Efﬁciently Computing Local Lipschitz Constants of Neural Networks via Bound Propagation
Abstract
Lipschitz constants are connected to many properties of neural networks, such as robustness, fairness, and generalization.
Existing methods for computing Lipschitz constants either produce relatively loose upper bounds or are limited to small networks.
In this paper, we develop an efﬁcient framework for computing the `local Lipschitz constant of a neural network by tightly upper bounding the norm of
Clarke Jacobian via linear bound propagation.
We formulate the computation of local Lipschitz constants with a linear bound propagation process on a high-order backward graph induced by the chain rule of Clarke Jacobian.
To enable linear bound propagation, we derive tight linear relaxations for speciﬁc nonlinearities in Clarke Jacobian. This formulate uniﬁes existing ad-hoc approaches such as RecurJac, which can be seen as a special case of ours with weaker relaxations.
The bound propagation framework also allows us to easily borrow the popular Branch-and-Bound (BaB) approach from neural network veriﬁcation to further tighten Lipschitz constants.
Experiments show that on tiny models, our method produces comparable bounds compared to exact methods that cannot scale to slightly larger models; on larger models, our method efﬁciently produces tighter results than existing relaxed or naive methods, and our method scales to much larger practical models that previous works could not handle.
We also demonstrate an application on provable monotonicity analysis.
Code is available at https: //github.com/shizhouxing/Local-Lipschitz-Constants .
Introduction
Lipschitz constants are important for characterizing many properties of neural networks, including robustness [43, 19, 44, 58, 21], fairness [12, 24], generalization [3], and explanation [14].
Local Lipschitz constants, which only need to hold for a small local region, can more precisely characterize the local behavior of a network.
Intuitively they characterize how fast the output of the network changes between any two input within the region.
It is challenging to exactly and efﬁciently compute local Lipschitz constants.
Naive approaches such as computing the product of the induced norm for all layers cannot capture local information and typically produce vacuous bounds.
To compute tight and exact local Lipschitz constants,
Jordan & Dimakis [23] considered small ReLU networks (e.g., up to tens of neurons), by solving a mixed-integer programming (MIP) problem to bound the norm of Clarke’s generalized Jacobian [8]. However, solving MIP is often too costly and cannot scale to slightly larger networks.
On the other hand, RecurJac [58] (an improved version of Fast-Lip [50]) is a specialized recursive algorithm for bounding the Jacobian and computing local Lipschitz constants, which is also relatively efﬁcient but the produced bounds are relatively loose.
Moreover, most of the existing works on local Lipschitz constants only used small toy models and cannot feasibly handle larger practical networks. Recently, in the ﬁeld of neural network veriﬁcation, many methods are proposed to compute provable output bounds for neural networks [25, 6, 11]; especially, linear bound propagation methods [51, 47, 57, 40] are becoming very successful [48, 60] because they are scalable and can be efﬁciently accelerated on GPUs.
These methods propagate the linear relationship between layers, where nonlinearities in networks are relaxed into linear bounds.
In this work, we ask the question if we can borrow these successful techniques from neural network veriﬁcation to scale up the computation of local Lipschitz constants to larger and more practical networks.
In this paper, we aim to efﬁciently compute relatively tight ` 1 local Lipschitz constants for neural networks using the bound propagation framework.
We formulate this problem as upper bounding the ` 1 norm of the Clarke Jacobian, and we formulate the computation for the Clarke Jacobian from a chain rule and its norm as a higher-order backward computational graph augmented to the original forward graph of the network.
On the augmented computational graph, we generalize linear bound propagation to bound the Clarke Jacobian, and we thereby reformulate the problem of computing local Lipschitz constants under a linear bound propagation framework. On the backward graph, applying Clarke gradients in the chain rule is nonlinear and requires a linear relaxation. It is essentially formed by a group of functions and is different from single activation functions in regular neural network veriﬁcation.
We propose a tight and closed-form linear relaxation for Clarke gradients with an optimality guarantee on the tightness, and thereby we efﬁciently bound the Clarke Jacobian with linear bound propagation.
We also show that RecurJac is a special case under our formulation where loose interval bounds instead of tight linear relaxation are used for nontrivial cases. Our formulation also allows us to develop a scalable and ﬂexible framework enhanced by progress from recent neural network veriﬁers using linear bound propagation.
