pith. sign in

arxiv: 2604.18728 · v1 · submitted 2026-04-20 · 💻 cs.LG · cs.AI

The Cost of Relaxation: Evaluating the Error in Convex Neural Network Verification

Merkouris Papamichail , Konstantinos Varsos , Giorgos Flouris , Jo\~ao Marques-Silva This is my paper

Pith reviewed 2026-05-10 04:32 UTC · model grok-4.3

classification 💻 cs.LG cs.AI
keywords neural network verificationconvex relaxationerror boundsl infinity distancemisclassification probabilitynetwork depthinput radiusrelaxation lattice
0
0 comments X

The pith

Convex relaxations of neural networks diverge from true outputs by an amount that grows exponentially with depth.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper measures how much the outputs of a neural network can shift when integer constraints on neuron activations are replaced by convex continuous relaxations to speed up verification. It derives analytical upper and lower bounds on the infinity-norm distance between the original network outputs and those of the loosest relaxation, showing the gap widens exponentially as depth increases and linearly as the input perturbation radius grows. This divergence matters because verification tools depend on relaxations for tractability, yet the accumulating error can produce incorrect conclusions about properties such as robustness or classification. The authors further note that the probability of misclassification under the relaxed model displays a sharp step-like transition with respect to input radius. Experiments on MNIST, Fashion MNIST, and random networks confirm the predicted scaling.

Core claim

The space of convex relaxations of the integer activation constraints forms a lattice ordered by inclusion, with the original network at the bottom and the full linearization of every neuron at the top. Analytical upper and lower bounds establish that the ℓ∞ distance between the fully relaxed and original outputs grows exponentially in network depth and linearly in input radius, while misclassification probability exhibits step-like behavior as a function of that radius.

What carries the argument

The lattice of convex relaxations of integer constraints, with full linearization of every neuron as the top element.

If this is right

  • Deeper networks will exhibit rapidly growing verification errors under full relaxation, limiting its practical use for deep architectures.
  • Larger input radii in robustness queries will scale the relaxation error linearly, requiring tighter bounds or partial relaxations.
  • Misclassification rates under relaxation will change abruptly once the input radius crosses certain thresholds.
  • Verification procedures must incorporate depth-dependent error corrections to maintain reliable soundness guarantees.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Intermediate points in the relaxation lattice could be selected to trade off tightness against computational cost in a depth-aware manner.
  • The exponential scaling may explain why complete verification remains difficult for deep networks even when relaxations are employed.
  • Analogous divergence analysis could be performed for relaxations used in other settings such as optimization or control.
  • The step-like misclassification pattern could be tested on architectures beyond image classifiers to assess its generality.

Load-bearing premise

The analysis assumes that the worst-case divergence is captured exactly by the top element of the relaxation lattice without additional restrictions from particular activation functions or network structures.

What would settle it

Direct computation of the ℓ∞ output difference on a network of increasing depth with fixed input radius, checking whether the observed gap follows the claimed exponential scaling.

Figures

Figures reproduced from arXiv: 2604.18728 by Giorgos Flouris, Jo\~ao Marques-Silva, Konstantinos Varsos, Merkouris Papamichail.

Figure 1
Figure 1. Figure 1: From left to right: The input domain [−1, 1]2 (blue). The pre-activation polytope (blue). The post-activation polytope (red). For the pre- and post- activation polytopes, we also depict their interval bounds (grey). The figures are drawn for a single layer network, with parameters W =  1 2 3 −4  and b = [−1 1]T . All the points of the pre-activation polytope with non-positive x-values are projected to th… view at source ↗
Figure 1
Figure 1. Figure 1: For the layer’s two neurons, holds q T = [0.37 0.58]. From left to right. λ1 = 0, λ2 = 0, thus σb1, σb2 is exact. λ1 = 0, λ2 = 1, thus σb1 is exact and σb2 is linearized. λ1 = 1, λ2 = 0, thus σb1 is linearized and σb2 is exact. Finally, λ1 = λ2 = 1, where the network is fully relaxed. A particular instance of the above optimization problem includes adversarial robustness [8, 30, 27]. In adversarial robustn… view at source ↗
read the original abstract

