SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Remark 3.2. For  $f \in \mathcal{F}$  and  $x \in f^{-1}(\{1\})$ , a subgradient  $\nabla g(\varphi(x)) \in \mathbb{R}^q$  of  $g$  always exists at  $\varphi(x)$ , since the subdifferential  $\partial g(\varphi(x))$  is a nonempty closed bounded convex set, as  $g$  is a finite convex function on all of  $\mathbb{R}^q$  —see Theorem 23.4 in Rockafellar [55] and the discussion thereafter. Furthermore, if  $f$  is not a constant classifier, such a subgradient  $\nabla g(\varphi(x))$  must necessarily be nonzero, since, if it were zero, then  $g(y) \geq g(\varphi(x)) + \nabla g(\varphi(x))^{\top}(y - \varphi(x)) = g(\varphi(x)) > 0$  for all  $y \in \mathbb{R}^q$ , implying that  $f$  identically predicts class 1, which is a contradiction. Thus, the certified radius given in Theorem 3.1 is always well-defined in practical settings.
Theorem 3.1 is derived from the fact that a convex function is globally underapproximated by any tangent plane. The nonconstant terms in Theorem 3.1 afford an intuitive interpretation: the radius scales proportionally to the confidence  $g(\varphi(x))$  and inversely with the input sensitivity  $\| \nabla g(\varphi(x)) \|_{p,*}$ . In practice,  $\mathrm{Lip}_p(\varphi)$  can be made quite small as mentioned in Section 2, and furthermore the subgradient  $\nabla g(\varphi(x))$  is easily evaluated as the Jacobian of  $g$  at  $\varphi(x)$  using standard automatic differentiation packages. This provides fast, deterministic class 1 certificates for any  $\ell_p$ -norm without modification of the feature-convex network's training procedure or architecture. We emphasize that our robustness certificates of Theorem 3.1 are independent of the architecture of  $f$ .
3.2 Representation Power Characterization
We now restrict our analysis to the class  $\mathcal{F}_{\mathrm{Id}}$  of feature-convex classifiers with an identity feature map. This can be equivalently considered as the class of classifiers for which the input-to-logit map is convex. We therefore refer to models in  $\mathcal{F}_{\mathrm{Id}}$  as input-convex classifiers. While the feature map  $\varphi$  is useful in boosting the practical performance of our classifiers, the theoretical results in this section suggest that there is significant potential in using input-convex classifiers as a standalone solution.
Classifying convexly separable sets. We begin by introducing the notion of convexly separable sets, which are intimately related to decision regions representable by the class  $\mathcal{F}_{\mathrm{Id}}$ .
Definition 3.3. Let  $X_1, X_2 \subseteq \mathbb{R}^d$ . The ordered pair  $(X_1, X_2)$  is said to be convexly separable if there exists a nonempty closed convex set  $X \subseteq \mathbb{R}^d$  such that  $X_2 \subseteq X$  and  $X_1 \subseteq \mathbb{R}^d \setminus X$ .
Notice that it may be the case that a pair  $(X_{1}, X_{2})$  is convexly separable yet the pair  $(X_{2}, X_{1})$  is not. Although low-dimensional intuition may raise concerns regarding the convex separability of binary-labeled data, we will soon see in Fact 3.8 and Theorem 3.10 that convex separability typically holds in high dimensions. We now show that convexly separable datasets possess the property that they may always be perfectly fit by input-convex classifiers.
Proposition 3.4. For any nonempty closed convex set  $X \subseteq \mathbb{R}^d$ , there exists  $f \in \mathcal{F}_{\mathrm{Id}}$  such that  $X = f^{-1}(\{2\}) = \{x \in \mathbb{R}^d : f(x) = 2\}$ . In particular, this shows that if  $(X_1, X_2)$  is a convexly
separable pair of subsets of  $\mathbb{R}^d$ , then there exists  $f \in \mathcal{F}_{\mathrm{Id}}$  such that  $f(x) = 1$  for all  $x \in X_1$  and  $f(x) = 2$  for all  $x \in X_2$ .