We demonstrate that we can further tighten our bounds by Branch-and-Bound when time budget allows, for a trade-off between tightness and time cost.
Experiments show that our method efﬁciently produces tightest ` 1 local Lipschitz constants compared to other relaxed methods, and is much more efﬁcient than the exact MIP method.
Moreover, our method scales to much larger models including practical convolutional neural networks (CNN) that previous works could not handle.
We also demonstrate an application of our method for provably analyzing the monotonicity of neural networks.
Related Work
For neural networks, a loose global Lipschitz constant (upper bound) can be computed by the product of layer-wise induced norms [43].
Based on this product, Virmaux & Scaman [45] considered the effect of activation and approximated upper bounds which, however, are not guaranteed; Gouk et al. [16] used a power method for convolutional layers.
LipSDP [13] used semideﬁnite programming (SDP) to compute tighter bounds.
These works all compute global Lipschitz constants which can be much looser than local Lipschitz constants as they have to hold even for distinct input points and they cannot characterize the local behavior of neural networks.
We focus on local Lipschitz constants in this paper.
On local Lipschitz constants, LipMIP [23] used mixed integer programming (MIP) to compute exact results.
LipOpt [15] used polynomial optimization but is limited to smooth activations not including the widely used ReLU.
LipBaB
[4] combined relatively loose interval bound propagation [20, 34, 17] with branch-and-bound to compute exact local Lipschitz constants. All of these methods cannot scale to relatively larger models due to their computational cost.
FastLip [50] and its improved version RecurJac [58] used recursive procedures to bound the Jacobian. While FastLip and RecurJac are much more efﬁcient, their bounds are relatively loose due to the use of strictly looser relaxations compared to ours.
In contrast, we compute ` 1 local Lipschitz constants efﬁciently while our bounds are tighter than existing relaxed methods. Besides, there are also several other works on Lipschitz constants under different settings:
Avant & Morgansen [2] derived layer-wise analytical bounds but only on a simpliﬁed deﬁnition for
Lipschitz constants, which does not cover Lipschitzness in the entire local region; and Laurel et al.
[27] proposed a dual number abstraction method to bound the Clarke Jacobian but they focused on non-smooth perturbations that can be represented by a single scalar, while we consider high dimensional perturbations. Lipschitz constants can also be used to train certiﬁably robust neural networks, by computing margins from Lipschitz constants [44, 30, 21] or enforcing 1-Lipschitzness [1, 31, 41, 54–56], These methods are competitive compared to certiﬁed training by directly bounding the output [34, 17, 59, 38, 49], but they are beyond the scope of this paper as we focus on pre-trained neural networks.
Background 3.1 ReLU Network
Suppose f ( x ) is a K -way neural network classiﬁer given a d -dimensional input x 2 R d , and then f ( x ) 2 R K .
For the simplicity of presentation, we mainly focus on feedforward ReLU networks, but our method can also be applied to general network architectures and activations as will be discussed in Section 4.
Suppose the network has n layers, it takes input h 0 ( x ) =
x and then computes
[Equation]
where i 2 [ n ] means 1  i  n , z i ( x ) is the pre-activation output of the i -th linear layer with weight
W i and bias b i , and h i ( x ) is the output after activation  ( · ) .
This formulation is compatible with CNNs since convolutional layers are also linear.
3.2 Lipschiz Constant
The ( ↵ ,  ) -Lipschitz constant of a network f ( x ) over an open set
X 2 R d is deﬁned as:
[Equation]
If f is smooth and ( ↵ ,  ) -Lipschitz continuous over X , the Lipschitz constant can be computed by upper bounding the norm of Jacobian, i.e., L ( ↵ ,  ) ( f, X ) =
sup x 2 X kr f
( x ) k ↵ ,  .
Since neural networks with non-smooth ReLU activation are non-smooth functions, we consider Clarke Jacobian [8] instead, which is deﬁned as the convex hull of lim i !
1 r f ( x i ) for any sequence { x i }
i =1 such that every f ( x i ) is differentiable at x i respectively.
We denote the Clarke Jacobian at x as @ f ( x ) , and then
[Equation]
Global Lipschitz constant, which considers the supremum over X = R d , needs to guarantee Eq.
(1) even for distant x 1 , x 2 , and thus it can be loose and cannot capture the local behavior of the network.
