{'fraction_non_alphanumeric': 0.03764492247520603, 'fraction_numerical': 0.017274293430181123, 'mean_word_length': 4.499295864806043, 'pattern_counts': {'":': 0, '<': 12, '<?xml version=': 0, '>': 6, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Invertible DenseNets with Concatenated LipSwish

We introduce Invertible Dense Networks (i-DenseNets), a more parameter efficient extension of Residual Flows. The method relies on an analysis of the Lipschitz continuity of the concatenation in DenseNets, where we enforce invertibility of the network by satisfying the Lipschitz constant. Furthermore, we propose a learnable weighted concatenation, which not only improves the model performance but also indicates the importance of the concatenated weighted representation. Additionally, we introduce the Concatenated LipSwish as activation function, for which we show how to enforce the Lipschitz condition and which boosts performance. The new architecture, i-DenseNet, out-performs Residual Flow and other flow-based models on density estimation evaluated in bits per dimension, where we utilize an equal parameter budget. Moreover, we show that the proposed model out-performs Residual Flows when trained as a hybrid model where the model is both a generative and a discriminative model.


Introduction
Neural networks are widely used to parameterize non-linear models in supervised learning tasks such as classification. In addition, they are also utilized to build flexible density estimators of the true distribution of the observed data [25,33]. The resulting deep density estimators, also called deep generative models, can be further used to generate realistic-looking images that are hard to separate from real ones, detection of adversarial attacks [9,17], and for hybrid modeling [27] which have the property to both predict a label (classify) and generate.
Many deep generative models are trained by maximizing the (log-)likelihood function and their architectures come in different designs. For instance, causal convolutional neural networks are used to parameterize autoregressive models [28,29] or various neural networks can be utilized in Variational Auto-Encoders [19,32]. The other group of likelihood-based deep density estimators, flow-based models (or flows), consist of invertible neural networks since they are used to compute the likelihood through the change of variable formula [31,37,36]. The main difference that determines an exact computation or approximation of the likelihood function for a flow-based model lies in the design of the transformation layer and tractability of the Jacobian-determinant. Many flow-based models formulate the transformation that is invertible and its Jacobian is tractable [3, 6-8, 21, 30, 31, 38].
Recently, Behrmann et al. [2] proposed a different approach, namely, deep-residual blocks as a transformation layer. The deep-residual networks (ResNets) of [12] are known for their successes in supervised learning approaches. In a ResNet block, each input of the block is added to the output, which forms the input for the next block. Since ResNets are not necessarily invertible, Behrmann et al. [2] enforce the Lipschitz constant of the transformation to be smaller than 1 (i.e., it becomes a contraction) that allows applying an iterative procedure to invert the network. Furthermore, Chen et al. [4] proposed Residual Flows, an improvement of i-ResNets, that uses an unbiased estimator for the logarithm of the Jacobian-determinant.  Figure 1: A schematic representation for: (a) a residual block, (b) a dense block. The pink part in (b) expresses a 1 × 1 convolution to reduce the dimension of the last dense layer. W i denotes the (convolutional) layer at step i that satisfy ||W i || 2 < 1.
In supervised learning, an architecture that uses fewer parameters and is even more powerful than the deep-residual network is the Densely Connected Convolution Network (DenseNet), which was first presented in [15]. Contrary to a ResNet block, a DenseNet layer consists of a concatenation of the input with the output. The network showed to improve significantly in recognition tasks on benchmark datasets such as CIFAR10, SVHN, and ImageNet, by using fewer computations and having fewer parameters than ResNets while performing at a similar level.
In this work, we extend Residual Flows [2,4], and use densely connected blocks (DenseBlocks) as a residual layer. First, we introduce invertible Dense Networks (i-DenseNets), and we show that we can derive a bound on the Lipschitz constant to create an invertible flow-based model. Furthermore, we propose the Concatenated LipSwish (CLipSwish) as an activation function, and derive a stronger Lipschitz bound. The CLipSwish function preserves more signal than LipSwish activation functions. Finally, we demonstrate how i-DenseNets can be efficiently trained as a generative model, outperforming Residual Flows and other flow-based models under an equal parameter budget.

