SlowGuess/NeurIPS_2023_OCR huggingface dataset:
$$
\frac {1}{2} \frac {1}{n} \sum_ {i = 1} ^ {n} \left(\Sigma^ {- 1} \delta_ {i} \left[ \nabla_ {x} f \left(x _ {0} + \delta_ {i}\right) \right] ^ {T}\right) + \frac {1}{2} \frac {1}{n} \sum_ {i = 1} ^ {n} \left(\nabla_ {x} f \left(x _ {0} + \delta_ {i}\right) \delta_ {i} ^ {T} \Sigma^ {- 1}\right) \tag {39c}
$$
Now, we show the convergence of our estimator  $\hat{H}_n$ :
Lemma 5.  $\lim_{n\to \infty}\hat{H}_n = H$
Proof. From Proposition 1 it is clear to see that  $\lim_{n\to \infty}H_n^\circ = H$
$$
\lim  _ {n \rightarrow \infty} H _ {n} ^ {\circ} = \lim  _ {n \rightarrow \infty} \frac {1}{n} \sum_ {i = 1} ^ {n} \Sigma^ {- 1} \delta_ {i} [ \nabla_ {x} f (x _ {0} + \delta_ {i}) ] ^ {T} = \mathbb {E} _ {\delta} [ \Sigma^ {- 1} \delta [ \nabla_ {x} f (x _ {0} + \delta) ] ^ {T} ] \stackrel {\text {P r o p}} {=} ^ {1} H. \tag {40}
$$
Next, we show it is also the case that  $\lim_{n\to \infty}H_n^{\circ T} = H$
$$
\lim  _ {n \rightarrow \infty} H _ {n} ^ {\circ T} = \lim  _ {n \rightarrow \infty} \frac {1}{n} \sum_ {i = 1} ^ {n} \nabla_ {x} f \left(x _ {0} + \delta_ {i}\right) \delta_ {i} ^ {T} \Sigma^ {- 1} = \tag {41a}
$$
$$
\lim  _ {n \rightarrow \infty} \frac {1}{n} \sum_ {i = 1} ^ {n} \left(\Sigma^ {- 1} \delta_ {i} \left[ \nabla_ {x} f \left(x _ {0} + \delta_ {i}\right)\right] ^ {T}\right) ^ {T} = \left(\lim  _ {n \rightarrow \infty} \frac {1}{n} \sum_ {i = 1} ^ {n} \Sigma^ {- 1} \delta_ {i} \left[ \nabla_ {x} f \left(x _ {0} + \delta_ {i}\right)\right] ^ {T}\right) ^ {T} = \tag {41b}
$$
$$
\left(\mathbb {E} _ {\delta} \left[ \Sigma^ {- 1} \delta \left[ \nabla_ {x} f (x _ {0} + \delta) \right] ^ {T} \right]\right) ^ {T} \stackrel {{\text {P r o p}}} {{=}} ^ {1} H ^ {T} = H \quad \tag {41c}
$$
Now, as we have  $\lim_{n\to \infty}H_n^\circ = \lim_{n\to \infty}H_n^{\circ T} = H$ , it follows that
$$
\lim  _ {n \rightarrow \infty} \hat {H} _ {n} = \lim  _ {n \rightarrow \infty} \frac {1}{2} H _ {n} ^ {\circ} + \lim  _ {n \rightarrow \infty} \frac {1}{2} H _ {n} ^ {\circ T} = \frac {1}{2} H + \frac {1}{2} H = H \tag {42}
$$
We establish the following notation to be used below: given a fixed vector  $\delta \in \mathbb{R}^d$  one may construct matrix  $A_{\delta}\in \mathbb{R}^{d\times d}$  by:
$$
A _ {\delta} = \frac {1}{2} \left(\Sigma^ {- 1} \delta \left[ \nabla_ {x} f \left(x _ {0} + \delta\right) \right] ^ {T}\right) + \frac {1}{2} \left(\nabla_ {x} f \left(x _ {0} + \delta\right) \delta^ {T} \Sigma^ {- 1}\right) \in \mathbb {R} ^ {d \times d} \tag {43}
$$
It can be seen from Eq. 39 and Lemma 5 that  $H$  and  $\hat{H}_n$  may be expressed in terms of matrices  $A_{\delta}$  and  $A_{\delta_i}$ :
$$
H = \mathbb {E} _ {\delta} \left[ A _ {\delta} \right], \quad \hat {H} _ {n} = \frac {1}{n} \sum_ {i = 1} ^ {n} A _ {\delta_ {i}} \tag {44}
$$
Next, we establish that the random vectors  $\Sigma^{-1}\delta$  and  $\nabla f(x_0 + \delta)$  are sub-gaussian:
Lemma 6. The random vectors  $\Sigma^{-1}\delta$  and  $\nabla f(x_0 + \delta)$  are sub-gaussian.