We focus on ` 1 local Lipschitz constants, where X = B 1 ( x 0 , ✏ ) :
= { x : k x  x 0 k 1  ✏ } is a small ` 1 -ball with radius ✏ around x 0 , and we take ↵ =
= 1 for the deﬁnition in Eq.
While exactly computing Eq. (2) is possible for very small networks [23, 4], for slightly larger networks, we only expect to compute guaranteed upper bounds for Eq.
(1) and Eq. (2), and we aim to make the upper bounds as tight as possible with an acceptable computational cost.
3.3 Backward Linear Bound Propagation
To bound the Clarke Jacobian, we will use linear bound propagation which is originally used for certiﬁably bounding the output of neural networks in neural network veriﬁcation.
We adopt backward bound propagation [57, 51, 40, 52] which typically propagates the linear relationship between the output layer to be bounded and all the previous layers it depends on, in a backward manner.
Suppose we want to compute certiﬁed bounds for output layer h n ( x ) w.r.t.
all x from a small domain B 1 ( x 0 , ✏ ) .
Starting from the output layer, we take A n = I , and then h n ( x ) =
A n h n ( x ) .
For every i 2 [ n ] , suppose h
i
x ) can be bounded by linear functions w.r.t.
h i  1 ( x ) parameterized by
P i , P i , q i , q i (the bounds element-wisely hold):
[Equation]
Then for every i = n, n  1 , · · · , 1 in order, A i h i ( x ) can be recursively bounded by substituting h i ( x ) with Eq.
[Equation] x z 1 ( x ) h 1 ( x ) z n-1 ( x ) h n-1 ( x ) h n ( x ) σ … σ W n, b n J n ( x ) J n-1 ( x ) σ’ Δ n-1 W n-1 J 1 ( x ) …
W n-1, b nǁJ 1 ( x ) ǁ ∞ Norm
Backward graph (norm of Clarke Jacobian) Forward graph (original neural network computation)
[Figure]
where [ · ] + stands for taking positive elements from the matrix or vector, and vice versa for [ · ]  .
A i  1 stands for the coefﬁcients of the linear relationship propagated from layer i to layer i  1 , and
c i is a bias term produced at this layer.
By this recursive procedure in a backward manner and accumulating c i i 2 [ n ]) , eventually bounds are propagated to the input layer as h n ( x )  A 0 x +
P ni =1 c i , which directly represents the linear relationship between the output layer and x .
We can eliminate x from
A 0 x to obtain the ﬁnal bounds.
When x 2 B 1 ( x 0 , ✏ ) , for the j -th dimension of h n ( x ) , we can use the fact that [ A 0 ] j, : x  [ A 0 ] j, : x 0 + ✏ k
[ A 0 ] j, : k 1 , where [ A 0 ] j, : stands for the j -th row in A 0 .
Parameters in Eq.
(3) can be obtained by considering the relation between h i ( x ) and h i  1 ( x ) .
We can ﬁrst obtain bounds l i  z i ( x )  u i using bound propagation by viewing z i ( x ) as the output layer.
Then a linear relaxation bounds activation
h i ( x ) =
( z i ( x )) with linear functions of z i ( x ) :
[Equation]
Intuitively, for the j -th neuron, [ s i ] j [ z i ( x )]
j + [ t i ] j and [ s i ] j [ z i ( x [-)) = 
-])]
j + [ t i ] j are two lines bounding  ([ z i ( x )] j ) against input [ z i ( x )]
j .
We provide a detailed derivation and illustration for ReLU in
Appendix A.1.
Then to satisfy Eq.
(3), we can take:
[Equation]
s
[Equation] Interested readers can ﬁnd more details of backward bound propagation in the literature [57, 48]. In this work, we generalize this linear bound propagation to bound the Clarke Jacobian.
Methodology
We present our method in this section.
We ﬁrst formulate the local Lipschitz constant computation as a higher-order backward computational graph, and use bound propagation to obtain the bounds of the Clarke Jacobian.
We discuss our methods for tightly bounding nonlinearities in Clarke Jacobian, and we show that RecurJac [58] is a special case with looser interval bounds.
Finally, we use Branch-and-Bound to further tighten the bounds.
4.1 Clarke Jacobian for ReLU Networks
In ReLU networks, the ReLU activation for a single neuron is deﬁned as  ( x ) = max { x, 0 } which is non-smooth at x =0 .