Background
Flow-based models Let us consider a vector of observable variables x ∈ R d and a vector of latent variables z ∈ R d . We define a bijective function f : R d → R d that maps a latent variable to a datapoint x = f (z). Since f is invertible, we define its inverse as F = f −1 . We use the change of variables formula to compute the likelihood of a datapoint x after taking the logarithm, that is: where p Z (z) is a base distribution (e.g., the standard Gaussian) and J F (x) is the Jacobian of F at x. The bijective transformation is typically constructed as a sequence of K invertible transformations, , and a single transformation f k is referred to as a flow [31]. The change of variables formula allows evaluating the data in a tractable manner. Moreover, the flows are trained using the log-likelihood objective where the Jacobian-determinant compensates the change of volume of the invertible transformations.
Residual flows Behrmann et al. [2] construct an invertible ResNet layer which is only constrained in Lipschitz continuity. A ResNet is defined as: , where g is modeled by a (convolutional) neural network and F represents a ResNet layer (see Figure 1(a)) which is in general not invertible. However, g is constructed in such a way that it satisfies the Lipschitz constant being strictly lower than 1, Lip(g) < 1, by using spectral normalization of [10,26]: where || · || 2 is the 2 matrix norm. Then Lip(g) = K < 1 and Lip(F ) < 1 + K. Only in this specific case the Banach fixed-point theorem holds and ResNet layer F has a unique inverse. As a result, the inverse can be approximated by fixed-point iterations.
To estimate the log-determinant is, especially for high-dimensional spaces, computationally intractable due to expensive computations. Since ResNet blocks have a constrained Lipschitz constant, the log-likelihood estimation of Equation (1) can be transformed to a version where the logarithm of the Jacobian-determinant is cheaper to compute, tractable, and approximated with guaranteed convergence [2]: where J g (x) is the Jacobian of g at x that satisfies ||J g || 2 < 1. The Skilling-Hutchinson trace estimator [35,16] is used to compute the trace at a lower cost than to fully compute the trace of the Jacobian. Residual Flows [4] use an improved method to estimate the power series at an even lower cost with an unbiased estimator based on "Russian roulette" of [18]. Intuitively, the method estimates the infinite sum of the power series by evaluating a finite amount of terms. In return, this leads to less computation of terms compared to invertible residual networks. To avoid derivative saturation, which occurs when the second derivative is zero in large regions, the LipSwish activation is proposed.

Invertible Dense Networks
In this section, we propose Invertible Dense Networks by using a DenseBlock as a residual layer. We show how the network can be parameterized as a flow-based model and refer to the resulting model as i-DenseNets. The code can be retrieved from: https://github.com/yperugachidiaz/ invertible_densenets.

Dense blocks
The main component of the proposed flow-based model is a DenseBlock that is defined as a function Note that an important modification to make the model invertible is to output x + g(x) whereas a standard DenseBlock would only output g(x). The function g is expressed as follows: where W n+1 represents a 1 × 1 convolution to match the output size of R d . A layer h i consists of two parts concatenated to each other. The upper part is a copy of the input signal. The lower part consists of the transformed input, where the transformation is a multiplication of (convolutional) weights W i with the input signal, followed by a non-linearity φ having Lip(φ) ≤ 1, such as ReLU, ELU, LipSwish, or tanh. As an example, a dense layer h 2 can be composed as follows: In Figure 1, we schematically outline a residual block (Figure 1(a)) and a dense block (Figure 1(b)). We refer to concatenation depth as the number of dense layers in a DenseBlock and growth as the channel growth size of the transformation in the lower part.

Constraining the Lipschitz constant
If we enforce function g to satisfy Lip(g) < 1, then DenseBlock F is invertible since the Banach fixed point theorem holds. As a result, the inverse can be approximated in the same manner as in [2]. To satisfy Lip(g) < 1, we need to enforce Lip(h i ) < 1 for all n layers, since Lip(g) ≤ Lip(h n+1 ) · . . . · Lip(h 1 ). Therefore, we first need to determine the Lipschitz constant for a dense layer h i . For the full derivation, see Appendix A. We know that a function f is K-Lipschitz if for all points v and w the following holds : where we assume that the distance metrics d X = d Y = d are chosen to be the 2 -norm. Further, let two functions f 1 and f 2 be concatenated in h: where function f 1 is the upper part and f 2 is the lower part. We can now find an analytical form to express a limit on K for the dense layer in the form of Equation (6): where we know that the Lipschitz constant of h consist of two parts, namely, Lip(f 1 ) = K 1 and Lip(f 2 ) = K 2 . Therefore, the Lipschitz constant of layer h can be expressed as: With spectral normalization of Equation (2), we know that we can enforce (convolutional) weights W i to be at most 1-Lipschitz. Hence, for all n dense layers we apply the spectral normalization on the lower part which locally enforces Lip(f 2 ) = K 2 < 1. Further, since we enforce each layer h i to be at most 1-Lipschitz and we start with h 1 , where f 1 (x) = x, we know that Lip(f 1 ) = 1. Therefore, the Lipschitz constant of an entire layer can be at most Lip(h) < √ 1 2 + 1 2 = √ 2, thus dividing by this limit enforces each layer to be at most 1-Lipschitz. We have shown that we can enforce an entire dense layer to have Lip(h i ) < 1 by applying a spectral norm on the (convolutional) weights W i and then divide the layer h i by √ 2. Although learning a weighting between the upper and lower part would barely affect a standard dense layer, it matters in this case because the layers are regularized to be 1-Lipschitz. To optimize and learn the importance of the concatenated representations, we introduce learnable parameters η 1 and η 2 for, respectively, the upper and lower part of each layer h i .

