SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Interestingly, both baselines either sacrifice robustness over accuracy (or vice versa): While additive noise certificates obtain higher clean accuracy at worse certified accuracy, ablation certificates obtain strong certified accuracy at lower clean accuracy. In contrast, hierarchical smoothing allows to explore the entire space and significantly expands the Pareto-front of the robustness-accuracy trade-off under our threat model. This demonstrates that hierarchical smoothing is a more flexible framework and represents a useful and novel tool for analyzing the robustness of machine learning models in general.
Entity-selection probability. With hierarchical smoothing we introduce the entity-selection probability  $p$  that allows to better control the robustness-accuracy trade-off under our threat model. Specifically, for larger  $p$  we add more noise and increase robustness but also decrease accuracy. As usual in randomized smoothing, the optimal  $p$  needs to be fine-tuned against a task, dataset and radius  $r$ . In our settings we found dominating points e.g. for  $p = 0.81$  (Cora-ML) and  $p = 0.85$  (CIFAR10).
Our hierarchical smoothing approach overcomes limitations of randomized smoothing certificates: Instead of having to derive Lemma 1 from scratch for each smoothing distribution, we can easily integrate the whole suite of existing and future randomized smoothing certificates. Our framework is highly flexible and allows to certify robustness against a wide range of adversarial perturbations.
Hierarchical smoothing also comes with limitations: First, we inherit the limitations of ablation certificates in which the certifiable radius  $r$  is bounded by the smoothing parameters independently of the classifier (Scholten et al., 2022). The underlying reason is that we do not evaluate the smoothed classifier on the entire space  $\mathcal{A}$  since we cannot reach certain matrices as exploited in Section 5. Second, the classifier defined on the original matrix space is invariant with respect to the new dimension introduced by our smoothing distribution and not incorporating such invariances into the Neyman-Pearson-Lemma yields strictly looser guarantees (Schuchardt and Gunnemann, 2022).
Beyond that, our certificates are highly efficient: The only additional cost for computing hierarchical smoothing certificates is to evaluate the algebraic term  $\Delta = 1 - p^r$ , which takes constant time (see also Appendix H). Since we train our classifiers on the extended matrices, we also allow classifiers to distinguish whether entities have been smoothed by the lower-level distribution (see Appendix A).
Future work. Future work can build upon our work towards even stronger certificates in theory and practice, for example by deriving certificates that are tight under the proposed threat model and efficient to compute at the same time. Future work can further (1) implement certificates for other  $\ell_p$ -norms (Levine and Feizi, 2021; Voracek and Hein, 2023) and domains, (2) improve and assess adversarial robustness, and (3) introduce novel architectures and training techniques.
Broader impact. Our hierarchical smoothing certificates are highly flexible and provide provable guarantees for arbitrary  $(\ell_p$ -norm) threat models, provided that certificates for the corresponding lower-level smoothing distribution exist. Therefore our contributions impact the certifiable robustness of a large variety of models in discrete and continuous domains and therefore the field of reliable machine learning in general: Our robustness certificates provide novel ways of assessing, understanding and improving the adversarial robustness of machine learning models.
With hierarchical smoothing we propose the first hierarchical (mixture) smoothing distribution for complex data where adversaries can perturb only a subset of all entities (e.g. pixels in an image, or nodes in a graph). Our main idea is to add noise in a more targeted manner: We first select a subset of all entities and then we add noise to them. By certifying robustness under this hierarchical smoothing distribution we achieve stronger robustness guarantees while still maintaining high accuracy. Overall, our certificates for hierarchical smoothing represent novel, flexible tools for certifying the adversarial robustness of machine learning models towards more reliable machine learning.
This work has been funded by the Munich Center for Machine Learning, by the DAAD program Konrad Zuse Schools of Excellence in Artificial Intelligence (sponsored by the Federal Ministry of Education and Research), and by the German Research Foundation, grant GU 1409/4-1. The authors of this work take full responsibility for its content.
Václav Vorácek and Matthias Hein. Improving 11-certified robustness via randomized smoothing by leveraging box constraints. In ICML, volume 202 of Proceedings of Machine Learning Research, pages 35198-35222. PMLR, 2023.
Binghui Wang, Jinyuan Jia, Xiaoyu Cao, and Neil Zhenqiang Gong. Certified robustness of graph neural networks against adversarial structural perturbation. In KDD, pages 1645-1653. ACM, 2021.
