SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Broader impact. Deploying deep learning based systems into the real-world, especially when they are of security-concerned [12, 72], poses risks for both companies and customers, and we researchers are responsible to make this technology more reliable through research towards AI safety [2, 29]. Adversarial robustness, that we focus on in this work, is one of the central parts of this direction, but one should also recognize that adversarial robustness is still a bare minimum requirement for reliable deep learning. The future research should also explore more diverse notions of AI Safety to establish a realistic sense of security for practitioners, e.g., monitoring and alignment research, to name a few.
This work was partly supported by Center for Applied Research in Artificial Intelligence (CARAI) grant funded by Defense Acquisition Program Administration (DAPA) and Agency for Defense Development (ADD) (UD230017TD), and by Institute of Information & communications Technology Planning & Evaluation (IITP) grant funded by the Korea government (MSIT) (No.2019-0-00075, Artificial Intelligence Graduate School Program (KAIST)). We are grateful to the Center for AI Safety (CAIS) for generously providing compute resources that supported a significant portion of the experiments conducted in this work. We thank Kyuyoung Kim and Sihyun Yu for the proofreading of our manuscript, and Kyungmin Lee for the initial discussions. We also thank the anonymous reviewers for their valuable comments to improve our manuscript.
In the context of aggregating multiple smoothed classifiers, several works have previously explored on ensembling smoothed classifiers of the same noise scale [46, 32, 71], in attempt to boost their certified robustness. Our proposed multi-scale framework for randomized smoothing considers a different setup of aggregating smoothed classifiers of different noise scales, with a novel motivation of addressing the current accuracy-robustness trade-off in randomized smoothing. More in this respect, Mueller et al. [51] have considered a selective inference scheme between a "certification" network (for robustness) and a "core" network (for accuracy), and Horváth et al. [33] have adapted the framework into randomized smoothing. Our approach explores an orthogonal direction, and can be viewed as directly improving the "certification" network here: in this way, we could offer improvements not only in empirical but also in certified accuracy as a result.
Independently to our method, there have been approaches to further tighten the certified lower-bound that randomized smoothing guarantees [50, 70, 43, 45, 69]. Mohapatra et al. [50] have shown that higher-order information of smoothed classifiers, e.g., its gradient on inputs, can tighten the certification of Gaussian-smoothed classifiers, beyond that only utilizes the zeroth-order information of smoothed confidence. In the context of denoised smoothing [58, 11], Xiao et al. [69] have recently proposed a multi-step, multi-round scheme for diffusion models to improve accuracy of denoising at randomized smoothing. Such approaches could be also incorporated to our method to further improve certification. Along with the developments of randomized smoothing, there have been also other attempts in certifying deep neural networks against adversarial examples [23, 68, 49, 25, 76, 16, 4, 77], where a more extensive survey on the field can be found in Li et al. [44].
CIFAR-10 [39] consist of 60,000 images of size  $32 \times 32$  pixels, 50,000 for training and 10,000 for testing. Each of the images is labeled to one of 10 classes, and the number of data per class is set evenly, i.e., 6,000 images per each class. By default, we do not apply any data augmentation but the input normalization with mean  $[0.5, 0.5, 0.5]$  and standard deviation  $[0.5, 0.5, 0.5]$ , following the standard training configurations of diffusion models. The full dataset can be downloaded at https://www.cs.toronto.edu/~kriz/cifar.html.
CIFAR-10-C [27] are collections of 75 replicas of the CIFAR-10 test datasets (of size 10,000), which consists of 15 different types of common corruptions each of which contains 5 levels of corruption severities. Specifically, the datasets include the following corruption types: (a) noise: Gaussian, shot, and impulse noise; (b) blur: defocus, glass, motion, zoom; (c) weather: snow, frost, fog, bright; and (d) digital: contrast, elastic, pixel, JPEG compression. In our experiments, we evaluate test errors on CIFAR-10-C for models trained on the "clean" CIFAR-10 datasets, where the error values are averaged across different corruption types per severity level. The full datasets can be downloaded at https://github.com/hendrycks/robustness.
CIFAR-10.1 [54] is a reproduction of the CIFAR-10 test set that are separately collected from Tiny Images dataset [62]. The dataset consists of 2,000 samples for testing, and designed to minimize distribution shift relative to the original CIFAR-10 dataset in their data creation pipelines. The full dataset can be downloaded at https://github.com/modestyachts/CIFAR-10.1, where we use the "v6" version for our experiments among those given in the repository.
