SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$\ell_0$  distance, i.e. the number of changed predictions. The task is equivariant to symmetric group  $S_{n}$  acting on  $\mathbb{X}$  and  $\mathbb{Y}$  via isomorphisms and permutations, respectively. To preserve equivariance, we use sparsity-aware measures and majority voting. The flip probabilities (see Appendix F.7) are set to  $p_{\pmb{X}}^{+} = 0, p_{\overline{\pmb{X}}}^{-} = 0, p_{\pmb{A}}^{+} = 0.001, p_{\pmb{A}}^{-} = 0.8$ . We use a 2-layer graph convolutional network [98] as our isomorphism equivariant base model  $h$ . Fig. 5 shows the resulting guarantees on Cora ML [121, 122] for graph edit perturbations of the adjacency, i.e.  $c_{\pmb{X}}^{+} = c_{\pmb{X}}^{-} = \infty$ , for varying costs  $c_{\pmb{A}}^{+}$  and  $c_{\pmb{A}}^{-}$ . We observe that increasing the cost for edge insertions significantly increases the provable robustness for the same budgets  $\epsilon$ , whereas the cost for edge deletions has virtually no effect. This suggests that insertions are much more effective at changing a model's predictions, which was empirically observed in prior work [123]. We repeat the experiment with other flip probabilities in Appendix A.3. The standard deviation of certified accuracies across all seeds was below 2.1 p.p. everywhere. Note that here, certified accuracy does not refer to the percentage of predictions that are correct and constant, but those that are correct and permute in compliance with isomorphisms of the input graph.
Deterministic edit distance certificates. In Fig. 6 we repeat the node classification experiment with our generalization of the convex polytope method from [10]. We consider feature perturbations, i.e.  $c_{\mathbf{A}}^{+} = c_{\mathbf{A}}^{-} = \infty$ , for varying  $c_{\mathbf{X}}^{+}$  and  $c_{\mathbf{X}}^{-}$ . Again, the cost of insertions has a larger effect, suggesting that the model is less robust to them. In Appendix A.3 we repeat the experiments with the four other graph edit distance certificates and also evaluate them on CiteSeer [124] and the TUDataset [125]. Overall, our generalizations of existing graph robustness guarantees us prove robustness to more complex threat models, even though evaluating the edit distance is computationally hard.
The main goal of this paper is to define adversarial robustness for group equivariant tasks. To this end, we introduce action-induced distances as the appropriate notion of input distance and consider how predictions should transform for semantics-preserving transformations of inputs. If the equivariances of a task and model match, the proposed notion of robustness can be guaranteed by proving traditional adversarial robustness. This has two consequences: Firstly, specialized certification procedures for equivariant architectures can be reused. One just has to reinterpret what is actually guaranteed by these procedures, e.g. robustness to perturbations bounded by graph edit distance. Secondly, randomized smoothing can be used to provide architecture-agnostic guarantees — but only if the smoothing scheme and measures preserve the model's equivariances. We experimentally demonstrated the generality of this equivariance-preserving randomized smoothing approach by certifying robustness for graph, point cloud and molecule models. Overall, our work provides a sound foundation for future work at the intersection of robust and geometric machine learning.
Future work. Based on Proposition 2, a direction for future work is to continue making equivariant models more robust to classic threat models, without caring about equivariance. A more interesting direction is to make attacks, defenses and certificates equivariance-aware. For instance, knowledge about model equivariances could be used to reduce the search space for attacks, disrupt gradient-based attacks (similar to [126]), or derive stronger randomized smoothing guarantees (as proposed for invariant models in [26]). Finally, developing procedures to certify non-equivariant models (e.g. vision transformers) or models that are only "almost equivariant" (e.g. due to interpolation artifacts) under the proposed notion of robustness would be desirable for equivariant computer vision tasks.
