Deep Learning in Practice / Advanced Deep Learning

Contents

• Introduction and overview
• 0. Review: risk, gradients and the training loop
• 1. Deep learning versus classical machine learning and optimisation
• 2. Architectures: residual networks, attention, sets and graphs
• 3. Interpretability, visualisation and biases
• 4. Small or noisy data: forms of weak supervision
• 5. Modelling: deep learning, physics and control
• 6. Generative models: VAE, GAN and normalizing flows
• 7. Auto-ML: automatic hyper-parameter tuning
• 8. Guarantees? Generalisation and formal proofs
• 9. Research directions and open problems
• Exercises
• Projects and assessment
• References

Introduction and overview

Audience: a student who has taken a first deep-learning course, can train a network in PyTorch, and now wants to know why training works, when it fails, and how to make it work on data that is small, noisy, biased or governed by physics.

Empirical first: trained on 1 257 handwritten digits, a network with 38 410 parameters reaches 97 % test accuracy, yet it fits the same digits with randomly shuffled labels just as perfectly, at 9 % test accuracy (ch. 1). A classical capacity bound cannot tell the two runs apart; this course explains what can, and what to do in practice.

Deep learning works far better than its classical theory predicts, yet networks are hard to train, hard to explain and easily biased. Real problems rarely fit the textbook setting either: data are scarce or noisy, and physical laws are known. This course gives mathematical tools for these practical aspects. It continues the semester-1 Deep Learning course and shares tools with Theoretical Foundations of Deep Learning, Multimodal Explainable AI, Responsible Machine Learning and Learning Physical Phenomena.

What you will be able to do

• Explain why parameter counts and uniform capacity bounds fail to predict the test error of deep networks, and reproduce the random-label experiment.
• Prove that over-parameterised least squares trained by gradient descent converges to the minimum-norm interpolator, and reproduce double descent.
• Choose an architecture from the symmetries of the data: residual blocks, attention, Deep Sets for sets and graph attention for graphs.
• Compute and criticise attribution maps: gradients, integrated gradients, Grad-CAM, occlusion, with sanity checks.
• Audit a model for an undesired dependence on a sensitive attribute, with fairness criteria and counterfactual tests, and reduce it.
• Train with few labels, coarse labels or noisy labels, using semi-supervised losses, loss correction, robust losses and multiple-instance pooling.
• Build invariances and physical laws into a model: group convolutions, physics-informed losses for PDEs, Hamiltonian networks.
• Derive and implement the three classical deep generative models: variational auto-encoders, GANs and normalizing flows.
• Tune hyper-parameters automatically with random search, Bayesian optimisation and successive halving.
• State a generalisation bound for networks, and certify a prediction formally with Lipschitz bounds, interval propagation or a mixed-integer program.

Official objectives and syllabus (2026–2027)

The course description on master-mva.com starts from a diagnosis. Despite impressive results, deep learning methods are still poorly understood, networks are often difficult to train, and their results are black boxes. This is a problem given the societal impact of machine learning: it assists decisions in medicine, hiring and bank loans. Real problems also rarely fit the assumptions of the best-known academic work, for instance in data quantity and quality.

The course aims at insights and tools for these practical aspects, based on mathematical concepts. It first emphasises the gap between practice and classical theory, for instance in the number of parameters, and reconciles them with recent theoretical advances.

After a review of recent architectures, it studies visualisation techniques and checks that undesired biases of the data set are not reproduced, for instance a sensitivity to gender when matching CVs to job offers. It then turns to practical issues of training: data quantity, small or big; applications to reinforcement learning and to physical problems; and automatic hyper-parameter tuning.

The page lists seven themes, the organisation of the sessions, the assessment and example references. The Université Paris-Saclay course detail gives the volume and the type of assessment, with no list of contents. Each item, and each part of a composite item, has a row below.

Beyond the official items, the page adds a review of the M1 tools (ch. 0), the Hamiltonian networks of ch. 5, scaling laws in ch. 4, and a self-study chapter on research directions (ch. 9).

Where this course fits in the programme

The official prerequisites are the semester-1 “Introduction to Deep Learning” course by Vincent Lepetit, notions in machine learning, Bayesian statistics, analysis and differential calculus, and basic Python and PyTorch. Guillaume Charpiat teaches it in period 2 of semester 2, as listed on master-mva.com.

• Prerequisites — Deep Learning (semester 1, the course named by the official page), and the refreshers Probability and Statistics, Linear Algebra, Analysis and Optimization and Scientific Python, NumPy and PyTorch.
• Semester-1 courses that prepare it — Theoretical Foundations of Deep Learning (landscapes, generalisation), Probabilistic Graphical Models and Deep Generative Models (variational inference), Introduction to Statistical Learning, Convex Optimization, ALTEGRAD and Geometry Processing and Geometric Deep Learning.
• Related courses in semester 2 — Multimodal Explainable AI, Responsible Machine Learning, Learning Physical Phenomena, Generative Models for Images, Reinforcement Learning, Bayesian Machine Learning, Graphs in Machine Learning and Training and Deploying Large-Scale Models.
• After the course — the practical habits of this course (baselines, ablations, seeds, sanity checks) are those of the research internship.

Course outline

• Review: risk, gradients and the training loop — empirical risk, bias and variance, backpropagation, the descent lemma and a PyTorch training loop.
• Deep learning versus classical machine learning and optimisation — why parameter counts mislead, over-parameterised optimisation, implicit bias, double descent, mimic learning.
• Architectures — residual blocks and normalisation, attention, networks on sets (Deep Sets) and on graphs (graph attention).
• Interpretability, visualisation and biases — attribution maps and their axioms, sanity checks, fairness criteria, counterfactual audits and debiasing.
• Small or noisy data — the forms of weak supervision, semi-supervised learning, label noise, multiple-instance learning and the big-data regime.
• Modelling: deep learning, physics and control — invariances, physics-informed losses for PDEs, Hamiltonian structure, deep reinforcement learning.
• Generative models — variational auto-encoders, generative adversarial networks and normalizing flows.
• Auto-ML — random search, Bayesian optimisation, successive halving, architecture search.
• Guarantees? — generalisation bounds for networks and formal verification of their predictions.
• Research directions and open problems — feature learning, mechanistic interpretability, fairness, neural operators and scalable verification (self-study).

Session plan

24 h in class = 8 sessions of 3 h.

The volume is that of the Université Paris-Saclay programme table: 12 h of lectures and 12 h of tutorials. The plan therefore pairs, in each session, 1 h 30 of lecture with 1 h 30 of exercises in PyTorch. master-mva.com lists seven themes but no session calendar; this split is a proposal.

The plan follows the order of the official objective, which reviews architectures before visualisation techniques. It thus swaps the second and third themes of the list, because Grad-CAM and attention maps need the architectures of ch. 2.

Level 1 = foundations (reviews, definitions, first worked examples), 2 = core methods and their proofs, 3 = advanced material close to current research; the level never decreases from one session to the next.

Self-study, outside the 24 h (about 3 h in total): ch. 9 Research directions and open problems (≈ 3 h).

How to study this module

• Read the chapters in order: each one uses only the previous ones. Chapter 0 can be skimmed by a reader fluent in backpropagation and maximum likelihood.
• After each session, do the exercises of its row in the plan, then run the Python block of the chapter and change one setting: a width, a noise rate, a step size.
• The Python environment is the one of the scientific Python refresher: NumPy, SciPy, scikit-learn and PyTorch on CPU. Every block uses synthetic data or the digits data set bundled with scikit-learn.
• Keep a page of formulas: the minimum-norm interpolator, the Deep Sets form, integrated gradients, the forward loss correction, the ELBO, the change of variables, expected improvement, and the PAC-Bayes bound.
• For the evaluated exercises of the official assessment, the practical sheets of the Projects and assessment section are a good rehearsal.

0. Review: risk, gradients and the training loop

Training a network means minimising an empirical risk with stochastic gradients computed by backpropagation. This chapter recalls the four M1 facts behind that sentence; every later chapter uses them.

The classical reading: a richer model lowers the bias and raises the variance, so the test error is U-shaped in the number of parameters. Chapter 1 shows where this picture breaks.

Backpropagation applies these rules from the loss back to the input, layer by layer. Reverse-mode automatic differentiation does it for any computational graph, at the cost of a few forward passes.

Stochastic gradient descent replaces the full gradient by the average over a random mini-batch of size B. This estimate is unbiased, and its variance decreases like 1/B.

Code 0.1 trains a one-hidden-layer network on the digits data set of scikit-learn (1 797 images of 8 \times 8 pixels) with mini-batch SGD and momentum.

import numpy as np
import torch
from sklearn.datasets import load_digits
from sklearn.model_selection import train_test_split
torch.set_num_threads(1)
torch.manual_seed(0)

X, y = load_digits(return_X_y=True)                     # 1797 images 8x8, 10 classes
X = torch.tensor(X / 16.0, dtype=torch.float32)
y = torch.tensor(y)
Xtr, Xte, ytr, yte = train_test_split(X, y, test_size=0.3, random_state=0)

model = torch.nn.Sequential(torch.nn.Linear(64, 256), torch.nn.ReLU(),
                            torch.nn.Linear(256, 10))
opt = torch.optim.SGD(model.parameters(), lr=0.1, momentum=0.9)
loss_fn = torch.nn.CrossEntropyLoss()                    # softmax + negative log-likelihood

def accuracy(Xs, ys):
    with torch.no_grad():
        return (model(Xs).argmax(1) == ys).float().mean().item()

for epoch in range(30):
    perm = torch.randperm(len(Xtr))
    for i in range(0, len(Xtr), 64):                     # mini-batches of 64
        idx = perm[i:i + 64]
        opt.zero_grad()
        loss = loss_fn(model(Xtr[idx]), ytr[idx])
        loss.backward()                                  # reverse-mode autodiff
        opt.step()
    if epoch % 10 == 9:
        print(f"epoch {epoch + 1:2d}  train loss {loss_fn(model(Xtr), ytr).item():.4f}"
              f"  train acc {accuracy(Xtr, ytr):.3f}  test acc {accuracy(Xte, yte):.3f}")
print("parameters:", sum(p.numel() for p in model.parameters()), " training points:", len(Xtr))

The network has 19 210 parameters for 1 257 training points. After 30 epochs it fits the training set exactly, and its test accuracy is \text{train accuracy} = 1.000, \qquad \text{test accuracy} = 0.974 . More parameters than data, zero training error, and yet good generalisation: this is the puzzle of ch. 1.

1. Deep learning versus classical machine learning and optimisation

Classical learning theory controls the test error by the size of the model class, and classical optimisation fears non-convex losses. Deep networks defy both: they have more parameters than data and non-convex losses, yet they train easily and generalise. This chapter makes the gap precise, then presents the results that reduce it.

1.1 Parameter counts and capacity

A network with p parameters stored in 32-bit floats belongs to a class of at most 2^{32p} functions, so \ln|\mathcal{F}| \approx 22.2\, p. The bound says nothing unless n is much larger than 22\, p. VC-dimension bounds behave the same way: for ReLU networks the VC dimension grows like the number of parameters times the depth, up to a logarithm (Bartlett and coauthors, 2019).

import numpy as np
import torch
from sklearn.datasets import load_digits
from sklearn.model_selection import train_test_split
torch.set_num_threads(1)

X, y = load_digits(return_X_y=True)
X = torch.tensor(X / 16.0, dtype=torch.float32)
Xtr, Xte, ytr, yte = train_test_split(X, torch.tensor(y), test_size=0.3, random_state=0)
g = torch.Generator().manual_seed(0)
y_rand = ytr[torch.randperm(len(ytr), generator=g)]      # labels shuffled: no signal left

for name, labels in [("true labels", ytr), ("random labels", y_rand)]:
    torch.manual_seed(0)
    net = torch.nn.Sequential(torch.nn.Linear(64, 512), torch.nn.ReLU(),
                              torch.nn.Linear(512, 10))  # 38 410 parameters for 1257 points
    opt = torch.optim.Adam(net.parameters(), lr=1e-2)
    for step in range(500):                              # full-batch training
        opt.zero_grad()
        loss = torch.nn.functional.cross_entropy(net(Xtr), labels)
        loss.backward()
        opt.step()
    with torch.no_grad():
        tr = (net(Xtr).argmax(1) == labels).float().mean().item()
        te = (net(Xte).argmax(1) == yte).float().mean().item()
    print(f"{name:13s}  train acc {tr:.3f}  test acc {te:.3f}  final loss {loss.item():.4f}")

The same network, optimiser and number of steps give \text{true labels: train } 1.000,\ \text{test } 0.972; \qquad \text{random labels: train } 1.000,\ \text{test } 0.089 .

The class of functions can fit anything, so a bound that depends only on the class must be vacuous for the true labels as well. What differs between the two runs is the data and the solution found. Useful explanations therefore depend on the algorithm and on the solution, through norms, margins or flatness (ch. 8).

1.2 Over-parameterised optimisation

The training loss of a network is not convex, yet gradient descent drives it to zero in the over-parameterised regime. A convenient sufficient condition replaces convexity.

Under PL, every stationary point is a global minimum, without convexity. For the squared loss of a model F : \mathbb{R}^p \to \mathbb{R}^n on the training set, with residual r = F(\theta) - y and Jacobian J, the gradient is J^\top r.

Hence the PL constant is the smallest eigenvalue of the n \times n matrix J J^\top: \|\nabla f\|^2 = \|J^\top r\|^2 \ge \lambda_{\min}(J J^\top)\, \|r\|^2 = 2\, \lambda_{\min}(J J^\top)\, f . This matrix can be non-singular only if p \ge n. Liu, Zhu and Belkin (2022) show that, for wide enough networks, it stays well conditioned in a ball around the initialisation that contains the whole trajectory.