Proof. As  $\Sigma^{-1}\delta$  is Gaussian it is sub-gaussian. Now, we show that  $\nabla f(x_0 + \delta)$  is a sub-gaussian random-vector. We have that  $f$  is piecewise-linear over a partition of  $\mathbb{R}^d$  with finite cardinality  $L$ . Let us denote this partition as  $\mathcal{Q} = \{Q_i\}_{i=1}^L$ ,  $Q_i \subseteq \mathbb{R}^d$ , where, when restricted to a given  $Q \in \mathcal{Q}$  we have
$$
f | _ {Q} (x) = V _ {Q} x + A _ {Q} \tag {45}
$$
where  $V_{Q}\in \mathbb{R}^{d},A_{Q}\in \mathbb{R}$  are the affine coefficients associated with the region  $Q$ . Then it is the case that  $\nabla f:\mathbb{R}^d\to \mathbb{R}$  is a bounded function, where, aside from a set of measure 0,  $M\subseteq \mathbb{R}^d$  (the boundaries of regions  $Q$ ) where  $\nabla f$  is not defined, one has
$$
\| \nabla f (x) \| _ {2} \leq \max  _ {Q \in \mathcal {Q}} \| V _ {Q} \| _ {2}, \forall x \in \mathbb {R} ^ {d} \backslash M. \tag {46}
$$
Thus,  $\nabla f(x_0 + \delta)$  is a bounded random vector and therefore is sub-gaussian.
Given the operators  $\lambda^{+},\lambda^{-}:\mathbb{R}^{d\times d}\to \mathbb{R}$  as defined in the statement of Lemma 4 and fixed vector  $\delta \in \mathbb{R}^d$ , we denote  $\lambda_{\delta}^{+}:= \lambda^{+}(A_{\delta}),\lambda_{\delta}^{-}:= \lambda^{-}(A_{\delta})$  and the corresponding unit eigenvectors as  $v_{\delta}^{+}\in \mathbb{R}^{d}$  and  $v_{\delta}^{-}\in \mathbb{R}^{d}$  respectively. We denote random vectors  $w_{\delta}^{+},w_{\delta}^{-}\in \mathbb{R}^{d}$  by
$$
w _ {\delta} ^ {+} = \sqrt {\lambda_ {\delta} ^ {+}} v _ {\delta} ^ {+}, \quad w _ {\delta} ^ {-} = \sqrt {- \lambda_ {\delta} ^ {-}} v _ {\delta} ^ {-} \tag {47}
$$
where  $\sqrt{\lambda_{\delta}^{+}}$  and  $v_{\delta}^{+}$  are a random variable random vector pair coming from the same  $\delta$ . An immediate consequence of Lemma 6 is that  $w_{\delta}^{+}$  and  $w_{\delta}^{-}$  are sub-gaussian random vectors:
Lemma 7.  $w_{\delta}^{+}$  and  $w_{\delta}^{-}$  are sub-gaussian random-vectors
Proof. Using Lemma 4(3), Lemma 4(2) and Lemma 6 we see that  $\lambda_{\delta}^{+}$  and  $-\lambda_{\delta}^{-}$  are non-negative sub-exponential random variables and thus that  $\sqrt{\lambda_{\delta}^{+}}$  and  $\sqrt{-\lambda_{\delta}^{-}}$  are sub-gaussian random variables. We may say  $w_{\delta}^{+}$  is a sub-gaussian random vector if  $\langle w_{\delta}^{+}, z \rangle$  is a sub-gaussian random variable  $\forall z \in \mathbb{R}^d$ . Let us fix arbitrary  $z \in \mathbb{R}^d$ . As  $\sqrt{\lambda_{\delta}^{+}}$  is sub-gaussian we have
$$
\exists K _ {1} > 0 \text {s . t .} \mathbb {P} \left(\left| \sqrt {\lambda_ {\delta} ^ {+}} \right| \geq t\right) \leq 2 \exp \left(- t ^ {2} / K _ {1} ^ {2}\right) \forall t \geq 0 \tag {48a}
$$
Now,  $\forall t\geq 0$
