SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Expected value and median smoothing. Median smoothing and expected value smoothing assume a base regression model  $h: \mathbb{X} \to \mathbb{R}$ . They construct a smoothed model  $f(\pmb{x})$  via the expected value or median of pushforward measure  $\mu_x \circ h^{-1}$ . To certify robustness, they require lower and upper bounds on the cumulative distribution function  $\operatorname{Pr}_{z \sim \mu_x'} \mathbb{I}[h(z) \leq a_t]$  for a finite range of thresholds  $-\infty \leq a_t \leq \dots \leq a_T \leq \infty$ . Since each of the indicator functions  $\mathbb{I}[h(z) \leq a_t]$  can be thought of as a binary classifier  $g_t: \mathbb{X} \to \{0, 1\}$ , these lower and upper bounds are given by  $\underline{p_{g_t, x', 1}}$  and  $\overline{p_{g_t, x', 1}}$ . These certification procedures can thus be adapted to any other smoothing measure by inserting the corresponding lower and upper bounds. They can be generalized to multi-output regression tasks with  $\mathbb{Y} = \mathbb{R}^M$  by applying the certification procedure independently to each output dimension. Instead of proving that the smoothed prediction  $f(\pmb{x})$  remains constant, these smoothing schemes guarantee that the output remains in a certified hyperrectangle  $\mathbb{H} = \{\pmb{y} \in \mathbb{R}^M | l_m \leq x_m \leq u_m\}$ . One can then prove that  $d_{\mathrm{out}}(f(\pmb{x}), f(\pmb{x}')) \leq \delta$  by verifying that  $\{\pmb{y} \in \mathbb{R}^M | d_{\mathrm{out}}(f(\pmb{x}), \pmb{y}) \leq \delta\} \subseteq \mathbb{H}$ , i.e. the hyperrectangle contains a  $d_{\mathrm{out}}$ -ball of radius  $\delta$ .
Center smoothing. Center smoothing is compatible with any model  $h: \mathbb{X} \to \mathbb{Y}$ , as long as the output space  $\mathbb{Y}$  fulfills a relaxed triangle inequality. It constructs a smoothed model  $f(\boldsymbol{x})$  via the center of the smallest ball that has at least 50% probability under pushforward measure  $\mu_{\boldsymbol{x}} \circ h^{-1}$ . To certify robustness, it requires bounds on the cumulative distribution function  $\operatorname{Pr}_{z \sim \mu_x'} \mathbb{1}[d_{\mathrm{out}}(f(\boldsymbol{x}), h(\boldsymbol{z}) \leq a_t]$ . Thus, like with expected value and median smoothing, this certification procedure can be adapted to any other smoothing measure by inserting the corresponding bounds  $\underline{p_{g_t, x', 1}}$  and  $\overline{p_{g_t, x', 1}}$ . This smoothing scheme directly provides an upper bound on  $d_{\mathrm{out}}(f(\boldsymbol{x}), f(\boldsymbol{x}'))$ .
Informally speaking, any of these schemes can be adapted to non-Gaussian measures by replacing any occurrence of  $\Phi\left(\Phi^{-1}(\ldots) - \ldots\right)$  and  $\Phi\left(\Phi^{-1}(\ldots) + \ldots\right)$ , which are the formulae for  $p_{h,x',k}$  and  $\overline{p_{h,x',k}}$  of Gaussian measures [20], with the bounds of another smoothing measure. For example, one can combine the bounds from derandomized smoothing with the center smoothing certification procedure to prove robustness of generative image reconstruction models to patch-based attacks.
E Equivariance-preserving randomized smoothing
In the following, we provide more formal justifications for our randomized smoothing framework, that we introduced in section Section 5.1 and that is visualized in Fig. 31. We first verify the correctness of our sufficient condition for equivariance-preserving randomized smoothing. We then consider the different equivariances preserved by different smoothing schemes and measures. We provide a tabular overview of different schemes, measures and their properties in Tables 1 and 2.