K is the Gram matrix, on the training set, of the neural tangent kernel k(x, x') = \nabla_\theta f_{\theta_0}(x)^\top \nabla_\theta f_{\theta_0}(x'). Jacot, Gabriel and Hongler (2018) proved that, as the width tends to infinity under a suitable scaling, this kernel is deterministic and stays constant during training. The network then trains like kernel regression: the lazy regime.

Each eigendirection of K decays at the rate of its eigenvalue, so the smooth components of the target, with large eigenvalues, are fitted first. Finite networks leave the lazy regime and learn features; ch. 9 returns to this.

1.3 Implicit bias: which interpolator?

With more parameters than data, infinitely many parameter vectors fit the data exactly. The training algorithm, not the loss, selects one of them.

The algorithm thus regularises implicitly. For linear classifiers on separable data, gradient descent on the logistic loss converges in direction to the maximum-margin separator (Soudry and coauthors, 2018): again a norm is minimised without being written in the loss.

1.4 Double descent and the jamming transition

import numpy as np
rng = np.random.default_rng(0)
d, n, n_test = 20, 100, 2000
beta = rng.normal(size=d) / np.sqrt(d)

def data(m):
    X = rng.normal(size=(m, d))
    return X, np.tanh(X @ beta) + 0.1 * rng.normal(size=m)

def test_error(p, seeds=20):
    errs = []
    for _ in range(seeds):
        X, y = data(n)
        Xt, yt = data(n_test)
        W = rng.normal(size=(d, p)) / np.sqrt(d)          # random first layer, frozen
        F, Ft = np.maximum(X @ W, 0), np.maximum(Xt @ W, 0)
        a = np.linalg.pinv(F) @ y                         # least squares, minimum norm if p > n
        errs.append(np.mean((Ft @ a - yt) ** 2))
    return np.median(errs)

for p in [10, 50, 80, 95, 100, 105, 120, 200, 500, 2000]:
    print(f"p = {p:5d}   p/n = {p / n:5.2f}   test MSE = {test_error(p):8.3f}")

The test error first follows the classical U, then explodes at the interpolation threshold, then descends again: p = 50:\ 0.163, \qquad p = n = 100:\ 7.453, \qquad p = 200:\ 0.100, \qquad p = 2000:\ 0.055 .

At p = n the feature matrix is square and badly conditioned, so the interpolator has a huge norm and amplifies the noise. Beyond the threshold, the minimum-norm choice among many interpolators shrinks the norm, and the variance falls. Belkin, Hsu, Ma and Mandal (2019) named this curve double descent; Nakkiran and coauthors (2020) observed it in deep networks, as a function of width and of training time.

For deep networks, Geiger and coauthors (2019) call the threshold N^\star at which the training set can be fitted a jamming transition. Beyond it, the trained output fluctuates with the random initialisation, with a size that decreases like N^{-1/4} in the number of parameters N. The test error then decays to a plateau like N^{-1/2}.

At N^\star itself the norm of the output function diverges, which explains the cusp of the test error. Their practical advice: at a fixed computational budget, average the outputs of several networks of intermediate size just beyond N^\star, which removes the fluctuations.

1.5 Do deep nets need to be deep? Mimic learning and distillation

Ba and Caruana (2014) trained shallow networks on TIMIT and CIFAR-10. Trained on the labels, they lose clearly to deep networks. Trained to regress the logits of a deep teacher with a squared loss, shallow networks with as many parameters come close to the teacher.

Part of the advantage of depth is therefore in learning, not only in what the network can represent. Distillation (Hinton, Vinyals and Dean, 2015) generalises mimic learning with a temperature T.

The logit regression of Ba and Caruana is thus the high-temperature limit of distillation (Exercise 12).

2. Architectures: residual networks, attention, sets and graphs

An architecture is a prior: it decides which functions training reaches easily, and which symmetries hold exactly. This chapter reviews the building blocks of recent architectures, then derives the structure that the symmetries of sets and graphs impose.

2.1 Depth that trains: residual blocks and normalisation

A residual network stacks blocks x_{l+1} = x_l + F_l(x_l), where each branch F_l is a small network (He, Zhang, Ren and Sun, 2016).

With small branches at initialisation, for instance a last layer initialised at zero in each branch, the gradient neither vanishes nor explodes through hundreds of layers.

Normalisation layers rescale pre-activations. Batch normalisation (Ioffe and Szegedy, 2015) standardises each unit over the mini-batch, then applies a learnt scale and shift. Layer normalisation (Ba, Kiros and Hinton, 2016) standardises over the units of one example; transformers use it.

Two practical consequences follow. A gradient step is orthogonal to w, so by Pythagoras it increases \|w\|. And the effective learning rate is \eta / \|w\|^2: weight decay, which shrinks \|w\|, acts on such layers as a learning-rate schedule rather than as a regulariser.

2.2 Attention and transformers

The factor 1/\sqrt{d_k} keeps the scores of order one: if the entries of a query and a key are independent with mean 0 and variance 1, their dot product has variance d_k. Without it, the softmax saturates and its gradient vanishes.

Order must therefore be injected by positional encodings. A transformer is a model of sets plus positions; vision transformers apply it to the sequence of 16 \times 16 patches of an image (Dosovitskiy and coauthors, 2021).

2.3 Networks on sets: Deep Sets

Point clouds, particles of a simulation or the atoms of a molecule are sets: the order in which they are listed carries no information.

For multisets with bounded multiplicities, a larger base works the same way. For continuous inputs, Wagstaff and coauthors (2019) show that continuous \phi and \rho need a latent dimension at least equal to the size of the set: the theorem guarantees expressivity, not economy.

An equivariant Deep Sets layer is thus x \mapsto \sigma\big(\lambda x + \gamma\, (\mathbf{1}^\top x)\, \mathbf{1}\big), with matrices instead of scalars when each element carries several channels. A final sum makes the network invariant. Code 2.1 learns the variance of a set of 10 numbers, with a Deep Set and with a plain network on the list.

import torch
torch.set_num_threads(1)
torch.manual_seed(0)
n_set, n_train = 10, 500
def make(m):                                   # sets of 10 numbers; target = their variance
    X = torch.randn(m, n_set) * torch.rand(m, 1) * 2
    return X, X.var(dim=1, unbiased=False)
Xtr, ytr = make(n_train)
Xte, yte = make(2000)

class DeepSet(torch.nn.Module):                # rho( sum_i phi(x_i) )
    def __init__(self, h=64):
        super().__init__()
        self.phi = torch.nn.Sequential(torch.nn.Linear(1, h), torch.nn.ReLU(), torch.nn.Linear(h, h))
        self.rho = torch.nn.Sequential(torch.nn.ReLU(), torch.nn.Linear(h, h), torch.nn.ReLU(),
                                       torch.nn.Linear(h, 1))
    def forward(self, X):
        return self.rho(self.phi(X.unsqueeze(-1)).sum(dim=1)).squeeze(-1)

mlp = torch.nn.Sequential(torch.nn.Linear(n_set, 128), torch.nn.ReLU(), torch.nn.Linear(128, 128),
                          torch.nn.ReLU(), torch.nn.Linear(128, 1), torch.nn.Flatten(0))
for name, net in [("Deep Set", DeepSet()), ("MLP on the list", mlp)]:
    opt = torch.optim.Adam(net.parameters(), lr=3e-3)
    for step in range(1500):
        opt.zero_grad()
        loss = torch.mean((net(Xtr) - ytr) ** 2)
        loss.backward()
        opt.step()
    with torch.no_grad():
        mse = torch.mean((net(Xte) - yte) ** 2).item()
        perm = torch.randperm(n_set)
        gap = (net(Xte) - net(Xte[:, perm])).abs().max().item()
    print(f"{name:16s} params {sum(p.numel() for p in net.parameters()):6d}  "
          f"test MSE {mse:.4f}  max |f(x) - f(permuted x)| {gap:.1e}")
print("variance of the targets:", yte.var().item())

With 500 training sets, the Deep Set (8 513 parameters) reaches a test error twenty times smaller than the plain network (18 049 parameters), whose output changes when the list is reordered: \text{Deep Set: MSE } 0.0032,\ \text{gap } 10^{-6}; \qquad \text{plain network: MSE } 0.0700,\ \text{gap } 1.4 . The targets have variance 1.94. The plain network must learn the invariance from examples; the Deep Set has it for free.

2.4 Networks on graphs: graph attention

A message-passing network (Gilmer and coauthors, 2017) updates each node from an invariant aggregation of its neighbours: a Deep Set over every neighbourhood. Graph attention chooses the aggregation weights from the features.

The layer is equivariant to relabelling the nodes, by the argument of Proposition 2.4 restricted to neighbourhoods. Its cost is linear in the number of edges, and it applies to graphs unseen in training.

The graph convolutional network of Kipf and Welling (2017) uses fixed weights given by the degrees; graph attention learns them. Brody, Alon and Yahav (2022) showed that this attention is static: the ranking of the neighbours by e_{ij} is the same for every node i. They proposed a dynamic variant, GATv2.

3. Interpretability, visualisation and biases

A network that predicts well may be right for the wrong reasons: a hiring model that reads gender, a captioning model that says “man” because it sees a snowboard. This chapter gives tools to look inside a trained model, axioms to judge these tools, and methods to detect and reduce an undesired dependence on a sensitive attribute.

3.1 Attributions and their axioms

For a linear model and the baseline 0, gradient × input is complete. For a network it is not, because of saturation. The function f(x) = \min(1, x) has zero derivative at x = 2, although f(2) - f(0) = 1: the gradient misses a feature that matters.

Sensitivity follows: if only feature i differs, \mathrm{IG}_i = f(x) - f(x'). In practice the integral is a Riemann sum over 50 to 300 points, and completeness is the numerical check that the sum is fine enough.

Explanations must be tested like any estimator. Adebayo and coauthors (2018) randomise the weights of a trained network, layer by layer: a method whose map barely changes explains the input, its edges for instance, not the model. Guided backpropagation fails this sanity check; plain gradients and Grad-CAM pass it. Shapley values (Lundberg and Lee, 2017) are treated in Multimodal Explainable AI.

3.2 Biases: definitions and proxies

Let A be a sensitive attribute, such as gender, Y the true outcome and \hat Y the decision of the model.

When the base rates of the groups differ and Y is binary, demographic parity and equalised odds cannot both hold for a decision that is not independent of Y (Barocas, Hardt and Narayanan, 2023). Likewise, a score calibrated within each group cannot have equal error rates across groups, except in degenerate cases (Kleinberg, Mullainathan and Raghavan, 2017; Chouldechova, 2017). The choice belongs to the application, not to the algorithm.

With s = 0.5 the gap is 2\Phi(1) - 1 = 0.683, although \hat Y never reads A: the feature X is a proxy. A postcode, a sport or a first name plays this role in a CV.

Code 3.1 audits a CV-screening network trained on synthetic past decisions that favoured one gender, with a proxy feature correlated with gender. It measures the parity gap, the counterfactual test and integrated gradients.

import torch
torch.set_num_threads(1)
torch.manual_seed(0)
m = 4000
g = torch.randint(0, 2, (m,)).float()                    # sensitive attribute (0 or 1)
skill, exper = torch.randn(m), torch.randn(m)
proxy = g + 0.5 * torch.randn(m)                         # e.g. a club membership correlated with g
y = (skill + 0.5 * exper + 0.8 * g + 0.5 * torch.randn(m) > 0.5).float()   # biased past decisions
names = ["skill", "experience", "proxy", "gender"]

def train(X):
    torch.manual_seed(1)
    net = torch.nn.Sequential(torch.nn.Linear(X.shape[1], 32), torch.nn.ReLU(), torch.nn.Linear(32, 1))
    opt = torch.optim.Adam(net.parameters(), lr=1e-2)
    for _ in range(300):
        opt.zero_grad()
        torch.nn.functional.binary_cross_entropy_with_logits(net(X).squeeze(1), y).backward()
        opt.step()
    return net

def integrated_gradients(net, x, base, steps=256):       # Riemann sum along the segment base -> x
    t = (torch.arange(steps) + 0.5).unsqueeze(1) / steps
    path = (base + t * (x - base)).requires_grad_(True)
    torch.sigmoid(net(path)).sum().backward()
    return (x - base) * path.grad.mean(0)

for k, cols in [(4, "with gender"), (3, "gender removed")]:
    X = torch.stack([skill, exper, proxy, g], 1)[:, :k]
    net = train(X)
    with torch.no_grad():
        yhat = (net(X).squeeze(1) > 0).float()
        dp = yhat[g == 1].mean() - yhat[g == 0].mean()
        Xf = X.clone()
        if k == 4:
            Xf[:, 3] = 1 - Xf[:, 3]                       # counterfactual: flip the attribute only
        flips = ((net(Xf).squeeze(1) > 0).float() != yhat).float().mean()
    base = X.mean(0)
    ig = torch.stack([integrated_gradients(net, X[i], base) for i in range(200)])
    gap = (torch.sigmoid(net(X[:200])).squeeze(1) - torch.sigmoid(net(base))).detach() - ig.sum(1)
    print(f"{cols:15s} parity gap {dp:.3f}  counterfactual flips {flips:.3f}  "
          f"mean |IG| " + " ".join(f"{n} {v:.3f}" for n, v in zip(names, ig.abs().mean(0))) +
          f"  completeness error {gap.abs().max():.1e}")

With gender as an input, the model reproduces the historical bias: a parity gap of 0.258, and 26 % of the decisions change when only gender is flipped. Gender receives a mean attribution of 0.242.