$$
\mathbb {P} \left(\left| \langle w _ {\delta} ^ {+}, z \rangle \right| \geq t\right) = \mathbb {P} \left(\left| \sqrt {\lambda_ {\delta} ^ {+}} \langle v _ {\delta} ^ {+}, z \rangle \right| \geq t\right) = \tag {49a}
$$
$$
\mathbb {P} \left(\left| \sqrt {\lambda_ {\delta} ^ {+}} \right| \geq t / \left| \langle v _ {\delta} ^ {+}, z \rangle \right|\right) \overset {\mathrm {C - S}, \| v _ {\delta} ^ {+} \| _ {2} = 1} {\leq} \mathbb {P} \left(\left| \sqrt {\lambda_ {\delta} ^ {+}} \right| \geq t / \| z \| _ {2}\right) \leq 2 \exp \left(- \left(t ^ {2} / \| z \| _ {2} ^ {2} K _ {1} ^ {2}\right)\right) \tag {49b}
$$
Thus defining  $K_1^{(z)} \coloneqq K_1\| z\| _2$  we see that  $\forall t\geq 0$
$$
\mathbb {P} \left(\left| \langle w _ {\delta} ^ {+}, z \rangle \right| \geq t\right) \leq \exp \left(- t ^ {2} / \left(K _ {1} ^ {(z)}\right) ^ {2}\right). \tag {50}
$$
Thus  $\langle w_{\delta}^{+},z\rangle$  is sub-gaussian for arbitrary  $z\in \mathbb{R}^d$ . Therefore,  $w_{\delta}^{+}$  is a sub-gaussian random-vector. The same argument holds to show that  $w_{\delta}^{-}$  is a sub-gaussian random vector.
Given any fixed  $\delta$ , it can be seen that
$$
A _ {\delta} = w _ {\delta} ^ {+} w _ {\delta} ^ {+ T} - w _ {\delta} ^ {-} w _ {\delta} ^ {- T}. \tag {51}
$$
Thus one may re-write  $H$  and  $\hat{H}_n$  from Eq. 44 as:
$$
H = \mathbb {E} _ {\delta} \left[ A _ {\delta} \right] = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {+} w _ {\delta} ^ {+ T} - w _ {\delta} ^ {-} w _ {\delta} ^ {- T} \right], \quad \hat {H} _ {n} = \frac {1}{n} \sum_ {i = 1} ^ {n} A _ {\delta_ {i}} = \frac {1}{n} \sum_ {i = 1} ^ {n} w _ {\delta_ {i}} ^ {+} w _ {\delta_ {i}} ^ {+ T} - w _ {\delta_ {i}} ^ {-} w _ {\delta_ {i}} ^ {- T}. \tag {52}
$$
Because  $\{\delta_i\}_{i=1}^n$  are i.i.d. random vectors and  $w_{\delta_i}^+, w_{\delta_i}^-$  are fully determined by  $\delta_i$ , it follows that  $\{w_{\delta_i}^+\}_{i=1}^n$  and  $\{w_{\delta_i}^-\}_{i=1}^n$  are both sets of i.i.d. random vectors.
We denote the following:
$$
H ^ {+} = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {+} w _ {\delta} ^ {+ T} \right], \quad H ^ {-} = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {-} w _ {\delta} ^ {- T} \right], \tag {53a}
$$
$$
\hat {H} _ {n} ^ {+} = \frac {1}{n} \sum_ {i = 1} ^ {n} w _ {\delta_ {i}} ^ {+} w _ {\delta_ {i}} ^ {+ T}, \quad \hat {H} _ {n} ^ {-} = \frac {1}{n} \sum_ {i = 1} ^ {n} w _ {\delta_ {i}} ^ {-} w _ {\delta_ {i}} ^ {- T} \tag {53b}
$$
It can be seen from the RHS of Eq. (52) that
$$
\hat {H} _ {n} = \hat {H} _ {n} ^ {+} - \hat {H} _ {n} ^ {-}. \tag {54}
$$
We now aim to decompose  $H$  in terms of  $H^{+}$ ,  $H^{-}$ , in order to derive separate concentration bounds. To this end, we prove the following lemma:
Lemma 8.  $H^{+}$  and  $H^{-}$  exist.
