Expected Tight Bounds for Robust Training

TL;DR

This paper introduces expected tight bounds (ETB) for robust training of deep neural networks, providing significantly tighter bounds than existing interval bound propagation (IBP) methods, leading to improved robustness and accuracy with simple training procedures.

Contribution

The paper proposes ETB, a new method for tighter bound estimation in robust training, extending it to deep networks and demonstrating improved robustness-accuracy trade-offs.

Findings

ETB bounds are provably tighter than IBP bounds in expectation.

Applying ETB yields orders of magnitude tighter bounds on deep networks.

Simple training with ETB achieves strong robustness and accuracy on MNIST and CIFAR10.

Abstract

Training Deep Neural Networks that are robust to norm bounded adversarial attacks remains an elusive problem. While exact and inexact verification-based methods are generally too expensive to train large networks, it was demonstrated that bounded input intervals can be inexpensively propagated from a layer to another through deep networks. This interval bound propagation approach (IBP) not only has improved both robustness and certified accuracy but was the first to be employed on large/deep networks. However, due to the very loose nature of the IBP bounds, the required training procedure is complex and involved. In this paper, we closely examine the bounds of a block of layers composed in the form of Affine-ReLU-Affine. To this end, we propose expected tight bounds (true bounds in expectation), referred to as ETB, which are provably tighter than IBP bounds in expectation. We then extend this result to deeper networks through blockwise propagation and show that we can achieve orders of magnitudes tighter bounds compared to IBP. Furthermore, using a simple standard training procedure, we can achieve impressive robustness-accuracy trade-off on both MNIST and CIFAR10.

Tables

Table 1. Table 1: Model Architectures. “CONV p × w × h + s 𝑝 𝑤 ℎ 𝑠 p\times w\times h+s ”, correspond to p 𝑝 p 2D convolutional filters with size ( w × h ) 𝑤 ℎ (w\times h) and strides of s 𝑠 s . While “FC d 𝑑 d ” is a fully connected layer with d 𝑑 d outputs.

small	medium	large
CONV $16\times 4\times 4+2$	CONV $32\times 3\times 3+1$	CONV $64\times 3\times 3+1$
CONV $32\times 4\times 4+1$	CONV $32\times 4\times 4+2$	CONV $64\times 3\times 3+1$
FC 100	CONV $64\times 3\times 3+1$	CONV $128\times 3\times 3+2$
	CONV $64\times 4\times 4+2$	CONV $128\times 3\times 3+1$
	FC 512	CONV $128\times 3\times 3+1$
	FC 512	FC 200

Table 2. Table 2: ETB vs. IBP on Real Networks. The table shows that our bounds are a superset to the true bounds, computed using an exact MIP solver, and much tighter than IBP.

$ϵ$	$\Gamma$	${\Gamma }_{\min }$	${\Gamma }_{\max }$	$W_{\text{IBP}}-W_{\text{ETB}}$	$W_{\text{IBP}}/W_{\text{ETB}}$
$0.01$	$1.0\pm 0$	$1.0$	$1.0$	$644.322$	$17.391$
$0.02$	$1.0\pm 0$	$1.0$	$1.0$	$1381.980$	$15.270$
$0.03$	$0.97\pm 0.088$	$0.635$	$1.0$	$2255.397$	$14.555$

Equations

$${\mathbf{L}}_f,{\mathbf{U}}_f=f\left(\frac{{\mathbf{U}}_{\mathbf{x}}+{\mathbf{L}}_{\mathbf{x}}}{2}\right)\mp |\mathbf{A}|\left(\frac{{\mathbf{U}}_{\mathbf{x}}-{\mathbf{L}}_{\mathbf{x}}}{2}\right)$$

$$\tilde{g}(\tilde{\mathbf{x}})={\mathbf{a}}_2^{\top }\mathbf{M}\left({\mathbf{A}}_1\tilde{\mathbf{x}}+{\mathbf{b}}_1\right)+b_2.$$

$${\mathbf{L}}_{\mathbf{ETB}},{\mathbf{U}}_{\mathbf{ETB}}=\tilde{g}\left(\frac{{\mathbf{U}}_{\mathbf{x}}+{\mathbf{L}}_{\mathbf{x}}}{2}\right)\mp |{\mathbf{a}}_2^{\top }\mathbf{M}{\mathbf{A}}_1|\left(\frac{{\mathbf{U}}_{\mathbf{x}}-{\mathbf{L}}_{\mathbf{x}}}{2}\right)$$

$${\mathbf{L}}_{\text{approx}}\le {\mathbb{E}}_{{\mathbf{A}}_1,{\mathbf{a}}_2}\left[{\mathbf{L}}_g\right]\text{ and }{\mathbb{E}}_{{\mathbf{A}}_1,{\mathbf{a}}_2}\left[{\mathbf{U}}_g\right]\le {\mathbf{U}}_{\text{approx}},\text{ where}$$

$${\mathbf{L}}_{\text{approx}},{\mathbf{U}}_{\text{approx}}={\mathbb{E}}_{{\mathbf{A}}_1,{\mathbf{a}}_2,\tilde{\mathbf{x}}}\left[g(\tilde{\mathbf{x}})\right]\mp m\sqrt{{\text{Var}}_{{\mathbf{A}}_1,{\mathbf{a}}_2,\tilde{\mathbf{x}}}\left[g(\tilde{\mathbf{x}})\right]}$$

$$\frac{{\sum }_{i=1}^n({\tilde{x}}_i{a}_i-\mathbb{E}[a_i{\tilde{x}}_i])}{\sqrt{\text{Var}\left({\sum }_{i=1}^n({\tilde{x}}_i{a}_i-\mathbb{E}[a_i{\tilde{x}}_i])\right)}}{\to }^d\mathcal{N}(0,1)$$

$$\text{Covariance}({\mathbf{A}}_1\tilde{\mathbf{x}})=\left(\frac{1}{3}{ϵ}^2{\sigma }_{{\mathbf{A}}_1}^{2}n+{\sigma }_{{\mathbf{A}}_1}^2\text{trace}(\mathbf{x}{\mathbf{x}}^{\top })\right)\mathbf{I}.$$

$${\mathbb{E}}_{\theta }\left[{\mathbf{L}}_{\mathbf{ETB}}\right]\le {\mathbb{E}}_{\theta }\left[{\mathbf{L}}_{\text{g}}\right]\text{ and }{\mathbb{E}}_{\theta }\left[{\mathbf{U}}_{\text{g}}\right]\le {\mathbb{E}}_{\theta }\left[{\mathbf{U}}_{\mathbf{ETB}}\right].$$