We also show that the converse of Proposition 3.4 holds: the geometry of the decision regions of classifiers in  $\mathcal{F}_{\mathrm{Id}}$  consists of a convex set and its complement.
Proposition 3.5. Let  $f \in \mathcal{F}_{\mathrm{Id}}$ . The decision region under  $f$  associated to class 2, namely  $X := f^{-1}(\{2\}) = \{x \in \mathbb{R}^d : f(x) = 2\}$ , is a closed convex set.
Note that this is not necessarily true for our more general feature-convex architectures with  $\varphi \neq \mathrm{Id}$ . We continue our theoretical analysis of input-convex classifiers by extending the universal approximation theorem for regressing upon real-valued convex functions (given in Chen et al. [16]) to the classification setting. In particular, Theorem 3.6 below shows that any input-convex classifier  $f\in \mathcal{F}_{\mathrm{Id}}$  can be approximated arbitrarily well on any compact set by ReLU neural networks with nonnegative weights. Here, "arbitrarily well" means that the set of inputs where the neural network prediction differs from that of  $f$  can be made to have arbitrarily small Lebesgue measure.
Theorem 3.6. For any  $f \in \mathcal{F}_{\mathrm{Id}}$ , any compact convex subset  $X$  of  $\mathbb{R}^d$ , and any  $\epsilon > 0$ , there exists  $\hat{f} \in \hat{\mathcal{F}}_{\mathrm{Id}}$  such that  $m(\{x \in X : \hat{f}(x) \neq f(x)\}) < \epsilon$ .
An extension of the proof of Theorem 3.6 combined with Proposition 3.4 yields that input-convex ReLU neural networks can perfectly fit convexly separable sampled datasets.
Theorem 3.7. If  $(X_{1},X_{2})$  is a convexly separable pair of finite subsets of  $\mathbb{R}^d$ , then there exists  $\hat{f}\in \hat{\mathcal{F}}_{\mathrm{Id}}$  such that  $\hat{f} (x) = 1$  for all  $x\in X_1$  and  $\hat{f} (x) = 2$  for all  $x\in X_2$ .
Theorems 3.6 and 3.7, being specialized to models with ReLU activation functions, theoretically justify the particular parameterization in Definition 2.2 for learning feature-convex classifiers to fit convexly separable data.
Empirical convex separability. Interestingly, we find empirically that high-dimensional image training data is convexly separable. We illustrate this in Appendix D by attempting to reconstruct a CIFAR-10 cat image from a convex combination of the dogs and vice versa; the error is significantly positive for every sample in the training dataset, and image reconstruction is visually poor. This fact, combined with Theorem 3.7, immediately yields the following result.
Fact 3.8. There exists  $\hat{f} \in \hat{\mathcal{F}}_{\mathrm{Id}}$  such that  $\hat{f}$  achieves perfect training accuracy for the unaugmented CIFAR-10 cats-versus-dogs dataset.
The gap between this theoretical guarantee and our practical performance is large; without the feature map, our CIFAR-10 cats-dogs classifier achieves just  $73.4\%$  training accuracy (Table 4). While high training accuracy does not necessarily imply strong test set performance, Fact 3.8 demonstrates that the typical deep learning paradigm of overfitting to the training dataset is theoretically attainable [49]. We thus posit that there is substantial room for improvement in the design and optimization of input-convex classifiers. We leave the challenge of overfitting to the CIFAR-10 cats-dogs training data with an input-convex classifier as an open research problem for the field.
Open Problem 3.9. Learn an input-convex ReLU neural network that achieves  $100\%$  training accuracy on the unaugmented CIFAR-10 cats-versus-dogs dataset.
