SlowGuess/NeurIPS_2023_OCR huggingface dataset:
The reason for splitting the cases for predicting 1 into two subcases, is that we will only need to analyse the first subcase and the second will not contribute to the robust risk.
Defining  $U_{1}$  to be the set of all points  $x$  which admit an adversarial example for the class 1, i.e.  $U_{1} = \{x\colon \exists \bar{x}$  such that  $\| \bar{x} -x\| _2\leq \epsilon ,f(\bar{x}) = 2\}$ . It is clear that
$$
U _ {1} \subseteq \left\{x: | x _ {1} | \geq \gamma / 2 \text {o r} | x _ {2} | \leq \gamma / 2 + 2 \epsilon \right\}.
$$
$U_{2}$  is defined analogously, and
$$
U _ {2} \subseteq \left\{x: | x _ {2} | \geq \gamma / 2 \text {o r} | x _ {1} | \leq \gamma / 2 + 2 \epsilon \right\}.
$$
Now,  $R(f,\epsilon) = 0.5q_{1}(U_{1}) + 0.5q_{2}(U_{2})$ . We look at the first term, and simplify an upper bound:
$$
\begin{array}{l} q _ {1} \left(U _ {1}\right) \leq q _ {1} \left(\left\{x: | x _ {1} | \geq \gamma / 2 \text {o r} | x _ {2} | \leq \gamma / 2 + 2 \epsilon\right) \right. \\ \leq q _ {1} \left(\left\{x: | x _ {1} | \geq \gamma / 2 \right\}\right) + q _ {1} \left(\left\{x: | x _ {2} | \leq \gamma / 2 + 2 \epsilon\right) \right. \\ = 0 + q _ {1} \left(\left\{x: \left| x _ {2} \right| \leq \gamma / 2 + 2 \epsilon \right\}\right). \tag {21} \\ \end{array}
$$
Now, recall that  $q_{1} = \mathrm{Unif}(\{x\colon |x_{1}|\leq \gamma /2\})$ , hence the expression in (21) evaluates to
$$
\begin{array}{l} q _ {1} \left(\left\{x: | x _ {2} | \leq \gamma / 2 + 2 \epsilon \right\}\right) = \frac {1}{\operatorname {V o l} \left(\left\{x : | x _ {1} | \leq \gamma / 2 \right\}\right)} \operatorname {V o l} \left(\left\{x: | x _ {2} | \leq \gamma / 2 + 2 \epsilon , | x _ {1} | \leq \gamma / 2 \right\}\right) \\ = \frac {1}{2 ^ {n - 1} \gamma} 2 ^ {n - 2} \cdot (\gamma + 4 \epsilon) \cdot \gamma \\ = 0. 5 \gamma + 2 \epsilon \\ \end{array}
$$
The situation for  $q_{2}$  is symmetric, and hence  $q_{2}(U_{2}) = 0.5(\gamma + 4\epsilon)$ . Adding them together, we see that the robust risk is upper bounded by
$$
R (f, \epsilon) \leq 0. 5 \left(e ^ {- \alpha} + 4 \epsilon\right)
$$
For the concentration parameters, note that the support of  $q_{1}$ , i.e.,  $S_{1} = \{x\colon |x_{1}|\leq \gamma /2,\| x\|_{\infty}\leq 1\}$  has volume  $\gamma 2^{n - 1} = 2^{n - 1}\exp (-\alpha) = 0.52^n\exp (-n(\alpha /n))\leq 0.5\exp (-n(\alpha /n - 1))$ . Hence,  $q_{1}$  is  $(0.5,\alpha /n - 1,0)$  concentrated over  $S_{1}$ . Similarly,  $q_{2}$  is  $(0.5,\alpha /n - 1,0)$ -concentrated over  $S_{2} = \{x\colon |x_{2}|\leq \gamma /2,\| x\|_{\infty}\leq 1\}$ . Finally,
