Venue: ACL 2020

# SAFER: A Structure-free Approach for Certified Robustness to Adversarial Word Substitutions

 Mao Ye\({}^{*}\)

UT Austin

my21@cs.utexas.edu &Chengyue Gong\({}^{*}\)

UT Austin

cygong@cs.utexas.edu &Qiang Liu

UT Austin

lqiang@cs.utexas.edu

Equal contribution

###### Abstract

State-of-the-art NLP models can often be fooled by human-unaware transformations such as synonymous word substitution. For security reasons, it is of critical importance to develop models with _certified robustness_ that can provably guarantee that the prediction is can not be altered by any possible synonymous word substitution. In this work, we propose a certified robust method based on a new randomized smoothing technique, which constructs a stochastic ensemble by applying random word substitutions on the input sentences, and leverage the statistical properties of the ensemble to provably certify the robustness. Our method is simple and _structure-free_ in that it only requires the black-box queries of the model outputs, and hence can be applied to any pre-trained models (such as BERT) and any types of models (world-level or subword-level). Our method significantly outperforms recent state-of-the-art methods for certified robustness on both IMDB and Amazon text classification tasks. To the best of our knowledge, we are the first work to achieve certified robustness on large systems such as BERT with practically meaningful certified accuracy.

## 1 Introduction

Deep neural networks have achieved state-of-the-art results in many NLP tasks, but also have been shown to be brittle to carefully crafted adversarial perturbations, such as replacing words with similar words Alzantot et al. (2018), adding extra text Wallace et al. (2019), and replacing sentences with semantically similar sentences Ribeiro et al. (2018). These adversarial perturbations are imperceptible to humans, but can fool deep neural networks and break their performance. Efficient methods for defending these attacks are of critical importance for deploying modern deep NLP models to practical automatic AI systems.

In this paper, we focus on defending the synonymous word substitution attacking Alzantot et al. (2018), in which an attacker attempts to alter the output of the model by replacing words in the input sentence with their synonyms according to a synonym table, while keeping the meaning of this sentence unchanged. A model is said to be _certified robust_ if such an attack is guaranteed to fail, no matter how the attacker manipulates the input sentences. Achieving and verifying certified robustness is highly challenging even if the synonym table used by the attacker is known during training see Jia et al. (2019), because it requires to check every possible synonymous word substitution, whose number is exponentially large.

Various defense methods against synonymous word substitution attacks have been developed (e.g., Wallace et al., 2019; Ebrahimi et al., 2018), most of which, however, are not certified robust in that they may eventually be broken by stronger attackers. Recently, Jia et al. (2019); Huang et al. (2019) proposed the first certified robust methods against word substitution attacking. Their methods are based on the interval bound propagation (IBP) method Dvijotham et al. (2018) which computes the range of the model output by propagating the interval constraints of the inputs layer by layer.

However, the IBP-based methods of Jia et al. (2019); Huang et al. (2019) are limited in several ways. First, because IBP only works for certifying neural networks with continuous inputs, the inputs in Jia et al. (2019) and Huang et al. (2019) are taken to be the word embedding vectors of the input sentences, instead of the discrete sentences. This makes it inapplicable to character-level Zhang et al. (2015) and subword-level Bojanowski et al. (2017) model, which are more widely used in practice Wu et al. (2016).



In this paper, we propose a _structure-free_ certified defense method that applies to arbitrary models that can be queried in a black-box fashion, without any requirement on the model structures. Our method is based on the idea of randomized smoothing, which smooths the model with random word substitutions build on the synonymous network, and leverage the statistical properties of the randomized ensembles to construct provably certification bounds. Similar ideas of provably certification using randomized smoothing have been developed recently in deep learning (e.g., Cohen et al., 2019; Salman et al., 2019; Zhang et al., 2020; Lee et al., 2019), but mainly for computer vision tasks whose inputs (images) are in a continuous space (Cohen et al., 2019). Our method admits a substantial extension of the randomized smoothing technique to discrete and structured input spaces for NLP.

We test our method on various types of NLP models, including text CNN (Kim, 2014), CharCNN (Zhang et al., 2015), and BERT (Devlin et al., 2019). Our method significantly outperforms the recent IBP-based methods (Jia et al., 2019; Huang et al., 2019) on both IMDB and Amazon text classification. In particular, we achieve an 87.35% certified accuracy on IMDB by applying our method on the state-of-the-art BERT, on which previous certified robust methods are not applicable.

## 2 Adversarial Word Substitution

In a text classification task, a model \(f({\bf X})\) maps an input sentence \({\bf X}\in\mathcal{X}\) to a label \(c\) in a set \(\mathcal{Y}\) of discrete categories, where \({\bf X}=x_{1},\ldots,x_{L}\) is a sentence consisting of \(L\) words. In this paper, we focus on adversarial word substitution in which an attacker arbitrarily replaces the words in the sentence by their synonyms according to a synonym table to alert the prediction of the model. Specifically, for any word \(x\), we consider a pre-defined synonym set \(S_{x}\) that contains the synonyms of \(x\) (including \(x\) itself). We assume the synonymous relation is symmetric, that is, \(x\) is in the synonym set of all its synonyms. The synonym set \(S_{x}\) can be built based on GLOVE (Pennington et al., 2014).

With a given input sentence \({\bf X}=x_{1}\),..., \(x_{L}\), the attacker may construct an adversarial sentence \({\bf X^{\prime}}=x^{\prime}_{1},\ldots,x^{\prime}_{L}\) by perturbing at most \(R\leq L\) words \(x_{i}\) in \({\bf X}\) to any of their synonyms \(x^{\prime}_{i}\in S_{x_{i}}\),

where \(S_{\bf X}\) denotes the candidate set of adversarial sentences available to the attacker. Here \(\|{\bf X^{\prime}}-{\bf X}\|_{0}:=\sum_{i=1}^{L}\mathbb{I}\left\{x^{\prime}_{ i}\neq x_{i}\right\}\) is the Hamming distance, with \(\mathbb{I}\{\cdot\}\) the indicator function. It is expected that all \({\bf X^{\prime}}\in S_{\bf X}\) have the same semantic meaning as \({\bf X}\) for human readers, but they may have different outputs from the model. The goal of the attacker is to find \({\bf X^{\prime}}\in S_{\bf X}\) such that \(f({\bf X})\neq f({\bf X^{\prime}})\).

Certified RobustnessFormally, a model \(f\) is said to be _certified robust_ against word substitution attacking on an input \({\bf X}\) if it is able to give consistently correct predictions for all the possible word substitution perturbations, i.e,

\[y=f({\bf X})=f({\bf X^{\prime}})\text{, \quad for all ${\bf X^{\prime}}\in S_{\bf X}$}, \tag{1}\]

where \(y\) denotes the true label of sentence \({\bf X}\). Deciding if \(f\) is certified robust can be highly challenging, because, unless additional structural information is available, it requires to exam all the candidate sentences in \(S_{\bf X}\), whose size grows exponentially with \(R\). In this work, we mainly consider the case when \(R=L\), which is the most challenging case.