Convex separability in high dimensions. We conclude by investigating why the convex separability property that allows for Fact 3.8 may hold for natural image datasets. We argue that dimensionality facilitates this phenomenon by showing that data is easily separated by some  $f \in \hat{\mathcal{F}}_{\mathrm{Id}}$  when  $d$  is sufficiently large. In particular, although it may seem restrictive to rely on models in  $\hat{\mathcal{F}}_{\mathrm{Id}}$  with convex class 2 decision regions, we show in Theorem 3.10 below that even uninformative data distributions that are seemingly difficult to classify may be fit by such models with high probability as the dimensionality of the data increases.
Theorem 3.10. Consider  $M, N \in \mathbb{N}$ . Let  $X_{1} = \{x^{(1)}, \ldots, x^{(M)}\} \subseteq \mathbb{R}^{d}$  and  $X_{2} = \{y^{(1)}, \ldots, y^{(N)}\} \subseteq \mathbb{R}^{d}$  be samples with all elements  $x_{k}^{(i)}, y_{l}^{(j)}$  drawn independently and identi-
cally from the uniform probability distribution on  $[-1, 1]$ . Then, it holds that
$$
\mathbb {P} \left(\left(X _ {1}, X _ {2}\right) \text {i s c o n v e x l y s e p a r a b l e}\right) \geq \left\{ \begin{array}{l l} 1 - \left(1 - \frac {M ! N !}{(M + N) !}\right) ^ {d} & \text {f o r a l l} d \in \mathbb {N}, \\ 1 & \text {i f} d \geq M + N. \end{array} \right. \tag {2}
$$
In particular,  $\hat{\mathcal{F}}_{\mathrm{Id}}$  contains an input-convex ReLU neural network that classifies all  $x^{(i)}$  into class 1 and all  $y^{(j)}$  into class 2 almost surely for sufficiently large dimensions  $d$ .
Although the uniformly distributed data in Theorem 3.10 is unrealistic in practice, the result demonstrates that the class  $\hat{\mathcal{F}}_{\mathrm{Id}}$  of input-convex ReLU neural networks has sufficient complexity to fit even the most unstructured data in high dimensions. Despite this ability, researchers have found that current input-convex neural networks tend to not overfit in practice, yielding small generalization gaps relative to conventional neural networks [60]. Achieving the modern deep learning paradigm of overfitting to the training dataset with input-convex networks is an exciting open challenge [49].
This section compares our feature-convex classifiers against a variety of state-of-the-art baselines in the asymmetric setting. Before discussing the results, we briefly describe the datasets, baselines, and architectures used. For a more in-depth description and hyperparameter details, see Appendix E.
Datasets. We use four datasets. First, we consider distinguishing between  $28 \times 28$  greyscale MNIST digits 3 and 8 [37], which are generally more visually similar and challenging to distinguish than other digit pairs. Next, we consider identifying malware from the "Allaple.A" class in the Maling dataset of  $512 \times 512$  bytwise encodings of malware [50]. Next, we consider distinguishing between shirts and T-shirts in the Fashion-MNIST dataset of  $28 \times 28$  greyscale images [70], which tend to be the hardest classes to distinguish [33]. Finally, we consider the  $32 \times 32$  RGB CIFAR-10 cat and dog images since they are relatively difficult to distinguish [26, 43, 30]. The latter two datasets can be considered as our more challenging settings. All pixel values are normalized into the interval  $[0,1]$ .
