SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Figure 11: Impact of the Jacobian regularization parameter  $\lambda$  on CIFAR-10 cats-dogs classification.
As expected, the clean accuracies for both datasets are lower for  $\varphi = \mathrm{Id}$ , while the certified radii are generally larger due to the Lipschitz scaling factor in Theorem 3.1. Interestingly, while the standard  $\varphi$  produces comparable performance in both experiments, the identity feature map classifier is more effective in the dogs-cats experiment, achieving around  $7\%$  greater clean accuracy. This reflects the observation that convex separability is an asymmetric condition and suggests that feature maps can mitigate this concern.
(a)
Figure 12: (a) Certification performance with cats as class 1 and dogs as class 2. (b) Certification performance with dogs as class 1 and cats as class 2.
G.3 Unaugmented Accuracies
Table 4 summarizes the experimental counterpart to Section 3.2. Namely, Fact 3.8 proves that there exists an input-convex classifier  $(\varphi = \mathrm{Id})$  that achieves perfect training accuracy on the CIFAR-10 cats-dogs dataset with no dataset augmentations (random crops, flips, etc.). Our practical experiments
are far from achieving this theoretical guarantee, with just  $73.4\%$  accuracy for cats-dogs and  $77.2\%$  for dogs-cats. Improving the practical performance of input-convex classifiers to match their theoretical capacity is an exciting area of future research.
Table 4: CIFAR-10 accuracies with no feature augmentation  $(\varphi = \mathrm{Id})$  and no input augmentation.
Class 1-class 2 data	Training accuracy	Test accuracy (balanced)
Cats-dogs	73.4%	57.3%
Dogs-cats	77.2%	63.9%
H MNIST Classes Sweep
For our comparison experiments, we select a specific challenging MNIST class pair (3 versus 8). For completeness, this section includes certification results for our method over all combinations of class pairs in MNIST. As this involves training models over 90 combinations, we lower the number of epochs from 60 to 10, maintaining all other architectural details described in Appendix E.
(a)  $\ell_1$ -certificates.
(b)  $\ell_2$ -certificates.
(c)  $\ell_{\infty}$ -certificates.
Figure 13: Plotting the median certified radii for the MNIST feature-convex architecture over a range of class combinations. The horizontal axis is the class being certified. The MNIST 3-8 experiment considered throughout therefore corresponds to the cell (3, 8) in each plot.
Our certified radii naturally scale with the complexity of the classification problem. As expected, 3 and 8 are among the most challenging digits to distinguish, along with 2-8, 5-8, 4-9, and 7-9. Particularly easy combinations to classify typically include 0 or 1.
The certification performance is remarkably symmetric across the diagonal despite the asymmetry in our convex architectures. In other words, when classifying between digits  $i$  and  $j$ , if a convex classifier exists which generates strong certificates for  $i$ , then we can generally train an asymmetric classifier that generates strong certificates for  $j$ . A few exceptions to this can be seen in Figure 13; the most notable are the 1-9 versus 9-1 pairs and the 4-8 versus 8-4 pairs. A deeper understanding of how class characteristics affect asymmetric certification is an exciting avenue of future research.
I Randomized Smoothing Noise Level Sweeps
In this section, we reproduce the performance randomized smoothing classifiers under different noise distributions for a range of noise parameters  $\sigma$ . Namely, we sweep over multiples of base values of  $\sigma$  reported in the subcaptions of Figures 14, 15, and 16. The base values of  $\sigma$  were set to  $\sigma = 0.75$  for the MNIST 3-8, Fashion-MNIST, and CIFAR-10 cats-dogs experiments. For the higher-resolution Maling experiment, we increase the base noise to  $\sigma = 3.5$ , matching the highest noise level examined in Levine and Feizi [40]. The epochs used for training were similarly scaled by  $n$ , starting from the base values provided in Section E, with the exception of the CIFAR-10 base epochs being increased to 600 epochs.
(a) MNIST 3-8,  $\sigma = 0.75$
(b) Malimg,  $\sigma = 3.5$
(c) Fashion-MNIST shirts,  $\sigma = 0.75$
(d) CIFAR-10 cats-dogs,  $\sigma = 0.75$
Figure 14: Randomized smoothing certified radii sweeps for the  $\ell_1$ -norm. Line shade indicates value of the integer noise multiplier  $n$ , with  $n$  ranging from 1 (darkest line) to 4 (lightest line).
(d) CIFAR-10 cats-dogs,  $\sigma = 0.75$
Figure 15: Randomized smoothing certified radii sweeps for the  $\ell_2$ -norm. Line shade indicates value of the integer noise multiplier  $n$ , with  $n$  ranging from 1 (darkest line) to 4 (lightest line). For higher-dimensional inputs (Maling and CIFAR-10) methods which certify to a different norm and convert are uncompetitive.
(d) CIFAR-10 cats-dogs,  $\sigma = 0.75$
Figure 16: Randomized smoothing certified radii sweeps for the  $\ell_{\infty}$ -norm. Line shade indicates value of the integer noise multiplier  $n$ , with  $n$  ranging from 1 (darkest line) to 4 (lightest line).