Antoine Gonon

Nicolas Brisebarre

Elisa Riccietti

Rémi

Rémi Gribonval

A PATH-NORM TOOLKIT FOR MODERN NETWORKS: CONSEQUENCES, PROMISES AND CHALLENGES

A path-norm toolkit for modern networks: consequences, promises and challenges

INTRODUCTION

Developing a thorough understanding of theoretical properties of neural networks is key to achieve central objectives such as efficient and trustworthy training, robustness to adversarial attacks (e.g. via Lipschitz bounds), or statistical soundness guarantees (via so-called generalization bounds).

The so-called path-norm and path-embedding are promising concepts to theoretically analyze neural networks: the path-norm has been used to derive generalization guarantees [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF][START_REF] Barron | Complexity, statistical risk, and metric entropy of deep nets using total path variation[END_REF], and the path-embedding has led for example to identifiability guarantees [START_REF] Stock | An embedding of ReLU networks and an analysis of their identifiability[END_REF] and characterizations of properties of the dynamics of training algorithms [START_REF] Marcotte | Abide by the law and follow the flow: Conservation laws for gradient flows[END_REF].

However, the current definitions of the path-norm and of the path-embedding are currently severely limited: they only cover simple models unable to combine in a single framework pooling layers, skip connections, biases, or even multi-dimensional output [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF][START_REF] Kawaguchi | Generalization in deep learning[END_REF][START_REF] Stock | An embedding of ReLU networks and an analysis of their identifiability[END_REF]. Thus, the promises of existing theoretical guarantees based on these tools are currently out of reach as they cannot even be tested on standard modern networks.

Because of the current lack of versatility of these tools, known results have only been tested on toy examples. This prevents us from both understanding the reach of these tools and from diagnosing their strengths and weaknesses, which is necessary to either improve them in order to make them actually operational, if possible, or to identify without concession the gap between theory and practice, in particular for generalization bounds.

This work adresses the challenge of making these tools fully compatible with modern networks, and to concretely assess them on standard real-world examples. First, it formalizes a definition of path-embedding (and path-norms) that is adapted to very generic ReLU networks, covering any DAG architecture (in particular with skip connections), including in the presence of max/average-pooling (and even more generally k-max-pooling, which extracts the k-th largest coordinate, recovering max-pooling for k = 1) and/or biases. This covers a wide variety of modern networks (notably ResNets, VGGs, U-nets, ReLU MobileNets, Inception nets, Alexnet) 1 , and recov- 1 The conclusion discusses networks not covered by the framework and adaptations needed to cover them.

1 Under review as a conference paper at ICLR 2024 ers previously known definitions of these tools in simpler settings such as multilayer feedforward networks.

The immediate interests of these tools are: 1) path-norms are easy to compute on modern networks via a single forward-pass; 2) path-norms are invariant under neuron permutations and parameter rescalings that leave the network invariant; and 3) the L 1 path-norm yields a Lipschitz bound of the network. These properties were known (but scattered in the literature) in the restricted case of feedforward ReLU networks primarily without biases (and without average/k-max-pooling nor skip connections) [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF][START_REF] Behnam Neyshabur | Implicit regularization in deep learning[END_REF][START_REF] Furusho | Analysis of Regularization and Optimization for Deep Learning[END_REF][START_REF] Jiang | Fantastic generalization measures and where to find them[END_REF][START_REF] Karolina Dziugaite | In search of robust measures of generalization[END_REF][START_REF] Stock | An embedding of ReLU networks and an analysis of their identifiability[END_REF]. They are generalized here for generic DAG ReLU networks with all the standard ingredients of modern networks.

Moreover, path-norms tightly lower bound products of operator norms, another complexity measure that does not enjoy the same invariances as path-norms, despite being widely used for Lipschitz bounds (e.g., to control adversarial robusteness) [START_REF] Behnam Neyshabur | A PAC-Bayesian approach to spectrally-normalized margin bounds for neural networks[END_REF][START_REF] Gonon | Approximation speed of quantized vs. unquantized ReLU neural networks and beyond[END_REF] or generalization bounds [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF][START_REF] Peter | Spectrally-normalized margin bounds for neural networks[END_REF][START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF]. This bound, which was only known for feedforward ReLU networks without biases [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF], is again generalized here to generic DAG ReLU networks. This requires a proper adaptation for such networks that are not necessarily organized into layers with associated weight matrices.

Second, this work also establishes a new generalization bound for modern ReLU networks based on their corresponding path-norm. This bound covers arbitrary output dimension (while previous work focused on scalar dimension, see Table 1), generic DAG ReLU network architectures with average/k-max-pooling, skip connections and biases. The achieved generalization bound recovers or beats the sharpest known ones of this type, that were so far only available in simpler restricted settings, see Table 1 for an overview. Among the technical ingredients used in the proof of this generalization bound, the new contraction lemmas and the new peeling argument are among the main theoretical contributions of this work. The first new contraction lemma extends the classical ones with scalar t i ∈ R, and contractions f i of the form (Ledoux & Talagrand, 1991, Theorem 4.12), with convex non-decreasing G, to situations where there are multiples independent copies indexed by z ∈ Z of the latter: E ε max z∈Z G sup t∈T z i∈I ε i,z f i,z (t i ) ⩽ E ε max z∈Z G sup t∈T z i∈I ε i,z t i . The second new contraction lemma deals with vector-valued t i ∈ R W , and functions f i that compute the k-th largest input's coordinate, to cope with k-max-pooling neurons, and it also handles multiple independent copies indexed by z ∈ Z. The most closely related lemma we could find is the vector-valued one in [START_REF] Maurer | A vector-contraction inequality for rademacher complexities[END_REF] established with a different technique, and that holds only for G = id with a single copy (|Z| = 1). The peeling argument reduces the Rademacher complexity of the entire model to the one of the inputs by getting rid (peeling), one by one, of the neurons of the model. This is inspired by the peeling argument of [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF], which is however specific to feedforward ReLU networks with layer-wise constraints on the weights. Substantial additional ingredients are developed to handle arbitrary DAG ReLU networks (as there is no longer such a thing as a layer to peel), with not only ReLU but also k-max-pooling and identity neurons (where [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF] has only ReLU neurons), and leveraging only a global constraint through the path-norm (instead of layerwise constraints on operator norms). The analysis notably makes use of the rescaling invariance of the proposed generalized path-embedding.

E ε G sup t∈T i∈I ε i f i (t i ) ⩽ E ε G sup t∈T i∈I ε i t i
The versatility of the proposed tools enables us to compute for the first time generalization bounds based on path-norm on networks really used in practice. This is the opportunity to assess the current state of the gap between theory and practice, and to diagnose possible room for improvements. As a concrete example, we demonstrate that on ResNet18 trained on ImageNet: 1) the proposed generalization bound can be numerically computed; 2) for a (dense) ResNet18 trained with standard tools, roughly 30 orders of magnitude would need to be gained for this path-norm based bound to match practically observed generalization error; 3) the same bound evaluated on a sparse ResNet18 (trained with standard sparsification techniques) is decreased by up to 13 orders of magnitude. We conclude the paper by discussing promising leads to reduce this gap.

Paper structure. Section 2 introduces the ReLU networks being considered, and generalizes to this model the central definitions and results related to the path-embedding, the path-activations and the path-norm. Section 3 state a versatile generalization bound for such networks based on path-norm, and sketches its proof. Section 4 reports numerical experiments on ImageNet and ResNets. Related works are discussed along the way, and we refer to Appendix J for more details.

Table 1: Generalization bounds (up to universal multiplicative constants) for a ReLU network estimator in Θ learned from n iid training points when 1) the loss ŷ ∈ (R dout , ∥ • ∥ 2 ) → ℓ(ŷ, y) ∈ R is L-Lipschitz for every y, and 2) inputs are bounded in L ∞ -norm by B ⩾ 1. Here, d in /d out = input/output dimension, K = the maximum kernel size of the * -max-pooling neurons, M d = matrix of layer d for a feedforward network (FFN), D = depth. Note that r is more desirable than R since r ⩽ R (Theorem B.1 in appendix) and R can be arbitrarly large when r = 0 (Figure 2 in appendix). This is because R decouples the layers without taking into account rescaling invariances.

Architecture

Parameter set Θ Generalization bound (Kakade et al., 2008, Eq. ( 5)) (Bach,Sec. 4.5.3) linear regression (FFN, 0 hidden layer, dout = 1) et al., 2022, Thm. 6) [START_REF] Francis | Breaking the curse of dimensionality with convex neural networks[END_REF] FFN, no biases, dout = 1

∥θ∥1 = ∥Φ(θ)∥1 ⩽ r LB √ n × r log(d in ) (E
D d=1 ∥M d ∥1,∞ ⩽ R LB √ n × R D + log(d in ) (Barron & Klusowski, 2019, Corollary 2) FFN, no biases, dout = 1 ∥Φ(θ)∥1 ⩽ r LB √ n × r D + log(d in )
Here, Theorem 3.1 DAG, with biases, arbitrary dout, with ReLU, identity and k-max-pooling neurons for k ∈ {k1, . . . , kP } ⊂ N>0

∥Φ(θ)∥1 ⩽ r LB √ n × r D log(P K) + log(d in d out )
2 RELU MODEL AND PATH-EMBEDDING Section 2.1 defines a general DAG ReLU model that covers modern architectures. Section 2.2 then introduces the so-called path-norm and extends related known results to this general model.

RELU MODEL THAT COVERS MODERN NETWORKS

The next definition introduces the model of ReLU neural networks being considered here. Definition 2.1 (ReLU neural network). A ReLU neural network architecture is a DAG G = (N, E, (ρ v ) v∈N ) with edges E, and vertices N (called neurons) such that each neuron v has an attribute ρ v ∈ {id, ReLU} ∪ {k-pool, k ∈ N >0 } that corresponds to the activation function of v (identity, ReLU, or k-max-pooling where k-pool(x) = x (k) is the k-th largest coordinate of x), with ρ v = id enforced whenever v has no successor. For a neuron v, the sets ant(v), suc(v) of antecedents and successors of v are ant

(v) = {u ∈ N, u → v ∈ E}, suc(v) = {u ∈ N, v → u ∈ E}.
Neurons with no antecedents (resp. no successors) are called input (resp. output) neurons, and their set is denoted N in (resp. N out ). Input and output dimensions are respectively

d in = |N in | and d out = |N out |. Denote N ρ = {v ∈ V, ρ v =
ρ} for an activation ρ, and denote also

N * -pool = ∪ k∈N>0 N k-pool . A neuron in N * -pool is called a * -max-pooling neuron. For v ∈ N * -pool , its kernel size is defined as being | ant(v)|.
Parameters associated with this architecture are vectors2 θ ∈ R E∪N \(Nin∪N * -pool) (no biases on input neurons and * -max-pooling neurons). We call bias and denote b v = θ v the coordinate associated with a neuron v, and denote θ u→v the weight associated with an edge u → v ∈ E. We often denote θ →v = (θ u→v ) u∈ant(v) and θ v→ = (θ u→v ) u∈suc (v) .

In what follows, the symbol v can either denote a neuron v ∈ N or the function associated to this neuron. The function R G θ : R Nin → R Nout (simply denoted R θ when G is clear from the context) realized by parameters θ is defined for every input x ∈ R Nin as

R θ (x) := (v(θ, x)) v∈Nout ,
where v(θ, x) is defined as v(θ, x) := x v for an input neuron v, and defined by induction otherwise

v(θ, x) := ρ v (b v + u∈ant(v) θ u→v u(θ, x)) if ρ v = ReLU or ρ v = id, k-pool (θ u→v u(θ, x)) u∈ant(v) otherwise when ρ v = k-pool.
Such a model indeed encompasses modern networks via the following implementations:

• Max-pooling: set ρ v = k-pool for k = 1 and θ u→v = 1 for every u ∈ ant(v).

• Average-pooling:

set ρ v = id, b v = 0 and θ u→v = 1/| ant(v)| for every u ∈ ant(v).
• GroupSort: use identity neurons to compute the pre-activations, group neurons using the DAG structure and sort them using * -max-pooling neurons, as prescribed in [START_REF] Anil | Sorting out Lipschitz function approximation[END_REF].

• Batch normalization: set ρ v = id and weights accordingly. Batch normalization layers only differ from standard affine layers by the way their parameters are updated during training.

• Skip connections: via the DAG structure, the outputs of any past layers can be added to the preactivation of any neuron by adding connections from these layers to the given neuron.

• Convolutional layers: consider them as (doubly) circulant/Toeplitz fully connected layers.

PATH-EMBEDDING, PATH-ACTIVATIONS AND PATH-NORM

Given a general DAG ReLU network G as in Definition 2.1, it is possible to define a set of paths P G , a path-embedding Φ G and path-activations A G , see Definition A.1 in the supplementary. The L q path-norm is then ∥Φ G (θ)∥ q . Superscript G is omitted when obvious from context. The interest is that path-norm, which is easy to compute, can be interpreted as a Lipschitz bound of the network which is tighter than products of operator norms. We give here a high-level overview of the definitions and properties, and refer to Appendix A for formal definitions, proofs and technical details.

We highlight that the definitions and properties coincide with previously known ones in classical simpler settings.

Path-embedding and path-activations: fundamental properties. The path-embedding Φ and the path-activations A are defined to ensure the next fundamental properties: 1) for each parameter θ, the path-embedding Φ(θ) ∈ R P is independent of the inputs x, and polynomial in the parameters θ in a way that it is invariant under all neuron-wise rescaling symmetries3 ; 2)

A(θ, x) ∈ R P×(din+1)
takes a finite number of values and is piece-wise constant as a function of (θ, x); and 3) denoting Φ →v and A →v to be the same objects but associated with the graph deduced from G by keeping only the largest subgraph of G with the same inputs as G and with single output v, then the output of every neuron v can be written as

v(θ, x) = Φ →v (θ), A →v (θ, x) x 1 . (1)
Compared to previous definitions given in simpler models (no k-max-pooling even for a single given k, no skip connections, no biases, one-dimensional output and/or layered network) [START_REF] Kawaguchi | Generalization in deep learning[END_REF][START_REF] Stock | An embedding of ReLU networks and an analysis of their identifiability[END_REF], the main novelty is essentially to properly define the pathactivations A(θ, x) in the presence of * -max-pooling neurons: when going through a k-max-pooling neuron, a path stays active only if the previous neuron of the path is the first in lexicographic order to be the k-th largest input of this pooling neuron.

Path-norm is easy to compute. It is mentioned in (Dziugaite et al., 2020, Appendix C.6.5) and (Jiang et al., 2020, Equation (44)) (without proof) that for ReLU feedforward networks without biases, the L 2 path-norm can be computed in a single forward pass with the formula:

∥Φ G (θ)∥ 2 = ∥R G |θ| 2 (1)∥ 1
, where |θ| 2 is the vector θ with x → x 2 applied coordinate-wise (bias included) and where 1 is the constant input equal to one. This can be proved in a straightforward way, using Equation (1), and even extended to an arbitrary exponent q ∈ [1, ∞]: ∥Φ G (θ)∥ q q = ∥R G |θ| q (1)∥ 1 . However, Appendix A shows that this formula is false as soon as there is at least one * -max-pooling neuron, and that easy computation remains possible by first replacing the activation function of *max-pooling neurons with the identity before doing the forward pass. Average-pooling neurons also need to be explicitly modeled as described after Definition 2.1, to apply x → x q to their weights.