Baseline Methods. We consider several state-of-the-art randomized and deterministic baselines. For all datasets, we evaluate the randomized smoothing certificates of Yang et al. [72] for the Gaussian, Laplacian, and uniform distributions trained with noise augmentation (denoted RS Gaussian, RS Laplacian, and RS Uniform, respectively), as well as the deterministic bound propagation framework  $\alpha$ ,  $\beta$ -CROWN [66], which is scatter plotted since certification is only reported as a binary answer at a given radius. We also evaluate, when applicable, deterministic certified methods for each norm ball. These include the splitting-noise  $\ell_1$ -certificates from Levine and Feizi [40] (denoted Splitting), the orthogonality-based  $\ell_2$ -certificates from Trockman and Kolter [63] (denoted Cayley), and the  $\ell_{\infty}$ -distance-based  $\ell_{\infty}$ -certificates from Zhang et al. [77] (denoted  $\ell_{\infty}$ -Net). The last two deterministic methods are not evaluated on the large-scale Malimg dataset due to their prohibitive runtime. Furthermore, the  $\ell_{\infty}$ -Net was unable to significantly outperform a random classifier on the CIFAR-10 cats-dogs dataset, and is therefore only included in the MNIST 3-8 and Fashion-MNIST shirts experiments. Notice that the three randomized smoothing baselines have fundamentally different predictions and certificates than the deterministic methods (including ours), namely, the predictions are random and the certificates hold only with high probability.
Feature-Convex Architecture. Our simple experiments (MNIST 3-8 and Malimg) require no feature map to achieve high accuracy ( $\varphi = \mathrm{Id}$ ). The Fashion-MNIST shirts dataset also benefited minimally from the feature map inclusion. For the CIFAR-10 cats-dogs task, we let our feature map be the concatenation  $\varphi(x) = (x - \mu, |x - \mu|)$ , as motivated by Appendix B, where  $\mu$  is the channel-wise dataset mean (e.g., size 3 for an RGB image) broadcasted to the appropriate dimensions. Our MNIST 3-8 and Malimg architecture then consists of a simple two-hidden-layer input-convex multilayer perceptron with  $(n_1, n_2) = (200, 50)$  hidden features, ReLU nonlinearities, and passthrough weights. For the Fashion-MNIST shirts (CIFAR-10 cats-dogs, resp.) dataset, we use a convex ConvNet architecture consisting of 3 (5, resp.) convolutional, BatchNorm, and ReLU layers. All models are trained using SGD on the standard binary cross entropy loss with Jacobian regularization, and clean accuracies are balanced as described in Section 1.1 and Appendix E.4 to ensure a fair comparison of different robustness certificates.
Results and Discussion. Experimental results for  $\ell_1$ -norm certification are reported in Figure 2, where our feature-convex classifier radii, denoted by Convex*, are similar or better than all other baselines across all datasets. Also reported is each method's clean test accuracy without any attacks, denoted by "clean." Due to space constraints, we defer the corresponding plots for  $\ell_2$ - and  $\ell_{\infty}$ -norm balls to Appendix F, where our certified radii are not dominant but still comparable to methods tailored specifically for a particular norm. We accomplish this while maintaining completely deterministic, closed-form certificates with orders-of-magnitude faster computation time than competitive baselines.
(a) MNIST 3-8.
(b) Malimg.
(c) Fashion-MNIST shirts.
Figure 2: Class 1 certified radii curves for the  $\ell_1$ -norm. Note the log-scale on the Maling plot.
(d) CIFAR-10 cats-dogs.
For the MNIST 3-8 and Malimg datasets (Figures 2a and 2b), all methods achieve high clean test accuracy. Our  $\ell_1$ -radii scale exceptionally well with the dimensionality of the input, with two orders of magnitude improvement over smoothing baselines for the Malimg dataset. The Malimg certificates in particular have an interesting concrete interpretation. As each pixel corresponds to one byte in the original malware file, an  $\ell_1$ -certificate of radius  $r$  provides a robustness certificate for up to  $r$  bytes in the file. Namely, even if a malware designer were to arbitrarily change  $r$  malware bytes, they would be unable to fool our classifier into returning a false negative. We note that this is primarily illustrative and is unlikely to have an immediate practical impact as small semantic changes (e.g., reordering unrelated instructions) can induce large  $\ell_p$ -norm shifts.
