We want to provep is a local minimum of(11), then since (11) is a convex optimization, we can prove that p is the global optimum. We consider a closed local areaB(p,δ > 0) such that for any q B(p,δ), q 0 and we can ignore the box constraint forql for l Jc. We call a local optimal solution of(11) in B(p,δ) as p . Moreover, if kp k < 1, then we can further extendp [Jc] to produce a larger inner product withv, and this contradicts the assumption. After propagating a ballB2(µ,ρ) through a ReLU layer, we can estimate the propagated outer bound with anew ballB2(µ+,ρ)whereµ+ = max(µ,0). However, the true image ReLU(B2(µ,ρ)) has no negative elements.

Roy, 2014] are not sufficient for optimal regret.

Bandits

Aweakness toexisting approaches isthattheyignore thefactthatadversarial example generation is often a sequential task where multiple similar problems are being solved in a row. That is, one has access to a large number of "normal" examples each of which should be perturbed to elicit