8 Acknowledgments and disclosure of funding
The authors would like to thank Hongwei Jin for assistance with the implementation of their topology attack certificates, Tom Wollschlager for providing access to code for training molecular force models, and Aman Saxena for valuable discussions concerning non-compact sets and non-isometric actions. This work has been funded by the Munich Center for Machine Learning, by the DAAD program Konrad Zuse Schools of Excellence in Artificial Intelligence (sponsored by the Federal Ministry of Education and Research), and by the German Research Foundation, grant GU 1409/4-1. The authors of this work take full responsibility for its content.
[1] Michael M Bronstein, Joan Bruna, Taco Cohen, and Petar Velickovic. Geometric deep learning: Grids, groups, graphs, geodesics, and gauges. arXiv preprint arXiv:2104.13478, 2021.
[2] Kunihiko Fukushima. Neural network model for a mechanism of pattern recognition unaffected by shift in position – neocognitron. IEICE Technical Report, A, 62(10):658–665, 1979.
[3] Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 2017.
[4] Marco Gori, Gabriele Monfardini, and Franco Scarselli. A new model for learning in graph domains. In Proceedings. 2005 IEEE International Joint Conference on Neural Networks, 2005., volume 2, pages 729-734. IEEE, 2005.
[5] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
[6] Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 427-436, 2015.
[7] Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
[8] Daniel Zügner, Amir Akbarnejad, and Stephan Gunnemann. Adversarial attacks on neural networks for graph data. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining, pages 2847-2856, 2018.
[9] Daniel Zügner and Stephan Gunnemann. Adversarial attacks on graph neural networks via meta learning. In International Conference on Learning Representations, 2019.
[10] Daniel Zügner and Stephan Gunnemann. Certifiable robustness and robust training for graph convolutional networks. In Proceedings of the 25th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2019.
[11] Aleksandar Bojchevski and Stephan Gunnemann. Certifiable robustness to graph perturbations. In Advances in Neural Information Processing Systems, 2019.
[12] Yang Liu, Jiaying Peng, Liang Chen, and Zibin Zheng. Abstract interpretation based robustness certification for graph convolutional networks. In ECAI 2020, pages 1309-1315. 2020.
[13] Daniel Zügner and Stephan Gunnemann. Certifiable robustness of graph convolutional networks under structure perturbations. In Proceedings of the 26th ACM SIGKDD International Conference on Knowledge Discovery & Data Mining, 2020.
[14] Aleksandar Bojchevski, Johannes Klicpera, and Stephan Gunnemann. Efficient robustness certificates for discrete data: Sparsity-aware randomized smoothing for graphs, images and more. In International Conference on Machine Learning, 2020.
A.1 Point cloud classification
Different smoothing standard deviations. In Fig. 7 we repeat our experiments on permutation invariant point cloud classification for different smoothing standard deviations  $\sigma \in \{0.05, 0.1, 0.15, 0.25\}$ . The maximum certifiable correspondence distance  $\epsilon$  increases linearly with  $\sigma$ . For  $\sigma = 0.05$ , the average natural accuracy (i.e. certified accuracy at  $\epsilon = 0$ ) of the smoothed PointNet and DGCNN models is  $88\%$  and  $90.4\%$ , respectively. Their certified accuracies are almost identical for most  $\epsilon$ . For the larger  $\sigma = 0.25$ , their accuracy decreases to  $75.5\%$  and  $79.9\%$ , respectively, i.e. the difference in accuracy grows by  $2\mathrm{p.p.}$ . DGCNN also offers stronger robustness guarantees with certified accuracies that are up to  $6.3\mathrm{p.p.larger}$ . The most important takeaway should however be that equivariance-preserving randomized smoothing provides sound robustness guarantees for equivariant tasks where discrete groups act on continuous data.