$$\frac{1}{\sqrt{2\pi }}{\mathbf{x}}_j{1}_k^{\top }{\mathbf{A}}_1(:,j)+\frac{1}{2n}{1}_k^{\top }{\mathbf{b}}_1\ge ϵ\left(\Vert {\mathbf{A}}_1(:,j){\Vert }_2-\frac{1}{\sqrt{2\pi }}\Vert {\mathbf{A}}_1(:,j){\Vert }_1\right)$$

$${\mathbb{E}}_{{\mathbf{A}}_1}\left(\Vert {\mathbf{A}}_1(:,j){\Vert }_2-\frac{1}{\sqrt{2\pi }}\Vert {\mathbf{A}}_1(:,j){\Vert }_1\right)=\sqrt{2}\frac{\Gamma \left(\frac{k+1}{2}\right)}{\Gamma \left(\frac{k}{2}\right)}-k\sqrt{\frac{2}{\pi }}\approx \sqrt{k}-k\sqrt{\frac{2}{\pi }}.$$

$$\mathbf{L},\mathbf{U}=\mathbf{b}_{1}\mp\epsilon|\mathbf{A}_{1}|\mathbf{1}_{n}=\mathbf{1}_{n}\Big{(}\mp 1000-999\Big{)}=-1999~{}\mathbf{1}_{n},\mathbf{1}_{n}.$$

$${\mathbf{L}}_{\mathbf{ETB}},{\mathbf{U}}_{\mathbf{ETB}}={\mathbf{a}}_2^{\top }{\mathbf{b}}_1\mp ϵ|{\mathbf{a}}_2^{\top }{\mathbf{A}}_1|1_n=9990n\mp 10000ϵ1_n^{\top }{1}_n=-10n,19990n.$$

$${\mathbf{L}}_{\mathbf{IBP}},{\mathbf{U}}_{\mathbf{IBP}}$$

$$=-\frac{10}{2}{1}_n^{\top }{1}_n\mp \frac{10}{2}{1}_n^{\top }{1}_n=-10n,0.$$

$$\frac{1}{s_n}\sum _{i=1}^n({\tilde{x}}_i{a}_i-\mathbb{E}[a_i{\tilde{x}}_i]){\to }^d\mathcal{N}(0,1),\text{where}{s}_n^2=\text{Var}\left(\sum _{i=1}^n({\tilde{x}}_i{a}_i-\mathbb{E}[a_i{\tilde{x}}_i])\right)$$

$$\displaystyle\exists\delta>0,\frac{1}{s_{n}^{2+\delta}}\sum_{i=1}^{n}\mathbb{E}\left[\big{|}\tilde{x}_{i}a_{i}-\mathbb{E}[a_{i}\tilde{x}_{i}]\big{|}^{2+\delta}\right]\rightarrow 0,\text{as}~{}~{}n\rightarrow\infty$$

$$s_n^2=\sum _{i=1}^2\text{Var}\left({\tilde{x}}_i{a}_i\right)=\sum _{i=1}^n\mathbb{E}\left[a_i^2{\tilde{x}}_i^2\right]={\sigma }_a^2\sum _{i=1}^n\left(\frac{{ϵ}^2}{3}+x_i^2\right)={\sigma }_a^2\left(\frac{n{ϵ}^2}{3}+\sum _{i=1}^n{x}_i^2\right).$$

$$\mathbb{E}[|a_i{\tilde{x}}_i{|}^{2+\delta }]$$

$$=\frac{3{\sigma }_a^4}{2ϵ}{\int }_{x_i-ϵ}^{x_i+ϵ}{\tilde{x}}_i^{4}d{\tilde{x}}_i=\frac{3{\sigma }_a^4}{10ϵ}\left[(x_i+ϵ{)}^5-(x_i-ϵ{)}^5\right].$$

$$\displaystyle\lim_{n\to\infty}\frac{1}{s_{n}^{4}}\sum_{i=1}^{n}\mathbb{E}\left[\big{|}\tilde{x}_{i}a_{i}-\mathbb{E}[a_{i}\tilde{x}_{i}]\big{|}^{2+\delta}\right]$$

$$=\underset{n\to \infty }{\lim }\frac{3{\sum }_{i=1}^n(x_i+ϵ{)}^5-(x_i-ϵ{)}^5}{10ϵ{\left(\frac{n{ϵ}^2}{3}+{\sum }_{i=1}^n{x}_i^2\right)}^2}$$

$$\le \underset{n\to \infty }{\lim }\frac{3n\left((x_{\text{max}}+ϵ{)}^5-(x_{\text{min}}-ϵ{)}^5\right)}{10ϵ{\left(\frac{n{ϵ}^2}{3}+{\sum }_{i=1}^n{x}_i^2\right)}^2}=0$$

$$\text{Covariance}\left({\mathbf{A}}_1\tilde{\mathbf{x}}+{\mathbf{b}}_1\right)$$

$$=\mathbb{E}\left[{\mathbf{A}}_1\tilde{\mathbf{x}}{\tilde{\mathbf{x}}}^{\top }{\mathbf{A}}_1^{\top }\right]$$

$$={\mathbb{E}}_{{\mathbf{A}}_1}\left[{\mathbf{A}}_1\mathbb{E}\left[\tilde{\mathbf{x}}{\tilde{\mathbf{x}}}^{\top }\right]{\mathbf{A}}_1^{\top }\right]$$

$$={\mathbb{E}}_{{\mathbf{A}}_1}\left[{\mathbf{A}}_1\left(\text{Diag}\left(\frac{{ϵ}^2}{3}\right)+\mathbf{x}{\mathbf{x}}^{\top }\right){\mathbf{A}}_1^{\top }\right]$$

$$=\frac{{ϵ}^2}{3}{\mathbb{E}}_{{\mathbf{A}}_1}\left[{\mathbf{A}}_1{\mathbf{A}}_1^{\top }\right]+\mathbb{E}\left[{\mathbf{A}}_1\mathbf{x}{\mathbf{x}}^{\top }{\mathbf{A}}_1^{\top }\right]$$

$$=\frac{{ϵ}^2}{3}{\mathbb{E}}_{{\mathbf{A}}_1}\left[{\mathbf{A}}_1{\mathbf{A}}_1^{\top }\right]+{\sigma }_{{\mathbf{A}}_1}^2\text{trace}\left(\mathbf{x}{\mathbf{x}}^{\top }\right)\mathbf{I}$$

$$=\left(\frac{{ϵ}^2{\sigma }_{{\mathbf{A}}_1}^{2}n}{3}+{\sigma }_{{\mathbf{A}}_1}^2\text{trace}\left(\mathbf{x}{\mathbf{x}}^{\top }\right)\right)\mathbf{I}$$