## 3 Certifying Smoothed Classifiers

Our idea is to replace \(f\) with a more smoothed model that is easier to verify by averaging the outputs of a set of randomly perturbed inputs based on random word substitutions. The smoothed classifier \(f^{\text{RS}}\) is constructed by introducing random perturbations on the input space,

\[f^{\text{RS}}({\bf X})=\operatorname*{arg\,max}_{c\in\mathcal{Y}}\mathbb{P}_{{ \bf Z}\sim\Pi_{\mathbf{X}}}\left(f({\bf Z})=c\right),\]

where \(\Pi_{\mathbf{X}}\) is a probability distribution on the input space that prescribes a random perturbation around \({\bf X}\). For notation, we define

\[g^{\text{RS}}({\bf X},c):=\mathbb{P}_{{\bf Z}\sim\Pi_{\mathbf{X}}}\left(f({\bf Z })=c\right),\]

which is the "soft score" of class \(c\) under \(f^{\text{RS}}\).

The perturbation distribution \(\Pi_{\mathbf{X}}\) should be chosen properly so that \(f^{\text{RS}}\) forms a close approximation to the original model \(f\) (i.e., \(f^{\text{RS}}({\bf X})\approx f({\bf X})\)), and is also sufficiently random to ensure that \(f^{\text{RS}}\) is smooth enough to allow certified robustness (in the sense of Theorem 1 below).

In our work, we define \(\Pi_{\mathbf{X}}\) to be the uniform distribution on a set of random word substitutions. Specifically, let \(P_{x}\) be a _perturbation set_ for word \(x\) in the vocabulary, which is different from the _synonym set_\(S_{x}\). In this work, we construct \(P_{x}\) based on the top \(K\) nearest neighbors under the cosine 

similarity of GLOVE vectors, where \(K\) is a hyper-parameter that controls the size of the perturbation set; see Section4 for more discussion on \(P_{x}\).

For a sentence \(\mathbf{X}=x_{1},\ldots,x_{L}\), the sentence-level perturbation distribution \(\Pi_{\mathbf{X}}\) is defined by randomly and independently perturbing each word \(x_{i}\) to a word in its perturbation set \(P_{x_{i}}\) with equal probability, that is,

\[\Pi_{\mathbf{X}}(\mathbf{Z})=\prod_{i=1}^{L}\frac{\mathbb{I}\left\{z_{i}\in P _{x_{i}}\right\}}{|P_{x_{i}}|},\]

where \(\mathbf{Z}=z_{1},\ldots,z_{L}\) is the perturbed sentence and \(|P_{x_{i}}|\) denotes the size of \(P_{x_{i}}\). Note that the random perturbation \(\mathbf{Z}\) and the adversarial candidate \(\mathbf{X}^{\prime}\in S_{\mathbf{X}}\) are different.

### Certified Robustness

We now discuss how to certify the robustness of the smoothed model \(f^{\text{RS}}\). Recall that \(f^{\text{RS}}\) is certified robust if \(y=f^{\text{RS}}(\mathbf{X}^{\prime})\) for any \(\mathbf{X}^{\prime}\in S_{\mathbf{X}}\), where \(y\) is the true label. A sufficient condition for this is

\[\min_{\mathbf{X}^{\prime}\in S_{\mathbf{X}}}g^{\text{RS}}(\mathbf{X}^{\prime}, y)\geq\max_{\mathbf{X}^{\prime}\in S_{\mathbf{X}}}g^{\text{RS}}(\mathbf{ X}^{\prime},c)\quad\forall c\neq y,\]

where the lower bound of \(g^{\text{RS}}(\mathbf{X}^{\prime},y)\) on \(\mathbf{X}^{\prime}\in S_{\mathbf{X}}\) is larger than the upper bound of \(g^{\text{RS}}(\mathbf{X}^{\prime},c)\) on \(\mathbf{X}^{\prime}\in S_{\mathbf{X}}\) for every \(c\neq y\). The key step is hence to calculate the upper and low bounds of \(g^{\text{RS}}(\mathbf{X}^{\prime},c)\) for \(\forall c\in\mathcal{Y}\) and \(\mathbf{X}^{\prime}\in S_{\mathbf{X}}\), which we address in Theorem1 below. All proofs are in AppendixA.2.

**Theorem 1**.: _(Certified Lower/Upper Bounds) Assume the perturbation set \(P_{x}\) is constructed such that \(|P_{x}|=|P_{x^{\prime}}|\) for every word \(x\) and its synonym \(x^{\prime}\in S_{x}\). Define_

\[q_{x}=\min_{x^{\prime}\in S_{x}}|P_{x}\cap P_{x^{\prime}}|/|P_{x}|,\]

_where \(q_{x}\) indicates the overlap between the two different perturbation sets. For a given sentence \(\textbf{X}=x_{1},\ldots,x_{L}\), we sort the words according to \(q_{x}\), such that \(q_{x_{i_{1}}}\leq q_{x_{i_{2}}}\leq\cdots\leq q_{x_{i_{L}}}\). Then_

\[\min_{\textbf{X}^{\prime}\in S_{\mathbf{X}}}g^{\text{RS}}(\textbf {X}^{\prime},c)\geq\max(g^{\text{RS}}(\textbf{X},c)-q_{\textbf{X}},0)\] \[\max_{\textbf{X}^{\prime}\in S_{\mathbf{X}}}g^{\text{RS}}(\textbf {X}^{\prime},c)\leq\min(g^{\text{RS}}(\textbf{X},c)+q_{\textbf{X}},1).\]

_where \(q_{\textbf{X}}:=1-\prod_{j=1}^{R}q_{x_{i_{j}}}\). Equivalently, this says_

The idea is that, with the randomized smoothing, the difference between \(g^{\text{RS}}(\textbf{X}^{\prime},c)\) and \(g^{\text{RS}}(\textbf{X},c)\) is at most \(q_{\textbf{X}}\) for any adversarial candidate \(\textbf{X}^{\prime}\in S_{\textbf{X}}\). Therefore, we can give adversarial upper and lower bounds of \(g^{\text{RS}}(\textbf{X}^{\prime},c)\) by \(g^{\text{RS}}(\textbf{X},c)\pm q_{\textbf{X}}\), which, importantly, avoids the difficult adversarial optimization of \(g^{\text{RS}}(\textbf{X}^{\prime},c)\) on \(\textbf{X}^{\prime}\in S_{\textbf{X}}\), and instead just needs to evaluate \(g^{\text{RS}}(\textbf{X},c)\) at the original input **X**.

We are ready to describe a practical criterion for checking the certified robustness.

**Proposition 1**.: _For a sentence **X** and its label \(y\), we define_

\[y_{B}=\arg\max_{c\in\mathcal{Y},c\neq y}g^{\text{RS}}(\textbf{X},c).\]

_Then under the condition of Theorem1, we can certify that \(f(\textbf{X}^{\prime})=f(\textbf{X})=y\) for any \(\textbf{X}^{\prime}\in S_{\textbf{X}}\) if_

\[\Delta_{\textbf{X}}\stackrel{{ def}}{{=}}g^{\text{RS}}(\textbf{X},y)- g^{\text{RS}}(\textbf{X},y_{B})-2q_{\textbf{X}}>0. \tag{2}\]

Therefore, certifying whether the model gives consistently correct prediction reduces to checking if \(\Delta_{\textbf{X}}\) is positive, which can be easily achieved with Monte Carlo estimation as we show in the sequel.