$$
\begin{array}{l} q _ {1} \left(S _ {2} ^ {+ 2 \epsilon}\right) = q _ {1} \left(\left\{\| x \| _ {\infty} \leq 1, \| x _ {1} \| \leq \gamma / 2, \| x _ {2} \| \leq \gamma / 2 + 2 \epsilon \right\}\right) \\ = 2 ^ {n - 2} \gamma (\gamma + 4 \epsilon) \gamma^ {- 1} 2 ^ {1 - n} \\ = 0. 5 \gamma + 2 \epsilon \\ \end{array}
$$
E Proof of Theorem 4.1
Proof. Let  $\lambda x' \in C(x)$  as defined in (8). There exist  $f \in F(x), v \in V(x)$  such that  $\lambda x' = f + v$ . We will show that the projection of  $\lambda x'$  onto  $F$  is given by  $f$ . Recall that
$$
A _ {\lambda} \left(x ^ {\prime}\right) = \left\{t _ {i}: \left\langle t _ {i}, d _ {\lambda} ^ {*} \left(x ^ {\prime}\right) \right\rangle = 1 \right\}, \text {w h e r e} d _ {\lambda} ^ {*} \left(x ^ {\prime}\right) = \operatorname {P r o j} _ {K ^ {\circ}} \left(\lambda x ^ {\prime}\right). \tag {22}
$$
Choose any  $z \in K^{\circ}$ . Recall that  $\operatorname{Proj}_{K^{\circ}}(\lambda x') = \min_{z \in K^{\circ}} \| z - \lambda x' \|_2$ . Consider the objective,
$$
\left\| z - \lambda x ^ {\prime} \right\| _ {2} ^ {2} = \left\| (z - f) - v \right\| _ {2} ^ {2} = \left\| z - f \right\| _ {2} ^ {2} + \left\| v \right\| _ {2} ^ {2} - 2 \langle z - f, v \rangle . \tag {23}
$$
We will show that  $\langle z - f, v \rangle$  is negative. Consider any  $t_i \in A_\lambda(x)$ , and observe that  $\langle z, t_i \rangle \leq 1$ , as  $z \in K^\circ$ . However, from the definition of  $F(x)$  recall that  $\langle f, t_i \rangle = 1$ . This implies that  $\langle z - f, t_i \rangle \leq 0$ . Using the fact that  $v \in V(x)$ , we expand the inner product as
$$
\langle z - f, v \rangle = \sum_ {t _ {i} \in A _ {\lambda} (x)} \alpha_ {i} \langle z - f, t _ {i} \rangle \leq 0. \tag {24}
$$
Using (24) in (23) to obtain
$$
\left\| z - \lambda x ^ {\prime} \right\| _ {2} ^ {2} \geq \left\| z - f \right\| _ {2} ^ {2} + \left\| v \right\| _ {2} ^ {2} \geq 0. \tag {25}
$$
The minimizer above is obtained at  $z = f \in C(x)$ , and hence we have shown that for all  $\lambda x' \in C(x)$ ,  $\operatorname{Proj}_{K^\circ}(\lambda x') = f$ . Finally,  $d_\lambda^*(x') = \operatorname{Proj}_{K^\circ}(\lambda x') = f \in F(x)$ . The theorem statement then follows from the definition of  $F(x)$ .
F Further Experimental Details and Qualitative Examples
F.1 Comparison along Projection on  $C_{\lambda}$
In this section, we will provide more details on attacking a classifier with perturbations that lie on our certified set  $C_{\lambda}$ .