L 1 path-norm yields a Lipschitz bound. Equation ( 1) is fundamental to understand the role of the path-norm. It shows that Φ contains information about the slopes of the function realized by the network on each of the regions where A is constant. A formal result that goes in this direction is the Lipschitz bound ∥R

θ (x) -R θ (x ′ )∥ 1 ⩽ ∥Φ(θ)∥ 1 ∥x -x ′ ∥ ∞ ,
already known in the case of ReLU feedforward networks (Neyshabur, 2017, before Section 3.4) (Furusho, 2020, Theorem 5), and generalized to the more general case of Definition 2.1 in Appendix A. This allows to leverage generic generalization bounds that apply to the set of all r-Lipschitz functions f : [0, 1] din → [0, 1], however these bounds suffer from the curse of dimensionality [START_REF] Von | Distance-based classification with Lipschitz functions[END_REF], unlike the bounds established in Section 3.

Path-norms tightly lower bound products of operators' norms. For models of the form R θ (x) = M D ReLU(M D-1 . . . ReLU(M 1 x)), i.e. ReLU feedforward neural networks with matrices M 1 , . . . , M D and no biases, products such as D d=1 ∥M d ∥ q,∞ , where ∥M ∥ q,∞ is the maximum L q norm of a row of matrix M , can be used for q = 1, to bound the Lipschitz constant of the network [START_REF] Behnam Neyshabur | A PAC-Bayesian approach to spectrally-normalized margin bounds for neural networks[END_REF][START_REF] Gonon | Approximation speed of quantized vs. unquantized ReLU neural networks and beyond[END_REF] and to establish generalization bounds [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF][START_REF] Peter | Spectrally-normalized margin bounds for neural networks[END_REF][START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF]. So which one of path-norm and products of operator norms should be used? There are at least three reasons to consider the path-norm. First, it holds ∥Φ(θ)∥ q ⩽ D d=1 ∥M d ∥ q,∞ , with equality if the parameters are properly rescaled. This is known for simple feedforward networks without biases (Neyshabur et al., 2015, Theorem 5). Appendix A generalizes it to DAGs as in Definition 2.1. The difficulty is to define the equivalent of the product of operators' norms with an arbitrary DAG and in the presence of biases. Apart from that, the proof is essentially the same as in [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF], with a similar rescaling that leads to equality of both measures, see Algorithm 1. Second, there are cases where the product of operators' norms is arbitrarily large while the path-norm is zero (see Figure 2 in Appendix B). Thus, it is not desirable to have a generalization bound that depends on this product of operators' norms since, compared to the path-norm, it fails to capture the complexity of the network end-to-end by decoupling the layers of neurons one from each other. Third, it has been empirically observed that products of operators' norms negatively correlate with the empirical generalization error while the path-norm positively correlates (Jiang et al., 2020, Table 2)(Dziugaite et al., 2020, Figure 1).

GENERALIZATION BOUND

The generalization bound of this section is based on path-norm for general DAG ReLU network. It encompasses modern networks, recovers or beats the sharpest known bounds of this type, and applies to the cross-entropy loss. The top-one accuracy loss is not directly covered, but can be controlled via a bound on the margin-loss, as detailed at the end of this section.

MAIN RESULT

To state the main result let us recall the definition of the generalization error.

Definition 3.1. Consider d in , d out ∈ N >0 , n ∈ N >0 iid random variables Z i = (X i , Y i ) ∈ R din × R dout
and an iid copy Z1 of Z 1 . Consider a function ℓ : R dout × R dout → R. The ℓ-generalization error of any estimator θ(Z) ∈ Θ is defined as:

ℓ-generalization error of θ(Z) := E Z1 ℓ R θ(Z) ( X1 ), Ỹ1 |Z 1 , . . . , Z n test error when trained on Z - 1 n n i=1 ℓ R θ(Z) (X i ), Y i
training error when trained on Z

.

For simplicity, we state the result in the case without biases before explaining how it adapts in the general case (note that the proof is directly given in the general case). Theorem 3.1. Consider d in , d out ∈ N >0 and n ∈ N >0 iid random variables

Z i = (X i , Y i ) ∈ R din × R dout . Define σ := E X max u=1,...,din n i=1 (X i ) 2 u 1/2
× R dout → R such that ℓ(ŷ 1 , y) -ℓ(ŷ 2 , y) ⩽ L∥ŷ 1 -ŷ2 ∥ 2 , ∀y, ŷ1 , ŷ2 ∈ support(Y 1 ). (2)
for some L > 0. Consider a set of parameters Θ. Then4 for any estimator θ : Z → θ(Z) ∈ Θ:

E Z ℓ-generalization error of θ(Z) ⩽ 4σ n LC sup θ∈Θ ∥Φ(θ)∥ 1
with (log being the natural logarithm)

C := D log((3 + 2P )K) + log( 3 + 2P 1 + P d in d out ) 1/2
.

Any neural network with biases can be transformed into an equivalent network (with same pathnorm and same associated function) by removing biases, adding an input neuron with constant input equal to one, and by adding edges between this input neuron and every neuron that had a bias, turning the bias into a parameter of this edge. With biases, one thus should replace d in by d in + 1 in the definition of C, and there is now a constant input equal to one in the definition of σ so that

σ = E X max n, max u=1,...,din n i=1 (X i ) 2 u 1/2 ⩾ √ n.
Theorem 3.1 applies to the cross-entropy loss with L = √ 2 (see Appendix F) if the labels y are one-hot encodings5 . A final softmax layer can be incorporated for free to the model by putting it in the loss. This does not change the bound since it is 1-Lipschitz with respect to the L 2 -norm (this is a simple consequence of the computations made in Appendix F).

On ImageNet, it holds 1/ √ n ⩽ σ/n ⩽ 2.6/ √ n (Section 4). This yields a bounds that decays in O(n -1/2 ) which is better than the generic O(n -1/din ) generalization bound for Lipschitz functions (von Luxburg & Bousquet, 2004, Thm. 18) that suffer from the curse of dimensionality. Besides its wider range of applicability, this bounds also recovers or beats the sharpest known ones based on path-norm, see Table 1.

Finally, note that Theorem 3.1 can be tightened: the same bound holds without counting the identity neurons when computing D. Indeed, for any neural network and parameters θ, it is possible to remove all the neurons v ∈ N id by adding a new edge u → w for any u ∈ ant(v), w ∈ suc(v) with new parameter θ u→v θ v→w (if this edge already exists, just add the latter to its already existing parameter). This still realizes the same function, with the same path-norm, but with less neurons, and thus with D possibly decreased. The proof technique would also yield a tighter bound but not by much: the occurences of 3 in C would be replaced by 2.

Sketch of proof for Theorem 3.1. The proof idea is explained below. Details are in Appendix E.

Already known ingredients. Classical arguments (Shalev-Shwartz & Ben-David, 2014, Theorem 26.3) [START_REF] Maurer | A vector-contraction inequality for rademacher complexities[END_REF], that are valid for any model, bound the expected generalization error by the Rademacher complexity of the model. It then remains to bound the latter, and this gets specific to neural networks. In the case of a feedforward ReLU neural network with no biases and scalar output (and no skip connections nor k-max-pooling even for a single given k), [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF] proved that it is possible to bound this Rademacher complexity with no exponential factor in the depth, by peeling, one by one, each layer off the Rademacher complexity. To get more specific, for a class of functions F and a function

Ψ : R → R, denote Rad •Ψ(F ) = E ε Ψ(sup f ∈F n i=1 ε i f (x i ))
the Rademacher complexity of F associated with n inputs x i and Ψ, where the ε i are iid Rademacher variables (ε i = 1 or -1 with equal probability). The goal for a generalization bound is to bound this in the case Ψ(x) = id(x) = x. In the specific case where F D is the class of functions that correspond to ReLU feedforward networks with depth D, assuming that some operator norm of each layer d is bounded by r d , then [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF] basically guarantees Rad •Ψ λ (F D ) ⩽ 2 Rad •Ψ λr D (F D-1 ) for every λ > 0, where Ψ λ (x) = exp(λx). Compared to previous works of [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF] that were directly working with Ψ = id instead of Ψ λ , the important point is that working with Ψ λ gets the 2 outside of the exponential. Iterating over the depth D, optimizing over λ, and taking a logarithm at the end yields (by Jensen's inequality) a bound on Rad • id(F D ) with a dependence on D that grows as D log(2) instead of 2 D for previous approaches.

Novelties for general DAG ReLU networks. Compared to the setup of [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF], there are at least three difficulties to do something similar here. First, the neurons are not organized in layers as the model can be an arbitrary DAG. So what should be peeled off one by one? Second, the neurons are not necessarily ReLU neurons as their activation function might be the identity (average-pooling) or * -max-pooling. Finally, [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF] has a constraint on the weights of each layer, which makes it possible to pop out the constant r d when layer d is peeled off. Here, the only constraint is global, since it constrains the paths of the network through ∥Φ(θ)∥ 1 ⩽ r. In particular, due to rescalings, the weights of a given neuron could be arbitrarily large or small under this constraint.

The first difficulty is primarily addressed using a new peeling lemma (Appendix D) that exploits a new contraction lemma (Appendix C). The second difficulty is resolved by splitting the ReLU, k-max-pooling and identity neurons in different groups before each peeling step. This makes the log(2) term in [START_REF] Golowich | Size-independent sample complexity of neural networks[END_REF] a log(3 + 2P ) term here (P being the number of different k's for which k-max-pooling neurons are considered). Finally, the third obstacle is overcome by rescaling the parameters to normalize the vector of incoming weights of each neuron. This type of rescaling has also been used in [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF][START_REF] Barron | Complexity, statistical risk, and metric entropy of deep nets using total path variation[END_REF].

Remark 3.1 (Improved bound with assumptions on * -max-pooling neurons). In the specific case where there is a single type of k-max-pooling neurons (P = 1), assuming that these k-max-pooling neurons are grouped in layers, and that there are no skip connections going over these k-max-pooling layers (satisfied by ResNets, not satisfied by U-nets), then a sharpened peeling argument can yield the same bound but with C replaced by

C sharpened = (D log(3) + M log(K) + log((d in + 1)d out ))
1/2 with M being the number of k-max-pooling layers (cf. Appendix D). The details are tedious so we only mention this result without proof. This basically improves D log(5K) into D log(3) + M log(K). For Resnet152, K = 9, D = 152 and M = 1, D log(5K) ≃ 24 while D log(3) + M log(K) ≃ 13.

HOW TO DEAL WITH THE TOP-1 ACCURACY LOSS?

Theorem 3.1 does not apply to the top-1 accuracy loss as Equation (2) cannot be satisfied for any finite L > 0 in general (see Appendix G). It is still possible to bound the expected (test) top-1 accuracy by the so-called margin loss achieved at training (Bartlett et al., 2017, Lemma A.4). The margin-loss is a relaxed definition of the top-1 accuracy loss. A corollary of Theorem 3.1 is the next result proved in Appendix H. Theorem 3.2 (Bound on the probability of misclassification). Consider the setting of Theorem 3.1. Assume that the labels are indices y ∈ {1, . . . , d out }. For any γ > 0, it holds

P arg max c R θ (X 1 ) c ̸ = Y 1 ⩽ 1 n n i=1 1 (R θ(Z) (Xi)) Y i ⩽γ+max c̸ =Y i (R θ(Z) (Xi))c + 8σ n C sup θ ∥Φ(θ)∥ 1 γ .
(3)

Note that the result is homogeneous: scaling both the outputs of the model and γ by the same scalar leaves the classifier and the corresponding bound unchanged.

EXPERIMENTS

Theorem 3.1 gives the first path-norm generalization bound that can be applied to modern networks (with average/ * -max-pooling, skip connections etc.). This bound is also the sharpest known bound of this type (Table 1). Since this bound is also easy to compute, the goal of this section is to numerically challenge for the first time the sharpest generalization bounds based on path-norm on modern networks. Note also that path-norms tightly lower bound products of operator norms (Appendix B) so that this also challenges the latter.

When would be the bound informative? For ResNets trained on ImageNet, the training error associated with cross-entropy is typically between 1 and 2, and the top-1 training error is typically less than 0.30. The same orders of magnitude apply to the empirical generalization error. To ensure that the test error (either for cross-entropy or top-1 accuracy) is of the same order as the training error, the bound should basically be of order 1.

For parameters θ learned from training data, Theorem 3.1 and Theorem 3.2 allow to bound the expected loss in terms of a performance measure (that depends on a free choice of γ > 0 for the top-1 accuracy) on training data plus a term bounded by 4σ n C ×L×∥Φ(θ)∥ 1 . The Lipschitz constant L is √ 2 for cross-entropy, and 2/γ for the top-1 accuracy.

Evaluation of 4σ

n C for ResNets on ImageNet. We further bound σ/n by B/ √ n, where B ≃ 2.6 is the maximum L ∞ -norm of the images of ImageNet normalized for inference. We at most lose a factor B compared to the bound directly involving σ since it also holds σ/n ⩾ 1/ √ n by definition of σ. We train on 99% of ImageNet so that n = 1268355. Moreover, recall that C =

D log((3 + 2P )K) + log( 3+2P 1+P (d in + 1)d out ) 1/2
. For ResNets, there is a single type of * -maxpooling neurons (classical max-pooling neurons corresponding to k-max-pooling with k = 1) so that P = 1, the kernel size is K = 9, d in = 224 × 224 × 3 and d out = 1000. The depth is D = 2 + # basic blocks×# conv per basic block, with the different values available in Appendix I. The values for 4BC/ √ n are reported in Table 2. Given these results and the values of the Lipschitz constant L then, on ResNet18, the bound would be informative only when ∥Φ(θ)∥ 1 ≲ 10 or ∥Φ(θ)∥ 1 /γ ≲ 10 respectively for the cross-entropy and the top-1 accuracy. We now compute the path-norms of trained ResNets, both dense and sparse, using the simple formula proved in Theorem A.1 in appendix.

L 1 -path-norm of pretrained ResNets are 30 orders of magnitude too large. Table 3 shows that the L 1 path-norm is 30 orders of magnitude too large to make the bound informative for the crossentropy loss. The choice of γ is discussed in Appendix I, where we observe that there is no possible choice that leads to an informative bound for top-1 accuracy in this situation.

(θ)∥ 1 1.3 × 10 30 overflow overflow overflow overflow ∥Φ(θ)∥ 2 2.5 × 10 2 1.1 × 10 2 2.0 × 10 8
2.9 × 10 9 8.9 × 10 10 ∥Φ(θ)∥ 4 7.2 × 10 -6 4.9 × 10 -6 6.7 × 10 -4 3.0 × 10 -4 1.5 × 10 -4

Sparse ResNets can decrease the bounds by 13 orders of magnitude. We have just seen that pretrained ResNets have very large L 1 path-norm. Does every network with a good test top-1 accuracy have a path-norm as large as this? Since any zero in the parameters θ leads to many zero coordinates in Φ(θ), we now investigate whether sparse versions of ResNet18 trained on ImageNet have a smaller path-norm. Sparse networks are obtained with iterative magnitude pruning plus rewinding, with hyperparameters similar to the one in (Frankle et al., 2021, Appendix A.3). Results show that the L 1 path-norm decreases from ≃ 10 30 for the dense network to ≃ 10 17 after 19 pruning iterations, basically losing between a half and one order of magnitude per pruning iteration. Moreover, the test top-1 accuracy is better than with the dense network for the first 11 pruning iterations, and after 19 iterations, the test top-1 accuracy is still way better than what would be obtained by guessing at random, so this is still a non-trivial matter to bound the generalization error for the last iteration. Details are in Appendix I. This shows that there are indeed practically trainable networks with much smaller L 1 path-norm that perform well. It remains open whether alternative training techniques, possibly with path-norm regularization, could lead to networks combining good performance and informative generalization bounds.