Estimating \(g^{\text{RS}}(\textbf{X},c)\) and \(\Delta_{\textbf{X}}\)Recall that \(g^{\text{RS}}(\textbf{X},c)=\mathbb{P}_{\textbf{Z}\sim\Pi_{\textbf{X}}}(f( \textbf{Z})=c)\). We can estimate \(g^{\text{RS}}(\textbf{X},c)\) with a Monte Carlo estimator \(\sum_{i=1}^{n}\mathbb{I}\{f(\textbf{Z}^{(i)}=c\}/n\), where \(\textbf{Z}^{(i)}\) are i.i.d. samples from \(\Pi_{\textbf{X}}\). And \(\Delta_{\textbf{X}}\) can be approximated accordingly. Using concentration inequality, we can quantify the non-asymptotic approximation error. This allows us to construct rigorous statistical procedures to reject the null hypothesis that \(f^{\text{RS}}\) is not certified robust at **X** (i.e., \(\Delta_{\textbf{X}}\leq 0\)) with a given significance level (e.g., \(1\%\)). See AppendixA.1 for the algorithmic details of the testing procedure.

We can see that our procedure is _structure-free_ in that it only requires the black-box assessment of the output \(f(\textbf{Z}^{(i)})\) of the random inputs, and does not require any other structural information of \(f\) and \(f^{\text{RS}}\), which makes our method widely applicable to various types of complex models.

TightnessA key question is if our bounds are sufficiently tight. The next theorem shows that the lower/upper bounds in Theorem1 are tight and can not be further improved unless further information of the model \(f\) or \(f^{\text{RS}}\) is acquired.

**Theorem 2**.: _(Tightness) Assume the conditions of Theorem1 hold. For a model \(f\) that satisfies \(f^{\text{RS}}(\textbf{X})=y\) and \(y_{B}\) as defined in Proposition1, there exists a model \(f_{*}\) such that its related smoothed classifier \(g^{\text{RS}}_{*}\) satisfies 

\(g^{\text{RS}}(\textbf{X},c)\) for \(c=y\) and \(c=y_{B}\), and

\[\min_{\textbf{X}^{\prime}\in S_{\textbf{X}}}g^{\text{RS}}_{*}( \textbf{X}^{\prime},y)=\max(g^{\text{RS}}_{*}(\textbf{X},y)-q_{\textbf{X}},0)\] \[\max_{\textbf{X}^{\prime}\in S_{\textbf{X}}}g^{\text{RS}}_{*}( \textbf{X}^{\prime},y_{B})=\min(g^{\text{RS}}_{*}(\textbf{X},y_{B})+q_{\textbf {X}},1),\]

where \(q_{\textbf{X}}\) is defined in Theorem 1.

In other words, if we access \(g^{\text{RS}}\) only through the evaluation of \(g^{\text{RS}}(\textbf{X},y)\) and \(g^{\text{RS}}(\textbf{X},y_{B})\), then the bounds in Theorem 1 are the tightest possible that we can achieve, because we can not distinguish between \(g^{\text{RS}}\) and the \(g^{\text{RS}}_{*}\) in Theorem 2 with the information available.

### Practical Algorithm

Figure 1 visualizes the pipeline of the proposed approach. Given the synonym sets \(S_{\textbf{X}}\), we generate the perturbation sets \(P_{\textbf{X}}\) from it. When an input sentence **X** arrives, we draw perturbed sentences \(\{\textbf{Z}^{(i)}\}\) from \(\Pi_{\textbf{X}}\) and average their outputs to estimate \(\Delta_{\textbf{X}}\), which is used to decide if the model is certified robust for **X**.

Training the Base Classifier \(f\)Our method needs to start with a base classifier \(f\). Although it is possible to train \(f\) using standard learning techniques, the result can be improved by considering that the method uses the smoothed \(f^{\text{RS}}\), instead of \(f\). To improve the accuracy of \(f^{\text{RS}}\), we introduce a data augmentation induced by the perturbation set. Specifically, at each training iteration, we first sample a mini-batch of data points (sentences) and randomly perturbing the sentences using the perturbation distribution \(\Pi_{\textbf{X}}\). We then apply gradient descent on the model based on the perturbed minibatch. Similar training procedures were also used for Gaussian-based random smoothing on continuous inputs (see e.g., Cohen et al., 2019).

Our method can easily leverage powerful pre-trained models such as BERT. In this case, BERT is used to construct feature maps and only the top layer weights are finetuned using the data augmentation method.

## 4 Experiments

We test our method on both IMDB Maas et al. (2011) and Amazon McAuley (2013) text classification tasks, with various types of models, including text CNN Kim (2014), Char-CNN Zhang et al. (2015) and BERT Devlin et al. (2019). We compare with the recent IBP-based methods Jia et al. (2019); Huang et al. (2019) as baselines. Text CNN Kim (2014) was used in Jia et al. (2019) and achieves the best result therein. All the baseline models are trained and tuned using the schedules recommended in the corresponding papers. We consider the case when \(R=L\) during attacking, which means all words in the sentence can be perturbed simultaneously by the attacker. Code for reproducing our results can be found in [https://github.com/lushleaf/Structure-free-certified-NLP](https://github.com/lushleaf/Structure-free-certified-NLP).

Synonym SetsSimilar to Jia et al. (2019); Alanatot et al. (2018), we construct the synonym set \(S_{x}\) of word \(x\) to be the set of words with \(\geq 0.8\) cosine similarity in the GLOVE vector space. The word vector space is constructed by post-processing the pretrained GLOVE vectors Pennington et al. (2014) using the counter-fitted method Mrksic et al. (2016) and the "all-but-the-top" method Mu and Viswanath (2018) to ensure that synonyms are near to each other while antonyms are far apart.

Perturbation SetsWe say that two words \(x\) and \(x^{\prime}\) are connected synonymously if there exists a path of words \(x=x_{1},x_{2},\ldots,x_{\ell}=x^{\prime}\), such that all the successive pairs are synonymous. Let \(B_{x}\) to be the set of words connected to \(x\) synonymously. Then we define the perturbation set \(P_{x}\) to consist of the top \(K\) words in \(B_{x}\) with the largest GLOVE cosine similarity if \(|B_{x}|\geq K\), and set \(P_{x}=B_{x}\) if \(|B_{x}|<K\). Here \(K\) is a hyper-parameter that controls the size of \(P_{x}\) and hence trades off the smoothness and accuracy of \(f^{\text{RS}}\). We use \(K=100\) by default and investigate its effect in Section 4.2.

Figure 1: A pipeline of the proposed robustness certification approach.