Details of the Projection Step II in (13) Recall from Theorem 4.1 that  $C_{\lambda}(x)$  is defined as the Minkowski sum of the face  $F_{\lambda}(x)$  (9) and the cone  $V_{\lambda}(x)$  (10). Given an iterate  $x^{t}$ , we can compute its projection onto  $C_{\lambda}(x^{0})$  by solving the following optimization problem
$$
\operatorname {P r o j} _ {C _ {\lambda} \left(x ^ {0}\right)} \left(x ^ {t}\right) = \underset {x} {\arg \min } \| x ^ {t} - x \| _ {2} \text {s . t .} x \in C _ {\lambda} \left(x ^ {0}\right)
$$
Now every  $x \in C_{\lambda}(x^0)$  can be written as  $x = d + v$  where  $d \in F(x^0), v \in V(x^0)$ .  $d$  is such that  $t^\top d = 1$  for all  $t_i \in A_{\lambda}(x^0)$ , and  $t^\top d \leq 1$  otherwise. Then,  $v$  is such that  $v = \sum_{t_i \in A_{\lambda}(x^0)} \alpha_i t_i$  for some  $\alpha_i \geq 0$ . Recall that  $T = [t_1, t_2, \ldots, t_{2M}]$  denotes the matrix containing the training data-points as well as their negations. Let the matrix  $A_1 \in \mathbb{R}^{d \times |A_{\lambda}(x^t)|}$  contain all the columns of  $T$  in  $A_{\lambda}(x^t)$  and let  $A_2 \in \mathbb{R}^{d \times (2M - |A_{\lambda}(x^t)|)}$  contain all the remaining columns. Then the objective of the optimization problem above can be written as
$$
\min  _ {\alpha , d} \left\| x ^ {t} - A _ {1} \alpha - d \right\| _ {2} ^ {2} \text {s . t .} A _ {1} ^ {\top} d = \mathbf {1}, A _ {2} ^ {\top} d \leq \mathbf {1}, \alpha \geq \mathbf {0} \tag {26}
$$
(26) is a linearly constrained quadratic program, and can be solved by standard optimization tools. In particular, we use the qp solver from the python cvxopt library.
Visualization of the Certified Set In Fig. 9, we visualize the set  $A_{\lambda}(x)$ , i.e., the set of active constraints at the optimal solution of the dual problem, for several  $x$  in the MNIST test set. It can be seen that  $A_{\lambda}(x)$  contains images of the same digit as  $x$  in most cases. This is expected, as taking the majority label among  $A_{\lambda}(x)$  gives an accuracy of around  $97\%$  (solid blue curve in Fig. 5). Note that all these images  $t \in A_{\lambda}(x)$  are also contained in the certified set,  $C_{\lambda}(x)$ , which can be seen as  $t = t + \mathbf{0}$ , with  $t \in F_{\lambda}(x)$ , and  $\mathbf{0} \in V_{\lambda}(x)$ .
Figure 9: A visualization of the set of active constraints  $A_{\lambda}(x)$  for several  $x$ . At most 5 members of  $A_{\lambda}(x)$  are shown for every  $x$ .
Visualization of Attacks restricted to the Certified Set In Fig. 10, we visualize the attacks restricted to our certified set  $C_{\lambda}$  computed by (13) for the classifier  $g_{0.02}^{\mathrm{RS}}$ . We observe that we can identify the correct digit from most of the attacked images, but the randomized smoothing classifier is incorrect at higher  $\epsilon$ . A small number of these attacked images are close to the actual class decision boundary, and the class is ambiguous. This is expected, both due to the inherent class ambiguity present in some MNIST images, as well as the large  $\epsilon$  we are attacking with. For all these images, the prediction of our classifier  $g_{\lambda}$  is certified to be accurate. For comparison, the RS certificate is unable to certify anything beyond  $\epsilon \geq 0.06$ .
Figure 10: A visualization of attacks on the RS classifier  $g_{0.02}^{\mathrm{RS}}$  restricted to our certified set  $C_{\lambda}$  obtained by (13). Different rows plot different attack strengths  $\epsilon$ . Whenever an image is misclassified, the red annotation on the top left shows the class predicted by  $g_{0.02}^{\mathrm{RS}}$ .
