SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Proposition D.16. [Enforce Invariance] Consider a neural network  $f: \mathcal{X}(\Omega, \mathcal{C}) \to \mathcal{Y}$  that is invariant with respect to the symmetry group  $\mathcal{G}$  and  $e: \mathcal{X}(\Omega, \mathcal{C}) \to \mathcal{E}$  be an explanation for  $f$ . We assume that  $\mathcal{G}$  acts on  $\mathcal{X}(\Omega, \mathcal{C})$  via the representation  $\rho: \mathcal{G} \to \operatorname{Aut}[\mathcal{X}(\Omega, \mathcal{C})]$ . We define the auxiliary explanation  $e_{\mathrm{inv}}: \mathcal{X}(\Omega, \mathcal{C}) \to \mathcal{E}$  as
Proof. For any  $\tilde{g} \in \mathcal{G}$ , we have that
$$
\begin{array}{l} e _ {\text {i n v}} (\rho [ \tilde {g} ] x) = \frac {1}{| \mathcal {G} |} \sum_ {g \in \mathcal {G}} e (\rho [ \tilde {g} ] \rho [ g ] x) \\ = \frac {1}{| \mathcal {G} |} \sum_ {g \in \mathcal {G}} e (\rho [ \tilde {g} \circ g ] x), \\ \end{array}
$$
where we have used the fact that the representation  $\rho$  is compatible with the group composition. We now define the map  $l_{\tilde{g}}: \mathcal{G} \to \mathcal{G}$  as  $l_{\tilde{g}}(g) = \tilde{g} \circ g$  for all  $g \in \mathcal{G}$ . We note that  $l_{\tilde{g}}$  is a bijection from  $\mathcal{G}$  to itself, since it admits an inverse  $l_{\tilde{g}}^{-1} = l_{\tilde{g}^{-1}}$ . Indeed, for all  $g \in \mathcal{G}$ :
$$
(l _ {\tilde {g} ^ {- 1}} \circ l _ {\tilde {g}}) (g) = \tilde {g} ^ {- 1} \circ \tilde {g} \circ g = g
$$
$$
(l _ {\tilde {g}} \circ l _ {\tilde {g} ^ {- 1}}) (g) = \tilde {g} \circ \tilde {g} ^ {- 1} \circ g = g
$$
Hence, we have that  $l_{\tilde{g}}(\mathcal{G}) = \mathcal{G}$ . By denoting  $g' = l_{\tilde{g}}(g) = \tilde{g} \circ g$ , we can therefore write
$$
\begin{array}{l} e _ {\text {i n v}} (\rho [ \tilde {g} ] x) = \sum_ {g ^ {\prime} \in \mathcal {G}} e (\rho [ g ^ {\prime} ] x) \\ = e _ {\text {i n v}} (x). \\ \end{array}
$$
This proves the  $\mathcal{G}$ -invariance of the explanation  $e_{\mathrm{inv}}$ .
The interpretability method  $e_{\mathrm{inv}}$  has to be understood as a way to assign a unified explanation to each class of equivalent signals rather than a patched version of  $e$ . To make this argument more rigorous, we define the equivalence relation  $\sim$  on the set of signals  $\mathcal{X}(\Omega, \mathcal{C})$  as follows: two signals  $x, x' \in \mathcal{X}(\Omega, \mathcal{C})$  are equivalent iff there exists a symmetry  $g \in \mathcal{G}$  relating the two signals  $x' = \rho[g]x$ . This equivalence relation is the one that underpins a  $\mathcal{G}$ -invariant neural network as  $x'$  and  $x$  are assigned the same prediction  $f(x') = f(x)$ . If we denote by  $S_x = \{x' \in \mathcal{X}(\Omega, \mathcal{C}) \mid x' \sim x\}$  the class of signals equivalent to the signal  $x$ , we may write  $e_{\mathrm{inv}}(x) = \frac{1}{|S_x|} \sum_{x' \in S_x} e(x')$ . This reformulation gives a nice interpretation to  $e_{\mathrm{inv}}$ : the explanation  $e_{\mathrm{inv}}(x)$  is simply given by averaging the explanation  $e$  over the class  $S_x$  of signals equivalent to  $x$ . If  $e$  is an example importance method, then  $e_{\mathrm{inv}}$  allows us to identify the examples that are the most related to the equivalence class  $S_x$ . If, on the other hand,  $e$  is a concept classifier, then  $e_{\mathrm{inv}}$  measures the fraction of examples in the equivalence class  $S_x$  where the concept of interest is detected. We believe that using  $e_{\mathrm{inv}}$  with this interpretation in mind should help to avoid unwarranted trust in the resulting explanations.
