SlowGuess/NAACL_2021_OCR huggingface dataset:
Wenjie Wang, Pengfei Tang, Jian Lou* and Li Xiong
{wang.wenjie, pengfei.tang, jian.lou, lxiong}@emory.edu
The robustness and security of natural language processing (NLP) models are significantly important in real-world applications. In the context of text classification tasks, adversarial examples can be designed by substituting words with synonyms under certain semantic and syntactic constraints, such that a well-trained model will give a wrong prediction. Therefore, it is crucial to develop techniques to provide a rigorous and provable robustness guarantee against such attacks. In this paper, we propose WordDP to achieve certified robustness against word substitution attacks in text classification via differential privacy (DP). We establish the connection between DP and adversarial robustness for the first time in the text domain and propose a conceptual exponential mechanism-based algorithm to formally achieve the robustness. We further present a practical simulated exponential mechanism that has efficient inference with certified robustness. We not only provide a rigorous analytic derivation of the certified condition but also experimentally compare the utility of WordDP with existing defense algorithms. The results show that WordDP achieves higher accuracy and more than  $30\times$  efficiency improvement over the state-of-the-art certified robustness mechanism in typical text classification tasks.
Deep neural networks (DNNs) have achieved state-of-the-art performance in many natural language processing (NLP) tasks, such as text classification (Zhang et al., 2015), sentiment analysis (Bakshi et al., 2016), and machine translation (Bahdanau et al., 2014), making the robustness and security of NLP models significantly important. Recent studies have shown that DNNs can be easily fooled by adversarial examples, which are carefully crafted
by adding imperceptible perturbations to input examples during inference time (Szegedy et al., 2013). In the context of text classification tasks, adversarial examples can be designed by manipulating the word or characters under certain semantic and syntactic constraints (Ren et al., 2019; Jin et al., 2019; Zang et al., 2020; Gao et al., 2018). Among all the attack strategies, word substitution attacks, in which attackers attempt to alter the model output by replacing input words with their synonyms, can maximally maintain the naturalness and semantic similarity of the input. Therefore, in this paper, we consider such word substitution attacks and focus on defending against such attacks. Figure 1 shows an example of the word substitution attack where the clean input text is changed into adversarial text by substituting input words from a synonym list. Various mechanisms have been developed to
Figure 1: Word Substitution Attack and Certified Robustness via WordDP.
defend against adversarial examples in text classification models. Miyato et al. (2016) applied adversarial training to the text domain that involves adversarial examples in the training stage. Data augmentation in the training phase is another defense approach to improve model robustness. For example, Synonyms Encoding Method (SEM) proposed by Wang et al. (2019), Dirichlet Neighborhood Ensemble (DNE) proposed by Zhou et al. (2020), and Robust Encodings (RobEn) proposed by Jones et al. (2020) are different data augmentation methods on either embedding space or word space. How-
J. Lou is the corresponding author.
Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 1102-1112 June 6-11, 2021. ©2021 Association for Computational Linguistics
ever, all the above-mentioned works are only evaluated empirically and have no theoretical analysis or guarantee on the robustness of the methods in that they may be broken by other adaptive attacks. Therefore, it is important to provide rigorous and provable certified defense.
There are several attempts to achieve certified robustness for word substitution attacks. Jia et al. (2019) and Huang et al. (2019) utilize Interval Bound Propagation (IBP) to compute an upper bound on the model's loss in the forward pass and minimize this bound via backpropagation. Although IBP gives a theoretical bound, it does not provide any certification condition. Another limitation is that it is not applicable to character-level DNNs, because IBP is limited to continuous space so that model input should be the word-level embedding. SAFER (Ye et al., 2020) achieves certified robustness with a new randomized smoothing technique. However, its computation of synonym set intersection greatly reduces the computation speed in the inference stage. Besides, SAFER only provides a theoretical certified accuracy and its empirical effectiveness on adversarial examples has not been evaluated.