We consider its Clarke gradient [8] denoted as @ ( x ) : when x< 0 , @ ( x )= { 0 } ;
when x > 0 , @ ( x ) = { 1 } ; and when x = 0 , @ ( x ) =
For the i -th layer (1  i < n ) , we use @ ([ z i ( x )] j ) to denote the Clarke gradient of the j -th neuron and @ ( z i ( x )) to denote the Clarke gradient for all neurons in the layer. And we use a diagonal matrix  i ( x )
@ ( z i ( x )) to denote a
Clarke gradient of neurons in the i -th layer layer, where [  i ( x )] jj 2 @ ([ z i ( x )] j ) .
Then a chain rule can be used to compute the Clarke Jacobian for the whole network [22, 23].
Denote J i ( x ) 2 @ f ( x ) @
h i  1 ( x ) as a Clarke Jacobian w.r.t.
the ( i  1) -th layer in the chain rule.
We have J n ( x ) =
W n , and for all
i 2 [ n  1] , we have
[Equation]
Finally J 1 ( x ) 2 @ f ( x ) is a Clarke Jacobian of the entire network [23].
Since f ( x ) 2 R K and x 2 R d , we have J 1 ( x ) 2 R K ⇥ d .
As we aim to compute the ` 1 local Lipschitz constant, we upper bound k J 1 ( x ) k 1 ( J 1 ( x ) 2 @ f ( x ))
w.r.t.
all x 2 X .
Given the forward pass computation of the original network, we can formulate a computational graph for k J 1 ( x ) k 1 in a backward pass accordingly as shown in Figure 1.
We augment the original forward graph with a backward graph, where the backward graph has a dependency on the pre-activation outputs of layers in the forward graph, due to  1 ,  2 , · · · ,  n  1 .
We build the augmented graph by traversing the forward graph, similar to automatic differentiation for neural network training.
The formulation with a computational graph allows our method to easily generalize to different network architectures given the existing bound propagation framework for general neural networks [52].
We use the bound propagation framework described in Section 3.3 to upper bound k J 1 ( x ) k 1 .
On the backward graph, when bounds are propagated to J i ( x ) , similar to A i and c i in Eq.
(4), we use e A i to denote the coefﬁcient matrix and e c i to denote the bias term for the backward graph, and then we have:
[Equation]
X j = e c j .
Note that we have e A i on the right of J i ( x ) rather than the left, since  i ( x ) W i is multiplied on the right of J i +1 ( x ) in Eq. As intermediate bounds for z i ( x ) are needed for bounding the forward graph, we also need intermediate bounds L i  J i ( x )  U i ( 8 x 2 X ) for the backward graph by starting bound propagation from J i ( x ) instead of k J 1 ( x ) k 1 . These intermediate bounds are used in the linear relaxation for nonlinearities in the backward graph.
There are particularly two categories of nonlinearities to be tackled on the backward graph: 1) ` 1 norm in k J 1 ( x ) k 1 ; 2)
J i +1 ( x )  i ( 8 i 2 [ n  1]) in Eq.
(7), which applies the Clarke gradient of ReLU on the later layer’s Clarke Jacobian.
We handle them in Section 4.2 and Section 4.3 respectively.
Then bounds can be propagated starting at k J 1 ( x ) k 1 , to J 1 ( x ) , J 2 ( x ) , · · · , J n ( x ) in order.
Bounds are eventually propagated to J n ( x ) as Eq.
(8) with i = n , where J n ( x ) can be substituted with W n , and thereby we obtain a ﬁnal upper bound for k J 1 ( x ) k 1 .
4.2 Norm of Clarke Jacobian
The ` 1 norm of Clarke Jacobian is the ﬁrst nonlinearity we would encounter during backward bound propagation, as it is the last node in the backward graph (see Figure 1).
The norm is computed as k J 1 ( x ) k 1 [-=max 
-]= max 1  k  K
P dj =
[ J 1 ( x )] kj  , where K rows in J 1 ( x ) can be bounded separately, and after that we can aggregate results on K rows by taking the max .
For the simplicity of the following analysis, we assume K = 1 as we can handle one row in J 1 ( x ) at each time, but they can still be batched in implementation.
Then Clarke Jacobian J i ( x ) ( i 2 [ n ]) and its bounds L i , U i can be viewed as row vectors, and we will use [ · ] j to denote the j -th element.