$${\left(\mathbb{E}\left[{\mathbf{A}}_1\mathbf{x}{\mathbf{x}}^{\top }{\mathbf{A}}_1^{\top }\right]\right)}_{i,j}$$

$$=\{\begin{array}{ll}0& \text{if}i\ne j\\ {\sigma }_{{\mathbf{A}}_1}^2\text{trace}\left(\mathbf{x}{\mathbf{x}}^{\top }\right)& \text{if}i=j\end{array}$$

$${\mathbb{E}}_{{\mathbf{A}}_1,{\mathbf{a}}_2}\left[{\mathbf{L}}_{\mathbf{ETB}}\right]\le {\mathbb{E}}_{{\mathbf{A}}_1,{\mathbf{a}}_2}\left[{\mathbf{L}}_{\text{true}}\right]$$

$${\mathbf{L}}_{\text{approx}}$$

$$\displaystyle\stackrel{{\scriptstyle\text{\char 172}\;}}{{=}}b_{2}-m\Big{(}\mathbb{E}_{\mathbf{a}_{2}}\left[\text{Var}_{\tilde{\mathbf{y}}}\left(\mathbf{a}_{2}^{\top}\text{max}\left(\tilde{\mathbf{y}},\mathbf{0}\right)+b_{2}|\mathbf{a}_{2}\right)\right]$$

$$\displaystyle\quad\quad\quad\quad\quad+\text{Var}_{\mathbf{a}_{2}}\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\mathbf{a}_{2}^{\top}\text{max}\left(\tilde{\mathbf{y}},\mathbf{0}\right)+b_{2}|\mathbf{a}_{2}\right]\right)\Big{)}^{\frac{1}{2}}$$

$$\displaystyle=b_{2}-m\Bigg{(}\mathbb{E}_{\mathbf{a}_{2}}\left[(\mathbf{a}_{2}^{\top}\odot\mathbf{a}_{2}^{\top})\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\text{max}^{2}\left(\tilde{\mathbf{y}},\mathbf{0}\right)\right]-\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\text{max}\left(\tilde{\mathbf{y}},\mathbf{0}\right)\right]\right)^{2}\right)\right]$$

$$\displaystyle\quad\quad\quad\quad\quad+\text{Var}_{\mathbf{a}_{2}}\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\mathbf{a}_{2}^{\top}\text{max}\left(\tilde{\mathbf{y}},\mathbf{0}\right)+b_{2}|\mathbf{a}_{2}\right]\right)\Bigg{)}^{\frac{1}{2}}$$

$$\displaystyle=b_{2}-m\Bigg{(}\left[\sum_{i=1}^{k}\sigma_{\mathbf{a}_{2}}^{2}\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\text{max}^{2}\left(\tilde{\mathbf{y}},\mathbf{0}\right)\right]\right)_{i}-\sum_{i=1}^{k}\sigma_{\mathbf{a}_{2}}^{2}\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\text{max}\left(\tilde{\mathbf{y}},\mathbf{0}\right)\right]\right)^{2}_{i}\right]$$

$$\displaystyle\quad\quad\quad\quad\quad+\sum_{i=1}^{k}\sigma_{\mathbf{a}_{2}}^{2}\left(\mathbb{E}_{\tilde{\mathbf{y}}}\left[\text{max}\left(\tilde{\mathbf{y}},\mathbf{0}\right)\right]\right)^{2}_{i}\Bigg{)}^{\frac{1}{2}}$$

Full text

1 Introduction

Deep neural networks (DNNs) are susceptible to small imperceptible perturbations, best known as adversarial attacks which can lead to drastic performance degradation. Several network defense approaches were proposed to alleviate this problem. They can be coarsely categorized into empirical methods, like adversarial training (Madry et al., 2018), and provably verifiable methods (Katz et al., 2017). Such verifiers are generally very expensive to compute exactly due to their combinatoric nature. However, they can be sped up with relaxed verification, often referred to as certification methods, by over approximating the worst adversarial loss, over all bounded energy (commonly measured in $\ell_{\infty}$) perturbations around a given input (Wong & Kolter, 2018). It has been demonstrated (Gowal et al., 2019) that robustly training large networks using a certificate is possible by leveraging the cheap-to-compute but very loose interval-based certifier, known as interval domain from Mirman et al. (2018). In particular, they propagate the $\epsilon$-$\ell_{\infty}$ norm bounded input centered at $\mathbf{x}\in\mathbb{R}^{n}$ (i.e. $[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$) through the layers in the network. Despite the simplicity and cost-efficacy of this interval bound propagation (IBP), it results in very loose output interval bounds; which in turn necessitates a complex and carefully tuned training procedure. We aim in this work to improve the bounds computed by IBP to allow for easier training, which can result in stronger robustness, by investigating the bounds in a probabilistic expectation setting. Figure 1 demonstrates the main differences between IBP and our proposed method ETB. We were inspired by prior arts that had investigated the notion of probabilistic certification (Webb et al., 2018; Weng et al., 2018).

We study the output bounds of the block in the form of Affine-ReLU-Affine in expectation over a distribution of network parameters. We prove that our bounds (ETB) are, in expectation, supersets to the true bounds of this block and much tighter than IBP bounds (Gowal et al., 2019). We conduct experiments on synthetic and on real networks, to verify the theory, as well as the factors of improvement over IBP. Additionally, we show a practically-efficient approach to propagating our blockwise bounds through a composition of blocks constituting a deep network; thus, resulting in magnitudes tighter output bounds compared to IBP. Due to the tightness of our proposed expected bounds, we show that with a simple standard training procedure, large deep networks can be robustly trained on both MNIST (LeCun, 1998) and CIFAR10 (Krizhevsky & Hinton, 2009) achieving state-of-art robustness-accuracy trade-off compared to IBP. In other words, we can consistently improve robustness with minimal effect on test accuracy as compared to IBP.

2 Methodology

2.1 Interval Bound Propagation (IBP)

Given input interval bounds for a network (i.e. $[\mathbf{L_{x},U_{x}}]$), Gowal et al. (2019) proposed obtaining the output bounds (i.e. $[\mathbf{L_{IBP}},\mathbf{U_{IBP}}]$) by recursively computing them for every layer.

The output bounds for affine layers in the form $f(\mathbf{x})=\mathbf{Ax+b}$, where $\mathbf{A}\in\mathbb{R}^{k\times n}$ and $\mathbf{b}\in\mathbb{R}^{k}$:

[TABLE]

Where $|.|$ is an elementwise absolute value operator. For the sake of brevity, the operator $\mp$ is a subtraction for $\mathbf{L}_{f}$ and an addition for $\mathbf{U}_{f}$. When the input is $\epsilon$-$\ell_{\infty}$ norm bounded (i.e. $\mathbf{L_{x},U_{x}}=\mathbf{x}\mp\epsilon\mathbf{1}_{n}$ where $\mathbf{1}_{n}$ is the $\mathbb{R}^{n}$ all-ones vector), Equation (1) simply becomes $\mathbf{L}_{f},\mathbf{U}_{f}=f(\mathbf{x})\mp\epsilon|\mathbf{A}|\mathbf{1}_{n}$.