Learnable weighted concatenation
Since the upper and lower part of the layer can be at most 1-Lipschitz, multiplication by these factors results in functions that are at most η 1 -Lipschitz and η 2 -Lipschitz. As indicated by Equation (9), the layer is then at most η 2 1 + η 2 2 −Lipschitz. Dividing by this factor results in a bound that is at most 1-Lipschitz.
In practice, we initialize η 1 and η 2 at value 1 and during training use a softplus function to avoid them being negative. The range of the normalized parameters is betweenη 1 ,η 2 ∈ [0, 1] and can be expressed on the unit circle as shown in Figure 2. In the special case where η 1 = η 2 , the normalized parameters areη 1 =η 2 = 1 2 √ 2. This case corresponds to the situation in Section 3.2 where the concatenation is not learned. An additional advantage is that the normalizedη 1 andη 2 express the importance of the upper and lower signal. For example, whenη 1 >η 2 , the input signal is of more importance than the transformed signal.

CLipSwish
When a deep neural network is bounded to be 1-Lipschitz, in practice each consecutive layer reduces the Jacobian-norm. As a result, the Jacobian-norm of the entire network is becoming much smaller than 1 and the expressive power is getting lost. This is known as gradient norm attenuation [1,24]. This problem arises in activation functions in regions where the derivative is small, such as the left tail of the ReLU and the LipSwish. Non-linearities φ modeled in i-DenseNets are required to be at most 1-Lipschitz and, thus, face gradient-norm attenuation issues. For this reason we introduce a new activation function, which mitigates these issues.
Recall that Residual Flows use the LipSwish activation function [4]: where σ(βx) = 1/(1 + exp(−xβ)) is the sigmoid , β is a learnable constant, initialized at 0.5 and is passed through a softplus to be strictly positive. This activation function is not only Lip(LipSwish) = 1 but also resolves the derivative saturation problem [4]. However, the LipSwish function has large ranges on the negative axis where its derivative is close to zero. Therefore, we propose the Concatenated LipSwish (CLipSwish) which concatenates two LipSwish functions with inputs x and −x. This is a concatenated activation function as in [34] but using a LipSwish instead of a ReLU. Intuitively, even if an input lies in the tail of the upper part, it will have a larger derivative in the bottom part and thus suffer less from gradient norm attenuation. Since using CLipSwish increases the channel growth and to stay inline with the channel growth that non-concatenated activation functions use, we use a lower channel growth when using CLipSwish.
To utilize the CLipSwish, we need to derive Lipschitz continuity of the activation function Φ defined below and enforce it to be 1-Lipschitz. We could use the result obtained in Equation (9) to obtain a √ 2-bound, however, by using knowledge about the activation function Φ, we can derive a tighter 1.004 < √ 2 bound. In general, a tighter bound is preferred since more expressive power will be preserved in the network. To start with, we define function Φ : R → R 2 for a point x as: where the LipSwish is given by Equation (10) and the derivative of Φ(x) exists. To find Lip(Φ) we use that for a differentiable 2 -Lipschitz bounded function Φ, the following identity holds: where J Φ (x) is the Jacobian of Φ at x and || · || 2 represents the induced matrix norm which is equal to the spectral norm of the matrix. Rewriting the spectral norm results in solving: where σ max (·) is the largest singular value. Now Lip(Φ) is the upper bound of the CLipSwish and is equal to the supremum of:  To make a clear comparison between the performance of Residual Flows and i-DenseNets, we train both models on 2-dimensional toy data and high-dimensional image data: CIFAR10 [22] and ImageNet32 [5]. Since we have a constrained computational budget, we use smaller architectures for the exploration of the network architectures. An indepth analysis of different settings and experiments can be found in Section 5. For density estimation, we run the full model with the best settings for 1,000 epochs on CIFAR10 and 20 epochs on Ima-geNet32 where we use single-seed results following [2,4,20], due to little fluctuations in performance.

Experiments
In all cases, we use the density estimation results of the Residual Flow and other flow-based models using uniform dequantization to create a fair comparison and benchmark these with i-DenseNets. We train i-DenseNets with learnable weighted concatenation (LC) and CLipSwish as the activation function, and utilize a similar number of parameters for i-DenseNets as Residual Flows; this can be found in Table 2. i-DenseNets uses slightly fewer parameters than the Residual Flow. A detailed description of the architectures can be found in Appendix B. To speed up training, we use 4 GPUs. We start with testing i-DenseNets and Residual Flows on toy data, where we use smaller architectures. Instead of 100 flow blocks, we use 10 flow blocks. We train both models for 50,000 iterations and, at the end of the training, we visualize the learned distributions.