Many neural network (NN) verification systems represent the network's input-output relation as a constraint program. Sound and complete, representations involve integer constraints, for simulating the activations. Recent works convexly relax the integer constraints, improving performance, at the cost of soundness. Convex relaxations consider outputs that are unreachable by the original network. We study the worst case divergence between the original network and its convex relaxations; both qualitatively and quantitatively. The relaxations' space forms a lattice, where the top element corresponds to a full relaxation, with every neuron linearized. The bottom element corresponds to the original network. We provide analytical upper and lower bounds for the $\ell_\infty$-distance between the fully relaxed and original outputs. This distance grows exponentially, w.r.t. the network's depth, and linearly w.r.t. the input's radius. The misclassification probability exhibits a step-like behavior, w.r.t. input radius. Our results are supported by experiments on MNIST, Fashion MNIST and random networks.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 2 minor

Summary. The manuscript studies the divergence between neural networks and their convex relaxations in verification settings. It frames the relaxations as a lattice ordered by tightness, with the original network (integer constraints for activations) as the bottom element and the fully linearized relaxation (every neuron replaced by its convex envelope) as the top element. Analytical upper and lower bounds are derived for the ℓ∞ distance between the original and fully-relaxed outputs; these bounds are claimed to grow exponentially in network depth and linearly in input radius. The misclassification probability is shown to exhibit step-like behavior as a function of input radius. The theoretical results are supported by experiments on MNIST, Fashion MNIST, and random networks.

Significance. If the derivations hold, the work supplies a clean lattice-theoretic account of relaxation error together with explicit scaling laws. The exponential-in-depth characterization is particularly useful for understanding when convex relaxations remain practically viable in deep networks, and the step-function behavior of misclassification probability offers a concrete, testable prediction for certified robustness. The provision of closed-form bounds rather than purely empirical observations strengthens the contribution to the verification literature.

major comments (2)
  1. [Theoretical development (around the lattice construction)] The central analytical bounds rely on the lattice being generated by successive relaxations of ReLU (or similar piecewise-linear) neurons; the manuscript should explicitly state the precise class of activation functions for which the top element is the full linearization and verify that the worst-case divergence is indeed attained there (rather than at some intermediate relaxation).
  2. [Derivation of the ℓ∞ bounds] The claimed exponential growth in depth is load-bearing for the main thesis; the proof should be checked for hidden constants or base that depend on the input radius or weight norms, as these would alter the practical interpretation of the bound.
minor comments (2)
  1. [Experiments] The experimental section should report the exact network depths, widths, and weight initialization ranges used for the random networks, together with quantitative error values (not only qualitative plots) to allow direct comparison with the analytical bounds.
  2. [Preliminaries] Notation for the lattice meet and join operations, as well as the precise definition of the input ball radius, should be introduced with a small diagram or table for clarity.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments and positive evaluation of our work. We address each major comment below and will revise the manuscript to incorporate the requested clarifications.

read point-by-point responses

  1. Referee: The central analytical bounds rely on the lattice being generated by successive relaxations of ReLU (or similar piecewise-linear) neurons; the manuscript should explicitly state the precise class of activation functions for which the top element is the full linearization and verify that the worst-case divergence is indeed attained there (rather than at some intermediate relaxation).

    Authors: We agree that the activation class requires explicit statement. The lattice and bounds are derived for feedforward networks using ReLU activations, where each relaxation replaces the ReLU with its convex envelope (the line segment connecting the lower and upper pre-activation bounds). We will add a dedicated paragraph in Section 3 stating this restriction and include a short lemma showing that, for any fixed input box, the output set of the fully relaxed network contains the output set of every intermediate relaxation; consequently the ℓ∞ divergence from the original network is maximized at the top element of the lattice. revision: yes

  2. Referee: The claimed exponential growth in depth is load-bearing for the main thesis; the proof should be checked for hidden constants or base that depend on the input radius or weight norms, as these would alter the practical interpretation of the bound.

    Authors: We have re-examined the inductive proof of the ℓ∞ bounds (Theorem 4.1). The upper bound is of the form C · r · β^d, where r is the input radius, d the depth, C is a small numerical constant independent of r and the weights, and β ≤ max(1, ||W||_∞) depends only on the maximum absolute weight value across layers. The base β therefore does not depend on the radius; the radius enters solely as a linear factor. We will rewrite the theorem statement and the proof sketch to display this dependence explicitly, thereby removing any ambiguity about the scaling laws. revision: yes