Proof. Let us consider the random matrix  $w_{\delta}^{+}w_{\delta}^{+T}\in \mathbb{R}^{d\times d}$ . As  $(w_{\delta}^{+})_k\in \mathbb{R}$  is sub-gaussian  $\forall k\in D$ , the element  $(w_{\delta}^{+}w_{\delta}^{+T})_{ij}\in \mathbb{R}$  is sub-exponential as the product of two sub-gaussian's,  $\forall i,j\in D$ . Thus,  $\mathbb{E}_{\delta}[(w_{\delta}^{+}w_{\delta}^{+T})_{ij}]$  exists  $\forall i,j\in D$ . The same argument can be made to show  $\mathbb{E}_{\delta}[(w_{\delta}^{-}w_{\delta}^{-T})_{ij}]$  exists  $\forall i,j\in D$ .
In light of Lemma 8, the LHS of Eq. (52) may be decomposed as
$$
H = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {+} w _ {\delta} ^ {+ T} - w _ {\delta} ^ {-} w _ {\delta} ^ {- T} \right] = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {+} w _ {\delta} ^ {+ T} \right] - \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {-} w _ {\delta} ^ {- T} \right] = H ^ {+} - H ^ {-}. \tag {55}
$$
Before deriving separate concentration bounds on  $\hat{H}_n^+$  and  $\hat{H}_n^-$  we note that
$$
\lim  _ {n \rightarrow \infty} \hat {H} _ {n} ^ {+} = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {+} w _ {\delta} ^ {+ T} \right], \quad \lim  _ {n \rightarrow \infty} \hat {H} _ {n} ^ {-} = \mathbb {E} _ {\delta} \left[ w _ {\delta} ^ {-} w _ {\delta} ^ {- T} \right]. \tag {56}
$$
Finally, we bound the deviation of  $\hat{H}_n^+$  and  $\hat{H}_n^-$  from their expectations. Let us fix  $\varepsilon, \gamma \in (0,1]$ . From Eq. (55), and the fact that  $\{w_{\delta_i}^+\}_{i=1}^n$  is a set of i.i.d. sub-gaussian random vectors, Theorem 3.39, Remark 3.40 of Vershynin [87] may be applied, yielding:  $\forall t \geq 0$
$$
\mathbb {P} \left(\| \hat {H} _ {n} ^ {+} - H ^ {+} \| _ {2} > \max  \left(\varepsilon_ {n} ^ {+}, \left(\varepsilon_ {n} ^ {+}\right) ^ {2}\right)\right) \leq 2 \exp \left(- c ^ {+} t ^ {2}\right) \tag {57}
$$
where  $\varepsilon_{n}^{+} = C^{+}\frac{\sqrt{d}}{\sqrt{n}} +\frac{t}{\sqrt{n}}$  and  $C^+$ $c_{+} > 0$  are constants depending on the sub-gaussian norm of  $w_{\delta_i}^+$ . Let us select  $t = \sqrt{\frac{\log(4 / \gamma)}{c^+}}$ . Plugging into Eq. (57), we get
$$
\mathbb {P} \left(\| \hat {H} _ {n} ^ {+} - H ^ {+} \| _ {2} > \max  \left(C ^ {+} \frac {\sqrt {d}}{\sqrt {n}} + \frac {\sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}}{\sqrt {n}}, \left(C ^ {+} \frac {\sqrt {d}}{\sqrt {n}} + \frac {\sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}}{\sqrt {n}}\right) ^ {2}\right)\right) \leq \frac {\gamma}{2} \tag {58}
$$
Let us consider  $n^+ = \frac{4}{\varepsilon^2} (C^+\sqrt{d} +\sqrt{\frac{\log(4 / \gamma)}{c^+}})^2$  . One may see that
$$
\varepsilon_ {n ^ {+}} ^ {+} = C ^ {+} \frac {\sqrt {d}}{\sqrt {n ^ {+}}} + \frac {\sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}}{\sqrt {n ^ {+}}} = \tag {59a}
$$
$$
C ^ {+} \frac {\varepsilon \sqrt {d}}{2 \left(C ^ {+} \sqrt {d} + \sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}\right)} + \frac {\varepsilon \sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}}{2 \left(C ^ {+} \sqrt {d} + \sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}\right)} = \tag {59b}