Concerning notation for pushforward measures. Consider measurable spaces  $(\mathbb{X},\mathbb{D})$  and  $(\mathbb{V},\mathbb{F})$  and a measurable function  $h:\mathbb{X}\to \mathbb{V}$ . We write  $h^{-1}$  to refer to the preimage of function  $h$ , not its inverse. That is, for any  $\mathbb{A}\subseteq \mathbb{V}$  we have  $h^{-1}(\mathbb{A}) = \{x\in \mathbb{X}\mid h(x)\in \mathbb{A}\}$ . Because  $h$  is measurable, we have  $h^{-1}(\mathbb{A})\in \mathbb{D}$  whenever  $\mathbb{A}\in \mathbb{F}$ . Thus, the expression  $\mu \circ h^{-1}(\mathbb{A})$  refers to the measure of all elements of  $\mathbb{X}$  that get mapped into  $\mathbb{A}\in \mathbb{F}$ , i.e. it is the pushforward measure of  $\mu$ .
Figure 31: Example of equivariance-preserving randomized smoothing for  $\mathbb{X} = \mathbb{V} = \mathbb{Y} = \mathbb{R}^2$  and diagonal translation group  $\mathbb{G} = (\mathbb{R}, +)$ , which acts via  $T_{,g}(\boldsymbol{x}) = \boldsymbol{x} + g \cdot \mathbf{1}$ . We construct our smoothed model using Gaussian measures  $\mu_{\boldsymbol{x}} = \mathcal{N}(\boldsymbol{x}, \sigma \cdot \boldsymbol{I})$ , base model  $h: \mathbb{X} \to \mathbb{V}$  and expected value smoothing scheme  $\xi: \Delta(\mathbb{V}, \mathbb{F}) \to \mathbb{Y}$ , which maps from measures on intermediate space  $(\mathbb{V}, \mathbb{F})$  to output space  $\mathbb{Y}$ . Measures are visualized via isocontours of their densities. Because the family of measures  $(\mu_{\boldsymbol{x}})_{\boldsymbol{x} \in \mathbb{X}}$  is equivariant (left cycle), the base model  $h$  is equivariant (central cycle), and the smoothing scheme  $\xi$  is equivariant (right cycle), the smoothed model  $f(\boldsymbol{x}) = \xi(\mu_{\boldsymbol{x}} \circ h^{-1})$  is also equivariant to diagonal translation.
- the family of measures  $(\mu_x)_{x \in \mathbb{X}}$  is equivariant, i.e.  $\forall x \in \mathbb{X}, g \in \mathbb{G}: \mu_{g \bullet x} = \mu_x \circ T_{\mathbb{X}, g}^{-1}$ ,
- and smoothing scheme  $\xi$  is equivariant, i.e.  $\forall \nu \in \Delta (\mathbb{V},\mathbb{F}),g\in \mathbb{G}:\xi (\nu \circ T_{\mathbb{V},g}^{-1}) = g\bullet \xi (\nu)$ .
Proof. By definition of  $f$ , verifying that  $\forall x \in \mathbb{X}, \forall g \in \mathbb{G} : f(g \bullet x) = g \bullet f(x)$  is equivalent to verifying that  $\xi(\mu_{g \bullet x} \circ h^{-1}) = g \bullet \xi(\mu_g \circ h^{-1})$ . We can do so by first using the equivariance of the family of measures  $(\mu_x)_{x \in \mathbb{X}}$ , then the equivariance of base model  $h$  and then the equivariance of
smoothing scheme  $\xi$  ..
$$
\begin{array}{l} \xi \left(\mu_ {g \bullet x} \circ h ^ {- 1}\right) = \xi \left(\left(\mu_ {x} \circ T _ {\mathbb {X}, g} ^ {- 1}\right) \circ h ^ {- 1}\right) \\ = \xi \left(\mu_ {x} \circ \left(T _ {\mathbb {X}, g} ^ {- 1} \circ h ^ {- 1}\right)\right) \\ = \xi \left(\mu_ {x} \circ (h \circ T _ {\mathbb {X}, g}) ^ {- 1}\right) \\ = \xi \left(\mu_ {x} \circ \left(T _ {\mathbb {V}, g} \circ h\right) ^ {- 1}\right) \\ = \xi \left(\mu_ {x} \circ \left(h ^ {- 1} \circ T _ {\mathbb {V}, g} ^ {- 1}\right)\right) \\ = \xi \left(\left(\mu_ {x} \circ h ^ {- 1}\right) \circ T _ {\mathbb {V}, g} ^ {- 1}\right) = g \bullet \xi (\mu_ {x} \circ h ^ {- 1}). \\ \end{array}
$$
In the second and sixth equality we used the associativity of function composition. In the third and fifth equality we used that the preimage of a composition of functions is equivalent to the composition of the individual preimages in reverse order.
