REVIEW 3 major objections 5 minor 28 references
A Scalable Approach for Safe and Robust Learning via Lipschitz-Constrained Networks
T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read This paper claims that Lipschitz-constrained training can be made convex and scalable by reparameterizing the network with a loop transformation and by replacing the global SDP with randomized subspace LMIs, yielding certified robustness…
desk verdict The RS-LMI sketch does not certify a Lipschitz bound, so the paper's central claim fails, but the empirical heuristic may have value. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing objects are two. First, the loop transformation: a linear fractional reparameterization $\tilde{N} = f(N)$ that shifts each slope-restricted activation into the sector $[-1,1]$, turning the bilinear LipSDP inequality into the convex LMI (18) in the paper, linear in the transformed variables. Second, the randomized subspace LMI (RS-LMI): each per-layer PSD constraint $\tau_k I - W_k^\top W_k \succeq 0$ is replaced by its projection $G_k^\top(\tau_k I - W_k^\top W_k)G_k \succeq 0$ onto a fixed Gaussian sketch $G_k \in \mathbb{R}^{n_{k-1}\times m}$, and the sketched condition becomes the differentiable penalty $P_k(W_k,\tau_k) = \|[G_k^\top W_k^\top W_k G_k - \tau_k I]_+\|_F^2$. The claimed effect is to reduce the per-batch complexity from $O((\sum_k n_k)^3)$ to $\sum_k O(n_k m^2 + m^3)$ while preserving the certificate with high probability.
What would settle it
Take any trained RS-LMI network, compute the true spectral norm $\|W_k\|_2$ of every layer, and compare it with $\sqrt{\tau_k}$ from the converged penalty; if any layer has $\|W_k\|_2 > \sqrt{\tau_k}$ outside solver tolerance, the Remark 3 certificate fails. A reader can also generate random matrices $W$, draw a Gaussian $G$, and check whether $G^\top(\tau I - W^\top W)G \succeq 0$ can hold while $\tau < \|W\|_2^2$; one such example would falsify the claimed implication.
Extended reading notes
Core claim
On the paper's own terms, the central discovery is that the nonconvex LipSDP admissibility condition becomes a convex linear matrix inequality after a loop transformation that normalizes every activation to the sector $[-\mathbf{1},\mathbf{1}]$. Writing the transformed network as $\tilde{N}$ and setting $Q_1 = T^{-1}$, the authors derive the LMI $\mathrm{LMI}(Q,L,K) \succeq 0$ that is jointly convex in $(Q_1,K_1,K_2,K_3,K_4)$, so the network map, the multiplier, and the Lipschitz bound can be optimized together via ADMM; any converged point yields a network with the certified bound. For scalability, Theorem 5.1 splits the global certificate into independent per-layer conditions $\tau_k I - W_k^\top W_k \succeq 0$, whose tight solution is $\tau_k^\star = \sigma_{\max}(W_k)^2$, and RS-LMI replaces each by a Gaussian sketch $G_k^\top(\tau_k I - W_k^\top W_k)G_k \succeq 0$ encoded as a positive-semidefinite-cone penalty. The paper claims that at convergence $\|W_k\|_2 \le \sqrt{\tau_k}$ with high probability and that $\prod_{k=1}^l \sqrt{\tau_k}$ is therefore a valid global certificate.
Load-bearing premise
The load-bearing premise is that a fixed random projection of each layer's constraint preserves the constraint's feasibility: if the projected matrix has only nonnegative eigenvalues, then the full matrix $\tau_k I - W_k^\top W_k$ also has only nonnegative eigenvalues.
Editorial extensions
If this is right
- If the central claim is correct, a trained network's global Lipschitz bound can be read off as $\prod_k \sqrt{\tau_k}$ without solving a global SDP, making certified training feasible for architectures as large as ResNet-18 on ImageNet.
- Lip-Loop gives a convex admissibility condition that can be enforced during training, so Lipschitz constraints no longer need to be imposed after the fact by spectral-norm clipping or by fixing the SDP multiplier $T$ conservatively.
- The per-layer decomposition implies that certification time and memory scale with the largest layer rather than the whole network, which is what the reported 10–50$\times$ speedups and memory reductions rest on.
- Because any converged ADMM point satisfies the LMI, the framework can in principle be combined with any differentiable loss, including losses for fairness or reinforcement-learning objectives, as the authors note.