$$
$$
\frac {\varepsilon}{2} \frac {C ^ {+} \sqrt {d} + \sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}}{C ^ {+} \sqrt {d} + \sqrt {\frac {\log (4 / \gamma)}{c ^ {+}}}} = \frac {\varepsilon}{2} \tag {59c}
$$
Thus, given  $n = n^+$  one has  $\varepsilon_n^+ = \max (\frac{\varepsilon}{2},\frac{(\varepsilon}{2})^2) = \frac{\varepsilon}{2}$ , because  $\frac{\varepsilon}{2} < \varepsilon \leq 1$ , and that
$$
\mathbb {P} \left(\| \hat {H} _ {n} ^ {+} - H ^ {+} \| _ {2} > \frac {\varepsilon}{2}\right) \leq \frac {\gamma}{2}. \tag {60}
$$
In fact, because  $\varepsilon_{n}^{+}$  is monotonically decreasing in  $n$ , given  $n \geq n^{+}$  Eq. (60) holds.
The same logic above may be used to show that there exists constants  $C^{-}, c^{-} > 0$  depending on the sub-gaussian norm of  $w_{\delta}^{-}$  such that, given  $n \geq n^{-} = \frac{4}{\varepsilon^2} (C^{-}\sqrt{d} + \sqrt{\frac{\log(4 / \gamma)}{c^{-}}})^2$  one has
$$
\mathbb {P} \left(\| \hat {H} _ {n} ^ {-} - H ^ {-} \| _ {2} > \frac {\varepsilon}{2}\right) \leq \frac {\gamma}{2}. \tag {61}
$$
Finally, we combine the two bounds from Eq. (61) and Eq. (60). Given  $n \geq \max \left( \frac{4}{\varepsilon^2} \left( C^+ \sqrt{d} + \sqrt{\frac{\log(4 / \gamma)}{c^+}} \right)^2, \frac{4}{\varepsilon^2} \left( C^- \sqrt{d} + \sqrt{\frac{\log(4 / \gamma)}{c^-}} \right)^2 \right)$  we have
$$
\mathbb {P} \left(\| \hat {H} _ {n} - H \| _ {2} > \varepsilon\right) = \mathbb {P} \left(\| \hat {H} _ {n} ^ {+} - \hat {H} _ {n} ^ {-} - H ^ {+} + H ^ {-} \| _ {2} > \varepsilon\right) = \quad \text {(E q . (5 5) E q . (5 4)) (6 2 a)}
$$
$$
\mathbb {P} \left(\left\| \left(\hat {H} _ {n} ^ {+} - H ^ {+}\right) - \left(\hat {H} _ {n} ^ {-} - H ^ {-}\right) \right\| _ {2} > \varepsilon\right) \leq \tag {62b}
$$
$$
\mathbb {P} \left(\left\| \left(\hat {H} _ {n} ^ {+} - H ^ {+}\right) \right\| _ {2} + \left\| \left(\hat {H} _ {n} ^ {-} - H ^ {-}\right) \right\| _ {2} > \varepsilon\right) \leq \tag {62c}
$$
$$
\mathbb {P} \left(\| \hat {H} _ {n} ^ {+} - H ^ {+} \| _ {2} > \frac {\varepsilon}{2} \cup \| \hat {H} _ {n} ^ {-} - H ^ {-} \| _ {2} > \frac {\varepsilon}{2}\right) \leq \tag {62d}
$$
$$
\mathbb {P} \left(\| \hat {H} _ {n} ^ {+} - H ^ {+} \| _ {2} > \frac {\varepsilon}{2}\right) + \mathbb {P} \left(\| \hat {H} _ {n} ^ {-} - H ^ {-} \| _ {2} > \frac {\varepsilon}{2}\right) \leq \tag {Union bound}
$$
$$
\frac {\gamma}{2} + \frac {\gamma}{2} = \gamma \quad \text {(E q . (6 0) E q . (6 1)) (6 2 f)}
$$
D.1 Quadratic Optimization
Given a function  $f: \mathbb{R}^d \to \mathbb{R}$ , point  $x_0 \in \mathbb{R}^d$  gradient Hessian pair  $G \in \mathbb{R}^d$ ,  $H \in \mathbb{R}^{d \times d}$  and a magnitude constraint  $\varepsilon > 0$ , we aim to solve the following optimization:
$$
\min  _ {\Delta \in \mathbb {R} ^ {d}} f (x _ {0}) + G ^ {T} (\Delta - x _ {0}) + \frac {1}{2} (\Delta - x _ {0}) ^ {T} H (\Delta - x _ {0}), \quad s. t. \quad \| \Delta - x _ {0} \| _ {2} \leq \varepsilon , \tag {63}