(a)  $\sigma = 0.05$
(b)  $\sigma = 0.1$
(c)  $\sigma = 0.15$
(d)  $\sigma = 0.25$
Figure 7: Provable robustness of smoothed PointNet and DGCNN point cloud classifiers on ModelNet40 for different smoothing standard deviations  $\sigma$ . Correspondence distance  $\epsilon$  is the Frobenius distance between point clouds after finding an optimal matching via permutation. For larger  $\sigma$ , DGCNN offers better accuracy and provable robustness than PointNet.
Comparison to 3DVerifier. As shown in Fig. 7, Gaussian randomized smoothing with  $\sigma \in [0.05, 0.25]$  lets us retain relatively high accuracy while certifying robustness to correspondence distance perturbations of sizes up to  $\epsilon = 0.8$ . However, as discussed in Section 5, Proposition 2 does not make any assumptions about how we prove traditional adversarial robustness. For example, 3DVerifier [92], which is a specialized certification procedure for PointNet, can on average prove robustness robustness to  $\ell_2$  norm perturbations of size  $\epsilon = 0.959$  (see Table 2 in [92]). Because both the point cloud classification task and the PointNet architecture are permutation invariant, this directly translates to correspondence distance perturbations with an average size of 0.959. This experiment demonstrates that developing specialized certification procedures for a wider range of equivariant models is a promising direction for future work. Nevertheless, equivariance-preserving randomized smoothing remains valuable as a general-purpose certification procedure. For instance, 3DVerifier cannot prove robustness for DGCNN or other point cloud classification architectures.
A.2 Molecular force prediction
Different smoothing standard deviations. In Fig. 8 we repeat our experiments on permutation and isometry equivariant force prediction on MD17 with different smoothing standard deviations  $\sigma \in \{10\mathrm{fm},100\mathrm{fm}\}$ . The maximum certifiable registration distance grows linearly with  $\sigma$ . This is inherent to Gaussian smoothing (see [20]). The average certified output distance  $\delta$  also grows approximately linearly. This can potentially be explained as follows: In a sufficiently small region around clean input  $\mathbf{X}$ , the model may have approximately linear behavior. If  $\sigma$  is small, the output distribution will be similar to a normal distribution whose covariances grow linearly with  $\sigma^2$ . The certified  $\delta$  of center smoothing are always between the median and maximum sampled distance from the smoothed prediction (see [93]), which will in this case also increase approximately linearly.
Different base models. In Appendix A.2 we repeat our experiment with  $\sigma = 1$  fm and different base models, namely SchNet [119] and SphereNet [120]. SphereNet achieves lower average test errors between 0.45 and  $1.4\mathrm{kcal / mol / A}$  than SchNet, which has test errors between between 0.51 and  $1.89\mathrm{kcal / mol / A}$ . However, the provable robustness guarantees obtained for SphereNet are worse than those for SchNet by more than an order of magnitude. For adversarial budgets of up to  $2\mathrm{fm}$ , the average certified output distance  $\delta$  for SphereNet varies between  $0.35\mathrm{kcal / mol / A}$  (Benzene) and  $1.61\mathrm{kcal / mol / A}$  (Malonaldehyde). For comparison, the average certified output  $\delta$  for SchNet vary between  $0.04\mathrm{kcal / mol / A}$  (Ethanol) and  $0.12\mathrm{kcal / mol / A}$  (Uracil) and are quite similar (but not identical to) those for DimeNet++. We also observe a much higher variance across random seeds.
Conclusion. While these observations may be of interest to some readers that are specifically interested in machine learning for molecules, the most important takeaway should be that equivariance-preserving randomized smoothing can be used to obtain sound robustness guarantees for equivariant tasks in which continuous groups act on continuous data.
(a)  $\sigma = 10\mathrm{fm}$
(b)  $\sigma = 100\mathrm{fm}$
Figure 8: Provable robustness of smoothed DimeNet++ force predictions on MD17 with smoothing standard deviations  $\sigma \in \{10\mathrm{fm},100\mathrm{fm}\}$ . The average certified output distance  $\delta$  and the maximum certifiable registration distance  $\epsilon$  grow (approximately) linearly with  $\sigma$ .