In this paper, we propose a novel approach WordDP to certified robustness against word substitution attacks in text classification via differential privacy (DP) (Dwork, 2008). Figure 1 is a high-level illustration. In the inference phase, the input goes through a randomized mechanism WordDP. If a clean input satisfies the certification condition of WordDP, its adversarial counterpart is guaranteed to predict the same output label. DP is a privacy framework that protects the information of individual record in the database by randomized computations, such that the change of the computation output is bounded when small perturbation is applied on the database. This stable output guarantee is in parallel with the definition of robustness: ensuring that small changes in the input will not result in dramatic shift of its output. The idea of providing robustness certification via DP was originally introduced in PixelDP (Lecuyer et al., 2019) which is specifically designed for norm-bounded adversarial examples in the continuous domain for applications like image classification. However, it is challenging to directly apply such an idea against word substitution attack, due to the discrete nature of the text input space. Therefore, in this work, we develop WordDP to achieve the DP and robustness connec
tion in the discrete text space by exploring novel application of the exponential mechanism (McSherry and Talwar, 2007), conventionally utilized to realize DP for answering discrete queries. To achieve this, we present a conceptual certified robustness algorithm that randomly samples word-substituted sentences according to the probability distribution designated by the exponential mechanism and aggregates their inference result as the final classification for the input.
A fundamental barrier limiting the conceptual algorithm from being applied in practice is that the sampling distribution of the exponential mechanism requires an exhaustive enumeration-based sub-step, which needs to repeat the model inference for every neighboring sentences with word substitutions from the input sentence. To overcome this computational difficulty, we develop a practical simulated exponential mechanism via uniform sampling and re-weighted averaging, which not only lowers the computational overhead but also ensures uncompromising level of certified robustness.
1) We propose WordDP to establish the connection between DP and certified robustness for the first time in text classification domain (Sec.4.1).
2) We leverage conceptual exponential mechanism to achieve WordDP and formally prove an  $L$ -word bounded certified condition for robustness against word substitution attacks (Sec.4.2).
3) We develop a simulated exponential mechanism via uniform sampling and weighted averaging to overcome the computation bottleneck of the conceptual exponential mechanism without compromising the certified robustness guarantee (Sec.4.3).
4) Extensive experiments validate that WordDP outperforms existing defense methods and achieves over  $30 \times$  efficiency improvement in the inference stage than the state-of-the-art certified robustness mechanism (Sec.5).
Word Substitution Attacks. Various attacks have been developed to fool DNNs in text classification, including substituting a word with its synonyms (Ren et al., 2019; Jin et al., 2019; Zang et al., 2020; Alzantot et al., 2018), manipulating the characters (Gao et al., 2018; Ebrahimi et al., 2018), and perturbation on the embedding space (Papernot et al., 2016; Liang et al., 2018; Sato et al., 2018; Cheng et al., 2019).
In word substitution attacks, attackers replace
words in a sentence with their synonyms according to a synonym table, including PWWS (Ren et al., 2019), TEXTFOOLER (Jin et al., 2019), among others (Zang et al., 2020). In particular, PWWS is the most widely used attack algorithm to evaluate defense mechanisms (Zhou et al., 2020; Jia et al., 2019; Ye et al., 2020). PWWS uses WordNet to build synonym set and only replaces named entities (NEs) with similar NEs in order to flip the prediction. It incorporates word saliency to determine the replacement order and selects the synonym that can cause the greatest prediction probability change.
Empirical Defenses to Word Substitution Attacks. Several existing empirical defenses are effective for adversarial word substitution. Miyato et al. (2016) applied adversarial training to the text domain. Wang et al. (2019) proposed Synonyms Encoding Method (SEM), which finds a mapping between the words and their synonyms before the input layer. Jones et al. (2020) proposed robust encodings (RobEn) that involves an encoding function to map sentences to a smaller, discrete space. Dirichlet Neighborhood Ensemble (DNE) (Zhou et al., 2020) creates virtual sentences by mixing the embedding of the original word with its synonyms' embedding via Dirichlet sampling, which is randomized smoothing based data augmentation.