Toy data
The results of the learned density distributions are presented in Figure 3. We observe that Residual Flows are capable to capture highprobability areas. However, they have trouble with learning low probability regions for two circles and moons. i-DenseNets are capable of capturing all regions of the datasets. The good performance of i-DenseNets is also reflected in better performance in terms of the negative-log-likelihood (see Table 1).  Model CIFAR10 ImageNet32

Density Estimation
Real NVP [8] 3.49 4.28 Glow [20] 3.35 4.09 FFJORD [11] 3.40 -Flow++ [13] 3.29 -ConvSNF [14] 3.29 i-ResNet [2] 3.45 -Residual Flow [4] The density estimation on CIFAR10 and Ima-geNet32 are benchmarked against the results of Residual Flows and other comparable flow-based models, where the results are retrieved from Chen et al. [4]. We measure performances in bits per dimension (bpd). The results can be found in Table 3. We find that i-DenseNets out-perform Residual Flows and other comparable flow-based models on all considered datasets in terms of bpd. On CIFAR10, i-DenseNet achieves 3.25bpd, against 3.28bpd of the Residual Flow. On ImageNet32 i-DenseNet achieves 3.98bpd against 4.01bpd of the Residual Flow. Samples of the i-DenseNet models can be found in Figure 4. Samples of the model trained on CIFAR10 are presented in Figure 4(b) and samples of the model trained on ImageNet32 in Figure 4(d). For more unconditional samples, see Appendix C.1. Note that this work does not compare against flow-based models using variational dequantization. Instead we focus on extending and making a fair comparison with Residual Flows which, similar to other flow-based models, use uniform dequantization. For reference note that Flow++ [13] with variational dequantization obtains 3.08bpd on CIFAR10 and 3.86bpd on ImageNet32 that is better than the model with uniform dequantization which achieves 3.29bpd on CIFAR10.

Hybrid Modeling
Besides density estimation, we also experiment with hybrid modeling [27]. We train the joint distribution p(x, y) = p(x) p(y|x), where p(x) is modeled with a generative model and p(y|x) is modeled with a classifier, which uses the features of the transformed image onto the latent space.  Due to the different dimensionalities of y and x, the emphasis of the likelihood objective is more likely to be focused on p(x) and a scaling factor for a weighted maximum likelihood objective is where λ is the scaling factor expressing the trade-off between the generative and discriminative parts. Unlike [27] where a linear layer is integrated on top of the latent representation, we use the architecture of [4] where the set of features are obtained after every scale level. Then, they are concatenated and are followed by a linear softmax classifier. We compare our experiments with the results of [4] where Residual Flow, coupling blocks [7] and 1 × 1 convolutions [20] are evaluated.   Table 4 presents the hybrid modeling results on CIFAR10 where we used We run the three models for 400 epochs and note that the model with λ = 1 was not fully converged in both accuracy and bits per dimension after training. The classifier model obtains a converged accuracy after around 250 epochs. This is in line with the accuracy for the model with λ = 1 D , yet based on bits per dimension the model was not fully converged after 400 epochs. This indicates that even though the accuracy is not further improved, the model keeps optimizing the bits per dimension which gives room for future research. Results in Table 4 show the average result over the last 5 epochs. We find that Dense Blocks out-perform Residual Blocks for all possible λ settings. Interestingly, Dense Blocks have the biggest impact using no penalty (λ = 1) compared to the other models. We obtain an accuracy of 75.67% with 3.31bpd, compared to 70.32% accuracy and 3.39bpd of Residual Blocks, indicating that Dense Blocks significantly improves classification performance with more than 5%. In general, the Dense Block hybrid model is out-performing Real NVP, Glow, FFJORD, and i-ResNet in bits per dimension (see Appendix C.2 for samples of the hybrid models).

Analysis and future work
To get a better understanding of i-DenseNets, we perform additional experiments, explore different settings, analyze the results of the model and discuss future work. We use smaller architectures for these experiments due to a limited computational budget. For Residual Flows and i-DenseNets we use 3 scale levels set to 4 Flow blocks instead of 16 per scale level and train models on CIFAR10 for 200 epochs. We will start with a short explanation of the limitations of 1-Lipschitz deep neural networks.