For any non-decreasing elementwise nonlinearity $h(\mathbf{x})$, like the ReLU activation function (i.e. $h(\mathbf{x})=\max(\mathbf{x},\mathbf{0}_{n})$), the bounds are propagated as $\mathbf{L}_{h},\mathbf{U}_{h}=h(\mathbf{L_{x}}),h(\mathbf{U_{x}})$.

2.2 Expected Tight Bound Propagation (ETB)

The high level idea is to use a recursive blockwise bound propagation which can be tighter than applying IBP layerwise for deeper networks. We consider the Affine-ReLU-Affine block of the functional form $g(\mathbf{x})=\mathbf{a}_{2}^{\top}\max\left(\mathbf{A}_{1}\mathbf{x}+\mathbf{b}_{1},\mathbf{0}_{n}\right)+b_{2}$. Throughout the paper, we take $\mathbf{A}_{1}\in\mathbb{R}^{k\times n}$ and without loss of generality the second affine map is a single vector $\mathbf{a}_{2}\in\mathbb{R}^{k}$. We propose new closed form expressions for the interval bounds denoted as $[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]$. In expectation under a distribution of the network parameters $\theta=\{\mathbf{A}_{1},\mathbf{a}_{2}\}$, we prove them to be supersets to the true (tightest) bounds $[\mathbf{L}_{g},\mathbf{U}_{g}]$ for a sufficiently large input dimension $n$ and tighter than $[\mathbf{L}_{\mathbf{IBP}},\mathbf{U}_{\mathbf{IBP}}]$ as the number of hidden nodes $k$ increases. To derive our ETB bounds, we study the bounds of:

[TABLE]

Note that $\tilde{g}$ is very similar to $g$ but with the ReLU replaced by a diagonal matrix $\mathbf{M}=\text{diag}\left(\mathbbm{1}\left\{\mathbf{U}_{1}\geq\mathbf{0}_{k}\right\}\right)$, where $\mathbbm{1}$ is the indicator function and $\mathbf{U}_{1}$ is the upper bound of the first affine layer (i.e. $\mathbf{A}_{1}\tilde{\mathbf{x}}+\mathbf{b}_{1}$). In other words, $\mathbf{M}_{ii}$ is one when the $i^{\text{th}}$ element of $\mathbf{U}_{1}$ is non-negative and zero otherwise. Observe that for the coordinates with $\mathbf{U}_{1}\leq 0$, i.e. the output of the first affine layer is always negative, the function $\tilde{g}$ behaves identically to $g$. Note that for a given $\mathbf{M}$, $\tilde{g}$ is an affine function with the following output interval bounds:

[TABLE]

To compare $\mathbf{L}_{\mathbf{ETB}}$ and $\mathbf{U}_{\mathbf{ETB}}$ to $\mathbf{L}_{g}$ and $\mathbf{U}_{g}$, respectively, and since having access to $\mathbf{L}_{g}$ and $\mathbf{U}_{g}$ is not feasible, we state the following trivial assumption.

Assumption 1**.**

Let $\mathbf{A}_{1}\sim\mathcal{N}(\mathbf{0},\sigma_{\mathbf{A}_{1}}^{2}\mathbf{I})$, $\mathbf{a}_{2}\sim\mathcal{N}(\mathbf{0}_{n},\sigma_{\mathbf{a}_{2}}^{2}\mathbf{I})$, and $\tilde{\mathbf{x}}\sim\mathcal{U}[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$ where $\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2},\tilde{\mathbf{x}}}\left[g(\tilde{\mathbf{x}})\right]$ and $\text{Var}_{\mathbf{A}_{1},\mathbf{a}_{2},\tilde{\mathbf{x}}}\left[g(\tilde{\mathbf{x}})\right]$ are finite. Then, for a sufficiently large $m$:

[TABLE]

Under Assumption 1 and to show that $[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]$ form a superset to $[\mathbf{L}_{g},\mathbf{U}_{g}]$ in expectation, we can show that $\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2}}\left[\mathbf{L}_{\mathbf{ETB}}\right]\leq\mathbf{L}_{\text{approx}}$ and $\mathbf{U}_{\text{approx}}\leq\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2}}\left[\mathbf{U}_{\mathbf{ETB}}\right]$. In general, $\mathbf{L}_{\text{approx}}$ and $\mathbf{U}_{\text{approx}}$ are difficult to compute but they can be well approximated as follows:

Proposition 1**.**

For independent $\mathbf{a}\in\mathbb{R}^{n}\sim\mathcal{N}(\mathbf{0}_{n},\sigma_{a}^{2}\mathbf{I})$ and $\tilde{\mathbf{x}}\sim\mathcal{U}[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$, we have:

[TABLE]

where $\rightarrow^{d}$ indicates convergence in distribution (Lyapunov Central Limit Theorem).

Proposition 2**.**

For independent $\mathbf{A}_{1}\in\mathbb{R}^{k\times n}\sim\mathcal{N}(\mathbf{0},\sigma_{\mathbf{A}_{1}}^{2}\mathbf{I})$ and $\tilde{\mathbf{x}}\sim\mathcal{U}\left[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}\right]$,

[TABLE]

For a sufficiently large $n$, following Propositions 1 and 2, we can approximate $g(\tilde{\mathbf{x}})\approx\mathbf{a}_{2}^{\top}\max\left(\tilde{\mathbf{y}},\mathbf{0}_{n}\right)+b_{2}$, where $\tilde{\mathbf{y}}$ by Lyapunov Central Limit Theorem is a Gaussian vector $\tilde{\mathbf{y}}\sim\mathcal{N}(\mathbf{b}_{1},(\frac{1}{3}\epsilon^{2}\sigma_{\mathbf{A}_{1}}^{2}n+\sigma_{\mathbf{A}_{1}}^{2}\text{trace}(\mathbf{x}\mathbf{x}^{\top}))\mathbf{I})$. This now can be used to approximate $\mathbf{L}_{\text{approx}}$ and $\mathbf{U}_{\text{approx}}$.

Theorem 1**.**

(ETB as Supersets in Expectation) Under Assumption 1 and a large dimension $n$,

[TABLE]

Theorem 1 states that the interval bounds for function $\tilde{g}$ are simply looser bounds to the function of interest $g$ in expectation under plausible distributions of $\theta=\{\mathbf{A}_{1},\mathbf{a}_{2}\}$.