By a tight linear relaxation for | · | as shown in Figure 5 in Appendix A.2 (only the upper bound is needed), we have the following bound for k J 1 ( x ) k 1 :
Proposition 1 (Linear relaxations for matrix k · k 1 norm) .
For all x 2 X , suppose 8 j [-
-]2 [ d ] , [ L 1 ] j  [ J 1 ( x )] j  [ U 1 ] j , and J 1 ( x ) is a row vector, we have a bound for its matrix k · k 1 norm:
[Equation] where [
[Equation]
We prove it in Appendix D.1, and this propagates bounds from the norm of Clarke Jacobian to J 1 ( x ) .
4.3 Clarke Gradient of Activation Functions
For each layer i 2 [ n  1] in the chain rule for computing the Clarke Jacobian as Eq.
(7), in addition to the ﬁxed weight matrix W i , there is a J i +1 ( x )  i ( x ) term, where  i ( x ) is determined by preactivation value
z i ( x ) from the forward graph.
For the j -th neuron in the layer, [ J i +1 ( x )  i ( x )]
j =
[ J i +1 ( x )]
j [  i ( x )] jj . When [ u i ] j < 0 or [ l i ] j > 0 , we have [  i ( x )]
jj = 0 and [  i ( x )]
jj =respectively ﬁxed, and then for these special cases [ J i +1 ( x )  i ( x )]
j is already linear w.r.t.
[ J i +1 ( x )] j , and thus a linear relaxation is not needed.
Otherwise, [ J i +1 ( x )  i ( x )] j is nonlinear, since both [ J i +1 ( x )]
j and [  ( x )]
jj may vary given different x 2 X .
We thereby relax the nonlinearity [ J i +1 ( x )]
j [  i ( x )] jj for [  i ( x )]
jj = [0 , 1] .
As illustrated in Figure 2, the solid blue line and solid red line are the exact upper and lower bound respectively for [ J i {++
+}
( x )  i ( x )] j , which are piecewise linear w.r.t.
[ J i +1 ( x )]
j .
When [ L i +1 ] j or [ U i +1 ] j  0 , [ J i +1 ( x )  i ( x )]
j can be exactly bounded by linear functions w.r.t.
[ J i +1 ( x )]
j : ⇢
[Equation]
 [ J i +1 ( x )  i ( x )]
j  [ J i +1 ( x )] j when [ L i +1 ] j  0 , [  i ( x )]
{+jj = [0 , 1] , [ J i +1 ( x )  [ J i +
+}
( x )  i ( x )]
j  0 when [ U i +1 ] j  0 , [  i ( x )]
jj = [0 , 1] .
In this example,  1 . 5  [ J i +1 ( x )] j  1 . 5 .
Our linear relaxation ( and lines) is much tighter than interval bounds (dashed green lines) by Zhang et al.
[Figure]
The most nontrivial case appears when [ L i +1 ]
j < 0 <
[ U i +1 ]
j , where exact bounds for [ J i {++
+} ( x )  i ( x )]
j are nonlinear given the input region.
We relax the exact bounds into linear bounds that can be handled by linear bound propagation.
We observe that the exact upper bound is essentially a ReLU function of J i +1 ( x ) (solid blue line in Figure 2), and the exact lower bound can be viewed as a ReLU function ﬂipped both horizontally and vertically (solid red line in Figure 2).
Formally, we have:
Proposition 2 (Exact lower and and upper bounds for the Clarke gradient of a ReLU neuron) .
For the j -th neuron in layer i ( i 2 [ n  1]) , if [  i ( x )]
jj = [0 , 1] , we have:
[Equation]
which can be rewritten using ReLU activation:
[Equation]
Its correctness can be easily veriﬁed by considering the sign of [ J i +1 ( x )] j as shown in Appendix D.2.
We then decompose [ J i +1 ( x )  i ( x )]
j into two ReLU activations (Eq.
(11)), as illustrated in Figure 3.
ReLU can be further relaxed by Eq.
(5), as derived in Appendix D.3, which yields:
Proposition 3 (Linear relaxations for Clarke Jacobian of a ReLU neuron) .