Additional observations: increasing the depth and the train size. In practice, increasing the size of the network (i.e. the number of parameters) or the number of training samples can improve generalization. We can, again, assess for the first time whether the bounds based on path-norms follows the same trend for standard modern networks. Table 3 shows that path-norms of pretrained ResNets available on PyTorch roughly increase with depth. This is complementary to (Dziugaite et al., 2020, Figure 1) where it is empirically observed on simple feedforward models that pathnorm has difficulty to correlate positively with the generalization error when the depth evolves. For increasing training sizes, we did not observe a clear trend for the L 1 path-norm, which seems to mildly evolve with the number of epochs rather than with the train size, see Appendix I for details.

CONCLUSION

Contribution. To the best of our knowledge, this work is the first to introduce path-norm related tools for general DAG ReLU networks (with average/ * -max-pooling, skip connections), and Theorem 3.1 is the first generalization bound valid for such networks based on path-norm. This bound recovers or beats the sharpest known ones of the same type. Its ease of computation leads to the first experiments on modern networks that assess the promises of such approaches. A gap between theory and practice is observed for a dense version of ResNet18 trained with standard tools: the bound is 30 orders of magnitude too large on ImageNet.

Possible leads to close the gap between theory and practice. 1) Without changing the bound of Theorem 3.1, sparsity seems promising to reduce the path-norm by several orders of magnitude without changing the performance of the network. 2) Theorem 3.1 results from the worst situation (that can be met) where all the inputs activate all the paths of the network simultaneously. Bounds involving the expected path-activations could be tighter. The coordinates of Φ(θ) are elementary bricks that can be summed to get the slopes of R θ on the different region where R θ is affine [START_REF] Arora | Understanding deep neural networks with rectified linear units[END_REF], ∥Φ(θ)∥ 1 is the sum of all the bricks in absolue value, resulting in a worst-case uniform bound for all the slopes. Ideally, the bound should rather depend on the expected slopes over the different regions, weighted by the probability of falling into these regions. 3) Weight sharing may leave room for sharpened analysis [START_REF] Pitas | Some limitations of norm based generalization bounds in deep neural networks[END_REF][START_REF] Galanti | Norm-based generalization bounds for compositionally sparse neural networks[END_REF]. 4) A k-max-pooling neuron with kernel size K only activates 1/K of the paths, but the bound sums the coordinates of Φ related to these K paths. This may lead to a bound K times too large in general (or even more in the presence of multiple maxpooling layers). 5) Possible bounds involving the L q path-norm for q > 1 deserve a particular attention, since numerical evaluations show that they are several orders of magnitude below the L 1 norm.

Extensions to other architectures. Despite its applicability to a wide range of standard modern networks, the generalization bound in Theorem 3.1 does not cover networks with other activations than ReLU, identity, and * -max-pooling. The same proof technique could be extended to new activations 1) that are positively homogeneous so that the weights can be rescaled without changing the associated function, and 2) that satisfy a contraction lemma similar to the one established here for ReLU and max neurons (typically requiring the activation to be Lipschitz

Φ p (θ) = b v1 d-1 i=1 θ vi→vi+1 ,
where, for practical purposes, we extended θ to input neurons v by setting b v = 1, and to * -max-

pooling neurons v by setting b v = 0. The path-embedding Φ G (θ) of θ is Φ G (θ) = (Φ p (θ)) p∈P G .
This is often denoted Φ when the graph G is clear from the context. Morever, given a neuron v of G, we often denote Φ →v to be the path-embedding associated with the graph deduce from G by keeping only the largest subgraph with the same inputs as G and with v as a single output: every neuron that cannot reach v through the edges of G is removed as well as all its incoming and outcoming edges.

Consider an input x of G. Say that a path p = v 1 → • • • → v d is active on input x and parameters θ, and denote a p (θ, x) = 1, if for every ReLU neuron v along p, it holds v(θ, x) ⩾ 0, and if for every k ∈ N >0 and every k-max-pooling neuron v i along p, the neuron v i-1 is the first in ant(v i ) in lexicographic order to satisfy v i-1 (θ, x) = k-pool (v(θ, x)) v∈ant(vi) . Otherwise, denote a p (θ, x) = 0. Consider a new symbol b (for bias) that is not used for denoting neurons. The path-activations matrix A(θ, x) is defined as the matrix in R P×Nin such that for any path p ∈ P and neuron u ∈ N in

(A(θ, x)) p,u = a p (θ, x)1 p starts at u if u ∈ N in , a p (θ, x) otherwise when u = b.
The next lemma shows how the path-embedding and the path-activations are an equivalent way to define the model. The proof is at the end of the section.

Lemma A.1. Consider a model as in Definition 2.1. Then for every neuron v, every input x and every parameters θ:

v(θ, x) = Φ →v (θ), A →v (θ, x) x 1 .
Proof of Lemma A.1. For any neuron v, denote P →v the set of paths ending at neuron v. We want to prove that for any neuron v:

v(θ, x) = Φ →v (θ), A →v (θ, x) x 1 = p∈P →v Φ p (θ)a p (θ, x)x p0 .
where we denote in the proof x u = 1 for any u which is not an input neuron, and where p 0 denotes the first neuron of a path p. This is true by convention for input neurons v. Indeed, considering the

path p = v, it holds Φ p (θ) = b v = 1, a p (θ, x) = 1 and v(θ, x) = x v = x.
Consider now v which is not an input neuron and assume that this is true for every neuron u ∈ ant(v). If v is an identity neuron or a ReLU neuron, then

v(θ, x) = ρ v   b v + u∈ant(v) θ u→v u(θ, x)   = ρ v   b v + u∈ant(v) θ u→v p∈P →u Φ p (θ)a p (θ, x)x p0   .
using the assumption on the antecedents of v. For a path p = p → v with p ∈ P →u , it holds

x p0 = x p0 , Φ p(θ) = θ u→v Φ p (θ) and b v = Φ p (θ)
x p0 for the path p = v. The latter is indeed true because Φ p (θ) = b v and x p0 = 1 by convention since v is not an input neuron.

If v is an identity neuron, then a p(θ, x) = a p (θ, x) and a v (θ, x) = 1. Since

P →v = {v} ∪   u∈ant(v) {p → v, p ∈ P →u }   ,
this yields the result in the case of an identity neuron v. If v is a ReLU neuron, then

a p(θ, x) = a p (θ, x)1 v(θ,x)⩾0
and for the path p = v, it holds a p (θ, x) = 1 v(θ,x)⩾0 so that once again the result holds true:

v(θ, x) = ρ v   b v + u∈ant(v) θ u→v p∈P →u Φ p (θ)a p (θ, x)x p0   = 1 v(θ,x)⩾0   b v + u∈ant(v) p∈P →u θ u→v Φ p (θ)a p (θ, x)x p0   = p∈P →v Φ p (θ)a p (θ, x)x p0 . If v is a k-max-pooling neuron for some k ∈ N >0 , then v(θ, x) = k-pool (θ u→v u(θ, x)) u∈ant(v) = k-pool      θ u→v p∈P →u Φ p (θ)a p (θ, x)x p0   u∈ant(v)   
with ties decided by lexicographic order. Since for any p = p → v with p ∈ P →u , it holds

a p(θ, x) = a p (θ, x)1 u realizes k-pool in lexicographic order for (θ,x)
thus once again the claim holds for v. This proves the result.

A straightforward consequence of Lemma A.1 is the Lipschitz bound

∥R θ (x) -R θ (x ′ )∥ 1 ⩽ ∥Φ(θ)∥ 1 ∥x -x ′ ∥ ∞ .
This fact is already mentioned in the case of feedforward neural networks without biases in (Neyshabur, 2017, before Section 3.4), and proven in (Furusho, 2020, Theorem 5). Proof of the Lipschitz property. Consider parameters θ. Consider inputs x, x ′ with the same pathactivations with respect to θ: A(θ, x) = A(θ, x ′ ). Then:

∥R θ (x) -R θ (x ′ )∥ 1 = Lemma A.1 v∈Nout Φ →v (θ), A →v (θ, x) x 1 -A →v (θ, x ′ ) x ′ 1 ⩽ Hölder v∈Nout ∥Φ →v (θ)∥ 1 A →v (θ, x) x 1 -A →v (θ, x ′ ) x ′ 1 ∞ ⩽ A(θ,x)=A(θ,x ′ ) v∈Nout ∥Φ →v (θ)∥ 1 A →v (θ, x) x 1 - x ′ 1 ∞ ⩽ ∥A →v (θ,x)y∥∞⩽∥y∥∞ v∈Nout ∥Φ →v (θ)∥ 1 ∥x -x ′ ∥ ∞ = ∥Φ(θ)∥ 1 ∥x -x ′ ∥ ∞ .
We just proved the claim locally on each region where the path-activations A(θ, •) are constant. This stays true on the boundary of these regions by continuity. It then expands to the whole domain by triangular inequality because between any pair of inputs, there is a finite number of times when the region changes.

Another straightforward but important consequence of Lemma A.1 is that the path-norm (the norm of the path-embedding) can be computed in a single forward pass, up to replacing * -max-pooling neurons with linear ones.

Theorem A.1. Consider an architecture G as in Definition 2.1. Define G to be the same as G except for * -max-pooling neurons for which their activation function is replaced by the identity. Consider an exponent q ∈ [1, ∞) and arbitrary parameters θ associated with G. Denote θ the parameters associated with G, obtained from θ by setting to zero the new coordinates in θ associated with the biases of the new identity neurons that come from * -max-pooling neurons of G. Denote | θ| q the vector deduced from θ by applying x → |x| q coordinate-wise, and by 1 the input full of ones. Then

∥Φ(θ)∥ q q = ∥ R G | θ| q (1)∥ 1 . (4)
Moreover, the formula is false in general if the * -max-pooling neurons have not been replaced with identity ones (i.e. if the forward pass is done on G rather than G).

Proof of Theorem A.1. Figure 1 shows that Equation ( 4) is false if the * -max-pooling neurons have not been replaced with identity ones as the forward pass yields 1 while the path-norm is 2.

We now establish Equation (4). Denote P →v the set of paths of G ending at a given neuron v.

Denote by Φ G and a G the path-embedding and the path-activations associated with G. According to Lemma A.1, it holds for every output neuron of

G (R G | θ| q (x)) v = p∈P →v Φ G p (| θ| q )a G p (| θ| q , x)x p0 .
Since G has only identity or ReLU neurons, and since the parameters | θ| q are non-negative, then for every input x with non-negative coordinates, a simple induction on the neurons shows that for every neuron u, it holds u(| θ| q , x) ⩾ 0.

Thus, every path p ∈ P G is active (recall that P G is by definition the set of paths of G), meaning that a G p (| θ| q , x) = 1 for every path p ∈ P G and every non-negative input x. Moreover,

Φ G p (| θ| q ) = bp0 u→v∈p θu→v q = |Φ G p ( θ)| q . Note that for every p ∈ P G ⊂ P G, it holds Φ G p ( θ) = Φ G p (θ). For p ∈ P G \ P G , it holds Φ G p ( θ)
= 0 since such a path must start at a linear neuron that come from a * -max-pooling neuron of G, for which bp0 has been set to zero. At the end, we get:

∥ R G | θ| q (1)∥ 1 = p∈P G |Φ G p ( θ)| q = p∈P G |Φ G p (θ)| q = ∥Φ( θ)∥ q q .
B RELATION BETWEEN PATH-NORMS AND PRODUCTS OF OPERATORS' NORMS Feedforward ReLU networks.

For simple models of the form

R θ (x) = M D ReLU(M D-1 . . . ReLU(M 1 x)), it is known that ∥Φ(θ)∥ q ⩽ D d=1 ∥M d ∥ q,∞
(where ∥M ∥ q,∞ is the maximum L q norm of a row of matrix M ) (Neyshabur et al., 2015, Theorem 5). Theorem B.1 below generalizes this result to the case of an arbitrary DAG (that may include max pooling, average-pooling, skip connections) with biases. The rescaling of θ that makes it an equality without changing R θ is given by Algorithm 1.

Algorithm 1. Algorithm 1 rescales θ while preserving R θ because for any neuron u / ∈ N in ∪ N out , the activation function ρ u is positively homogeneous: ρ u (λx) = λρ u (x) for every λ > 0. Thus, λρ u ( 1 λ x) = ρ u (x). Let us also give some more remarks about this algorithm, which is used here for the case of equality, and in the proof of the generalization bound. The first line of the algorithm considers a topological sorting of the neurons, i.e. an order on the neurons such that if u → v is an edge then u comes before v in this ordering. Such an order always exists (and it can be computed in linear time). Moreover, note that a classical max-pooling neuron v (corresponding to a k-maxpooling neurone with k = 1 and constant incoming weights all equal to one) has not anymore its incoming weights equal to one after rescaling, in general. This has no incidence on the validity of the generalization bound on classical max-pooling neurons: rescaling is only used in the proof to reduce to another representation of the parameters that realize the same function and that is more handy to work with.

Algorithm 1 Normalization of parameters for norm q ∈ [1, ∞)

1: Consider a topological sorting v 1 , . . . , v k of the neurons 2: for v = v 1 , . . . , v k do 3: if v / ∈ N in ∪ N out then 4: λ v = ∥θ →v ∥ q q + |b v | q 1/q 5: if λ v = 0 then 6: θ v→ = 0 7: else 8: θ →v ← 1 λv × θ →v ▷ normalize incoming weights 9: b v ← 1 λv × b v ▷ normalize bias 10: θ v→ ← λ v × θ v→
▷ rescale outgoing weights to preserve the function R θ

Coming back to the comparison between the path-norm and the product of operators' norms, first, we introduce an equivalent of the product of operators' norms when neurons are not regrouped in layers. Note that for the simple feedforward model as above, it holds

D d=1 ∥M d ∥ q,∞ = maxu0→•••→uD, u0∈Nin D d=1 ∥θ →u d ∥ q .
Indeed, all the neurons of two consecutive layers are connected, so the product of the maximum of L q -norms over layers is also the maximum over all paths of the product of L q -norms.

General DAG ReLU network. Consider now the case of a general DAG ReLU network. For practical purposes, we extend the parameters θ to input neurons v by setting b v = 1 and to * -maxpooling neurons by setting b v = 0. Consider for every path

u 0 → • • • → u D the quantity Π q (u 0 → • • • → u D ) := D d=0 |b u d | q D k=d+1 ∥θ →u k ∥ q q 1/q
, with the convention that an empty product is equal to one. Note that when there are no biases, it holds

Π q (u 0 → • • • → u D ) = D d=1 ∥θ →u d ∥ q ,
and taking the maximum of this product over all paths

u 0 → • • • → u D recovers D d=1 ∥M d ∥ q,∞ .
The next theorem shows that the L q path-norm is the minimum of this complexity measure over all possible rescalings of the parameters θ that leave invariant the associated function R θ . Theorem B.1. For every parameters θ,

∥Φ(θ)∥ q ⩽       v∈Nout |b v | q + ∥θ →v ∥ q q max D⩾0, v∈Nout, u0∈Nin, u0→•••→u D →v Π q (u 0 → • • • → u D ) q       1/q .
If θ has been normalized by Algorithm 1, then this is an equality with the maximum being equal to one so that it simply holds ∥Φ(θ)∥ q = v∈Nout |b v | q + ∥θ →v ∥ q q 1/q .