Now, we investigate the tightness of these bounds as compared to the IBP bounds $[\mathbf{L}_{\mathbf{IBP}},\mathbf{U}_{\mathbf{IBP}}]$.

Theorem 2**.**

(ETB vs. IBP in Expectation) Consider an input $\tilde{\mathbf{x}}\sim\mathcal{U}[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$ to $\mathbf{a}_{2}^{\top}\max\left(\mathbf{A}_{1}\mathbf{x}+\mathbf{b}_{1},\mathbf{0}_{n}\right)+b_{2}$, where $\mathbf{a}_{2}\sim\mathcal{N}(\mathbf{0}_{n},\sigma_{\mathbf{a}_{2}}^{2}\mathbf{I})$, under the assumption that $\forall j$

[TABLE]

we have: $\mathbb{E}_{\mathbf{a}_{2}}\left[(\mathbf{U}_{\textbf{IBP}}-\mathbf{L}_{\textbf{IBP}})-(\mathbf{U}_{\mathbf{ETB}}-\mathbf{L}_{\mathbf{ETB}})\right]\geq 0$.

Theorem 2 states that under some assumptions on $\mathbf{A}_{1}$ and a plausible distribution for $\mathbf{a}_{2}$, our proposed ETP interval width can be much smaller than the IBP interval width in expectation. Next, we show that the inequality assumption in Theorem 2 is very mild. In fact, a wide range of $(\mathbf{A}_{1},\mathbf{b}_{1})$ satisfy it, and the following proposition gives an example.

Proposition 3**.**

For a matrix $\mathbf{A}_{1}\in\mathbb{R}^{k\times n}\sim\mathcal{N}(\mathbf{0},\mathbf{I})$,

[TABLE]

Proposition 3 implies that as the number of hidden nodes $k$ increases, the expectation of the right hand side of the inequality assumption in Theorem 2 grows more negative, while the left hand side is zero in expectation when $\mathbf{b}_{1}\sim\mathcal{N}(\mathbf{0}_{k},\mathbf{I})$. In other words, for zero-mean Gaussian weights $(\mathbf{A}_{1},\mathbf{b}_{1})$ and with a large enough number of hidden nodes $k$, the assumption is satisfied. Furthermore, it is common to regularize network weights while training with an $\ell_{2}$ regularizer; encouraging the weights to follow a zero-mean Gaussian distribution. We show empirical evidence of this on MNIST and CIFAR10 in the Appendix along with all the proofs and detailed analyses.

3 Experiments

We compare our method against models trained nominally (i.e. only the standard training loss is used), and those trained robustly with IBP (Gowal et al., 2019). Given the well-known robustness-accuracy trade off (Tsipras et al., 2019), robust models are often less accurate. Therefore, we compare all methods using a robustness vs. accuracy scatter plot. Following prior work, we use Projected Gradient Descent (PGD) (Madry et al., 2018) to measure robustness. We use a loss function similar to the one proposed in Gowal et al. (2019). In particular, we use $L=\ell(f_{\theta}(\mathbf{x}),\mathbf{y}_{g})+\kappa\ell(\mathbf{z},\mathbf{y}_{g})$, where $\ell$, $f_{\theta}(\mathbf{x})$, $\mathbf{y}_{g}$, and $\kappa$ are the cross-entropy loss, output logits, true class label, and regularization hyperparameter, respectively. $\mathbf{z}$ represents the “adversarial” logits that combine the lower bound of the true label and the upper bound of all other labels. Nominal training occurs when $\kappa=0$. Due to the tightness of our bounds, in contrast to IBP, we don’t need to carefully tune $\kappa$ or $\epsilon_{\text{train}}$.

We train the three network models (small, medium, large) provided by Gowal et al. (2019) on both MNIST and CIFAR10. Following the same setup in Gowal et al. (2019), we train all models with $\epsilon_{\text{train}}\in\{0.1,0.2,0.3,0.4\}$ for MNIST and $\epsilon_{\text{train}}\in\{2/255,8/255,16/255,0.1\}$ for CIFAR10. In all experiments, and for stronger baselines and fair comparison between IBP training and ETB training, we grid search over $\{0.1,0.001,0.0001\}$ learning rates and employ a temperature over the logits with a grid of $\{1,1/5\}$ as in Hinton et al. (2015) and report the best performing models for both. Then, we compute PGD robustness for every $\epsilon_{\text{train}}$ of every model for all $\epsilon_{\text{test}}\in\{0.1,0.2,0.3,0.4\}$ for MNIST and for all $\epsilon_{\text{test}}\in\{2/255,8/255,16/255,0.1\}$ for CIFAR10.

We compute the average PGD robustness over all $\epsilon_{\text{test}}$ and the test accuracy, and report them in a 2D scatter plot. We report the performance results on MNIST and CIFAR10 for the small, medium, and large architectures in Figure 2. For all trained architectures, we only report the results for those that achieve at least a test accuracy of $97.5\%$ and $40\%$ on MNIST and CIFAR10, respectively; otherwise, it is an indication of failure in training. Interestingly, our training scheme can be used to train all architectures for all $\epsilon_{\text{train}}$. This is unlike IBP, which for example was only able to successfully train the large architecture with $\epsilon_{\text{train}}=0.1$ on MNIST. Moreover, models trained with ETB always achieve better PGD robustness on all architectures while preserving similar if not higher accuracy (on large networks). Models trained with IBP achieve high robustness but their test accuracy is drastically affected. More details and experiments are left for the avid reader in the Appendix.

Appendix A PGD Robustness on Specific Input Bounds

In section 3, we used the three models (small, medium, and large) provided by Gowal et al. (2019):

Appendix B ETB as Supersets in Expectation

Here, we validate Theorem 1 with several controlled experiments. For a network $g(\mathbf{x})=\mathbf{a}_{2}^{\top}\max\left(\mathbf{A}_{1}\mathbf{x}+\mathbf{b}_{1},\mathbf{0}_{n}\right)+b_{2}$ that has true bounds $[\mathbf{L}_{g},\mathbf{U}_{g}]$ for $\tilde{\mathbf{x}}\in[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$, we empirically show under the mild assumptions of Theorem 1 that $[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]$ is a superset to $[\mathbf{L}_{g},\mathbf{U}_{g}]$ in expectation.