Our opinion is that explanations  $e$  that are robust by design are preferable over auxiliary explanations  $e_{\mathrm{inv}}$ . In this way, a possible hierarchy between interpretability methods based on our robustness criterion for  $\mathcal{G}$ -invariant models could be as follows:
Method 1 An interpretability method  $e$  that has  $G$ -invariance by design.
Method 2 An auxiliary interpretability method  $e_{\mathrm{inv}}$  obtained from  $e$  with Proposition 2.3.
Method 3 An interpretability method  $e$  that is not  $\mathcal{G}$ -invariant.
In this way, Method 2 should be avoided whenever Method 1 is available. This is the case, for instance, of example-based interpretability methods where loss-based methods are naturally invariant. Hence, in this case, the benefit of patching representation-based methods is limited. However, in the case of concept-based explanations, we note that neither CAVs nor CARs grant invariance. In this case, since Method 1 is unavailable, Method 2 might be the best we can do. In the specific case of concept-based interpretability, we note that Proposition 2.3 implements a sensible fix to the lack of invariance. Indeed, applying Proposition 2.3 is equivalent to making the concept-classifiers invariant by applying a  $\mathcal{G}$ -invariant group aggregation, which is a standard way to implement classifier invariance (examples include GNNs and Deep Sets). In this way, the usefulness of Proposition 2.3 is context-dependent and we believe that a good usage should always be informed by domain knowledge.
E Convergence of the Monte Carlo Estimators
In this appendix, we discuss the Monte Carlo estimators used to approximate the invariance and equivariance metrics defined in Definition 2.1. We first note that our experiments typically aggregate the metrics over a test set  $\mathcal{D}_{\mathrm{test}}$  of examples. Hence, we are interested in the metrics
$$
\overline {{\operatorname {I n v}}} _ {\mathcal {G}} (e) = \mathbb {E} _ {X \sim U (\mathcal {D} _ {\text {t e s t}}), G \sim U (\mathcal {G})} \left[ s _ {\mathcal {E}} [ e (\rho [ G ] X), e (X) ] \right]
$$
$$
\overline {{\operatorname {E q u i v}}} _ {\mathcal {G}} (e) = \mathbb {E} _ {X \sim U (\mathcal {D} _ {\text {t e s t}}), G \sim U (\mathcal {G})} \left[ s _ {\mathcal {E}} \left[ e \left(\rho [ G ] X\right), \rho^ {\prime} [ G ] e (X) \right] \right],
$$
where  $U$  denotes a uniform distribution. Clearly, whenever the order  $|\mathcal{G}|$  of the symmetry group is large, these metrics might become prohibitively expensive to compute. In this setting, we simply build a Monte Carlo estimator for the above metrics by sampling  $N_{\mathrm{samp}}$  symmetries  $G_{1}, \ldots, G_{N_{\mathrm{samp}}}$  with  $N_{\mathrm{samp}} \in \mathbb{N}^{+}$  and  $N_{\mathrm{samp}} \ll |\mathcal{G}|$ . If we have  $N_{\mathrm{test}} = |\mathcal{D}_{\mathrm{test}}|$  test examples, the Monte Carlo estimators can be written as
$$
\widehat {\operatorname {I n v}} _ {\mathcal {G}} (e) = \frac {1}{N _ {\text {t e s t}} N _ {\text {s a m p}}} \sum_ {n = 1} ^ {N _ {\text {t e s t}}} \sum_ {m = 1} ^ {N _ {\text {s a m p}}} s _ {\mathcal {E}} \left[ e \left(\rho \left[ G _ {m} \right] X ^ {n}\right), e \left(X ^ {n}\right) \right]
$$
$$
\widehat {\mathrm {E q u i v}} _ {\mathcal {G}} (e) = \frac {1}{N _ {\mathrm {t e s t}} N _ {\mathrm {s a m p}}} \sum_ {n = 1} ^ {N _ {\mathrm {t e s t}}} \sum_ {m = 1} ^ {N _ {\mathrm {s a m p}}} s _ {\mathcal {E}} \left[ e \left(\rho [ G _ {m} ] X ^ {n}\right), \rho^ {\prime} [ G _ {m} ] e (X ^ {n}) \right].
