Random Parameter Noise Does Not Make Exact ReLU Verification Easy

• URL: http://arxiv.org/abs/2607.14375v1
• Date: Wed, 15 Jul 2026 21:26:20 GMT
• Title: Random Parameter Noise Does Not Make Exact ReLU Verification Easy
• Abstract summary: We study exact verification of ReLU networks in an adversarial smoothed model.<n>We show that, under the standard assumption $mathrmNPnotsubseteqmathrmBPP$, there is no sound and complete verifier whose expected running time is embedding in network size, bit complexity, and inverse noise level for every base instance.
• Score: 14.270378035741404
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: We study exact verification of ReLU networks in an adversarial smoothed model. Every network weight and bias is independently perturbed by Gaussian noise, clipped to $[-2,2]$, and rounded to the exact dyadic grid determined by the input bit complexity. We show that, under the standard assumption $\mathrm{NP}\not\subseteq\mathrm{BPP}$, there is no sound and complete verifier whose expected running time is polynomial in network size, bit complexity, and inverse noise level for every base instance. The conclusion already holds at the fixed noise level $σ_\star=2^{-11}$ for one-hidden-layer networks over a unit box, with hidden fan-in at most three and base coefficients in $[-1,1]$. The proof combines an exact gap embedding with a quantitative robustness argument. For every E3SAT formula $Φ$ with $m$ clauses, a four-ReLU-per-clause construction satisfies $\max_{x\in[0,1]^n} g_Φ(x)=(m-\operatorname{unsat}(Φ))/3$, and coordinatewise threshold rounding never decreases the objective. A weighted parameter-sensitivity inequality and Gaussian concentration then show that a verification gap linear in $m$ survives the aggregate perturbation of all coefficients with probability at least $1-e^{-m/8}$. The proof includes clipping, exact dyadic rounding, output-layer perturbations, polynomial-bit sampling of the rounded Gaussian law, and the conversion from expected smoothed running time to a BPP algorithm. Computational checks test the exact identity and illustrate the different scaling of extensive and constant gaps; they are diagnostics rather than evidence for the complexity theorem. The result concerns worst-case base networks in the stated absolute-noise model, but it shows that parameter nondegeneracy alone does not yield a universal smoothed-polynomial guarantee for exact verification.