Figure 2: A network for which the path-norm is zero while the product of operators' norms scales as M 2 .

Proof of Theorem B.1. Since Φ(θ) = (Φ →v (θ)) v∈Nout , it holds

∥Φ(θ)∥ q q = v∈Nout ∥Φ →v (θ)∥ q q .
For any neuron

v ∈ N out , Φ →v (θ) = (θ u→v Φ →u (θ)) u∈ant(v) b v so that ∥Φ →v (θ)∥ q q = |b v | q + u∈ant(v) |θ u→v | q ∥Φ →u (θ)∥ q q ⩽ |b v | q + ∥θ →v ∥ q q max u∈ant(v) ∥Φ →u (θ)∥ q q .
For every u ∈ ant(v), u cannot be an output neuron since it has at least v as a successor. Thus Lemma B.2 gives:

∥Φ →u (θ)∥ q ⩽ max D⩾0, u0∈Nin, u0→•••→u D →u Π q (u 0 → • • • → u D → u).
Putting everything together shows the upper-bound:

∥Φ(θ)∥ q q ⩽ v∈Nout |b v | q + v∈Nout ∥θ →v ∥ q q max D⩾0, v∈Nout, u0∈Nin, u0→•••→u D →v (Π q (u 0 → • • • → u D )) q .
We now prove the case of equality. Recall that

∥Φ(θ)∥ q q = v∈Nout ∥Φ →v (θ)∥ q q = v∈Nout |b v | q + u∈ant(v)
|θ u→v | q ∥Φ →u (θ)∥ q q It would then be sufficient to prove that, as soon as the parameters θ have been rescaled with Algorithm 1, then |θ u→v |∥Φ →u (θ)∥ q = |θ u→v | for every v ∈ N out and u ∈ ant(v). Indeed, we would then deduce the claim by writing:

∥Φ(θ)∥ q q = v∈Nout |b v | q + u∈ant(v) |θ u→v | q = v∈Nout |b v | q + ∥θ →v ∥ q q .
It now remains to see that |θ u→v |∥Φ →u (θ)∥ q = |θ u→v | is a direct consequence of the next lemma.

Lemma B.1. Consider u ∈ N and parameters θ rescaled by Algorithm 1. If ∥Φ →u (θ)∥ q = 0 then θ u→ = 0. Otherwise, ∥Φ →u (θ)∥ q = 1.

Proof of Lemma B.1. The proof is by induction on the neurons. Consider u ∈ N in . Then by convention Φ →u (θ) = 1 so the claim holds true.

Consider now u / ∈ N in and assume the claim to be true for every antecedent of u. It holds:

∥Φ →u (θ)∥ q q = |b u | q + w∈ant(u) |θ w→u | q ∥Φ →w (θ)∥ q q .
A consequence of the induction hypothesis is that |θ w→u | q ∥Φ →w (θ)∥ q q = |θ w→u | q for every w ∈ ant(u). Thus

∥Φ →u (θ)∥ q q = |b u | q + w∈ant(u)
|θ w→u | q = |b u | q + ∥θ →u ∥ q q . The latter is either equal to 0 or 1 by Lemma B.3. Moreover, when it is equal to 0, this means that in Algorithm 1, λ u = 0 and θ u→ = 0 after rescaling since it is set to zero line 6 of Algorithm 1 when u is encountered, and the coordinates of θ u→ can only be multiplied by scalars in the remaining of the algorithms so that this property stays true for the remaining of the algorithm. This proves the claim for u, and thus the induction.

Lemma B.2. Consider an exponent q ∈ [1, ∞). For every neuron v, it holds min D⩾0, u0∈Nin, u0→•••→u D →v Π q (u 0 → • • • → u D → v) ⩽ ∥Φ →v (θ)∥ q ⩽ max D⩾0, u0∈Nin, u0→•••→u D →v Π q (u 0 → • • • → u D → v),
where by convention, an empty minimum (resp. maximum) is -∞ (resp. ∞) and where we define by convention Φ →u (θ) = θ →v = 1 for an input neuron u ∈ N in .

Proof of Lemma B.2. The proof goes by induction on a topological sorting of the graph. The first neurons of the sorting are the neurons without antecedents, i.e. the input neurons by definition. The inequality is true for such neurons since it writes -∞ ⩽ 1 ⩽ ∞ by convention. Indeed ∥Φ →v (θ)∥ q = 1, and the minimum and maximum are empty.

Consider a neuron v /

∈ N in and assume that this is true for every neuron before v in a topological sorting of the graph. By definition,

Φ →v (θ) = (θ u→v Φ →u (θ)) u∈ant(v) b v so that ∥Φ →v (θ)∥ q q = |b v | q + u∈ant(v) |θ u→v | q ∥Φ →u (θ)∥ q q .
Thus

|b v | q + ∥θ →v ∥ q q min u∈ant(v) ∥Φ →u (θ)∥ q q ⩽ ∥Φ →v (θ)∥ q q ⩽ |b v | q + ∥θ →v ∥ q q max u∈ant(v)
∥Φ →u (θ)∥ q q .

Every u ∈ ant(v) must arrive before v in the topological sorting so the induction hypothesis applies to them. Thus:

∥Φ →v (θ)∥ q q ⩽ |b v | q + ∥θ →v ∥ q q max u∈ant(v) max D⩾0, u0∈Nin, u0→•••→u D →u (Π q (u 0 → • • • → u D → u)) q = |b v | q + ∥θ →v ∥ q q max D⩾1, u0∈Nin, u0→•••→u D →v (Π q (u 0 → • • • → u D )) q Now, note that for any path u 0 → • • • → u D → v, it holds |b v | q + ∥θ →v ∥ q q (Π q (u 0 → • • • → u D )) q = (Π q (u 0 → • • • → u D → v)) q .
Indeed, denoting u D+1 = v, it holds by definition

|b v | q + ∥θ →v ∥ q q (Π q (u 0 → • • • → u D )) q = |b v | q D+1 k=D+2 ∥θ →u k ∥ q q =1 (empty product) +∥θ →v ∥ q q D d=0 |b u d | q L k=d+1 ∥θ →u k ∥ q q = |b u D+1 | q D+1 k=D+2 ∥θ →u k ∥ q q + D d=0 |b u d | q D+1 k=d+1 ∥θ →u k ∥ q q = D+1 d=0 |b u d | q D+1 k=d+1 ∥θ →u k ∥ q q = (Π q (u 0 → • • • → u D → v)) q . Thus ∥Φ →v (θ)∥ q q ⩽ max D⩾1, u0∈Nin, u0→•••→u D →v (Π q (u 0 → • • • → u D → v))
q and the maximum does not change if we consider D ⩾ 0 since any path going from an input neuron to v must be of length at least equal to one because v is not an input neuron itself. This proves that the upper bound by induction, and a similar argument applies for the lower bound.

Lemma B.3. Consider an exponent q ∈ [1, ∞). Any output parameters θ of Algorithm 1 are normalized, in the sense that for every neuron v which is not an output neuron, it holds:

∥θ →v ∥ q q + |b v | q = 0 if ∥θ →v ∥ q = b v = 0, 1 otherwise.
Proof of Lemma B.3. It is clear that the claim holds true right after iteration of line 2 of Algorithm 1 corresponding to v. And since the last time the incoming weights and the bias of a neuron v are modified is when this is the turn of v in line 2, then the claim holds true. Indeed, the neurons are seen in an order given by a topological sorting, and given the lines 8, 9 and 10, the incoming weights of v can only be modified when this is the turn of v or one of its antecedents. But the antecedents of v come before v in any topological order, so they are seen before v line 2. Moreover, from line 9, it is clear that the bias of v can only be modified when this is the turn of v line 2.

C RELEVANT (AND APPARENTLY NEW) CONTRACTION LEMMAS

The main result is Lemma C.1. Lemma C.1. Consider finite sets I, W, Z, and for each z ∈ Z, consider a set T z ⊂ (R W ) I . We denote t = (t i ) i∈I ∈ T z with t i = (t i,w ) w∈W ∈ R W . Consider functions f i,z : R W → R and a finite family ε = (ε j ) j∈J of independent identically distributed Rademacher variables, with the index set J that will be clear from the context. Finally, consider a convex and non-decreasing function G : R → R. Assume that at least one of the following setting holds.

Setting 1: scalar input case. |W | = 1 and for every i ∈ I and z ∈ Z, f i,z is 1-Lipschitz with f i,z (0) = 0.

Setting 2: * -max-pooling case. For every i ∈ I and z ∈ Z, there is k i,z ∈ N >0 such that for every t ∈ T z , f i,z (t) = t (ki,z) is the k i,z -th largest coordinate of t.

Then:

E max z∈Z sup t∈T z G i∈I ε i,z f i,z (t i ) ⩽ E max z∈Z sup t∈T z G   i∈I,w∈W ε i,w,z t i,w   . (5)
The scalar input case is a simple application of (Ledoux & Talagrand, 1991, Theorem 4.12). Indeed, for z ∈ Z and t ∈ T z , define s(z, t) ∈ R I×Z to be the matrix with coordinates

(i, v) ∈ I × Z given by [s(z, t)] i,v = t i if v = z, 0 otherwise. Define also g i,v = f i . Since g i,v (0) = 0, it holds: i∈I ε i,z f i (t i ) = i∈I,v∈Z ε i,v g i,v ([s(z, t)] i,v ).
If S := {s(z, t), z ∈ Z, t ∈ T z } and J := I × Z then the result claimed in the scalar case reads

E sup s∈S G   j∈J ε j f j (s j )   ⩽ E sup s∈S G   j∈J ε j s j   .
The latter is true by Theorem 4.12 of [START_REF] Ledoux | Probability in Banach spaces[END_REF]. We still give an alternative proof below that turns to be useful for the * -max-pooling case. This alternative proof actually mimics the scheme of proof of Theorem 4.12 in [START_REF] Ledoux | Probability in Banach spaces[END_REF]: the beginning of the proof is the same for the scalar case and the * -max-pooling case, and then the arguments become specific to each case.

Note that Theorem 4.12 of [START_REF] Ledoux | Probability in Banach spaces[END_REF] does not apply for the * -max-pooling case because the t i 's are now vectors. The most related result we could find is a vector-valued contraction inequality [START_REF] Maurer | A vector-contraction inequality for rademacher complexities[END_REF] that is known in the specific case where |Z| = 1, G is the identity, and for arbitrary 1-Lipschitz functions f i,z such that f i,z (0) = 0 (with a different proof, and with a factor √ 2 on the right-hand side). Here, the vector-valued case we are interested in is f i,z = k i,z -pool and G = exp, which is covered by Lemma C.1. We could not find it stated elsewhere.

In the proof of Lemma C.1, we reduce to the simpler case where |Z| = 1 and |I| = 1 that corresponds to the next lemma. Again, the scalar input case is given by (Ledoux & Talagrand, 1991, Equation (4.20)) while the * -max-pooling case is apparently new. Lemma C.2. Consider a finite set W , a set T of elements t = (t 1 , t 2 ) ∈ R W × R and a function f : R W → R. Consider also a convex non-decreasing function F : R → R and a family of iid Rademacher variables (ε j ) j∈J where J will be clear from the context. Assume that we are in one of the two following situations. Scalar input case. f is 1-Lipschitz, satisfies f (0) = 0 and has a scalar input (|W | = 1). * -max-pooling case. There is k ∈ N >0 such that f computes the k-th largest coordinate of its input.

Denoting t 1 = (t 1,w ) w∈W , then it holds:

E sup t∈T F (ε 1 f (t 1 ) + t 2 ) ⩽ E sup t∈T F w ε 1,w t 1,w + t 2 .
The proof of Lemma C.2 is postponed. We now prove Lemma C.1.

Proof of Lemma C.1. First, because of the Lipschitz assumptions on the f i 's and the convexity of G, everything is measurable and the expectations are well defined.

We prove the result by reducing to the simpler case of Lemma C.2. This is inspired by the reduction done in the proof of (Ledoux & Talagrand, 1991, Theorem 4.12) in the special case of scalar t i 's (|W | = 1).

Reduce to the case |Z| = 1 by conditioning and iteration.

For z ∈ Z, define

A z := sup t∈T z G i∈I ε i,z f i,z (t i ) , B z := sup t∈T z G   i∈I,w∈W ε i,w,z t i,w   .
Lemma C.3 applies since these random variables are independent. Thus, it is enough to prove that for every c). This can be rewritten as (inverting the supremum and the maximum)

c ∈ [-∞, ∞): E max(A z , c) ⩽ E max(B z , c). Define F (x) = max(G(x),
E sup t∈T z F i∈I ε i,z f i,z (t i ) ⩽ E sup t∈T z F   i∈I,w∈W ε i,w,z t i,w   . (6)
We just reduced to the case where there is a single z to consider, up to the price of replacing G by F . Since G and x → max(x, c) are non-decreasing and convex, then so is F by composition.

Alternatively, note that we could also have reduced to the case |Z| = 1 by defining S := {s(z, t), z ∈ Z, t ∈ T z } just as it is done right after the statement of Lemma C.1. In order to apply Lemma C.2, it remains to reduce to the case |I| = 1.

Reduce to the case |I| = 1 by conditioning and iteration. Lemma C.4 shows that in order to prove Equation ( 6), it is enough to prove that for every i ∈ I and every subset

R ⊂ R W × R, denoting r = (r 1 , r 2 ) ∈ R W × R, it holds E sup r∈R F (ε i,z f i,z (r 1 ) + r 2 ) ⩽ E sup r∈R F w∈W ε i,w,z r 1,w + r 2 .
We just reduced to the case |I| = 1 since one can now consider the indices i one by one. The latter inequality is now a direct consequence of Lemma C.2. This proves the result.

Lemma C.3. Consider a finite set Z and independent families of independent real random variables (A z ) z∈Z and (B z ) z∈Z . If for every z ∈ Z and every constant

c ∈ [-∞, ∞), it holds E max(A z , c) ⩽ E max(B z , c) then E max z∈Z A z ⩽ E max z∈Z B z .
Proof of Lemma C.3. The proof is by conditioning and iteration. To prove the result, it is enough to prove that if

E max z∈Z A z ⩽ E max max z∈Z1 A z , max z∈Z2 B z
for some partition Z 1 , Z 2 of Z, with Z 2 possibly empty for the initialization of the induction, then for every z 0 ∈ Z 1 :

E max z∈Z A z ⩽ E max max z∈Z1\{z0} A z , max z∈Z2∪{z0} B z ,
with the convention that the maximum over an empty set is -∞. Indeed, the claim would then come directly by induction on the size of Z 2 . Now, consider an arbitrary partition Z 1 , Z 2 of Z, with Z 2 possibly empty, and consider z 0 ∈ Z 1 . It is then enough to prove that

E max max z∈Z1 A z , max z∈Z2 B z ⩽ E max max z∈Z1\{z0} A z , max z∈Z2∪{z0} B z . (7)
Define the random variable C = max max z∈Z1\{z0} A z , max z∈Z2 B z which may be equal to -∞ when the maximum is over empty sets, and which is independent of A z0 and B z0 . Then:

max max z∈Z1 A z , max z∈Z2 B z = max (A z0 , C) and max max z∈Z1\{z0} A z , max z∈Z2∪{z0} B z = max (B z0 , C) .
Equation ( 7) is then equivalent to

E max(A z0 , C) ⩽ E max(B z0 , C) with C independent of A z0 and B z0 . For a constant c ∈ [-∞, ∞), denote A(c) = E max(A z0 , c) and B(c) = E max(B z0 , c). Then: E max(A z0 , C) = E (E (max (A z0 , C) |A z0 )) law of total expectation = EA(C)
independence of C and A z0 .

and similarly ∞), this is true by assumption. This proves the claims.