E.2 Equivariance-preserving schemes and measures
In the following,  $\Delta (\mathbb{X},\mathbb{D})$  refers to the set of all probability measures on measurable space  $(\mathbb{X},\mathbb{D})$ .
E.2.1 Componentwise smoothing schemes.
For this type of smoothing scheme, we assume that the intermediate space and output space consist of  $M$  distinct components, i.e.  $\mathbb{V} = \mathbb{A}^M$  and  $\mathbb{Y} = \mathbb{B}^M$  for some sets  $\mathbb{A}$ ,  $\mathbb{B}$ . We write  $\mathrm{proj}_m: \mathbb{A}^M \to \mathbb{A}$  for the function that maps any vector  $\pmb{a} \in \mathbb{A}^M$  to its  $m$ th component  $a_m$ . Thus, for any measure  $\nu \in \Delta(\mathbb{A}^M, \mathbb{F}^M)$  the function  $\nu \circ \mathrm{proj}_m^{-1}$  is the  $m$ th marginal measure, which is a measure on the single-dimensional space  $(\mathbb{A}, \mathbb{F})$ . Componentwise smoothing means generating the  $m$ th prediction based on some quantity of the  $m$ th marginal measure.
Proposition 4. Assume an  $M$ -dimensional measurable product space  $(\mathbb{A}^M,\mathbb{F}^M)$  and an output space  $\mathbb{B}^M$ . Further assume that there is a function  $\kappa :\Delta (\mathbb{A},\mathbb{F})\to \mathbb{B}$  such that  $\forall \nu \in \Delta (\mathbb{A}^{M},\mathbb{F}^{M}): \xi (\nu)_{m} = \kappa (\nu \circ \mathrm{proj}_{m}^{-1})$ . If a group  $\mathbb{G}$  acts on  $\mathbb{A}^N$  and  $\mathbb{B}^N$  via the same permutation, then the smoothing scheme  $\xi$  is equivariant.
Proof. Consider an arbitrary  $g \in \mathbb{G}$  with corresponding actions  $T_{\mathbb{V},g} : \mathbb{A}^M \to \mathbb{A}^M$  with  $T_{\mathbb{V},g}(\pmb{v})_m = v_{\pi^{-1}(m)}$  and  $T_{\mathbb{Y},g} : \mathbb{A}^M \to \mathbb{A}^M$  with  $T_{\mathbb{Y},g}(\pmb{y})_m = y_{\pi^{-1}(m)}$ , where  $\pi : \{1, \dots, M\} \to \{1, \dots, M\}$  is a permutation. For any  $m$ , we can use the definition  $\xi$ , the associativity of function composition and the fact that the preimage of a composition is equivalent to the composition of preimages in reverse order to show that
$$
\begin{array}{l} \xi \left(\nu \circ T _ {\mathbb {V}, g} ^ {- 1}\right) _ {m} = \kappa \left(\left(\nu \circ T _ {\mathbb {V}, g} ^ {- 1}\right) \circ \operatorname {p r o j} _ {m} ^ {- 1}\right) \\ = \kappa \left(\nu \circ \left(T _ {\mathbb {V}, g} ^ {- 1} \circ \operatorname {p r o j} _ {m} ^ {- 1}\right)\right) \\ = \kappa (\nu \circ (\operatorname {p r o j} _ {\mathrm {m}} \circ T _ {\mathbb {V}, g}) ^ {- 1}) \\ = \kappa \left(\nu \circ \operatorname {p r o j} _ {\pi^ {- 1} (\mathrm {m})} ^ {- 1}\right) = \xi (\nu) _ {\pi^ {- 1} (m)} = (g \bullet \xi (\nu)) _ {m}. \\ \end{array}
$$
For the fourth equality we used that selecting the  $m$ th element from a sequence permuted by  $\pi$  is equivalent to selecting the element  $\pi^{-1}(m)$  of the unpermuted sequence. The second to last equality is just the definition of our smoothing scheme  $\xi$ .