Without gender, the counterfactual test passes trivially, yet the parity gap is still 0.144. The attribution of the proxy rises tenfold: \text{mean } |\mathrm{IG}_{\text{proxy}}| :\ 0.016 \ \longrightarrow\ 0.161 . The bias has moved to the proxy, and the attributions show where. Completeness holds to about 10^{-3}.

3.3 Reducing biases

Hendricks, Burns, Saenko, Darrell and Rohrbach (2018) observed that image-captioning models trained on COCO guess gender from context, a snowboard for a man or a kitchen for a woman. They even amplify the imbalance of the training set, as Zhao and coauthors (2017) measured for visual recognition.

Their Equalizer adds two losses to the captioning loss.

• An appearance confusion loss, on images where the person is masked out, asks for equal probabilities of the words “man” and “woman”: without the person, the model should not know.
• A confident loss, on the full images, asks for a confident gender word when the person is visible.

They evaluate the error on gender words, the ratio of predicted to true gender proportions, and a pointing game: does the Grad-CAM map of the word “woman” fall on the person? The Equalizer reduces the error and moves the maps onto the people: right for the right reasons.

Other levers act on the data, by reweighting the training set so that A and Y become independent, or on the decision, with group-wise thresholds that equalise the odds (Hardt and coauthors, 2016). Or they act on training, adversarially.

Zhang, Lemoine and Mitchell (2018) train the predictor to minimise its loss while maximising the loss of such an adversary. Giving the adversary Y as an extra input targets equalised odds instead.

4. Small or noisy data: forms of weak supervision

Benchmarks offer many clean labels; real projects rarely do. Labels are few, coarse or wrong, and at the other extreme data are so plentiful that the question becomes how to spend the compute. This chapter treats each case.

4.1 Three forms of weak supervision

4.2 Few labels

The first tool is transfer: fine-tune a network pre-trained on a large data set, possibly without labels, as in the semester-1 Deep Learning course. Data augmentation encodes known invariances (ch. 5). Then the unlabelled data can help, under the cluster assumption: the decision boundary should cross regions of low density.

Confident predictions on easy views become targets for hard views. Entropy minimisation (Grandvalet and Bengio, 2004) is the soft version: it pushes the predictions on unlabelled data towards confidence, hence the boundary away from the data. Active learning chooses instead which points to label, for instance the most uncertain ones (Settles, 2009).

4.3 Noisy labels

A network eventually memorises wrong labels, as the random labels of ch. 1 show. Arpit and coauthors (2017) observed that it fits the clean, simple patterns first, so early stopping helps. Two loss-level remedies have guarantees.

Assume class-conditional noise: the observed label \tilde y equals j with probability T_{ij} when the clean label is i, independently of x.

In practice T is estimated, for instance from anchor points: inputs that surely belong to class i, where the noisy posterior gives the row i of T.

The mean absolute error between p and the one-hot label, 2(1 - p_y), is symmetric with C = 2(K - 1); the cross-entropy is not. The price is slow training, which the generalised cross-entropy of Zhang and Sabuncu (2018) trades against robustness.

Code 4.1 resamples 60 % of the training labels of the digits uniformly, so that 55 % end up wrong, and compares three losses on the clean test set.

import torch
from sklearn.datasets import load_digits
from sklearn.model_selection import train_test_split
torch.set_num_threads(1)
X, y = load_digits(return_X_y=True)
X = torch.tensor(X / 16.0, dtype=torch.float32)
Xtr, Xte, ytr, yte = train_test_split(X, torch.tensor(y), test_size=0.3, random_state=0)
K, eta = 10, 0.6                                          # 60 % of the labels resampled
g = torch.Generator().manual_seed(0)
flip = torch.rand(len(ytr), generator=g) < eta
y_noisy = torch.where(flip, torch.randint(0, K, (len(ytr),), generator=g), ytr)
T = (1 - eta) * torch.eye(K) + eta / K                    # T[i, j] = P(noisy = j | clean = i)
print(f"labels actually wrong: {(y_noisy != ytr).float().mean():.3f}")

def loss_ce(logits, t):
    return torch.nn.functional.cross_entropy(logits, t)
def loss_forward(logits, t):                              # cross-entropy of T^T p against noisy labels
    p_noisy = torch.softmax(logits, 1) @ T
    return torch.nn.functional.nll_loss(torch.log(p_noisy), t)
def loss_mae(logits, t):                                  # || p - e_t ||_1 = 2 (1 - p_t): symmetric
    return (2 - 2 * torch.softmax(logits, 1).gather(1, t[:, None])).mean()

for name, loss_fn in [("cross-entropy", loss_ce), ("forward-corrected", loss_forward), ("MAE", loss_mae)]:
    torch.manual_seed(0)
    net = torch.nn.Sequential(torch.nn.Linear(64, 256), torch.nn.ReLU(), torch.nn.Linear(256, K))
    opt = torch.optim.Adam(net.parameters(), lr=3e-3)
    accs = []
    for step in range(1, 801):
        opt.zero_grad()
        loss_fn(net(Xtr), y_noisy).backward()
        opt.step()
        if step in (100, 800):
            with torch.no_grad():
                accs.append((net(Xte).argmax(1) == yte).float().mean().item())
    with torch.no_grad():
        fit = (net(Xtr).argmax(1) == y_noisy).float().mean().item()
    print(f"{name:18s} clean test acc after 100 steps {accs[0]:.3f}, after 800 steps {accs[1]:.3f};"
          f"  agreement with noisy train labels {fit:.3f}")

The cross-entropy memorises every noisy label, and its test accuracy collapses from 0.744 at step 100 to 0.463. The two corrected losses do not memorise: \text{forward correction: } 0.813 \to 0.722, \qquad \text{MAE: } 0.844 \to 0.811 .

4.4 Inexact labels: multiple-instance learning

In multiple-instance learning (Dietterich, Lathrop and Lozano-Pérez, 1997), a bag of instances is positive if at least one instance is. A histology slide labelled “tumour”, cut into thousands of unlabelled tiles, is a typical case. A bag classifier must be permutation-invariant, so by Theorem 2.6 it pools instance embeddings h_i.

Ilse, Tomczak and Welling (2018) learn the scores with a small network. The weights then localise the positive instances, which gives an explanation of the bag label for free.

4.5 Big data: scaling laws

With abundant data, the test loss of language models follows power laws in the number of parameters N and of training tokens D (Kaplan and coauthors, 2020). Hoffmann and coauthors (2022) fit, for a training compute C \approx 6ND floating-point operations, L(N, D) = E + \frac{A}{N^{\alpha}} + \frac{B}{D^{\beta}} .

With similar exponents, parameters and data should grow together. Their 70-billion-parameter model Chinchilla, trained on 1.4 trillion tokens (20 tokens per parameter), outperformed larger models trained on fewer tokens. At that scale the bottleneck moves to data quality: deduplication, filtering and the label noise of web data. Training and Deploying Large-Scale Models covers the systems side.

5. Modelling: deep learning, physics and control

In science much is known before any data is seen: symmetries, conservation laws, equations. This chapter injects that knowledge at three levels, the architecture, the loss and the structure of the model. It ends with reinforcement learning, where the network collects its own data.

5.1 Known invariances

Let a group G act on the inputs. A model is invariant if f(g \cdot x) = f(x) for all g, and equivariant if its output transforms along with the input. Data augmentation teaches an invariance approximately; an architecture can enforce it exactly.

The ordinary convolution is the case of translations. Rotating the input of a group-convolutional network rotates its feature maps, instead of producing unrelated ones.

5.2 Physics as a loss: solving PDEs with networks

No mesh is needed, which makes the method usable in high dimension. Physics-informed neural networks (Raissi, Perdikaris and Karniadakis, 2019) use the same residual loss and add observed data, which also solves inverse problems. Learning Physical Phenomena develops them.

Why should a small residual mean a small error? This needs a stability estimate for the PDE.

Code 5.1 solves this equation for f(x) = \pi^2 \sin(\pi x), whose solution is \sin(\pi x), with random collocation points at every step.

import math
import torch
torch.set_num_threads(1)
torch.manual_seed(0)
# Solve -u'' = pi^2 sin(pi x) on (0, 1), u(0) = u(1) = 0; exact solution u(x) = sin(pi x).
net = torch.nn.Sequential(torch.nn.Linear(1, 32), torch.nn.Tanh(), torch.nn.Linear(32, 32),
                          torch.nn.Tanh(), torch.nn.Linear(32, 1))
opt = torch.optim.Adam(net.parameters(), lr=3e-3)
sched = torch.optim.lr_scheduler.StepLR(opt, step_size=1000, gamma=0.2)
xb = torch.tensor([[0.0], [1.0]])                          # boundary points

def residual(x):                                           # r = -u'' - f, by automatic differentiation
    x = x.requires_grad_(True)
    u = net(x)
    du = torch.autograd.grad(u.sum(), x, create_graph=True)[0]
    d2u = torch.autograd.grad(du.sum(), x, create_graph=True)[0]
    return -d2u - math.pi ** 2 * torch.sin(math.pi * x)

for step in range(1, 3001):
    x = torch.rand(128, 1)                                 # fresh random collocation points (DGM)
    loss = residual(x).pow(2).mean() + 10 * net(xb).pow(2).mean()
    opt.zero_grad()
    loss.backward()
    opt.step()
    sched.step()
    if step % 1000 == 0:
        xs = torch.linspace(0, 1, 1001).unsqueeze(1)
        err = (net(xs) - torch.sin(math.pi * xs)).abs().max().item()
        print(f"step {step}  loss {loss.item():.2e}  max |u_net - u| on a grid {err:.2e}")

After 3 000 steps the maximal error on a grid of 1 001 points is \max_x |u_\theta(x) - \sin(\pi x)| = 3.8 \times 10^{-4}. With a source of high frequency the same network fails; Exercise 18 explores this spectral bias.

5.3 Physical structure: Hamiltonian networks

A conservative mechanical system has an energy H(q, p) and obeys Hamilton’s equations. Greydanus, Dzamba and Yosinski (2019) learn a scalar network H_\theta and define the dynamics from it, instead of predicting the velocities directly.

A network that predicts (\dot q, \dot p) without this structure drifts in energy over long rollouts. The numerical integrator matters too: Exercise 16 compares explicit and symplectic Euler.

5.4 Reinforcement learning: the network collects its own data

In a Markov decision process with rewards r(s, a) and discount \gamma < 1, the optimal action-value function is the fixed point of the Bellman optimality operator (\mathcal{T} Q)(s, a) = r(s, a) + \gamma\, \mathbb{E}_{s' \mid s, a}\, \max_{a'} Q(s', a').

With these two devices, one architecture with one set of hyper-parameters, trained separately on each game, learnt 49 Atari games from pixels, at a level comparable to a professional games tester on many of them. They answer two practical difficulties. The data are not independent, because they depend on the current policy: the buffer decorrelates and reuses them. The targets move with \theta: freezing \theta^- turns each phase into a regression.

Function approximation, bootstrapping and off-policy data together, the deadly triad of Sutton and Barto (2018), can still diverge. The maximum over noisy estimates is biased upwards, which Double DQN corrects (van Hasselt, Guez and Silver, 2016). Reinforcement Learning treats the theory.

6. Generative models: VAE, GAN and normalizing flows

A generative model learns a distribution p_\theta close to that of the data, to sample from it or to evaluate densities. The three classical deep families differ in how they treat the likelihood: the variational auto-encoder bounds it, the adversarial network avoids it, the flow computes it exactly. Diffusion models appear in ch. 9 and in Generative Models for Images.

6.1 Variational auto-encoders

A latent variable z \sim \mathcal{N}(0, I) is decoded by a network into p_\theta(x \mid z). The likelihood p_\theta(x) = \int p_\theta(x \mid z)\, p(z)\, dz is intractable, so an encoder q_\phi(z \mid x) approximates the posterior (Kingma and Welling, 2014; Rezende, Mohamed and Wierstra, 2014).

For a Gaussian encoder with means \mu_j and variances \sigma_j^2, the KL term has the closed form \frac12 \sum_j (\mu_j^2 + \sigma_j^2 - 1 - \log \sigma_j^2).

One sample of \varepsilon per data point gives an unbiased, low-variance gradient of the ELBO. With a Gaussian decoder, samples tend to be blurry; with a powerful decoder, the encoder may be ignored, which is called posterior collapse.

6.2 Generative adversarial networks

A generator G maps noise z to samples, and a discriminator D tells real from generated (Goodfellow and coauthors, 2014). They play \min_G \max_D\ V(D, G) = \mathbb{E}_{x \sim p_{\mathrm{d}}} \log D(x) + \mathbb{E}_{z} \log\big(1 - D(G(z))\big).

In practice the generator maximises \log D(G(z)), which gives stronger gradients early in training. Training remains delicate: the generator may cover only a few modes (mode collapse). When the two distributions have disjoint supports, the Jensen–Shannon divergence is constant and its gradient carries no information. The Wasserstein GAN (Arjovsky, Chintala and Bottou, 2017) replaces it by a transport distance. GANs have no likelihood, so they are evaluated by sample statistics such as the Fréchet inception distance (Heusel and coauthors, 2017).

6.3 Normalizing flows

A flow trains by exact maximum likelihood and samples by inverting f. The difficulty is to build maps that are expressive, easy to invert, and have cheap determinants.