Analysis of activations and preservation of signals
Since gradient-norm attenuation can arise in 1-Lipschitz bounded deep neural nets, we analyze how much signal of activation functions is preserved by examining the maximum and average distance ratios of sigmoid, LipSwish, and CLipSwish. Note that the maximum distance ratio approaches the Lipschitz constant and it is desired that the average distance ratio remains high. We sample 100,000 datapoints v, w ∼ N (0, 1) with dimension set to D = {1, 128, 1024}. We compute the mean and maximum of the sampled ratios with: 2 (φ(v), φ(w))/ 2 (v, w) and analyze the expressive power of each function. Table 5 shows the results. We find that CLipSwish for all dimensions preserves most of the signal on average compared to the other non-linearities. This may explain why i-DenseNets with CLipSwish activation achieves better results than using, e.g., LipSwish. This experiment indicates that on randomly sampled points, CLipswish functions suffer from considerably less gradient norm attenuation. Note that sampling from a distribution with larger parameter values is even more pronounced in preference of CLipSwish, see Appendix D.1.

Activation Functions
We start with exploring different activation functions for both networks and test these with the smaller architectures. We compare our CLipSwish to the LipSwish and the LeakyLSwish as an additional baseline, which allows freedom of movement in the left tail as opposed to a standard LipSwish: with α ∈ (0, 1) by passing it through a sigmoid function σ. Here α is a learnable parameter which is initialized at α = σ(−3) to mimic the LipSwish at initialization. Note that the dimension for Residual Flows with CLipSwish activation function is set to 652 instead of 512 to maintain a similar number of parameters (8.7M) as with LipSwish activation.   Figure 5.
We observe that the model with a depth of 3 obtains the best scores and after 200 epochs it achieves the lowest bits per dimension with 3.37bpd. A concatenation depth of 5 results in 3.42bpd after 200 epochs, which is the least preferred. This could indicate that the corresponding DenseNet growth of 92 is too little to capture the density structure sufficiently and due to the deeper depth the network might lose important signals. Further, the figure clearly shows how learnable weighted concatenation after 25 epochs boosts training for all i-DenseNets. See Appendix D.3 for an in-depth analysis of results of the learnable weighted concatenation. Furthermore, we performed an additional experiment (see Appendix D.4) where we extended the width and depth of the ResNet connections in g(x) of Residual Flows in such a way that it matches the size of the i-DenseNet. As a result on CIFAR10 this puts the extended Residual Flow at a considerable advantage as it utilizes 19.1M parameters instead of 8.7M. However, when looking at performance the model performs worse (7.02bpd) than i-Densenets (3.39bpd) and even worse than its original version (3.42bpd) in terms of bpd. A possible explanation of this phenomenon is that by forcing more convolutional layers to be 1-Lipschitz, the gradient norm attenuation problems increase and in practice they become considerably less expressive. This indicates that modeling a DenseNet in g(x) is indeed an important difference that gives better performance.

Future Work
We introduced a new framework, i-DenseNet, that is inspired by Residual Flows and i-ResNets. We demonstrated how i-DenseNets out-performs Residual Flows and alternative flow-based models for density estimation and hybrid modeling, constraint by using uniform dequantization. For future work, we want to address several interesting aspects we came across and where i-DenseNets may be further deployed and explored.
First of all, we find that smaller architectures have more impact on performance than full models compared to Residual Flows. Especially for exploration of the network, we recommend experimenting with smaller architectures or when a limited computational budget is available. This brings us to the second point. Due to a limited budget, we trained and tested i-DenseNets on 32 × 32 CIFAR10 and ImageNet32 data. It will be interesting to test higher resolution and other types of datasets.
Further exploration of DenseNets depth and growth for other or higher resolution datasets may be worthwhile. In our studies, deeper DenseNets did not result in better performance. However, it would also be beneficial to further examine the optimization of DenseNets architectures. Similarly, we showed how to constrain DenseBlocks for the 2 -norm. For future work, it may be interesting to generalize the method to different norm types, as well as the norm for CLipSwish activation function. Note that CLipSwish as activation function not only boosts performance of i-DenseNets but also for Residual Flows. We recommend this activation function for future work.
We want to stress that we focused on extending Residual Flows, which uses uniform dequantization. However, we believe that the performance of our network may be improved using variational dequantization or augmentation. Finally, we found that especially hybrid model with λ = 1, achieve better performance than its predecessors. This may be worthwhile to further investigate in the future.
Societal Impact We discussed methods to improve normalizing flow, a method that learns highdimensional distributions. We generated realistic-looking images and also used hybrid models that both predict the label of an image and generate new ones. Besides generating images, these models can be deployed to, e.g., detect adversarial attacks. Additionally, this method is applicable to all different kind of fields such as chemistry or physics. An increasing concern is that generative models in general, have an impact on society. They can not only be used to aid society but can also be used to generate misleading information by those who use these models. Examples of these cases could be generating real-looking documents, Deepfakes or even detection of fraud with the wrong intentions. Even though current flow-based models are not there yet to generate flawless reproductions, this concern should be kept in mind. It even raises the question if these models should be used in practice when detection of misleading information becomes difficult or even impossible to track.