ImageNet [56], also known as ILSVRC 2012 classification dataset, consists of 1.2 million high-resolution training images and 50,000 validation images, which are labeled with 1,000 classes. As a data pre-processing step, we apply a  $256 \times 256$  center cropping for both training and testing images after re-scaling the images to have 256 in their shorter edges, making it compatible with the preprocessing of ADM [18], the backbone diffusion model. Similarly to CIFAR-10, all the images are normalized with mean [0.5, 0.5, 0.5] and standard deviation [0.5, 0.5, 0.5]. A link for downloading the full dataset can be found in http://image-net.org/download.
ImageNet-R [28] consists of 30,000 images of various artistic renditions for 200 (out of 1,000) ImageNet classes: e.g., art, cartoons, deviantart, graffiti, embroidery, graphics, origami, paintings, patterns, plastic objects, plush objects, sculptures, sketches, tattoos, toys, video game renditions,
and so on. To perform an evaluation of ImageNet classifiers on this dataset, we apply masking on classifier logits for the 800 classes those are not in ImageNet-R. The full dataset can be downloaded at https://github.com/hendrycks/imagenet-r.
ImageNet-A [30] consists of 7,500 images of 200 ImageNet classes those are "adversarily" filtered, by collecting natural images that causes wrong predictions from a pre-trained ResNet-50 model. To perform an evaluation of ImageNet classifiers on this dataset, we apply masking on classifier logits for the 800 classes those are not in ImageNet-A. The full dataset can be downloaded at https://github.com/hendrycks/natural-adv-examples.
B.2 Training
CLIP fine-tuning. We follow the training configuration suggested by FT-CLIP [19] in fine-tuning the CLIP ViT-B/16@224 model, where the full script is specified at https://github.com/ LightDXY/FT-CLIP. The same configuration is applied to all the datasets considered for fine-tuning, namely CIFAR-10, ImageNet, and Gaussian-corrupted versions of CIFAR-10 (for baselines such as "Gaussian" and "Consistency"), which can be done by resizing the datasets into  $224 \times 224$  as a data pre-processing. We fine-tune all these tested models for 50 epochs on each of the considered datasets.
Diffusion fine-tuning. Similarly to the CLIP fine-tuning, we follow the training details given by Nichol and Dhariwal [52] in fine-tuning diffusion models, which are specified in https://github.com/openai/improved-diffusion. More concretely, here we fine-tune each pre-trained diffusion model by "resuming" the training following its configuration, but with an added regularization term we propose upon the original training loss. We use the 50M-parameter  $32 \times 32$  diffusion model from Nichol and Dhariwal [52] for CIFAR-10, and the 552M-parameter  $256 \times 256$  unconditional model from Dhariwal and Nichol [18] for ImageNet to initialize each fine-tuning run. We fine-tune each model for 50K training steps, using batch size 128 and 64 for CIFAR-10 and ImageNet, respectively.
Unless otherwise noted, we use  $p_0 = 0.5$  for cascaded smoothing throughout our experiments. We mainly consider two configurations of cascaded smoothing: (a)  $\sigma \in \{0.25, 0.50, 1.00\}$ , and (b)  $\sigma \in \{0.25, 0.50\}$ , each of which denoted as “(0.25-1.00)” and “(0.25-0.50)” in tables, respectively. For diffusion calibration, on the other hand, we use  $\alpha = 1.0$  by default. We use  $\lambda = 0.01$  on CIFAR-10 and  $\lambda = 0.005$  on ImageNet, unless noted: we halve the regularization strength  $\lambda$  on ImageNet considering its batch size used in the fine-tuning, i.e., 128 (for CIFAR-10) vs. 64 (for ImageNet). In other words, we follow  $\lambda = 0.01 \cdot (\text{batch_size}/128)$ . Among the baselines considered, “Consistency” [35] requires two hyperparameters: the coefficient for the consistency term  $\eta$  and the entropy term  $\gamma$ . Following those considered by Jeong and Shin [35], we fix  $\gamma = 0.5$  and  $\eta = 5.0$  throughout our experiments.