E max(B z0 , C) = EB(C). It is then enough to prove that A(C) ⩽ B(C) almost surely. Since C ∈ [-∞,
Lemma C.4. Consider finite sets I, W and independent families of independent real random variables (ε i ) i∈I and (ε i,w ) i∈I,w∈W . Consider functions f i : R W → R and F : R → R that are continuous. Assume that for every i ∈ I and every subset R ⊂ R W × R, denoting r = (r 1 , r 2 ) ∈ R with r 1 = (r 1,w ) w ∈ R W and r 2 ∈ R the components of r, it holds

E sup r∈R F (ε i f i (r 1 ) + r 2 ) ⩽ E sup r∈R F ( w∈W ε i,w r 1,w + r 2 ).
Consider an arbitrary T ⊂ (R W ) I and for t = (t i ) i∈I ∈ T , denote t i,w the w-th coordinate of

t i ∈ R W . Then E sup t∈T F ( i∈I ε i f i (t i )) ⩽ E sup t∈T F ( i∈I,w∈W ε i,w t i,w ).
Proof of Lemma C.4. The continuity assumption on F and the f i 's is only used to make all the considered suprema measurable. The proof goes by conditioning and iteration. For any J ⊂ I, denote ε J the family that contains both (ε j ) j∈J and (ε j,w ) j∈J,w∈W . Define

h J (t, ε J ) := j∈J ε j f j (t j ), H J (t, ε J ) := j∈J,w∈W ε j,w t j,w ,
with the convention that an empty sum is zero. To make notations lighter, if J = {j} then we may write h j and H j instead of h J and H J . We also omit to write the dependence on ε J as soon as possible. What we want to prove is thus equivalent to

E sup t∈T F (h I (t)) ⩽ E sup t∈T F (H I (t)).
It is enough to prove that for every partition I 1 , I 2 of I, with I 2 possibly empty, if

E sup t∈T F (h I (t)) ⩽ E sup t∈T F (h I1 (t) + H I2 (t)),
then for every j ∈ I 1 ,

E sup t∈T F (h I (t)) ⩽ E sup t∈T F (h I1\{j} (t) + H I2∪{j} (t)).
Indeed, the result would then come by induction on the size of I 2 . Fix an arbitrary partition I 1 , I 2 of I with I 2 possibly empty, and j ∈ I 1 . It is then enough to prove that

E sup t∈T F (h I1 (t) + H I2 (t)) ⩽ E sup t∈T F (h I1\{j} (t) + H I2∪{j} (t)). ( 8
)
Denote ε -j := ε I\{j} and φ(t, ε -j ) := h I1\{j} (t, ε I1\{j} ) + H I2 (t, ε I2 )). It holds:

h I1 (t) + H I2 (t) = h j (t, ε j ) + φ(t, ε -j )
and, writing ε j,• = (ε j,w ) w∈W :

h I1\{j} (t) + H I2∪{j} (t) = H j (t, ε j,• ) + φ(t, ε -j ).
Consider the measurable functions

g(ε j , ε -j ) := sup t∈T F (h j (t, ε j ) + φ(t, ε -j ))
and

G(ε j,• , ε -j ) := sup t∈T F (H j (t, ε j,• ) + φ(t, ε -j )).
Denote ∆ the ambiant space of ε -j and consider a constant

δ ∈ ∆. Define ĝ(δ) = Eg(ε j , δ) and Ĝ(δ) = EG(ε j,• , δ). Then E sup t∈T F (h I1 (t) + H I2 (t)) = Eg(ε j , ε -j ) by definition of g = E (E (g(ε j , ε -j )|ε -j )) law of total expectation = Eĝ(ε -j )
independence of ε j and ε -j

and similarly E sup t∈T F (h I1\{j} (t) + H I2∪{j} (t)) = E Ĝ(ε -j ). Thus, Equation ( 8) is equivalent to Eĝ(ε -j ) ⩽ E Ĝ(ε -j ). For every δ ∈ ∆, we can define

R(δ) = {(t j , φ(t, δ)) ∈ R W × R, t ∈ T } and it holds ĝ(δ) = E sup r∈R F (ε j f j (r 1 ) + r 2 ) and Ĝ(δ) = E sup r∈R F ( w∈ ε j,w r 1,w + r 2 ).
Thus, ĝ(δ) ⩽ Ĝ(δ) for every δ ∈ ∆ by assumption. This shows the claim.

Proof of Lemma C.2. Recall that we want to prove

E sup t∈T F (ε 1 f (t 1 ) + t 2 ) ⩽ E sup t∈T F w∈W ε 1,w t 1,w + t 2 . ( 9
)
Scalar input case. In this case, |W | = 1 i.e. the inputs t 1 are scalar and the result is well-known, see (Ledoux & Talagrand, 1991, Equation (4.20)).

k-max-pooling case. In this case, f computes the k-th largest coordinate of its input. Computing explicitly the expectation where the only random thing is ε 1 ∈ {-1, 1}, the left-hand side of Equation ( 9) is equal to

1 2 sup t∈T F (f (t 1 ) + t 2 ) + 1 2 sup s∈T F (-f (s 1 ) + s 2 ) . Consider s, t ∈ T . Recall that s 1 , t 1 ∈ R W . Denote s 1,(k) the k-th largest component of vector s 1 . The set {w ∈ W : s 1,w ⩽ s 1,(k) } has at least |W | -k + 1 elements, and {w ∈ W : t 1,(k) ⩽ t 1,w }
has at least k elements, so their intersection is not empty. Consider any6 w(s, t) in this intersection.

We are now going to use that both f (t 1 ) = t 1,(k) ⩽ t 1,w(s,t) and -f (s 1 ) = -s 1,(k) ⩽ -s 1,w(s,t) . Even if we are not going to use it, note that this implies f (t) -f (s) ⩽ t 1,w(s,t) -s 1,w(s,t) : we are exactly using an argument that establishes that f is 1-Lipschitz. Since f (t 1 ) = t 1,(k) ⩽ t 1,w(s,t) and F is non-decreasing, it holds:

F (f (t 1 ) + t 2 ) ⩽F t 1,w(s,t) + t 2 = ε centered F   t 1,w(s,t) + E   w̸ =w(s,t) ε 1,w t 1,w   + t 2   ⩽ Jensen EF   t 1,w(s,t) + w̸ =w(s,t) ε 1,w t 1,w + t 2   .
Moreover, -f (s 1 ) = -s 1,(k) ⩽ -s 1,w(s,t) so that in a similar way:

F (-f (s 1 ) + s 2 ) ⩽F -s 1,w(s,t) + s 2 ⩽F   -s 1,w(s,t) + E   w̸ =w(s,t) ε 1,w s 1,w   + s 2   ⩽EF   -s 1,w(s,t) + w̸ =w(s,t) ε 1,w s 1,w + s 2   .
At the end, we get

1 2 F (f (t 1 ) + t 2 ) + 1 2 F (-f (s 1 ) + s 2 ) ⩽ 1 2 EF   t 1,w(s,t) + w̸ =w(s,t) ε 1,w t 1,w + t 2   + 1 2 EF   -s 1,w(s,t) + w̸ =w(s,t) ε 1,w s 1,w + s 2   ⩽ 1 2 E sup r∈T F   r 1,w(s,t) + w̸ =w(s,t) ε 1,w r 1,w + r 2   + 1 2 E sup r∈T F   -r 1,w(s,t) + w̸ =w(s,t) ε 1,w r 1,w + r 2   = E sup r∈T F   ε 1,w(s,t) r 1,w(s,t) + w̸ =w(s,t) ε 1,w r 1,w + r 2   = E sup r∈T F w ε 1,w r 1,w + r 2 .
The latter is independent of s, t. Taking the supremum over all s, t ∈ T yields Equation ( 9) and thus the claim.

D PEELING ARGUMENT

First, we state a simple lemma that will be used several times.

Lemma D.1. Consider a vector ε ∈ R n with iid Rademacher coordinates, meaning that P(ε i = 1) = P(ε i = -1) = 1/2. Consider a function G : R → R ⩾0 . Consider a set X ⊂ R n . Then whenever the suprema are measurable:

E ε sup x∈X G n i=1 ε i x i ⩽ 2E ε sup x∈X G n i=1 ε i x i . Proof of Lemma D.1. Since G ⩾ 0, it holds G(|x|) ⩽ G(x) + G(-x). Thus E ε sup x∈X G n i=1 ε i x i ⩽ E ε sup x∈X G n i=1 ε i x i + E ε sup x∈X G n i=1 (-ε i )x i .
Since ε is symmetric, that is -ε has the same distribution as ε, then the latter is just

2E ε sup x∈X G ( n i=1 ε i x i ).
This proves the claim.

Notations We now fix for all the next results of this section n vectors x 1 , . . . , x n ∈ R din , for some d in ∈ N >0 . We denote x i,u the coordinate u of x i .

For any neural network architecture, recall that v(θ, x) is the output of neuron v for parameters θ and input x, and ant d (v) is the set of neurons u for which there exists a path from u to v of distance d. For a set of neurons

V , denote R V (θ, x) = (v(θ, x)) v∈V .
Introduction to peeling This section shows that some expected sum over output neurons v can be reduced to an expected maximum over ant(v), and iteratively over an expected maximum over ant d (v) for increasing d's. Eventually, the maximum is only over input neurons as soon as d is large enough. We start with the next lemma which is the initialization of the induction over d: it peels off the output neurons v to reduce to their antecedents ant(v). Then

E ε G     sup θ∈Θ i=1,...,n, v∈Nout ε i,v v(θ, x i )     ⩽ E ε G r max v∈Nout max u∈(ant(v)∩Nin)∪{b} n i=1 ε i,v x i,u + E ε G r max v∈Nout max u∈ant(v)\Nin sup θ n i=1 ε i,v u(θ, x i )
Proof of Lemma D.2. Recall that for a set of neurons V , we denote R V (θ, x) = (v(θ, x)) v∈V .

Recall that by Definition 2.1, output neurons are identity neurons so that for every v ∈ N out , θ ∈ Θ and every input x:

v(θ, x) = θ →v b v , R ant(v) (θ, x) 1 .
Overloading the symbol b to make it represent a new neuron that computes the constant function equal to one (b(θ, x) = 1), we get:

E ε G     sup θ i=1,...,n v∈Nout ε i,v v(θ, x i )     = E ε G sup θ v∈Nout θ →v b v , n i=1 ε i,v R ant(v) (θ, x i ) 1 ⩽ Hölder E ε G        sup θ v∈Nout ∥θ →v ∥ 1 + |b v | ⩽r by assumption max v∈Nout n i=1 ε i,v , max u∈ant(v) n i=1 ε i,v u(θ, x i )        ⩽ E ε G r max v∈Nout max u∈ant(v)∪{b} sup θ n i=1 ε i,v u(θ, x i ) .
Everything is non-negative so the maximum over u ∈ ant(v) ∪ {b} is smaller than the sum of the maxima over u ∈ (ant(v) ∩ N in ) ∪ {b} and u ∈ ant(v) \ N in . Note that when u is an input neuron, it simply holds u(θ, x i ) = x i,u . This proves the result.

We now show how to peel neurons to reduce the maximum over ant d (v) to ant d+1 (v). Later, we will repeat that until the maximum is only on input neurons. Compared to the previous lemma, note the presence of an index m = 1, . . . , M in the maxima. This is because after d steps of peeling (when the maximum over u has been reduced to u ∈ ant d (v)), we will have M = K d-1 where K is the kernel size. Indeed, the number of copies indexed by m gets multiplied by K after each peeling step. Lemma D.3. Consider a neural network architecture with an associated set Θ of parameters θ such that every neuron v that is not an output neuron satisfies ∥θ →v ∥ 1 + |b v | ⩽ 1. Consider a family of independent Rademacher variables (ε j ) j∈J with J that will be clear from the context. Consider arbitrary M, d ∈ N and a convex non-decreasing function G : R → R ⩾0 . Take a symbol b (for bias) which does not correspond to a neuron (b / ∈ N ) and set by convention x b = 1 for every input x. Denote K the maximal kernel size of the network (i.e. the maximum of | ant(u)| over every neuron u ∈ N * -pool ). Define P := |{k ∈ N >0 , ∃u ∈ N k-pool }| as the number of different types of * -max-pooling neurons in G. Then:

E ε G   max v∈Nout, m=1,...,M max u∈ant d (v)\Nin sup θ n i=1 ε i,v,m u(θ, x i )   ⩽ (3 + 2P )E ε G   max v∈Nout, m=1,...,KM max u∈(ant d+1 (v)∩Nin)∪{b} n i=1 ε i,v,m x i,u   + (3 + 2P )E ε G   max v∈Nout, m=1,...,KM max u∈ant d+1 (v)\Nin sup θ n i=1 ε i,v,m u(θ, x i )   Proof.
Step 1: split the neurons depending on their activation function. In the term that we want to bound from above, the neurons u compute something of the form ρ u (. . . ) where ρ u is the activation associated with u which is 1-Lipschitz and satisfy ρ u (0) = 0. The first step of the proof is to get rid of ρ u using a contraction lemma of the type (Ledoux & Talagrand, 1991, Theorem 4.12). However, here, the function ρ u depends on the neuron u, what we are taking a maximum over so that classical contraction lemmas do not apply directly. To resolve this first obstacle, we split the neurons according to their activation function. Below, we highlight in blue what is important and/or the changes from one line to another. Denote N ρ the neurons that have ρ as their associated activation function, and the term with a maximum over all u ∈ N ρ is denoted:

e(ρ) := E ε G   max v∈Nout, m=1,...,M max u∈(ant d (v)∩Nρ)\Nin sup θ n i=1 ε i,v,m u(θ, x i )   ,
with the convention e(ρ) = 0 if N ρ is empty. This yields a first bound

E ε G   max v∈Nout, m=1,...,M max u∈ant d (v)\Nin sup θ n i=1 ε i,v,m u(θ, x i )   ⩽ e(ReLU) + e(id) + k e(k-pool)
where the sum of the right-hand side is on all the k ∈ N >0 such that there is at least one neuron in N k-pool . Define E(ρ) to be the same thing as e(ρ) but without the absolute values:

E(ρ) := E ε G   max v∈Nout, m=1,...,M max u∈(ant d (v)∩Nρ)\Nin sup θ n i=1 ε i,v,m u(θ, x i )   .
Then Lemma D.1 gets rid of the absolute values by paying a factor 2: e(ρ) ⩽ 2E(ρ). We now want to bound each E(ρ).