Certified Robustness. Certified robustness has been first studied in image domain, which certifies that a model is robust to adversarial examples when its prediction result is stable when applying small perturbations to the input (Lecuyer et al., 2019; Cohen et al., 2019; Lee et al., 2019). In text domain, Jia et al. (2019) and Huang et al. (2019) both applied Interval Bound Propagation (IBP) for certification. The intuition is to compute an upper bound on the model's loss through the network in a standard forward pass and minimize this upper bound via backpropagation. One major limitation of IBP certification is that it is not applicable to character-level DNNs, because IBP is limited to continuous space (word-level embedding).
SAFER (Ye et al., 2020) is a certified robust method based on randomized smoothing. The certification is based on the intersection of synonym sets between perturbed examples and clean examples. However, its computation of synonym set intersection greatly reduces the inference efficiency. Besides, it lacks thorough evaluation of empirical effectiveness on adversarial examples.
3.1 Adversarial Word Substitution and Certified Robustness
Adversarial Word Substitution. Consider a sentence of  $\omega$  words  $\mathbf{X} = (x_{1}, x_{2}, \ldots, x_{i}, \ldots, x_{\omega})$ , where each word  $x_{i}$  belongs to a synonym set of  $\kappa(i)$  number of synonyms  $\mathbf{S}(x_{i}) = \{x_{i}^{1}, x_{i}^{2}, \ldots, x_{i}^{\kappa(i)}\}$ . Following common practice (Ye et al., 2020), we also assume the synonymous relation is symmetric, such that  $x_{i}$  is in the synonym set of all its synonyms  $x_{i}^{2}, \ldots, x_{i}^{\kappa(i)}$  and  $\mathbf{S}(x_{i}^{j}) = \mathbf{S}(x_{i}^{k})$  for all  $j, k \in [\kappa(i)]$ . The synonym set  $\mathbf{S}(x_{i})$  can be built by following GLOVE (Pennington et al., 2014b).
Definition 3.1. (L-Adversarial Word Substitution Attack) For an input sentence  $\mathbf{X}$ , an  $L$ -adversarial word substitution attack perturbs the sentence by selecting at most  $L$  ( $L \leq \omega$ ) words  $x_{\tau_1}, \ldots, x_{\tau_L}$  and substitutes each selected word  $x_{\tau_i}$  with one of its synonyms  $x_{\tau_i}' \in \mathbf{S}(x_{\tau_i})$ . We denote an attacked sentence by  $\mathbf{X}'$  and the set of all possible attacked sentences by  $\mathcal{S}(L)$ .
Certified Robustness. In general, we say a model is robust to adversarial examples when its prediction result is stable when applying small perturbations to the input.
Definition 3.2. (Certified Robustness to Word Substitution Attack) Denote a multiclass classification model by  $f(\mathbf{X}): \mathcal{X} \mapsto c \in \mathcal{C}$ , where  $c$  is a label in the possible label set  $\mathcal{C} = \{1, \dots, C\}$ . In general,  $f(\mathbf{X})$  outputs a vector of scores  $f^{\mathbf{y}}(\mathbf{X}) = (f^{y_1}, \dots, f^{y_C}) \in \mathcal{V}$ , where  $\mathcal{V} = \{\mathbf{y}: \sum_{i=1}^{C} f^{y_i} = 1, f^{y_i} \in [0,1]\}$ , and  $c = \arg \max_{i \in \mathcal{C}} f^{y_i}$ . A predictive model  $f(\mathbf{X})$  is robust to  $L$ -adversarial word substitution attack on input  $\mathbf{X}$ , if for all  $\mathbf{X}' \in \mathcal{S}(L)$ , it has  $f(\mathbf{X}) = f(\mathbf{X}')$ , which is equivalent to
$$
y _ {c} \left(\mathbf {X} ^ {\prime}\right) > \max  _ {i \in \mathcal {C}: i \neq c} y _ {i} \left(\mathbf {X} ^ {\prime}\right). \tag {1}
$$
In the following, we refer to the above robustness as  $L$ -certified robustness for short.
3.2 Differential Privacy and Exponential Mechanism
Differential Privacy. The concept of DP is to prevent the information leakage of an individual record in the database by introducing randomness into the computation. More specifically, DP guarantees the output of a function over two neighbouring databases are indistinguishable.