 

Evaluation MetricWe evaluate the certified robustness of a model \(f^{\text{RS}}\) on a dataset with the _certified accuracy_Cohen et al. (2019), which equals the percentage of data points on which \(f^{\text{RS}}\) is certified robust, which, for our method, holds when \(\Delta_{\mathbf{X}}>0\) can be verified.

### Main Results

We first demonstrate that adversarial word substitution is able to give strong attack in our experimental setting. Using IMDB dataset, we attack the vanilla BERT Devlin et al. (2019) with the adversarial attacking method of Jin et al. (2020). The vanilla BERT achieves a \(91\%\) clean accuracy (the testing accuracy on clean data without attacking), but only a \(20.1\%\) adversarial accuracy (the testing accuracy under the particular attacking method by Jin et al. (2020)). We will show later that our method is able to achieve \(87.35\%\) certified accuracy and thus the corresponding adversarial accuracy must be higher or equal to \(87.35\%\).

We compare our method with IBP Jia et al. (2019); Huang et al. (2019). in Table 1. We can see that our method clearly outperforms the baselines. In particular, our approach significantly outperforms IBP on Amazon by improving the \(14.00\%\) baseline to \(24.92\%\).

Thanks to its structure-free property, our algorithm can be easily applied to any pre-trained models and character-level models, which is not easily achievable with Jia et al. (2019) and Huang et al. (2019). Table 2 shows that our method can further improve the result using Char-CNN (a character-level model) and BERT Devlin et al. (2019), achieving an \(87.35\%\) certified accuracy on IMDb. In comparison, the IBP baseline only achieves a \(79.74\%\) certified accuracy under the same setting.

### Trade-Off between Clean Accuracy and Certified Accuracy

We investigate the trade-off between smoothness and accuracy while tuning \(K\) in Table 3. We can see that the clean accuracy decreases when \(K\) increases, while the gap between the clean accuracy and certified accuracy, which measures the smoothness, decreases when \(K\) increases. The best certified accuracy is achieved when \(K=100\).

## 5 Conclusion

We proposed a robustness certification method, which provably guarantees that all the possible perturbations cannot break down the system. Compared with previous work such as Jia et al. (2019); Huang et al. (2019), our method is structure-free and thus can be easily applied to any pre-trained models (such as BERT) and character-level models (such as Char-CNN).

The construction of the perturbation set is of critical importance to our method. In this paper, we used a heuristic way based on the synonym network to construct the perturbation set, which may not be optimal. In further work, we will explore more efficient ways for constructing the perturbation set. We also plan to generalize our approach to achieve certified robustness against other types of adversarial attacks in NLP, such as the out-of-list attack. An naive way is to add the "OOV" token into the synonyms set of every word, but potentially better procedures can be further explored.

## Acknowledgement

This work is supported in part by NSF CRII 1830161 and NSF CAREER 1846421.

\begin{table}
\begin{tabular}{l|c c} \hline \hline
**Method** & **IMDB** & **Amazon** \\ \hline Jia et al. (2019) & 79.74 & 14.00 \\ Huang et al. (2019) & 78.74 & 12.36 \\ Ours & **81.16** & **24.92** \\ \hline \hline \end{tabular}
\end{table}
Table 1: The certified accuracy of our method and the baselines on the IMDB and Amazon dataset.

\begin{table}
\begin{tabular}{l|l|c c c c} \hline \hline \(K\) & 20 & 50 & 100 & 250 & 1000 \\ \hline Clean (\%) & 88.47 & 88.48 & 88.09 & 84.83 & 67.54 \\ Certified (\%) & 65.58 & 77.32 & 81.16 & 79.98 & 65.13 \\ \hline \hline \end{tabular}
\end{table}
Table 2: The certified accuracy of different models and methods on the IMDB dataset.

\begin{table}
\begin{tabular}{l|l|c} \hline \hline
**Method** & **Model** & **Accuracy** \\ \hline Jia et al. (2019) & CNN & 79.74 \\ Huang et al. (2019) & CNN & 78.74 \\ \hline  & CNN & 81.16 \\ Ours & Char-CNN & 82.03 \\  & BERT & **87.35** \\ \hline \hline \end{tabular}
\end{table}
Table 3: Results of the smoothed model \(f^{\text{RS}}\) with different \(K\) on IMDB using text CNN. “Clean” represents the accuracy on the clean data without adversarial attacking and “Certified” the certified accuracy.

 



## References

* Alzantot et al. (2018) Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. Generating natural language adversarial examples. In _ACL_.
* Bojanowski et al. (2017) Piotr Bojanowski, Edouard Grave, Armand Joulin, and Tomas Mikolov. 2017. Enriching word vectors with subword information. In _ACL_.
* Cohen et al. (2019) Jeremy M Cohen, Elan Rosenfeld, and J Zico Kolter. 2019. Certified adversarial robustness via randomized smoothing. In _ICML_.
* Devlin et al. (2019) Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2019. Bert: Pre-training of deep bidirectional transformers for language understanding. In _NAACL_.
* Dvijotham et al. (2018) Krishnamurthy Dvijotham, Sven Gowal, Robert Stanforth, Relja Arandjelovic, Brendan O'Donoghue, Jonathan Uesato, and Pushmeet Kohli. 2018. Training verified learners with learned verifiers. _arXiv preprint arXiv:1805.10265_.
* Ebrahimi et al. (2018) Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. 2018. Hotflip: White-box adversarial examples for text classification. In _ACL_.
* Huang et al. (2019) Po-Sen Huang, Robert Stanforth, Johannes Welbl, Chris Dyer, Dani Yogatama, Sven Gowal, Krishnamurthy Dvijotham, and Pushmeet Kohli. 2019. Achieving verified robustness to symbol substitutions via interval bound propagation. In _EMNLP_.
* Jia et al. (2019) R. Jia, A. Raghunathan, K. Gksel, and P. Liang. 2019. Certified robustness to adversarial word substitutions. In _EMNLP_.
* Jin et al. (2020) Di Jin, Zhiijing Jin, Joey Tianyi Zhou, and Peter Szolovits. 2020. Is bert really robust? natural language attack on text classification and entailment. In _AAAI_.
* Kim (2014) Yoon Kim. 2014. Convolutional neural networks for sentence classification. In _AAAI_.
* Lee et al. (2019) Guang-He Lee, Yang Yuan, Shiyu Chang, and Tommi Jaakkola. 2019. Tight certificates of adversarial robustness for randomly smoothed classifiers. In _NeurlPS_.
* Maas et al. (2011) Andrew L Maas, Raymond E Daly, Peter T Pham, Dan Huang, Andrew Y Ng, and Christopher Potts. 2011. Learning word vectors for sentiment analysis. In _ACL_.
* McAuley and Leskovec (2013) Jure McAuley, Julian; Leskovec. 2013. Hidden factors and hidden topics: understanding rating dimensions with review text. In _ACM RecSys_.
* Mrksic et al. (2016) Nikola Mrksic, Dirmuid O Seaghdha, Blaise Thomson, Milica Gasic, Lina Rojas-Barahona, Pei-Hao Su, David Vandyke, Tsung-Hsien Wen, and Steve Young. 2016. Counter-fitting word vectors to linguistic constraints. In _NAACL_.
* Mu and Viswanath (2018) Jiaqi Mu and Pramod Viswanath. 2018. All-but-the-top: Simple and effective postprocessing for word representations. In _ICLR_.
* Pennington et al. (2014) Jeffrey Pennington, Richard Socher, and Christopher Manning. 2014. Glove: Global vectors for word representation. In _EMNLP_.
* Ribeiro et al. (2018) Marco Tulio Ribeiro, Sameer Singh, and Carlos Guestrin. 2018. Semantically equivalent adversarial rules for debugging nlp models. In _ACL_.
* Salman et al. (2019) Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. 2019. Provably robust deep learning via adversarially trained smoothed classifiers. In _NeurIPS_.
* Wallace et al. (2019) Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for nlp. In _EMNLP_.
* Wu et al. (2016) Yonghui Wu, Mike Schuster, Zhifeng Chen, Quoc V Le, Mohammad Norouzi, Wolfgang Macherey, Maxim Kirikun, Yuan Cao, Qin Gao, Klaus Macherey, et al. 2016. Google's neural machine translation system: Bridging the gap between human and machine translation. _arXiv preprint arXiv:1609.08144_.
* Zhang et al. (2020) Dinghuai Zhang, Mao Ye, Chengye Gong, Zhanxing Zhu, and Qiang Liu. 2020. Black-box certification with randomized smoothing: A functional optimization based framework. _arXiv preprint arXiv:2002.09169_.
* Zhang et al. (2015) Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text classification. In _NIPS_.



