SlowGuess/ACL_2020_OCR huggingface dataset:
Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In ACL.
Piotr Bojanowski, Edouard Grave, Armand Joulin, and Tomas Mikolov. 2017. Enriching word vectors with subword information. In ACL.
Jeremy M Cohen, Elan Rosenfeld, and J Zico Kolter. 2019. Certified adversarial robustness via randomized smoothing. In ICML.
Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In *NAACL*.
Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O'Donoghue, Jonathan Uesato, and Pushmeet Kohli. 2018. Training verified learners with learned verifiers. arXiv preprint arXiv:1805.10265.
Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. Hotflip: White-box adversarial examples for text classification. In ACL.
Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. 2019. Achieving verified robustness to symbol substitutions via interval bound propagation. In EMNLP.
R. Jia, A. Raghunathan, K. Gksel, and P. Liang. 2019. Certified robustness to adversarial word substitutions. In EMNLP.
Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? natural language attack on text classification and entailment. In AAAI.
Yoon Kim. 2014. Convolutional neural networks for sentence classification. In AAAI.
Guang-He Lee, Yang Yuan, Shiyu Chang, and Tommi Jaakkola. 2019. Tight certificates of adversarial robustness for randomly smoothed classifiers. In NeurIPS.
Andrew L Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In ACL.
Jure McAuley, Julian; Leskovec. 2013. Hidden factors and hidden topics: understanding rating dimensions with review text. In ACM RecSys.
Nikola Mrkšić, Diarmuid O Seaghdha, Blaise Thomson, Milica Gašić, Lina Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016. Counter-fitting word vectors to linguistic constraints. In NAACL.
Jiaqi Mu and Pramod Viswanath. 2018. All-but-the-top: Simple and effective postprocessing for word representations. In ICLR.
Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. Glove: Global vectors for word representation. In EMNLP.
Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2018. Semantically equivalent adversarial rules for debugging nlp models. In ACL.
Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. 2019. Provably robust deep learning via adversarially trained smoothed classifiers. In NeurIPS.
Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for nlp. In EMNLP.
Yonghui Wu, Mike Schuster, Zhifeng Chen, Quoc V Le, Mohammad Norouzi, Wolfgang Macherey, Maxim Krikun, Yuan Cao, Qin Gao, Klaus Macherey, et al. 2016. Google's neural machine translation system: Bridging the gap between human and machine translation. arXiv preprint arXiv:1609.08144.
Dinghuai Zhang, Mao Ye, Chengyue Gong, Zhanxing Zhu, and Qiang Liu. 2020. Black-box certification with randomized smoothing: A functional optimization based framework. arXiv preprint arXiv:2002.09169.
Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In NIPS.
A.1 Bounding the Error of Monte Carlo Estimation
As shown in Proposition 1, the smoothed model  $f^{\mathrm{RS}}$  is certified robust at an input  $\mathbf{X}$  in the sense of (1) if
$$
\begin{array}{l} \Delta_ {\mathbf {X}} = g ^ {\mathrm {R S}} (\mathbf {X}, y) - g ^ {\mathrm {R S}} (\mathbf {X}, y _ {B}) - 2 q _ {\mathbf {X}} \\ = g ^ {\mathrm {R S}} (\mathbf {X}, y) - \max  _ {c \neq y} g ^ {\mathrm {R S}} (\mathbf {X}, c) - 2 q _ {\mathbf {X}} > 0, \\ \end{array}
$$
where  $y$  is the true label of  $\mathbf{X}$ , and
$$
g ^ {\mathrm {R S}} (\mathbf {X}, c) := \mathbb {P} _ {\mathbf {Z} \sim \Pi_ {\mathbf {X}}} (f (\mathbf {Z}) = c) = \mathbb {E} _ {\mathbf {Z} \sim \Pi_ {\mathbf {X}}} [ \mathbb {I} \{f (\mathbf {Z}) = c \} ].