Circularity Check

0 steps flagged

No significant circularity in analytical bounds derivation

full rationale

The paper defines a lattice of convex relaxations ordered by inclusion, with the original integer-constrained network as the bottom element and the full linearization of every neuron as the top element by construction of the relaxation ordering. It then derives analytical upper and lower bounds on the ℓ∞ output distance between these extremes, establishing the exponential dependence on depth and linear dependence on input radius through direct analysis of the worst-case divergence under this ordering. The step-like misclassification behavior follows as a consequence of the distance bounds crossing decision thresholds. No load-bearing step reduces to a fitted parameter, self-citation chain, or tautological renaming; the central results are self-contained mathematical consequences of the lattice model and network properties.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

The work relies on standard domain assumptions about convex relaxations of integer constraints and the lattice ordering of relaxation tightness; no free parameters or new entities are introduced.

axioms (2)
  • domain assumption Convex relaxations of integer constraints for neural network activations form a lattice ordered by inclusion of feasible sets.
    Explicitly described in the abstract as the structure used to study divergence between relaxations and the original network.
  • domain assumption The top element of the lattice corresponds to linearizing every neuron independently.
    Stated in the abstract as the full relaxation case for which bounds are derived.

pith-pipeline@v0.9.0 · 5486 in / 1208 out tokens · 66420 ms · 2026-05-10T04:32:39.243015+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

123 extracted references · 123 canonical work pages

  1. [1]

    Abduction-Based Explanations for Machine Learning Models , year =

    Alexey Ignatiev and Nina Narodytska and Jo. Abduction-Based Explanations for Machine Learning Models , year =. AAAI , optbooktitle =

    work page

  2. [2]

    Stuckey and Jo

    Yacine Izza and Alexey Ignatiev and Peter J. Stuckey and Jo. Delivering Inflated Explanations , year =. AAAI , optbooktitle =

    work page

  3. [3]

    Computing Reseacrh Repository , title =

    Yacine Izza and Xuanxiang Huang and Ant. Computing Reseacrh Repository , title =

    work page

  4. [4]

    Computing Reseacrh Repository , title =

    Xuanxiang Huang and Jo. Computing Reseacrh Repository , title =

    work page

  5. [5]

    Barrett , booktitle =

    Min Wu and Haoze Wu and Clark W. Barrett , booktitle =. VeriX: Towards Verified Explainability of Deep Neural Networks , year =

    work page

  6. [6]

    Logic-Based Explainability in Machine Learning , year =

    Jo. Logic-Based Explainability in Machine Learning , year =. Reasoning Web , optbooktitle =

    work page

  7. [7]

    Explainability Is

    Jo. Explainability Is. Communications of

    work page

  8. [8]

    International Journal of Approximate Reasoning , title =

    Xuanxiang Huang and Jo. International Journal of Approximate Reasoning , title =

    work page

  9. [9]

    On Tackling Explanation Redundancy in Decision Trees (Extended Abstract) , year =

    Yacine Izza and Alexey Ignatiev and Jo. On Tackling Explanation Redundancy in Decision Trees (Extended Abstract) , year =. IJCAI , optbooktitle =

    work page

  10. [10]

    Theory of Mind Abilities of Large Language Models in Human-Robot Interaction: An Illusion? , year =

    Mudit Verma and Siddhant Bhambri and Subbarao Kambhampati , booktitle =. Theory of Mind Abilities of Large Language Models in Human-Robot Interaction: An Illusion? , year =

    work page

  11. [11]

    Position:

    Subbarao Kambhampati and Karthik Valmeekam and Lin Guan and Mudit Verma and Kaya Stechly and Siddhant Bhambri and Lucas Paul Saldyt and Anil. Position:. Proceedings of the 41st International Conference on Machine Learning , pages =

    work page

  12. [12]

    Survey of Hallucination in Natural Language Generation , year =

    Ziwei Ji and Nayeon Lee and Rita Frieske and Tiezheng Yu and Dan Su and Yan Xu and Etsuko Ishii and Ye Jin Bang and Andrea Madotto and Pascale Fung , journal =. Survey of Hallucination in Natural Language Generation , year =

    work page

  13. [13]

    Cooper and Jo

    Martin C. Cooper and Jo. Artificial Intelligence , title =

    work page

  14. [14]

    International Journal on Software Tools for Technology Transfer , title =

    Christopher Brix and Mark Niklas M. International Journal on Software Tools for Technology Transfer , title =

    work page

  15. [15]

    Proceedings of the ACM on Programming Languages6(POPL), 1–33 (2022)

    Mark Niklas M. doi:10.1145/3498704 , journal =

    work page doi:10.1145/3498704

  16. [16]