$$
Those are the estimators that we use in our experiments. Let us first discuss the convergence of these estimators theoretically. Since  $s_{\mathcal{E}}(a,b) \in [-1,1]$  for all  $a,b \in \mathcal{E}$ , Hoeffding's inequality [76] guarantees that for all  $t \in \mathbb{R}^+$ :
$$
\mathbb {P} \left(\left| \widehat {\operatorname {I n v}} _ {\mathcal {G}} (e) - \overline {{\operatorname {I n v}}} _ {\mathcal {G}} (e) \right| \geq t\right) \leq 2 \exp \left(- \frac {N _ {\text {t e s t}} N _ {\text {s a m p}} t ^ {2}}{2}\right)
$$
$$
\mathbb {P} \left(\left| \widehat {\mathrm {E q u i v}} _ {\mathcal {G}} (e) - \overline {{\mathrm {E q u i v}}} _ {\mathcal {G}} (e) \right| \geq t\right) \leq 2 \exp \left(- \frac {N _ {\mathrm {t e s t}} N _ {\mathrm {s a m p}} t ^ {2}}{2}\right).
$$
Let us now plug-in some numbers to see how these inequalities translate in our experiments. In Section 3, we typically use  $N_{\mathrm{test}} = 1,000$  and  $N_{\mathrm{samp}} = 50$ . Hence, the probability of making an error larger than  $t = 2\%$  in our experiments is smaller than  $10^{-4}$ . This guarantees that all the metrics reported in the main paper are precisely evaluated.
We shall now verify this theoretical analysis with the experimental setup described in Section 3. Since we do not resort to any Monte Carlo approximation for the Electrocardiogram dataset, we exclude
it from our analysis. Similarly, robustness scores  $\widehat{\mathrm{Inv}}_{\mathcal{G}}(e)\approx 1$  or  $\widehat{\mathrm{Equiv}}_{\mathcal{G}}(e)\approx 1$  can be excluded as these can only be produced by having  $\mathrm{Inv}[e,G_m]\approx 1$  or  $\mathrm{Equiv}[e,G_m]\approx 1$  for all  $m\in \mathbb{Z}_{N_{\mathrm{samp}}}$  which guarantees that the estimators have already converged. By applying these filters with the help of Figure 3, we restrict our analysis to Gradient Shap for the Mutagenicity dataset and to Gradient Shap, Feature Permutation, SimplEx-Equiv, CAV-Equiv and CAR-Equiv for the ModelNet40 dataset. We plot the Monte Carlo estimators  $\widehat{\mathrm{Inv}}_{\mathcal{G}}(e)$  and  $\widehat{\mathrm{Equiv}}_{\mathcal{G}}(e)$  as a function of  $N_{\mathrm{samp}}$  for various interpretability methods in Figure 7. As we can see, all the Monte Carlo estimators have already converged for  $N_{\mathrm{samp}} = 50$  used in the experiment. This is due to the fact that we use a relatively large test set in each experiment, with  $N_{\mathrm{test}} = 433$  for the Mutagenicity dataset and  $N_{\mathrm{test}} = 1,000$  for the ModelNet40 experiment.