Yihan Wu, Aleksandar Bojchevski, Aleksei Kuvshinov, and Stephan Gunnemann. Completing the picture: Randomized smoothing suffers from the curse of dimensionality for a large family of distributions. In AISTATS, volume 130 of Proceedings of Machine Learning Research, pages 3763-3771. PMLR, 2021.
Cihang Xie, Mingxing Tan, Boqing Gong, Jiang Wang, Alan L. Yuille, and Quoc V. Le. Adversarial examples improve image recognition. In CVPR, pages 816-825. Computer Vision Foundation / IEEE, 2020.
Greg Yang, Tony Duan, J. Edward Hu, Hadi Salman, Ilya P. Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. In ICML, volume 119 of Proceedings of Machine Learning Research, pages 10693-10705. PMLR, 2020a.
Yao-Yuan Yang, Cyrus Rashtchian, Hongyang Zhang, Ruslan Salakhutdinov, and Kamalika Chaudhuri. A closer look at accuracy vs. robustness. In Advances in Neural Information Processing Systems, NeurIPS, 2020b.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In ICML, volume 97 of Proceedings of Machine Learning Research, pages 7472-7482. PMLR, 2019.
Daniel Zügner and Stephan Gunnemann. Certifiable robustness and robust training for graph convolutional networks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019.
Daniel Zügner and Stephan Gunnemann. Certifiable robustness of graph convolutional networks under structure perturbations. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, pages 1656-1665, 2020.
A Additional experiments and results
In the following we provide additional results for our experiments with hierarchical randomized smoothing for the tasks of node and image classification.
Figure 5: Discrete hierarchical smoothing significantly extends the Pareto-front w.r.t. robustness-accuracy (smoothed GAT on Cora-ML). Left:  $r = 1, r_a = 0, r_d = 20$ . Right:  $r = 1, r_a = 0, r_d = 40$ .
Figure 6: Discrete hierarchical smoothing significantly extends the Pareto-front w.r.t. robustness-accuracy (smoothed GAT on Cora-ML). Left:  $r = 1, r_a = 5, r_d = 0$ . Right:  $r = 1, r_a = 10, r_d = 0$ .
Figure 7: Discrete hierarchical smoothing significantly extends the Pareto-front w.r.t. robustness-accuracy (smoothed GAT on Cora-ML). Left:  $r = 1, r_a = 5, r_d = 15$ . Right:  $r = 2, r_a = 0, r_d = 40$ .
Figure 8: Continuous hierarchical smoothing significantly extends the Pareto-front w.r.t. robustness-accuracy (smoothed ResNet50 on CIFAR10). Left:  $r = 2, \epsilon = 0.4$ . Right:  $r = 3, \epsilon = 0.3$ .
Figure 9: Continuous hierarchical smoothing significantly extends the Pareto-front w.r.t. robustness-accuracy (smoothed ResNet50 on CIFAR10). Left:  $r = 3, \epsilon = 0.35$ . Right:  $r = 4, \epsilon = 0.4$ .
Figure 10: Skip-connections for hierarchical and sparse smoothing significantly extend the Paretofront (smoothed GAT on Cora-ML). Left:  $r = 2, r_a = 0, r_d = 70$ . Right:  $r = 3, r_a = 0, r_d = 70$ .
Figure 11: Hierarchical smoothing with and without appended column (smoothed GAT on Cora-ML). Left:  $r = 1, r_a = 0, r_d = 40$ . Right:  $r = 3, r_a = 0, r_d = 70$ .
Figure 12: Upper row: Smoothed GNNs on Cora-ML ( $p = 0.8$ ,  $p_a = 0.006$ ,  $p_d = 0.88$ ) for  $r = 1, 2, 3$  from left to right. Lower row: Smoothed ResNet50 on CIFAR10 for different radii  $r$  (Left:  $k = 150$ ,  $\sigma = 0.25$ . Middle:  $k = 150$ ,  $\sigma = 0.35$ . Right:  $k = 160$ ,  $\sigma = 0.4$ .)
Figure 13: Smoothed GAT models on CoraML ( $r = 1, r_a = 0$ ). Different number of Monte-Carlo samples and the effect on the certifiable robustness. Left:  $\alpha = 0.01$ . Middle:  $n_1 = 100$ . Right:  $n_1 = 10,000$ . Different clean accuracies at  $r_d = 0$  are due to abstained predictions.