Following the default PyTorch initialization (Paszke et al., 2017), we construct the biases. As for the elements of the weight matrices $\mathbf{A}_{1}\in\mathbb{R}^{k\times n}$ and $\mathbf{A}_{2}\in\mathbb{R}^{1\times k}$, they are sampled from $\mathcal{N}(0,1/\sqrt{n})$ and $\mathcal{N}(0,1/\sqrt{k})$, respectively. We estimate $\mathbf{L}_{g}$ and $\mathbf{U}_{g}$ by taking the minimum and maximum of $10^{6}+2^{n}$ Monte-Carlo evaluations of $g$. For a given $\mathbf{x}\sim\mathcal{N}(\mathbf{0}_{n},\mathbf{I})$ and with $\epsilon=0.1$, we uniformly sample $10^{6}$ examples from the interval $[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$. We also sample all $2^{n}$ corners of the hyper cube $[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$. To show that the proposed interval $[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]$ is a superset of $[\mathbf{L}_{g},\mathbf{U}_{g}]$, we evaluate the length of the intersection of the two intervals over the length of the true interval defined as $\Gamma=|[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]\cap[\mathbf{L}_{g},\mathbf{U}_{g}]|/|[\mathbf{L}_{g},\mathbf{U}_{g}]|$. Note that $\Gamma=1$ if and only if $[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]$ is a superset to $[\mathbf{L}_{g},\mathbf{U}_{g}]$. For a given $n$, we conduct this experiment $10^{3}$ times with varying $\mathbf{A}_{1}$, $\mathbf{A}_{2}$, $\mathbf{b}_{1}$, $\mathbf{b}_{2}$ and $\mathbf{x}$ and report the average $\Gamma$. Then, we run this for a varying number of input size $n$ and a varying number of hidden nodes $k$. As predicted by Theorem 1, Figure 5(a) demonstrates that as $n$ increases, the proposed interval will be more likely to be a superset of the true interval, regardless of the number of hidden nodes $k$. Note that networks that are as wide as $k=1000$, require no more than $n=15$ input dimensions for the proposed intervals to be a superset of the true intervals. In practice, $n$ is much larger than that, e.g. $n\approx 3\times 10^{3}$ in CIFAR10.

In Figure 5(b), we empirically show that the above behavior persists in deeper networks. We propagate the bounds blockwise and conduct similar experiments on fully-connected networks. We vary the network depth but keep $k=n$ fixed. These results indeed suggest that the proposed bounds are supersets to the true bounds in expectation and are more likely so with larger $k$.

Appendix C Tightness of ETB vs. IBP in Expectation

In this experiment we focus our attention on the tightness of ETB when compared to IBP. In particular, we validate Theorem 2 by comparing the interval width of our proposed bounds, $W_{\mathbf{ETB}}=\mathbf{U}_{\mathbf{ETB}}-\mathbf{L}_{\mathbf{ETB}}$, with that of IBP, $W_{\mathbf{IBP}}=\mathbf{U}_{\mathbf{IBP}}-\mathbf{L}_{\mathbf{IBP}}$. We compute both the difference and ratio of widths for varying values of $k$, $n$, and $\epsilon$. Figure 6 reports the average width difference and ratio over $10^{3}$ runs in a similar setup to the previous experiment. Figures 6(a) and 6(b) show that the proposed bounds indeed get tighter than IBP, as $k$ increases across all $\epsilon$ values (as predicted by Theorem 2). Note that we only show results for $\epsilon=\{0.01,0.1\}$ in Figure 6(b) as the performance of $\epsilon=\{0.5,1.0\}$ was very similar to $\epsilon=0.1$. Similar improvement occurs with increasing $n$, as in Figures 6(c) and 6(d).

We also compare the bounds under increasing depth for both fully-connected networks (refer to Figures 7(a) and 7(b)) and convolutional networks (refer to Figures 7(c) and 7(d)). For all fully-connected networks, we take $n=k=500$. Our proposed bounds get consistently tighter as the network depth increases over all choices of $\epsilon$. In particular, the proposed bounds can be more than $10^{6}$ times tighter than IBP for a ten-layer DNN. A similar observation can also be made for convolutional networks, where it is expensive to compute our bounds. So, instead, we obtain matrices $\mathbf{M}$ using the easy-to-compute IBP upper bounds. Despite this relaxation, we still obtain very tight expected bounds. Note that this slightly modified approach reduces exactly to our bounds for two-layer networks.

Appendix D ETB vs. IBP on Real Networks

We also train a three-layer network on the MNIST dataset with $\sim 99\%$ test accuracy. To show that ETB are also supersets to true bounds on real networks, and since the input dimension is too large for Monte-Carlo sampling ($n=784$ pixels), we use the MIP formulation by Tjeng et al. (2019) with an identical parameter setting to Gowal et al. (2019). We then report $\Gamma$ over varying testing $\epsilon$. Table 2 demonstrates that indeed even on real networks beyond two layers and without the Gaussian weight assumption, our bounds are still supersets to the true bounds computed with the MIP solver and are much tighter than IBP. The results are averaged over $100$ randomly selected MNIST images.

Appendix E Qualitative Results

Following previous works (Wong & Kolter, 2018; Gowal et al., 2019), we show qualitative results on synthetic random five-layer fully-connected networks with the architecture (i.e. layer dimensions) $n$-$100$-$100$-$100$-$100$-$2$ where $n\in\{2,10,20\}$ is the input size. In Figure 8, we visualize examples of the interval bounds of ETB and compare them to IBP and the true bounds estimated by Monte-Carlo sampling for several choices of $\epsilon\in\{0.05,0.1,0.25\}$.

Appendix F Comments on Assumption 1

F.1 Hypothetical Failure Example

Generally speaking, our proposed bounds $[\mathbf{L}_{\mathbf{ETB}},\mathbf{U}_{\mathbf{ETB}}]$ computed using Equation (3) can be very loose if the network weights $\mathbf{A_{1}},\mathbf{a}_{2}$ do not follow Assumption 1. In this section, we show a failure example when this Gaussian premise is violated. Consider a two-layer network $g(\mathbf{x})$ where $\mathbf{A}_{1}=1000~{}\mathbf{I}_{n\times n}$, $\mathbf{b}_{1}=-999~{}\mathbf{1}_{n}$, $\mathbf{a}_{2}=-10~{}\mathbf{1}_{n}$, and $b_{2}=0$. For the interval $[-\mathbf{1}_{n},\mathbf{1}_{n}]$, the output lower and upper bounds of the first layer are given as

[TABLE]

Since $\mathbf{U}\geq\mathbf{0}$, then $\mathbf{M}=\mathbf{I}_{n\times n}$. Therefore, our estimated bounds by Equation (3) are

[TABLE]

As for IBP bounds, they are given as follows:

[TABLE]

Under this construction of network weights, violating the i.i.d Gaussian assumption, it is clear that our bounds can be orders of magnitude looser to IBP. In the following section, we demonstrate that networks trained on real data do have weights that are not far from the Gaussian assumption by empirically investigating the histogram of the network weights.