B.4 Computing infrastructure
Overall, we conduct our experiments with a cluster of 8 NVIDIA V100 32GB GPUs and 8 instances of a single NVIDIA A100 80GB GPU. All the CIFAR-10 experiments are run on a single NVIDIA A100 80GB GPU, including both the diffusion fine-tuning and the smoothed inference procedures. For the ImageNet experiments, we use 8 NVIDIA V100 32GB GPUs per run. In our computing environment, it takes e.g.,  $\sim 10$  seconds and  $\sim 5$  minutes per image (we use  $n = 10,000$  for each inference) to perform a single pass of smoothed inference on CIFAR-10 and ImageNet, respectively. For a single run of fine-tuning diffusion models, we observe  $\sim 1.5$  days of training cost on CIFAR-10 with a single NVIDIA A100 80GB GPU, and that of  $\sim 4$  days on ImageNet using a cluster of 8 NVIDIA V100 32GB GPUs, to run 50K training steps.
At inference time, our proposed cascaded smoothing may introduce an extra computational overhead as the cost for the increased accuracy, i.e., from taking multiple times of smoothed inferences. Nevertheless, remark that the actual overhead per input in practice can be different depending on the early-stopping result of cascaded smoothing. For example, in our experiments, we observe that
<sup>6</sup>https://github.com/openai/improved-diffusion
Figure 4: Comparison of certified test accuracy with (a) Carlini et al. [11] at  $\sigma = 0.25$ , (b) Input-Dependent Randomized Smoothing (IDRS) proposed by Sūkeník et al. [60]. For (b), we adopt the per-sample  $\sigma$  values of CIFAR-10 test set of Sūkeník et al. [60].
Figure 5: Comparison of histograms across  $p_0 \in [0.5,1.0)$  on the distribution of  $\sigma$ 's where each of CIFAR-10 test samples halts from cascaded smoothing. Each of smoothed inferences is performed with  $n = 10,000$  noise samples and  $\alpha = 0.001$ .
the average inference time to process the CIFAR-10 test set via cascaded smoothing is only  $\sim 1.5\times$  compared to standard (single-scale) smoothed inferences, even considering  $\sigma \in \{0.25,0.5,1.0\}$ .
C.1 Comparison with input-dependent smoothing
In a sense that the proposed cascaded smoothing results in different smoothing factors  $\sigma$  per-sample basis, our approach can be also viewed in the context of input-dependent randomized smoothing [1, 67, 13, 20], a line of attempts to improve certified robustness by applying different smoothing factor  $\sigma$  conditioned on input. From being more flexible in assigning  $\sigma$ , however, these approaches commonly require more assumptions for their certification, making them hard to compare directly upon the standard evaluation protocol, e.g., that we considered in our experiments. For example, Súkeník et al. [60] have proved that such a scheme of freely assigning  $\sigma$  does not provide valid robustness certificates in the standard protocol, and [1, 20] in response have suggested to further assume that all the previous test samples during evaluation can be memorized to predict future samples, which can affect the practical relevance of the overall evaluation protocol.
To address the issue, Sūkeník et al. [60] have also proposed a fix of [1] to discard its test-time dependency, by assuming a more strict restriction on the variation of  $\sigma$ . Nevertheless, they also report that the benefit of input-dependent  $\sigma$  then becomes quite limited, supporting the challenging nature of input-dependent smoothing. As shown in Figure 4 that additionally compares our method with [60], we indeed confirm that cascaded smoothing offers significantly wider robustness certificates with a better accuracy trade-off. This is unprecedented to the best of our knowledge, which could be achieved from our completely new approach of data-dependent smoothing: i.e., by combining multiple smoothed classifiers through abstention, moving away from the previous attempts that are focused on obtaining a single-step smoothing.
C.2 Clean ensemble for empirical accuracy
In this appendix, we demonstrate that predictions from smoothed classifiers can not only useful to obtain adversarial robustness, but also to improve out-of-distribution robustness of clean classifiers, which suggests a new way to utilize randomized smoothing. Specifically, consider a smoothed classifier  $\tilde{f}$ , and its smoothed confidence at  $\mathbf{x}$ , say  $p_{\tilde{f}}(y|\mathbf{x})$  for  $y \in \mathcal{V}$ . Next, we consider prediction confidence of a "clean" prediction, namely  $p_f(y|\mathbf{x})$ . Remark that  $p_f(y|\mathbf{x})$  can be interpreted in terms of logits, namely  $\log p_f(\mathbf{x}|y)$ , of a neural network based model  $f$  as follows:
$$
p _ {f} (y | \mathbf {x}) = \frac {p _ {f} (\mathbf {x} , y)}{p _ {f} (\mathbf {x})} = \frac {p (y) \cdot p _ {f} (\mathbf {x} | y)}{\sum_ {y \in \mathcal {Y}} p _ {f} (\mathbf {x} , y)}. \tag {10}
$$
Note that the prior  $p(y)$  is usually assumed to be the uniform distribution  $\mathcal{U}(\mathcal{V})$ . Here, we consider a variant of this prediction, by replacing the prior  $p(y)$  by a mixture of  $p(y)$  and a smoothed prediction
Table 6: Comparison of per-corruption empirical accuracy of clean ("FT-CLIP") and smoothed classifiers (Others) on CIFAR-10-C. For each corruption type, we report accuracy averaged over 5 levels of severity, and for each level we use 1,000 uniform subsamples to compute the accuracy.