    Rudy Bunel and Jingyue Lu and Ilker Turkaslan and Philip H. S. Torr and Pushmeet Kohli and M. Pawan Kumar , bibsource =. Branch and Bound for Piecewise Linear Neural Network Verification , url =. Journal of Machine Learning Research , pages =

    work page

  17. [17]

    Towards Fast Computation of Certified Robustness for ReLU Networks , publisher =

    Tsui. Towards Fast Computation of Certified Robustness for ReLU Networks , publisher =

    work page

  18. [18]

    Efficient Neural Network Robustness Certification with General Activation Functions , booktitle =

    Huan Zhang and Tsui. Efficient Neural Network Robustness Certification with General Activation Functions , booktitle =

    work page

  19. [19]

    ICLR , title =

    Kaidi Xu and Huan Zhang and Shiqi Wang and Yihan Wang and Suman Jana and Xue Lin and Cho. ICLR , title =

    work page

  20. [20]

    NeurIPS , title =

    Shiqi Wang and Huan Zhang and Kaidi Xu and Xue Lin and Suman Jana and Cho. NeurIPS , title =

    work page

  21. [21]

    Huang and Duligur Ibeling and Kyle Julian and Christopher Lazarus and Rachel Lim and Parth Shah and Shantanu Thakoor and Haoze Wu and Aleksandar Zeljic and David L

    Guy Katz and Derek A. Huang and Duligur Ibeling and Kyle Julian and Christopher Lazarus and Rachel Lim and Parth Shah and Shantanu Thakoor and Haoze Wu and Aleksandar Zeljic and David L. Dill and Mykel J. Kochenderfer and Clark W. Barrett , booktitle =. The Marabou Framework for Verification and Analysis of Deep Neural Networks , year =

    work page

  22. [22]

    Barrett and David L

    Guy Katz and Clark W. Barrett and David L. Dill and Kyle Julian and Mykel J. Kochenderfer , title =. Formal Methods Syst. Des. , year =

    work page

  23. [23]

    Haoze Wu and Omri Isac and Aleksandar Zeljic and Teruhiro Tagomori and Matthew L. Daggitt and Wen Kokke and Idan Refaeli and Guy Amir and Kyle Julian and Shahaf Bassan and Pei Huang and Ori Lahav and Min Wu and Min Zhang and Ekaterina Komendantskaya and Guy Katz and Clark W. Barrett , booktitle =. Marabou 2.0:

    work page

  24. [24]

    Algorithms for Verifying Deep Neural Networks , author=. Found. Trends Optim. , year=

    work page

  25. [25]

    Timon Gehr and Matthew Mirman and Dana Drachsler. 2018

    work page 2018

  26. [26]

    ICLR , year =

    Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu , title =. ICLR , year =

    work page

  27. [27]

    Xing and Laurent El Ghaoui and Michael I

    Hongyang Zhang and Yaodong Yu and Jiantao Jiao and Eric P. Xing and Laurent El Ghaoui and Michael I. Jordan , editor =. Theoretically Principled Trade-off between Robustness and Accuracy , booktitle =

    work page

  28. [28]

    ICLR , year =

    Dimitris Tsipras and Shibani Santurkar and Logan Engstrom and Alexander Turner and Aleksander Madry , title =. ICLR , year =

    work page

  29. [29]

    Duchi and Percy Liang , title =

    Aditi Raghunathan and Sang Michael Xie and Fanny Yang and John C. Duchi and Percy Liang , title =. ICML , series =

    work page

  30. [30]

    Computing Reseacrh Repository , title =

    Joey Huchette and Gonzalo Mu. Computing Reseacrh Repository , title =

    work page

  31. [31]

    Deep neural networks and mixed integer linear optimization , year =

    Matteo Fischetti and Jason Jo , journal =. Deep neural networks and mixed integer linear optimization , year =

    work page

  32. [32]

    Integer programming , author =

    work page

  33. [33]

    Stinchcombe and Halbert White , journal =

    Kurt Hornik and Maxwell B. Stinchcombe and Halbert White , journal =. Multilayer feedforward networks are universal approximators , year =

    work page

  34. [34]

    AISTATS , series =

    Xavier Glorot and Yoshua Bengio , title =. AISTATS , series =

    work page

  35. [35]

    Kingma and Jimmy Ba , title =

    Diederik P. Kingma and Jimmy Ba , title =. ICLR , year =

    work page

  36. [36]

    Barrett and David L

    Guy Katz and Clark W. Barrett and David L. Dill and Kyle Julian and Mykel J. Kochenderfer , booktitle =. Reluplex: An Efficient

    work page

  37. [37]