Definition 3.3. (Differential Privacy (Dwork et al., 2006)) A randomized mechanism  $\mathcal{A}$  is  $\epsilon$ -differentially private if, for all neighboring datasets  $\mathbf{D} \sim \mathbf{D}'$  that differ in one record or are bounded by certain distance and for all events  $\mathbf{O}$  in the output space  $\mathcal{O}$  of  $\mathcal{A}$ , we have
$$
\mathbb {P} [ \mathcal {A} (\mathbf {D}) \in \mathbf {O} ] \leq e ^ {\epsilon} \mathbb {P} [ \mathcal {A} (\mathbf {D} ^ {\prime}) \in \mathbf {O} ]. \tag {2}
$$
Exponential Mechanism. The exponential mechanism is a commonly utilized DP mechanism in the discrete domain, which consists of the utility score function, sensitivity, and sampling probability distribution as its key ingredients.
Definition 3.4. (Exponential Mechanism (McSherry and Talwar, 2007)) Denote the score function  $u(\mathbf{D}, \mathbf{r}) : \mathcal{D} \times \mathcal{R} \mapsto \mathbb{R}$ , which maps each pair of input dataset  $\mathbf{D} \sim \mathcal{D}$  and candidate result  $\mathbf{r} \in \mathcal{R}$  to a real valued score. Denote the sensitivity by  $\Delta_u := \max_{\mathbf{r} \in \mathcal{R}} \max_{\mathbf{D} \sim \mathbf{D}'} |u(\mathbf{D}, \mathbf{r}) - u(\mathbf{D}', \mathbf{r})|$ . The exponential mechanism  $\mathcal{M}_E(\mathbf{D}, u, \mathcal{R})$  selects and outputs an element  $\mathbf{r} \in \mathcal{R}$  with probability proportional to  $e^{\frac{\epsilon u(\mathbf{D}, \mathbf{r})}{2\Delta_u}}$ . The exponential mechanism is  $\epsilon$ -differentially private.
4.1 WordDP for Certified Robustness
WordDP. We expand the intuition that DP can be applied to provide certified robustness against textual adversarial examples like word substitution attack by regarding the sentence as a database and each word as a record. If the randomized predictive model satisfies  $\epsilon$ -DP during inference, then the output of a potentially adversarial input  $\mathbf{X}' \in \mathcal{S}(L)$  and the output of the original input  $\mathbf{X}$  should be indistinguishable. Thus, our proposed approach is to transform a multiclass classification model's prediction score into a randomized  $\epsilon$ -WordDP score, which is formally defined below.
Definition 4.1. (Word Differential Privacy) Consider any input sentence  $\mathbf{X}$  and its  $L$ -word substitution sentence set  $\mathcal{S}(L)$ . For a randomized function  $f_{A}(\mathbf{X})$ , let its prediction score vector be  $\mathbf{y} \in \mathcal{Y}$ .  $f_{A}(\mathbf{X})$  satisfies  $\epsilon$ -word differential privacy (WordDP), if it satisfies  $\epsilon$ -differential privacy for any pair of neighboring sentences  $\mathbf{X}_1, \mathbf{X}_2 \in \mathcal{S}(L)$  and the output space  $\mathbf{y} \in \mathcal{Y}$ .
Remark 1. We stress that  $WordDP$  does not seek DP protection for the training dataset as in the conventional privacy area. Instead, it leverages the DP randomness for certified robustness during inference with respect to a testing input.
In practice, for a base model  $f$ , a DP mechanism  $\mathcal{A}$  will be introduced to randomize it to  $f_{\mathcal{A}}$ . For an  $\epsilon$ -WordDP model  $f_{\mathcal{A}}$ , its expected prediction  $\mathbb{E}[f_{\mathcal{A}}(\mathbf{X})]$  is certified robust. Denote the prediction score vector of  $\mathbb{E}[f_{\mathcal{A}}(\mathbf{X})]$  by  $\mathbb{E}[f_{\mathcal{A}}^{\mathbf{y}}(\mathbf{X})] = (\mathbb{E}[f_{\mathcal{A}}^{y_1}(\mathbf{X})], \dots, \mathbb{E}[f_{\mathcal{A}}^{y_C}(\mathbf{X})]) \in \mathcal{Y}$ . Lemma 4.2 shows  $\mathbb{E}[f_{\mathcal{A}}^{\mathbf{y}}(\mathbf{X})]$  satisfies the certified robustness condition in eq.(1), based on Lemma 4.1 that shows each expected prediction score  $\mathbb{E}[f_{\mathcal{A}}^{y_i}(\mathbf{X})]$  is stable.