For node classification we experimentally observe that smoothed GAT models are more robust on average (Figure 12 upper row). We therefore decide to show more results for smoothed GAT models in the following. Recall that  $r$  is the number of adversarial nodes,  $r_d$  is the number of adversarial deletions  $(1 \to 0)$ , and  $r_a$  the number of adversarial insertions  $(0 \to 1)$ . In Figure 5 we show results for varying  $r_d$  with fixed  $r = 1$  and  $r_a = 0$ . In Figure 6 we further vary  $r_a$  with fixed  $r = 1$  and  $r_d = 0$ . In Figure 7 we show results for  $r = 1$ ,  $r_d > 0$  and  $r_a > 0$  and separately results for  $r = 2$ . For image classification, recall that  $r$  is the number of pixels controlled by the adversary and  $\epsilon$  the perturbation strength in  $\ell_2$ -distance across channels. In Figure 8 and Figure 9 we provide additional results for different radii  $r$  and  $\epsilon$ .
Clearly, hierarchical randomized smoothing is significantly expanding the Pareto-front w.r.t. the robustness-accuracy trade-off in all of these settings. Since our certificates generalize ablation and additive noise certificates into a new common framework, our method performs either better or on-par with the existing methods under our threat model. Note that in special threat models where e.g. adversaries have access to all nodes ( $r = N$ ), our certificates correspond to standard randomized smoothing and consequently perform on-par with existing methods.
In Figure 12 (upper row) we compare different GNN architectures for the task of node classification and generally observe that smoothed GAT models are more robust on average. In Figure 12 (lower row) we provide further results for different smoothing parameters when certifying the robustness of smoothed ResNet50 models on CIFAR10. Note the different effects on the certifiable robustness at different radii  $r$  when increasing  $\sigma$  and  $k$  (increasing  $k$  corresponds to decreasing  $p$ ).
In Figure 10 we study the setting where adversaries do not have access to target nodes in the graph but only to nodes in the first- and second-hop neighborhoods (this setting has been previously studied by Scholten et al. (2022)). Such threat models allow us to introduce skip-connections: We can forward the (unsmoothed) features of target nodes separately through the GNN (without graph structure) and add the final representations on the representations obtained with smoothing. In Figure 10 we experimentally observe that such skip-connections can significantly expand the Pareto-front w.r.t. robustness and accuracy of sparse and hierarchical smoothing.
In Figure 11 we perform experiments with and without the additional additional column for smoothed GAT models on CoraML. Notably, training the models on the extended matrices and using the additional column at inference can result in better classifiers: As we experimentally observe for graph-structured data, using the additional column significantly extends the Pareto-front w.r.t. robustness and accuracy under specific threat models.
In Figure 13 we study the effect of different numbers of Monte-Carlo samples on the certificate strength. We observe that for our setting using  $\alpha = 0.01$  and  $n_1 = 10,000$  is sufficient to compare our method to the baselines. Note that in practice one would have to fix  $\alpha$  and  $n_0, n_1$  prior to computing certificates to ensure their statistical validity.
Error bars. For the node classification task we run every experiment 5 times with different dataset splits and model initializations and report averaged results. The average standard deviation is  $(3\%, 3\%, 4\%, 4\%)$  in clean accuracy and  $(3\%, 3\%, 2\%, 3\%)$  in certified accuracy (across all node classification experiments, hierarchical smoothing only, sparse smoothing only, and ablation smoothing only, respectively).
B Full experimental setup (Section 7)
We provide detailed information on the experimental setup as described in Section 7 to ensure reproducibility of our results. Note that we also upload our implementation. $^4$
B.1 Experimental setup for the task of node classification
Datasets and models. We implement smoothed classifiers for four architectures with two message-passing layers: Graph convolutional networks (GCN) (Kipf and Welling, 2017), graph attention networks (GAT and GATv2) (Velickovic et al., 2018; Brody et al., 2022), and APPNP (Klicpera et al., 2019). We train models on the citation dataset Cora-ML (Bojchevski and Gunnemann, 2018; McCallum et al., 2000) consisting of 2,810 nodes with 2,879 binary features, 7,981 edges and 7 classes. We follow the standard procedure in graph machine learning (Shchur et al., 2018) and preprocess graphs into undirected graphs containing only their largest connected component.
Model details. We implement all GNN models for two message-passing layers. We use 64 hidden channels for GCN (Kipf and Welling, 2017) and APPNP (Klicpera et al., 2019), and 8 attention heads for 8 hidden channels for GAT and GATv2 (Velickovic et al., 2018; Brody et al., 2022). For APPNP we further set the hyperparameter k_hops to 10 and the teleport probability to 0.15.