$$
Assume  $\{\mathbf{Z}^{(i)}\}_{i = 1}^n$  is an i.i.d. sample from  $\Pi_{\mathbf{X}}$ . By Monte Carlo approximation, we can estimate  $g^{\mathrm{RS}}(\mathbf{X},c)$  for all  $c\in \mathcal{V}$  jointly, via
$$
\hat {g} ^ {\mathrm {R S}} (\mathbf {X}, c) := \frac {1}{n} \sum_ {i = 1} ^ {n} \mathbb {I} \left\{f \left(\mathbf {Z} ^ {(i)}\right) = c \right\},
$$
and estimate  $\Delta_{\mathbf{X}}$  via
$$
\hat {\Delta} _ {\mathbf {X}} := \frac {1}{n} \sum_ {i = 1} ^ {n} \mathbb {I} \left\{f (\mathbf {Z} ^ {(i)}) = y \right\} - \max  _ {c \neq y} \frac {1}{n} \sum_ {i = 1} ^ {n} \mathbb {I} \left\{f (\mathbf {Z} ^ {(i)}) = c \right\} - 2 q _ {\mathbf {X}}.
$$
To develop a rigorous procedure for testing  $\Delta_{\mathbf{X}} > 0$ , we need to bound the non-asymptotic error of the Monte Carlo estimation, which can be done with a simple application of Hoeffding's concentration inequality and union bound.
Proposition 2. Assume  $\{\mathbf{Z}^{(i)}\}$  is i.i.d. drawn from  $\Pi_X$ . For any  $\delta \in (0,1)$ , with probability at least  $1 - \delta$ , we have
$$
\Delta_ {X} \geq \hat {\Delta} _ {X} - 2 \sqrt {\frac {\log \frac {1}{\delta} + \log | \mathcal {Y} |}{2 n}}.
$$
We can now frame the robustness certification problem into a hypothesis test problem. Consider the null hypothesis  $\mathrm{H}_0$  and alternatively hypothesis  $\mathrm{H}_a$ :
$$
\mathrm {H} _ {0}: \Delta_ {\mathbf {X}} \leq 0 \quad (f ^ {\mathrm {R S}} \text {i s n o t c e r t i f i e d r o b u s t t o} \mathbf {X})
$$
$$
\mathrm {H} _ {a}: \Delta_ {\mathbf {X}} > 0 (f ^ {\mathrm {R S}} \text {i s c e r t i f i e d r o b u s t t o} \mathbf {X}).
$$
Then according to Proposition 2, we can reject the null hypothesis  $\mathrm{H}_0$  with a significance level  $\delta$  if
$$
\hat {\Delta} _ {\mathbf {X}} - 2 \sqrt {\frac {\log \frac {1}{\delta} + \log | \mathcal {Y} |}{2 n}} > 0.
$$
In all the experiments, we set  $\delta = 0.01$  and  $n = 5000$ .
A.2 Proof of the Main Theorems
In this section, we give the proofs of the theorems in the main text.
According to the definition of  $f^{\mathrm{RS}}$ , it is certified robust at  $\mathbf{X}$ , that is,  $y = f^{\mathrm{RS}}(\mathbf{X}')$  for  $\forall \mathbf{X}' \in S_{\mathbf{X}}$ , if
$$
g ^ {\mathrm {R S}} \left(\mathbf {X} ^ {\prime}, y\right) \geq \max  _ {c \neq y} g ^ {\mathrm {R S}} \left(\mathbf {X} ^ {\prime}, c\right), \quad \mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}. \tag {3}
$$
$$
\begin{array}{l} g ^ {\mathrm {R S}} \left(\mathbf {X} ^ {\prime}, y\right) - \max  _ {c \neq y} g ^ {\mathrm {R S}} \left(\mathbf {X} ^ {\prime}, c\right) \geq \min  _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} g ^ {\mathrm {R S}} \left(\mathbf {X} ^ {\prime}, y\right) - \max  _ {c \neq y} \max  _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} g ^ {\mathrm {R S}} \left(\mathbf {X} ^ {\prime}, c\right) \\ \geq \left(g ^ {\mathrm {R S}} (\mathbf {X}, y) - q _ {\mathbf {X}}\right) - \max  _ {c \neq y} \left(g ^ {\mathrm {R S}} (\mathbf {X}, c) + q _ {\mathbf {X}}\right) \quad / / \text {b y} \\ \mathbf {\Delta} = \Delta_ {\mathbf {X}}. \\ \end{array}
$$
Therefore,  $\Delta_{\mathbf{X}} > 0$  must imply (3) and hence certified robustness.