In practice, componentwise smoothing schemes are not evaluated exactly but approximated using  $S$  Monte Carlo samples  $\pmb{v}^{(1)},\dots,\pmb{v}^{(S)}\in \mathbb{V}$ . The  $m$ th component of smoothed prediction  $y_{n}$  is generated based on some quantity of  $v_{m}^{(1)},\dots,v_{m}^{(S)}\in \mathbb{V}$ , such as their mean [75]. We can thus use the same argument as above to show that the Monte Carlo approximations are permutation equivariant: Permuting the components of the samples before applying componentwise functions is equivalent to first applying componentwise functions and then performing a permutation.
E.2.2 Expected value smoothing scheme.
For this smoothing scheme, we assume that the intermediate and output space coincide are real-valued, i.e.  $\mathbb{V} = \mathbb{Y} = \mathbb{R}^{M}$ . We then make smoothed predictions via the expected value of the model's output distribution over  $\mathbb{Y}$ .
Proposition 5. Let  $\mathcal{B}(\mathbb{R}^M)$  be the corresponding Borel  $\sigma$ -algebra of  $\mathbb{R}^M$ . Define expected value smoothing scheme  $\xi: \Delta(\mathbb{R}^M, \mathcal{B}(\mathbb{R}^M)) \to \mathbb{R}^M$  with
$$
\xi (\nu) = \int_ {\mathbb {R} ^ {M}} \boldsymbol {y} d \nu (\boldsymbol {y})
$$
If group  $\mathbb{G}$  acts on  $\mathbb{R}^M$  via affine transformations, then smoothing scheme  $\xi$  is equivariant.
Proof. Consider an arbitrary  $g \in \mathbb{G}$  with corresponding action  $T_{\mathbb{Y},g}$ . By change of variables and linearity of integration, we have
$$
\begin{array}{l} \xi \left(\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}\right) = \int_ {\mathbb {R} ^ {M}} \boldsymbol {y} d \left(\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}\right) (\boldsymbol {y}) \\ = \int_ {\mathbb {R} ^ {M}} T _ {\mathbb {Y}, g} (\boldsymbol {y}) d \nu (y) \\ = T _ {\mathbb {Y}, g} \left(\int_ {\mathbb {R} ^ {M}} \boldsymbol {y} d \nu (\boldsymbol {y})\right) \\ = g \bullet \xi (\nu). \\ \end{array}
$$
In practice, expected value smoothing is not evaluated exactly but approximated using the average of  $S$  Monte Carlo samples  $\pmb{v}^{(1)},\dots,\pmb{v}^{(S)}\in \mathbb{R}^{M}$  [75]. We can thus use the same argument as above to show that the Monte Carlo approximation is equivariant to affine transformations: Affinely transforming the samples before computing the average is equivalent to computing the average and then applying the affine transformation.
E.2.3 Median smoothing scheme
For this smoothing scheme, we assume that the intermediate and output space coincide and are real-valued, i.e.  $\mathbb{V} = \mathbb{Y} = \mathbb{R}^M$ . We then make smoothed predictions via the elementwise median of the model's output distribution over  $\mathbb{Y}$ . As before, we write  $\mathrm{proj}_m: \mathbb{R}^M \to \mathbb{R}$  for the function that maps any vector  $\pmb{y} \in \mathbb{R}^M$  to its  $m$ th component  $y_m$ . Thus,  $\nu \circ \mathrm{proj}_m^{-1}$  is the  $m$ th marginal measure of  $\nu$ .