Node classification task. For GNNs we follow the setup in (Scholten et al., 2022). We evaluate our certificates for the task of node classification in semi-supervised inductive learning settings: We label 20 randomly drawn nodes per class for training and validation, and  $10\%$  of the nodes for testing. We use the labelled training nodes and all remaining unlabeled nodes as training graph, and insert the validation and test nodes into the graph at validation and test time, respectively. We train our models on training nodes, tune them on validation nodes and compute certificates for all test nodes. Note that transductive settings come with shortcomings when evaluating robustness certificates (Scholten et al., 2022), or in adversarial robustness on graph-structured data in general (Gosch et al., 2023a).
Training details. We train models full-batch using Adam (learning rate  $= 0.001$ ,  $\beta_{1} = 0.9$ ,  $\beta_{2} = 0.999$ ,  $\epsilon = e - 08$ , weight decay  $= 5e - 04$ ) for a maximum of 1,000 epochs with cross-entropy loss. Note that we implement early stopping after 50 epochs. We also use a dropout of 0.5 on the hidden node representations after the first graph convolution for GCN and GAT, and additionally a dropout of 0.5 on the attention coefficients for GAT and GATv2.
Training-time smoothing parameters. During training we sample one smoothed feature matrix (i.e. a matrix with (partially) added noise) in each epoch and then we normally proceed training with the noised feature matrix. Unless stated differently we also train our models on the higher-dimensional matrices, i.e. we append the additional column to the matrices. Note that we use the same smoothing parameters during training as for certification.
Experimental evaluation. We compare hierarchical smoothing to the additive noise baseline by Bojchevski et al. (2020) and the ablation baseline Scholten et al. (2022) as follows: We run 1,000 experiments for each method by (1) randomly drawing specific smoothing parameters  $(p$  and  $p_{+}, p_{-}$ , depending on the method), (2) training 5 smoothed classifiers with different seeds for the datasplit and model initialization, (3) computing robustness certificates under the corresponding smoothing distribution, and (4) averaging resulting clean and certified accuracies.
Exploring the Pareto-front. In our exhaustive experiments we randomly explore the entire space of possible parameter combinations. The reason for this is to demonstrate Pareto-optimality, i.e. to find all ranges of smoothing parameters for which we can offer both better robustness and accuracy. Note that in practical settings one would have to conduct significantly less experiments to find suitable parameters, and the task of efficiently finding the optimal parameters is a research direction orthogonal to deriving robustness certificates.
Smoothing parameters for node classification. We randomly sample from the following space of possible smoothing parameters (we draw from a uniform distribution over these intervals):
- Discrete hierarchical smoothing:  $p \in  \left\lbrack  {{0.51},{0.993}}\right\rbrack  ,{p}_{ + } \in  \left\lbrack  {0,{0.05}}\right\rbrack  ,{p}_{ - } \in  \left\lbrack  {{0.5},1}\right\rbrack$  ,
- Sparse smoothing (additive noise baseline):  $p_{+} \in [0, 0.05]$ ,  $p_{-} \in [0.5, 1]$
- Interception smoothing (ablation smoothing baseline):  $p \in [0.51, 0.993]$
4Project page: https://www.cs.cit.tum.de/daml/hierarchical-smoothing
Note that the search space of hierarchical smoothing is the cross product of the search spaces of the two baselines (sparse smoothing (Bojchevski et al., 2020) and interception smoothing (Scholten et al., 2022)). Notably, we still find that hierarchical smoothing is superior despite running 1,000 experiments equally for all three methods (see Section 7). Note that we run 1,000 experiments equally for all methods to establish an equal chance for random outliers in accuracy. Also note that for clarity of the plots we only include points with certified accuracies of larger than  $0\%$ .
B.2 Experimental setup for the task of image classification
Dataset and model architecture. For the task of image classification we follow the experimental setup in (Levine and Feizi, 2020b) and train smoothed ResNet50 (He et al., 2016) on CIFAR10 (Krizhevsky et al., 2009). CIFAR10 consists of 50,000 training images and 10,000 test images with 10 classes (6,000 images per class). The colour images are of size  $32 \times 32$  and have 3 channels. Note that for runtime reasons we only certify a subset of the entire test set: For all experiments we report clean and certified accuracy for the same subset consisting of 1,000 randomly sampled test images.
Training details. We train the ResNet50 model with stochastic gradient descent (learning rate 0.01, momentum 0.9, weight decay 5e-4) for 400 epochs using a batch-size of 128. We also deploy a cosine learning rate scheduler (Loshchilov and Hutter, 2017). At inference we use a batch size of 300. We append the additional indicator channel (see Figure 3) during training and certification. We train the smoothed classifiers with the same noise level as during certification.