Step 2: get rid of the * -max-pooling and ReLU activation functions. Since the maximal kernel size is K, any * -max-pooling neuron u must have at most K antecedents. When a * -max-pooling neuron u has less than K antecedents, we artificially add neurons w to ant(u) to make it of cardinal K, and we set by convention θ w→u = 0. We also fix an arbitrary order on the antecedents of u and write ant(u) w for the antecedent number w, with R ant(u)w the function associated with this neuron. For a ReLU or * -max-pooling neuron u, define the pre-activation of u to be

pre u (θ, x) :=    θ →u b u , R ant(u) (θ, x) 1 if u ∈ N ReLU ,
θ ant(u)w→u R ant(u)w (θ, x) w=1,...,k otherwise when u ∈ N * -pool .

Note that the pre-activation has been defined to satisfy u(θ, x) = ρ u (pre u (θ, x)). When ρ is the ReLU or k-pool, we can thus rewrite E(ρ) in terms of the pre-activations:

E(ρ) = E ε G   max v∈Nout, m=1,...,M max u∈(ant d (v)∩Nρ)\Nin sup θ n i=1 ε i,v,m ρ(pre u (θ, x i ))   . Consider the finite set Z = {(v, m), v ∈ N out , m = 1, . . . , M } and for every z = (v, m) ∈ Z, define T z = {(pre u (θ, x i )) i=1,...,n ∈ R n , u ∈ (ant d (v) ∩ N ρ ) \ N in , θ ∈ Θ}. We can again rewrite E(ρ) as E(ρ) = E ε G max z∈Z sup t∈T z n i=1 ε i,z ρ(t i ) .
We now want to get rid of the activation function ρ with a contraction lemma. There is a second difficulty that prevents us from directly applying classical contraction lemmas such as (Ledoux & Talagrand, 1991, Theorem 4.12). It is the presence of a maximum over multiple copies indexed by z ∈ Z of a supremum that depends on iid families (ε i,z ) i=1...n . Indeed, (Ledoux & Talagrand, 1991, Theorem 4.12) only deals with a single copy (|Z| = 1). This motivates the contraction lemma established for the occasion in Lemma C.1. Once the activation functions removed, we can conclude separately for ρ = ReLU, id and ρ = k-pool.

Step 3a: deal with ρ = k-pool via rescaling. In the case ρ = k-pool, Lemma C.1 shows that

E ε G max z∈Z sup t∈T z n i=1 ε i,z k-pool(t i ) ⩽ E ε G     max z∈Z sup t∈T z i=1,...,n, w=1,...,K ε i,z,w t i,w     .
The right-hand side is equal to

E ε G     max v∈Nout, m=1,...,M sup u∈(ant d (v)∩Nmax)\Nin,θ∈Θ i=1,...,n, w=1,...,K ε i,v,m,w θ ant(u)w→u R ant(u)w (θ, x i )     . (10)
We now deal with this using the assumption on the norm of incoming weights. It holds: i=1,...,n, w=1,...,K

ε i,v,m,w θ ant(u)w→u R ant(u)w (θ, x i ) = w=1,...,K θ ant(u)w→u   i=1,...,n ε i,v,m,w R ant(u)w (θ, x i )   ⩽ Hölder ∥θ →u ∥ 1 ⩽1 by assumption max w=1,...,K i=1,...,n ε i,v,m,w R ant(u)w (θ, x i ) ⩽ decoupling w and ant(u)w max w∈ant(u) max w ′ =1,...,K n i=1 ε i,v,m,w ′ w(θ, x i ) .
Thus, Equation ( 10) is bounded from above by

E ε G   max v∈Nout, m=1,...,M sup u∈(ant d (v)∩Nmax)\Nin,θ∈Θ max w∈ant(u) max w ′ =1,...,K n i=1 ε i,v,m,w ′ w(θ, x i )   .
We can re-index the variables ε by making the third coordinate equal to the cartesian product of the current third and fourth coordinates. This absorbs the fourth coordinate in the third one, with m going from 1 to KM instead of M . Note also that for u ∈ (ant d (v) ∩ N max ) \ N in and w ∈ ant(u), then w ∈ ant d+1 (v) so considering a maximum over w ∈ ant d+1 (v) can only increase the latter expectation. Moreover, we can add a new neuron b (for bias) that computes the constant function equal to one (b(θ, x) = 1) and add b to the maximum over w. At the end, Equation ( 10) is bounded by

H := E ε G   max v∈Nout, m=1,...,KM sup w∈ant d+1 (v)∪{b} sup θ∈Θ n i=1 ε i,v,m w(θ, x i )   .
We now derive similar inequalities when ρ = id and ρ = ReLU.

Step 3b: deal with ρ = id, ReLU via rescaling. In the case ρ = ReLU, Lemma C.1 shows that

E ε G max z∈Z sup t∈T z n i=1 ε i,z ReLU(t i ) ⩽ E ε G   max z∈Z sup t∈T z i=1,...,n ε i,z t i   .
The difference with the * -max-pooling case is that each t i is scalar so this does not introduce an additional index w to the Rademacher variables. The right-hand side can be rewritten as

E ε G   max v∈Nout, m=1,...,M sup u∈(ant d (v)∩N ReLU )\Nin,θ∈Θ i=1,...,n ε i,v,m θ →u b u , R ant(u) (θ, x i ) 1  
We can only increase the latter by considering a maximum over all u ∈ ant d (v), not only the ones in N ReLU . We also add absolutes values. This is then bounded by

F := E ε G   max v∈Nout, m=1,...,M sup u∈ant d (v)\Nin,θ∈Θ i=1,...,n ε i,v,m θ →u b u , R ant(u) (θ, x i ) 1   . (11)
This means that E(ReLU) ⩽ F . Let us also observe that e(id) ⩽ F . Indeed, recall that by definition

e(id) = E ε G   max v∈Nout, m=1,...,M max u∈(ant d (v)∩N id )\Nin sup θ n i=1 ε i,v,m u(θ, x i )   .
We can only increase the latter expectation by considering a maximum over all u ∈ ant d (v). Moreover, for an identity neuron u, it holds u(θ, x) =

θ →u b u , R ant(u) (θ, x) 1
. This shows that e(id) ⩽ F . It then remains to bound F using that the parameters are rescaled. Introduce a new neuron b (for bias) that computes the constant function equal to one: b(θ, x) = 1. Note that i=1,...,n

ε i,v,m θ →u b u , R ant(u) (θ, x i ) 1 = θ →u b u , i=1,...,n ε i,v,m R ant(u) (θ, x i ) 1 ⩽ Hölder (∥θ →u ∥ 1 + |b u |) ⩽1 by assumption max w∈ant(u)∪{b} n i=1 ε i,v,m w(θ, x i ) .
This shows that

F ⩽ E ε G   max v∈Nout, m=1,...,M sup u∈ant d (v)\Nin,θ∈Θ max w∈ant(u)∪{b} n i=1 ε i,v,m w(θ, x i )   .
Obviously, one can introduce additional copies of ε to make the third index going from m = 1 to KM , and this can only increase the latter. Moreover, if u ∈ ant d (v) \ N in and w ∈ ant(u) then w ∈ ant d+1 (u) so that we can consider a maximum over w ∈ ant d+1 (v) and this could only increase the latter. This gives the final bound

F ⩽ E ε G   max v∈Nout, m=1,...,KM max w∈ant d+1 (v)∪{b} sup θ∈Θ n i=1 ε i,v,m w(θ, x i )   = H.
Step 4: putting everything together. At the end, recalling that there are at most P different k ∈ N >0 associated with an existing k-max-pooling neuron, we get the final bound

E ε G   max v∈Nout, m=1,...,M max u∈ant d (v)\Nin sup θ n i=1 ε i,v,m u(θ, x i )   ⩽ e(id) + e(ReLU) + k e(k-pool) ⩽ e(id) + 2E(ReLU) + 2 k E(k-pool) ⩽ F + 2F + 2 k E(k-pool) ⩽ H + 2H + 2 k H ⩽ H + 2H + 2P H = (3 + 2P )H.
The term (3 + 2P )H can again be bounded by splitting the maximum over w ∈ ant d+1 (v) ∪ {b} between the w's that are input neurons, and those that are not, since everything is non-negative. This yields the claim.

Theorem D.1. Consider a neural network architecture as in Definition 2.1. Denote K its maximal kernel size (i.e. the maximum of | ant(u)| over all neurons u ∈ N * -pool ), with K = 1 by convention if there is no * -max-pooling neuron, and denote D the depth (the length of the longest path from an input to an output). Define P := |{k ∈ N >0 , ∃u ∈ N k-pool }| as the number of different types of * -max-pooling neurons in G. Add an artificial neuron b in the input neurons N in and define x b = 1 for any input x. For any set of parameters Θ associated with the network, such that ∥Φ(θ)∥ 1 ⩽ r for every θ ∈ Θ, it holds for every convex non-decreasing function

G : R → R ⩾0 E ε G     sup θ∈Θ i=1,...,n, v∈Nout ε i,v v(θ, x i )     ⩽ (3 + 2P ) D 2 + 2P E ε G   r max v∈Nout, m=1,...,K D-1 max u∈Nin∪{b} n i=1 ε i,v,m x i,u    .
Proof of Theorem D.1. Without loss of generality, we assume that the parameters in Θ are rescaled with Algorithm 1, as the rescaling of parameters θ performed by Algorithm 1 does not change the associated function R θ nor the path-norm ∥Φ(θ)∥ 1 so that we still have ∥Φ(θ)∥ 1 ⩽ r and the supremum over θ ∈ Θ on the left-hand side can be taken over rescaled parameters. Now that the parameters are rescaled, note that Theorem B.1 guarantees v∈Nout ∥θ →v ∥ 1 + |b v | = ∥Φ(θ)∥ 1 ⩽ r so Lemma D.2 applies. Moreover, Lemma B.3 also guarantees that for every v that is not an ouput neuron, it holds ∥θ →v ∥ 1 + |b v | ⩽ 1 so that Lemma D.3 also applies.

By induction on d ⩾ 1, we prove that (highlighting in blue what is important)

E ε G     sup θ∈Θ i=1,...,n, v∈Nout ε i,v v(θ, x i )     ⩽ d ℓ=1 (3 + 2P ) ℓ-1 E ε G   r max v∈Nout, m=1,...,K ℓ-1 max u∈(ant ℓ (v)∩Nin)∪{b} n i=1 ε i,v,m x i,u    + (3 + 2P ) d-1 E ε G   r max v∈Nout, m=1,...,K d-1 max u∈ant d (v)\Nin sup θ∈Θ n i=1 ε i,v,m u(θ, x i )    ,
with the convention that a maximum over an empty set is zero. This is true for d = 1 by Lemma D.2. The induction step is then verified using Lemma D.3. This concludes the induction. Applying the result for d = D, and since ant D (v) \ N in = ∅, we get:

E ε G     sup θ∈Θ i=1,...,n, v∈Nout ε i,v v(θ, x i )     ⩽ D d=1 (3 + 2P ) d-1 E ε G   r max v∈Nout, m=1,...,K d-1 max u∈(ant d (v)∩Nin)∪{b} n i=1 ε i,v,m x i,u    .
We can only increase the right-hand side by considering maximum over all u ∈ N in ∪ {b} and by adding independent copies indexed from m = 1 to m = K D-1 . Moreover,

D d=1 (3 + 2P ) d-1 = ((3 + 2P ) D -1)/(2 + 2P
). This shows the final bound:

E ε G     sup θ∈Θ i=1,...,n, v∈Nout ε i,v v(θ, x i )     ⩽ (3 + 2P ) D 2 + 2P E ε G   r max v∈Nout, m=1,...,K D-1 max u∈Nin∪{b} n i=1 ε i,v,m x i,u    .
E DETAILS TO DERIVE THE GENERALIZATION BOUND (THEOREM 3.1) Proof of Theorem 3.1. The proof is given directly in the general case with biases. Define the random matrices

E = (ε i,v ) i,v ∈ R n×dout and R(θ, X) = (v(θ, X i )) i,v ∈ R n×dout so that ⟨E, R(θ, X)⟩ = i,v ε i,v R θ (X i ) v . It then holds: E Z ℓ-generalization error of θ(Z) ⩽ 2 n E Z,ε sup θ n i=1 ε i ℓ (R θ (X i ), Y i ) ⩽ 2 √ 2L n E Z,ε sup θ ⟨E, R(θ, X)⟩ .
The first inequality is the symmetrization property given by (Shalev-Shwartz & Ben-David, 2014, Theorem 26.3), and the second inequality is the vector-valued contraction property given by [START_REF] Maurer | A vector-contraction inequality for rademacher complexities[END_REF]. These are the relevant versions of very classical arguments that are widely used to reduce the problem to the Rademacher complexity of the model (Bach,Propositions 4.2 and 4.3) (Wainwright, 2019, Equations (4.17) and (4.18)) [START_REF] Bartlett | Rademacher and Gaussian complexities: Risk bounds and structural results[END_REF], Proof of Theorem 8) (Shalev-Shwartz & Ben-David, 2014, Theorem 26.3) (Ledoux & Talagrand, 1991, Equation (4.20)). In particular, this step has nothing specific with neural networks. Note that the assumption on the loss is used for the second inequality.

We now condition on Z = (X, Y) and denote E ε the conditional expectation. For any random variable λ(Z) > 0 measurable in Z, it holds

E ε sup θ ⟨E, R(θ, X)⟩ = 1 λ(Z) log exp λ(Z)E ε sup θ ⟨E, R(θ, X)⟩ = λ measurable in Z 1 λ(Z) log exp E ε λ(Z) sup θ ⟨E, R(θ, X)⟩ ⩽ Jensen 1 λ(Z) log E ε exp λ(Z) sup θ ⟨E, R(θ, X)⟩ . For z = ((x i , y i )) n i=1 ∈ (R din × R dout ) n , denote e(z) = E ε exp λ(z) sup θ ⟨E, R(θ, x)⟩ .
Since Z is independent of ε, it holds

E ε exp λ(Z) sup θ ⟨E, R(θ, X)⟩ = e(Z).
Denote r = sup θ∈Θ ∥Φ(θ)∥ 1 . For z as above, simply denote λ := λ(z). The peeling argument given by Theorem D.1 for G : t ∈ R → exp(λt) gives: Using Lemma E.1, it holds

e(z) ⩽ (3 + 2P ) D 2 + 2P E ε exp   λr max v∈Nout, m=1,...,K D-1 max u∈Nin∪{b} n i=1 ε i,v,m x i,u    , where x i,u is coordinate u of vector x i ∈ R din
E ε exp      λr max v∈Nout, u∈Nin∪{b}, m=1,...,K D-1 n i=1 ε i,v,m (X i ) u      ⩽ 2K D-1 (d in + 1)d out exp (rλ(z)σ(x)) 2 2 .
Putting everything together, we get:

E ε sup θ ⟨E, R(θ, X)⟩ = e(Z) ⩽ 1 λ log(C 1 ) + λ(Z)C 2 (X)
with

C 1 = 2K D-1 (d in + 1)d out × (3 + 2P ) D 2 + 2P = 3 + 2P 1 + P ((3 + 2P )K) D-1 (d in + 1)d out and C 2 (X) = 1 2 (rσ(X)) 2 .
Choosing λ(Z) = log(C1) C2(X) yields:

E ε sup θ ⟨E, R(θ, X)⟩ ⩽ 2 log(C 1 )C 2 (X) ⩽ √ 2σ(X)r =2 √ C2(X) log( 3 + 2P 1 + P (d in + 1)d out ) + D log((3 + 2P )K) 1/2 √ log(C1)⩽
.