Conclusion
In this paper, we proposed i-DenseNets, a parameter-efficient alternative to Residual Flows. Our method enforces invertibility by satisfying the Lipschitz continuity in dense layers. In addition, we introduced a version where the concatenation of features is learned during training that indicates which representations are of importance for the model. Furthermore, we showed how to deploy the CLipSwish activation function. For both i-DenseNets and Residual Flows this significantly improves performance. Smaller architectures under an equal parameter budget were used for the exploration of different settings.
The full model for density estimation was trained on 32 × 32 CIFAR10 and ImageNet32 data. We demonstrated the performance of i-DenseNets and compared the models to Residual Flows and other comparable Flow-based models on density estimation in bits per dimension. Yet, it also demonstrated how the model could be deployed for hybrid modeling that includes classification in terms of accuracy and density estimation in bits per dimension. Furthermore, we showed that modeling ResNet connections matching the size of an i-DenseNet obtained worse performance than the i-DenseNet and the original Residual Flow. In conclusion, i-DenseNets out-perform Residual Flows and other competitive flow-based models for density estimation on all considered datasets in bits per dimension and hybrid modeling that includes classification. The obtained results clearly indicate the high potential of i-DenseNets as powerful flow-based models.

A Derivations
This appendix provides the reader full derivations of the Lipschitz constant for the concatenation in DenseNets and a bound of the Lipschitz for the activation functions.

A.1 Derivation of Lipschitz constant K for the concatenation
We know that a function f is K-Lipschitz if for all points v and w the following holds: where d Y and d X are distance metrics and K is the Lipschitz constant.
Consider the case where we assume to have the same distance metric d Y = d X = d, and where the distance metric is assumed to be chosen as any p-norm, where p ≥ 1, for vectors: |δ i | p . Further, we assume a DenseBlock to be a function h where the output for each data point v and w is expressed as follows: where in this paper for a Dense Layer and for a data point x the function f 1 (x) = x and f 2 expresses a linear combination of (convolutional) weights with x followed by a non-linearity, for example φ(W 1 x). We can rewrite Equation (15) for the DenseNet function as: where K is the unknown Lipschitz constant for the entire DenseBlock. However, we can find an analytical form to express a limit on K. To solve this, we know that the distance between h v and h w can be expressed by the p-norm as: where we can simplify the equation by taking the p-th power: Since we know that the distance of f 1 can be expressed as: which is similar for the distance of f 2 , re-writing the second term of Equation (19) in the form of Equation (17) is assumed to be of form: which is similar for Assuming this, we can find a form of Equation (17) by substituting Equation (19) and Equation (21): Now, taking the p-th root we have: where we have derived the form of Equation (17) and where Lip(h) = K is expressed as: where Lip(f 1 ) = K 1 and Lip(f 2 ) = K 2 , which are assumed to be known Lipschitz constants.

A.2 Derivation bounded Lipschitz Concatenated ReLU
We define function φ : R → R 2 as the Concatenated ReLU for a point x: Let points v, w ∈ R. From Section A.1, Equation (18), we know that the distance between points transformed with φ and using the 2 -norm can be written as: Furthermore, we know that the distance between the two points is: We have four different situations that can happen. If v > 0, w > 0, then the distance between the points will be: In this specific case we have that d(v, w) 2 = v 2 + w 2 − 2vw, where 2vw > 0. The same holds for v ≤ 0, w ≤ 0, when the first term becomes zero and instead of zero, the second term becomes d(v, w) 2 with 2vw ≥ 0.
If v > 0, w ≤ 0, the distance between the points is equal to: The same derivation holds in the case v ≤ 0, w > 0. Combining all cases, we find that d(φ(v), φ(w)) ≤ d(v, w), therefore:

A.3 Derivation Lipschitz bound of CLipSwish
We propose the Concatenated LipSwish (CLipSwish) and show how we can enforce the CLipSwish to be 1-Lipschitz for a 1-dimensional input signal x and generalization to a higher dimension in the upcoming subsections.