    CoRR , year =

    Alessio Lomuscio and Lalit Maganti , title =. CoRR , year =

    work page

  38. [38]

    "Why Should

    Marco T. "Why Should. KDD , journal =

    work page

  39. [39]

    Mittelstadt and Chris Russell , journal =

    Sandra Wachter and Brent D. Mittelstadt and Chris Russell , journal =. Counterfactual Explanations without Opening the Black Box: Automated Decisions and the

    work page

  40. [40]

    Sharp Minima Can Generalize For Deep Nets , year =

    Laurent Dinh and Razvan Pascanu and Samy Bengio and Yoshua Bengio , booktitle =. Sharp Minima Can Generalize For Deep Nets , year =

    work page

  41. [41]

    Fatemeh Alizadeh and Gunnar Stevens and Margarita Esau , journal =. I Don

    work page

  42. [42]

    Right to an Explanation

    Lilian Edwards and Michael Veale , journal =. Enslaving the Algorithm: From a "Right to an Explanation" to a "Right to Better Decisions"? , year =

    work page

  43. [43]

    The mnist database of handwritten digit images for machine learning research , year =

    Li Deng , journal =. The mnist database of handwritten digit images for machine learning research , year =

    work page

  44. [44]

    CoRR , year =

    Han Xiao and Kashif Rasul and Roland Vollgraf , title =. CoRR , year =

    work page

  45. [45]

    Muggleton , journal =

    Andrew Cropper and Sebastijan Dumancic and Richard Evans and Stephen H. Muggleton , journal =. Inductive logic programming at 30 , year =

    work page

  46. [46]

    JAIR , year =

    Richard Evans and Edward Grefenstette , title =. JAIR , year =

    work page

  47. [47]

    Duarte and Jochen Garcke , journal =

    Ribana Roscher and Bastian Bohn and Marco F. Duarte and Jochen Garcke , journal =. Explainable Machine Learning for Scientific Insights and Discoveries , year =

    work page

  48. [48]

    On the Decision Boundaries of Neural Networks:

    Motasem Alfarra and Adel Bibi and Hasan Hammoud and Mohamed Gaafar and Bernard Ghanem , journal =. On the Decision Boundaries of Neural Networks:

    work page

  49. [49]

    Geometry and Topology of Deep Neural Networks' Decision Boundaries , year =

    Bo Liu , journal =. Geometry and Topology of Deep Neural Networks' Decision Boundaries , year =

    work page

  50. [50]

    Cynthia Rudin and Caroline Wang and Beau Coker , journal =. The

    work page

  51. [51]

    The perceptron: A probabilistic model for information storage and organization in the brain

    Frank Rosenblatt , journal =. The perceptron: A probabilistic model for information storage and organization in the brain. , year =

    work page

  52. [52]

    IEEE TSSC , year =

    Kunihiko Fukushima , title =. IEEE TSSC , year =

    work page

  53. [53]

    Householder , title =

    Alston S. Householder , title =. Bulletin of Mathematical Biophysics , year =

    work page

  54. [54]

    A Stochastic Approximation Method , year =

    Herbert Robbins and Sutton Monro , journal =. A Stochastic Approximation Method , year =

    work page

  55. [55]

    Werbos , booktitle =

    Paul J. Werbos , booktitle =. Backpropagation: past and future , year =

    work page

  56. [56]

    Ng , booktitle =

    Rajat Raina and Anand Madhavan and Andrew Y. Ng , booktitle =. Large-scale deep unsupervised learning using graphics processors , year =

    work page

  57. [57]

    Hinton , booktitle =

    Alex Krizhevsky and Ilya Sutskever and Geoffrey E. Hinton , booktitle =. ImageNet Classification with Deep Convolutional Neural Networks , year =

    work page

  58. [58]

    Regression Shrinkage and Selection via the Lasso , year =

    Robert Tibshirani , journal =. Regression Shrinkage and Selection via the Lasso , year =

    work page

  59. [59]

    One Pixel Attack for Fooling Deep Neural Networks , volume =

    Jiawei Su and Danilo Vasconcellos Vargas and Kouichi Sakurai , journal =. One Pixel Attack for Fooling Deep Neural Networks , volume =

    work page

  60. [60]

    Goodfellow and Jonathon Shlens and Christian Szegedy , booktitle =

    Ian J. Goodfellow and Jonathon Shlens and Christian Szegedy , booktitle =. Explaining and Harnessing Adversarial Examples , year =

    work page

  61. [61]