Lemma 4.1. For an  $\epsilon$ -WordDP model  $f_{\mathcal{A}}$ , its prediction score satisfies the relation,  $\forall i \in [C]$
$$
\mathbb {E} \left[ f _ {\mathcal {A}} ^ {y i} \left(\mathbf {X} _ {1}\right) \right] \leq e ^ {\epsilon} \mathbb {E} \left[ f _ {\mathcal {A}} ^ {y i} \left(\mathbf {X} _ {2}\right) \right], \forall \mathbf {X} _ {1}, \mathbf {X} _ {2} \in \mathscr {L}. \tag {3}
$$
From the above property, we can derive the certified robustness condition to adversarial examples.
Lemma 4.2. For an  $\epsilon$ -WordDP model  $f_{\mathcal{A}}$  and an input sentence  $\mathbf{X}$ , if there exists a label  $c$  such that:
$$
\mathbb {E} \left(f _ {\mathcal {A}} ^ {y _ {c}} (\mathbf {X})\right) > e ^ {2 \epsilon} \max  _ {i \neq c} \mathbb {E} \left(f _ {\mathcal {A}} ^ {y _ {i}} (\mathbf {X})\right), \tag {4}
$$
then the multiclass classification model  $f_{\mathcal{A}}$  based on the expected label prediction score vector  $\mathbb{E}[f_{\mathcal{A}}^{\mathbf{y}}(\cdot)]$  is certified robust to  $L$ -adversary word substitution attack on  $\mathbf{X}$ .
The proofs of the above two lemmas can be adapted from the pixelDP to WordDP context based on Lemma 1 and Proposition 1 in Lecuyer et al. (2019). We relegate the proofs to Appendix A. Our focus is how to design the DP mechanism  $\mathcal{A}$  to achieve WordDP (Subsection 4.2), and how to implement it for efficient inference that still ensures certified robustness (Subsection 4.3).
4.2 WordDP with Exponential Mechanism
In this subsection, we present the conceptual exponential mechanism-based algorithm to achieve WordDP and the certification procedure.
Exponential Mechanism for WordDP. To obtain the DP classifier  $f_{A}$  given the base model  $f$ , we introduce the exponential mechanism  $\mathcal{M}_E$  as the randomization mechanism  $\mathcal{A}$  and define  $f_{A} := f(\mathcal{M}_{E})$ . Given an input example, the mechanism selects and outputs  $L$ -substitution sentences with a probability based on exponential mechanism. It then aggregates the inferences of these samples by an average as the estimated prediction of the input. Figure 2 illustrates the algorithm.
Definition 4.2. (Exponential Mechanism for WordDP and  $L$ -Certified Robustness) Given the base model  $f$ , for any input sentence  $\mathbf{X}$  and potential  $L$ -substitution sentence set  $\mathcal{S}(L)$ , we define the utility score function as:
$$
u (\mathcal {S} (L), \mathbf {X} ^ {\prime}) = e ^ {- \| f ^ {\mathbf {y}} (\mathbf {X} ^ {\prime}) - f ^ {\mathbf {y}} (\mathbf {X}) \| _ {1}}, \tag {5}
$$
Figure 2:WordDP with Exponential Mechanism.
which associates a utility score to a candidate output  $\mathbf{X}' \in \mathcal{S}(L)$ . The sensitivity of the utility score is  $\Delta_u = 1 - e^{-1}$ . Then, the exponential mechanism selects and outputs  $\mathbf{X}'$  with probability  $\mathbb{P}_{\mathbf{X}'}$
$$
\mathbb {P} _ {\mathbf {X} ^ {\prime}} = \frac {1}{\rho} \exp \left(\frac {\epsilon \cdot u (\mathcal {S} (L) , \mathbf {X} ^ {\prime})}{2 \Delta u}\right), \tag {6}
$$
where  $\rho = \sum_{i=1}^{|\mathcal{S}(\mathbf{X}, L)|} \exp\left(\frac{\epsilon \cdot u(\mathcal{S}(L), \mathbf{X}_i')}{2\Delta u}\right)$  is the normalization factor.