The networks s and t are never inverted, so they can be as complex as needed. Code 6.1 stacks six coupling layers, alternating the coordinate left unchanged, and fits the two-moons data set of scikit-learn by maximum likelihood.

import math
import torch
from sklearn.datasets import make_moons
torch.set_num_threads(1)
torch.manual_seed(0)
X = torch.tensor(make_moons(3000, noise=0.05, random_state=0)[0], dtype=torch.float32)
X = (X - X.mean(0)) / X.std(0)
Xtr, Xte = X[:2000], X[2000:]

class Coupling(torch.nn.Module):            # y_a = x_a,  y_b = x_b * exp(s(x_a)) + t(x_a)
    def __init__(self, a):
        super().__init__()
        self.a, self.b = a, 1 - a
        self.net = torch.nn.Sequential(torch.nn.Linear(1, 64), torch.nn.ReLU(),
                                       torch.nn.Linear(64, 64), torch.nn.ReLU(), torch.nn.Linear(64, 2))
    def forward(self, x):                   # data -> latent, with log |det Jacobian|
        s, t = self.net(x[:, [self.a]]).chunk(2, dim=1)
        s = torch.tanh(s)
        y = x.clone()
        y[:, [self.b]] = x[:, [self.b]] * torch.exp(s) + t
        return y, s.squeeze(1)
    def inverse(self, y):
        s, t = self.net(y[:, [self.a]]).chunk(2, dim=1)
        x = y.clone()
        x[:, [self.b]] = (y[:, [self.b]] - t) * torch.exp(-torch.tanh(s))
        return x

layers = torch.nn.ModuleList([Coupling(i % 2) for i in range(6)])
def log_prob(x):                            # change of variables: log p(x) = log N(f(x)) + log|det J_f(x)|
    logdet = torch.zeros(len(x))
    for layer in layers:
        x, ld = layer(x)
        logdet = logdet + ld
    return -0.5 * (x ** 2).sum(1) - math.log(2 * math.pi) + logdet

opt = torch.optim.Adam(layers.parameters(), lr=2e-3)
for step in range(1, 1201):
    batch = Xtr[torch.randint(0, len(Xtr), (256,))]
    loss = -log_prob(batch).mean()
    opt.zero_grad()
    loss.backward()
    opt.step()
    if step % 400 == 0:
        with torch.no_grad():
            print(f"step {step}  test NLL per point {-log_prob(Xte).mean().item():.3f} nats")
with torch.no_grad():
    z = Xte.clone()
    for layer in layers:
        z, _ = layer(z)
    x_back = z
    for layer in reversed(layers):
        x_back = layer.inverse(x_back)
    print("max reconstruction error f^-1(f(x)) - x:", (x_back - Xte).abs().max().item())
    print("Gaussian fit of the same data, NLL:",
          (-torch.distributions.MultivariateNormal(Xtr.mean(0), torch.cov(Xtr.T)).log_prob(Xte).mean()).item())

On held-out points the flow reaches a negative log-likelihood of 1.27 nats per point, against 2.73 for the best Gaussian, and it inverts to 2 \times 10^{-6}: \mathrm{NLL}_{\text{flow}} = 1.27 \ \text{nats} \quad < \quad \mathrm{NLL}_{\text{Gaussian}} = 2.73 \ \text{nats}.

7. Auto-ML: automatic hyper-parameter tuning

Learning rate, width, depth, weight decay, augmentation: a network has many hyper-parameters, and a published gain often owes as much to tuning as to the method. Auto-ML automates the search. This chapter gives the principles that make it efficient.

7.1 The problem

Each evaluation of the outer objective costs a full training run. The objective is noisy, often not differentiable, and has cheaper approximations: fewer epochs, a subset of the data, a smaller model.

7.2 Random versus grid search

With q = 5\%, sixty trials suffice for a probability above 0.95: 1 - 0.95^{60} = 0.954 .

7.3 Bayesian optimisation

Bayesian optimisation fits a Gaussian-process surrogate to the evaluations made so far, with posterior mean \mu(\lambda) and standard deviation \sigma(\lambda), and evaluates next where an acquisition function is largest (Snoek, Larochelle and Adams, 2012).

The first term rewards a low predicted loss (exploitation), the second a high uncertainty (exploration). Code 7.1 compares a 4 \times 4 grid, random search and Bayesian optimisation with 16 evaluations each, on a validation-loss surface where only the first hyper-parameter matters, as is common for the learning rate.

import warnings
import numpy as np
from scipy.stats import norm
from sklearn.gaussian_process import GaussianProcessRegressor
from sklearn.gaussian_process.kernels import Matern
warnings.filterwarnings("ignore")                     # GP hyper-parameter fits at their bounds

def val_loss(h):     # a validation-loss surface on [0, 1]^2 where only the first coordinate matters
    return 1 - np.exp(-(h[..., 0] - 0.37) ** 2 / (2 * 0.05 ** 2)) + 0.01 * h[..., 1]

def bayes_opt(budget, rng, n_init=4):
    H = rng.random((n_init, 2))
    f = val_loss(H)
    gp = GaussianProcessRegressor(Matern(length_scale=0.2, nu=2.5), alpha=1e-6, normalize_y=True)
    while len(f) < budget:
        gp.fit(H, f)
        cand = rng.random((2000, 2))
        mu, sd = gp.predict(cand, return_std=True)
        z = (f.min() - mu) / np.maximum(sd, 1e-12)
        ei = (f.min() - mu) * norm.cdf(z) + sd * norm.pdf(z)     # expected improvement
        H = np.vstack([H, cand[np.argmax(ei)]])
        f = np.append(f, val_loss(H[-1]))
    return f.min()

budget, rng = 16, np.random.default_rng(0)
g = np.linspace(0, 1, 4)
grid = np.array([[a, b] for a in g for b in g])               # 4 x 4 grid: only 4 distinct values of h_1
print(f"grid 4 x 4      best loss {val_loss(grid).min():.3f}")
rand = [val_loss(rng.random((budget, 2))).min() for _ in range(1000)]
print(f"random search   median best loss {np.median(rand):.3f}   (1000 repetitions)")
bo = [bayes_opt(budget, rng) for _ in range(20)]
print(f"Bayesian opt.   median best loss {np.median(bo):.3f}   (20 repetitions)")

The grid tries only four learning rates and misses the optimum; random search tries sixteen, and Bayesian optimisation concentrates its last evaluations near the optimum: \text{grid: } 0.236, \qquad \text{random (median): } 0.089, \qquad \text{Bayesian optimisation (median): } 0.054 .

7.4 Successive halving, architecture search and hypergradients

Most configurations are visibly bad after a few epochs. Successive halving (Jamieson and Talwalkar, 2016) starts n configurations with a small budget, keeps the best fraction 1/\eta, multiplies their budget by \eta, and repeats.

With n = 81, \eta = 3 and one epoch to start, the rounds train 81 configurations for 1 epoch, 27 for 3, 9 for 9, 3 for 27 and 1 for 81. Each round costs 81 epochs, so the total is 5 \times 81 = 405 \text{ epochs}, \qquad \text{against } 81 \times 81 = 6\,561 \text{ for full training of all}. Hyperband (Li and coauthors, 2018) runs several such brackets with different starting budgets, to hedge against configurations that start slowly. Population-based training (Jaderberg and coauthors, 2017) lets parallel runs copy the weights of better runs and perturb their hyper-parameters during training.

Neural architecture search treats the architecture itself as a hyper-parameter. Zoph and Le (2017) trained a controller by reinforcement learning, at a very large compute cost. DARTS (Liu, Simonyan and Yang, 2019) relaxes the choice of an operation into a softmax-weighted mixture of all candidates, and optimises the mixture weights by gradient on the validation loss. That requires the gradient of the outer objective of Definition 7.1.

The inverse Hessian is applied to a vector with conjugate gradients or a truncated Neumann series, which scales to millions of hyper-parameters (Lorraine, Vicol and Duvenaud, 2020). DARTS uses a cruder approximation, a single gradient step for \theta^\star.

8. Guarantees? Generalisation and formal proofs

Two kinds of guarantees are possible. A statistical guarantee bounds the error on new data; a formal guarantee proves that a property holds for every input of a set. This chapter shows what can be proved for networks today, and at what cost.

8.1 Bounds that depend on the solution

Chapter 1 showed that the size of the class cannot explain generalisation. The bounds below depend instead on the norms of the trained weights. The Rademacher complexity of a class \mathcal{G} on n points is \mathfrak{R}_n(\mathcal{G}) = \mathbb{E}_{S, \sigma}\, \sup_{g \in \mathcal{G}} \frac1n \sum_{i=1}^n \sigma_i\, g(z_i), \qquad \sigma_i \text{ independent uniform signs}.

No parameter count appears: the bound depends on the norms of the solution. Fitting random labels requires much larger norms than fitting true ones, which part 2 can detect. For classification, a loss with margin \gamma that is 1/\gamma-Lipschitz turns this into a bound on the error with a \mathfrak{R}_n / \gamma term. Bartlett, Foster and Telgarsky (2017) give a version with spectral norms. For practical networks these bounds remain numerically loose.

8.2 PAC-Bayes and non-vacuous bounds

PAC-Bayes bounds the error of a randomised predictor: a distribution Q over weights, compared with a prior P fixed before seeing the data.

Dziugaite and Roy (2017) took a Gaussian Q centred near the weights found by SGD and optimised its variances to minimise the bound. On MNIST, for networks with more parameters than training examples, they obtained risk bounds well below 1, that is non-vacuous. Flat minima tolerate large posterior variances, hence a small KL term: flatness enters the bound.

8.3 Formal proofs about a trained network

Take logits F : \mathbb{R}^d \to \mathbb{R}^K, an input x with label y, and a perturbation set \mathcal{B}(x, \varepsilon). The property to prove is that the predicted class is y on the whole set. Adversarial examples (Szegedy and coauthors, 2014) show that it often fails for imperceptible \varepsilon. A verifier is sound if it never certifies a false property, and complete if it certifies every true one.

The propagation costs two forward passes but ignores correlations between units, so it is loose (Exercise 10). Training against the propagated bound, as Gowal and coauthors (2018) do, makes it tight enough to certify. Complete verification needs an exact encoding.

Maximising a wrong logit minus the true one over the input box then becomes a mixed-integer linear program, a complete verifier (Tjeng, Xiao and Tedrake, 2019). There is no free lunch: verification of ReLU networks is NP-complete (Katz and coauthors, 2017), and the cost grows with the number of ReLUs whose sign is undecided on the box.

The probabilities are estimated by Monte Carlo, so this certificate holds with a chosen confidence, and it concerns the smoothed classifier g, not f. Code 8.1 trains a small network on the digits, computes its Lipschitz certificate, then compares the accuracy certified by interval propagation with the accuracy under a projected-gradient attack.

import torch
from sklearn.datasets import load_digits
from sklearn.model_selection import train_test_split
torch.set_num_threads(1)
torch.manual_seed(0)
X, y = load_digits(return_X_y=True)
X = torch.tensor(X / 16.0, dtype=torch.float32)
Xtr, Xte, ytr, yte = train_test_split(X, torch.tensor(y), test_size=0.3, random_state=0)
net = torch.nn.Sequential(torch.nn.Linear(64, 64), torch.nn.ReLU(), torch.nn.Linear(64, 10))
opt = torch.optim.Adam(net.parameters(), lr=1e-2)
for _ in range(300):
    opt.zero_grad()
    torch.nn.functional.cross_entropy(net(Xtr), ytr).backward()
    opt.step()

def ibp(lo, hi):                                  # interval bound propagation, layer by layer
    for layer in net:
        if isinstance(layer, torch.nn.Linear):
            mid, rad = (hi + lo) / 2, (hi - lo) / 2
            mid, rad = layer(mid), rad @ layer.weight.abs().T
            lo, hi = mid - rad, mid + rad
        else:                                     # ReLU is monotone
            lo, hi = layer(lo), layer(hi)
    return lo, hi

def pgd(x, t, eps, steps=40):                     # projected gradient attack in the l_inf ball
    delta = torch.zeros_like(x, requires_grad=True)
    for _ in range(steps):
        torch.nn.functional.cross_entropy(net(x + delta), t).backward()
        delta.data = (delta + eps / 10 * delta.grad.sign()).clamp(-eps, eps)
        delta.grad.zero_()
    return net(x + delta).argmax(1)

W = [l.weight for l in net if isinstance(l, torch.nn.Linear)]
lip = torch.linalg.matrix_norm(W[0], 2) * torch.linalg.matrix_norm(W[1], 2)   # l2 Lipschitz bound
with torch.no_grad():
    out = net(Xte)
    print(f"clean accuracy {(out.argmax(1) == yte).float().mean():.3f};  Lipschitz bound {lip:.1f}")
    top2 = out.topk(2, dim=1).values
    radius = (top2[:, 0] - top2[:, 1]) / (2 ** 0.5 * lip)
    print(f"median certified l2 radius of correct points {radius[out.argmax(1) == yte].median():.4f}")
for eps in [0.005, 0.01, 0.02, 0.05]:
    with torch.no_grad():
        lo, hi = ibp(Xte - eps, Xte + eps)
        others = hi.scatter(1, yte[:, None], -float("inf"))       # best case of every wrong class
        certified = (lo.gather(1, yte[:, None]).squeeze(1) > others.max(1).values).float().mean()
    attacked = (pgd(Xte, yte, eps) == yte).float().mean()
    print(f"eps {eps:.3f}:  IBP-certified {certified:.3f}  <=  accuracy under PGD attack {attacked:.3f}")

The clean accuracy is 0.970 and the Lipschitz bound is 54.1, which certifies a median Euclidean radius of 0.125 around correctly classified digits. In the \ell_\infty ball, certified and attacked accuracies bracket the true robust accuracy: \varepsilon = 0.01:\ 0.602 \le \text{robust accuracy} \le 0.937, \qquad \varepsilon = 0.05:\ 0.000 \le \text{robust accuracy} \le 0.517 . Between the two numbers lies what neither the cheap certificate nor the attack can decide; only a complete verifier closes the gap.