    Goodfellow and Rob Fergus , booktitle =

    Christian Szegedy and Wojciech Zaremba and Ilya Sutskever and Joan Bruna and Dumitru Erhan and Ian J. Goodfellow and Rob Fergus , booktitle =. Intriguing properties of neural networks , year =

    work page

  62. [62]

    ICLR , publisher =

    Aleksander Madry and Aleksandar Makelov and Ludwig Schmidt and Dimitris Tsipras and Adrian Vladu , title =. ICLR , publisher =

    work page

  63. [63]

    Square Attack:

    Maksym Andriushchenko and Francesco Croce and Nicolas Flammarion and Matthias Hein , booktitle =. Square Attack:

    work page

  64. [64]

    How Deep Learning Sees the World:

    Joana Cabral Costa and Tiago Roxo and Hugo Proen. How Deep Learning Sees the World:

    work page

  65. [65]

    Barrett and David L

    Nicholas Carlini and Guy Katz and Clark W. Barrett and David L. Dill , journal =

    work page

  66. [66]

    McDaniel and Ian J

    Nicolas Papernot and Patrick D. McDaniel and Ian J. Goodfellow and Somesh Jha and Z. Berkay Celik and Ananthram Swami , booktitle =. Practical Black-Box Attacks against Machine Learning , year =

    work page

  67. [67]

    McDaniel and Xi Wu and Somesh Jha and Ananthram Swami , booktitle =

    Nicolas Papernot and Patrick D. McDaniel and Xi Wu and Somesh Jha and Ananthram Swami , booktitle =. Distillation as a Defense to Adversarial Perturbations Against Deep Neural Networks , year =

    work page

  68. [68]

    Ensemble Adversarial Training: Attacks and Defenses , year =

    Florian Tram. Ensemble Adversarial Training: Attacks and Defenses , year =. ICLR , optbooktitle =

    work page

  69. [69]

    Wagner , booktitle =

    Anish Athalye and Nicholas Carlini and David A. Wagner , booktitle =. Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples , year =

    work page

  70. [70]

    A survey of safety and trustworthiness of deep neural networks: Verification, testing, adversarial attack and defence, and interpretability , year =

    Xiaowei Huang and Daniel Kroening and Wenjie Ruan and James Sharp and Youcheng Sun and Emese Thamo and Min Wu and Xinping Yi , journal =. A survey of safety and trustworthiness of deep neural networks: Verification, testing, adversarial attack and defence, and interpretability , year =

    work page

  71. [71]

    Adversarial robustness of deep neural networks: A survey from a formal verification perspective , year =

    Mark Huasong Meng and Guangdong Bai and Sin Gee Teo and Zhe Hou and Yan Xiao and Yun Lin and Jin Song Dong , journal =. Adversarial robustness of deep neural networks: A survey from a formal verification perspective , year =

    work page

  72. [72]

    Towards Formal XAI: Formally Approximate Minimal Explanations of Neural Networks , year =

    Shahaf Bassan and Guy Katz , booktitle =. Towards Formal XAI: Formally Approximate Minimal Explanations of Neural Networks , year =

    work page

  73. [73]

    2023 , author =

    A comprehensive survey of robust deep learning in computer vision , journal =. 2023 , author =

    work page 2023

  74. [74]

    Circuit Complexity and Neural Networks , author =

    work page

  75. [75]

    CoRR , year =

    Johannes Lederer , title =. CoRR , year =

    work page

  76. [76]

    The MIT Press, Cambridge, expanded edition , volume=

    Perceptron: an introduction to computational geometry , author=. The MIT Press, Cambridge, expanded edition , volume=

    work page

  77. [77]

    Boning and Cho

    Huan Zhang and Hongge Chen and Chaowei Xiao and Sven Gowal and Robert Stanforth and Bo Li and Duane S. Boning and Cho. ICLR , title =

    work page

  78. [78]

    Mann and Pushmeet Kohli , title =

    Sven Gowal and Krishnamurthy Dvijotham and Robert Stanforth and Rudy Bunel and Chongli Qin and Jonathan Uesato and Relja Arandjelovic and Timothy A. Mann and Pushmeet Kohli , title =. CoRR , year =

    work page

  79. [79]

    Zico Kolter , title =

    Eric Wong and J. Zico Kolter , title =. ICML , publisher =

    work page

  80. [80]

    ICML , publisher =

    Chen Liu and Ryota Tomioka and Volkan Cevher , title =. ICML , publisher =

    work page

Showing first 80 references.