$$
as  $f(x_0)$  is constant, the problem above is equivalent to
$$
\min  _ {\delta \in \mathbb {R} ^ {d}} G ^ {T} \delta + \frac {1}{2} \delta^ {T} H \delta , \quad s. t. \quad \| \delta \| _ {2} \leq \varepsilon , \tag {64}
$$
where we have replaced  $\Delta - x_0$ , which can be interpreted as the output after the attack with  $\delta = \Delta - x_0$ , the attack vector itself.
The optimization problem in Eq. (64) is non-convex as  $H$  is not guaranteed to be positive semi-definite. However, as Slater's constraint qualification is satisfied, i.e.  $\exists \delta \in \mathbb{R}^d$  s.t.  $\| \delta \|_2 < \varepsilon$ , Eq. (64) may be solved exactly[12]. Specifically, the solution may be obtained by solving an equivalent convex optimization problem:
$$
\min  _ {\gamma \in \mathbb {R} ^ {d}, X \in S ^ {d}} \mathbf {t r} \left(\frac {1}{2} H X\right) + G ^ {T} \gamma , \tag {65a}
$$
$$
s. t. \operatorname {t r} (X) - \varepsilon^ {2} \leq 0, \tag {65b}
$$
$$
[ X, \gamma ; \gamma^ {T}, 1 ] \succeq 0 \tag {65c}
$$
where  $S^d$  denotes the set of symmetric matrices and  $\succeq$  indicates the block matrix  $[X,\gamma ;\gamma^T,1]\in \mathbb{R}^{(d + 1)\times (d + 1)}$  is constrained to be positive semi-definite.
However, the optimization in Eq. (65) is expensive to solve when  $d \gg 0$  as there are  $\mathcal{O}(d^2)$  variables. For instance, MNIST and FMNIST have  $d^2 \approx 6.0 \cdot 10^6$  and CIFAR10 has  $d^2 \approx 10^8$ . Thus, before converting Eq. (64) into Eq. (65), we elect to reduce the dimension of the optimization problem to  $k \in \mathbb{N}, k \ll d$ .
Let us consider the eigendecomposition  $Q\Lambda Q^T = H$ . Here the columns of  $Q \in \mathbb{R}^{d \times d}$  are orthonormal eigenvectors of  $H$ . Given the  $d$  eigenvalues  $\{\lambda_1, \ldots, \lambda_d\}$ , sorted such that  $i < j \Rightarrow |\lambda_i| \geq |\lambda_j|$ , we have  $\Lambda = \mathrm{diag}(\lambda_1, \ldots, \lambda_d)$ . We remove the last  $d - k$  columns from  $Q$  and  $d - k$  columns and rows from  $\Lambda$  to construct  $\tilde{Q} \in \mathbb{R}^{d \times k}$ ,  $\tilde{\Lambda} \in \mathbb{R}^{k \times k}$ . Thus, we have a low-rank approximation of  $H$ :
$$
H \simeq \tilde {Q} \tilde {\Lambda} \tilde {Q} ^ {T}. \tag {66}
$$
Thus, Eq. (64) is approximately equivalent to another optimization which uses this low-rank approximation for  $H$ :
$$
\min  _ {\delta \in \mathbb {R} ^ {d}} G ^ {T} \delta + \frac {1}{2} \delta^ {T} \tilde {Q} \tilde {\Lambda} \tilde {Q} ^ {T} \delta , \quad s. t. \quad \| \delta \| _ {2} \leq \varepsilon . \tag {67}
$$
Defining  $\tilde{\delta} = \tilde{Q}^T\delta \in \mathbb{R}^k$ , Eq. (67) is approximately equivalent to
$$
\min  _ {\tilde {\delta} \in \mathbb {R} ^ {k}} G ^ {T} \tilde {Q} \tilde {\delta} + \frac {1}{2} \tilde {\delta} ^ {T} \tilde {\Lambda} \tilde {\delta}, \quad s. t. \quad \| \tilde {\delta} \| _ {2} \leq \varepsilon , \tag {68}
$$