F.2 Assumption Validity on Real Networks

While the Gaussian i.i.d. assumption can be strong for general networks trained on real data, it is not far from being reasonable due to commonly accepted training procedures. This is since it is common to regularize network weights while training with an $\ell_{2}$ regularizer encouraging the weights to follow a zero-mean Gaussian distribution let alone that networks in many cases are initialized in such manner. However, to quantify how reasonable is the assumption of Gaussian i.i.d. weights in trained networks, we visualize the histogram of the weights of a trained medium-sized network (provided by Gowal et al. (2019)) on MNIST in Figure 9(a). As can be seen, all the histograms of the weights have a center of mass around 0 with a bell shaped looking distribution. A similar observation can be noted for CIFAR10 in Figure 9(b) and CIFAR100 in Figure 9(c). This provide some evidence that the assumption of standard Gaussian is not far from being realistic.

Appendix G Proofs

Proposition 1**.**

For $\mathbf{a}\in\mathbb{R}^{n}\sim\mathcal{N}(\mathbf{0},\sigma_{a}^{2}\mathbf{I})$ and a uniform random vector $\tilde{\mathbf{x}}\sim\mathcal{U}[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}]$ where both $\mathbf{a}$ and $\tilde{\mathbf{x}}$ are independent, we have that Lyapunov Central Limit Theorem holds such that

[TABLE]

where $\rightarrow^{d}$ indicates convergence in distribution.

Proof.

The Lyapunov condition

[TABLE]

is sufficient for Lyapunov Central Limit Theorem to hold. Note that

[TABLE]

Since for $\delta=2$, we have that

[TABLE]

Thereafter, Lyapunov Central Limit Theorem with $\delta=2$ is satisfied since

[TABLE]

Proposition 2**.**

A random matrix $\mathbf{A}_{1}$ with i.i.d. Gaussian elements of zero mean and $\sigma_{\mathbf{A}_{1}}$ standard deviation and a uniform random vector $\tilde{\mathbf{x}}\sim\mathcal{U}\left[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}\right]$ we have that $\text{Covariance}\left(\mathbf{A}\tilde{\mathbf{x}}\right)=\left(\frac{\epsilon^{2}\sigma_{\mathbf{A}_{1}}^{2}n}{3}+\sigma_{\mathbf{A}_{1}}^{2}\text{trace}\left(\mathbf{x}\mathbf{x}^{\top}\right)\right)\mathbf{I}$.

Proof.

The former follows from the fact that

[TABLE]

The last equality follows since:

[TABLE]

Theorem 1**.**

(ETB as Supersets in Expectation) Let Assumption 1 hold. For a sufficiently large input dimension $n$,

[TABLE]

Proof.

[TABLE]

Note that ①  follows by total expectation and total variance on the two terms, respectively. Lastly, ②  follows from the closed form expression derived in Bibi et al. (2018) where $\Phi$ and $\phi$ are the normal cumulative and probability Gaussian density functions, respectively. Note that $\tilde{\mathbf{y}}\sim\mathcal{N}\left(\mathbf{b}_{1},\left(\frac{\epsilon^{2}\sigma_{\mathbf{A}_{1}}^{2}n}{3}+\sigma_{\mathbf{A}_{1}}^{2}\text{trace}\left(\mathbf{x}\mathbf{x}^{\top}\right)\right)\mathbf{I}\right)$ and that $\sigma_{\tilde{\mathbf{y}}}^{2}=\left(\frac{\epsilon^{2}\sigma_{\mathbf{A}_{1}}^{2}n}{3}+\sigma_{\mathbf{A}_{1}}^{2}\text{trace}\left(\mathbf{x}\mathbf{x}^{\top}\right)\right)$.

[TABLE]

Note that ①  follows from the mean of a folded Gaussian. The last equality follows by taking the total expectation where $S$ is the set of indices where $\mathbf{u}_{1}^{i}\geq\mathbf{0}$ for all $i\in S$. Since $\mathbf{u}_{1}$ is random, then $|S|$ is also random. Therefore, one can reparameterize the sum and thus we have:

[TABLE]

The inequality follows by Stirling’s formula where the right hand side only grows by order $n\mathbb{E}_{|S|}\sqrt{|S|}$ for large $|S|$. Then we have that:

[TABLE]

Note that if $n$ grows sufficiently faster than $\sqrt{k}$, it grows faster than $\mathbb{E}_{|S|}\sqrt{|S|}$ since $\mathbb{E}_{|S|}[\sqrt{|S|}]\leq\sqrt{k}$ we have that ①  is $\mathcal{O}(n)$ while ②  is $\mathcal{O}(\sqrt{n})$. Thus, for sufficiently large input dimension $n$ we have that $\mathbf{L}_{\text{approx}}\geq\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2}}[\mathbf{L}_{\mathbf{ETB}}]$ and since by construction $\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2}}\left[\mathbf{L}_{\text{true}}\right]\geq\mathbf{L}_{\text{approx}}$ the proof is complete. Note that a symmetric argument can be applied to show that $\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2}}\left[\mathbf{U}_{\mathbf{ETB}}\right]\geq\mathbb{E}_{\mathbf{A}_{1},\mathbf{a}_{2}}\left[\mathbf{U}_{\text{true}}\right]$.

Theorem 2**.**

*(ETB vs. IBP in Expectation)

Consider an $\epsilon-\ell_{\infty}$ bounded uniform random variable input $\tilde{\mathbf{x}}\in\left[\mathbf{x}-\epsilon\mathbf{1}_{n},\mathbf{x}+\epsilon\mathbf{1}_{n}\right]$ to a block of layers in the form Affine-ReLU-Affine (parameterized by $\mathbf{A}_{1},\mathbf{b}_{1},\mathbf{a}_{2}$ and $\mathbf{b}_{2}$ for the first and second affine layers respectively) and $\mathbf{a}_{2}^{2}\sim\mathcal{N}(\mathbf{0},\sigma_{\mathbf{a}_{2}}\mathbf{I})$. Under the assumption that $\frac{1}{\sqrt{2\pi}}\mathbf{x}_{j}\mathbf{1}_{k}^{\top}\mathbf{A}_{1}(:,j)+\frac{1}{2n}\mathbf{1}_{k}^{\top}\mathbf{b}_{1}\geq\epsilon\left(\|\mathbf{A}_{1}(:,j)\|_{2}-\frac{1}{\sqrt{2\pi}}\|\mathbf{A}_{1}(:,j)\|_{1}\right)$ $\forall j$, we have: $\mathbb{E}_{\mathbf{a}_{2}}\left[(\mathbf{U}_{\textbf{IBP}}-\mathbf{L}_{\textbf{IBP}})-(\mathbf{U}_{\mathbf{ETB}}-\mathbf{L}_{\mathbf{ETB}})\right]\geq 0$.*

Proof.