While our method produces competitive robustness certificates for  $\ell_2$ - and  $\ell_{\infty}$ -norms (Appendix F), it offers the largest improvement for  $\ell_1$ -certificates in the high-dimensional image spaces considered. This is likely due to the characteristics of the subgradient dual norm factor in the denominator of
Table 1: Average runtimes (seconds) per input for computing the  $\ell_1$ ,  $\ell_2$ , and  $\ell_{\infty}$ -robust radii. * = our method. † = per-property verification time. ‡ = certified radius computed via binary search.
MNIST 3-8	Maling	Fashion-MNIST shirts	CIFAR-10 cats-dogs
Convex*	0.00159	0.00295	0.00180	0.00180
RS Gaussian	2.16	111.9	2.41	5.78
RS Laplacian	2.23	114.8	2.51	5.81
RS Uniform	2.18	112.4	2.44	5.80
Splitting	0.597	994.5	0.185	0.774
α, β-CROWN†	6.088	6.138	6.425	9.133
Cayley	0.000505	—	0.0451	0.0441
l∞-Net‡	0.138	—	0.115	—
Theorem 3.1. The dual of the  $\ell_1$ -norm is the  $\ell_{\infty}$ -norm, which selects the largest magnitude element in the gradient of the output logit with respect to the input pixels. As the input image scales, it is natural for the classifier to become less dependent on any one specific pixel, shrinking the denominator in Theorem 3.1. Conversely, when certifying for the  $\ell_{\infty}$ -norm, one must evaluate the  $\ell_1$ -norm of the gradient, which scales proportionally to the input size. Nevertheless, we find in Appendix F that our  $\ell_2$ - and  $\ell_{\infty}$ -radii are generally comparable those of the baselines while maintaining speed and determinism.
Our feature-convex neural network certificates are almost immediate, requiring just one forward pass and one backward pass through the network. This certification procedure requires a few milliseconds per sample on our hardware and scales well with network size. This is substantially faster than the runtime for randomized smoothing, which scales from several seconds per CIFAR-10 image to minutes for an ImageNet image [18]. The only method that rivaled our  $\ell_1$ -norm certificates was  $\alpha$ ,  $\beta$ -CROWN; however, such bound propagation frameworks suffer from exponential computational complexity in network size, and even for small CIFAR-10 ConvNets typically take on the order of minutes to certify nontrivial radii. For computational tractability, we therefore used a smaller network in our experiments (Appendix E). Certification time for all methods is reported in Table 1.
Unlike the randomized smoothing baselines, our method is completely deterministic in both prediction and certification. Randomized prediction poses a particular problem for randomized smoothing certificates: even for a perturbation of a "certified" magnitude, repeated evaluations at the perturbed point will eventually yield misclassification for any nontrivial classifier. While the splitting-based certificates of Levine and Feizi [40] are deterministic, they only certify quantized (not continuous)  $\ell_1$ -perturbations, which scale poorly to  $\ell_2$ - and  $\ell_{\infty}$ -Certificates (Appendix F). Furthermore, the certification runtime grows linearly in the smoothing noise  $\sigma$ ; evaluating the certified radii at  $\sigma$  used for the Malimg experiment takes several minutes per sample.
Ablation tests examining the impact of Jacobian regularization, the feature map  $\varphi$ , and data augmentation are included in Appendix G. We illustrate the certification performance of our method across all combinations of MNIST classes in Appendix H.
This work introduces the problem of asymmetric certified robustness, which we show naturally applies to a number of practical adversarial settings. We define feature-convex classifiers in this context and theoretically characterize their representation power from geometric, approximation theoretic, and statistical lenses. Closed-form sensitive-class certified robust radii for the feature-convex architecture are provided for arbitrary  $\ell_p$ -norms. We find that our  $\ell_1$ -robustness certificates in particular match or outperform those of the current state-of-the-art methods, with our  $\ell_2$ - and  $\ell_{\infty}$ -radii also competitive to methods tailored for a particular norm. Unlike smoothing and bound propagation baselines, we accomplish this with a completely deterministic and near-immediate computation scheme. We also show theoretically that significant performance improvements should be realizable for natural image datasets such as CIFAR-10 cats-versus-dogs. Possible directions for future research include bridging the gap between the theoretical power of feature-convex models and their practical implementation, as well as exploring more sophisticated choices of the feature map  $\varphi$ .