(a) SchNet
(b)SphereNet
Figure 9: Provable robustness of smoothed SchNet and SphereNet force predictions on MD17 with a smoothing standard deviation  $\sigma = 1$  fm. While SphereNet is more accurate, its provable robustness guarantees are weaker and have higher variance across different random weight initializations.
A.3 Node and graph classification
Next, we evaluate the different robustness guarantees for graph and node classification that we generalized to graph edit distance perturbations with user-specified costs (see Appendix F).
Convex outer adversarial polytopes for attribute perturbations. In Fig. 11 we repeat our experiment on proving the robustness of 2-layer graph convolutional networks to graph edit distance perturbations. We use our generalization of the convex relaxation approach (see Appendix F.3), which was originally proposed in [10], on the CiteSeer [124] node classification dataset. As before, we set  $c_{\mathbf{A}}^{+} = c_{\mathbf{A}}^{-} = \infty$  and vary the cost of attribute insertion  $c_{\mathbf{X}}^{+}$ and deletion  $c_{\mathbf{X}}^{-}$ . The result is qualitatively similar to our results on Cora-ML. Increasing the cost of attribute insertions leads to significantly higher certified accuracy. With  $c_{\mathbf{X}}^{-} = 1$ , the average certified accuracy for  $c_{\mathbf{X}}^{+} = 4$  at edit distance  $\epsilon = 25$  is  $23.4\%$ , which is much larger than the  $6.6\%$  for  $c_{\mathbf{X}}^{+} = 1$ . Increasing the cost of deletions does however not have a noticeable effect, which matches the empirical observation that insertions are more effective when attacking graph neural networks [123]. The main difference to Cora-ML is that we have a larger standard deviation across seeds. This is not necessarily surprising, since many graph benchmarks are known to be sensitive to the choice of data split and model initialization [127]. Note that the split and initialization for each seed are the same in all experiments.
Figure 10: Convex outer adversarial polytope robustness guarantees for GCNs under attribute perturbations on Cora-ML.
Figure 11: Convex outer adversarial polytope robustness guarantees for GCNs under attribute perturbations on Citeseer.
Interval bound propagation for attribute perturbations. In Figs. 12 and 13 we repeat the same experiment using our generalization of the interval bound propagation approach (see Appendix F.2) originally proposed in [12]. Unlike before, increasing a single cost parameter while keeping the other one at 1 has no noticeable effect on the certified accuracy. A potential explanation is that interval bound propagation only offers very loose guarantees. For example, the maximum certifiable edit distance on Cora (see Fig. 12) is 10, compared to over 50 with the previously discussed convex relaxation approach. The relaxation might simply be too loose to accurately capture the effect of different perturbation types on the models.
Figure 12: Interval bound propagation robustness guarantees for GCNs under attribute perturbations on Cora-ML.
Figure 13: Interval bound propagation robustness guarantees for GCNs under attribute perturbations on Citeseer.
Policy iteration for adjacency perturbations. Next, we consider perturbations of the adjacency matrix. We begin with our generalization of the policy iteration approach (see Appendix F.6)
originally proposed in [11]. This robustness guarantee is specifically designed for  $\pi$ -PPNP, which is APPNP [99] where the degree normalized adjacency matrix  $D^{-1/2}AD^{-1/2}$  is replaced with  $D^{-1}A$ . Different from the other guarantees, we do not have a single global budget  $\epsilon$ . Instead, we only have nodewise budgets  $\rho_1,\ldots,\rho_N$  with  $\rho_n = (D_{n,n} - c + s)$  with an arbitrarily chosen constant  $c$  and attack strength  $s$ . Like in [11], we set  $c = 11$  and vary attack strength  $s$ . Figs. 14 and 15 show the resulting certified accuracies on Cora-ML and CiteSeer for  $c_X^+ = c_X^- = \infty$  and varying  $c_A^+$ ,  $c_A^-$ . Again, increasing the cost of adversarial perturbations to  $c_A^+ = 4$  has a larger effect, in some cases almost tripling the certified accuracy. But there is also a small increase of up to 2.9 p.p. certified accuracy when increasing the deletion cost  $c_A^-$  from 1 to 4 on CiteSeer.