(a) Mutagenicity Dataset
(b) ModelNet40 Dataset
Figure 7: Convergence of the Monte Carlo estimators. Each curve represents the value of the estimator  $\widehat{\operatorname{Inv}}_{\mathcal{G}}(e)$  or  $\widehat{\operatorname{Equiv}}_{\mathcal{G}}(e)$  as a function of  $N_{\mathrm{samp}}$ . In each case, we build a  $95\%$  confidence interval around this estimator.
We finish this appendix by mentioning that all the groups manipulated in this paper are finite groups. It goes without saying that an extension of our analysis to infinite, or even uncountable groups would probably require a more sophisticated sampling technique, such as e.g. importance sampling [77].
In this appendix, we provide all the details for the experiments conducted in Section 3.
Computing Resources. Almost all the empirical evaluations were run on a single machine equipped with a 64-Core AMD Ryzen Threadripper PRO 3995WX CPU and a NVIDIA RTX A4000 GPU. The only exceptions are the CIFAR100 and STL10 experiments, for which we used a Microsoft Azure virtual machine equipped with a single Tesla V100 GPU. All the machines run on Python 3.10 [78] and Pytorch 1.13.1 [79].
Electrocardiograms. The MIT-BIH Electrocardiogram (ECG) dataset [50, 51] consists of univariate time series  $x \in \mathcal{X}(\mathbb{Z}_T,\mathbb{R})$  with  $T = 187$  time steps, each representing a heartbeat cycle. Each time series comes with a binary label indicating whether the heartbeat is normal or not. We train a 1-dimensional convolutional neural network (CNN) to predict this label. This CNN is made invariant under the action of the cyclic translation group  $\mathcal{G} = \mathbb{Z} / T\mathbb{Z}$  on the time series by using only circular padding and global pooling.
Mutagenicity. The Mutagenicity dataset [53-55] consists of graphs  $x \in \mathcal{X}([V_x, E_x], \mathbb{Z}_{N_{\mathrm{sp}}})$  representing organic molecules. In a graph, each node  $u \in V_x$  is assigned an atom indexed by  $x(u) \in \mathbb{Z}_{N_{\mathrm{sp}}}$ , where  $N_{\mathrm{sp}} = 14$  is the number of atom species. We ignore the attributes for the edges  $E_x \subseteq V_x^2$ . Each graph comes with a binary label indicating whether the molecule is a mutagen or not. We train a graph neural network (GNN) to predict this label. This GNN is made invariant under the action of the permutation group  $\mathcal{G} = S_{V_x}$  on the node ordering by using global pooling.
ModelNet40. The ModelNet40 [57] dataset consists of CAD representations of 3D objects. We use the same process as [58, 59] to convert each CAD representation into a cloud  $x \in \mathcal{X}(\mathbb{Z}_{N_{\mathrm{pt}}}, \mathbb{R}^3)$  of
$N_{\mathrm{pt}} = 1,000$  points embedded in  $\mathbb{R}^3$ . Each cloud of point comes with a label  $y \in \mathbb{Z}_{40}$  indicating the class of object represented by the cloud of points among the 40 different classes of objects present in the dataset. We train a Deep Set [58] model to predict this label. Thanks to its architecture, this model is naturally invariant under the action of the permutation group  $\mathcal{G} = S_{N_{\mathrm{pt}}}$  on the points in the cloud. Each model is trained on a training set  $\mathcal{D}_{\mathrm{train}}$ .
IMDb. The IMDb dataset [60] This dataset contains 50k text movie reviews. Each review comes with a binary label  $y \in \{0,1\}$ . We represent each review as a sequence of tokens  $x \in \mathcal{X}(\mathbb{Z}_T,\mathbb{R}^V)$ , where we cap the sequence length to  $T = 128$  and set the vocabulary size to  $V = 1,000$ . We perform a train-validation-test split of this dataset randomly (90%-5%-5%) and fit a 2-layers bag-of-word MLP on the training dataset for 20 epochs with Adam and a cosine annealing learning rate. The best model (according to validation accuracy) achieves a reasonable 86% accuracy on the test set  $D_{\mathrm{test}}$ . Let us justify the bag-of-word classifier invariance with respect to the token permutation group  $S_T$ . A bag-of-words classifier  $f$  receives a sequence of tokens  $x \in \mathcal{X}(\mathbb{Z}_T,\mathbb{R}^V)$  and outputs class logits  $f(x) \in \mathbb{R}^2$ . By definition, the bag-of-word classifier can be written as a function  $f(x) = g\left(\sum_{t=1}^{T}\text{onehot}(x_t)\right)$ . In this form, the invariance of the classifier with respect to tokens permutation is manifest. Let  $\pi \in S_T$  be a permutation of the token indices. Applying this permutation to the token sequence does not change the classifier's output:  $f(x_{\pi}) = g\left(\sum_{t=1}^{T}\text{onehot}(x_{\pi(t)})\right) = g\left(\sum_{t=1}^{T}\text{onehot}(x_t)\right) = f(x)$ . We conclude that bag-of-words classifiers are  $S_T$ -invariant.