A.3.1 CLipSwish 1 dimensional input signal
We derive the upper bound of Concatenated LipSwish and show that CLipSwish(x) = Φ(x)/1.004 is enforced to satisfy Lip(CLipSwish) = 1. To start with, we define function Φ : R → R 2 for a point x as: where: LipSwish(x) = xσ(βx)/1.1, and the partial derivative of Φ(x) exists. Then the Jacobian matrix of Φ is well-defined as: Furthermore, we know that for a 2 -Lipschitz bounded function Φ, the following holds: where J Φ (x) is the Jacobian of Φ and norm and || · || 2 represents the induced matrix norm which is equal to the spectral norm of the matrix. Furthermore, we know that for a matrix A the following holds: ||A|| 2 = σ max (A), where σ max is the largest singular value and the largest singular value is given by σ max (A) = √ λ 1 , since σ i = √ λ i for i = 1, . . . , n [23]. Now determining the singular values of J Φ (x) is done by solving det(J Φ (x) T J Φ (x) − λI n ) = 0. Combining and solving gives: where λ = λ 1 the largest eigenvalue, thus: . Therefore, the spectral norm of Equation (33), can be re-written as: Now Lip(Φ) is the upper bound of the CLipSwish and is equal to the supremum of: Lip(Φ) = sup x ||J Φ (x)|| 2 ≈ 1.004, for all values of β. This can be numerically computed by any solver, by determining the extreme values of Equation (35).

A.3.2 Generalization to higher dimensions
To generalize the Concatenated LipSwish activation function activation function to higher dimensions, we take Φ : R d → R 2d , which represents the CLipSwish activation function for a vector x = {x 1 , x 2 , . . . , x d }. Then the CLipSwish is given by the concatenation Φ(x) = [LipSwish(x), LipSwish(−x)], where φ 1 (x) = LipSwish(x) and φ 2 (x) = LipSwish(−x) ele-mentwise. The Jacobian matrix J Φ (x) with shape 2d × d, looks as follows: where ∂φi,j with off-diagonals equal to zero. Therefore, the determinant is given by multiplication of the diagonal entries and each eigenvalue is given by each diagonal entry. The general form of determinant and eigenvalues is written as: where each eigenvalue is given by: Then: where the last step is numerically approximated for the CLipSwish function, where φ is the LipSwish. Therefore, we plot Equation (39) in Python and compute the absolute extrema, which can be found in Figure 6. For this figure we plotted CLipSwish with β = 0.5 and passed it through a softplus function, as it is initialized in the code on GitHub. Next, we can numerically obtain the absolute extrema by computing the maximum value and argmax of the maximum value of Equation (39), which respectively represent the y-coordinate and x-coordinate of the absolute maximum. This accounts for all β's being strictly positive since changing β does not change the y-coordinate of the extreme value but only shifts the x-coordinate more to or further away from the origin.

B Implementation
We followed the architecture of [4] and during training used a batch size of 64. CIFAR10 and ImageNet32 are of size 32 × 32. CIFAR10 contains 50,000 training images and 10,000 test images. ImageNet32 contains 1,281,167 training images and 50,000 validation images. CIFAR10 has an MIT License and the ImageNet terms of access can be found here: https://image-net.org/ download.php. Before training, uniform dequantization is applied to the images after which a logit transformation is applied. For hybrid models, instead of the logit transform, the images use normalization x = x−µ σ . As in [4], for evaluation at least 20 terms of the power series for the Jacobian-determinant are computed while the remaining terms to compute, are determined by the unbiased estimator. Furthermore, we set a bound on the Lipschitz constant of each dense layer with a Lipschitz coefficient of 0.98. We use Adam optimizer with learning rate set to 0.001 to train the models.
For all our models we ensured an equal parameter budget as the architecture of Residual Flows [4]. For CIFAR10, the full i-DenseNets utilize 24.9M to utilize the 25.2M of Residual Flows. For ImageNet32, i-DenseNet utilizes 47.0M parameters to utilize the 47.1M of the Residual Flow. A numerical architecture of the full i-DenseNets for image data is presented in Table 7. g consists of several dense layers. The last dense layer h n is followed by a 1 × 1 convolution to match the output of size R d , after which a squeezing layer is applied. The final part of the network consists of a Fully Connected (FC) layer with the number of blocks set to 4 for both datasets. Before the concatenation in the FC layer, a Linear layer of input R d to output dimension 64 is applied, followed by the dense layer with for both datasets the FC DenseNet growth of 32, activation CLipSwish and a DenseNet depth of 3. The final part consists of a Linear layer to match the output of size R d . The large-scale models require approximately 410 seconds for an epoch on 4 NVIDIA TITAN RTX GPUs.

C Samples
This appendix contains samples of the models trained on CIFAR10 and ImageNet32, along with samples of the hybrid models.  C.2 Hybrid modeling samples Figure 9 shows samples of the hybrid models trained on CIFAR10. The model trained with a scaling factor of λ = 1 D can be found in Figure 9(a). We notice that the samples tend to show a lot of red and brown colors and that the images tend to look noisy. This is probably due to the scaling factor where the generative part and classifier part have an equal focus for the likelihood objective, while there are D = 32 × 32 features per image.