9. Research directions and open problems

This chapter is for self-study. It follows the themes of the course to the questions that are still open, with pointers to papers that a master’s student can read. Each section ends with a question worth a research internship.

9.1 Feature learning beyond the lazy regime

The neural tangent kernel of ch. 1 describes networks that barely move their weights. Chizat, Oyallon and Bach (2019) showed that this lazy regime comes from the scaling of the model, and that it often performs worse in practice than regimes where features change. For two-layer networks, mean-field analyses describe the other extreme as a gradient flow on a distribution of neurons (Mei, Montanari and Nguyen, 2018; Chizat and Bach, 2018).

• Open problem: a quantitative theory of feature learning for deep networks that predicts which features are learnt, and how fast.

9.2 Optimisation that defies the classical picture

The descent lemma of ch. 0 asks for a step below 2/L. Cohen, Kaur, Li, Kolter and Talwalkar (2021) observed that full-batch gradient descent on networks drives the sharpness, the top Hessian eigenvalue, up to about 2/\eta, and then trains at this edge of stability while the loss still decreases non-monotonically.

Power, Burda, Edwards, Babuschkin and Misra (2022) described grokking: on small algorithmic data sets, test accuracy jumps long after the training set has been fitted.

• Open problem: explain why training at the edge of stability converges, and what it implies for the implicit bias of ch. 1.

9.3 Generalisation bounds that predict

Compression bounds (Arora, Ge, Neyshabur and Zhang, 2018) are orders of magnitude tighter than earlier norm bounds. Optimised PAC-Bayes bounds (ch. 8) give non-vacuous guarantees for networks with more parameters than data, and Zhou and coauthors (2019) combine them with compression to reach ImageNet. Frankle and Carbin (2019) found sparse sub-networks, lottery tickets, that train as well as the full network from the same initialisation, a sign that the effective complexity of trained networks is much lower than their size.

• Open problem: bounds that are non-vacuous and also rank architectures and training methods in the same order as their test errors.

9.4 Interpretability: from attributions to mechanisms

Attribution maps (ch. 3) say where a model looks, not how it computes. Mechanistic interpretability reverse-engineers circuits of neurons (Olah and coauthors, 2020). Sparse auto-encoders trained on activations recover directions that are more interpretable than single neurons (Bricken and coauthors, 2023). Concept activation vectors test the use of human concepts (Kim and coauthors, 2018).

• Open problem: evaluation. There is no agreed measure of the faithfulness of an explanation to the model, and the sanity checks of ch. 3 are necessary but not sufficient.

9.5 Fairness, causality and distribution shift

The impossibility results of ch. 3 push towards causal definitions, such as counterfactual fairness (Kusner, Loftus, Russell and Silva, 2017), which require a causal model of the data. Bias also appears as a failure under distribution shift; the WILDS benchmark collects real shifts across hospitals, regions and time (Koh and coauthors, 2021).

• Open problem: auditing large generative models, whose outputs are open-ended text or images, for the biases that Hendricks and coauthors measured in captions.

9.6 Weak supervision at scale

Contrastive pre-training on hundreds of millions of noisy image–caption pairs from the web (Radford and coauthors, 2021) turned noisy, abundant supervision into strong zero-shot classifiers. Large pre-trained models now serve as sources of pseudo-labels for the small-data problems of ch. 4.

• Open problem: guarantees in the style of Theorem 4.3 when the noise depends on the input and is produced by another model.

9.7 Learning physics: operators and their failure modes

Neural operators learn the solution map of a family of PDEs rather than one solution: DeepONet (Lu, Jin, Pang, Zhang and Karniadakis, 2021) and the Fourier neural operator (Li and coauthors, 2021). Learned weather models trained on reanalysis data now compete with numerical forecasts at medium range (Lam and coauthors, 2023). Physics-informed training can fail on stiff or high-frequency problems (Krishnapriyan and coauthors, 2021), as Exercise 18 shows on a toy case.

• Open problem: stability estimates in the style of Proposition 5.4 for nonlinear PDEs and for operator learning, and certified error bars.

9.8 Generative models after GANs

Diffusion models (Sohl-Dickstein and coauthors, 2015; Ho, Jain and Abbeel, 2020) and their continuous-time formulation (Song and coauthors, 2021) learn to reverse a noising process; flow matching (Lipman and coauthors, 2023) trains continuous normalizing flows without simulation. They combine the stable training of likelihood models with the sample quality of GANs.

• Open problem: evaluation. Sample statistics such as the Fréchet distance miss memorisation and coverage; good metrics for scientific generative models are lacking.

9.9 Auto-ML and reproducibility

Tabular benchmarks such as NAS-Bench-101 (Ying and coauthors, 2019) made architecture search reproducible. Li and Talwalkar (2019) showed that random search with early stopping is a strong baseline that many methods did not beat.

• Open problem: hyper-parameter transfer, tuning on small models and transferring to large ones with guarantees.

9.10 Verification at scale

Bound propagation with branch and bound, such as \beta-CROWN (Wang and coauthors, 2021), verifies networks far larger than mixed-integer programs can. Certified training still loses clean accuracy compared with standard training.

• Open problem: verified properties beyond small perturbations, for instance semantic changes of an image or physical constraints on the output of a surrogate model.

Exercises

Levels: ★ apply the course, ★★ combine or prove a short result, ★★★ open-ended or research-flavoured. The Practice column of the session plan says when to do each one. Exercises 17, 18 and 20 are computational.

1. ★ A softmax gradient by hand. A network outputs the logits z = (2, 1, 0) for an input whose label is the first class. (a) Compute the probabilities, the cross-entropy loss and its gradient in z (Proposition 0.3). (b) The logits come from z = W a + b with a = (1, 2); give the gradient in W.

   Solution: (a) The exponentials are 7.389, 2.718 and 1, of sum 11.107, so p = (0.665, 0.245, 0.090) and the loss is -\log 0.665 = 0.408. The gradient is p - e_1 = (-0.335,\ 0.245,\ 0.090). The logit of the true class goes up after a step, the two others go down.

   (b) The gradient in W is \delta a^\top with \delta = p - e_1, with rows (-0.335, -0.670), (0.245, 0.490) and (0.090, 0.180).

2. ★ An Occam bound for the random-label network. The network of Code 1.1 has 38 410 parameters stored in 32-bit floats and is trained on n = 1\,257 points. (a) Evaluate the bound of Proposition 1.1 with \delta = 0.05. (b) How many training points would make the square-root term equal to 0.05?

   Solution: (a) The logarithm of the size of the class is \ln|\mathcal{F}| = 32 \times 38\,410 \times \ln 2 = 851\,961, and \ln 20 = 3.0. The square-root term is \sqrt{851\,964 / 2\,514} = 18.4, far above 1: the bound is vacuous, for the true labels as for the random ones.

   (b) n = 851\,964 / (2 \times 0.05^2) \approx 1.7 \times 10^8 points, about 10^5 times the size of the data set.

3. ★ The minimum-norm interpolator. Let A = (1\ \ 2) and b = 5, so that p = 2 > n = 1. (a) Give the minimum-norm solution of A\theta = b. (b) Gradient descent starts from \theta_0 = (1, 0); what is its limit by Theorem 1.5, and which step sizes are allowed?

   Solution: (a) A A^\top = 5, so A^+ b = A^\top \cdot 5/5 = (1, 2), of norm \sqrt 5.

   (b) The limit is \theta_0 + A^+(b - A\theta_0), that is (1, 0) + \frac{5 - 1}{5}\, (1, 2) = (1.8,\ 1.6), which indeed satisfies 1.8 + 2 \times 1.6 = 5. Since \lambda_{\max}(A^\top A) = 5, the steps must satisfy \eta < 0.4. The limit keeps the component of \theta_0 orthogonal to the row space: the initialisation matters.

4. ★ Self-attention by hand. Two tokens x_1 = (1, 0) and x_2 = (0, 1) go through one attention head with W_Q = W_K = W_V = I_2 (Definition 2.3). (a) Compute the attention weights and the outputs. (b) Swap the tokens and check Proposition 2.4. (c) How many parameters has one head with d = d_k = 64, and how does this depend on the number of tokens?

   Solution: (a) The score matrix is X X^\top / \sqrt 2 = \operatorname{diag}(0.707, 0.707). Each row of the softmax gives weight e^{0.707}/(e^{0.707} + 1) = 0.670 to the token itself and 0.330 to the other. The outputs are (0.670, 0.330) and (0.330, 0.670).

   (b) After the swap, the outputs are the same two vectors in swapped order. (c) Three 64 \times 64 matrices, 12 288 parameters, whatever the number of tokens.

5. ★ Integrated gradients by hand. (a) For f(x) = x_1 x_2, the input x = (2, 3) and the baseline 0, compute integrated gradients and gradient × input, and check completeness (Theorem 3.3). (b) Same question for f(x) = \operatorname{ReLU}(x - 1) at x = 3.

   Solution: (a) Along the segment, \partial_1 f(\alpha x) = \alpha x_2, so \mathrm{IG}_1 = x_1 x_2 \int_0^1 \alpha\, d\alpha = 3, and likewise \mathrm{IG}_2 = 3. The sum is 6 = f(x) - f(0). Gradient × input gives (6, 6), of sum 12: it double-counts the interaction.

   (b) Gradient × input gives 3 \times 1 = 3. Integrated gradients give 3 \int_0^1 \mathbb{1}[3\alpha > 1]\, d\alpha = 3 \times \frac23 = 2, which is f(3) - f(0): completeness holds, gradient × input overshoots.

6. ★ Correcting a noisy posterior. Two classes are observed through the noise matrix with rows (0.8, 0.2) and (0.3, 0.7) (Theorem 4.3). (a) The clean posterior at x is (0.9, 0.1); what is the noisy posterior? (b) A model of the noisy labels outputs (0.5, 0.5) at another input; what clean posterior does the forward correction attribute to it, and which class does it predict?

   Solution: (a) The noisy posterior is T^\top p^\star: (0.8 \times 0.9 + 0.3 \times 0.1,\ 0.2 \times 0.9 + 0.7 \times 0.1) = (0.75,\ 0.25).

   (b) Solve 0.8a + 0.3(1 - a) = 0.5: a = 0.4, so the clean posterior is (0.4, 0.6). The uncorrected model is undecided, the corrected one predicts the second class: class 1 receives more noisy labels than it deserves, because 30 % of class 2 is mislabelled as class 1.

7. ★ The KL term of a VAE. A one-dimensional Gaussian encoder outputs \mu = 1 and \sigma = 0.5 for an input. (a) Compute the KL term of the ELBO (after Proposition 6.1). (b) Compute its derivatives in \mu and \sigma, and its minimiser. (c) With \varepsilon = 0.4, which latent sample does the reparameterisation of Proposition 6.2 produce?

   Solution: (a) The KL term is \frac12 (1 + 0.25 - 1 - \ln 0.25) = \frac12 (0.25 + 1.386) = 0.818 .

   (b) The derivative in \mu is \mu = 1, and in \sigma it is \sigma - 1/\sigma = -1.5: the KL term pulls the mean to 0 and the standard deviation up to 1, where it vanishes. (c) z = 1 + 0.5 \times 0.4 = 1.2.

8. ★ Likelihood under an affine flow. The flow z = A x, with A lower-triangular with rows (2, 0) and (1, 0.5), maps the data to a standard Gaussian (Proposition 6.4).

   1. Compute \log p_X(x) at x = (1, 2). (b) Invert the flow at z = (2, 2).

   Solution: (a) z = (2, 1 + 1) = (2, 2). The Gaussian term is -\frac12 (4 + 4) - \ln(2\pi) = -5.838, and \log|\det A| = \ln(2 \times 0.5) = 0, so \log p_X(1, 2) = -5.838 .

   (b) Triangular systems invert by substitution, as coupling layers do: x_1 = 2/2 = 1, then x_2 = (2 - 1)/0.5 = 2.

9. ★ How many random trials? (a) How many uniform random trials guarantee, with probability at least 0.95, one trial in the best 5 % of the space (Proposition 7.2)? (b) With probability 0.99, one in the best 1 %? (c) A budget of 64 runs covers three hyper-parameters; how many values of each does a grid try, and random search?

   Solution: (a) n \ge \ln 0.05 / \ln 0.95 = 58.4, so 59 trials. (b) n \ge \ln 0.01 / \ln 0.99 = 458.2, so 459 trials. (c) A grid tries 64^{1/3} = 4 values of each, random search 64 distinct values of each.

10. ★ Interval bound propagation by hand. A network maps x \in [0, 1]^2 to f(x) = r_1 - r_2, with r_1 = \operatorname{ReLU}(x_1 - x_2) and r_2 = \operatorname{ReLU}(x_1 + x_2). (a) Propagate the box with Proposition 8.4. (b) Compute the exact range of f and explain the gap.

    Solution: (a) The pre-activations lie in [-1, 1] and [0, 2], the activations in [0, 1] and [0, 2], so the output box is [-2, 1].

    (b) If x_1 \ge x_2, f = -2 x_2; otherwise f = -(x_1 + x_2). The exact range is [-2, 0].