F.2 Comparison along  $\ell_2$  balls
Exact Certification for  $g_{\lambda}$  In this section, we first state and prove Theorem 4.1 that allows us to exactly compute the  $\ell_2$  certified radius for our classifier  $g_{\lambda}$  at any point  $x$ .
Lemma F.1. For all  $x' \in C(x)$  as defined in Theorem 4.1, we have  $g_{\lambda}(x') = g_{\lambda}(x)$ . Additionally, for all  $\| v \|_2 \leq r_0(x)$  we have  $g_{\lambda}(x + v) = g_{\lambda}(x)$ , where
$$
r _ {0} (x) = \quad \min  _ {\mathbf {u}} - \langle x, \mathbf {u} \rangle \tag {27}
$$
$$
\text {s u b . t o} \| \mathbf {u} \| _ {2} = 1, \quad \langle \mathbf {u}, t _ {i} \rangle \leq 0 \forall t _ {i} \in A _ {\lambda} (x), \quad \langle \mathbf {u}, v \rangle \leq 1 \forall v \in \operatorname {e x t} (F (x)),
$$
where  $\operatorname{ext}(F(x))$  is the set of extreme points of the polyhedron  $F(x)$ .
Discussion Before presenting the proof, let us ponder over the result. We see that (27) involves solving an optimization problem having as many constraints as the number of extreme points of the polyhedron  $F(x)$ . In general, this can be very large in high dimensions, and hence computationally inefficient to compute. As a result, while Lemma F.1 provides an exact certificate in theory, it is hard to use in practice without further approximations.
Proof. Recall that given a set  $A_{\lambda}(x)$ , the polyhedron  $C(x)$  is defined in (8) as
$$
C (x) = F (x) + V (x), \tag {28}
$$
where  $F(x)$  is a polyhedron, and  $V(x)$  is a cone given as the conic hull of  $A_{\lambda}(x)$ , i.e.,  $V(x) = \operatorname{cone}(A_{\lambda}(x))$ . We want to find the size  $r(x)$  of the largest  $\ell_2$  ball centered at  $x$ , i.e.,  $B(x,r(x))$ , that can be inscribed within  $C(x)$ . From convex geometry [4], we know that any polyhedron can be described as an intersection over halfspaces obtained from its polar,  $C^\circ$  as
$$
C (x) = \cap_ {\mathbf {u} \in C ^ {\circ} (x)} H ^ {-} (\mathbf {u}, 0), \tag {29}
$$
where  $H^{-}(\mathbf{u},0) = \{x\colon \langle \mathbf{u},x\rangle \leq 0\}$ . The distance of  $x$  from the boundary of  $C(x)$  is the same as the smallest distance of  $x$  from any halfspace in (29). However, this distance is simply
$$
\operatorname {d i s t} (x, H ^ {-} (\mathbf {u}, 0)) = - \left\langle x, \frac {\mathbf {u}}{\| \mathbf {u} \| _ {2}} \right\rangle . \tag {30}
$$
In other words, we can expressing  $C(x)$  as the intersection over halfspaces whose normals lie in  $C^\circ (x)$ , i.e.,
$$
r (x) = \left(\min  _ {\mathbf {u}} - \langle x, \mathbf {u} \rangle , \text {s u b . t o} \| \mathbf {u} \| _ {2} = 1, \mathbf {u} \in C ^ {\circ} (x)\right). \tag {31}
$$
All that is left is to obtain a description of  $C^\circ(x)$ . This can be done by first expressing  $C(x)$  in a standard form, as
$$
C (x) = \operatorname {c o n v} (\operatorname {e x t} (F (x))) + \operatorname {c o n e} \left(A _ {\lambda} (x)\right), \tag {32}
$$
where  $\operatorname{ext}(F(x))$  denotes the extreme points of the polyhedron  $F(x)$ ,  $\operatorname{conv}(\cdot)$  denotes the convex hull and  $\operatorname{cone}(\cdot)$  denotes the conic hull. Now we can apply a theorem in convex geometry to obtain the polar ([4, Th. 2.79]) as
$$
C ^ {\circ} (x) = \left\{\mathbf {u}: \begin{array}{l} \langle \mathbf {u}, t _ {i} \rangle \leq 0 \forall t _ {i} \in A _ {\lambda} (x) \\ \langle \mathbf {u}, v \rangle \leq 1 \forall v \in \operatorname {e x t} (F (x)) \end{array} \right\} \tag {33}
$$
Combining (31) and (33), we obtain the lemma statement. Finally, we note that as Theorem 4.1 shows that  $A_{\lambda}(x') = A_{\lambda}(x)$  for all  $\lambda x' \in C(x)$ , and the classifier  $g_{\lambda}(x)$  is purely a function of  $A_{\lambda}(x)$ , we have that  $g_{\lambda}(x') = g_{\lambda}(x)$  for all  $\lambda x' \in C(x)$ .