C.1 Model Samples
The model trained with λ = 1 can be found in Figure 9(b). The samples tend to look like the samples in Figure 7(b), only with less definition. This is probably due to the extra part, namely, the classifier part. Comparing the bits per dimension of the hybrid model with i-DenseNet trained for density estimation only, we find a difference of 0.06bpd.

D Additional experiments
In this appendix, we perform additional experiments. First, we analyze the preservation of signal for the activations functions with datapoints that are sampled from a distribution with larger parameter values. Furthermore, we analyze the running time of the models. Next, we examine the importance of the concatenated representation for i-DenseNets that are learned with learnable weighted concatenation. Finally, we analyze a Residual Flow where we extend the width and depth of the ResNet connections modeled in g(x) such that it matches the size of i-DenseNet.

D.1 Preservation of signal
To further analyze the expressive power for the activation functions with a larger range, we sample 100,000 datapoints from distribution: v, w ∼ N (0, 5) with dimension set to D = {1, 128, 1024}. We compute the mean and maximum of the sampled ratios with: 2 (φ(v), φ(w))/ 2 (v, w) and analyze the expressive power of each function. Table 8 shows the results. We find that CLipSwish for all dimensions preserves even more expressive power than datapoints sampled from N (0, 1), while sigmoid loses a considerable amount of signal with mean values close to zero instead of 0.25.  Table 9 shows the forward pass, train time and sampling time, expressed in percentage faster or slower than Residual Flow, for each activation function. We find that the forward pass of i-DenseNet, for all activation functions, is faster than Residual Flow. The train time is slower and during sampling i-DenseNet is faster. Note that in comparison to the preliminary results in the rebuttal the times has changed somewhat, since these results have been obtained on a clean system with multiple runs. An interesting observation is that the LeakyLSwish with Residual Flows is much slower than the DenseNet variant, which indicates that fewer fixed-point iterations are needed for i-DenseNets to converge.

D.3 Importance of concatenated representation
Trained on CIFAR10, the smaller architecture with CLipSwish activation and a DenseNet depth of 3 and growth of 178, run for 200 epochs with CLipSwish obtains the best performance score with 3.37bpd. To analyze the importance of the concatenated representation after training, Figure 10 shows the heatmap for parameterη 1 (Figure 10(a)) and parameterη 2 (Figure 10(b)). Every scale level 1, 2, and 3 contains 4 DenseBlocks, that each contains 3 dense layers with convolutional layers.
The final level FC indicates that fully connected layers are used. The letters 'a', 'b', and 'c' index the dense layers per block.
Remarkably, all scale levels for the last layers h ic give little importance to the input signal. The input signals for these layers are in most cases multiplied withη 1 (close to) zero, while the transformed signal uses almost all the information when multiplied withη 2 , which is close to one. This indicates that the transformed signal is of more importance for the network than the input signal. For the fully connected part, this difference is not that pronounced. Instead of 4 DenseBlocks, the full i-DenseNet model utilizes 16 DenseBlocks (CIFAR10) and 32 (ImageNet32) for every scale; these are not included due to the size.

D.4 Matching architectures
The Residual Flow architecture with LipSwish activation and 3 scale levels set to 4 Flow blocks has 8.7M parameters. To utilize a similar number of parameters for i-DenseNet with LipSwish activation, we set DenseNets depth to 3 and growth to 124. To go a step further, we also examine modeling ResNet connections matching the size of i-DenseNet. Therefore, we use the same 3 × 3 kernels as each dense layer uses and as a final layer a 1 × 1 kernel to match the input size. Instead of the concatenation, we use the growth size of 124 plus the input size to imitate the dense layers of i-DenseNet but then with convolutional connections. We repeat this process for the Fully Connected layer. Note that this puts the Residual Flow at a considerable advantage as it uses 19.1M parameters instead of the 8.7M of the original flow. We do the same experiment for toy data that uses only linear connections instead of convolutions.
In Table 10 the results are shown. On toy data, the extended Residual Flow performs slightly better in terms of nats compared to the original Residual Flow without extended width and depth. Yet, i-DenseNet obtains the lowest (better) scores. On high-dimensional CIFAR10 data, the extended Residual Flow obtains 7.02bpd which is worse than i-DenseNet with 3.39bpd. Yet, the model also scores more than double as high (worse) in terms of bpd than the original Residual Flow with 3.42bpd. The main difference in architecture of the toy and CIFAR10 is the linear layer for toy data whereas mainly convolutional layers are used for CIFAR10. A possible explanation of this phenomenon is that by forcing more convolutional layers to be 1-Lipschitz that gradient norm attenuation problems increase and in practice become less expressive. Concluding, even though the model utilizes more than double the number of parameters, it performs worse than i-DenseNet with similar architecture and even worse than the original Residual Flow architecture, indicating that modeling a DenseNet in g(x) indeed is an important difference that gives better performance.