Proposition 4.1. The exponential mechanism  $\mathcal{M}(E)$  satisfies  $\epsilon$ -DP. The composition model function  $f_{\mathcal{M}_E}(\mathbf{X}) \coloneqq f(\mathcal{M}_E(X))$  is  $\epsilon$ -DP and its prediction score vector  $\mathbb{E}[f_{\mathcal{M}_E}^{\mathbf{Y}}(\mathbf{X})]$ -based classification is certified robust to  $L$ -adversary word substitution attack on  $\mathbf{X}$ .
Proof. To show  $\mathcal{M}_E$  is  $\epsilon$ -DP, we prove the sensitivity of the utility score (maximum difference between the utility scores given any two neighboring input)  $\Delta_u$  is indeed  $1 - e^{-1}$  and the remaining follows the definition of the exponential mechanism (c.f. Definition 3.4). Since  $\|f^{\mathbf{y}}(\mathbf{X}_i') - f^{\mathbf{y}}(\mathbf{X})\|_1$  is the prediction probability change which is in  $[0,1]$ , we have  $u(\mathcal{S}(L),\mathbf{X}_i') \in [e^{-1},1]$ , which leads to  $\Delta_u = 1 - e^{-1}$ . Next, since  $\mathcal{M}_E(\mathbf{X})$  is  $\epsilon$ -DP, by the post-processing property (i.e., any computation on the output of the DP mechanism remains DP, Proposition 2.1 in (Dwork et al., 2014)).  $f_{\mathcal{M}_E}(\mathbf{X})$  is also  $\epsilon$ -DP. Subsequently, by Lemma 4.2,  $\mathbb{E}[f_{\mathcal{M}_E}(\mathbf{X})]$  is  $L$ -certified robust on  $\mathbf{X}$ .
Remark 2. 1) The design of the utility function has the intuition that we wish to assign higher probability to sentences that have minimal impact on the prediction score function. 2) The privacy budget  $\epsilon$  influences whether the sampling probability distribution is flat (lower  $\epsilon$ ) or peaky (greater  $\epsilon$ ). Too small of an  $\epsilon$  value will clearly affect the prediction accuracy. For certification purpose, according to the certified condition Lemma 4.2, too large of an  $\epsilon$  value will result in none certified, so  $\epsilon$  can only be searched within a limited range.
Certification Condition. It is a common practice in certified robustness literature to estimate  $\mathbb{E}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]$  via Monte Carlo estimation (Lecuyer et al., 2019; Cohen et al., 2019) in the form of  $\widehat{\mathbb{E}}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]$ . That is, we repeat the exponential mechanism-based inference to draw  $n$  samples of  $f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X}_{\tau}')$ , for  $\tau \in [n]$  and let  $\widehat{\mathbb{E}}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})] = \frac{1}{n}\sum_{\tau=1}^{n}f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X}_{\tau}')$ . The estimation error between  $\widehat{\mathbb{E}}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]$  and  $\mathbb{E}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]$  can be bounded based on Hoeffding's inequality with probability  $\eta$ , which guarantees that  $\widehat{\mathbb{E}}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})] \in [\mathbb{E}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})] - \sqrt{\frac{1}{2n}\ln\left(\frac{2C}{1-\eta}\right)}, \mathbb{E}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})] + \sqrt{\frac{1}{2n}\ln\left(\frac{2C}{1-\eta}\right)}] := [\widehat{\mathbb{E}}^{lb}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})], \widehat{\mathbb{E}}^{ub}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]]$ . The next proposition shows that the inference based on the estimated  $\widehat{\mathbb{E}}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]$  (as versus  $\mathbb{E}[f_{\mathcal{M}_E}^{\mathbf{y}}(\mathbf{X})]$ ) can still ensure certified robustness.
Proposition 4.2. Under the same condition with Proposition 4.1, if there exists a label  $c$  such that