Appendix A Method Details

A.1 A Toy example In this section, we provide a toy example to walk through the tighter local Lipschitz bound calculation method in a three-layer neural network step by step. The third entry varies under perturbation. W [ ] [ 0 0 0 0 ] 0 0 = [0 0 1] 0 0 0 0 0 0 = 1 (14) 0 0 1 0 0 1 which is significantly tighter than the global Lipschitz bound obtained in Eq (13). A.2 Why not consider linear ReLU outputs? Our approach for tighter local Lipschitz bound separate ReLU outputs to two classes: constant ReLU outputs and varying ReLU outputs under perturbation.