Black Box Attacks on  $g_{\lambda}$  Since our classifier  $g_{\lambda}$  is not explicitly differentiable with respect to its input, we use the HopSkipJump [9] black-box attack to obtain adversarial perturbations that cause a misclassification. The obtained attacked images, and the perturbation magnitude are shown in Fig. 11.
0.74
Figure 11: A visualization of attacks on our classifier  $g_{\lambda}$  obtained by the HopSkipJump black box attack [9]. The label predicted by  $g_{\lambda}$  is shown as a red annotation on the top left. The  $\ell_2$  perturbation magnitude  $\epsilon$  is shown at the bottom. Note that the  $\epsilon$  values are not nice fractions because they are set by the HopSkipJump attack using a binary search to find the minimum attack strength that causes a misclassification.
F.3 Details of Randomized Smoothing Certificates
For obtaining the certified accuracy curves using Randomized Smoothing [11] (solid lines in Figs. 5 and 6), we follow the certification and prediction algorithms for RS in [11, Sec 3.2.2]: given a base classifier  $f$  and a test image  $x$ , we use  $n_0 = 100$  samples from an isotropic gaussian distribution  $\mathcal{N}(0,\sigma)$  to predict the majority class  $g_{\sigma}^{\mathrm{RS}}(x)$ . We then use  $n = 100$  samples to estimate the prediction probability  $\underline{p_A}$  under  $\mathcal{N}(0,\sigma)$  with confidence at least 0.999. If  $\underline{p_A}$  is at least 0.5, we report the certified radius  $\sigma \Phi^{-1}(\underline{p_A})$ . Otherwise, if  $\underline{p_A} < 0.5$ , we abstain and return a certified radius of 0.
Evaluating the Dual Classifier  $g_{\lambda}$  We normalize each image in the MNIST dataset to have unit  $\ell_2$  norm, and resize to  $32 \times 32$ . We pick 10000 images  $s_i$  at random from the training set to obtain our data matrix  $\mathbf{S} \in \mathbb{R}^{1024 \times 10000}$ . We now pick a test point  $x$ , and then solve the dual problem (5) with  $\lambda = 2$ , to obtain the dual solution  $d_{\lambda}^{*}(x)$ . This allows us to then obtain the set of active constraints  $A_{\lambda}(x)$  in (7). Then, we use the majority rule as the aggregate function in (11) to obtain the classification output from the dual classifier  $g_{\lambda}(x)$ . We sample 100 and 500 images  $x$  uniformly at random from the MNIST test set for generating the curves in Figs. 5 and 6, respectively. All experiments are performed on a NVIDIA GeForce RTX 2080 Ti GPU with 12 GB memory.