For the j -th neuron in the i -th layer ( i 2 [ n  1] ), given [  i ( x )]
jj = [0 , 1] and [ L i +1 ]
j  [ J i +1 ( x )]
j  [ U i +1 ]
j , we have the following relaxation:
[Equation]
where [
[Equation]
The linear relaxation in Proposition 3 corresponds to dashed blue and red lines shown in Figure 2 for the relaxed upper bound and lower bound respectively.
And Eq.
[-+
-](9) is a special case for the relaxation in Proposition 3. In the following theorem, we show that relaxation in Proposition 3 is the tightest linear relaxation: Theorem 4 (Optimality of linear relaxations for the Clarke gradient of a ReLU neuron) .
For the j -th neuron in the i -th layer ( i 2 [ [-e s i +
 j =-]n  1] ), and any linear bound coefﬁcients s, t, s, t satisfying
[Equation]
we show that they produce looser relaxations:
[Equation]
8 [ L i +1 ] j <J < [ U i +1 ]
j , sJ + t >
[ e s i
+1 ]
j J + [ e t i +1 ] j , where [ e s i
+1 ]
j , [ e t i +1 ]
j , [ e s i
+1 ]
j , [ e t i +1 ]
j are deﬁned in Proposition 3.
This theorem, proved in Appendix D.4 states that our proposed linear relaxation is provably tighter than any other valid linear relaxation.
While there are previous works tightening the linear relaxation for activation functions [57, 33, 53], we consider the optimal linear relaxation for a group of functions (as shown in Figure 2) instead of a single activation function, and our relaxation is closed-form with a provable optimality, without gradient-based optimization [33, 53].
4.4 Connections to RecurJac [58]
While RecurJac is a recursive algorithm specialized for local Lipschitz constants and it was not related to bound propagation in the original paper, we ﬁnd that it is essentially a special case under our formulation with linear bound propagation, but it uses looser interval bound relaxation instead of our tight linear relaxation proposed in Proposition 2 and Proposition 3 (note that interval bound propagation is also a special case of linear bound propagation, but interval bounds use relaxation with zero slope only instead of general non-zero slopes).
Figure 2 shows a nontrivial case where [ L i +1 ]
j < 0 <
[ U i +1 ]
j and [  i ( x )] jj = [0 , 1] . RecurJac takes interval bounds as the horizontal green dashed lines with a zero slope, and the interval bounds are looser than our linear relaxation with non-zero slopes, i.e., the gap between upper and lower bounds is larger. In Appendix E, we show that if we use interval relaxation when [ L i +1 ] j < 0 <
[ U i +1 ]
j , our framework will be equivalent to
RecurJac.
Compared to RecurJac, we not only have a more general formulation with linear bound propagation but also produce tighter results.
Formulating the backward computational graph also allows us to utilize recent progress in linear bound propagation for neural network veriﬁcation, to further tighten the results. In neural network veriﬁcation, Branch-and-Bound (BaB) has been used to compute tighter bounds [25, 6, 7, 46, 47, 53, 48] by branching activations or input and then bounding each smaller subdomain respectively. We also utilize BaB to tighten our bounds when time budget allows.
We denote {+C 
 = } ( l 1 , u 1 ) , ( l 2 , u 2 ) , · · · ( l n  1 , u n  1 ) } as the domain of all pre-activation bounds of ReLU neurons {+in the forward computational graphs before BaB. We use
C to denote a pool of domains that we currently have, and initially C =
{C 0 } .
BaB aims to recursively split domains in
C into smaller subdomains C 1 , C 2 , · · · , where C {+
+} = C
S
C
[Equation] S · · · , and bounds for each subdomain can be computed respectively using bound propagation, as linear relaxation can generally be tighter with smaller domains.
At each iteration, we take B domains in C with loosest bounds, where B is the batch size for BaB. For each domain, we choose a layer
ˆ i and a ReLU neuron ˆ j in layer
ˆ i on the forward graph, such that the neuron has uncertain Clarke gradient ( [ l ˆ i ]
ˆ j  0  [ u ˆ i ] ˆ j ).
We branch this domain into two subdomains by branching ([ l ˆ i ] ˆ j , [ u ˆ i ] ˆ j ) into ([ l ˆ i ] ˆ j ,  ˜ ✏ ) and (˜ ✏ , [ l ˆ i ] ˆ j ) respectively, where ˜ ✏ is a sufﬁciently small value (e.g., 10  9 ), so that the Clarke gradient for the branched neuron becomes certain in each subdomain (0 and 1 respectively) with other neurons unchanged.