FashionMNIST. The FashionMNIST dataset [61] consists of  $28 \times 28$  grayscale images  $x \in \mathcal{X}(\mathbb{Z}_W \times \mathbb{Z}_H, \mathbb{R})$  with  $W = H = 28$ , each representing a fashion object (e.g. dress) from 10 categories. Each image comes with a label  $y \in \mathbb{Z}_{10}$  indicating object's category. We train a 2-dimensional CNN to predict this label. We pad each image by adding 10 black pixels in each direction, so that the image information content is conserved by applying translations from the group  $\mathcal{G} = (\mathbb{Z}/10\mathbb{Z})^2$ . The CNN is made invariant under the action of this group by using global pooling.
CIFAR100. The CIFAR100 dataset [63] consists of  $32 \times 32$  RGB images  $x \in \mathcal{X}(\mathbb{Z}_W \times \mathbb{Z}_H, \mathbb{R}^3)$  with  $W = H = 32$ , each representing an object (e.g. truck) from 100 categories. Each image comes with a label  $y \in \mathbb{Z}_{100}$  indicating object's category. We train the  $\mathbb{D}_8 - \mathbb{D}_4 - \mathbb{D}_1$  28/10 WideResNet from [64] to predict this label. The design of this model imposes a strong bias toward  $\mathbb{D}_8$  invariance. To avoid artifacts created by rotating an image by  $45^\circ$ , we restrict all our evaluations to the subgroup  $\mathbb{D}_4 \subset \mathbb{D}_8$ .
STL10. The STL10 dataset [65] consists of  $96 \times 96$  RGB images  $x \in \mathcal{X}(\mathbb{Z}_W \times \mathbb{Z}_H, \mathbb{R}^3)$  with  $W = H = 96$ , each representing an object (e.g. truck) from 10 categories. Each image comes with a label  $y \in \mathbb{Z}_{10}$  indicating object's category. We train the  $\mathbb{D}_8 - \mathbb{D}_4 - \mathbb{D}_1$  16/8 WideResNet from [64] to predict this label. The design of this model imposes a strong bias toward  $\mathbb{D}_8$  invariance. To avoid artifacts created by rotating an image by  $45^\circ$ , we restrict all our evaluations to the subgroup  $\mathbb{D}_4 \subset \mathbb{D}_8$ .
Data Split. All the datasets are endowed with a natural train-test split. In the ECG dataset, the different types of abnormal heartbeats are imbalanced (e.g. fusion beats only amount for  $.7\%$  of the training set). We use SMOTE [80] to augment the proportion of each type of abnormal heartbeat in the training set.
Symmetry Groups. Each dataset in the experiment is associated to a specific group of symmetry and group representation. We detail those in Table 4. We note that all these groups and group representations are easily implemented as tensor operations on the dimensions of the tensor corresponding to the domain  $\Omega$ .