Our goal is to calculate the upper and lower bounds  $\max_{\mathbf{X}^{\prime}\sim \Pi_{\mathbf{X}}}g^{\mathrm{RS}}(\mathbf{X}^{\prime},c)$  and  $\min_{\mathbf{X}^{\prime}\sim \Pi_{\mathbf{X}}}g^{\mathrm{RS}}(\mathbf{X}^{\prime},c)$ . Our key idea is to frame the computation of the upper and lower bounds into a variational optimization.
Lemma 1. Define  $\mathcal{H}_{[0,1]}$  to be the set of all bounded functions mapping from  $\mathcal{X}$  to  $[0,1]$ . For any  $h\in \mathcal{H}_{[0,1]}$ , define
$$
\Pi_ {X} [ h ] = \mathbb {E} _ {\mathbf {Z} \sim \Pi_ {X}} [ h (\mathbf {Z}) ].
$$
Then we have for any  $X$  and  $c\in \mathcal{V}$
$$
\min _ {\pmb {X} ^ {\prime} \sim \Pi_ {\pmb {X}}} g ^ {R S} (\pmb {X} ^ {\prime}, c) \geq \min _ {h \in \mathcal {H} _ {[ 0, 1 ]}} \min _ {\pmb {X} ^ {\prime} \sim \Pi_ {\pmb {X}}} \left\{\Pi_ {\pmb {X} ^ {\prime}} [ h ] \textit {s . t .} \Pi_ {\pmb {X}} [ h ] = g ^ {R S} (\pmb {X}, c) \right\} := g _ {l o w} ^ {R S} (\pmb {X}, c),
$$
$$
\max _ {\pmb {X} ^ {\prime} \sim \Pi_ {\pmb {X}}} g ^ {R S} (\pmb {X} ^ {\prime}, c) \leq \max _ {h \in \mathcal {H} _ {[ 0, 1 ]}} \max _ {\pmb {X} ^ {\prime} \sim \Pi_ {\pmb {X}}} \left\{\Pi_ {\pmb {X} ^ {\prime}} [ h ] \textit {s . t .} \Pi_ {\pmb {X}} [ h ] = g ^ {R S} (\pmb {X}, c) \right\} := g _ {u p} ^ {R S} (\pmb {X}, c).
$$
Proof of Lemma 1. The proof is straightforward. Define  $h_0(\mathbf{X}) = \mathbb{I}\{f(\mathbf{X}) = c\}$ . Recall that
$$
g ^ {\mathrm {R S}} (\mathbf {X}, c) = \mathbb {P} _ {\mathbf {Z} \sim \Pi_ {\mathbf {X}}} (f (\mathbf {Z}) = c) = \Pi_ {\mathbf {X}} [ h _ {0} ].
$$
Therefore,  $h_0$  satisfies the constraints in the optimization, which makes it obvious that
$$
g ^ {\mathrm {R S}} (\mathbf {X} ^ {\prime}, c) = \Pi_ {\mathbf {X} ^ {\prime}} [ h _ {0} ] \geq \min  _ {h \in \mathcal {H} _ {[ 0, 1 ]}} \left\{\Pi_ {\mathbf {X} ^ {\prime}} [ h ] \textit {s . t .} \Pi_ {\mathbf {X}} [ h ] = g ^ {\mathrm {R S}} (\mathbf {X}, c) \right\}.
$$
Taking  $\min_{\mathbf{X}' \in S_{\mathbf{X}}}$  on both sides yields the lower bound. The upper bound follows the same derivation.