    The upper bound 1 would need r_1 = 1 and r_2 = 0 together, impossible since both grow with x_1: interval propagation forgets this correlation.

11. ★★ The PL inequality for least squares. Let A \in \mathbb{R}^{n \times p} have rank n < p and f(\theta) = \frac12 \|A\theta - b\|^2.

    1. Show that f is not strongly convex, yet satisfies the PL inequality of Theorem 1.3 with \mu = \lambda_{\min}(A A^\top). (b) Deduce the convergence rate of gradient descent with step 1/L. (c) What happens for A = (1\ \ 2)?

    Solution: (a) The Hessian A^\top A has rank n < p, hence a zero eigenvalue: no strong convexity. With r = A\theta - b, \|\nabla f\|^2 = r^\top A A^\top r \ge \lambda_{\min}(A A^\top)\, \|r\|^2 = 2\, \lambda_{\min}(A A^\top)\, f .

    (b) L = \lambda_{\max}(A^\top A) = \lambda_{\max}(A A^\top), so f(\theta_t) \le (1 - 1/\kappa)^t f(\theta_0), with \kappa the condition number of A A^\top.

    (c) A A^\top = 5, so \kappa = 1: one step of size 1/5 reaches an exact interpolator.

12. ★★ Distillation and logit matching. (a) Prove the first identity of Proposition 1.7. (b) For K = 3, T = 10, student logits z = (1, 0, -1) and teacher logits v = (2, 0, -2), compare the exact gradient with its high-temperature approximation. (c) Hinton, Vinyals and Dean multiply the soft-target loss by T^2; why?

    Solution: (a) C = -\sum_k p_k z_k / T + \log \sum_k e^{z_k / T}, using \sum_k p_k = 1. Its derivative in z_k is (q_k - p_k)/T.

    (b) The exact gradient is (-0.00346, 0.00033, 0.00313); the approximation (z - v)/(K T^2) gives (-0.00333, 0, 0.00333), close to it.

    (c) The gradients scale like 1/T^2. Multiplying by T^2 keeps the balance between the soft-target and the hard-label terms when the temperature changes.

13. ★★ Sum, mean or max pooling? (a) Show that no network of the form \rho(\max_i \phi(x_i)), with a componentwise maximum, can count the ones in a multiset of zeros and ones. (b) Show that sum pooling can. (c) Which pairs of multisets does mean pooling confuse?

    Solution: (a) The multisets \{0, 0, 1\} and \{0, 1, 1\} give the same componentwise maximum of \phi(0) and \phi(1), hence the same output, while they contain one and two ones.

    (b) With \phi(x) = x and \rho the identity, the sum is the count, as in Theorem 2.6.

    (c) Mean pooling confuses a multiset with its repetitions, for instance \{0, 1\} and \{0, 0, 1, 1\}: it sees proportions, not counts. The choice of pooling is a modelling decision.

14. ★★ Symmetric losses. (a) Show that the mean absolute error \|p - e_y\|_1 is symmetric in the sense of Theorem 4.4, and that the cross-entropy is not. (b) In Code 4.1 the label is resampled uniformly among all ten classes with probability 0.6. What is the noise rate of Theorem 4.4, and does the theorem apply? (c) What is the threshold for two classes, and why is it natural?

    Solution: (a) \|p - e_k\|_1 = 2(1 - p_k), so the sum over k is 2K - 2 for every p.

    For the cross-entropy, \sum_k -\log p_k equals K \log K at the uniform distribution and tends to infinity as p becomes one-hot.

    (b) A resampled label is wrong with probability 0.9, so \eta = 0.54. The coefficient of R(f) is 1 - 0.54 \times 10/9 = 0.4 > 0: the theorem applies, as the robustness of the MAE in Code 4.1 confirms.

    (c) For K = 2 the condition is \eta < 1/2. At \eta = 1/2 the labels are independent of the inputs, and beyond it they are flipped more often than not.

15. ★★ Choosing the next trial. The best validation loss so far is f^\star = 0.30. The surrogate predicts \mathcal{N}(0.25, 0.10^2) at configuration A and \mathcal{N}(0.35, 0.20^2) at configuration B. (a) Compute the expected improvement of each (Proposition 7.3). (b) Above which standard deviation at B would Bayesian optimisation prefer B?

    Solution: (a) For A, z = 0.5 and \mathrm{EI}_A = 0.05\, \Phi(0.5) + 0.10\, \varphi(0.5) = 0.0346 + 0.0352 = 0.0698 . For B, z = -0.25 and \mathrm{EI}_B = -0.05 \times 0.4013 + 0.20 \times 0.3867 = 0.0573 . The next trial is A, the more promising mean.

    (b) Solving \mathrm{EI}_B(\sigma) = 0.0698 numerically gives \sigma \approx 0.232: above it, uncertainty wins and B is explored.

16. ★★ Energy drift and symplectic integration. For the harmonic oscillator H = (q^2 + p^2)/2 with step h:

    1. show that explicit Euler multiplies H by 1 + h^2 at every step; (b) show that symplectic Euler, p' = p - hq then q' = q + hp', conserves \tilde H = q^2 + p^2 - h\,qp exactly; (c) compare the two after 1 000 steps with h = 0.1.

    Solution: (a) q' = q + hp and p' = p - hq give q'^2 + p'^2 = (1 + h^2)(q^2 + p^2).

    (b) The update is linear, q' = (1 - h^2) q + hp and p' = p - hq.

    Expanding q'^2 + p'^2 - h\, q'p', the coefficients of q^2, qp and p^2 are 1, -h and 1: \tilde H is invariant.

    Since |qp| \le H, the true energy stays in [\tilde H/(2 + h), \tilde H/(2 - h)].

    (c) Explicit Euler multiplies the energy by 1.01^{1000} \approx 2.1 \times 10^4. Symplectic Euler keeps it forever between \tilde H / 2.1 and \tilde H / 1.9, a band of relative width about 10 %. Learnt Hamiltonians (Proposition 5.5) deserve symplectic integrators.

17. ★★ Regularisation removes the peak (Python). In Code 1.2, replace the minimum-norm fit by ridge regression, a = F^\top (F F^\top + \lambda n I)^{-1} y, for \lambda \in \{10^{-3}, 10^{-1}\}, and plot the median test error against p. Explain the result with Theorem 1.5.

    Hints and expected result: with \lambda = 10^{-3}, the peak at p = n falls from 7.5 to about 0.23.

    With \lambda = 10^{-1} it disappears: the error decreases with p, up to noise, from about 0.12 at p = 50 to 0.08 at p = 100 and 0.05 at p = 2\,000.

    Ridge lifts the small eigenvalues of F F^\top by \lambda n, so the norm of the fit cannot explode at the threshold. As \lambda \to 0, ridge tends to the minimum-norm interpolator of Theorem 1.5, which explains why unregularised interpolation shows the peak. Nakkiran, Venkat, Kakade and Ma (2021) prove that optimally tuned ridge removes double descent in linear models.

18. ★★ Spectral bias of physics-informed networks (Python). In Code 5.1, replace the source by (k\pi)^2 \sin(k\pi x), whose solution is \sin(k\pi x), for k = 1, 4, 8.

    1. Report the maximal error. (b) Divide the residual by (k\pi)^2 and try again. (c) Feed the network the features \sin(j\pi x) and \cos(j\pi x) for j = 1, \dots, 10 instead of x.

    Hints and expected result: (a) The errors are about 4 \times 10^{-4} for k = 1 and 3 \times 10^{-3} for k = 4. For k = 8 training fails, with an error near 9 and a residual loss of order 10^4.

    (b) Rescaling balances the boundary term but the network stays near the trivial function 0, with an error near 1. Networks fit low frequencies first: this is the spectral bias of Rahaman and coauthors (2019).

    (c) For k = 8, Fourier input features, in the spirit of Tancik and coauthors (2020), bring the error down to about 2 \times 10^{-1} with the raw residual, and to about 5 \times 10^{-2} with the rescaled residual of (b).

19. ★★★ A PAC-Bayes bound in numbers. A network with p = 10^5 parameters is trained on n = 60\,000 examples. Take Q = \mathcal{N}(w, \sigma^2 I), P = \mathcal{N}(0, \sigma_0^2 I) and \delta = 0.05 in Theorem 8.2.

    1. Derive the KL term. (b) With \sigma = \sigma_0 = 0.1, \|w\|^2 = 50 and a stochastic training error of 0.03, evaluate the bound. (c) Same with \sigma = 0.01, as a sharp minimum would require. (d) How can \sigma_0 be chosen after seeing the data without breaking the theorem?

    Solution: (a) For Gaussians, \mathrm{KL}(Q \Vert P) = \frac12 \Big(\frac{p\,\sigma^2}{\sigma_0^2} + \frac{\|w\|^2}{\sigma_0^2} - p + p \ln \frac{\sigma_0^2}{\sigma^2}\Big).

    (b) The KL is 50 / 0.02 = 2\,500 and \ln(2\sqrt n/\delta) = 9.19. The gap is \sqrt{2\,509 / 120\,000} = 0.145, so the bound is 0.175: non-vacuous.

    (c) The KL becomes about 1.8 \times 10^5 and the gap 1.24: vacuous. A flat minimum, which tolerates large \sigma, is what makes the bound small.

    (d) Fix a grid of k values in advance and apply the theorem to each with \delta/k: the price is \ln k inside the square root. Priors built from part of the data are another option (Parrado-Hernández and coauthors, 2012).

20. ★★★ Exact verification with a mixed-integer program (Python). (a) Encode the network of Exercise 10 with Proposition 8.5, and compute the exact maximum and minimum of f on the box with scipy.optimize.milp. (b) Do the same for the network of Code 8.1, on twenty test digits, with \varepsilon = 0.01: for each digit and each wrong class, maximise the wrong logit minus the true one over the box. Compare with interval propagation and with the attack.

    Hints and expected result: (a) Use eight variables: two inputs, two pre-activations, two activations and two binaries, with the bounds [-1, 1] and [0, 2] of Exercise 10. The solver returns a maximum 0 at x_2 = 0 and a minimum -2, where interval propagation gave [-2, 1].

    (b) Take the bounds from interval propagation; stable ReLUs need no binary. Every digit certified by interval propagation is certified by the program; every digit broken by the attack is refuted, with a counterexample. The program decides the remaining ones, and its time grows quickly with the number of unstable ReLUs.

21. ★★★ Designing a bias audit for CV matching. A company scores CVs against job offers with a text model. Design an audit for an undesired dependence on gender, in the spirit of ch. 3: data, tests, metrics, statistical decision and remedies.

    Hints and expected result: a good answer contains the following elements.

    • Counterfactual pairs: edit the gendered words of real CVs (names, pronouns, gendered job titles) and measure the distribution of score changes and the rate of changed decisions.
    • Group metrics: parity gap at the operating threshold (Definition 3.5); equalised odds if hiring outcomes are known; confidence intervals by bootstrap and a paired permutation test.
    • Proxies: train a probe to predict gender from the internal representation. By Proposition 3.7, a probe loss below the entropy of gender reveals leakage; integrated gradients then locate the proxy words.
    • Remedies and report: counterfactual data augmentation or adversarial debiasing, re-audit, and a model card (Mitchell and coauthors, 2019) stating which criterion was chosen and why.

Projects and assessment

The official assessment (master-mva.com) is based on 6 exercises: the course combines lectures with practical and theoretical exercises in PyTorch, which are evaluated, on personal laptops without a GPU. The Université Paris-Saclay course detail describes partial continuous assessment (“Evaluation Continue non Intégrale”). No weights, project or written exam are displayed. The six practical sheets below are shaped like these exercises, one per block of chapters; the projects extend them, and the exam is a self-assessment proposal.

Six practical sheets (proposal), each about 3 h on a laptop CPU:

• Sheet 1, gap between theory and practice (ch. 0–1): Code 1.1 and Code 1.2, then Exercise 17; report the training curves on random labels and the double-descent curve with and without ridge.
• Sheet 2, architectures (ch. 2): Code 2.1 with sets of varying size, then a graph attention layer written from Definition 2.8 and tested for equivariance on a random graph.
• Sheet 3, interpretability and biases (ch. 3): Code 3.1, then an adversarial debiasing head (Proposition 3.7) and the new parity gap.
• Sheet 4, noisy labels (ch. 4): Code 4.1 with the noise matrix estimated from anchor points instead of known.
• Sheet 5, physics (ch. 5): Code 5.1, Exercise 18, and a Hamiltonian network for the pendulum integrated with symplectic Euler (Exercise 16).
• Sheet 6, generative models and guarantees (ch. 6–8): Code 6.1 with sampling, then Code 8.1 and Exercise 20.