F.4 Discussion of Computational Cost
The computational complexity of obtaining the certificate  $C(x)$  in Theorem 4.1 is dominated by solving the linear optimization problem (6) to obtain the set  $A_{\lambda}$ , which has  $n + M$  variables. It is known that in practice, the cost of solving LPs is much lower than the worst case [52], and it takes us 11.7 seconds on average on a single CPU for each image  $x$  without parallel processing.
For comparison to other certified defenses (like Randomized Smoothing), we perform  $T = 20$  steps of (13), and each Step II of (13) requires solving a quadratic optimization program, given in (26). This is a linearly constrained quadratic program. In practice it takes us 18.1 seconds on average on a single CPU for each  $x$  without parallel processing.
F.5 Experiments on CIFAR-10
We provide experiments for our method applied to CIFAR-10. To do this, we first embed each CIFAR-10 image into a feature space, designed such that  $\ell_2$ -bounded perturbations in the feature space, i.e.,  $\phi(x + v), \|v\|_2 \leq \epsilon$ , correspond to semantic perturbations in the input space, e.g., distorting the image. Such a feature space is obtained following recent popular work in learning perceptual metrics in vision [67], where the task is precisely to learn a feature representation where  $\ell_2$  distances align with human perception. We now use our subspace model on  $\phi(X)$ , and perform exactly the experiments in Section 5, and make similar observations: we obtain reasonable robust accuracy using our method (Fig. 12 blue lines), and this accuracy is maintained within our certified polyhedra at high  $\epsilon$ , where existing defenses are not robust.
Though such experiments showing feature space certificates have appeared in the literature [58], the question of whether the perceptual representation is itself susceptible to small adversarial perturbations still remains for future exploration.
Figure 12: Comparing Randomized Smoothing (RS) with Our Method from Section 4, for adversarial perturbations computed by repeating Steps I, II from Eq. (13). This figure is the counterpart of Fig. 5, where the MNIST dataset has been changed to  $\phi$  (CIFAR-10), and the transformation  $\phi$  is given by (left) 384-dimensional slice of LPIPS [67] features (i.e., output of the third Conv2D layer) and (right) 128-dimensional input features used by SENet [68]. Observation 1: Our method retains robustness even when the dashed empirical upper bound for robust accuracy for the RS classifier drops to random chance. Observation 2: Our robust accuracy (solid blue line) gets higher from left to right, as the feature space of SENet is closer to a union of subspaces than LPIPS. On the other hand, the left feature space aligns better with human perception than the right feature space.
F.6 Evaluating Theorem 3.1 on Empirical Distributions
The empirical results in [44, 5] create an empirical distribution  $\hat{p}$  by selecting two classes from CIFAR-10, which simply places probability mass  $1 / N$  on each of the  $N$  samples in the dataset. [44, 5] evaluate their lower bounds on  $\hat{p}$ , and not on the actual real world distribution  $p$ , which might be arbitrarily complex. Hence, it is unclear whether the trends observed hold for  $p$ . Nevertheless, the
same experiment can be translated to our setting for any real world dataset, our Theorem 3.1 would then show the existence of a robust classifier for  $\hat{p}$ . We would need to solve a discrete optimization problem for finding the concentrated sets in Theorem 3.1. Even though valid only for  $\hat{p}$ , this analysis is interesting, and is reported in Fig. 13.
Figure 13: Instantiating Theorem 3.1 for the CIFAR-10 empirical distribution. We construct the empirical distribution  $\hat{p}$  which assigns equal probability to each  $(x,y)$  pair in the CIFAR-10 test set. This leads to empirical class conditionals  $\hat{q}_1,\dots ,\hat{q}_{10}$ , corresponding to the 10 classes. We set  $\gamma = 0$  in Theorem 3.1, and greedily construct the sets  $S_{1},\ldots ,S_{10}$ : sort all images in decreasing order of their distance to their nearest neighbor in the test set, pick the first  $m$  images, and then compute the concentration parameters (minimum separation  $\epsilon_{m}$  and mass  $\delta_{m} = 1 - \min_{i}\hat{q}_{i}(S_{i})$ ). We then plot  $(\epsilon_{m},1 - \delta_{m})$  for several choices of  $m$ . Applying Theorem 3.1, each  $(\epsilon_{m},\delta_{m})$  guarantees the existence of a  $(\epsilon_{m},\delta_{m})$ -robust classifier for  $\hat{p}$ .