Related papers

• Tight Sampling Complexity with stochastic gradient oracles in Fixed Dimensions [5.603202398374589]
  The potential is $$-strongly convex and $L$-smooth, with an unknown mode in the ball of radius $-1/2$ about the origin.<n>We prove that the tight complexity of sampling a distribution within $$-TV distance from the target distribution is [ Nstar_textTV=!left(log(1+)+ frac2right), ] where $:=frac L$ is the condition number.
  arXiv  Detail & Related papers  (2026-09-11T08:44:06Z)
• The geometry of AI validation: Exact certification limits for iid best-of-N search [0.0]
  We represent validation and deployment rules as kernels over a reliability surface.<n>Knowing best-of-$n$ reliability through $n=m$ leaves exact ambiguity width $B_m,N=1+2sum_r=1m(-1)rcos2Nr/[(m+1)]$.
  arXiv  Detail & Related papers  (2026-08-21T15:18:11Z)
• Robust Average-Reward Markov Decision Processes: Minimax-Optimal Learning via Plug-in Reductions [51.50375419691955]
  Distributionally robust Markov decision processes provide a principled framework for sequential decision making under model uncertainty.<n>We study how many samples are necessary and sufficient to learn an $varepsilon$-optimal robust policy under the average-reward criterion.
  arXiv  Detail & Related papers  (2026-08-06T19:49:48Z)
• Research Report on Noise-Shaped One-Bit Coefficients in Discrete Polynomial Fourier Extension [0.0]
  This report studies noise-shaped one-bit coefficients in normalized discrete Fourier extension.<n>For first-order Sigma- quantization, the error is written as $e_k=u_k-q_k=v_k$ with a uniformly bounded state.<n>For the parabolic $_x,t()=x+t2$, the bound is expressed through $J(x,t)=int_01 |x+2t|d$, and the uniform $N-1$ rate is shown to be sharp.
  arXiv  Detail & Related papers  (2026-07-26T21:51:41Z)
• Saturation Makes Quantization Error Additive: A Coverage Model with a Certificate [0.0]
  Mixed-precision quantization must decide which parts of a model to keep at higher precision.<n>We show that the loss from quantizing a set of layers can be reconstructed from per-layer or pairwise sensitivities measured in isolation.<n>We propose the coverage model $f(S)=cbigl (1-prod_iin S (1-a_i)bigr)$, which reproduces the measured variance profile of $f$ to within a few percent from its $L$ fitted break-rates.
  arXiv  Detail & Related papers  (2026-07-14T02:08:33Z)
• A law of robustness for two-layer neural networks with arbitrary weights [0.0]
  Bubeck, Li and Nagaraj conjectured that, for generic data, any two-layer neural network with $m$ neurons that fits noisy labels must have Lipschitz constant.<n>We prove the conjectured law, up to one logarithmic factor, for every continuous piecewise-linear activation in particular for ReLU networks.
  arXiv  Detail & Related papers  (2026-07-08T17:44:15Z)
• Decoherence as Defence and the Magnitude of Noise Regularisation: A Rigorous N -Qubit Theory of Stochastic Quantum Neural Networks for Adversarially Robust Network Intrusion Detection [0.0]
  We give an $N$-qubit formulation through the master equation and its vectorised Liouvillian.<n>We prove a emphdecoherence-contraction theorem: a depolarising channel of strength.<n>We show this robustness arises from a noise-reshaped training boundary rather than from attack-time contraction.
  arXiv  Detail & Related papers  (2026-06-23T07:06:56Z)
• Provable Scaling Laws for the Test-Time Compute of Large Language Models [84.00141420901038]
  We propose two algorithms that enjoy provable scaling laws for the test-time compute of large language models.<n>One is a two-stage knockout-style algorithm, where each candidate is evaluated by its average win rate against multiple opponents.<n>The other is a two-stage league-style algorithm, where each candidate is evaluated by its average win rate against multiple opponents.
  arXiv  Detail & Related papers  (2024-11-29T05:29:47Z)
• Efficiently Learning One-Hidden-Layer ReLU Networks via Schur Polynomials [50.90125395570797]
  We study the problem of PAC learning a linear combination of $k$ ReLU activations under the standard Gaussian distribution on $mathbbRd$ with respect to the square loss. Our main result is an efficient algorithm for this learning task with sample and computational complexity $(dk/epsilon)O(k)$, whereepsilon>0$ is the target accuracy.
  arXiv  Detail & Related papers  (2023-07-24T14:37:22Z)
• Random quantum circuits transform local noise into global white noise [118.18170052022323]
  We study the distribution over measurement outcomes of noisy random quantum circuits in the low-fidelity regime. For local noise that is sufficiently weak and unital, correlations (measured by the linear cross-entropy benchmark) between the output distribution $p_textnoisy$ of a generic noisy circuit instance shrink exponentially. If the noise is incoherent, the output distribution approaches the uniform distribution $p_textunif$ at precisely the same rate.
  arXiv  Detail & Related papers  (2021-11-29T19:26:28Z)
• The Sample Complexity of Robust Covariance Testing [56.98280399449707]
  We are given i.i.d. samples from a distribution of the form $Z = (1-epsilon) X + epsilon B$, where $X$ is a zero-mean and unknown covariance Gaussian $mathcalN(0, Sigma)$. In the absence of contamination, prior work gave a simple tester for this hypothesis testing task that uses $O(d)$ samples. We prove a sample complexity lower bound of $Omega(d2)$ for $epsilon$ an arbitrarily small constant and $gamma
  arXiv  Detail & Related papers  (2020-12-31T18:24:41Z)
• Why Are Convolutional Nets More Sample-Efficient than Fully-Connected Nets? [33.51250867983687]
  We show a natural task on which a provable sample complexity gap can be shown, for standard training algorithms. We demonstrate a single target function, learning which on all possible distributions leads to an $O(1)$ vs $Omega(d2/varepsilon)$ gap. Similar results are achieved for $ell$ regression and adaptive training algorithms, e.g. Adam and AdaGrad.
  arXiv  Detail & Related papers  (2020-10-16T17:15:39Z)
• Denoising modulo samples: k-NN regression and tightness of SDP relaxation [5.025654873456756]
  We derive a two-stage algorithm that recovers estimates of the samples $f(x_i)$ with a uniform error rate $O(fraclog nn)frac1d+2)$ holding with high probability. The estimates of the samples $f(x_i)$ can be subsequently utilized to construct an estimate of the function $f$.
  arXiv  Detail & Related papers  (2020-09-10T13:32:46Z)
• Optimal Robust Linear Regression in Nearly Linear Time [97.11565882347772]
  We study the problem of high-dimensional robust linear regression where a learner is given access to $n$ samples from the generative model $Y = langle X,w* rangle + epsilon$ We propose estimators for this problem under two settings: (i) $X$ is L4-L2 hypercontractive, $mathbbE [XXtop]$ has bounded condition number and $epsilon$ has bounded variance and (ii) $X$ is sub-Gaussian with identity second moment and $epsilon$ is
  arXiv  Detail & Related papers  (2020-07-16T06:44:44Z)
• Curse of Dimensionality on Randomized Smoothing for Certifiable Robustness [151.67113334248464]
  We show that extending the smoothing technique to defend against other attack models can be challenging. We present experimental results on CIFAR to validate our theory.
  arXiv  Detail & Related papers  (2020-02-08T22:02:14Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.