i .
B ⊂ C \ ν
( G ) .
Pick any G ∈ G i , then we have f ( G ) (cid:62) ( i + 1) τ .
Thus, from Lem.
B.6, f ( G B ) (cid:62) iτ .
Recall that if
B ∈ G , then G B =
ν ( B ) .
Hence, f ( ν ( G )) (cid:62) iτ .
However, f ( B ) (cid:54) u (cid:54) ( i − 1) τ , so B ∩ ν ( G ) = ∅ .
Equivalently, B ⊂ C \ ν ( G ) .
From Thm.
6.2, ∀ G ∈ G i .
N # G ( B ) ⊆
[0 , θ ) , so (cid:88)
G ∈G
i
N
[Equation]
B
[Equation] [Equation]
G
[Equation]
We assumed that θ (cid:54) 14 |G| and (cid:15) < 0 .
5 (see Appendix B.2), so |G| θ (cid:54) 0 .
25 , and |G| θ − 0 .
5 (cid:54) − 0 .
25 (cid:54) − 0 .
5 (cid:15) .
Hence, (cid:88)
G ∈G
i
N # G ( B ) ⊆
[0 , 0 . 25) and (cid:88)
G ∈G
i
N # G ( B )+ # [ − 0 .
5 , − 0 .
5] ⊆
[ − 0 .
5 , − 0 .
25) ⊆
( −∞ , − 0 .
5 (cid:15) )
It follows from Lem.
6.1 that
[Equation]
B. A BSTRACT INTERPRETATION OF N
Before proceeding with the proof, we give a general lemma that will be useful in our analysis.
The lemma follows from the fact that, by construction, θ (cid:54) 1 K +1 .
Lemma B.8.
If η 0 , . .
, η K ∈ [ − θ, θ ] , then (cid:80) Ki =
η i ∈ [ − 1 , 1] .
Proof.
This simply follow from the choice of θ (cid:54) 1 K +1 .
Proof outline of Thm.
Our proof involves three pieces, outlined below:
(A) Because N # ( B ) =
τ # ∗ # (cid:80) Ki =
N # i ( B ) , we need only analyze (cid:80) Ki
=
N # i ( B ) .
We will decompose the sum into ﬁve sums and analyze each separately, arriving at ﬁve results of the form:
[Equation]
(cid:105)
[Equation]
(cid:88)
[Equation]
for j ∈ { 1 , .
where (cid:83)
j S j
= { 0 , . .
, K } and S j are
mutually
disjoint sets.
(B) Then, we sum over all ﬁve cases, getting 
[Equation]
B
[Equation]

 (C) Let L i =
τ (cid:80)
j =
˜
L ij
and U
i =
τ (cid:80)
j =1 ˜
U ij .
Then, we get the bound [ L 1 , U 1 ] ⊆
N # ( B ) ⊆
[ L 2 , U 2 ] .
Finally, we show that [ L 2 , U 2 ] ⊆
[ l − δ, u + δ ] and [ l + δ, u − δ ] ⊆
[ L 1 , U 1 ] .
Equivalently, we will show that
l − δ (cid:54)
L 2 (cid:54) L 1 (cid:54) l + δ and u − δ (cid:54)
U 1 (cid:54) U 2 (cid:54) u
+ δ
Proof assumptions.
We will assume that l ∈ [ pτ, ( p + 1) τ ) and u ∈ [ qτ, ( q + 1) τ ) , for some p (cid:54) q (cid:54) K .
Additionally, let c, d ∈ B be such that f ( c )
=
l and f ( d ) = u .
Step A:
Decompose sum and analyze separately.
We begin by decomposing the sum into ﬁve terms.
This is the most important step of the proof.
We want to show that most N i ’s in (cid:80) Ki =
N # i ( B ) are (
almost) precise.
By almost we mean that their values are ≈ 1 and ≈ 0 .
The motivation is then to extract as many precise terms as possible.
The only tool used in the analysis is Thm.
B.7.
• Consider the function slices represented by Term 1 and 5; for example, Term 1 represents abstractions N # i of function slices f i , for i ∈ [0 , p − 2] .
The function slices of Term 1 and 5 are referred to in Thm.
B.7 (Statements 2 and 3): they have an (almost) precise abstract interpretation.
That is, the abstract semantics of N # i ( B ) and the collecting semantics of f i ( B ) agree.
For Term 1, the abstract interpretation of all N # i ( B ) ≈
[1 , 1] and f i ( B ) =
[ τ, τ ] .
For Term 5, the abstract interpretation of all N # i ( B ) ≈
[0 , 0] and f i ( B ) =
• Now consider function slices f i , where i ∈ [ p + 2 , q − 2] .
The abstraction of these function slices is also (almost) precise.
We can see f ( c ) =
l is below the lower bound of the slices and f ( d ) =
u is above the upper bound of the slices.
Hence, f i ( d ) = τ and N # i ( { d } )
≈ [1 , 1] .
Similarly, f i ( c ) =
and N # i ( { c } )
≈ [0 , 0] .