We compute the bounds for the new subdomains, and we repeat this process until reaching a time limit or there is no domain left to branch.
Finally, the bound of the domain with the loosest bound in C is the tightened result.
We use a heuristic score to decide which neuron to branch for a given domain, by estimating the potential improvement to the bounds [6].
For branching a ReLU neuron on the forward graph, we estimate the potential improvement on the backward graph.
Suppose neuron ˆ j in layer ˆ i is branched, we estimate the gap between the lower and upper bound in the liner relaxation, as the gap can be closed after the branching.
We estimate the gap (the gap between the blue dashed line and the red dashed line in Figure 2) as 12 ([ U ˆ i +1 ]
ˆ j  [ L ˆ i +1 ] ˆ j ) 2 , and we multiply it by coefﬁcient [ e
A ˆ i ] ˆ j from the bound propagation as the heuristic score.
We thereby branch neurons with highest scores.
Experiments
In the experiments, we focus on evaluating the tightness of ` 1 local Lipschitz constant bounds and the computational cost.
There are three parts: 1) We compare the tightness and efﬁciency on relatively small models and synthetic data, to accommodate slower baselines; 2) We also use practical image datasets with larger models; 3) Finally, we demonstrate an application of our method on analyzing the monotonicity of neural networks.
Additional experimental details are provided in Appendix C.
Baselines We compare our methods to the following baselines: NaiveUB multiplies the induced norm of each layer, which can scale to arbitrarily large models but the bound is often vacuous. LipMIP [23] computes exact and tightest local Lipschitz constants using MIP but can only work for tiny models.
During the process of solving MIP, an upper bound of the result may be available and is gradually improved, and thus for models that LipMIP cannot ﬁnish within a time budget, we report the upper bound obtained at the timeout.
LipSDP [13] computes upper bounds of ` 2 local Lipschitz constants using SDP, and we convert their ` 2 results into upper bounds for the ` 1 -case by a p d factor.
Since LipSDP by itself does not support the ` 1 case which may not be the intended use of LipSDP, the results converted from the ` 2 case are for reference only.
LipBaB [4] uses loose interval bounds with branch-and-bound.
RecurJac [58] is a recursive algorithm computing relaxed local Lipschitz constants which can be seen as a special case of ours with weaker relaxations.
The baselines except NaiveUB do not support CNN in their implementation, and we convert the CNN models to equivalent MLP models for these baselines. [Figure] [Table] [Figure]
[Table]
5.1 Comparison on a Synthetic Dataset
We follow Jordan & Dimakis [23] and train several small models on a synthetic dataset.
We compare different methods on models with varying width as shown in Table 1, and we also show results with varying depth and ✏ in Appendix B.1.
Some of these models are already large for LipMIP and we set a time limit of 1000 seconds.
For our BaB, we stop further branching after 60 seconds.
Without BaB, our method is very efﬁcient while it already outperforms the baselines on tightness except for LipMIP on the smallest MLP.
Compared to LipMIP, for the smallest MLP on which
LipMIP does not timeout, our result without BaB is very close to but larger than their exact result. This smallest model serves as a sanity check to validate that our results should be no smaller than LipMIP’s exact results. For other relatively larger models, LipMIP cannot produce exact results within the timeout and our result is much tighter than the upper bounds by LipMIP after 1000 seconds.
And LipSDP fails to yield results within the timeout on many models.
Although LipBaB has BaB to tighten the bounds, their results are still loose within the time budget, since using loose interval bounds in their BaB is inefﬁcient.
RecurJac is a relatively efﬁcient baseline but still returns looser bounds compared to our method with tight linear relaxation.
Our BaB further improves the bounds and consistently produces tightest results within a reasonable time budget [Table]
5.2 Comparison on Image Datasets
[Table]
[Table]
[Table]
[Table]
To further evaluate the scalability of different methods to relatively large models [Table] we then conduct experiments on image datasets including MNIST [29], CIFAR-10 [26] [Table]
and TinyImagenet [28].
We use a 3-layer MLP and a 4-layer CNN on MNIST, and we use 4-layer and 6-layer CNN models on
CIFAR-10 and TinyImageNet.
All the models here are too large for LipSDP.
LipMIP and LipBaB can only handle the MLP model on MNIST, and they cannot return any valid upper bound for the
CNN models within a reasonable time budget.