Taking the expectation on both sides over Z, and multiplying this by 2 √ 2L n yields Theorem 3.1.

The next lemma is classical (Golowich et al., 2018, Section 7.1) and is here only for completeness. Lemma E.1. For any d, k ∈ N >0 and λ > 0, it holds

E ε exp   λ max m=1,...,k, u=1,...,d n i=1 ε i,m (X i ) u   ⩽ 2kd max u=1,...,d exp λ 2 2 n i=1 (X i ) 2 u .
Proof. It holds

E ε exp   λ max m=1,...,k, u=1,...,d n i=1 ε i,m (X i ) u   ⩽ m=1,...,k, u=1,...,d E ε exp λ n i=1 ε i,m (X i ) u .
For given u and m:

E ε exp λ n i=1 ε i,m (X i ) u ⩽ Lemma D.1 2E ε exp λ n i=1 ε i,m (X i ) u = 2 n i=1 exp (λ(X i ) u ) + exp (-λ(X i ) u ) 2 ⩽ 2 exp λ 2 2 n i=1
(X i ) 2 u using exp(x) + exp(-x) ⩽ 2 exp(x 2 /2) in the last inequality.

F THE CROSS-ENTROPY LOSS IS LIPSCHITZ Theorem 3.1 applies to the cross-entropy loss with L = √ 2. To see this, first recall that with C classes, the cross-entropy loss is defined as

ℓ : (x, y) ∈ R C × {0, 1} C → - dout c=1 y c log exp(x c ) d exp(x d )
.

Consider y ∈ {0, 1} C with exactly one nonzero coordinate and an exponent p ∈ [1, ∞] with conjugate exponent p ′ (1/p + 1/p ′ = 1). Then for every x, x ′ ∈ R C : is continuously differentiable so that for every x, x ′ ∈ R C :

ℓ(x, y) -ℓ(x ′ , y) ⩽ 2 1/p ′ ∥x -x ′ ∥ p .
f (x) -f (x ′ ) = 1 0 ⟨∇f (tx + (1 -t)x ′ ), x -x ′ ⟩ dt ⩽ sup t∈[0,1] ∥∇f (tx + (1 -t)x ′ )∥ p ∥x -x ′ ∥ p ′ .
In order to differentiate f , let's start to differentiate g

(x) = exp(xc) C c ′ =1 exp(x c ′ )
. Denote ∂ i the partial derivative with respect to coordinate i. Then for i ̸ = c:

∂ c g(x) = exp(x c ) ( c ′ exp(x c ′ )) -exp(x c ) (exp(x c )) ( c ′ exp(x c ′ )) 2 = g(x) c ′ ̸ =c exp(x c ′ ) c ′ exp(x c ′ ) . ∂ i g(x) = 0 ( c ′ exp(x c ′ )) -exp(x c ) (exp(x i )) ( c ′ exp(x c ′ )) 2 = g(x) -exp(x i ) c ′ exp(x c ′ ) . Since f (x) = (-log •h)(x): ∂ i f (x) = - ∂ i g(x) g(x) = 1 C c ′ =1 exp(x c ′ ) × -c ′ ̸ =c e x c ′ if i = c, e xi otherwise.
Thus

∥∇f (x)∥ p p = C i=1 |∂ i f (x)| p = c ′ ̸ =c exp(x c ′ ) p + c ′ ̸ =c exp(x c ′ ) p C c ′ =1 exp(x c ′ ) p ⩽ 2 c ′ ̸ =c exp(x c ′ ) p C c ′ =1 exp(x c ′ ) p ⩽ 2 c ′ ̸ =c exp(x c ′ ) p c ′ ̸ =c exp(x c ′ ) p = 2.
where we used in the first inequality that ∥v∥ p p ⩽ ∥v∥ p 1 for any vector v. This shows that for every

x, x ′ ∈ R C : ℓ(x, y) -ℓ(x ′ , y) ⩽ 2 1/p ∥x -x ′ ∥ p ′ .
G THE TOP-1 ACCURACY LOSS IS NOT LIPSCHITZ Theorem 3.1 does not apply to the top-1 accuracy loss ℓ(ŷ, y) = 1 arg max ŷ=arg max y as Equation ( 2) cannot be satisfied by ℓ. Indeed, it is easy to construct situations where ŷ1 = R θ (x 1 ) is arbitrarily close to ŷ2 = R θ (x 2 ) with x 2 correctly classified, while x 1 is not (just take x 2 on the boundary decision of the network and x 1 on the wrong side of the boundary), so that the left-hand side is equal to 1 and the right-hand side is arbitrarily small. Thus, there is no finite L > 0 that could satisfy Equation (2).

H THE MARGIN-LOSS IS LIPSCHITZ

For ŷ ∈ R dout and a one-hot encoding y ∈ R dout of the class c of x (meaning that y c ′ = 1 c ′ =c for every c ′ ), the margin M (ŷ, y) is defined by

M (ŷ, y) := [ŷ] c -max c ′ ̸ =c [ŷ] c ′ .
For γ > 0, recall that the γ-margin-loss is defined by

ℓ(ŷ, y) =    0 if γ < M (ŷ, y), 1 -M (ŷ,y) γ if 0 ⩽ M (ŷ, y) ⩽ γ, 1 if M (ŷ, y) < 0. (12)
For any class c and one-hot encoding y of c, it is known that ŷ ∈ R dout → M (ŷ, y) is 2-Lipschitz with respect to the L 2 -norm on ŷ (Bartlett et al., 2017, Lemma A.3). Moreover, the function

r ∈ R →    0 if r < -γ, 1 + r γ if -γ ⩽ r ⩽ 0, 1 if r > 0. is 1 γ -Lipschitz. By composition, this shows that ŷ ∈ R dout → ℓ γ (ŷ, y) is 2 γ -Lipschitz with respect to the L 2 -norm.
Proof of Theorem 3.2. Since the labels Y are one-hot encodings, we equivalently consider Y either in R dout or in {1, . . . , d out }. It holds (Bartlett et al., 2017, Lemma A.4)

P arg max c [R θ (X)] c ̸ = Y ⩽ E (ℓ γ (R θ (X), Y))
for any γ > 0 and associated γ-margin-loss ℓ γ . Thus, considering the generalization error for ℓ γ : We consider ResNets. They have a single max-pooling layer of kernel size 3 × 3 so that K = 9. The depth is D = 3 + # basic blocks × # conv per basic block, where 3 accounts for the conv1 layer, the average-pooling layer, the fc layer, and the rest accounts for all the convolutional layers in the basic blocks. Note that the average-pooling layer can be incorporated into the next fc layer as it only contains identity neurons, see the discussion after Theorem 3.1, so we can actually consider D = 2 + # basic blocks × # conv per basic block. Choice of γ > 0 for Theorem 3.2. In Equation (3), note that there is a trade-off when choosing γ > 0. Indeed, the first term of the right-hand side is non-decreasing with γ while the second one is non-increasing. The first term is simply the proportion of datapoints that are not correctly classified with a margin at least equal to γ. Defining the margin of input i on parameters θ to be

P arg max c [R θ (X)] c ̸ = Y ⩽ 1 n n i=1 ℓ γ R θ(Z) (X i ), Y i = training error of θ(Z) +E Z ℓ γ -generalization error of θ(Z). By definition of ℓ γ , the training error of θ(Z) is at most 1 n n i=1 1 [R θ(Z) (Xi)] Y i ⩽γ+max c̸ =Y i [R θ(Z) (Xi)]c .
R θ (X i ) Yi -arg max c̸ =Yi R θ (X i ) c
, this means that the first term is (approximately) equal to q if γ = γ(q) is the q-quantile of the distribution of the margins over the training set.

Note that since the second term in Equation ( 3) is of order 1/ √ n, it would be desirable to choose the 1/ √ n-quantile (up to a constant) for γ. However, this is not possible in practice as soon as the training top 1 accuracy is too large compared to 1/ √ n (eg. on ImageNet). Indeed, if the training top 1 error is equal to e ∈ [0, 1], then at least a proportion e of the data margins should be negative8 so that any q-quantile with q < e is negative and cannot be considered for Theorem 3.2

The distribution of the margins on the training set of ImageNet can be found in Figure 3. The maximum training margin is roughly of size 30, which is insufficient to compensate the size of the L 1 path-norm of pretrained ResNets reported in Table 3. For γ > 30, the first term of the right hand-side of Theorem 3.2 is greater than one, so that the bound is not informative. This shows that there is no possible choice for γ > 0 that makes the bound informative on these pretrained ResNets. Table 5 reports a quantile for these pretrained ResNets.

Table 5: The q-quantile γ(q) for q = 1 3 e+ 2 3 , with e being the top 1 error, on ImageNet, of pretrained ResNets available on PyTorch.

ResNet 18 34 50 101 152 γ(q) 5.0 5.6 4.2 5.6 5.8

Details for sparse networks. ResNet18 is trained on 99% of ImageNet with a single GPU using SGD for 90 epochs, learning rate 0.1, weight-decay 0.0001, batch size 1024, and a multi-step scheduler where the learning rate is divided by 10 at epochs 30, 60 and 80. The epoch out of the 90 ones with maximum validation top 1 accuracy is considered as the final epoch. Pruning is done iteratively accordingly to [START_REF] Frankle | Pruning neural networks at initialization: Why are we missing the mark?[END_REF]. We prune 20% of the remaining weights of each convolutional layer, and 10% of the final fully connected layer, at each pruning iteration, save the mask and rewind the weights to their values after the first 5 epochs of the dense network, and train for 85 remaining epochs, before pruning again etc. Results for a single run are shown in Figure 4.

Details for increasing the train size. Instead of training on 99% of ImageNet (n = 1268355), we trained a ResNet18 on n/2 k samples drawn at random, for 1 ⩽ k ⩽ 5. For each given k, the results are averaged over 3 seeds. The hyperparameters are the same as for sparse networks (except that we do not perform any pruning here): 90 epochs etc. Results are in Figure 5.

J MAIN RELATED WORKS

Given the extent of the literature on generalization bounds, we apologize in advance for papers the reader may find missing below. The legend indicates the size of the subset considered, e.g. 1/m corresponds to 1/m of 99% of ImageNet, leaving the other 1% out for validation. The color also indicates the size of the subset: from small (black) to large (yellow). (Golowich et al., 2018, Theorem 4.3) is a bound that holds for ReLU feedforward neural networks with no biases (no max and no identity neurons) and it depends on the product of operators' norms of the layers. It has the merit of having no dependence on the size of the architecture (depth, width, number of neurons etc.). However, it requires an additional assumption: each layer must have an operator norm bounded from below, so that it only applies to a restricted set of feedforward networks. Moreover, it is unclear whether such an assumption is desirable: there are networks with arbitrary small operators' norms that realize the zero function, and the latter has a generalization error equal to zero. Theorem 8 in [START_REF] Kawaguchi | Generalization in deep learning[END_REF] gives a generalization bound for scalar-valued (d out = 1) models with an output of the form ⟨Φ(θ), A(θ ′ , x)x⟩ for some specific parameters θ, θ ′ that have no reason to be equal. This is orthogonal to the case of neural networks where one must have θ = θ ′ , and it is therefore not included in Table 1. Theorem 5 in [START_REF] Kawaguchi | Generalization in deep learning[END_REF]) can be seen as a possible first step to derive a bound based on path-norm in the specific case of the mean squared error loss. However, as discussed in more details below, (Kawaguchi et al., 2017, Theorem 5) is a rewriting of the generalization error with several terms that are as complex to bound as the original generalization error, resulting in a bound being as hard as the generalization error to evaluate/estimate. More details about Theorem 5 in [START_REF] Kawaguchi | Generalization in deep learning[END_REF] We start by re-deriving Theorem 5 in [START_REF] Kawaguchi | Generalization in deep learning[END_REF]. In the specific case of mean squared error, using that ∥R θ (x) -y∥ 2 2 = ∥R θ (x)∥ 2 2 + ∥y∥ 2 2 -2 ⟨R θ (x), y⟩ , it is possible to rewrite the generalization error as follows: generalization error of θ(Z) =E ∥R θ(Z) ( X) -Ỹ∥ 2 2 |Z -

1 n n i=1 ∥R θ(Z) (X i ) -Y i ∥ 2 2 =E ∥R θ(Z) ( X)∥ 2 2 |Z - 1 n n i=1 ∥R θ(Z) (X i )∥ 2 2 + E ∥ Ỹ∥ 2 2 |Z - n i=1 ∥Y i ∥ 2 2 -2E R θ(Z) ( X), Ỹ |Z - 1 n n i=1 R θ(Z) (X i ), Y i .
It is then possible to make the L 2 path-norm appear. For instance, for one-dimensional output networks, it can be proven (see Lemma A.1) that R θ (x) = ⟨Φ(θ), z(x, θ)⟩ with Φ(θ) the pathembedding of parameters θ, and z that typically depends on the path-activations and the input, so that the first term above can be rewritten

Φ( θ(Z)) T E z( X, θ(Z))z( X, θ(Z)) T |Z - 1 n n i=1
z(X i , θ(Z))z(X i , θ(Z)) T Φ( θ(Z)).

Let us call a "generalization error like quantity" any term of the form

E f θ(Z) ( Z)|Z - 1 n n i=1 f θ(Z) (Z i ),
that is, any term that can be represented as a difference between the estimator learned from training data Z evaluated on test data Z, and the evaluation on the training data. We see that the derivation above replaces the classical generalization error with two others quantities similar in definition to the generalization error. This derivation, which is specific to mean squared error, leads to Theorem 5 in [START_REF] Kawaguchi | Generalization in deep learning[END_REF]. Very importantly, note that this derivation trades a single quantity similar to generalization error for two new such quantities. [START_REF] Kawaguchi | Generalization in deep learning[END_REF] does not discuss how to bound these two new terms, but without any further new idea, there is no other way than the ones developed in the literature so far: reduce the problem to bounding a Rademacher complexity (as it is done in Theorem 3.1), or use the PAC-Bayes framework, and so on.

More on numerical evaluation of path-norm (Dziugaite, 2018, Section 2.9.1) reports numerical evaluations after 5 epochs of SGD on a one hidden layer network trained on a binary variant of MNIST. (Furusho, 2020, Figure 9 and Section 3.3.1) deals with 1d regression with 5 layers and 100 width. (Zheng et al., 2019) experiments on MNIST. Note that it is not clear whether (Zheng et al., 2019) reports the path-norm as defined in Definition A.1. Indeed, (Zheng et al., 2019) quotes both [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF] and (Neyshabur et al., 2017) when refering to the path-norm, but these two papers have two different definitions of the path-norm, as (Neyshabur et al., 2017) normalize it by the margin while [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF] does not.

For completeness, let us also mention that [START_REF] Karolina Dziugaite | In search of robust measures of generalization[END_REF][START_REF] Jiang | Fantastic generalization measures and where to find them[END_REF] reports whether the path-norm correlates with the empirical generalization error or not, but do not report the numerical values. (Neyshabur et al., 2017) reports the path-norm normalized by the margins, but not separately from each other.

Inherent limitations of uniform convergence bounds Theorem 3.1 has some inherent limitations due to its nature. It is data-dependent as it depends on the input distribution. However, it does not depend on the label distribution, making it uninformative as soon as Θ is so much expressive that it can fit random labels. Networks that can fit random labels have already been found empirically (Zhang et al., 2021), and it is open whether this stays true with a constraint on the path-norm.