Models. We provide a detailed architecture for each model in Tables 5 to 11. All the models are implemented with Pytorch [79] and PyG [81]. All the models except the WideResNets are trained using Adam [82]. The CNNs are trained to minimize the cross entropy loss for 200 epochs with early stopping and patience 10 with a learning rate of  $10^{-3}$  and a weight decay of  $10^{-5}$ . The GNN is trained to minimize the negative log likelihood for 200 epochs with early stopping and patience 20 with a learning rate of  $10^{-3}$  and a weight decay of  $10^{-5}$ . The Deep Set is trained to minimize the cross entropy loss for 1,000 epochs with early stopping and patience 20 with a learning rate of  $10^{-3}$ , a weight decay of  $10^{-7}$  and a multi step learning rate scheduler with  $\gamma = 0.1$ . The WideResNets are trained with Stochastic Gradient Descent to minimize the negative cross entropy loss for 200 epochs (1,000 for STL10) with an initial learning rate of 0.1, a weight decay of  $5 \cdot 10^{-5}$ , momentum 0.9 and an exponential learning rate scheduler with  $\gamma = 0.2$  applied each 60 epochs (300 for STL10). The test set is used as a validation set in some cases, as the model generalization is never used as
Table 4: Different groups and representations appearing in Section 3. Since Mutagenicity has heterogeneous graphs,  $V_{x} \subset \mathbb{N}^{+}$  denotes the set of vertices specific to the graph data  $x$ . We use the notation  $a(u,v)$  to denote the elements of the edges data matrix.
Dataset	Modality	Input Signal	Symmetry	Representation
Electrocardiograms	Time Series	[x(t)]t∈ZT	g∈Z/TZ	ρ[g]x(t)=x(t-g mod T)
Mutagenicity	Graphs	[x(u),a(u,v)]u,v∈Vx	g∈SVx	ρ[g]x(u)=x(g-1(u))ρ[g]a(u,v)=a(g-1(u),g-1(v))
ModelNet40	Tabular Set	[x(n)]n∈ZNpts	g∈SNpt	ρ[g]x(n)=x(g-1(n))
FashionMNIST	Image	[x(u,v)](u,v)∈ZW×ZH	(g1, g2)∈(Z/10Z)2	ρ[g]x(t)=x(u-g1 mod W, v-g2 mod H)
CIFAR100	Image	[x(u,v)](u,v)∈ZW×ZH	g∈D8	ρ[g]x(t)=x(g-1(u,v))
STL10	Image	[x(u,v)](u,v)∈ZW×ZH	g∈D8	ρ[g]x(t)=x(g-1(u,v))
an evaluation criterion. All the parameters hyperparameters that are not specified are chosen to the Pytorch and PyG default value. Note that for each architecture, we have highlighted the layer that we call Inv and Equiv in Section 3. The representation-based interpretability methods rely on the output of these layers.
Table 5: ECG All-CNN Architecture.
Layer Type	Parameters	Activation	Notes
Conv1d	in_channels=1, out_channels=16, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU
Conv1d	in_channels=16, out_channels=64, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU
Conv1d	in_channels=64, out_channels=128, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU	Equiv layer
Pooling	Global Average Pooling
Linear	in_channels=128, out_channels=32	LeakyReLU	Inv layer
Linear	in_channels=32, out_channels=32	LeakyReLU
Linear	in_channels=32, out_channels=2
Table 6: ECG Augmented-CNN and Standard-CNN Architecture.
Layer Type	Parameters	Activation	Notes
Conv1d	in_channels=1, out_channels=16, kernel_size=3, stride=1, padding=1, padding_mode='circular'
MaxPool1d	kernel_size=2
Conv1d	in_channels=16, out_channels=64, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU
MaxPool1d	kernel_size=2
Conv1d	in_channels=64, out_channels=128, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU	Equiv layer
MaxPool1d	kernel_size=2
Flatten	Collapse all the dimensions together except the batch dimension
Linear	in_channels=2944, out_channels=32	LeakyReLU	Inv layer
Linear	in_channels=32, out_channels=32	LeakyReLU
Linear	in_channels=32, out_channels=2
Table 7: Mutagenicity GNN. The GraphConv layers correspond to the graph operator introduced in [56]
Layer Type	Parameters	Activation	Notes
GraphConv	in_channels=14, out_channels=32	ReLU
GraphConv	in_channels=32, out_channels=32	ReLU
GraphConv	in_channels=32, out_channels=32	ReLU
GraphConv	in_channels=32, out_channels=32	ReLU
Pooling	Global additive pooling on the graph
Linear	in_channels=32, out_channels=32	ReLU	Inv layer
Dropout	p=0.5
Linear	in_channels=32, out_channels=2	Log Softmax
Table 8: ModelNet40 Deep Set adapted from [58]. The Sub. Max layers correspond to the operation  $x_{b,s,i} \mapsto x_{b,s,i} - \max_{s' \in \mathbb{Z}_{N_{\mathrm{pt}}}} x_{b,s',i}$  for each batch index  $b \in \mathbb{N}$ , set index  $s \in \mathbb{Z}_{N_{\mathrm{pt}}}$  and feature index  $i \in \mathbb{Z}_3$ .