Figure 14: Robustness guarantees for  $\pi$ -PPNP under adjacency perturbations on Cora-ML. Note that we do not have a global budget  $\epsilon$  and instead vary per-node budgets.
Figure 15: Robustness guarantees for  $\pi$ -PPNP under adjacency perturbations on Citeseer. Note that we do not have a global budget  $\epsilon$  and instead vary per-node budgets.
Figure 16: Linearization and dualization robustness guarantees for GCN graph classifiers under adjacency perturbations on PROTEINS.
Figure 17: Linearization and dualization robustness guarantees for GCN graph classifiers under adjacency perturbations on MUTAG.
Bilinear programming for adjacency perturbations. Generalizing the bilinear programming method for proving robustness of GCNs to adjacency perturbations proposed in [13] from  $c_{\mathbf{X}}^{+}, c_{\mathbf{X}}^{-}, c_{\mathbf{A}}^{+} = \infty, c_{\mathbf{X}}^{-} = 1$  to  $c_{\mathbf{X}}^{-} \in \mathbb{R}_{+}$  does not require any modifications, since scaling the cost is equivalent to scaling the adversarial budgets (see Appendix F.4). We thus refer to [13] for experimental results.
Linearization and dualization for adjacency perturbations. Next, we consider GCN-based node classifiers and adjacency perturbations. We prove robustness via our generalization of the procedure proposed in [15]. This guarantee is specifically designed for single layer GCNs followed by a linear layer and max-pooling. Since Cora-ML and CiteSeer are node classification datasets, we instead use the PROTEINS and MUTAG datasets from the TUDataset [125] collection, which were also used in [15]. Figs. 16 and 17 show the resulting certified accuracies for fixed  $c_{X}^{+} = c_{X}^{-} = \infty$  and varying adjacency perturbation costs  $c_{A}^{+}$ and  $c_{A}^{-}$ . Unlike in all previous experiments, increasing the cost of deletions also leads to a significant increase for the same edit distance budget  $\epsilon$ . On PROTEINS, choosing  $c_{A}^{+} = 1$  and  $c_{A}^{-} = 4$  even yields stronger robustness guarantees than  $c_{A}^{+} = 4$  and  $c_{A}^{-} = 1$ . For example, the average certified accuracies for budget  $\epsilon$  are  $61.2\%$  and  $55.6\%$ , respectively (see Fig. 16). This may be caused by one of multiple factory. Firstly, we have a different task - graph instead of node classifier. Secondly, we have a different architecture that aggregates
information from the entire graph via max-pooling instead of just using local information. Thirdly, the considered graphs have a significantly different distribution than Cora-ML and Citeseer. For instance, Cora-ML and Citeser consist of 2708 and 3327 nodes, respectively, whereas the average number of nodes in PROTEINS and MUTAG is 17.9 and 39.1. Cora-ML and Citeseer also have much sparser adjacency matrices, with just  $0.14\%$  and  $0.08\%$  non-zero entries.