Reading between the lines
- Editorial inference: the certificate in Remark 3 is not automatic from a Johnson–Lindenstrauss guarantee, because JL preserves distances between finitely many vectors, not membership in the positive semidefinite cone; a rigorous version would need a sketch that preserves PSD feasibility with an explicit failure probability, or a post-hoc check of the full $\tau_k I - W_k^\top W_k$.
- Editorial inference: the per-layer split in Theorem 5.1 assumes 1-Lipschitz activations; extending the loop-transformation idea to general slope-restricted activations inside the RS-LMI penalty could yield tighter bounds for tanh or leaky ReLU without losing convexity.
- Editorial inference: one testable extension is to make the sketch adaptive or data-dependent and measure, on random weights, how often the sketched penalty is active while the true spectral norm exceeds $\sqrt{\tau_k}$; that frequency is an empirical upper bound on the failure probability of the certificate.
- Editorial inference: since the loop transformation is a standard linear-fractional tool, the same convexification strategy could be carried over to other safety constraints expressible as IQCs, such as stability or passivity margins in learned controllers.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes a framework for training neural networks under global Lipschitz constraints. It first introduces Lip-Loop, a loop-transformation reparameterization intended to make the LipSDP admissibility condition convex in the decision variables, and then RS-LMI, a randomized sketching scheme that replaces per-layer LMI constraints with low-dimensional sketched constraints to reduce computational cost. The authors claim that RS-LMI provides a valid global Lipschitz certificate with high probability and demonstrate improved runtime and memory usage on MNIST, CIFAR-10, and ImageNet. The central theoretical support for the certificate claim is that a Gaussian sketch preserves the feasibility of the per-layer LMI, and that the global Lipschitz bound equals the product of per-layer spectral norms.
Significance. If the main claims were correct, the paper would offer a practically important advance: a scalable, certifiable Lipschitz-constrained training method with convex structure and empirical gains over existing SDP-based approaches. The empirical comparisons in Table I and Table II are suggestive, and the paper makes useful connections between loop transformation and neural network Lipschitz analysis. However, the load-bearing theoretical claims are not supported. The randomized sketching step does not preserve the PSD feasibility of the LMI, so the claimed valid global certificate does not follow; the equality in Theorem 5.1 between the global LipSDP constant and the product of layerwise spectral norms is not generally true; and the overall training problem remains nonconvex despite the 'convex' framing. These issues undermine the paper's core novelty, namely the certifiable scalability result. The paper does not provide machine-checked proofs or released code, and the experimental section lacks the detail needed to verify the efficiency claims independently.
major comments (3)
- [Section V, Eq. (25) and Remark 3] The claim that drawing a fixed Gaussian sketch G_k and imposing G_k^T(τ_k I - W_k^T W_k)G_k ⪰ 0 preserves the Lipschitz certificate with high probability is not justified and is false. The Johnson-Lindenstrauss lemma controls distances between finitely many points; it does not preserve membership in the positive semidefinite cone. The sketched inequality is necessary for τ_k I - W_k^T W_k ⪰ 0, but not sufficient: for W = diag(1.2, 1.0), τ = 1.1, the matrix A = diag(-0.34, 0.1) is indefinite, yet a random one-dimensional Gaussian sketch satisfies g^T A g ≥ 0 with probability about 0.16. Thus a converged RS-LMI solution can certify a false bound ∥W_k∥2 ≤ √τ_k, and the product over layers in Remark 3 is not a valid global certificate. This invalidates the central scalability claim of the paper.
- [Section V, Theorem 5.1] Theorem 5.1 asserts equality between the global LipSDP Lipschitz constant and the product of per-layer spectral norms. Only the inequality L ≤ ∏ σ_max(W_k) holds in general for slope-restricted activations; equality fails even for simple ReLU networks (e.g., a two-layer abs-like network has Lipschitz constant 1 while the product of spectral norms is 2). The theorem provides no proof of equality and the condition 'each activation is 1-Lipschitz' does not imply equality. Consequently the claim that the global LipSDP 'can split into independent layer-wise SDPs' is not established, and RS-LMI's reported bounds should not be described as recovering the Lip-Loop bound.
- [Section IV-C, Eq. (20)] The paper calls the training framework 'convex' and states that any converged solution provides safety guarantees, but optimization problem (20) contains the nonconvex equality constraint f(N)Q = K together with L(N) as a nonlinear function of N. The ADMM updates (22)-(24) are therefore not guaranteed to converge to a feasible point, and no convergence analysis is provided. The statement that the N-update 'typically converges to local optima' and the (L,Q,K)-update obtains a global optimum does not imply convergence of the alternating scheme to a point satisfying f(N)Q = K. Hence the 'convex admissibility condition' is only a convexification of part of the problem and the overall training algorithm lacks the advertised guarantee.
minor comments (5)
- [Throughout] There are numerous typos and grammatical errors, including 'A principle approach' in the abstract, 'yielf' in the introduction, 'access scalability' in Section VI, and 'Imagnet' in Table II discussion; these should be corrected.