Layer Type	Parameters	Activation	Notes
Sub. Max
Linear	in_channels=3, out_channels=256	Tanh
Sub. Max
Linear	in_channels=256, out_channels=256	Tanh	Equiv layer
Sub. Max
Linear	in_channels=256, out_channels=256	Tanh
Max Pooling Dropout	Takes the maximum along the set dimension p=0.5
Linear	in_channels=256, out_channels=256	Tanh	Inv Layer
Dropout	p=0.5
Linear	in_channels=256, out_channels=40	Tanh
Linear	in_channels=256, out_channels=40
Table 9: FashionMNIST All-CNN Architecture.
Layer Type	Parameters	Activation	Notes
Conv2d	in_channels=1, out_channels=16, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU
Conv2d	in_channels=16, out_channels=64, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU
Conv2d	in_channels=64, out_channels=128, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU	Equiv layer
Pooling	Global Average Pooling
Linear	in_channels=128, out_channels=32	LeakyReLU	Inv layer
Linear	in_channels=32, out_channels=32	LeakyReLU
Linear	in_channels=32, out_channels=10
Table 10: FashionMNIST Augmented-CNN and Standard-CNN Architecture.
Layer Type	Parameters	Activation	Notes
Conv2d	in_channels=1, out_channels=16, kernel_size=3, stride=1, padding=1, padding_mode='circular'
MaxPool2d	kernel_size=2
Conv2d	in_channels=16, out_channels=64, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU
MaxPool2d	kernel_size=2
Conv2d	in_channels=64, out_channels=128, kernel_size=3, stride=1, padding=1, padding_mode='circular'	ReLU	Equiv layer
MaxPool2d	kernel_size=2
Flatten	Collapse all the dimensions together except the batch dimension
Linear	in_channels=294912, out_channels=32	LeakyReLU	Inv layer
Linear	in_channels=32, out_channels=32	LeakyReLU
Linear	in_channels=32, out_channels=2
Table 11: WideResNet from [64]
Layer Type	Parameters	Activation	Notes
Conv	Equiv Layer
Residual Layer
Residual Layer
Residual Layer	in_channels=32, out_channels=32
BatchNorm	ReLU	Inv Layer
Pooling	Global Average Pooling
Flatten
Linear	out_channels=100 or 10
Model Invariance. We note that Figure 5 includes model invariance on the  $x$ -axis. The metric we use to evaluate this invariance is simply adapted from Definition 2.1:  $\mathrm{Inv}_{\mathcal{G}}(f,x)\equiv s_{\mathcal{Y}}[f(\rho [g]x),f(x)]$  where  $s_{\mathcal{Y}}:\mathcal{V}^2\to \mathbb{R}$  is defined as  $s_{\mathcal{Y}}(y_1,y_2) = y_1^\intercal y_2 / \| y_1\| \cdot \| y_2\|$  for all  $y_{1},y_{2}\in \mathcal{V}$ . We note that this cos-similarity similarity metric is sensible in a classification setting since  $s_{\mathcal{Y}}(y_1,y_2) = 1$  implies  $y_{1} = \alpha \cdot y_{2}$  for some  $\alpha \in \mathbb{R}^{+}$ . Since  $\| y_1\| _1 = \| y_2\| _1 = 1$ , this is equivalent to  $y_{1} = y_{2}$ .