Proposition 6. Let  $\mathcal{B}(\mathbb{R}^M)$  be the Borel  $\sigma$ -algebra of  $\mathbb{R}^M$ . Let  $F_{m}(\nu, x)$  be the cumulative distribution function for marginal measure  $\nu \circ \mathrm{proj}_m^{-1}$ , i.e.
$$
F _ {m} (\nu , x) = \left(\nu \circ \operatorname {p r o j} _ {m} ^ {- 1}\right) ((- \infty , x ]).
$$
Let  $F_{m}^{-}(\nu ,p)$  and  $F_{m}^{+}(\nu ,p)$  be the corresponding lower and upper quantile functions, i.e.
$$
F _ {m} ^ {-} (\nu , p) = \inf  \left\{x \mid F _ {m} (\nu , x) \geq p \right\}
$$
$$
F _ {m} ^ {+} (\nu , p) = \sup  \{x \mid F _ {m} (\nu , x) \leq p \}
$$
Define median smoothing scheme  $\xi :\Delta (\mathbb{R}^M,\mathcal{B}(\mathbb{R}^M))\to \mathbb{R}^M$  with
$$
\xi (\nu) _ {m} = \frac {1}{2} \cdot \left[ F _ {m} ^ {-} (\nu , 1 / 2) + F _ {m} ^ {+} (\nu , 1 / 2) \right].
$$
If group  $\mathbb{G}$  acts on  $\mathbb{Y}$  via elementwise linear transformations, then smoothing scheme  $\xi$  is equivariant.
Proof. Consider an arbitrary  $g \in \mathbb{G}$ . Let  $T_{\mathbb{Y},g}$  be the corresponding group action with  $T_{\mathbb{Y},g}(\pmb{y})_m = w_m \cdot y_m + c_m$  for some  $w_m, c_m \in \mathbb{R}$ . Assume w.l.o.g. that  $\forall m : w_m > 0$ .
For the cumulative distribution functions, we have
$$
F _ {m} (\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}, x) = F _ {m} (\nu , (x - c _ {m}) / w _ {m}).
$$
For the corresponding lower and upper quantile functions, we thus have
$$
F _ {m} ^ {-} (\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}, p) = w _ {m} \cdot F _ {m} ^ {-} (\nu , p) + c _ {m}
$$
$$
F _ {m} ^ {+} (\nu \circ T _ {\mathbb {Y}, q} ^ {- 1}, p) = w _ {m} \cdot F _ {m} ^ {+} (\nu , p) + c _ {m}.
$$
For the smoothing scheme, we thus have
$$
\xi (\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}) _ {m} = w _ {m} \cdot \xi (\nu) _ {m} + c _ {m} = (g \bullet \xi (\nu)) _ {m}.
$$
In practice, median smoothing is not evaluated exactly but approximated using the elementwise median of  $S$  Monte Carlo samples  $\pmb{v}^{(1)}, \dots, \pmb{v}^{(S)} \in \mathbb{V}$  [75]. We can thus use the same argument as above to show that the Monte Carlo approximation is equivariant to elementwise linear transformations: Linearly transforming the samples elementwise before computing the sample median is equivalent to computing the sample median and then applying the elementwise linear transformations.
E.2.4 Center smoothing scheme
For this type of smoothing scheme, we assume that the intermediate and output space are identical, i.e.  $\mathbb{V} = \mathbb{Y}$ . Let  $\mathbb{B}(y,r) = \{y' \in \mathbb{Y} \mid d_{\mathrm{out}}(y,y') \leq r\}$  be the  $d_{\mathrm{out}}$  ball of radius  $r$  around  $y \in \mathbb{Y}$ . Center smoothing makes its predictions using the center of the  $d_{\mathrm{out}}$  ball with the smallest radius among all  $d_{\mathrm{out}}$  balls with a measure of at least  $\frac{1}{2}$ .