G Discussion on Strong Concentration
Are Natural Image Distributions Strongly Concentrated? Consider the task of classifying images of dogs vs cats. Any small  $\ell_2$  perturbation (say of size  $\epsilon = 0.1$ ) to an image of a dog is not likely to change it to an image of a cat - the true label (or a human decision) does not change with small perturbations. Let  $S_{\mathrm{cat}}$  be the set of images that are cats with a high confidence, and similarly for  $S_{\mathrm{dog}}$ . What we just said was that any image in the  $\epsilon$ -expansion of  $S_{\mathrm{cat}}$  is not likely to be a dog, and vice versa. This is precisely the condition of separation in the definition of strong concentration:  $q_{\mathrm{dog}}(S_{\mathrm{cat}}^{+\epsilon}) \leq \gamma$ , and  $q_{\mathrm{cat}}(S_{\mathrm{dog}}^{+\epsilon}) \leq \gamma$ , for a small  $\gamma$ .
Now, despite the above, the task of practically classifying an image into a dog or a cat is not trivial at all, as the sets  $S_{\mathrm{dog}}$  and  $S_{\mathrm{cat}}$  might be very complex, and hence it might be computationally hard to find a predictor (neural network, or any other classifier) for distinguishing  $S_{\mathrm{dog}}$  and  $S_{\mathrm{cat}}$ . Using modern deep learning, one is able to learn an approximation to these sets that leads to small standard error, but this approximation is still bad enough that the learned predictor is very susceptible to adversarial examples. This is to say that task of robustly classifying an image into dog or cat is even harder.
Tightness of Strong Concentration In Definition 3.1, we are trying to obtain a sufficient condition for the existence of a robust classifier. There are two parts to Definition 3.1: the concentration, and the separation conditions. The first is essential, as Theorem 2.1 asserts that whenever a robust classifier exists for a data distribution, the class conditionals are concentrated (i.e., it is necessary).
As we argued above, the separation condition is not very strong, and should be satisfied by image distributions like MNIST, CIFAR-10 and ImageNet. Let us walk through this condition to see if it can be further relaxed. As we note at the start of Section 3, if all the class conditionals were to be concentrated on subsets  $S_{k}$  that have high intersection among each other, then even benign classification would be hard (i.e., benign risk will be high), let alone robust classification. So, even for the existence of a good benign classifier, it is essential for  $S_{k} \cap S_{k^{\prime}}$  to be close to empty, for all  $k \neq k^{\prime}$ .
Now, even if  $S_{k} \cap S_{k'}$  were almost empty, for a robust classifier, we care about the  $\epsilon$ -expansions of these sets to not intersect. In other words, we do not want an  $\epsilon$ -perturbed cat to look like a dog. Hence, for the existence of a good robust classifier,  $S_{k} \cap S_{k'}^{+\epsilon}$  should be close to empty, for all  $k \neq k'$ . This can be generalized in measure terms, to require  $q_{k}(S_{k'}^{+\epsilon}) \leq \gamma$ , for a small  $\gamma$ . Upto this, all these conditions are essential for obtaining a robust classifier.
Now, note that in Definition 3.1, the expansion is taken for  $2\epsilon$ , instead of  $\epsilon$ . This is where our proof technique for Theorem 3.1 incurs a slack of  $\epsilon$ , and we believe a different approach for constructing the robust classifier might be able to reduce the expansion requirement to  $\epsilon$ . This could be an interesting future avenue for relaxing Definition 3.1 and thereby strengthening Theorem 3.1.