- [Section VI] The experimental section omits key details needed for reproducibility: the sketch dimension m, the penalty weights α_k, the ADMM penalty ρ, the optimizer and hyperparameters, the exact network architectures, and the hardware/software environment. Without these, the reported runtime and memory comparisons cannot be independently verified.
- [Section IV-A] The loop transformation derivation is deferred to the authors' previous work [20] with no summary of the assumptions or proof, even though this is the source of the convex reparameterization and a central contribution of the paper; a self-contained statement of the transformation and its validity would strengthen the manuscript.
- [Table II] The sentence 'Training time is reduced by over 90% on MNIST by GloRo and over 80% on CIFAR-10 by LipDiff' is confusing; it should specify the comparison baseline and dataset for each percentage.
- [References] Reference [28] is cited for the Johnson-Lindenstrauss lemma, but that reference is about randomized sketches of convex programs; a direct citation to a Johnson-Lindenstrauss statement would be more appropriate, and the linkage should be made explicit.
Circularity Check
Partial self-citation burden in the Lip-Loop convexification; no equation-level input-output circularity, and the RS-LMI flaw is a correctness gap rather than a circular step.
-
self citation load bearing
[Section IV-A, equations (12)-(14) and the sentence introducing them]
"The key idea is to reparametrize the NN such that the condition (9) becomes convex in a transformed space. Loop transformation is a standard linear fractional transformation technique in the control literature [19]. This transformation leads to new representation of the NN (for detailed derivation see our previous work [20]):"
The Lip-Loop contribution rests on the loop-transformed representation (12)-(14): LMI (18), the convex admissibility condition, is derived from that representation by Schur complement and congruence. The paper does not derive (12)-(14) here; it explicitly refers to the authors' own ACC 2022 paper [20]. Thus the central convexification's validity is imported from a self-citation rather than established in the present derivation. The subsequent matrix manipulations are standard, so the circularity is partial: the transformation input is taken on loan from prior work by the same authors.
full rationale
No prediction in the paper reduces to its fit by construction: the RS-LMI penalty is minimized to satisfy a sketched LMI and then claimed to certify ||W_k||_2 <= sqrt(tau_k), but this claim is an unsupported JL-based sufficiency assertion (sketched PSD conditions are only necessary), which is a correctness risk, not a circular equivalence. Theorem 5.1's equality of the global LipSDP bound with the product of per-layer spectral norms is also unsupported/incorrect in general, but again it is an assertion about quantities, not a definitional reduction. The one circularity-adjacent element is the delegation of the loop-transformed network representation to the authors' prior work [20], which is load-bearing for the Lip-Loop convex formulation; the rest of the derivation (IQC Lemma 2.1, S-procedure, Schur complements) is external or standard. Score reflects that partial self-reference, not the correctness flaws.
Assumptions & free parameters
free parameters (4)
- penalty weights alpha_k
- ADMM penalty rho
- robustness trade-off eta
- sketch dimension m
assumptions (4)
- standard math Incremental quadratic constraint characterization of slope-restricted activations (Lemma 2.1 from [26])
- domain assumption Loop transformation reparameterization from the authors' prior work [20]
- ad hoc to paper Johnson-Lindenstrauss lemma implies preservation of LMI feasibility
- domain assumption Each activation is 1-Lipschitz in Theorem 5.1
Cite this review
Pith. "Pith review of A Scalable Approach for Safe and Robust Learning via Lipschitz-Constrained Networks." pith.science (2026). https://pith.science/paper/5NWQHYCS
@misc{pith2026250623977,
author = {Pith},
title = {Pith review of: A Scalable Approach for Safe and Robust Learning via Lipschitz-Constrained Networks},
year = {2026},
howpublished = {\url{https://pith.science/paper/5NWQHYCS}},
note = {Machine review of arXiv:2506.23977}
}
read the original abstract
Certified robustness is a critical property for deploying neural networks (NN) in safety-critical applications. A principle approach to achieving such guarantees is to constrain the global Lipschitz constant of the network. However, accurate methods for Lipschitz-constrained training often suffer from non-convex formulations and poor scalability due to reliance on global semidefinite programs (SDPs). In this letter, we propose a convex training framework that enforces global Lipschitz constraints via semidefinite relaxation. By reparameterizing the NN using loop transformation, we derive a convex admissibility condition that enables tractable and certifiable training. While the resulting formulation guarantees robustness, its scalability is limited by the size of global SDP. To overcome this, we develop a randomized subspace linear matrix inequalities (RS-LMI) approach that decomposes the global constraints into sketched layerwise constraints projected onto low-dimensional subspaces, yielding a smooth and memory-efficient training objective. Empirical results on MNIST, CIFAR-10, and ImageNet demonstrate that the proposed framework achieves competitive accuracy with significantly improved Lipschitz bounds and runtime performance.