Method	Clean	Gaussian	Shot	Input	Defocus	Glass	Motion	Zoom	Show	Frost	Fog	Brightness	Contrast	Elastic	Pixelate	JPEG	AVG
FT-CLIP [19]	98.1	83.7	88.7	96.4	96.8	85.7	95.0	96.1	96.1	96.0	97.0	97.8	97.5	94.7	91.0	88.5	93.4
Carlini et al. [11]	88.8	85.8	86.9	88.7	87.3	83.6	86.8	86.0	85.2	83.6	78.9	87.8	75.7	85.4	86.4	85.8	84.9
+ Casc. + Calib.	92.5	89.0	90.1	91.5	90.7	87.3	89.6	90.7	89.9	89.4	86.0	91.1	81.2	89.7	90.4	89.3	89.1
+ Clean prior	98.0	90.9	93.0	96.5	96.8	89.9	95.2	96.3	96.2	96.6	96.8	97.7	97.4	95.3	94.2	91.6	95.0
Table 7: Comparison of empirical accuracy and certified accuracy of cascaded smooth classifiers on CIFAR-10 across ablations on  $\lambda$ . We use  $\sigma \in \{0.25, 0.5, 1.0\}$  for cascaded smoothing.
CIFAR-10	Empirical	Certified accuracy at ε (%)
Setup	Clean	0.00	0.25	0.50	0.75	1.00	1.25	1.50	1.75
λ = 0.001	α = 1.0	84.1	79.9	54.4	39.6	30.9	24.2	18.9	13.9	9.3
α = 2.0	84.3	80.7	53.9	38.9	29.7	23.9	18.7	13.0	9.6
α = 4.0	85.1	80.9	52.8	39.1	29.5	23.2	17.3	12.4	9.4
α = 8.0	86.1	81.5	53.2	38.5	29.0	22.0	17.1	13.0	8.8
λ = 0.01	α = 1.0	82.9	79.6	53.5	40.5	31.2	25.0	20.1	16.2	11.4
α = 2.0	84.8	80.1	54.6	39.2	30.6	24.0	18.5	14.5	9.9
α = 4.0	85.1	80.4	53.6	39.1	29.5	22.8	17.8	13.1	9.5
α = 8.0	86.1	81.5	54.5	39.0	27.7	21.4	17.3	12.9	8.8
λ = 0.1	α = 1.0	80.8	77.2	53.9	39.9	31.4	24.8	20.1	15.5	11.6
α = 2.0	82.7	78.0	53.9	39.9	30.7	24.1	19.8	15.1	11.1
α = 4.0	82.1	78.3	52.6	39.1	30.1	22.6	17.4	13.7	10.0
α = 8.0	83.7	78.2	51.1	36.9	28.0	22.3	17.9	13.1	9.1
Table 8: Comparison of empirical accuracy and certified accuracy of cascaded smooth classifiers on CIFAR-10 across ablations on  $p_0$ . We use  $\sigma \in \{0.25, 0.5, 1.0\}$  for cascaded smoothing.