Because c, d ∈ B , and due to continuity of f , we have f i ( B ) =
[0 , 1] , and N # i ( B ) ≈ [0 , 1] .
• The remaining function slices are those in Term 2 and Term 4, and they are at the neighborhood of the boundary of [ l, u ] .
Most precision loss of N # i ( B ) comes from those two terms.
This drives us to decompose the sum as follows:
[Equation]
We will analyze the ﬁve terms in Eq.
(8) separately, and then take their sum to get the ﬁnal result.
For now, assume that q (cid:62) p + 3 ; the q (cid:54) p + 2 case will follow easily.
(i) Term 1: ∀ i (cid:54) p − 2 , we have pτ (cid:62) ( i + 2) τ .
Because l = min f ( B ) and l ∈ [ pτ, ( p + 1) τ ) , then f ( B ) (cid:62) pτ (cid:62) ( i + 2) τ .
From Thm.
B.7, ∃ u i ∈ (1 − θ, 1] such that [ u i , u i ] ⊆
N #
i
B ) ⊆
(1 − θ, 1] .
Then (cid:80) p −i =
[ u i , u i ] ⊆
(cid:80) p − 2 i
=
N # i ( B ) ⊆
(cid:80) p − 2 i
=
(1 − θ, 1] .
p − 2 (cid:88) i =
[ u i , u i ] ⊆
p − 2 (cid:88) i = N # i ( B ) ⊆
( p − 1) # ∗ # (1 − θ, 1] (ii) Term 5: ∀ i (cid:62) q + 2 , we have ( q + 1) τ (cid:54) ( i − 1) τ .
Because u = max f ( B ) and u ∈ [ qτ, ( q + 1) τ ) , then f ( B ) <
( q + 1) τ (cid:54) ( i − 1) τ .
From Thm.
B.7, ∃ l i ∈ [0 , θ ) such that [ l i , l i ] ⊆
N #
i ( B ) ⊆
[0 , θ ) .
Then (cid:80) Ki =
q +
[ l i , l i ] ⊆
(cid:80)
Ki =
q +2 N #
i ( B ) ⊆ (cid:80) Ki
= q +2 [0 , θ ) .
K (cid:88) i =
q
+ [ l i , l i ] ⊆
K (cid:88)
i = q +
N # i ( B ) ⊆
( K − q − 1) # ∗ # [0 , θ ) (iii) Term 3:
∀ i ∈
[ p + 2 , q − 2]
, we have (
p + 1) τ (cid:54) ( i − 1) τ and qτ (cid:62) ( i + 2) τ
f c
=
l < ( p + 1) τ (cid:54) ( i − 1)
τ
, and f
( d
=
u (cid:62) qτ (cid:62) ( i + 2) τ .
From Thm.
B.7, N #
i ( { c } ) ⊆
[0 , θ ) and N #
i ( { d } ) ⊆
(1 − θ, 1] .
Because c, d ∈ B , [ θ, 1 − θ ] ⊆
N #
i ( B ) .
Also by Thm.
B.7, N # i ( B ) ⊆
Hence, (cid:80) q − 2 i = p +
[ θ, 1 − θ ] ⊆
(cid:80) q − 2 i
=
p
+
N
# i ( B ) ⊆
(cid:80) q − 2 i
=
p
+
q − 2 (cid:88) i = p
+ [ θ, 1 − θ ] ⊆
q − 2 (cid:88) i = p +
N # i ( B ) ⊆ ( q − p − 3) # ∗ # [0 , 1] (iv) Term 2: ∀
i ∈ [ p − 1 , p + 1] , since we have assumed that q (cid:62) p + 3 , then q (cid:62) p + 3 (cid:62) i + 2 .
Because f ( d ) (cid:62) qτ (cid:62) ( i + 2) τ , from Thm.
B.7, ∃ u i ∈ (1 − θ, 1] such that [ u i , u i ] ⊆
N # i ( { d } ) ⊆
(1 − θ, 1] .
Because d ∈ B , [ u i , u i ] ⊆
N #
i ( B ) .
Hence, [ u i , u
B
(cid:88)
=
−
[ u i , u i ] ⊆
p +1 (cid:88)
= p −
N # i ( B ) ⊆ 3 # ∗ # [0 , 1]
(v) Term 4:
For ∀ q − 1 (cid:54) i (cid:54) q + 1 , because q (cid:62) p + 3 , we have p + 1 (cid:54) q − 2 (cid:54) i − 1 .
Then
f ( c ) =
l < (
p
+ 1) τ (cid:54) ( i − 1)
τ
From Thm.
B.7, ∃ l i ∈ [0 , θ ) such that [ l i , l i ] ⊆
N #
i ( { c } ) ⊆
[0 , θ )
Because c
∈
B l
i ,
l
i
⊆
N # i (
B
Thus
l
i
, l i
⊆
N #
i ( B ) ⊆
[Equation]
Step B: Sum all ﬁve cases.