Figures
Reference graph
Works this paper leans on
-
[1]
Efficient and accurate estimation of lipschitz constants for deep neural networks,
M. Fazlyab, A. Robey, H. Hassani, M. Morari, and G. Pappas, “Efficient and accurate estimation of lipschitz constants for deep neural networks,” Advances in neural information processing systems, vol. 32, 2019
work page 2019
-
[2]
I. Goodfellow, Y . Bengio, A. Courville, and Y . Bengio, Deep learning, vol. 1. MIT press Cambridge, 2016
work page 2016
-
[3]
Sequence to sequence learning with neural networks,
I. Sutskever, O. Vinyals, and Q. V . Le, “Sequence to sequence learning with neural networks,” Advances in neural information processing systems, vol. 27, 2014
2014
-
[4]
Globally-robust neural net- works,
K. Leino, Z. Wang, and M. Fredrikson, “Globally-robust neural net- works,” in International Conference on Machine Learning, pp. 6212– 6222, PMLR, 2021
work page 2021
-
[5]
A berkeley view of systems challenges for ai,
I. Stoica, D. Song, R. A. Popa, D. Patterson, M. W. Mahoney, R. Katz, A. D. Joseph, M. Jordan, J. M. Hellerstein, J. E. Gonzalez, et al., “A berkeley view of systems challenges for ai,” arXiv preprint arXiv:1712.05855, 2017
arXiv 2017
-
[6]
Intriguing properties of neural networks,
C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfel- low, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013
arXiv 2013
-
[7]
Direct parameterization of lipschitz- bounded deep networks,
R. Wang and I. Manchester, “Direct parameterization of lipschitz- bounded deep networks,” in International Conference on Machine Learning, pp. 36093–36110, PMLR, 2023
work page 2023
-
[8]
Distillation as a defense to adversarial perturbations against deep neural networks,
N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE symposium on security and privacy (SP), pp. 582–597, IEEE, 2016
2016
Show all 28 references
-
[9]
To- wards defending multiple lp-norm bounded adversarial perturbations via gated batch normalization,
A. Liu, S. Tang, X. Chen, L. Huang, H. Qin, X. Liu, and D. Tao, “To- wards defending multiple lp-norm bounded adversarial perturbations via gated batch normalization,” International Journal of Computer Vision, vol. 132, no. 6, pp. 1881–1898, 2024
2024
-
[10]
Certified ro- bustness via dynamic margin maximization and improved lipschitz regularization,
M. Fazlyab, T. Entesari, A. Roy, and R. Chellappa, “Certified ro- bustness via dynamic margin maximization and improved lipschitz regularization,” Advances in Neural Information Processing Systems, vol. 36, pp. 34451–34464, 2023
2023
-
[11]
Training robust neural networks using lipschitz bounds,
P. Pauli, A. Koch, J. Berberich, P. Kohler, and F. Allg ¨ower, “Training robust neural networks using lipschitz bounds,” IEEE Control Systems Letters, vol. 6, pp. 121–126, 2021
2021
-
[12]
Safe learning in robotics: From learning-based control to safe reinforcement learning,
L. Brunke, M. Greeff, A. W. Hall, Z. Yuan, S. Zhou, J. Panerati, and A. P. Schoellig, “Safe learning in robotics: From learning-based control to safe reinforcement learning,” Annual Review of Control, Robotics, and Autonomous Systems, vol. 5, no. 1, pp. 411–444, 2022
2022
-
[13]
Spectrally-normalized margin bounds for neural networks,
P. L. Bartlett, D. J. Foster, and M. J. Telgarsky, “Spectrally-normalized margin bounds for neural networks,” Advances in neural information processing systems, vol. 30, 2017
2017
-
[14]
Lipschitz regularity of deep neural networks: analysis and efficient estimation,
A. Virmaux and K. Scaman, “Lipschitz regularity of deep neural networks: analysis and efficient estimation,” Advances in Neural Information Processing Systems, vol. 31, 2018
2018
-
[15]
Regularisation of neural networks by enforcing lipschitz continuity,