Proposition 7. Consider a measurable space  $(\mathbb{Y},\mathbb{F})$ , a function  $d_{\mathrm{out}}:\mathbb{Y}\times \mathbb{Y}\to \mathbb{R}_{+}$ , and assume that  $\forall y\in \mathbb{Y},r\geq 0:\mathbb{B}(y,r)\in \mathbb{F}$ . Define center smoothing scheme  $\xi :\Delta (\mathbb{Y},\mathbb{F})\to \mathbb{Y}$  with  $\xi (\nu) = \arg \min_y r$  s.t.  $\nu \left(\mathbb{B}(y,r)\right)\geq \frac{1}{2}$ . If  $\mathbb{G}$  acts isometrically on  $\mathbb{Y}$ , i.e.  $\forall y,y^{\prime}\in \mathbb{Y},g\in \mathbb{G}: d_{\mathrm{out}}(g\bullet y,g\bullet y^{\prime}) = d_{\mathrm{out}}(y,y^{\prime})$ , then smoothing scheme  $\xi$  is equivariant.
Proof. Consider an arbitrary  $g \in \mathbb{G}$  with corresponding action  $T_{\mathbb{Y},g}$ . By definition of the center smoothing scheme,  $\xi(\nu \circ T_{\mathbb{Y},g}^{-1})$  is
$$
\left(\underset {y} {\arg \min } r \text {s . t .} \left(\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}\right) (\mathbb {B} (y, r)) \geq \frac {1}{2}\right) = \left(\underset {y} {\arg \min } r \text {s . t .} \nu \left(T _ {\mathbb {Y}, g} ^ {- 1} (\mathbb {B} (y, r)) \geq \frac {1}{2}\right)\right).
$$
By definition of the preimage and action  $T_{\mathbb{Y},g}$ , we have  $T_{\mathbb{Y},g}^{-1}(\mathbb{B}(y,r)) = \{y' \mid g \bullet y' \in \mathbb{B}(y,r)\} = \{y' \mid d_{\mathrm{out}}(y,g \bullet y') \leq r\} = \{y' \mid d_{\mathrm{out}}(g^{-1} \bullet y,y') \leq r\} = \mathbb{B}\left(g^{-1} \bullet y,r\right)$ , where the second to last equality holds because  $\mathbb{G}$  acts isometrically. This shows that
$$
\xi (\nu \circ T _ {\mathbb {Y}, g} ^ {- 1}) = \left(\operatorname * {a r g   m i n} _ {y} r \text {s . t .} \nu \left(\mathbb {B} (g ^ {- 1} \bullet y, r)\right) \geq \frac {1}{2}\right).
$$
The optimum of this problem is  $g \bullet \xi(\nu)$ , because  $g^{-1} \bullet (g \bullet \xi(\nu)) = \xi(\nu)$  and  $\xi(\nu)$  is the optimum of the original problem without group action.
In practice, center smoothing is approximated using  $S$  Monte Carlo samples  $\pmb{y}^{(1)},\dots,\pmb{y}^{(S)}\in \mathbb{Y}$  by selecting the sample with the smallest median distance  $d_{\mathrm{out}}$  to all other samples [93]. We can use a similar argument to the one above to show that the Monte Carlo approximation is isometry equivariant: Isometries, by definition, do not change the pairwise distances and therefore do not change which sample has the smallest median distance to all other samples.
E.2.5 Product measures
For our discussion of product measures, note that the  $\sigma$ -algebra  $\mathbb{D}^N$  of a measurable product space  $(\mathbb{A}^N,\mathbb{D}^N)$  is not the  $n$ -fold Cartesian product of the  $\sigma$ -algebra  $\mathbb{D}$ . Instead, it is defined as  $\left\{\left(\times_{n = 1}^{N}\mathbb{S}_{n}\right)\mid \mathbb{S}_{1}\in \mathbb{D},\ldots ,\mathbb{S}_{N}\in \mathbb{D}\right\}$ , i.e. the set containing all Cartesian products of measurable sets.