Therefore, the problem reduces to deriving bounds for the optimization problems.
Theorem 3. Under the assumptions of Theorem 1, for the optimization problems in Lemma 1, we have
$$
g _ {l o w} ^ {R S} (\pmb {X}, c) \geq \max (g ^ {R S} (\pmb {X}, c) - q _ {\pmb {X}}, 0), g _ {u p} ^ {R S} (\pmb {X}, c) \leq \min (g ^ {R S} (\pmb {X}, c) + q _ {\pmb {X}}, 1).
$$
where  $q_{X}$  is the quantity defined in Theorem 1 in the main text.
Now we proceed to prove Theorem 3.
Proof of Theorem 3. We only consider the minimization problem because the maximization follows the same proof. For notation, we denote  $p = g^{\mathrm{RS}}(\mathbf{X}, c)$ . Applying the Lagrange multiplier to the constraint optimization problem and exchanging the min and max, we have
$$
\begin{array}{l} g _ {l o w} ^ {\mathrm {R S}} (\mathbf {X}, c) = \min  _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} \min  _ {h \in \mathcal {H} _ {[ 0, 1 ]}} \max  _ {\lambda \in \mathbb {R}} \Pi_ {\mathbf {X} ^ {\prime}} [ h ] - \lambda \Pi_ {\mathbf {X}} [ h ] + \lambda p \\ \geq \max _ {\lambda \in \mathbb {R}} \min _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} \min _ {h \in \mathcal {H} _ {[ 0, 1 ]}} \Pi_ {\mathbf {X} ^ {\prime}} [ h ] - \lambda \Pi_ {\mathbf {X}} [ h ] + \lambda p \\ = \max  _ {\lambda \in \mathbb {R}} \min  _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} \min  _ {h \in \mathcal {H} _ {[ 0, 1 ]}} \int h (\mathbf {Z}) \left(d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z}) - \lambda d \Pi_ {\mathbf {X}} (\mathbf {Z})\right) + \lambda p \\ = - \max _ {\lambda \in \mathbb {R}} \max _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} \int (\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z})) _ {+} + \lambda p \\ = - \max _ {\lambda \geq 0} \max _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} \int (\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z})) _ {+} + \lambda p. \\ \end{array}
$$
Here  $d\Pi_{\mathbf{X}}^{0}(\mathbf{Z})$  and  $d\Pi_{\mathbf{X}'}^{0}(\mathbf{Z})$  is the counting measure and  $(s)_{+} = \max(s, 0)$ . Now we calculate  $\int (\lambda d\Pi_{\mathbf{X}}(\mathbf{Z}) - d\Pi_{\mathbf{X}'}(\mathbf{Z}))_{+}$ .
Lemma 2. Given  $x, x'$ , define  $n_x = |P_x|$ ,  $n_{x'} = |P_{x'}|$  and  $n_{x,x'} = |P_x \cap P_{x'}|$ . We have the following identity
$$
\begin{array}{l} \int \left(\lambda d \Pi_ {X} (\mathbf {Z}) - d \Pi_ {X ^ {\prime}} (\mathbf {Z})\right) _ {+} \\ = \lambda \left[ 1 - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \right] + \left[ \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \right] \left[ \lambda - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j}}}{n _ {x _ {j} ^ {\prime}}} \right] _ {+}. \\ \end{array}
$$
As a result, under the assumption that  $n_x = |P_x| = |P_{x'}| = n_{x'}$  for every word  $x$  and its synonym  $x' \in S_x$ , we have
$$
\int (\lambda d \Pi_ {X} (\pmb {Z}) - d \Pi_ {\pmb {X} ^ {\prime}} (\pmb {Z})) _ {+} = \lambda \left[ 1 - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \right] + \left[ \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \right] (\lambda - 1) _ {+}.