H. Gouk, E. Frank, B. Pfahringer, and M. J. Cree, “Regularisation of neural networks by enforcing lipschitz continuity,” Machine Learning, vol. 110, pp. 393–416, 2021
2021
-
[16]
Verification of non-linear specifications for neural networks,
C. Qin, B. O’Donoghue, R. Bunel, R. Stanforth, S. Gowal, J. Uesato, G. Swirszcz, P. Kohli, et al., “Verification of non-linear specifications for neural networks,” arXiv preprint arXiv:1902.09592, 2019
1902 arXiv
-
[17]
Efficiently computing local lipschitz constants of neural networks via bound propagation,
Z. Shi, Y . Wang, H. Zhang, J. Z. Kolter, and C.-J. Hsieh, “Efficiently computing local lipschitz constants of neural networks via bound propagation,” Advances in Neural Information Processing Systems, vol. 35, pp. 2350–2364, 2022
2022
-
[18]
Chordal sparsity for sdp-based neural network verification,
A. Xue, L. Lindemann, and R. Alur, “Chordal sparsity for sdp-based neural network verification,” Automatica, vol. 161, p. 111487, 2024
2024
-
[19]
Imitation learning with stability and safety guarantees,
H. Yin, P. Seiler, M. Jin, and M. Arcak, “Imitation learning with stability and safety guarantees,” IEEE Control Systems Letters, vol. 6, pp. 409–414, 2021
2021
-
[20]
Learning neural networks under input-output specifications,
Z. ul Abdeen, H. Yin, V . Kekatos, and M. Jin, “Learning neural networks under input-output specifications,” in 2022 American Control Conference (ACC), pp. 1515–1520, IEEE, 2022
2022
-
[21]
Neural network training under semidefinite constraints,
P. Pauli, N. Funcke, D. Gramlich, M. A. Msalmi, and F. Allg ¨ower, “Neural network training under semidefinite constraints,” in 2022 IEEE 61st Conference on Decision and Control (CDC), pp. 2731– 2736, IEEE, 2022
2022
-
[22]
Chordal and factor-width decompositions for scalable semidefinite and polynomial optimization,
Y . Zheng, G. Fantuzzi, and A. Papachristodoulou, “Chordal and factor-width decompositions for scalable semidefinite and polynomial optimization,” Annual Reviews in Control, vol. 52, pp. 243–279, 2021
2021
-
[23]
Cosmo: A conic operator splitting method for convex conic problems,
M. Garstka, M. Cannon, and P. Goulart, “Cosmo: A conic operator splitting method for convex conic problems,” Journal of Optimization Theory and Applications, vol. 190, no. 3, pp. 779–810, 2021
2021
-
[24]
On the scalability and memory efficiency of semidefinite programs for lipschitz constant estimation of neural networks,
Z. Wang, B. Hu, A. J. Havens, A. Araujo, Y . Zheng, Y . Chen, and S. Jha, “On the scalability and memory efficiency of semidefinite programs for lipschitz constant estimation of neural networks,” in The Twelfth International Conference on Learning Representations, 2024
2024
-
[25]
On robust reinforce- ment learning with lipschitz-bounded policy networks,
N. H. Barbara, R. Wang, and I. R. Manchester, “On robust reinforce- ment learning with lipschitz-bounded policy networks,” arXiv preprint arXiv:2405.11432, 2024
2024 arXiv
-
[26]
Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite programming,
M. Fazlyab, M. Morari, and G. J. Pappas, “Safety verification and robustness analysis of neural networks via quadratic constraints and semidefinite programming,” IEEE Transactions on Automatic Control, vol. 67, no. 1, pp. 1–15, 2020
2020
-
[27]
S-procedure in nolinear control theory,
V . A. Yakubovich, “S-procedure in nolinear control theory,” Vestnik Leninggradskogo Universiteta, Ser. Matematika, pp. 62–77, 1971
1971
-
[28]
Randomized sketches of convex programs with sharp guarantees,
M. Pilanci and M. J. Wainwright, “Randomized sketches of convex programs with sharp guarantees,” IEEE Transactions on Information Theory, vol. 61, no. 9, pp. 5096–5115, 2015
2015
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.