Proposition 8. Assume that  $(\mu_{\mathbf{x}})_{\mathbf{x}\in \mathbb{A}^{N}}$  is a family of product measures on the  $N$ -dimensional measurable product space  $(\mathbb{A}^N,\mathbb{D}^N)$ , i.e. there is a family of measures  $(\kappa_{a})_{a\in \mathbb{A}}$  on  $(\mathbb{A},\mathbb{D})$  such that  $\forall \mathbf{x}\in \mathbb{A}^{N},\forall \left(\times_{n = 1}^{N}\mathbb{S}_{n}\right)\in \mathbb{D}^{N}:\mu_{\mathbf{x}}\left(\times_{n = 1}^{N}\mathbb{S}_{n}\right) = \prod_{n = 1}^{N}\kappa_{x_{n}}(\mathbb{S}_{n})$ . If group  $\mathbb{G}$  acts on  $\mathbb{A}^N$  via permutation, then the family of measures  $(\mu_{\mathbf{x}})_{\mathbf{x}\in \mathbb{X}^{N}}$  is equivariant.
Proof. Consider an arbitrary  $g \in \mathbb{G}$  with action  $T_{\mathbb{X},g} : \mathbb{A}^N \to \mathbb{A}^N$  with  $T_{\mathbb{V},g}(\boldsymbol{x})_n = x_{\pi^{-1}(n)}$ , where  $\pi : \{1, \ldots, N\} \to \{1, \ldots, N\}$  is a permutation. For any  $\left( \times_{n=1}^{N} \mathbb{S}_n \right) \in \mathbb{D}^N$ , we have
$$
\mu_ {g \bullet \boldsymbol {x}} \left(\bigotimes_ {n = 1} ^ {N} \mathbb {S} _ {n}\right) = \prod_ {n = 1} ^ {N} \kappa_ {(g \bullet \boldsymbol {x}) _ {n}} (\mathbb {S} _ {n}) = \prod_ {n = 1} ^ {N} \kappa_ {x _ {\pi - 1 (n)}} (\mathbb {S} _ {n}) = \prod_ {n = 1} ^ {N} \kappa_ {x _ {n}} (\mathbb {S} _ {\pi (n)}) = \mu_ {\boldsymbol {x}} \left(\bigotimes_ {n = 1} ^ {N} \mathbb {S} _ {\pi (n)}\right).
$$
For the second to last equality, we have just changed the iteration order of the product from  $(1,\dots ,N)$  to  $(\pi (1),\ldots ,\pi (N))$ . Finally, it follows from the definition of our group action and preimages that
$$
\begin{array}{l} \left(\bigotimes_ {n = 1} ^ {N} \mathbb {S} _ {\pi (n)}\right) = \left\{\boldsymbol {s} \in \mathbb {A} ^ {N} \mid s _ {1} \in \mathbb {S} _ {\pi (1)}, \dots , s _ {N} \in \mathbb {S} _ {\pi (N)} \right\} \\ = \left\{\boldsymbol {s} \in \mathbb {A} ^ {N} \mid s _ {\pi^ {- 1} (1)} \in \mathbb {S} _ {1}, \dots , s _ {\pi^ {- 1} (N)} \in \mathbb {S} _ {\pi (N)} \right\} \\ = \left\{\boldsymbol {s} \in \mathbb {A} ^ {N} \mid T _ {\mathbb {X}, g} (\boldsymbol {s}) \in \left(\bigotimes_ {n = 1} ^ {N} \mathbb {S} _ {n}\right) \right\} \\ = T _ {\mathbb {X}, g} ^ {- 1} \left(\bigotimes_ {n = 1} ^ {N} \mathbb {S} _ {n}\right), \\ \end{array}
$$
and thus  $\forall \pmb {x}\in \mathbb{A}^N,g\in \mathbb{G}:\mu_{g\bullet \pmb{x}} = \mu_{\pmb{x}}\circ T_{\mathbb{X},g}^{-1}$
E.2.6 Isotropic Gaussian measures
Proposition 9. Consider the measurable space  $(\mathbb{R}^{N\times D},\mathcal{B}(\mathbb{R}^{N\times D}))$ , where  $\mathcal{B}(\mathbb{R}^{N\times D})$  is the Borel  $\sigma$ -algebra on  $\mathbb{R}^{N\times D}$ . Let  $(\mu_{\mathbf{X},\sigma})_{\mathbf{X}\in \mathbb{R}^{N\times D}}$  be the family of isotropic Gaussian measures with standard deviation  $\sigma$  on  $(\mathbb{R}^{N\times D},\mathcal{B}(\mathbb{R}^{N\times D}))$ . If a group  $\mathbb{G}$  acts isometrically on  $\mathbb{R}^{N\times D}$  with respect to Frobenius norm  $||\cdot ||_2$ , then the family of measures is equivariant.