$$
We now need to solve the optimization of  $\max_{\mathbf{X}^{\prime}\in S_{\mathbf{X}}}\int (\lambda d\Pi_{\mathbf{X}}(\mathbf{Z}) - d\Pi_{\mathbf{X}^{\prime}}(\mathbf{Z}))_{+}$
Lemma 3. For any word  $x$ , define  $\tilde{x}^{*} = \underset{x^{\prime}\in S_{x}}{\arg \min}n_{x,x^{\prime}} / n_{x}$ . For a given sentence  $X = x_{1},\ldots ,x_{L}$ , we define an ordering of the words  $x_{\ell_1},\ldots ,x_{\ell_L}$  such that  $n_{x_{\ell_i}},\tilde{x}_{\ell_i}^* /n_{x_{\ell_i}}\leq n_{x_{\ell_j}},\tilde{x}_{\ell_j}^*\big / n_{x_{\ell_j}}$  for any  $i\leq j$ . For a given  $X$  and  $R$ , we define an adversarial perturbed sentence  $X^{*} = x_{1}^{*},\ldots ,x_{L}^{*}$ , where
$$
x _ {i} ^ {*} = \left\{ \begin{array}{l l} \tilde {x} _ {i} ^ {*} & i f i \in [ \ell_ {1}, \ldots , \ell_ {R} ] \\ x _ {i} & i f i \notin [ \ell_ {1}, \ldots , \ell_ {R} ]. \end{array} \right.
$$
Then for any  $\lambda \geq 0$ , we have that  $X^{*}$  is the optimal solution of  $\max_{X^{\prime}\in S_X}\int (\lambda d\Pi_X(\mathbf{Z}) - d\Pi_{X^{\prime}}(\mathbf{Z}))_+$ , that is,
$$
\max _ {X ^ {\prime} \in S _ {X}} \int (\lambda d \Pi_ {X} (\mathbf {Z}) - d \Pi_ {X ^ {\prime}} (\mathbf {Z})) _ {+} = \int (\lambda d \Pi_ {X} (\mathbf {Z}) - d \Pi_ {X ^ {*}} (\mathbf {Z})) _ {+}.
$$
Now by Lemma 3, the lower bound becomes
$$
\begin{array}{l} g _ {l o w} ^ {\mathrm {R S}} (\mathbf {X}, c) = - \max _ {\lambda \geq 0} \max _ {\mathbf {X} ^ {\prime} \in S _ {\mathbf {X}}} \int \left(\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z})\right) _ {+} + \lambda p \\ = - \max _ {\lambda \geq 0} \int (\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {*}} (\mathbf {Z})) _ {+} + \lambda p \\ = \max  _ {\lambda \geq 0} (p - q _ {\mathbf {X}}) \lambda - (1 - q _ {\mathbf {X}}) (\lambda - 1) _ {+} \tag {4} \\ = \max  (p - q _ {\mathbf {X}}, 0), \\ \end{array}
$$
where  $q_{\mathbf{X}}$  is consistent with the definition in Theorem 1:
$$
q _ {\mathbf {X}} = 1 - \prod_ {j \in [ L ], x _ {j} \neq \tilde {x} _ {j} ^ {*}} \frac {n _ {x _ {j} , \tilde {x} _ {j} ^ {*}}}{n _ {x _ {j}}} = 1 - \prod_ {j = 1} ^ {R} q _ {x _ {\ell_ {j}}}.
$$
Here equation (4) is by calculation using the assumption of Theorem 1. The optimization of  $\max_{\lambda \geq 0}$  in (4) is an elementary step: if  $p \leq q$ , we have  $\lambda^{*} = 0$  with solution 0; if  $p \geq q$ , we have  $\lambda^{*} = 1$  with solution  $(p - q_{\mathbf{X}})$ . This finishes the proof of the lower bound. The proof the upper bound follows similarly.
Proof of Lemma 2 Notice that we have
$$
\begin{array}{l} \int \left(\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z})\right) _ {+} = \sum_ {\mathbf {Z} \in S _ {\mathbf {X} ^ {\prime}} \cap S _ {\mathbf {X}}} \left(\lambda \left| S _ {\mathbf {X}} \right| ^ {- 1} - \left| S _ {\mathbf {X} ^ {\prime}} \right| ^ {- 1}\right) _ {+} + \lambda \sum_ {\mathbf {Z} \in S _ {\mathbf {X}} - S _ {\mathbf {X} ^ {\prime}}} \left| S _ {\mathbf {X}} \right| ^ {- 1} \\ = | S _ {\mathbf {X} ^ {\prime}} \cap S _ {\mathbf {X}} | \left(\lambda | S _ {\mathbf {X}} | ^ {- 1} - | S _ {\mathbf {X} ^ {\prime}} | ^ {- 1}\right) _ {+} + \lambda | S _ {\mathbf {X}} - S _ {\mathbf {X} ^ {\prime}} | | S _ {\mathbf {X}} | ^ {- 1}. \\ \end{array}
$$
Also notice that  $|S_{\mathbf{X}}| = \prod_{j=1}^{L} n_{x_j}$ ;  $|S_{\mathbf{X}'}| = \prod_{j=1}^{L} n_{x_j'}$ ;  $|S_{\mathbf{X}''} \cap S_{\mathbf{X}}| = \prod_{j=1}^{L} n_{x_j, x_j'}$  and  $|S_{\mathbf{X}} - S_{\mathbf{X}'}| = \prod_{j=1}^{L} n_{x_j} - \prod_{j=1}^{L} n_{x_j, x_j'}$ . Plugging in the above value, we have
$$
\begin{array}{l} | S _ {\mathbf {X}} - S _ {\mathbf {X} ^ {\prime}} | | S _ {\mathbf {X}} | ^ {- 1} = \frac {\prod_ {j = 1} ^ {L} n _ {x _ {j}} - \prod_ {j = 1} ^ {L} n _ {x _ {j} , x _ {j} ^ {\prime}}}{\prod_ {j = 1} ^ {L} n _ {x _ {j}}} \\ = 1 - \prod_ {j = 1} ^ {L} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \\ = 1 - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}}. \\ \end{array}
$$
And also,
$$
\begin{array}{l} \left(\lambda \left| S _ {\mathbf {X}} \right| ^ {- 1} - \left| S _ {\mathbf {X} ^ {\prime}} \right| ^ {- 1}\right) _ {+} = \left(\lambda \prod_ {j = 1} ^ {L} n _ {x _ {j}} ^ {- 1} - \prod_ {j = 1} ^ {L} n _ {x _ {j} ^ {\prime}} ^ {- 1}\right) _ {+} \\ = \left(\lambda \prod_ {j \in [ L ], x _ {j} = x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} - \prod_ {j \in [ L ], x _ {j} = x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j} ^ {\prime}} ^ {- 1}\right) _ {+} \\ = \prod_ {j \in [ L ], x _ {j} = x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} \left(\lambda \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j} ^ {\prime}} ^ {- 1}\right) _ {+}. \\ \end{array}
$$
Plugging in the above value, we have
$$
\begin{array}{l} \left| S _ {\mathbf {X} ^ {\prime}} \cap S _ {\mathbf {X}} \right| \left(\lambda \left| S _ {\mathbf {X}} \right| ^ {- 1} - \left| S _ {\mathbf {X} ^ {\prime}} \right| ^ {- 1}\right) _ {+} = \prod_ {j = 1} ^ {L} n _ {x _ {j}, x _ {j} ^ {\prime}} \left(\lambda \left| S _ {\mathbf {X}} \right| ^ {- 1} - \left| S _ {\mathbf {X} ^ {\prime}} \right| ^ {- 1}\right) _ {+} \\ = \prod_ {j \in [ L ], x _ {j} = x _ {j} ^ {\prime}} n _ {x _ {j}} \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}, x _ {j} ^ {\prime}} \left(\lambda \left| S _ {\mathbf {X}} \right| ^ {- 1} - \left| S _ {\mathbf {X} ^ {\prime}} \right| ^ {- 1}\right) _ {+} \\ = \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}, x _ {j} ^ {\prime}} \left(\lambda \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j} ^ {\prime}} ^ {- 1}\right) _ {+} \\ = \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}, x _ {j} ^ {\prime}} \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} n _ {x _ {j}} ^ {- 1} \left(\lambda - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j}}}{n _ {x _ {j} ^ {\prime}}}\right) _ {+} \\ = \left(\prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}}\right) \left(\lambda - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j}}}{n _ {x _ {j} ^ {\prime}}}\right) _ {+}. \\ \end{array}
$$
Combining all the calculation, we get
$$
\begin{array}{l} \int \left(\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z})\right) _ {+} \\ = \lambda \left[ 1 - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \right] + \left[ \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime}}}{n _ {x _ {j}}} \right] \left[ \lambda - \prod_ {j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}} \frac {n _ {x _ {j}}}{n _ {x _ {j} ^ {\prime}}} \right] _ {+}. \\ \end{array}
$$
Proof of Lemma 3 It is sufficient to proof that, for any  $\mathbf{X}' \neq \mathbf{X}^*$ , we have
$$
\int \left(\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {*}} (\mathbf {Z})\right) _ {+} \geq \int \left(\lambda d \Pi_ {\mathbf {X}} (\mathbf {Z}) - d \Pi_ {\mathbf {X} ^ {\prime}} (\mathbf {Z})\right) _ {+}.
$$
Notice that for any  $\lambda \geq 0$ , define
$$
Q (\mathbf {X}, \mathbf {X} ^ {\prime \prime}) = \lambda \left[ 1 - \prod_ {{j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime \prime}}}{n _ {x _ {j}}} \right] + \left[ \prod_ {{j \in [ L ], x _ {j} \neq x _ {j} ^ {\prime}}} \frac {n _ {x _ {j} , x _ {j} ^ {\prime \prime}}}{n _ {x _ {j}}} \right] (\lambda - 1) _ {+}.
$$
Given any  $\mathbf{X}$ , we can view  $Q(\mathbf{X},\mathbf{X}^{\prime \prime})$  as the function of  $n_{x_i,x_i^{\prime \prime}} / n_{x_i}$ ,  $i\in [L]$ . And  $Q(\mathbf{X},\mathbf{X}^{\prime \prime})$  is a decreasing function of  $n_{x_i,x_i^{\prime \prime}} / n_{x_i}$  for any  $i\in [L]$  when fixing  $\frac{n_{x_j,x_j^{\prime\prime}}}{n_{x_j}}$  for all other  $j\neq i$ . Suppose  $\tilde{r}_k$  is the  $k$ -th smallest quantities of  $n_{x_i,\tilde{x}_i^*} / n_{x_i}$ ,  $i\in [L]$  and  $r_k^\prime$  is the  $k$ -th smallest quantities of  $n_{x_j,\tilde{x}_j^*} / n_{x_i}$ ,  $i\in [L]$ . By the construction of  $\mathbf{X}^*$ , we have  $\tilde{r}_k\leq r_k^\prime$  for any  $k\in [L]$ . This implies that
$$
Q (\mathbf {X}, \mathbf {X} ^ {*}) \geq Q (\mathbf {X}, \mathbf {X} ^ {\prime}).
$$
A.2.3 Proof of Theorem 2
We denote  $g^{\mathrm{RS}}(\mathbf{X},y) = p_A$ ,  $g^{\mathrm{RS}}(\mathbf{X},y_B) = p_B$  and  $q = q_{\mathbf{X}}$  in this proof for simplicity. The  $\mathbf{X}^*$  below is the one defined in the proof of Lemme 3. Our proof is based on constructing a randomized smoothing classifier that satisfies the desired property we want to prove.