[70] Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: A novel image dataset for benchmarking machine learning algorithms. arXiv preprint arXiv:1708.07747, 2017.
[71] Samir S Yadav and Shivajirao M Jadhav. Deep convolutional neural network based medical image classification for disease diagnosis. Journal of Big Data, 6(1):1-18, 2019.
[72] Greg Yang, Tony Duan, J Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. In International Conference on Machine Learning, pages 10693-10705. PMLR, 2020.
[73] Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Russ R Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. Advances in Neural Information Processing Systems, 33:8588-8601, 2020.
[74] Roozbeh Yousefzadeh. Deep learning generalization and the convex hull of training sets. In Neurips Deep Learning through Information Workshop, 2020.
[75] Fancheng Zeng, Guanqiu Qi, Zhiqin Zhu, Jian Sun, Gang Hu, and Matthew Haner. Convex neural networks based reinforcement learning for load frequency control under denial of service attacks. Algorithms, 15(2):34, 2022.
[76] Runtian Zhai, Chen Dan, Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. MACER: Attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations, 2020.
[77] Bohang Zhang, Du Jiang, Di He, and Liwei Wang. Boosting the certified robustness of 1-infinity distance nets. arXiv preprint arXiv:2110.06850, 2021.
[78] Dinghuai Zhang, Mao Ye, Chengyue Gong, Zhanxing Zhu, and Qiang Liu. Black-box certification with randomized smoothing: A functional optimization based framework. In Advances in Neural Information Processing Systems, volume 33, pages 2316-2326, 2020.
[79] Ling Zhang, Yize Chen, and Baosen Zhang. A convex neural network solver for DCOPF with generalization guarantees. IEEE Transactions on Control of Network Systems, 2021.
[80] Sen Zhao, Erez Louidor, and Maya Gupta. Global optimization networks. In International Conference on Machine Learning, pages 26927-26957. PMLR, 2022.
A Classification Framework Generalization
While outside the scope of our work, we note that there are two natural ways to extend our approach to a multiclass setting with one sensitive class. Let  $\mathcal{Y} = \{1,2,\dots ,c\}$ , with class 1 being the sensitive class for which we aim to generate certificates.
One approach involves a two-step architecture, where a feature-convex classifier first distinguishes between the sensitive class 1 and all other classes  $\{2,3,\dots ,c\}$  and an arbitrary second classifier distinguishes between the classes  $\{2,3,\ldots ,c\}$ . The first classifier could then be used to generate class 1 certificates, as described in Section 3.1.
Alternatively, we could define  $g$  to map directly to  $c$  output logits, with the first logit convex in the input and the other logits concave in the input. Concavity can be easily achieved by negating the output of a convex network. Let the  $i$ th output logit then be denoted as  $g_{i}$  and consider an input  $x$  where the classifier predicts class 1 (i.e.,  $g_{1}(\varphi(x)) \geq g_{i}(\varphi(x))$  for all  $i \in \{2,3,\ldots,c\}$ ); since the difference of a convex and a concave function is convex, we can generate a certificate for the nonnegativity of each convex decision function  $g_{1} \circ \varphi - g_{i} \circ \varphi$  around  $x$ . Minimizing these certificates over all  $i \in \{2,3,\ldots,c\}$  yields a robustness certificate for the sensitive class.
Note that  $g$  mapping to 2 or more logits, all convex in the input, would not yield any tractable certificates. This is because the classifier decision function would now be the difference of two convex functions and have neither convex nor concave structure. We therefore choose to instantiate our binary classification networks with a single convex output logit for clarity.
A.1 Maling Multiclass Extension