RecurJac can handle the CNN model on MNIST, but other CNN models on CIFAR-10 and TinyImageNet are still too large for RecurJac after converted to equivalent MLP models.
In contrast, our formulation with linear bound propagation allows us to utilize the efﬁcient bound propagation for convolutional layers from Xu et al. Since RecurJac is a special case under our formulation, we implement RecurJac’s loose relaxation to obtain results for
RecurJac on CNN models.
We show results on MNIST in Table 2.
Our results are much tighter compared to the baselines even if we do not enable BaB, and BaB can further tighten results.
On CIFAR-10 and TinyImageNet, we do not enable BaB on to save time cost on relatively larger models, and we show results in Table 3.
Our method can scale to these larger CNNs that previous works could not handle.
And our results are much tighter than NaiveUB and also RecurJac reimplemented in bound propagation. We present additional results on models with different random initialization in Appendix B.2.
5.3 An Application on Monotonicity Analysis
We further use an application to demonstrate that our method can be used to verify the monotonicity of neural networks.
Given a network, we aim to verify whether the network’s output is a monotonic function w.r.t.
each input feature.
Monotonicity can be preferred properties in some real-world scenarios [39, 9, 32, 42].
In this experiment, we adopt the Adult dataset [5], with a binary classiﬁcation task about predicting income level.
There are only several continuous features, and we aim to check the monotonicity of income level w.r.t.
age, education level, capital gain, capital loss, and hours per week.
We train an MLP model and verify its monotonicity on the ﬁrst 100 test examples.
Signs of Clarke Jacobian can be used to check monotonicity [36], and we achieve it by checking the bounds of Clarke Jacobian.
For each continuous feature j , we set an input domain X j where only this particular feature can be varied between the minimum and maximum possible values in the dataset, while we keep other features ﬁxed.
And then we obtain bounds on the Clarke Jacobian of the output class for high income level, as L 1  J 1 ( x )  U 1 ( 8 x 2 X j ) .
Then if [ L 1 ] j > 0 , the predicted conﬁdence on high income level is monotonically increasing w.r.t.
feature j , and vice versa.
We count the percentage of examples that satisfy each type of monotonicity respectively.
We show results in Table 4.
The predicted conﬁdence on high income level is monotonically increasing w.r.t.
age, education number, and hours per week on at least part of the examples, which is reasonable.
On the other hand, the models learn little monotonicity on capital gain or loss features.
Compared to RecurJac, our method veriﬁes more monotonicity.
We expect the gap to be larger when the models and datasets are larger.
Conclusion
In this paper, we propose an efﬁcient framework to compute tight ` 1 local Lipschitz constants for neural networks by upper bounding the norm of Clarke Jacobian, and we formulate the problem with linear bound propagation.
We model the computation for the Clarke Jacobian as a backward computational graph and conduct linear bound propagation on the backward graph.
We propose tight linear relaxation for nonlinearities in Clarke Jacobian with guarantees on the optimality.
And we further tighten bounds with branch-and-bound when time budget allows.
Experiments show that our method efﬁciently produces much tighter results compared to existing relaxed methods and can scale to larger convolutional networks on which previous works cannot handle.
We also use our method to analyze the monotonicity of neural networks as a potential application.
Limitations There are several limitations in this work and challenges for future works.
It is still difﬁcult for the proposed method to scale to deeper neural networks such as ResNet [18] with tens of convolutional layers on ImageNet [10].
It is also a common challenge in neural network veriﬁcation, where efﬁciency and the tightness of certiﬁed bounds can be very limited on deep models.
Besides, we have only focused on ` 1 local Lipschitz constants in this paper but not other norms.
Linear bound propagation computes certiﬁed bounds for each neuron respectively and thus aligns better with ` 1 norm.
Bounds may become signiﬁcantly looser if it is applied to other norms such as `norm.
Previous state-of-the-art works [23, 58, 13] on local Lipschitz constants did not consider both ` 1 norm and ` 2 norm simultaneously either.
Handling other norms is a challenge for future works.
Moreover, in addition to verifying pre-trained models and computing local Lipschitz constants, we have not utilized the proposed method to train neural networks with stronger certiﬁed guarantees on Lipschitz constants or robustness, and it remains challenging for future works to better align veriﬁcation and training.
Funding Disclosure
This work is supported in part by NSF under