where the constraint is simplified to  $\| \tilde{\delta}\| _2\leq \varepsilon$  from  $\| \tilde{Q}\tilde{\delta}\| _2\leq \varepsilon$  as
$$
\| \tilde {Q} \tilde {\delta} \| _ {2} = \left(\left(\tilde {Q} \tilde {\delta}\right) ^ {T} \left(\tilde {Q} \tilde {\delta}\right)\right) ^ {\frac {1}{2}} = \left(\tilde {\delta} ^ {T} \tilde {Q} ^ {T} \tilde {Q} \tilde {\delta}\right) ^ {\frac {1}{2}} = \left(\tilde {\delta} ^ {T} \tilde {Q} ^ {T} \tilde {Q} \tilde {\delta}\right) ^ {\frac {1}{2}} = \left(\tilde {\delta} ^ {T} I \tilde {\delta}\right) ^ {\frac {1}{2}} = \| \tilde {\delta} \| _ {2}. \tag {69}
$$
Finally,  $\tilde{\delta}^{*}\in \mathbb{R}^{k}$ , the optimal solution to Eq. (68), is projected back to  $\mathbb{R}^d$  yielding an approximate solution to Eq. (67):
$$
\delta^ {*} = \tilde {Q} \tilde {\delta} ^ {*} \in \mathbb {R} ^ {d}. \tag {70}
$$
Choosing  $\mathbf{k}$ : The choice of  $k\in \mathbb{N}$  is determined using a threshold hyperparameter  $T\in (0,1]$ . Given  $T$ ,  $k$  is chosen to be the smallest number of (sorted) eigenvalues/eigenvectors which account for a proportion of the total eigenvalue magnitude that is at least  $T$ :
$$
k = \underset {k ^ {\prime}} {\operatorname {a r g m i n}} \left\{k ^ {\prime} \in \mathbb {N}: \sum_ {i = 1} ^ {k ^ {\prime}} \left| \lambda_ {i} \right| \geq T \sum_ {i = 1} ^ {d} \left| \lambda_ {i} \right| \right\}. \tag {71}
$$
For the values of  $T$  used for each dataset see App. E
D.1.1 Similarities and Differences with CASO/CAFO
Our quadratic optimization is closely connected to the CAFO/CASO explanation vectors proposed by Singla et al. [74]. Both methods use optimizations to minimize a value outputted by the network, and the CASO method also uses a second-order Taylor expansion in their objective. Additionally, the proposed Smooth-CASO method is equivalent to an attack using SmoothGrad and SmoothHess on the cross-entropy loss function (when their regularizers are set to 0), which admits higher order derivatives.
However, there are some key differences. First, our optimization is meant for use with arbitrary network outputs as opposed to just the loss, as is the case with CAFO/CASO. While the vanilla loss Hessian modeled by Singla et al. [74] is proven to be positive semi-definite, this is not the case for arbitrary functions which one may wish to attack. Thus methods to optimize non-convex quadratic objectives, such as those outlined in App. D.1, are required. Second, our goal is not to generate an explanatory feature importance vector for analysis, as is an important motivation for CAFO/CASO, but to assess the quality of the gradient Hessian pair used to attack the function. For this reason, we do not use sparsity constraints such as in Singla et al. [74], which are in part meant to improve the interpretability of CAFO/CASO as explainers. Last we stress that the techniques used to find the cross-entropy loss Hessian for CASO and Smooth-CASO cannot be used for internal neurons, logits or regression valued output in ReLU networks, due to their piecewise-linearity.