Appendix

### Bounding the Error of Monte Carlo Estimation

As shown in Proposition 1, the smoothed model \(f^{\text{RS}}\) is certified robust at an input **X** in the sense of (1) if

\[\Delta_{\textbf{X}} =g^{\text{RS}}(\textbf{X},y)-g^{\text{RS}}(\textbf{X},y_{B})-2q_{ \textbf{X}}\] \[=g^{\text{RS}}(\textbf{X},y)-\max_{c\neq y}g^{\text{RS}}(\textbf{ X},c)-2q_{\textbf{X}}>0,\]

where \(y\) is the true label of **X**, and

Assume \(\{\textbf{Z}^{(i)}\}_{i=1}^{n}\) is an i.i.d. sample from \(\Pi_{\textbf{X}}\). By Monte Carlo approximation, we can estimate \(g^{\text{RS}}(\textbf{X},c)\) for all \(c\in\mathcal{Y}\) jointly, via

and estimate \(\Delta_{\textbf{X}}\) via

To develop a rigorous procedure for testing \(\Delta_{\textbf{X}}>0\), we need to bound the non-asymptotic error of the Monte Carlo estimation, which can be done with a simple application of Hoeffding's concentration inequality and union bound.

**Proposition 2**.: _Assume \(\{\boldsymbol{Z}^{(i)}\}\) is i.i.d. drawn from \(\Pi_{\textbf{X}}\). For any \(\delta\in(0,1)\), with probability at least \(1-\delta\), we have_

\[\Delta_{\textbf{X}}\geq \hat{\Delta}_{\textbf{X}}-2\sqrt{\frac{\log\frac{1}{\delta}+\log| \mathcal{Y}|}{2n}}.\]

We can now frame the robustness certification problem into a hypothesis test problem. Consider the null hypothesis H\({}_{0}\) and alternatively hypothesis H\({}_{a}\):

\[\begin{split}\text{H${}_{0}$}&:\!\Delta_{\textbf{ X}}\leq 0~{}~{}~{}(f^{\text{RS}}\text{ is not certified robust to }\textbf{X})\\ \text{H${}_{a}$}&:\!\Delta_{\textbf{X}}>0~{}~{}~{}( f^{\text{RS}}\text{ is certified robust to }\textbf{X}).\end{split}\]

Then according to Proposition 2, we can reject the null hypothesis H\({}_{0}\) with a significance level \(\delta\) if

\[\hat{\Delta}_{\textbf{X}}-2\sqrt{\frac{\log\frac{1}{\delta}+\log|\mathcal{ Y}|}{2n}}>0.\]

In all the experiments, we set \(\delta=0.01\) and \(n=5000\).

### Proof of the Main Theorems

In this section, we give the proofs of the theorems in the main text.

#### a.2.1 Proof of Proposition 1

According to the definition of \(f^{\text{RS}}\), it is certified robust at **X**, that is, \(y=f^{\text{RS}}(\textbf{X}^{\prime})\) for \(\forall\textbf{X}^{\prime}\in S_{\textbf{X}}\), if

\[g^{\text{RS}}(\textbf{X}^{\prime},\;y)\geq\max_{c\neq y}g^{\text{ RS}}(\textbf{X}^{\prime},c),~{}~{}~{}~{}\textbf{X}^{\prime}\in S_{\textbf{X}}. \tag{3}\]

Obviously

\[g^{\text{RS}}(\textbf{X}^{\prime},\;y)-\max_{c\neq y}g^{\text{ RS}}(\textbf{X}^{\prime},c) \geq\min_{\textbf{X}^{\prime}\in S_{\textbf{X}}}g^{\text{RS}}( \textbf{X}^{\prime},\;y)-\max_{c\neq y}\max_{\textbf{X}^{\prime}\in S_{ \textbf{X}}}g^{\text{RS}}(\textbf{X}^{\prime},c)\] \[\geq\left(g^{\text{RS}}(\textbf{X},\;y)-q_{\textbf{X}}\right)- \max_{c\neq y}\left(g^{\text{RS}}(\textbf{X},c)+q_{\textbf{X}}\right)~{}~{} \mbox{//by Theorem 1}.\] \[=\Delta_{\textbf{X}}.\]

Therefore, \(\Delta_{\textbf{X}}>0\) must imply (3) and hence certified robustness.

 



#### a.2.2 Proof of Theorem 1

Our goal is to calculate the upper and lower bounds \(\max_{\mathbf{X}^{\prime}\sim\Pi_{\textbf{X}}}g^{\text{RS}}(\mathbf{X}^{\prime},c)\) and \(\min_{\mathbf{X}^{\prime}\sim\Pi_{\textbf{X}}}g^{\text{RS}}(\mathbf{X}^{\prime} ,c)\). Our key idea is to frame the computation of the upper and lower bounds into a variational optimization.

**Lemma 1**.: _Define \(\mathcal{H}_{[0,1]}\) to be the set of all bounded functions mapping from \(\mathcal{X}\) to \([0,1]\), For any \(h\in\mathcal{H}_{[0,1]}\), define_

\[\Pi_{\textbf{X}}[h]=\mathbb{E}_{\textbf{Z}\sim\Pi_{\textbf{X}}}[h(\textbf{Z})].\]

_Then we have for any **X** and \(c\in\mathcal{Y}\),_

Proof of Lemma 1.: The proof is straightforward. Define \(h_{0}(\textbf{X})=\mathbb{I}\{f(\textbf{X})=c\}\). Recall that

Therefore, \(h_{0}\) satisfies the constraints in the optimization, which makes it obvious that

Taking on both sides yields the lower bound. The upper bound follows the same derivation. 