Case 1  $p_A \geq q$  and  $p_B + q \leq 1$  Note that in this case  $|S_{\mathbf{X}} \cap S_{\mathbf{X}^*}| / |S_{\mathbf{X}}| = 1 - q \geq (p_A - q) + p_B$ , where the inequality is due to  $p_A + p_B \leq 1$ . Therefore, we can choose set  $U_1$  and  $U_2$  such that  $U_1 \subseteq S_{\mathbf{X}} \cap S_{\mathbf{X}^*}$ ;  $U_2 \subseteq S_{\mathbf{X}} \cap S_{\mathbf{X}^*}$ ;  $U_1 \cap U_2 = \emptyset$ ;  $|U_1| / |S_{\mathbf{X}}| = p_A - q$  and  $|U_2| / |S_{\mathbf{X}}| = p_B$ . We define the classifier:
$$
f ^ {*} (\mathbf {Z}) = \left\{ \begin{array}{l l} y & \text {i f} \mathbf {Z} \in (S _ {\mathbf {X}} - S _ {\mathbf {X} ^ {*}}) \cap U _ {1} \\ y _ {B} & \text {i f} \mathbf {Z} \in (S _ {\mathbf {X} ^ {*}} - S _ {\mathbf {X}}) \cup U _ {2} \\ \text {o t h e r c l a s s} (c \neq y \text {o r} y _ {B}) & \text {i f} \mathbf {Z} \in S _ {\mathbf {X}} \cap S _ {\mathbf {X} ^ {*}} - (U _ {1} \cup U _ {2}) \\ \text {a n y c l a s s} (c \in \mathcal {Y}) & \text {o t h e r w i s e} \end{array} \right.
$$
This classifier is well defined for binary classification because  $S_{\mathbf{X}} \cap S_{\mathbf{X}^*} - (U_1 \cup U_2) = \emptyset$ .
Case 2  $p_A < q$  and  $p_B + q \leq 1$  In this case, we can choose set  $U_1$  and  $U_2$  such that  $U_1 \subseteq S_{\mathbf{X}} - S_{\mathbf{X}^*}$ ;  $U_2 \subseteq S_{\mathbf{X}} \cap S_{\mathbf{X}^*}$ ;  $|U_1| / |S_{\mathbf{X}}| = p_A$  and  $|U_2| / |S_{\mathbf{X}}| = p_B$ . We define the classifier:
$$
f ^ {*} (\mathbf {Z}) = \left\{ \begin{array}{l l} y & \text {i f} \mathbf {Z} \in U _ {1} \\ y _ {B} & \text {i f} \mathbf {Z} \in U _ {2} \cup (S _ {\mathbf {X} ^ {*}} - S _ {\mathbf {X}}) \\ \text {o t h e r c l a s s} (c \neq y \text {o r} y _ {B}) & \text {i f} \mathbf {Z} \in S _ {\mathbf {X}} - (U _ {1} \cup U _ {2}) \\ \text {a n y c l a s s} (c \in \mathcal {Y}) & \text {o t h e r w i s e} \end{array} \right.
$$
This classifier is well defined for binary classification because  $S_{\mathbf{X}} - (U_1 \cup U_2) = \emptyset$ .
Case 3  $p_A \geq q$  and  $p_B + q > 1$  This case does not exist since we would have  $p_A + p_B > 1$ .