Proof. By definition of the Gaussian measure, we have for any  $\mathbb{A} \in \mathcal{B}(\mathbb{R}^{N \times D})$
$$
\begin{array}{l} \mu_ {\boldsymbol {X}, \sigma} (\mathbb {A}) = \int_ {\mathbb {A}} \prod_ {n = 1} ^ {N} \prod_ {d = 1} ^ {D} \frac {1}{\sqrt {2 \pi \sigma^ {2}}} \exp \left(- \frac {1}{2 \sigma^ {2}} (Z _ {n, d} - X _ {n, d} ^ {2})\right) d \boldsymbol {Z} \\ = \int_ {\mathbb {A}} \frac {1}{\left(\sqrt {2 \pi \sigma^ {2}}\right) ^ {N \cdot D}} \exp \left(- \frac {1}{2 \sigma^ {2}} | | \boldsymbol {Z} - \boldsymbol {X} | | _ {2} ^ {2}\right) d \boldsymbol {Z}. \\ \end{array}
$$
By change of variables, we have
$$
\begin{array}{l} \left(\mu_ {\boldsymbol {X}, \sigma} \circ T _ {\mathbb {X}, g} ^ {- 1}\right) (\mathbb {A}) = \int_ {T _ {\mathbb {X}, g} ^ {- 1} (\mathbb {A})} \frac {1}{\left(\sqrt {2 \pi \sigma^ {2}}\right) ^ {N \cdot D}} \exp \left(- \frac {1}{2 \sigma^ {2}} | | \boldsymbol {Z} - \boldsymbol {X} | | _ {2} ^ {2}\right) d \boldsymbol {Z} \\ = \int_ {\mathbb {A}} \left| \det  \left(J _ {T _ {\mathbb {X}, g} ^ {- 1}}\right) \right| \frac {1}{(\sqrt {2 \pi} \sigma) ^ {N \cdot D}} \exp \left(- \frac {1}{2 \sigma^ {2}} | | T _ {\mathbb {X}, g} ^ {- 1} (\boldsymbol {Z}) - \boldsymbol {X} | | _ {2} ^ {2}\right) d \boldsymbol {Z} \\ = \int_ {\mathbb {A}} 1 \cdot \frac {1}{\left(\sqrt {2 \pi} \sigma\right) ^ {N \cdot D}} \exp \left(- \frac {1}{2 \sigma^ {2}} | | \boldsymbol {Z} - T _ {\mathbb {X}, g} (\boldsymbol {X}) | | _ {2} ^ {2}\right) d \boldsymbol {Z} \\ = \mu_ {g \bullet \mathbf {X}, \sigma} (\mathbb {A}). \\ \end{array}
$$
The third equality follows from  $T_{\mathbb{X},g}$  being an isometry with respect to the Frobenius norm  $||\cdot||_2$ .
E.2.7 Transformation-specific measures
In transformation-specific smoothing [46, 60, 63-65], the clean input  $x \in \mathbb{X}$  is transformed via randomly sampled functions from a parametric family  $(\psi_{\theta})_{\theta \in \Theta}$  with  $\psi_{\theta} : \mathbb{X} \to \mathbb{X}$  and measurable parameter space  $(\Theta, \mathbb{G})$ . Let  $\gamma : \mathbb{G} \to \mathbb{R}_{+}$  be the corresponding parameter distribution. Then, transformation-specific smoothing induces a smoothing measure
$$
\mu_ {x} (\mathbb {A}) = \gamma \left(\left\{\theta \in \Theta \mid f _ {\theta} (x) \in \mathbb {A} \right\}\right) \tag {3}
$$