Therefore, the problem reduces to deriving bounds for the optimization problems.

**Theorem 3**.: _Under the assumptions of Theorem 1, for the optimization problems in Lemma 1, we have_

\[g^{\text{RS}}_{low}(\textbf{X},c)\geq\max(g^{\text{RS}}(\textbf{ X},c)-q_{\textbf{X}},~{}0),~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}~{}g^{\text{RS}}_{up}( \textbf{X},c)\leq\min(g^{\text{RS}}(\textbf{X},c)+q_{\textbf{X}},~{}1).\]

_where \(q_{\textbf{X}}\) is the quantity defined in Theorem 1 in the main text._

Now we proceed to prove Theorem 3.

Proof of Theorem 3.: We only consider the minimization problem because the maximization follows the same proof. For notation, we denote \(p=g^{\text{RS}}(\textbf{X},c)\). Applying the Lagrange multiplier to the constraint optimization problem and exchanging the min and max, we have

Here \(d\Pi_{\textbf{X}}^{0}(\textbf{Z})\) and \(d\Pi_{\textbf{X}^{\prime}}^{0}(\textbf{Z})\) is the counting measure and \((s)_{+}=\max(s,0)\). Now we calculate \(\int{(\lambda d\Pi_{\textbf{X}}(\textbf{Z})-d\Pi_{\textbf{X}^{\prime}}( \textbf{Z}))_{+}}\).

**Lemma 2**.: _Given \(x,x^{\prime}\), define \(n_{x}=|P_{x}|\), \(n_{x^{\prime}}=|P_{x^{\prime}}|\) and \(n_{x,x^{\prime}}=|P_{x}\cap P_{x^{\prime}}|\). We have the following identity_

\[\int{(\lambda d\Pi_{\textbf{X}}(\textbf{Z})-d\Pi_{\textbf{X}^{ \prime}}(\textbf{Z}))_{+}}\] \[= \lambda\left[1-\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{ x_{j},x_{j}^{\prime}}}{n_{x_{j}}}\right]+\left[\prod_{j\in[L],x_{j}\neq x_{ j}^{\prime}}\frac{n_{x_{j},x_{j}^{\prime}}}{n_{x_{j}}}\right]\left[\lambda- \prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j}}}{n_{x_{j}^{\prime}}} \right]_{+}.\]

_As a result, under the assumption that \(n_{x}=|P_{x}|=|P_{x^{\prime}}|=n_{x^{\prime}}\) for every word \(x\) and its synonym \(x^{\prime}\in S_{x}\), we have_

\[\int\left(\lambda d\Pi_{\textbf{X}}(\textbf{Z})-d\Pi_{\textbf{X}^{\prime}}( \textbf{Z})\right)_{+}= \lambda\left[1-\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{ n_{x_{j},x_{j}^{\prime}}}{n_{x_{j}}}\right]+\left[\prod_{j\in[L],x_{j}\neq x_{ j}^{\prime}}\frac{n_{x_{j},x_{j}^{\prime}}}{n_{x_{j}}}\right]\left(\lambda-1 \right)_{+}.\]

We now need to solve the optimization of \(\max_{\textbf{X}^{\prime}\in S_{\mathbf{X}}}\int\left(\lambda d\Pi_{\textbf{ X}}(\textbf{Z})-d\Pi_{\textbf{X}^{\prime}}(\textbf{Z})\right)_{+}\).

**Lemma 3**.: _For any word \(x\), define \(\tilde{x}^{*}=\operatorname*{arg\,min}_{x^{\prime}\in S_{x}}n_{x,x^{\prime}}/ n_{x}\). For a given sentence \(\textbf{X}=x_{1},\ldots,x_{L}\), we define an ordering of the words \(x_{\ell_{1}},\ldots,x_{\ell_{L}}\) such that \(n_{x_{\ell_{i}},\tilde{x}_{\ell_{i}}^{*}}/n_{x_{\ell_{i}}}\leq n_{x_{\ell_{j}} ,\tilde{x}_{\ell_{j}}^{*}}/n_{x_{\ell_{j}}}\) for any \(i\leq j\). For a given \(\textbf{X}\) and \(R\), we define an adversarial perturbed sentence \(\textbf{X}^{*}=x_{1}^{*},\ldots,x_{L}^{*}\), where_

\[x_{i}^{*}=\begin{cases}\tilde{x}_{i}^{*}&\text{if $i\in[\ell_{1},\ldots,\ell_{ R}]$}\\ x_{i}&\text{if $i\notin[\ell_{1},\ldots,\ell_{R}]$}.\end{cases}\]

_Then for any \(\lambda\geq 0\), we have that \(\textbf{X}^{*}\) is the optimal solution of \(\max_{\textbf{X}^{\prime}\in S_{\textbf{X}}}\int\left(\lambda d\Pi_{\textbf{ X}}(\textbf{Z})-d\Pi_{\textbf{X}^{\prime}}(\textbf{Z})\right)_{+}\), that is,_

Now by Lemma 3, the lower bound becomes

\[g_{low}^{\textrm{RS}}(\textbf{X},c)= -\max_{\lambda\geq 0}\max_{\textbf{X}^{\prime}\in S_{\textbf{X}}} \int\left(\lambda d\Pi_{\textbf{X}}(\textbf{Z})-d\Pi_{\textbf{X}^{\prime}}( \textbf{Z})\right)_{+}+\lambda p\] \[= -\max_{\lambda\geq 0}\int\left(\lambda d\Pi_{\textbf{X}}( \textbf{Z})-d\Pi_{\textbf{X}^{*}}(\textbf{Z})\right)_{+}+\lambda p\] \[= \max_{\lambda\geq 0}\left(p-q_{\textbf{X}}\right)\!\lambda- \left(1-q_{\textbf{X}}\right)\!\left(\lambda-1\right)_{+}\] \[= \max(p-q_{\textbf{X}},~{}0),\]

where \(q_{\textbf{X}}\) is consistent with the definition in Theorem 1:

\[q_{\textbf{X}}=1-\prod_{j\in[L],x_{j}\neq\tilde{x}_{j}^{*}}\frac{n_{x_{j}, \tilde{x}_{j}^{*}}}{n_{x_{j}}}=1-\prod_{j=1}^{R}q_{x_{\ell_{j}}}.\]

Here equation (4) is by calculation using the assumption of Theorem 1. The optimization of \(\max_{\lambda\geq 0}\) in (4) is an elementary step: if \(p\leq q\), we have \(\lambda^{*}=0\) with solution \(0\); if \(p\geq q\), we have \(\lambda^{*}=1\) with solution \((p-q_{\textbf{X}})\). This finishes the proof of the lower bound. The proof the upper bound follows similarly. 