Solo projects

1. [Solo · ≈ 20 h] Do deep nets really need to be deep? Mimic learning on a laptop. A paper study of Ba and Caruana, “Do Deep Nets Really Need to be Deep?” (NIPS 2014).
   • Question: how much of the gap between a deep and a shallow network closes when the shallow one learns from the deep one’s logits?
   • Implement: on Fashion-MNIST (Xiao, Rasul and Vollgraf, 2017), a small convolutional teacher, and a one-hidden-layer student with the same number of parameters. Train the student on the labels, on the teacher’s logits with a squared loss, and by distillation at temperatures 1, 4 and 10 (Proposition 1.7).
   • Deliverables: code, a 4–6 page report, a 10-minute talk. Chapters: ch. 1, 2. Laptop CPU.
   • Success: over 3 seeds, the logit-trained student closes at least half of the gap between the label-trained student and the teacher, with a curve of accuracy against the number of parameters.
2. [Solo · ≈ 20 h] Double descent and the jamming transition in networks. A paper study of Geiger and coauthors, “Scaling description of generalization with number of parameters in deep learning” (arXiv 2019).
   • Implement: fully connected networks of increasing width on 1 000 MNIST digits (LeCun, Bottou, Bengio and Haffner, 1998), trained with the hinge loss of the paper until the training loss is exactly zero. Locate the jamming threshold, then train 10 networks per width.
   • Measure: the test error of single networks and of their ensemble average, and the fluctuation of the outputs around their mean as a function of the number of parameters (ch. 1.4).
   • Deliverables: code, a 4–6 page report, a 10-minute talk. Chapters: ch. 1. Laptop CPU.
   • Success: the cusp at the threshold, its removal by ensemble averaging, and a fitted fluctuation exponent compared with the predicted -1/4.
3. [Solo · ≈ 20 h] Deep Sets on sums of handwritten digits. A paper study of Zaheer and coauthors, “Deep Sets” (NIPS 2017), on their task of summing the digits shown in a set of MNIST images.
   • Implement: a small convolutional encoder \phi, sum pooling and a network \rho (Theorem 2.6). Baselines: recurrent networks reading the images in sequence, and the Deep Set with mean or max pooling (Exercise 13).
   • Protocol: train on sets of at most 10 images; test on sets of 5 to 100 images.
   • Deliverables: code, a 4–6 page report, a 10-minute talk. Chapters: ch. 2. Laptop CPU.
   • Success: accuracy against set size over 3 seeds, with the sum-pooled Deep Set ahead of the recurrent baselines beyond the training sizes, as in the paper.
4. [Solo · ≈ 20 h] A Deep Galerkin solver in ten dimensions. A paper study of Sirignano and Spiliopoulos, “DGM: A deep learning algorithm for solving partial differential equations” (Journal of Computational Physics 2018).
   • Problem: the heat equation \partial_t u = \Delta u on [0, 1] \times [0, 1]^d, with the exact solution u = e^{-t} \frac1d \sum_i \sin x_i giving initial and boundary data.
   • Implement: the loss of Definition 5.3 with fresh random points at every step, for d \in \{2, 5, 10, 20\}; compare with a fixed set of collocation points.
   • Deliverables: code, a 4–6 page report, a 10-minute talk. Chapters: ch. 5. Laptop CPU.
   • Success: a relative L^2 error below 1 % on 10^4 random test points for d = 10, and a curve of error and training time against the dimension.

Group projects

1. [Group of 3 · ≈ 30 h each] Right for the right reasons: auditing and debiasing a vision model. A paper study of Hendricks, Burns, Saenko, Darrell and Rohrbach, “Women also Snowboard: Overcoming Bias in Captioning Models” (FAT-ML 2018), transposed to classification.
   • Data: CelebA (Liu, Luo, Wang and Tang, 2015), predicting “blond hair”, an attribute correlated with gender in the data; Colored MNIST (Arjovsky, Bottou, Gulrajani and Lopez-Paz, 2019) as a warm-up.
   • Implement: a standard classifier; reweighting; an Equalizer-style confusion loss, asking for equal probabilities of the two classes on images where the hair is hidden (tight face crops from the CelebA landmarks); adversarial debiasing (Proposition 3.7); group distributionally robust optimisation (Sagawa, Koh, Hashimoto and Liang, 2020).
   • Split: data and metrics; training methods; explanations, with Grad-CAM pointing tests.
   • Deliverables: repository, an 8-page report, a 15-minute defence. Chapters: ch. 3, 4. Free GPU tier.
   • Success: over 3 seeds, a gain of at least 10 points of worst-group accuracy over the standard classifier, for a loss of at most 3 points of average accuracy, and Grad-CAM maps that move to the hair.
2. [Group of 2–3 · ≈ 30 h each] Learning with noisy labels: correction, robust losses and co-teaching. A paper study of Patrini, Rozza, Menon, Nock and Qu, “Making deep neural networks robust to label noise: a loss correction approach” (CVPR 2017).
   • Data: CIFAR-10 (Krizhevsky, 2009) with symmetric noise of rates 0.2 and 0.4, and asymmetric noise between similar classes (truck to automobile, cat and dog), as in the paper.
   • Implement: cross-entropy, forward correction with the true and the estimated noise matrix (Theorem 4.3), the mean absolute error (Theorem 4.4), and co-teaching (Han and coauthors, 2018).
   • Split: noise and its estimation; losses; co-teaching and analysis.
   • Deliverables: repository, an 8-page report, a 15-minute defence. Chapters: ch. 4. Free GPU tier.
   • Success: a table of clean test accuracies over 3 seeds, with forward correction using the estimated matrix within 3 points of the true one.
3. [Group of 3 · ≈ 30 h each] Auto-ML on a budget. A comparison in the spirit of Li, Jamieson, DeSalvo, Rostamizadeh and Talwalkar, “Hyperband” (JMLR 2018).
   • Problem: tune five hyper-parameters of a small convolutional network on Fashion-MNIST (learning rate, weight decay, width, depth, dropout) with a total budget of 200 epochs.
   • Implement: random search, Bayesian optimisation with expected improvement (Proposition 7.3), successive halving and Hyperband.
   • Split: the search methods; a training harness that logs every epoch; the analysis.
   • Deliverables: repository, an 8-page report, a 15-minute defence. Chapters: ch. 7. Laptop CPU or free GPU tier.
   • Success: anytime curves of the best validation error against consumed epochs over 5 seeds, the test error of each winner, and the early advantage of Hyperband reproduced or explained.
4. [Group of 2–3 · ≈ 30 h each] Three certificates of robustness. A comparison of interval bound propagation (Gowal and coauthors, 2018), exact verification (Tjeng, Xiao and Tedrake, 2019) and randomised smoothing (Cohen, Rosenfeld and Kolter, 2019) on MNIST.
   • Implement: a standard and an interval-trained network (Proposition 8.4); the mixed-integer verifier of Proposition 8.5 on a small network; a smoothed classifier with Monte Carlo certificates (Theorem 8.6).
   • Split: one certificate per member, then a joint analysis.
   • Deliverables: repository, an 8-page report, a 15-minute defence. Chapters: ch. 8. Free GPU tier.
   • Success: certified accuracy against \varepsilon for both networks; the exact robust accuracy of 100 test digits for the small network; smoothed certified accuracy against the Euclidean radius.

Written exam (proposal)

Two hours, one handwritten A4 sheet allowed, no electronic device; four questions, 20 points.

1. Question (5 points). A network fits a training set with random labels perfectly. Explain what this experiment shows about bounds that depend only on the model class, and on which quantities a useful explanation of generalisation can depend.

   Expected:

   • The experiment of Example 1.2: same architecture and algorithm, zero training error on both label sets, chance test error on random labels (1.5 pts).
   • A bound that depends only on the class holds for both runs at once, so it is vacuous; the finite-class bound with 32-bit weights illustrates this (Proposition 1.1, 1.5 pts).
   • Useful quantities depend on the data, the algorithm or the solution: implicit bias (Theorem 1.5), norms (Theorem 8.1), flatness through PAC-Bayes (Theorem 8.2) (2 pts).

2. Question (5 points). (a) Compute the integrated gradients of f(x) = \operatorname{ReLU}(x_1 + x_2 - 1) at x = (1, 1) with baseline 0, and gradient × input. Check completeness. (b) A Gaussian-process surrogate predicts \mathcal{N}(0.2, 0.1^2) at a candidate whose mean equals the best value so far, f^\star = 0.2. Compute its expected improvement.

   Expected:

   • (a) On the segment, f(\alpha x) = \operatorname{ReLU}(2\alpha - 1), with partial derivatives 1 for \alpha > 1/2 and 0 before. Each integrated gradient is 1 \times 1/2 = 0.5, summing to 1 = f(1, 1) - f(0). Gradient × input gives (1, 1), summing to 2: not complete (3 pts).
   • (b) z = 0, so the expected improvement is \sigma\, \varphi(0) = 0.040, a pure exploration value (2 pts).

3. Question (5 points). (a) Prove that the linear permutation-equivariant maps of \mathbb{R}^m are the maps aI + b\mathbf{1}\mathbf{1}^\top. (b) Deduce the form of an equivariant layer and of an invariant network on sets. (c) Why does building the invariance in help when data are few?

   Expected:

   • (a) The proof of Proposition 2.7: equivariance is L_{\sigma(i)\sigma(j)} = L_{ij}; permutations act transitively on diagonal and on off-diagonal positions; the converse (2.5 pts).
   • (b) Layers x \mapsto \sigma(\lambda x + \gamma\, \bar x\, \mathbf{1}) with \bar x = \mathbf{1}^\top x, stacked, then a sum and a network \rho, as in Theorem 2.6 (1 pt).
   • (c) Symmetrisation never increases the excess risk when the target is invariant (Proposition 5.1); the invariant model need not learn the symmetry from data, as Code 2.1 shows (1.5 pts).

4. Question (5 points). (a) State and prove the noise tolerance of symmetric losses under uniform label noise. (b) Apply it to K = 4 classes and a noise rate of 0.5. (c) Why does the cross-entropy fail, and what does the forward correction do instead?

   Expected:

   • (a) The statement and proof of Theorem 4.4: condition on the clean label, use the symmetry, collect the coefficient 1 - \eta K/(K-1) (2.5 pts).
   • (b) The coefficient is 1 - 0.5 \times 4/3 = 1/3 > 0, so the minimisers coincide; the threshold is 0.75 (1 pt).
   • (c) The cross-entropy is not symmetric, and an over-parameterised network memorises the wrong labels (Code 4.1). Forward correction models the noise with T^\top p(x), so the clean posterior minimises the noisy risk when T is invertible (Theorem 4.3) (1.5 pts).

Grading rubric (proposal)

References

Official references (master-mva.com course page).

• Related conferences named by the course page: in machine learning NIPS (now NeurIPS), ICML and ICLR; in computer vision CVPR, ICCV and ECCV.
• I. Goodfellow, Y. Bengio, A. Courville, Deep Learning, MIT Press, 2016 — the related book named by the course page.
• L. J. Ba, R. Caruana, “Do deep nets really need to be deep?”, NIPS 2014.
• P. Veličković, G. Cucurull, A. Casanova, A. Romero, P. Liò, Y. Bengio, “Graph attention networks”, ICLR 2018.
• L. A. Hendricks, K. Burns, K. Saenko, T. Darrell, A. Rohrbach, “Women also snowboard: overcoming bias in captioning models”, FAT-ML 2018; extended version by K. Burns, L. A. Hendricks, K. Saenko, T. Darrell, A. Rohrbach, ECCV 2018.
• M. Geiger, A. Jacot, S. Spigler, F. Gabriel, L. Sagun, S. d’Ascoli, G. Biroli, C. Hongler, M. Wyart, “Scaling description of generalization with number of parameters in deep learning”, arXiv, 2019.
• M. Zaheer, S. Kottur, S. Ravanbakhsh, B. Póczos, R. Salakhutdinov, A. Smola, “Deep sets”, NIPS 2017.
• J. Sirignano, K. Spiliopoulos, “DGM: a deep learning algorithm for solving partial differential equations”, Journal of Computational Physics 375, 2018.

Textbooks.

• S. J. D. Prince, Understanding Deep Learning, MIT Press, 2023.
• S. Shalev-Shwartz, S. Ben-David, Understanding Machine Learning: From Theory to Algorithms, Cambridge University Press, 2014.
• F. Bach, Learning Theory from First Principles, MIT Press, 2024.
• R. S. Sutton, A. G. Barto, Reinforcement Learning: An Introduction, 2nd ed., MIT Press, 2018.

Ch. 1 — deep learning versus classical theory.

• C. Zhang, S. Bengio, M. Hardt, B. Recht, O. Vinyals, “Understanding deep learning requires rethinking generalization”, ICLR 2017.
• P. L. Bartlett, N. Harvey, C. Liaw, A. Mehrabian, “Nearly-tight VC-dimension and pseudodimension bounds for piecewise linear neural networks”, Journal of Machine Learning Research 20, 2019.
• H. Karimi, J. Nutini, M. Schmidt, “Linear convergence of gradient and proximal-gradient methods under the Polyak–Łojasiewicz condition”, ECML-PKDD 2016.
• C. Liu, L. Zhu, M. Belkin, “Loss landscapes and optimization in over-parameterized non-linear systems and neural networks”, Applied and Computational Harmonic Analysis 59, 2022.
• A. Jacot, F. Gabriel, C. Hongler, “Neural tangent kernel: convergence and generalization in neural networks”, NeurIPS 2018.
• D. Soudry, E. Hoffer, M. S. Nacson, S. Gunasekar, N. Srebro, “The implicit bias of gradient descent on separable data”, Journal of Machine Learning Research 19, 2018.
• M. Belkin, D. Hsu, S. Ma, S. Mandal, “Reconciling modern machine-learning practice and the classical bias–variance trade-off”, PNAS 116, 2019.
• P. Nakkiran, G. Kaplun, Y. Bansal, T. Yang, B. Barak, I. Sutskever, “Deep double descent: where bigger models and more data hurt”, ICLR 2020.
• G. Hinton, O. Vinyals, J. Dean, “Distilling the knowledge in a neural network”, arXiv, 2015.

Ch. 2 — architectures.