Theorem 3.1 is based on a uniform convergence bound 10 as any other bound also based on a control of a Rademacher complexity. (Nagarajan & Kolter, 2019) empirically argue that even the tightest uniform convergence bound holding with high probability must be loose on some synthetic datasets.

If this was confirmed theoretically, this would still allow uniform bounds to be tight when considering other datasets than the one in (Nagarajan & Kolter, 2019), such as real-world datasets, or when the estimator considered in (Nagarajan & Kolter, 2019) is not in Θ (for instance because of constraints on the slopes via the path-norm).

Finally, Theorem 3.1 can provide theoretical guarantees on the generalization error of the output of a learning algorithm, but only a posteriori, after training. In order to have a priori guarantees, one should have to derive a priori knowledge on the path-norm at the end of the learning algorithm.

Comparison to PAC-Bayes bounds Another interesting direction to understand generalization of neural networks is the PAC-Bayes framework [START_REF] Guedj | A primer on PAC-Bayesian learning[END_REF][START_REF] Alquier | User-friendly introduction to PAC-Bayes bounds[END_REF]. Unfortunately, PAC-Bayes bounds cannot be exactly computed on networks that are trained in a usual way. Indeed, these bounds typically involve a KL-divergence, or something related, for which there is no closed form except for very specific distributions (iid Gaussian/Cauchy weights...) that do not correspond to the distributions of the weights after a usual training 1112 . We are aware of two research directions that try to get over this issue. The first way is to change the learning algorithm by enforcing the weights to be iid normally distributed, and then optimize the parameters of these normal distributions, see for instance the pioneer work [START_REF] Gintare | Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many more parameters than training data[END_REF]. The merit of this new learning algorithm is that it has explicitly been designed with the goal of having a small generalization error. Practical performance are worse than with usual training, but this leads to networks with an associated nonvacuous generalization bound. To the best of our knowledge, this is the only way to get a nonvacuous bound 13 , and unfortunately, this does not apply to usual training. The second way to get over the intractable evaluation of the KL-divergence is to 1) try to approximate the bound within reasonable time, and 2) try to quantify the error made with the approximation (Pérez & Louis, 2020). Unfortunately, to the best of our knowledge, approximation is often based on a distribution assumption of the weights that is not met in practice (e.g. iid Gaussian weights), approximation is costly, and the error is unclear when applied to networks trained usually. For instance, the bound in (Pérez & Louis, 2020, Section 5) 1) requires at least O(n 2 ) operations to be evaluated, with n being the number of training examples, thus being prohibitive for large n (Pérez & Louis, 2020, Section 7), and 2) it is unclear what error is being made when using a Gaussian process as an approximation of the neural network learned by SGD.

  , Proposition 7) one hidden layer, no biases, dout = 1 ∥Φ(θ)∥1 ⩽ r LB √ n × r log(d in ) (Neyshabur et al., 2015, Corollary 7) DAG, no biases, dout = 1 ∥Φ(θ)∥1 ⩽ r LB √ n × 2 D r log(d in ) (Golowich et al., 2018, Theorem 3.2)

Figure 1 :

 1 Figure 1: Example of a network where one must replace the max-pooling neuron to compute the path-norm with a single forward pass as in Equation (4).

Lemma D. 2 .

 2 Consider a neural network architecture as in Definition 2.1 with an associated set Θ of parameters θ such that v∈Nout ∥θ →v ∥ 1 + |b v | ⩽ r. Consider a family of independent Rademacher variables (ε j ) j∈J with J that will be clear from the context. Consider a non-decreasing function G : R → R ⩾0 . Consider a new neuron b (for bias) and set by convention x b = 1 for every input x.

  , and where b (for bias) is an added neuron for which we set by convention x b = 1 for any input x. Denote σ(x)

  Consider a class c ∈ {1, . . . , C} and take y ∈ {0, 1} C to be a one-hot encoding of c (meaningthat y c ′ = 1 c ′ =c ). Consider an exponent p ∈ [1, ∞] with conjugate exponent p ′ (1/p + 1/p ′ = 1). The function f : x → ℓ(x, y) =c y c log exp(xc) C c ′ =1 exp(x c ′ ) exp(x c ′ )

Figure 3 :

 3 Figure 3: Distribution of the margins on the training set of ImageNet, with the pretrained ResNets available on PyTorch.

Figure 4 :

 4 Figure4: L q path-norm (q = 1, 2, 4), test top 1 accuracy, training top 1 accuracy, and the top 1 generalization error (difference between test top 1 and train top 1) during the training of a ResNet18 on ImageNet. The pruning iteration is indicated in legend, with 0 corresponding to the dense network. The color also indicates the degree of sparsity: from dense (black) to extremely sparse (yellow).

Figure 5 :

 5 Figure 5: L 1 path-norm, and empirical generalization errors for both the top-1 accuracy and the cross-entropy during the training of a ResNet18 on a subset of the training images of ImageNet.The legend indicates the size of the subset considered, e.g. 1/m corresponds to 1/m of 99% of ImageNet, leaving the other 1% out for validation. The color also indicates the size of the subset: from small (black) to large (yellow).

  . Consider a general DAG ReLU network as in Definition 2.1 without biases, with input dimension d in and output dimension d out . Denote by D its depth (the maximal length of a path from an input to an output) and by K its maximal kernel size (i.e. the maximum of | ant(u)| over all neurons u ∈ N * -pool ), with K = 1 by convention when there is no * -max-pooling neuron. Define P := |{k ∈ N >0 , ∃u ∈ N k-pool }| as the number of different types of * -max-pooling neurons in G. Consider any loss function ℓ : R dout

Table 2 :

 2 Numerical evaluations on ResNets and ImageNet1k with 2 significant digits. Multiplying by the Lipschitz constant L of the loss and the path-norm gives the bound in Theorem 3.1. The second line reports the values when the analysis is sharpened for max-pooling neurons, see Remark 3.1.

	ResNet	18	34	50	101	152
	4 √ n CB = n C sharpened B = 4 √	0.088 0.060	0.11 0.072	0.14 0.082	0.19 0.11	0.23 0.13

Table 3 :

 3 Path-norms of pretrained ResNets available on PyTorch, computed in float32.

	ResNet	18	34	50	101	152
	∥Φ

  ). A plausible candidate is Leaky ReLU. For smooth approximations of the ReLU such as the SiLU (for Efficient Nets) and the Hardswish (for MobileNet-V3), parts of the technical lemmas related to contraction may extend since they are Lipschitz, but rescalings would not as these activations are not positively homogeneous. Chiyuan Zhang, Samy Bengio, Moritz Hardt, Benjamin Recht, and Oriol Vinyals. Understanding deep learning (still) requires rethinking generalization. Commun. ACM, 64(3):107-115, 2021. doi: 10.1145/3446776. URL https://doi.org/10.1145/3446776. (Path-embedding and path-activations). Consider a DAG ReLU neural network architecture G as in Definition 2.1 and parameters θ associated with G. Call a path of G any sequence of neurons v 1 , . . . , v d such that v i → v i+1 is an edge. This includes paths p reduced to a single v ∈ N out . Denote P G the set of paths ending at an output neuron of G. For p ∈ P G ,

	Shuxin Zheng, Qi Meng, Huishuai Zhang, Wei Chen, Nenghai Yu, and Tie-Yan Liu. Capac-
	ity control of ReLU neural networks by basis-path norm. In The Thirty-Third AAAI Con-
	ference on Artificial Intelligence, AAAI 2019, The Thirty-First Innovative Applications of Ar-
	tificial Intelligence Conference, IAAI 2019, The Ninth AAAI Symposium on Educational Ad-
	vances in Artificial Intelligence, EAAI 2019, Honolulu, Hawaii, USA, January 27 -Febru-Definition A.1
	ary 1, 2019, pp. 5925-5932. AAAI Press, 2019. doi: 10.1609/aaai.v33i01.33015925. URL
	https://doi.org/10.1609/aaai.v33i01.33015925.

  Moreover, Theorem 3.1 can be used to bound the generalization error associated with ℓ γ with L = 2/γ. This proves the claim. Details for Table 2. All the experiments are done on ImageNet-1k using 99% of the 1,281,167 images of the training set for training, the other 1% is used for validation. Thus, n = 1268355 = ⌊0.99 × 1281167⌋ in our experiments, d in = 224 × 224 × 3 = 150528, d out = 1000. We also estimated B = 2.640000104904175 by taking the maximum of the L ∞ norms of the training images normalized for inference 7 . The PyTorch code for normalization at inference is standard:

		I DETAILS ON THE EXPERIMENTS OF SECTION 4
	1 inference_normalization = transforms.Compose([
	2	transforms.Resize(256),
	3	transforms.CenterCrop(224),
	4	transforms.ToTensor(),
	5	transforms.Normalize(mean=[0.485, 0.456, 0.406], std=[0.229,
		0.224, 0.225]),

6

])

Table 4 :

 4 Table 4 details the relevant values related to basic blocks. Number of basic blocks, of convolutional layer per basic blocks and associated D for ResNets (He et al., 2016, Table 1). Pretrained ResNets. The PyTorch pretrained weights that have been selected are the ones with the best performance: ResNetX_Weights.IMAGENET1K_V1 for ResNets 18 and 34, and ResNetX_Weights.IMAGENET1K_V2 otherwise.

	ResNet	18 34 50 101 152
	# basic blocks	8	16	33	50
	# conv per basic block	2		3
	D	18 34 50 101 152

For an index set I, denote R I = {(θi)i∈I , θi ∈ R}.

Because of positive-homogeneity of the considered activations functions, the realized function is preserved[START_REF] Stock | An embedding of ReLU networks and an analysis of their identifiability[END_REF] when the incoming weights and the bias of a neuron are multiplied by λ > 0, while its outgoing weights are divided by λ. Path-norms inherit such symmetries and are further invariant to certain neuron permutations, typically within each layer in the case of feedforward networks.

Classical concentration results[START_REF] Boucheron | Concentration inequalities[END_REF] can be used to deduce a bound that holds with high probability under additional mild assumptions on the loss.

A vector y is a one-hot encoding of a class c if y = (1 c ′ =c ) c ′ ∈{1,...,dout} .

The choice of a specific w has no importance, unlike when defining the activations of k-max-pooling neurons.

The constant σ in Theorem 3.1 corresponds to data Zi drawn from the distribution for which we want to evaluate the test error. This is then the data normalized for inference. Thus, the training loss appearing in Theorem 3.1 is also evaluated on the training data Zi normalized for inference. In the experiments, we ignore this fact and still evaluate the training loss on the data augmented for training. Moreover, note that it is not possible to recover the training images augmented for training from the images normalized for inference, because cropping is done at random for training. Thus, the real life estimator is not a function of the images Zi normalized for inference, and Theorem 3.1 does not apply stricto sensu. This fact is ignored here.

A data margin is negative if and only if it is misclassified.

(E et al., 2022) starts from the fact that the infinite-depth limits of residual networks can be characterized with partial differential equations. Then,(E et al., 2022) establishes a bound for functions characterized by similar, but different, partial differential equations, using what seems to be an analogue of path-norm for these new functions. However, even if the characterizations of these functions are closed, as it is said in(E et al., 2022), "it is unclear how the two spaces are related".

ACKNOWLEDGMENTS

This work was supported in part by the AllegroAssai ANR-19-CHIA-0009 and NuSCAP ANR-20-CE48-0014 projects of the French Agence Nationale de la Recherche.

The authors thank the Blaise Pascal Center for the computational means. It uses the SIDUS (Quemener & Corvellec, 2013) solution developed by Emmanuel Quemener.

Supplementary material

A MODEL'S BASICS

The next definition introduces the path-embedding and the path-activations associated with the general model described in Definition 2.1.

Previous definitions of the path-embedding and the path-activations In the work of (Kawaguchi et al., 2017, Section 5.1) the path-embedding and the path-activations are evoked in the case of a ReLU DAG with max-pooling neurons and no biases, but with no explicit definitions. Definition A.1 gives a formal definition for these objects, and extend it to the case where there are biases, which requires extending the path-embedding to paths starting from neurons that are not input neurons. Moreover, Definition A.1 extends it to arbitrary k-max-pooling neurons (classical max-pooling neurons correspond to k = 1).

Note also that the formula Equation ( 1) is stated in the specific case of (Kawaguchi et al., 2017, Section 5.1) (as an explicit sum rather than an inner product), without proof since the objects are not explicitly defined in [START_REF] Kawaguchi | Generalization in deep learning[END_REF].

A formal definition of the path-embedding is given in the specific case of ReLU feedforward neural networks with biases in the work of (Stock & Gribonval, 2022, Definition 6). Moreover, it is proved that Equation (1) holds in this specific case in (Stock & Gribonval, 2022, Corollary 3). Definition A.1 and Equation (1) generalize the latter to an arbitrary DAG with * -max-pooling or identity neurons (allowing in particular for skip connections, max-pooling and average-pooling).

The rest of the works we are aware of only define and consider the norm of the path-embedding, but not the embedding itself. The most general setting being the one of [START_REF] Behnam Neyshabur | Norm-based capacity control in neural networks[END_REF] with a general DAG, but without max or identity neurons, nor biases. Not defining the path-embedding and the path-activations makes notations arguably heavier since Equation ( 1) is then always written with an explicit sum over all paths, with explicit product of weights along each path, and so on.

Previous generalization bounds based on path-norm See Table 1 for a comparison. Appendix K tackles some other bounds that do not appear in Table 1.

Empirical evaluation of path-norm

The formula given in Theorem A.1 is the first one to fully encompass modern networks with biases, average/ * -max-pooling, and skip connections, such as ResNets. An equivalent formula is stated for ReLU feedforward networks without biases (and no pooling/skip connections) in (Dziugaite et al., 2020, Appendix C.6.5) and (Jiang et al., 2020, Equations (43) and ( 44)) but without proof. Actually, this equivalent formula turns out to be false when there are * -max-pooling neurons as one must replace * -max-pooling neurons with identity ones, see Theorem A.1. Care must also be taken with average-pooling neurons that must be rescaled by considering them as identity neurons.

We could not find reported numerical values of the path-norm except for toy examples (Dziugaite, 2018;[START_REF] Furusho | Analysis of Regularization and Optimization for Deep Learning[END_REF]Zheng et al., 2019). Details are in Appendix K.

Appendix K also discusses 1) inherent limitations of Theorem 3.1 which are common to many generalization bounds, and 2) the applicability of Theorem 3.1 compared to PAC-Bayes bounds.

K MORE RELATED WORKS

More generalization bounds using path-norm (E et al., 2022) establishes an additional bound to the one appearing in Table 1, for a class of functions and a complexity measure that are related to the infinite-depth limits of residual networks and the path-norm. However, it is unclear how this result implies anything for actual neural networks with the actual path-norm 9 .

The bound in (Zheng et al., 2019) holds only for ReLU feedforward neural networks (no max or identity neurons) with no biases and it grows exponentially with the depth of the network. It is not included in Table 1 because it requires an additional assumption: the coordinates of the pathembedding must not only be bounded from above, but also from below. The reason for this assumption is not discussed in (Zheng et al., 2019), and it is unclear whether this is at all desirable, since a small path-norm can only be better for generalization in light of Theorem 3.1.