Proof of Lemma 2Notice that we have

\[\int\left(\lambda d\Pi_{\textbf{X}}(\textbf{Z})-d\Pi_{\textbf{X}^ {\prime}}(\textbf{Z})\right)_{+}= \sum_{\textbf{Z}\in S_{\textbf{X}^{\prime}}\cap S_{\textbf{X}}} \left(\lambda\left|S_{\textbf{X}}\right|^{-1}-\left|S_{\textbf{X}^{\prime}} \right|^{-1}\right)_{+}+\lambda\sum_{\textbf{Z}\in S_{\textbf{X}}-S_{\textbf{X} ^{\prime}}}\left|S_{\textbf{X}}\right|^{-1}\] \[= \left|S_{\textbf{X}^{\prime}}\cap S_{\textbf{X}}\right|\left( \lambda\left|S_{\textbf{X}}\right|^{-1}-\left|S_{\textbf{X}^{\prime}}\right|^{ -1}\right)_{+}+\lambda\left|S_{\textbf{X}}-S_{\textbf{X}^{\prime}}\right| \left|S_{\textbf{X}}\right|^{-1}.\]

Also notice that \(\left|S_{\textbf{X}}\right|=\prod_{j=1}^{L}n_{x_{j}}\); \(\left|S_{\textbf{X}^{\prime}}\right|=\prod_{j=1}^{L}n_{x_{j}^{\prime}}\); \(\left|S_{\textbf{X}^{\prime}}\cap S_{\textbf{X}}\right|=\prod_{j=1}^{L}n_{x_{j} ,x_{j}^{\prime}}\) and \(\left|S_{\textbf{X}}-S_{\textbf{X}^{\prime}}\right|=\prod_{j=1}^{L}n_{x_{j}}- \prod_{j=1}^{L}n_{x_{j},x_{j}^{\prime}}\). Plugging in the above value, we have

\[\left|S_{\textbf{X}}-S_{\textbf{X}^{\prime}}\right|\left|S_{\textbf {X}}\right|^{-1}= \frac{\prod_{j=1}^{L}n_{x_{j}}-\prod_{j=1}^{L}n_{x_{j},x_{j}^{ \prime}}}{\prod_{j=1}^{L}n_{x_{j}}}\] \[= 1-\prod_{j=1}^{L}\frac{n_{x_{j},x_{j}^{\prime}}}{n_{x_{j}}}\] \[= 1-\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j},x_{j}^{ \prime}}}{n_{x_{j}}}.\] 

And also,

\[\left(\lambda\left|S_{\mathbf{X}}\right|^{-1}-\left|S_{ \mathbf{X}^{\prime}}\right|^{-1}\right)_{+}= \left(\lambda\prod_{j=1}^{L}n_{x_{j}}^{-1}-\prod_{j=1}^{L}n_{x_{ j}^{\prime}}^{-1}\right)_{+}\] \[= \left(\lambda\prod_{j\in[L],x_{j}=x_{j}^{\prime}}n_{x_{j}}^{-1} \prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j}}^{-1}-\prod_{j\in[L],x_{j}=x_ {j}^{\prime}}n_{x_{j}^{\prime}}^{-1}\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}} n_{x_{j}^{\prime}}^{-1}\right)_{+}\] \[= \prod_{j\in[L],x_{j}=x_{j}^{\prime}}n_{x_{j}}^{-1}\left(\lambda \prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j}}^{-1}-\prod_{j\in[L],x_{j} \neq x_{j}^{\prime}}n_{x_{j}^{\prime}}^{-1}\right)_{+}.\]

Plugging in the above value, we have

\[\left|S_{\mathbf{X}^{\prime}}\cap S_{\mathbf{X}}\right|\left( \lambda\left|S_{\mathbf{X}}\right|^{-1}-\left|S_{\mathbf{X}^{\prime}}\right|^ {-1}\right)_{+}= \prod_{j=1}^{L}n_{x_{j},x_{j}^{\prime}}\left(\lambda\left|S_{ \mathbf{X}}\right|^{-1}-\left|S_{\mathbf{X}^{\prime}}\right|^{-1}\right)_{+}\] \[= \prod_{j\in[L],x_{j}=x_{j}^{\prime}}n_{x_{j}}\prod_{j\in[L],x_{j} \neq x_{j}^{\prime}}n_{x_{j},x_{j}^{\prime}}\left(\lambda\left|S_{\mathbf{X}} \right|^{-1}-\left|S_{\mathbf{X}^{\prime}}\right|^{-1}\right)_{+}\] \[= \prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j},x_{j}^{\prime}} \left(\lambda\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j}}^{-1}-\prod_{j \in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j}^{\prime}}^{-1}\right)_{+}\] \[= \prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j},x_{j}^{\prime}} \prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}n_{x_{j}}^{-1}\left(\lambda-\prod_{j \in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j}}}{n_{x_{j}^{\prime}}}\right)_{+}\] \[= \left(\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j},x_{j} ^{\prime}}}{n_{x_{j}}}\right)\left(\lambda-\prod_{j\in[L],x_{j}\neq x_{j}^{ \prime}}\frac{n_{x_{j}}}{n_{x_{j}^{\prime}}}\right)_{+}.\]

Combining all the calculation, we get

\[\int\left(\lambda d\Pi_{\mathbf{X}}(\mathbf{Z})-d\Pi_{\mathbf{X} ^{\prime}}(\mathbf{Z})\right)_{+}\] \[= \lambda\left[1-\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x _{j},x_{j}^{\prime}}}{n_{x_{j}}}\right]+\left[\prod_{j\in[L],x_{j}\neq x_{j}^{ \prime}}\frac{n_{x_{j},x_{j}^{\prime}}}{n_{x_{j}}}\right]\left[\lambda-\prod_{ j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j}}}{n_{x_{j}^{\prime}}} \right]_{+}.\]

Proof of Lemma 3It is sufficient to proof that, for any \(\mathbf{X}^{\prime}\neq\mathbf{X}^{*}\), we have

\[\int\left(\lambda d\Pi_{\mathbf{X}}(\mathbf{Z})-d\Pi_{\mathbf{ X}^{*}}(\mathbf{Z})\right)_{+}\geq\int\left(\lambda d\Pi_{\mathbf{X}}(\mathbf{ Z})-d\Pi_{\mathbf{X}^{\prime}}(\mathbf{Z})\right)_{+}.\]

Notice that for any \(\lambda\geq 0\), define

\[Q(\mathbf{X},\mathbf{X}^{\prime\prime})=\lambda\left[1-\prod_{j\in[ L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j},x_{j}^{\prime\prime}}}{n_{x_{j}}} \right]+\left[\prod_{j\in[L],x_{j}\neq x_{j}^{\prime}}\frac{n_{x_{j},x_{j}^{ \prime\prime}}}{n_{x_{j}}}\right]\left(\lambda-1\right)_{+}.\]