CIFAR-10	Empirical	Certified accuracy at ε (%)
Setup	Clean	0.00	0.25	0.50	0.75	1.00	1.25	1.50	1.75
p0=0.50	84.8	81.1	52.8	37.2	27.9	21.7	16.8	11.8	8.5
p0=0.55	87.9	82.6	53.5	35.6	26.9	19.8	14.0	10.1	7.1
p0=0.60	90.7	83.9	52.7	34.5	23.9	16.9	11.9	8.3	6.4
p0=0.65	92.5	83.4	52.1	34.0	22.6	14.4	9.8	7.0	5.5
p0=0.70	94.1	83.0	52.6	31.6	19.2	12.2	8.2	6.3	4.7
p0=0.75	95.2	81.9	52.2	29.1	16.5	9.5	6.7	5.2	3.7
p0=0.80	96.0	79.5	47.6	25.0	14.0	8.0	5.9	4.6	2.4
p0=0.85	96.6	76.3	45.0	22.8	12.5	7.1	4.7	2.8	2.2
p0=0.90	97.2	72.1	42.5	20.0	11.7	4.6	2.8	1.9	1.0
p0=0.95	97.8	65.5	38.6	16.7	7.2	2.2	1.7	0.7	0.0
$p(\hat{y}) \coloneqq p_{\hat{f}}(y|\mathbf{x})$ : in this way, one could use  $\hat{f}(\mathbf{x})$  as an additional prior to refine the clean confidence in cases when the two sources of confidence do not match. More specifically, we consider:
$$
\log p _ {f} (\hat {y} | \mathbf {x}) := \log p _ {\hat {f}} ^ {\beta} (y | \mathbf {x}) + \log p _ {f} (\mathbf {x} | y) + C, \quad \text {w h e r e} \tag {11}
$$
$$
\log p _ {\hat {f}} ^ {\beta} (y | \mathbf {x}) := (1 - \beta) \cdot \log p _ {\hat {f}} (y | \mathbf {x}) + \beta \cdot p (y). \tag {12}
$$
where  $C$  denotes the normalizing constant, and  $\beta > 0$  is a hyperparameter which we fix as  $\beta = 0.1$  in our experiment. In Table 6, we compare the accuracy of the proposed inference with the accuracy of standard classifiers derived from FT-CLIP [19] fine-tuned on CIFAR-10: overall, we observe that this "ensemble" of clean prediction with cascaded smoothed predictions could improve the corruption accuracy of FT-CLIP on CIFAR-10-C, namely by  $93.4\% \rightarrow 95.0\%$ , while maintaining its clean accuracy. The gain can be considered significant in a sense that the baseline accuracy of  $93.4\%$  is already at the state-of-the-art level, e.g., according to RobustBench [17].
Figure 6: Comparison of per-class histograms of critical  $\sigma$ : the minimum value of  $\sigma$  for each input where the smoothed confidence at true class falls below 0.5. We use the whole CIFAR-10 training samples for the analysis. Each image is smoothed with  $n = 1,000$  samples of Gaussian noise, while iterating  $\sigma$  within the range  $\sigma \in [0.0,2.0]$ . Images with critical  $\sigma$  larger than 2.0 are truncated.
Effect of  $\lambda$ . In Table 7, we jointly ablate the effect of tuning  $\lambda \in \{0.001, 0.01, 0.1\}$  upon the choices of  $\alpha \in \{1.0, 2.0, 4.0, 8.0\}$ , by comparing its certified accuracy of cascaded smoothing as well as their empirical accuracy on CIFAR-10 test set. Overall, we observe that increasing  $\lambda$  has an effect of improving robustness at large radii, with a slight decrease in the clean accuracy as well as the empirical accuracy, where using higher  $\alpha$  could compensate this at some extent. Although we generally observe effectiveness of the proposed regularization for a wide range of  $\lambda$ , using higher values of  $\lambda$ , e.g.,  $\lambda = 0.1$ , often affects the base diffusion model and results in a degradation in accuracy without a significant gain in its certified robustness.
Effect of  $p_0$ . Table 8, on the other hand, reports the effect of  $p_0$  we introduced for cascaded smoothing. Recall that we use  $p_0 = 0.5$  throughout our experiments by default. We observe that using a bit of higher values of  $p_0$ , e.g.,  $p_0 = 0.6$  could be beneficial to improve the clean accuracy of cascaded smoothing, at the cost of robustness at larger radii: for example, it improves the certified accuracy at  $r = 0.0$  by  $81.1 \rightarrow 83.9$ . The overall certified robustness starts to decrease as  $p_0$  further increases, due to its effect of increasing abstention rate. One could still observe the consistent improvement in the empirical accuracy as  $p_0$  increases, i.e., by also considering abstain as a valid prediction, i.e., using high values of  $p_0$  could be useful in certain scenarios. We think a more detailed choice of  $p_0$  per  $\sigma$  can further boost the performance of cascaded smoothing, which is potentially an important practical consideration.