D.2 SmoothHess
The SmoothHess estimation procedure, and the amortization with SmoothGrad estimation, is presented below in Algorithm 1. While empirically our SmoothHess estimator converges, we have additionally found that reflecting each point  $\delta_{i}$  in the perturbation set  $\{\delta_i\}_{i = 1}^n$  about the origin to create an augmented perturbation set  $\{\delta_i\}_{i = 1}^n\cup \{-\delta_i\}_{i = 1}^n$  before estimation can result in faster per-sample convergence.
Input: Sample of interest  $x \in \mathbb{R}^d$ , Neural network indexed to output scalar of interest  $f: \mathbb{R}^d \to \mathbb{R}$ , Covariance  $\Sigma \in \mathbb{R}^{d \times d}$ , Batch size for gradient oracle calls  $n_1 \in \mathbb{N}$ , Number of batches  $n_2 \in \mathbb{N}$ .
Output:  $\hat{H}$  an estimate of SmoothHess,  $\hat{G}$  an estimate of SmoothGrad
$\hat{H}, \hat{G} \gets \text{torch.zeros(d,d), torch.zeros(d)}$ $\backslash \hat{H} \in \mathbb{R}^{d \times d}$ ,  $\hat{G} \in \mathbb{R}^d$
$\Sigma^{-1}\gets$  torch.inverse(  $\boldsymbol{\Sigma}$  ）  $\backslash \backslash \Sigma^{-1}\in \mathbb{R}^{d\times d}$  ,If  $\boldsymbol{\Sigma}$  diagonal  $\mathcal{O}(d)$  ,Else  $\mathcal{O}(d^3)$
$\backslash \backslash \mathcal{O}(n_1n_2(W + d^2))$  ,  $\mathcal{O}(W)$  is complexity of one forward pass through  $f$
for  $i = 1,\dots ,n_2$  do
Algorithm 1 Joint SmoothHess and SmoothGrad Estimation
$\delta \leftarrow$  torch.normal  $(n_{1},0,\Sigma)$ $\backslash \backslash \delta \in \mathbb{R}^{n_1\times d}$ $\nabla f(x + \delta)\gets$  torch.autograd  $(f,x + \delta)$ $\backslash \backslash \nabla f(x + \delta)\in \mathbb{R}^{n_1\times d},\mathcal{O}(n_1W)$ $\hat{A}_i\gets$  torch.matmul(  $\delta ,\nabla f(x + \delta).T)$ $\backslash \backslash \hat{A}_i\in \mathbb{R}^{d\times d},\mathcal{O}(n_1d^2)$ $\hat{H}\gets \hat{H} +\hat{A}_i / n_1n_2\qquad \backslash \backslash \mathcal{O}(n_1d^2)$ $\hat{G}\gets \hat{G} +\nabla f(x + \delta).\mathrm{sum}(\mathrm{dim} = 0) / n_1n_2$
$\hat{H}\gets \mathrm{torch}.matmul(\Sigma^{-1},\hat{H})$ $\backslash \backslash$  If  $\boldsymbol{\Sigma}$  diagonal  $\mathcal{O}(d^2)$  , Else  $\mathcal{O}(d^3)$ $\hat{H}\leftarrow \hat{H} +\hat{H}.T$ $\backslash \backslash \mathcal{O}(d^{2})$
Return  $\hat{H},\hat{G}$
D.3 Alternative Covariance Matrices
While in this work we use isotropic covariance matrices of the form  $\Sigma = \sigma^2 I, \sigma > 0$ , SmoothHess can be estimated using arbitrary positive definite covariance matrices  $\Sigma \in \mathbb{R}^{d \times d}$ . Such a covariance matrix can be set according to the users preference, encoded using the fact that the eigenvectors of  $\Sigma$  represent directions of interest and their corresponding eigenvalues represent levels of smoothing.
In the simplest case the user already has an orthonormal eigenvector basis in mind,  $a_1,\ldots ,a_d\in \mathbb{R}^d$  as well as desired levels of smoothing  $\sigma_{1},\dots,\sigma_{d} > 0$ . In this case  $\Sigma$  may be set by constructing eigenvector and eigenvalue matrices  $\bar{Q} = [a_1|\dots |a_d]\in \mathbb{R}^{d\times d}$  and  $\Lambda = \mathrm{diag}(\sigma_1,\dots,\sigma_d)\in \mathbb{R}^{d\times d}$  and simply multiplying  $\Sigma = Q\Lambda Q^T$ .