We now sum up all ﬁve inequalities we derived above to derive an overall bound of the sum in the form [ L (cid:48) 1 , U (cid:48) 1 ] ⊆
(cid:80) Ki =
N # i ( B ) ⊆
[ L (cid:48) 2 , U (cid:48) 2 ] .
For example,
[Equation]
(cid:88)
[Equation]
Recall that, by Thm.
B.7, ∀ i ∈ { 0 , . . .
, K } , u i ∈ (1 − θ, 1] and l i ∈ [0 , θ ) .
Let ˜ l
i = 1 − u i , so ˜ l i ∈ [0 , θ ) .
We simplify L (cid:48) 1 , L (cid:48) 2 , U (cid:48) 1 and U (cid:48) 2 as follows:
[Equation]
(sum of the left bound)
[Equation]
u i with
[Equation]
l i )
[Equation] [Equation]
the terms)
[Equation]
(Sum all the 1’s)
From Lem.
B.8, (cid:80) p +1 i =
( − ˜ l i ) + (cid:80) q − 2 i = p
+2 θ
+ (cid:80)
Ki =
q − 1 l i ∈ [1 , 1] by plugging in − ˜ l i , l i , θ to η i .
So,
L (cid:48) 1 ∈ [ p + 1 , p + 3]
U
[Equation]
= (cid:80) p − 2 i
=
u i + (cid:80) Ki
= q +2 l i + (cid:80) q − 2 i = p +2 (1 − θ )
+ (cid:80) p +1 i
=
p − 1 u i + (cid:80)
q
+1 i =
q − 1 l i (sum of right bound) =
(cid:80) p − 2 i
=
(1 − ˜ l i ) + (cid:80)
Ki =
q +2 l i + (cid:80) q − 2 i = p +2 (1 − θ )
+ (cid:80) p +1 i
= p − 1 (1 − ˜ l i ) + (cid:80)
q
+1 i =
q − 1 l i (substitute u i with ˜ l i ) =
( q − 1)
+ (cid:80) p
+1 i =
( − ˜ l i ) + (cid:80)
Ki =
q − 1 l i + (cid:80) q − 2 i = p +2 ( − θ ) (sum all the 1’s)
From Lem.
B.8, (cid:80) p +2 i =
( − ˜ l i ) + (cid:80) q − 2 i = p +2 ( − θ ) + (cid:80)
Ki =
q − 1 l i ∈ [ − 1 , 1] .
Thus,
U (cid:48) 1 ∈ [ q − 2 , q ]
L (cid:48)= ( p − 1)(1 − θ ) (sum of left bound) =
( p − 1)
+ ( p − 1)( − θ )
(rearrange terms)
Because θ (cid:54) 1 K +1 , and − K (cid:54) p − 1 (cid:54) K , we have ( p − 1)( − θ ) ∈
[ − 1 , 1] .
Hence,
L (cid:48) 2 ∈ [ p − 2 , p ]
U (cid:48)= ( p − 1)
+ ( K − q − 1) θ
+ ( q − p − 3) + 3 + 3 (sum of right bound) =
( p − 1 + q − p − 3 + 3 + 3)
+ ( K − q − 1)( θ ) (rearrange terms)
=
q + 2 + ( K − q − 1)( θ ) (sum all the 1’s)
Because θ (cid:54) 1 K +1 , and − K (cid:54) ( K − q − 1) (cid:54) K , we have ( K − q + 1)( − θ ) ∈
[ − 1 , 1] .
Then,
U (cid:48) 2 ∈ [ q + 1 , q + 3]
Step C: Analyze the bound.
It remains to show that l − δ (cid:54)
L 2 (cid:54) L 1 (cid:54) l + δ and u − δ (cid:54)
U 1 (cid:54)
U 2 (cid:54) u + δ .
Recall that we have set that δ = 3 τ .
Also l ∈ [ pτ, ( p + 1) τ ) , then l − δ <
( p − 2) τ and l + δ (cid:62) ( p + 3) τ
Since u ∈ [ qτ, ( q + 1) τ ) , then u − δ < ( q − 2)
τ and u
+ δ (cid:62) ( q + 3) τ
We have just analyzed L (cid:48) 1 , L (cid:48) 2 , U (cid:48)
and U (cid:48) 2 above.
Now we have:
[Equation]
It follows from the above inequalities that
[Equation]
and
[Equation]
This concludes the proof for the case where q (cid:62) p + 3 .
Excluded case.
Previously, we have shown that Terms 1, 3, and 5 are almost precise.
The imprecise terms can only come from Terms 2 and 4.
If q (cid:54) p + 2 , the only analyses that will be affected are those of Terms 2 and 4.
Since q (cid:54) p + 2 , we have p + 1 (cid:62) q − 1 , which means Terms 2 and 4 have potentially less sub-terms in this case.
Thus imprecise terms are less than the q (cid:62) p + 3 case
and we can apply the same analysis as above and derive the same bound.
We have thus shown that the neural network N that we construct δ -abstractly approximates f , and therefore the AUA theorem is true.