• K. He, X. Zhang, S. Ren, J. Sun, “Deep residual learning for image recognition”, CVPR 2016.
• S. Ioffe, C. Szegedy, “Batch normalization: accelerating deep network training by reducing internal covariate shift”, ICML 2015; J. L. Ba, J. R. Kiros, G. E. Hinton, “Layer normalization”, arXiv, 2016.
• A. Vaswani et al., “Attention is all you need”, NeurIPS 2017; A. Dosovitskiy et al., “An image is worth 16x16 words: transformers for image recognition at scale”, ICLR 2021.
• E. Wagstaff, F. Fuchs, M. Engelcke, I. Posner, M. A. Osborne, “On the limitations of representing functions on sets”, ICML 2019.
• J. Gilmer, S. S. Schoenholz, P. F. Riley, O. Vinyals, G. E. Dahl, “Neural message passing for quantum chemistry”, ICML 2017.
• T. N. Kipf, M. Welling, “Semi-supervised classification with graph convolutional networks”, ICLR 2017; S. Brody, U. Alon, E. Yahav, “How attentive are graph attention networks?”, ICLR 2022.

Ch. 3 — interpretability and biases.

• K. Simonyan, A. Vedaldi, A. Zisserman, “Deep inside convolutional networks: visualising image classification models and saliency maps”, ICLR workshop, 2014.
• M. Sundararajan, A. Taly, Q. Yan, “Axiomatic attribution for deep networks”, ICML 2017.
• R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, D. Batra, “Grad-CAM: visual explanations from deep networks via gradient-based localization”, ICCV 2017.
• M. D. Zeiler, R. Fergus, “Visualizing and understanding convolutional networks”, ECCV 2014; D. Erhan, Y. Bengio, A. Courville, P. Vincent, “Visualizing higher-layer features of a deep network”, technical report 1341, Université de Montréal, 2009.
• J. Adebayo, J. Gilmer, M. Muelly, I. Goodfellow, M. Hardt, B. Kim, “Sanity checks for saliency maps”, NeurIPS 2018.
• S. M. Lundberg, S.-I. Lee, “A unified approach to interpreting model predictions”, NeurIPS 2017.
• M. Hardt, E. Price, N. Srebro, “Equality of opportunity in supervised learning”, NeurIPS 2016.
• S. Barocas, M. Hardt, A. Narayanan, Fairness and Machine Learning: Limitations and Opportunities, MIT Press, 2023.
• J. Kleinberg, S. Mullainathan, M. Raghavan, “Inherent trade-offs in the fair determination of risk scores”, ITCS 2017; A. Chouldechova, “Fair prediction with disparate impact: a study of bias in recidivism prediction instruments”, Big Data 5, 2017.
• J. Zhao, T. Wang, M. Yatskar, V. Ordonez, K.-W. Chang, “Men also like shopping: reducing gender bias amplification using corpus-level constraints”, EMNLP 2017.
• B. H. Zhang, B. Lemoine, M. Mitchell, “Mitigating unwanted biases with adversarial learning”, AAAI/ACM Conference on AI, Ethics, and Society 2018.

Ch. 4 — weak supervision and data quantity.

• Z.-H. Zhou, “A brief introduction to weakly supervised learning”, National Science Review 5, 2018.
• K. Sohn et al., “FixMatch: simplifying semi-supervised learning with consistency and confidence”, NeurIPS 2020; Y. Grandvalet, Y. Bengio, “Semi-supervised learning by entropy minimization”, NIPS 2004.
• B. Settles, “Active learning literature survey”, technical report 1648, University of Wisconsin–Madison, 2009.
• D. Arpit et al., “A closer look at memorization in deep networks”, ICML 2017.
• G. Patrini, A. Rozza, A. K. Menon, R. Nock, L. Qu, “Making deep neural networks robust to label noise: a loss correction approach”, CVPR 2017.
• A. Ghosh, H. Kumar, P. S. Sastry, “Robust loss functions under label noise for deep neural networks”, AAAI 2017; Z. Zhang, M. R. Sabuncu, “Generalized cross entropy loss for training deep neural networks with noisy labels”, NeurIPS 2018.
• T. G. Dietterich, R. H. Lathrop, T. Lozano-Pérez, “Solving the multiple instance problem with axis-parallel rectangles”, Artificial Intelligence 89, 1997; M. Ilse, J. M. Tomczak, M. Welling, “Attention-based deep multiple instance learning”, ICML 2018.
• J. Kaplan et al., “Scaling laws for neural language models”, arXiv, 2020; J. Hoffmann et al., “Training compute-optimal large language models”, NeurIPS 2022.

Ch. 5 — physics and control.

• T. Cohen, M. Welling, “Group equivariant convolutional networks”, ICML 2016.
• M. Raissi, P. Perdikaris, G. E. Karniadakis, “Physics-informed neural networks: a deep learning framework for solving forward and inverse problems involving nonlinear partial differential equations”, Journal of Computational Physics 378, 2019.
• S. Greydanus, M. Dzamba, J. Yosinski, “Hamiltonian neural networks”, NeurIPS 2019.
• V. Mnih et al., “Human-level control through deep reinforcement learning”, Nature 518, 2015; H. van Hasselt, A. Guez, D. Silver, “Deep reinforcement learning with double Q-learning”, AAAI 2016.
• N. Rahaman et al., “On the spectral bias of neural networks”, ICML 2019; M. Tancik et al., “Fourier features let networks learn high frequency functions in low dimensional domains”, NeurIPS 2020.

Ch. 6 — generative models.

• D. P. Kingma, M. Welling, “Auto-encoding variational Bayes”, ICLR 2014; D. J. Rezende, S. Mohamed, D. Wierstra, “Stochastic backpropagation and approximate inference in deep generative models”, ICML 2014.
• I. Goodfellow et al., “Generative adversarial nets”, NeurIPS 2014; M. Arjovsky, S. Chintala, L. Bottou, “Wasserstein generative adversarial networks”, ICML 2017; M. Heusel et al., “GANs trained by a two time-scale update rule converge to a local Nash equilibrium”, NeurIPS 2017.
• L. Dinh, J. Sohl-Dickstein, S. Bengio, “Density estimation using Real NVP”, ICLR 2017; G. Papamakarios, E. Nalisnick, D. J. Rezende, S. Mohamed, B. Lakshminarayanan, “Normalizing flows for probabilistic modeling and inference”, Journal of Machine Learning Research 22, 2021.

Ch. 7 — Auto-ML.

• J. Bergstra, Y. Bengio, “Random search for hyper-parameter optimization”, Journal of Machine Learning Research 13, 2012.
• J. Snoek, H. Larochelle, R. P. Adams, “Practical Bayesian optimization of machine learning algorithms”, NeurIPS 2012.
• K. Jamieson, A. Talwalkar, “Non-stochastic best arm identification and hyperparameter optimization”, AISTATS 2016; L. Li, K. Jamieson, G. DeSalvo, A. Rostamizadeh, A. Talwalkar, “Hyperband: a novel bandit-based approach to hyperparameter optimization”, Journal of Machine Learning Research 18, 2018.
• M. Jaderberg et al., “Population based training of neural networks”, arXiv, 2017.
• B. Zoph, Q. V. Le, “Neural architecture search with reinforcement learning”, ICLR 2017; H. Liu, K. Simonyan, Y. Yang, “DARTS: differentiable architecture search”, ICLR 2019.
• J. Lorraine, P. Vicol, D. Duvenaud, “Optimizing millions of hyperparameters by implicit differentiation”, AISTATS 2020.

Ch. 8 — guarantees.

• N. Golowich, A. Rakhlin, O. Shamir, “Size-independent sample complexity of neural networks”, COLT 2018; P. L. Bartlett, D. J. Foster, M. Telgarsky, “Spectrally-normalized margin bounds for neural networks”, NeurIPS 2017.
• D. A. McAllester, “PAC-Bayesian model averaging”, COLT 1999; A. Maurer, “A note on the PAC Bayesian theorem”, arXiv, 2004.
• G. K. Dziugaite, D. M. Roy, “Computing nonvacuous generalization bounds for deep (stochastic) neural networks with many more parameters than training data”, UAI 2017.
• C. Szegedy et al., “Intriguing properties of neural networks”, ICLR 2014.
• Y. Tsuzuku, I. Sato, M. Sugiyama, “Lipschitz-margin training: scalable certification of perturbation invariance for deep neural networks”, NeurIPS 2018.
• S. Gowal et al., “On the effectiveness of interval bound propagation for training verifiably robust models”, arXiv, 2018.
• V. Tjeng, K. Xiao, R. Tedrake, “Evaluating robustness of neural networks with mixed integer programming”, ICLR 2019; G. Katz, C. Barrett, D. L. Dill, K. Julian, M. J. Kochenderfer, “Reluplex: an efficient SMT solver for verifying deep neural networks”, CAV 2017.
• J. Cohen, E. Rosenfeld, J. Z. Kolter, “Certified adversarial robustness via randomized smoothing”, ICML 2019.

Ch. 9 — research directions.

• L. Chizat, E. Oyallon, F. Bach, “On lazy training in differentiable programming”, NeurIPS 2019; S. Mei, A. Montanari, P.-M. Nguyen, “A mean field view of the landscape of two-layer neural networks”, PNAS 115, 2018; L. Chizat, F. Bach, “On the global convergence of gradient descent for over-parameterized models using optimal transport”, NeurIPS 2018.
• J. Cohen, S. Kaur, Y. Li, J. Z. Kolter, A. Talwalkar, “Gradient descent on neural networks typically occurs at the edge of stability”, ICLR 2021; A. Power, Y. Burda, H. Edwards, I. Babuschkin, V. Misra, “Grokking: generalization beyond overfitting on small algorithmic datasets”, arXiv, 2022.
• S. Arora, R. Ge, B. Neyshabur, Y. Zhang, “Stronger generalization bounds for deep nets via a compression approach”, ICML 2018; W. Zhou, V. Veitch, M. Austern, R. P. Adams, P. Orbanz, “Non-vacuous generalization bounds at the ImageNet scale: a PAC-Bayesian compression approach”, ICLR 2019; J. Frankle, M. Carbin, “The lottery ticket hypothesis: finding sparse, trainable neural networks”, ICLR 2019.
• C. Olah et al., “Zoom in: an introduction to circuits”, Distill, 2020; T. Bricken et al., “Towards monosemanticity: decomposing language models with dictionary learning”, Transformer Circuits Thread, 2023; B. Kim et al., “Interpretability beyond feature attribution: quantitative testing with concept activation vectors (TCAV)”, ICML 2018.
• M. J. Kusner, J. Loftus, C. Russell, R. Silva, “Counterfactual fairness”, NeurIPS 2017; P. W. Koh et al., “WILDS: a benchmark of in-the-wild distribution shifts”, ICML 2021.
• A. Radford et al., “Learning transferable visual models from natural language supervision”, ICML 2021.
• L. Lu, P. Jin, G. Pang, Z. Zhang, G. E. Karniadakis, “Learning nonlinear operators via DeepONet based on the universal approximation theorem of operators”, Nature Machine Intelligence 3, 2021; Z. Li et al., “Fourier neural operator for parametric partial differential equations”, ICLR 2021.
• R. Lam et al., “Learning skillful medium-range global weather forecasting”, Science 382, 2023; A. S. Krishnapriyan, A. Gholami, S. Zhe, R. M. Kirby, M. W. Mahoney, “Characterizing possible failure modes in physics-informed neural networks”, NeurIPS 2021.
• J. Sohl-Dickstein, E. Weiss, N. Maheswaranathan, S. Ganguli, “Deep unsupervised learning using nonequilibrium thermodynamics”, ICML 2015; J. Ho, A. Jain, P. Abbeel, “Denoising diffusion probabilistic models”, NeurIPS 2020; Y. Song et al., “Score-based generative modeling through stochastic differential equations”, ICLR 2021; Y. Lipman, R. T. Q. Chen, H. Ben-Hamu, M. Nickel, M. Le, “Flow matching for generative modeling”, ICLR 2023.
• C. Ying et al., “NAS-Bench-101: towards reproducible neural architecture search”, ICML 2019; L. Li, A. Talwalkar, “Random search and reproducibility for neural architecture search”, UAI 2019.
• S. Wang et al., “Beta-CROWN: efficient bound propagation with per-neuron split constraints for neural network robustness verification”, NeurIPS 2021.

Exercises and projects — data sets and further papers.

• P. Nakkiran, P. Venkat, S. Kakade, T. Ma, “Optimal regularization can mitigate double descent”, ICLR 2021.
• E. Parrado-Hernández, A. Ambroladze, J. Shawe-Taylor, S. Sun, “PAC-Bayes bounds with data dependent priors”, Journal of Machine Learning Research 13, 2012.
• M. Mitchell et al., “Model cards for model reporting”, FAT* 2019.
• Y. LeCun, L. Bottou, Y. Bengio, P. Haffner, “Gradient-based learning applied to document recognition”, Proceedings of the IEEE 86, 1998; H. Xiao, K. Rasul, R. Vollgraf, “Fashion-MNIST: a novel image dataset for benchmarking machine learning algorithms”, arXiv, 2017; A. Krizhevsky, “Learning multiple layers of features from tiny images”, technical report, University of Toronto, 2009.
• Z. Liu, P. Luo, X. Wang, X. Tang, “Deep learning face attributes in the wild”, ICCV 2015; M. Arjovsky, L. Bottou, I. Gulrajani, D. Lopez-Paz, “Invariant risk minimization”, arXiv, 2019.
• S. Sagawa, P. W. Koh, T. B. Hashimoto, P. Liang, “Distributionally robust neural networks for group shifts: on the importance of regularization for worst-case generalization”, ICLR 2020; B. Han et al., “Co-teaching: robust training of deep neural networks with extremely noisy labels”, NeurIPS 2018.