Sparsity-aware randomized smoothing for attribute and adjacency perturbations. Finally, we perform additional experiments with sparsity-aware randomized smoothing [14]. As we discussed in Section 5.1, this randomized smoothing method preserves isomorphism equivariance and can thus be used to prove adversarial robustness for arbitrary isomorphism equivariant models and tasks w.r.t. graph edit distance and both attribute and adjacency perturbations. Figs. 18 to 29 show the certified accuracy of graph convolutional networks, graph attention networks [128] (GAT), and APPNP on Cora-ML and Citeseer for varying costs of attribute and adjacency perturbations with smoothing parameters  $p_{\mathbf{X}}^{+} = 0.001$ ,  $p_{\mathbf{X}}^{-} = 0.8$ ,  $p_{\mathbf{A}}^{+} = 0$ ,  $p_{\mathbf{A}}^{-} = 0$  and  $p_{\mathbf{X}}^{+} = 0$ ,  $p_{\mathbf{X}}^{-} = 0$ ,  $p_{\mathbf{A}}^{+} = 0.001$ ,  $p_{\mathbf{A}}^{-} = 0.8$ . While the different models and datasets differ slightly with respect to (certified) accuracy, we observe the same effect as in our previous node classification experiments: Only increasing the cost of insertions has a large effect on provable robustness for any graph edit distance  $\epsilon$ , which suggests that these perturbations are significantly more effective at changing the prediction of the models.
Conclusion. Overall, there are three main takeaways from evaluating the different graph edit distance robustness guarantees. Firstly, even though evaluating the graph edit distance is not tractable, it is possible to prove robust under it to provide sound robustness guarantees for isomorphism equivariant tasks. Secondly, unless they use very loose relaxations (like interval bound propagation), generalizing existing guarantees to non-uniform costs provides more fine-grained insights into the adversarial robustness of different graph and node classification architectures. Thirdly, equivariance-preserving randomized smoothing is an effective way of obtaining sound robustness guarantees for equivariant tasks where discrete groups act on discrete data.
Figure 18: Randomized smoothing robustness guarantees for GCNs under attribute perturbations on Cora-ML. The Smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0.001, p_{\mathbf{X}}^{-} = 0.8, p_{\mathbf{A}}^{+} = 0, p_{\mathbf{A}}^{-} = 0$ .
Figure 19: Randomized smoothing robustness guarantees for GCNs under adjacency perturbations on Cora-ML. The smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0, p_{\mathbf{X}}^{-} = 0, p_{\mathbf{A}}^{+} = 0.001, p_{\mathbf{A}}^{-} = 0.8$ .
Figure 20: Randomized smoothing robustness guarantees for GCNs under attribute perturbations on CiteSeer. The Smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0.001, p_{\mathbf{X}}^{-} = 0.8, p_{\mathbf{A}}^{+} = 0, p_{\mathbf{A}}^{-} = 0$ .
Figure 21: Randomized smoothing robustness guarantees for GCNs under adjacency perturbations on CiteSeer. The smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0, p_{\mathbf{X}}^{-} = 0, p_{\mathbf{A}}^{+} = 0.001, p_{\mathbf{A}}^{-} = 0.8$ .
Figure 22: Randomized smoothing robustness guarantees for GATs under attribute perturbations on Cora-ML. The Smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0.001, p_{\mathbf{X}}^{-} = 0.8, p_{\mathbf{A}}^{+} = 0, p_{\mathbf{A}}^{-} = 0$ .
Figure 23: Randomized smoothing robustness guarantees for GATs under adjacency perturbations on Cora-ML. The smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0, p_{\mathbf{X}}^{-} = 0, p_{\mathbf{A}}^{+} = 0.001, p_{\mathbf{A}}^{-} = 0.8$ .
Figure 24: Randomized smoothing robustness guarantees for GATs under attribute perturbations on CiteSeer. The Smoothing parameters are set to  $p_{X}^{+} = 0.001, p_{X}^{-} = 0.8, p_{A}^{+} = 0, p_{A}^{-} = 0$ .
Figure 25: Randomized smoothing robustness guarantees for GATs under adjacency perturbations on Citeuser. The smoothing parameters are set to  $p_{\mathbf{X}}^{+} = 0, p_{\mathbf{X}}^{-} = 0, p_{\mathbf{A}}^{+} = 0.001, p_{\mathbf{A}}^{-} = 0.8$ .