Critical  $\sigma$ . Although it is not required for cascaded smoothing to guarantee the stability of smoothed confidences across  $\sigma$  (e.g., outside of  $\{0.25, 0.5, 1.0\}$  in our experiments), we observe that smoothed confidences from denoised smoothing usually interpolate smoothly between different  $\sigma$ 's, at least for the diffusion denoised smoothing pipeline. In this respect, we consider a new concept of critical  $\sigma$  for each sample, by measuring the threshold of  $\sigma$  where its confidence goes below  $p_0 = 0.5$ . Figure 6 examines this measure on CIFAR-10 training samples and plots its distribution for each class as histograms. Interestingly, we observe that the distributions are often significantly biased, e.g., the "Ship" class among CIFAR-10 classes relatively obtains much higher critical  $\sigma$  - possibly due to its peculiar background of, e.g., ocean.
Per- $\sigma$  distribution from cascading. To further verify that per-sample  $\sigma$ 's from cascaded smoothing are diverse enough to achieve better robustness-accuracy trade-off, we examine in Figure 5 the actual histograms of the resulting  $\sigma \in \{\mathrm{ABSTAIN}, 0.25, 0.50, 1.00\}$  on CIFAR-10, also varying  $p_0 \in \{0.5, 0.6, 0.7, 0.8, 0.9\}$ . Overall, we observe that (a) the distributions of  $\sigma_x$  indeed widely cover the total range of  $\sigma$  for every  $p_0$ 's considered, and (b) using higher  $p_0$  can further improve diversity of the distribution while its chance to be abstained can be also increased.
D Technical Details
D.1 Proof of Theorem 3.1
Our proof is based on the fact that any smoothed classifier  $\hat{f}$  composed with  $\Phi^{-1}(\cdot)$  is always Lipschitz-continuous, which is shown by Salman et al. [57]:
Lemma D.1 (followed by Salman et al. [57]). Let  $\Phi(a) := \frac{1}{\sqrt{2\pi}} \int_{-\infty}^{a} \exp \left(-\frac{1}{2} s^2\right) \, \mathrm{d}s$  be the cumulative distribution function of standard Gaussian. For any function  $f: \mathbb{R}^d \to [0,1]$ , the map  $\mathbf{x} \mapsto \sigma \cdot \Phi^{-1}(p_{\hat{f}_{\sigma}}(\mathbf{x}))$  is 1-Lipschitz for any  $\sigma > 0$ .
Given Lemma D.1, the robustness certificate by Cohen et al. [15] in (2) (of the main text) can be viewed as computing the region of  $p_{\hat{f}_{\sigma}}(\mathbf{x} + \boldsymbol{\delta}; y) > 0.5$ , i.e., where it is guaranteed to return  $y$  over other (binary) smoothed classifiers  $p_{\hat{f}_{\sigma}}(\mathbf{x} + \boldsymbol{\delta}; y')$  of  $y \neq y'$ .
In general, as in our proposed cascaded smoothing, one can consider a more "strict" region defined by  $p_{\hat{f}_{\sigma}}(\mathbf{x} + \boldsymbol{\delta}; y) > p_0$  for some  $p_0 \geq 0.5$ . Here, the region corresponds to a policy that  $\hat{f}_{\sigma}$  abstains whenever  $p_{\hat{f}_{\sigma}}(\mathbf{x}) \leq p_0$ . Accordingly, the certified radius one can obtain from this policy becomes:
$$
R _ {p _ {0}} \left(\hat {f} _ {\sigma}; \mathbf {x}, y\right) := \sigma \cdot \left(\Phi^ {- 1} \left(p _ {\hat {f} _ {\sigma}} (\mathbf {x}, y)\right) - \Phi^ {- 1} \left(p _ {0}\right)\right). \tag {13}
$$
With this notation, we restate Theorem 3.1 into a tighter form to show, which do not consider neither  $\underline{p}$  nor  $\bar{p}$  upon the knowledge of  $p_{\hat{f}_{\sigma_k}}$  and implies Theorem 3.1 as a consequence:
Theorem 3.1 (restated). Let  $\hat{f}_{\sigma_1}, \dots, \hat{f}_{\sigma_K} : \mathcal{X} \to \mathcal{Y}$  be smoothed classifiers with  $0 < \sigma_1 < \dots < \sigma_K$ . Suppose  $\operatorname{casc}(\mathbf{x}; \{\hat{f}_{\sigma_i}\}_{i=1}^K) =: \hat{y} \in \mathcal{Y}$  halts at  $\hat{f}_{\sigma_k}$  for some  $k$ . Then, it holds that  $\operatorname{casc}(\mathbf{x} + \boldsymbol{\delta}; \{\hat{f}_{\sigma_i}\}_{i=1}^K) = \hat{y}$  for  $\|\boldsymbol{\delta}\| < R$ , where: