ℓ0-Ball Convex Hull for Robust Neural Verification

• The topic defines the ℓ0-ball as a nonconvex set formed by a union of coordinate-flats and describes its convex hull via an intersection with a scaled ℓ1-polytope.
• It details how the convex hull is obtained by intersecting the axis-aligned bounding box with an asymmetrically scaled ℓ1-like polytope, achieving tighter relaxations than traditional methods.
• The analysis introduces a computationally efficient top‑k strategy that significantly improves neural network robustness verification against sparse adversarial attacks.

The convex hull of an $\ell_0$-ball is a central object in the formal verification of neural network robustness against few-pixel (sparse) adversarial attacks. Unlike the convex and well-understood $\ell_p$-balls for $p\geq1$, the $\ell_0$-ball comprises a finite union of $k$-dimensional flats in $\mathbb{R}^n$ and is highly nonconvex for $k<n$. Recent work establishes that the convex hull of an $\ell_0$-ball can be described precisely as the intersection of its axis-aligned bounding box and an asymmetrically scaled $\ell_1$-like polytope, enabling tight geometric and computational characterizations that outperform previous relaxations in both accuracy and tractability (Shapira et al., 13 Nov 2025).

1. Definition and Nonconvexity of the $\ell_0$-Ball

In $\mathbb{R}^n$, the centered $\ell_0$-ball of radius $k$ about a reference point $\bar{x}$ is

$$B_0(k) = \{ x \in \mathbb{R}^n\ :\ \|x - \bar{x}\|_0 \leq k \}$$

where $\|x\|_0$ denotes the number of nonzero coordinates in $x$. Geometrically, $B_0(k)$ consists of all points differing from $\bar{x}$ in at most $k$ coordinates, forming a union of all $k$-dimensional axis-aligned subspaces ("coordinate-flats"). For $k < n$, this set is highly nonconvex and discrete in structure, posing challenges in the application of standard convex relaxation techniques used in neural network robustness certification.

2. Convex Hull Characterization via Intersection

To analyze and exploit $B_0(k)$ for verification, it is necessary to work with its convex hull. Let each coordinate $x_i$ be constrained within $[a_i, b_i]$ and define the ambient box $D = \prod_{i=1}^n [a_i, b_i]$. The convex hull is shown to satisfy:

$\mathrm{Conv}(B_0(k)) = D \cap \widetilde{V}_1(k)$

where $\widetilde{V}_1(k)$ is a "scaled $\ell_1$-polytope," given by

$$\widetilde{V}_1(k) = \left\{ y \in \mathbb{R}^n:\ \sum_{i=1}^n \delta_i(y) \leq k \right\}$$

with

$$\delta_i(y) = \begin{cases} 0 & y_i = \bar{x}_i \ \frac{y_i - \bar{x}_i}{b_i - \bar{x}_i} & y_i > \bar{x}_i \ \frac{y_i - \bar{x}_i}{a_i - \bar{x}_i} & y_i < \bar{x}_i \end{cases}$$

Each $\delta_i(y)$ measures, asymmetrically, how far the $i$th coordinate moves away from $\bar{x}_i$, normalized over its permissible interval. The intersection $D \cap \widetilde{V}_1(k)$ excludes those points of the box requiring more than $k$ coordinates to be displaced maximally, thus tightly bounding the convex hull of the sparse attack set.

3. Geometric Properties and Volume Analysis

A direct orthant-decomposition gives closed-form volume formulas:

• $$V := \operatorname{Vol}(D) = \prod_{i=1}^n (b_i - a_i)$$.
• $$\operatorname{Vol}(\widetilde{V}_1(k)) = V \cdot k^n / n!$$
• $$\operatorname{Vol}(D \cap \widetilde{V}_1(k)) = V \cdot (k^n / n!) \cdot \sum_{r=0}^{k-1} (-1)^r \binom{n}{r} (1 - r/k)^n$$.

The ratio of excess volume between $\widetilde{V}_1(k)$ and $D \cap \widetilde{V}_1(k)$ tends to zero exponentially as $n \to \infty$ (fixed $k$), demonstrating that $\mathrm{Conv}(B_0(k))$ is a geometrically tight superset of $B_0(k)$ for high-dimensional input spaces. In contrast, the bounding box $D$ includes a super-polynomial excess in volume as dimension increases, leading to significant looseness when used for adversarial budget relaxation.

4. Exact Linear Bound Propagation over $\mathrm{Conv}(B_0(k))$

Propagation of affine bounds through neural networks typically relies on overapproximating the perturbation domain. For any linear form $\ell(y) = w \cdot y + c$ over $\mathrm{Conv}(B_0(k))$: Let

$$d^-_i = \min\{ w_i(b_i - \bar{x}_i),\ w_i(a_i - \bar{x}_i) \}, \quad d^+_i = \max\{ w_i(b_i - \bar{x}_i),\ w_i(a_i - \bar{x}_i) \}$$

The minimum and maximum optimizer is given by: $$\min_{y \in \mathrm{Conv}(B_0(k))} w \cdot y + c = w \cdot \bar{x} + c + \sum_{j=1}^k \text{Smallest}_{j}\{ d^-_i \}$$

$$\max_{y \in \mathrm{Conv}(B_0(k))} w \cdot y + c = w \cdot \bar{x} + c + \sum_{j=1}^k \text{Largest}_{j}\{ d^+_i \}$$

where $\text{Smallest}_{j}$ and $\text{Largest}_{j}$ denote the $j$th smallest/largest entries among $\{d^-_i\}$ and $\{d^+_i\}$, respectively. Thus, the propagation procedure simply selects the top-$k$ coordinates with the most extreme contributions, matching the combinatorial nature of $B_0(k)$ itself.

5. Algorithmic Integration and Comparative Analysis

In practical neural network verification settings, these "top-$k$" updates are integrated into standard linear-bound propagation frameworks (e.g., GPUPoly), replacing the $O(n)$ sign-checks used for $\ell_\infty$ or $\ell_1$ domains. All other GPU-friendly sum-and-reduce kernels remain intact except for parallel tracking of the $k$ extremal $d_i$ values.

Comparison of relaxation techniques for bounding $\ell(y)$ yields:

Relaxation	Bound Method	Tightness/Empirical Performance
Box-only	Sum all $d^-_i$ values	Gross over-approximation, adversary over-limited
Pure $\ell_1$	Multiply largest $|d^-_i|$ by $k$	Looser than actual top-$k$, poorly modeled limits
Conv($B_0(k)$)	Sum top-$k$ extremal $d^-_i$ or $d^+_i$	Tight domain, empirically 3x–7x more properties proven

On MNIST, Fashion-MNIST, and CIFAR-10 benchmarks, the top-$k$ propagation method proves $3\times$–$7\times$ as many local-robustness properties within the same time budget.

6. Geometric and Computational Advantages

$\mathrm{Conv}(B_0(k))$ is strictly smaller than both the bounding box and the $\ell_1$-relaxation, deviating on only a negligible fraction of the box's total volume for typical high-dimensional inputs. Algorithmically, optimal linear-programming over $\mathrm{Conv}(B_0(k))$ requires only $O(n\log k)$ or $O(n)$ time by top-$k$ selection, matching the efficiency of existing sum-reduce primitives and avoiding the combinatorial explosion associated with the $k$-flat union in $B_0(k)$ itself.

7. Implications and Application in Robustness Pipelines

The precise geometric and computational properties of $\mathrm{Conv}(B_0(k))$ enable a robust certified-robustness pipeline for $\ell_0$ attacks on deep networks that is both tighter and computationally faster than prior box- or $\ell_1$-based relaxations. In practice, this improvement leads to substantially tighter neuron-range estimates in bound-propagation designs, significantly accelerating verification designs (including CAV/CAVerification stages) without scalability loss.

A plausible implication is the generalization of these characterizations to broader sparse perturbation models or other structured nonconvex sets, as the intersection-of-box-and-polytope principle offers a template for tight approximations within convex formal verification frameworks.