Given any \(\mathbf{X}\), we can view \(Q(\mathbf{X},\mathbf{X}^{\prime\prime})\) as the function of \(n_{x_{i},x_{i}^{\prime\prime}}/n_{x_{i}}\), \(i\in[L]\). And \(Q(\mathbf{X},\mathbf{X}^{\prime\prime})\) is a decreasing function of \(n_{x_{i},x_{i}^{\prime\prime}}/n_{x_{i}}\) for any \(i\in[L]\) when fixing \(\frac{n_{x_{j},x_{j}^{\prime\prime}}}{n_{x_{j}}}\) for all other \(j\neq i\). Suppose \(\tilde{r}_{k}\) is the \(k\)-th smallest quantities of \(n_{x_{i},\tilde{x}_{i}^{*}}/n_{x_{i}}\), \(i\in[L]\) and \(r_{k}^{\prime}\) is the \(k\)-th smallest quantities of \(n_{x_{j},\tilde{x}_{j}^{*}}/n_{x_{i}}\), \(i\in[L]\). By the construction of \(\mathbf{X}^{*}\), we have \(\tilde{r}_{k}\leq r_{k}^{\prime}\) for any \(k\in[L]\). This implies that

\[Q(\mathbf{X},\mathbf{X}^{*})\geq Q(\mathbf{X},\mathbf{X}^{\prime}).\] 



#### a.2.3 Proof of Theorem 2

We denote \(g^{\mathbf{RS}}(\mathbf{X},y)=p_{A}\), \(g^{\mathbf{RS}}(\mathbf{X},y_{B})=p_{B}\) and \(q=q_{\mathbf{X}}\) in this proof for simplicity. The \(\mathbf{X}^{*}\) below is the one defined in the proof of Lemme 3. Our proof is based on constructing a randomized smoothing classifier that satisfies the desired property we want to prove.

Case 1\(p_{A}\geq q\) and \(p_{B}+q\leq 1\)Note that in this case \(\left|S_{\mathbf{X}}\cap S_{\mathbf{X}^{*}}\right|/\left|S_{\mathbf{X}}\right| =1-q\geq(p_{A}-q)+p_{B}\), where the inequality is due to \(p_{A}+p_{B}\leq 1\). Therefore, we can choose set \(U_{1}\) and \(U_{2}\) such that \(U_{1}\subseteq S_{\mathbf{X}}\cap S_{\mathbf{X}^{*}}\); \(U_{2}\subseteq S_{\mathbf{X}}\cap S_{\mathbf{X}^{*}}\); \(U_{1}\cap U_{2}=\emptyset\); \(\left|U_{1}\right|/\left|S_{\mathbf{X}}\right|=p_{A}-q\) and \(\left|U_{2}\right|/\left|S_{\mathbf{X}}\right|=p_{B}\). We define the classifier:

This classifier is well defined for binary classification because \(S_{\mathbf{X}}\cap S_{\mathbf{X}^{*}}-(U_{1}\cup U_{2})=\emptyset\).

Case 2\(p_{A}<q\) and \(p_{B}+q\leq 1\)In this case, we can choose set \(U_{1}\) and \(U_{2}\) such that \(U_{1}\subseteq S_{\mathbf{X}}-S_{\mathbf{X}^{*}}\); \(U_{2}\subseteq S_{\mathbf{X}}\cap S_{\mathbf{X}^{*}}\); \(\left|U_{1}\right|/\left|S_{\mathbf{X}}\right|=p_{A}\) and \(\left|U_{2}\right|/\left|S_{\mathbf{X}}\right|=p_{B}\). We define the classifier:

\[f^{*}(\mathbf{Z})=\begin{cases}y&\text{if $\mathbf{Z}\in U_{1}$}\\ y_{B}&\text{if $\mathbf{Z}\in U_{2}\cup(S_{\mathbf{X}^{*}}-S_{\mathbf{X}})$}\\ \text{other class ($c\neq y$ or $y_{B}$)}&\text{if $\mathbf{Z}\in S_{\mathbf{ X}}-(U_{1}\cup U_{2})$}\\ \text{any class ($c\in\mathcal{Y}$)}&\text{otherwise}\end{cases}\]

This classifier is well defined for binary classification because \(S_{\mathbf{X}}-(U_{1}\cup U_{2})=\emptyset\).

Case 3\(p_{A}\geq q\) and \(p_{B}+q>1\)This case does not exist since we would have \(p_{A}+p_{B}>1\).

Case 4\(p_{A}<q\) and \(p_{B}+q>1\)We choose set \(U_{1}\) and \(U_{2}\) such that \(U_{1}\subseteq S_{\mathbf{X}}-S_{\mathbf{X}^{*}}\); \(U_{2}\in S_{\mathbf{X}}-S_{\mathbf{X}^{*}}\); \(U_{1}\cap U_{2}=\emptyset\); \(\left|U_{1}\right|/\left|S_{\mathbf{X}}\right|=p_{A}\) and \(\left|U_{2}\right|/\left|S_{\mathbf{X}}\right|=p_{B}-(1-q)\). Notice that the intersect of \(U_{1}\) and \(U_{2}\) can be empty as \(\left|U_{1}\right|/\left|S_{\mathbf{X}}\right|+\left|U_{2}\right|/\left|S_{ \mathbf{X}}\right|=p_{A}+p_{B}-(1-q)\leq 1-(1-q)=q=\left|S_{\mathbf{X}}-S_{ \mathbf{X}^{*}}\right|/\left|S_{\mathbf{X}}\right|\). We define the classifier:

\[f^{*}(\mathbf{Z})=\begin{cases}y&\text{if $\mathbf{Z}\in U_{1}$}\\ y_{B}&\text{if $\mathbf{Z}\in U_{2}\cup S_{\mathbf{X}^{*}}$}\\ \text{other class ($c\neq y$ or $y_{B}$)}&\text{if $\mathbf{Z}\in(S_{ \mathbf{X}}-S_{\mathbf{X}^{*}})-(U_{1}\cup U_{2})$}\\ \text{any class ($c\in\mathcal{Y}$)}&\text{otherwise}\end{cases}\]

This classifier is well defined for binary classification because \(S_{\mathbf{X}}-S_{\mathbf{X}^{*}}-(U_{1}\cup U_{2})=\emptyset\).

It can be easily verified that for each case, the defined classifier satisfies all the conditions in Theorem 2.

## Appendix B Additional Experiment Details

We set \(R=L\) in adversarial attacking, that is, all words in the sentence can be perturbed simultaneously by the attacker. We use 5,000 random draws in the Monte Carlo estimation of \(\Delta_{\mathbf{X}}\), and use the same method in Jia et al. (2019) to tune the hyper-parameters when training the base models e.g. learning rate, batch size and the schedule of loss function. For the IMDB dataset, we train the IBP models and ours for 60 and 10 epochs, respectively. For the Amazon dataset, we train the IBP models and ours for 100 and 20 epochs, respectively.

We test our algorithm on two different datasets, IMDB and Amazon. The IMDB movie review dataset Maas et al. (2011) is a sentiment classification dataset. It consists of 50,000 movie review comments with binary sentiment labels. The Amazon review dataset McAuley (2013) is an extremely large dataset that contains 34,686,770 reviews with 5 different types of labels. Similar to Cohen et al. (2019), we test the models on randomly selected subsets of the test set with 1,250 and 6,500 examples for IMDB and Amazon dataset, respectively