Note that

[TABLE]

Consider the coordinate splitting functions $S^{++}(.)$, $S^{+-}(.)$, $S^{--}(.)$ and $S^{-+}(.)$ such that for $\mathbf{x}\in\mathbb{R}^{n}$, $S^{++}(\mathbf{x})=\mathbf{x}\odot{\mathbbm{1}\left\{\mathbf{u}_{1}^{i}\geq 0,\mathbf{l}^{i}_{1}\geq 0\right\}}$ where $\mathbbm{1}\left\{\mathbf{u}_{1}^{i}\geq 0,\mathbf{l}^{i}_{1}\geq 0\right\}$ is a vector of all zeros and 1 in the locations where both $\mathbf{u}_{1}^{i},\mathbf{l}_{1}^{i}\geq 0$. However, since $\mathbf{u}_{1}\geq\mathbf{l}_{1}$, then $S^{-+}(.)=\mathbf{0}$. Therefore it is clear that for any vector $\mathbf{x}$ and an interval $[\mathbf{l}_{1},\mathbf{u}_{1}]$, we have that

[TABLE]

since the sets $\{i;\mathbf{u}_{1}^{i}\geq 0,\mathbf{l}_{1}^{i}\geq 0\}$, $\{i;\mathbf{u}_{1}^{i}\geq 0,\mathbf{l}_{1}^{i}\leq 0\}$ and $\{i;\mathbf{u}_{1}^{i}\leq 0,\mathbf{l}_{1}^{i}\leq 0\}$ are disjoints and their union $\{i=1,2,\dots,i=n\}$. We will denote the difference in the interval lengths as $W_{IBP}-W_{ETB}$ for ease of notation. Thus, we have:

[TABLE]

Note that in the first equality, we used the property of the coordinate splitting functions defined in Equation (8). In the second equality, we used the fact that $\mathbf{l}_{1},\mathbf{u}_{1}=\mathbf{A}_{1}\mathbf{x}+\mathbf{b}_{1}\mp\epsilon|\mathbf{A}_{1}|\mathbf{1}_{n}$. The last term in the penultimate equality follows since $S^{++}$ and $S^{+-}$ corresponds to the indices that are selected by $\text{diag}\left(\mathbbm{1}\left\{\mathbf{u}_{1}\geq\mathbf{0}\right\}\right)$.

Now by taking the expectation over $\mathbf{a}_{2}$, we have for ① :

[TABLE]

The second equality follows from the mean of the folded Gaussian and the fact that $\mathbf{u}_{1}\geq\mathbf{l}_{1}$.

For ② , we have:

[TABLE]

Lastly, for ③ , we have:

[TABLE]

Using Holder’s inequality, i.e. $\mathbb{E}[|x|]\leq\sqrt{\mathbb{E}[x^{2}]}$, per coordinate of the vector $\left[\sum_{i=1}^{k}\mathbf{A}_{1}(i,:)\mathbf{a}_{2}^{i}\left(\mathbbm{1}\left\{\mathbf{u}_{1}^{i}\geq 0\right\}\right)\right]$ and by binomial expansion, we have at the $j^{\text{th}}$ coordinate

[TABLE]

The second equality follows by the independence of $\mathbf{a}_{2}^{i}$ and that they have zero mean. Therefore it follows from ③ that:

[TABLE]

Lastly, putting things together, i.e. $\mathbb{E}\left[\text{\char 172}\;+\text{\char 173}\;-\text{\char 174}\;\right]$ we have that

[TABLE]

Note that to show that the previous inequality is non-negative, it is sufficient to show that the previous inequality is non-negative for the non-intersecting sets $\{i:\mathbf{l}^{i}_{1}\geq\mathbf{0}\}$ and $\{i:\mathbf{u}_{1}^{i}\geq\mathbf{0},\mathbf{l}_{1}^{i}\leq\mathbf{0}\}$. Thus the right hand side can be written as the sum of two sets.

For the set $\{i:\mathbf{l}^{i}_{1}\geq\mathbf{0}\}$, the RHS of inequality (9) reduces to :

[TABLE]

For the set $\{i:\mathbf{u}_{1}^{i}\geq\mathbf{0},\mathbf{l}_{1}^{i}\leq\mathbf{0}\}$ and using the definition of $\mathbf{u}_{1}$, the RHS of inequality (9) reduces to

[TABLE]

Note that given the Assumption 1 where $\frac{1}{\sqrt{2\pi}}\mathbf{x}_{j}\mathbf{1}_{k}^{\top}\mathbf{A}_{1}(:,j)+\frac{1}{2n}\mathbf{1}_{k}^{\top}\mathbf{b}\geq 0\geq\epsilon\left(\|\mathbf{A}_{1}(:,j)\|_{2}-\frac{1}{\sqrt{2\pi}}\|\mathbf{A}_{1}(:,j)\|_{1}\right)$ $\forall j$, then if both Equations (10) and (G), this completes the proof.

Lemma 1**.**

For $\mathbf{x}\in\mathbb{R}^{k}\sim\mathcal{N}\left(\mathbf{0},\mathbf{I}\right)$, where $k\geq 5$ we have that $\mathbb{E}\left[\frac{3}{\sqrt{2\pi}}\|\mathbf{x}\|_{1}-2\|\mathbf{x}\|_{2}\right]\geq 0$.

Proof.

Note that by the mean of a folded Gaussian, we gave that $\mathbb{E}\left[\|\mathbf{x}\|_{1}\right]=\sum_{i}^{k}\mathbb{E}\left[|\mathbf{x}_{i}|\right]=k\sqrt{\frac{2}{\pi}}$. Moreover, note that

[TABLE]

Note that $y$ is Chi-Square random variable and that $f_{\sqrt{y}}(x)=2xf_{y}(x^{2})=\frac{x^{k-1}}{2^{\frac{k}{2}-1}\Gamma(\frac{k}{2})}\exp\left(-\frac{x^{2}}{2}\right)$ where the third inequality follows by integrating by parts recursively. Lastly, the last approximation follows by stirling’s approximation for large $k$.

Proposition 3**.**

For a random matrix $\mathbf{A}_{1}\in\mathbb{R}^{k\times n}$ with i.i.d elements such $\mathbf{A}_{1}(i,j)\sim\mathcal{N}(0,1)$, then

[TABLE]

Proof.

The proof follows immediately from Lemma 1.