Image preprocessing and smoothing. We augment the training set with random horizontal flips and random crops (with a padding of 4). We normalize all images using the channel-wise dataset mean [0.4914, 0.4822, 0.4465] and standard deviation [0.2023, 0.1994, 0.2010]. For the ablation smoothing baseline we follow the implementation of Levine and Feizi (2020b) and first normalize the images before appending three more channels to the images. Specifically, for each channel  $x$  we append the channel  $1 - x$  (resulting in 6 channels in total). Finally, we set all channels of ablated pixels to 0. We train and certify the extended images. See Levine and Feizi (2020b) for a detailed setup of their method. For hierarchical smoothing and the Gaussian smoothing baseline (Cohen et al., 2019) we first add the Gaussian noise and then normalize the images. Note that for hierarchical smoothing we extend the images with the additional indicator channel (Figure 3), resulting in 4 channels in total.
Smoothing parameters for image classification. Note that the ablation baseline (Levine and Feizi, 2020b) draws  $k$  pixels to ablate from a uniform distribution  $\mathcal{U}(k,N)$  over all possible subsets with  $k$  pixels of an image with  $N$  total pixels. This is in contrast to our approach, which selects pixels to add noise to with a probability of  $p$ . For the comparison we choose the pixel selection probability  $p = 1 - \frac{k}{N}$  for every  $k$ , where  $N$  is the number of pixels in an image (i.e. we select  $k$  pixels in expectation). This way, increasing  $k$  corresponds to decreasing  $p$  and vice versa. We run experiments for every 10th  $k$  from 0 to 500. Note that for  $k$  larger than 512 we cannot obtain certificates with either method since then  $\Delta > 0.5$ . For Gaussian smoothing we run experiments for every 100th  $\sigma$  in the interval [0, 1], and for hierarchical smoothing for every 20th  $\sigma$  in [0, 1]. Overall, we run 50 experiments for the ablation baseline (Levine and Feizi, 2020b), 100 experiments for the Gaussian noise baseline (Cohen et al., 2019), and 1,000 experiments for hierarchical smoothing.
B.3 Further experimental details
Certification parameters. All presented plots for graphs show results for the tighter multi-class certificates, for images we compute the binary-class certificates. Our certificates are probabilistic (Cohen et al., 2019), and we use Monte-Carlo samples to estimate the smoothed classifiers with Clopper-Pearson confidence intervals for  $\alpha = 0.01$  (thus our certificates hold with high probability of  $99\%$ ). We also apply Bonferroni correction to ensure that the bounds hold simultaneously with confidence level  $1 - \alpha$ . We follow the procedure of Cohen et al. (2019) and, if not stated differently, use  $n_0 = 1,000$  Monte-Carlo samples for estimating the majority class at test time and  $n_1 = 10,000$  samples for the certification at test time.
Reproducibility. To ensure reproducibility we further use random seeds for all random processes including for model training, for drawing smoothing parameters and for drawing Monte-Carlo samples. We publish the source code including reproducibility instructions and all random seeds.
Computational resources. All experiments were performed on a Xeon E5-2630 v4 CPU with a NVIDIA GTX 1080TI GPU. In the following we report experiment runtimes (note that for node classification we compute certificates for 5 different smoothed models in each experiment): Regarding node classification experiments, the average runtime of hierarchical smoothing for the 1,000 experiments is 1.6 hours. For the additive noise baseline 1.5 hours, and for the ablation baseline 0.92 hours. For image classification we only train a single classifier. The overall training and certification process takes (on average) 9.9 hours for hierarchical smoothing, 8.6 hours for Gaussian smoothing, and 13.3 hours for ablation smoothing.
Third-party assets. For the sparse smoothing baseline we use the implementation of Bojchevski et al. (2020). For the ablation smoothing baseline for GNNs we use the implementation of Scholten et al. (2022). We implement all GNNs using PyTorch Geometric (Fey and Lenssen, 2019). The graph datasets are publicly available and can be downloaded also e.g. using PyTorch Geometric. The CIFAR10 dataset is also publicly available, for example via the torchvision library.
<sup>5</sup>https://github.com/abojchevski/sparse_smoothing
<sup>6</sup>https://github.com/yascho/interception_smoothing
$^{7}$ https://pytorch-geometric.readthedocs.io
<sup>8</sup>https://pytorch.org/vision/stable/index.html
C Robustness certificates for hierarchical smoothing (Proofs of Section 5)
In the following we show the statements of Section 5 about hierarchical smoothing certificates and correctness of the following certification procedure: