Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
Authors: Thomas Massena
Léo Andéol
Thibaut Boissin
Franck Mamalet
Corentin Friedrich
Mathieu Serrurier
Sébastien Gerchinovitz
Venue: ICML 2025 poster (2025)
Keywords: robustness
conformal prediction
uncertainty quantification
lipschitz networks
Primary area: deep_learning->robustness
TL;DR: This paper conducts a careful study of conformal prediction under attack: it provides an efficient framework for robust conformal prediction and introduces a powerful robustness auditing process for vanilla conformal prediction.

Abstract: Conformal Prediction (CP) has proven to be an effective post-hoc method for improving the trustworthiness of neural networks by providing prediction sets with finite-sample guarantees. However, under adversarial attacks, classical conformal guarantees do not hold anymore: this problem is addressed in the field of Robust Conformal Prediction. Several methods have been proposed to provide robust CP sets with guarantees under adversarial perturbations, but, for large scale problems, these sets are either too large or the methods are too computationally demanding to be deployed in real life scenarios. In this work, we propose a new method that leverages Lipschitz-bounded networks to precisely and efficiently estimate robust CP sets. When combined with a 1-Lipschitz robust network, we demonstrate that our *lip-rcp* method outperforms state-of-the-art results in both the size of the robust CP sets and computational efficiency in medium and large-scale scenarios such as ImageNet. Taking a different angle, we also study vanilla CP under attack, and derive new worst-case coverage bounds of vanilla CP sets, which are valid simultaneously for all adversarial attack levels. Our *lip-rcp* method makes this second approach as efficient as vanilla CP while also allowing robustness guarantees.

Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
Thomas Massena 12 Léo Andéol 32 Thibaut Boissin 4 Franck Mamalet 4 Corentin Friedrich 4
Mathieu Serrurier'
Sébastien Gerchinovitz 43
Abstract
provide additional information on the output of a model, indicating the confidence in its prediction.
Conformal Prediction (CP) has proven to be an effective post-hoc method for improving the trust- worthiness of neural networks by providing pre- diction sets with finite-sampii sample guarantees. How- ever, under adversarial attacks, classical confor- mal guarantees do not hold anymore: this prob- lem is addressed in the field of Robust Conformal Prediction. Several methods have been proposed to provide robust CP sets with guarantees under adversarial perturbations, but, for large scale prob- lems, these sets are either too large or the meth- ods are too computationally demanding to be de- ployed in real life scenarios. In this work, we propose a new method that leverages Lipschitz- bounded networks to precisely and efficiently es- timate robust CP sets. When combined with a I-Lipschitz robust network, we demonstrate that our lip-rep method outperforms state-of-the-art results in both the size of the robust CP sets and computational efficiency in medium and large- scale scenarios such as ImageNet. Taking differ- ent angle, we also study vanilla' CP under attack, and derive new worst-case coverage bounds of vanilla CP sets, which are valid simultancously for all adversarial attack levels. Our lip-rep method makes this second approach as efficient as vanilla CP while also allowing robustness guarantees.
We focus here on a UQ framework called Conformal Pre- diction (CP), which provides guarantees in nominal settings. It is a finite-sample, distribution- and agdel-agnostic framework that efficiently constructs prediction sets which contain the ground truth with high probability. The main un- derlying assumption is mild: calibration and test data points are assumed to be exchangeable (a lighter assumption than independence and identical distribution) (Vovk et al., 2005). CP has successfully been applied to numerous fields: classi- fication (Sadinle et al., 2019; Ding et al., 2024), regression (Papadopoulos al., 201 1: Romano et al., 2019), object de- tection (Andéol et al., 2023; Timans al., 2025), semantic segmentation (Brunekreef et al., 2024; Mossina et al., 2024) and generative models (Mohri & Hashimoto, 2024; Teneggi et al., 2023). Overall, CP represents powerful tool in order to trust deep learning systems in their nominal settings.
However, research on adversarial robustness has demon- strated that state-of-the-art models can be misled with mini- mal adversarial input perturbations (Szegedy et al., 2014). This vulnerability has led to extensive research into adver- sarial robustness, focusing on both attack strategies and defense mechanisms (Goodfellow et al., 2015; Carlini & Wagner, 2017). However, some popular adversarial defense strategies have been shown not to hold in the face of more sophisticated attacks (Athalye et al., 2018). Therefore, re- search on certifiable robustness aims to provide theoretical worst-case guarantees for model performance under adver- sarial attacks independently from the attack method. These certified robustness methods also exhibit interesting prop- erties in the domains of Reinforcement Learning (Russo & Proutiere, 2019; Corsi et al., 2020), Differential Privacy (Béthune et al., 2024; Wu et al., 2024), explainable AI (Ser- rurier et al., 2024; Fel et al., 2023).
1. Introduction
With the development of neural networks, and their appli- cations in industrial settings, the study of their reliability has become prevalent. Many approaches have been studied to improve the trustworthiness of neural networks (Delseny et al., 2021). One of them is Uncertainty Quantification (UQ), which has become key research domain for deploy- ing safety-critical deep learning models. Its purpose is to
Recently, some works in robust Conformal Prediction (Li et al., 2024; Ledda et al., 2023; Liu al., 2024) have demonstrated that minimal adversarial perturbations can undermine its associated guarantees. Therefore, developing provably robust CP methods is a crucial objective in order to reconcile the guarantees of CP in nominal settings and the worst-case guarantees of certifiably robust systems. Indeed,
'Equal contribution 'IRIT PSNCF de Mathématiques de Toulouse 'IRT Saint Exupery. Correspondence to: Thomas Massena <thomas maw.amsaaannnnaeaaaa @ iri..ft>>.
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 202.5 by the author(s).
'Throughout this paper we refer to standard CP as vanilla CP.

---

Efficient Robust Conformal Prediction via Lipschitz- Bounded Networks
Worst case conformal scores
Cunservativs Confermal Sconea
Restrictive Contormal Scores ran iosesac bonnbaluttzto
mas recisore tounces mosks
fa
gboon. deg.
Ca (ayl
B
Original Confornal Scores
Possible adverserial prediction eets
Our finite-sample guarantees:
(a))=
Ca(a) = aM |
Robust Conformal Prediction
Auditing Vanilla GP
Calar) -| abobon, eat
We
inferenci:
The coverage of the attached vanilla prediction set belonga to
Crl(ry) =| skunk cat
Die (e). Tiblell
Wilbon
Ca(ira) =
C.s
coverage.
computed on Powt
Figure 1: Our framework allows different certifiable guarantees for conformal prediction sets. Through the fast estimation of worst-casc conformal prediction scores, the user can either return Ca, which provably verifies Def. 2.2 ($ 4). Or, compute worst-case conformal coverage bounds Ymm (e) and 7,ū (e) of vanilla CP sets Dieet through efficient post-hoc auditing process a holdout dataset Deval. This guarantee holds with probability
($ 3). Importantly the latter's coverage bounds hold over all c levels.
the vulnerability of CP methods to adversarial attacks raises significant concerns for deploying CP in safety-critical set- tings, where reliability is essential.
CIFAR-100, Tiny ImageNet and ImageNet datasets. Our experiments showcase negligible computational overhead compared to vanilla CP, with best-in-class performances for both robust CP and vanilla CP's au- diting.
For this purpose, several approaches were proposed to con- struct robust conformal sets by using randomized smoothing methods (Gendler et al., 2022; Yan et al., 2024) or formal verification solvers (Jeary et al., 2024). These methods in- flate the CP sets in order for them to remain valid under adversarial conditions. Therefore, the performance of ro- bust CP methods is measured by their ability to provide small and meaningful CP sets which maintain 1 confor- mal coverage under c-bounded perturbations. Unfortunately, these works suffer from two penalties: they lack scalability, and/or provide conservative prediction sets that are too large for practical usage. We address these two shortcomings through the following set of contributions:
2. Background and Related Works
2.1. Split Conformal Prediction
Multiple approaches to Conformal Prediction exist (Vovk et al., 2005; Angelopoulos & Bates, 2023). We focus on Split Conformal Prediction (Papadopoulos et al., 2002), a variant applied post-hoc using separate data split. This ap- proach has the advantage of being applicable any model, even pre-trained work, we focus on classification tasks. We denote X' as the input domain for classifier f X + Re which maps inputs to class logits of labels E ) with Card())) = c the number of classes. Generally lowercase letters x, refer to deterministic examples, while uppercase letters X,Y Y are for random variables. Split CP methods construct prediction sets Ca (z) that contain the true label with probability least 1 - a, where E Reaa+I 1) is user-specified risk.?
different dataset. Throughout this
1. We complement theoretical guarantees on robust CP from a different angle. We introduce new method to audit vanilla CP's robustness to adversarial attacks. We derive the first sound coverage bounds for vanilla CP that are valid simultaneously across all attack levels.
2. We provide simple and efficient method, called lip- rcp, to compute lower and upper bounds on CP scores under adversarial attacks. The method applies to any Lipschitz- bounded network, and can be used both to construct robust CP sets and to audit vanilla CP's ro- bustness. is tailored for efficiency and compatibility with real-time embedded systems.
For this purpose, CP defines 8 : X x y + RR a non- conformity score that measures the degree of incorrectness of a prediction f(x) for ground truth label y. On hold- out "calibration" data split Deal (X' x y)" the non- conformity score is computed for each instance, denoted as R s(X; Yi) for i E {l.... .,. Heal), along with the quantile of the score Ga = ((matty))a)) (where H represents the R, scores sorted ascending order). For a
3. We propose to combine lip-rcp with robust 1-Lipschitz networks with tight certified Lipschitz bounds. This al- lows to obtain tight estimates on worst-case variations of conformal prediction scores.
'Though some papers might mention the interval (0, 1), this is slight abuse of notation, since split CP methods are only well defined for a 2 1/(real + 1).
4. We validate the whole approach across the CIFAR-10,
2

---

Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
given example Frest, the prediction set is then defined as Co (Freet) = (y y s(Itest; V) S qa This formulation is quite intuitive: the prediction set C. (Zrest) is defined as all the labels y that would lead to non-conformity score be- low Zo. and would place among the 1 - a most conforming pairs compared to the calibration set. This set then satisfies the following coverage guarantee.
Definition 2.4. Let & X. A robust prediction set (or conservative prediction set) under c-bounded adversarial perturbations around æ is defined as:
(x)) = {y E 3 s(x, v) - qa
(4)
where & is a conservative score under e-bounded adversarial perturbations.
Theorem 2.1 (Vovk et al. 2005). Let Deal {(X,, Vesisnn and (Xrest, Y(sr)) be exchangeable ran- dom variables. For any non non-conformity score s: : X x y + I and any user-specified risk E
General formulation Importantly, the robust prediction set of Def. 2.4 verifies robust CP coverage as defined in Def. 2.2, and as demonstrated in Jeary et al. (2024). More- over, as general rule, robust CP methods revolve around the tight estimation of the conservative score of Eq. (3) in order to verify robust CP coverage. We now discuss the specifics of these computations.
(eaatt 1). the predic- tion set C. (Xust)) = ty E V: s(eestt 2) } satisfies:
IP (Yrest E Cr 2- ax,
(1)
where the probability is taken over the random draws of both Deat and (X Yuest): ).
2.3. Related Works
Monte-Carlo methods In order to compute robust CP sets, the initial work of Gendler et al. (2022) leverages a smoothed score function from the framework of randomized smoothing (Cohen al., 2019). The RSCP score is defined as:
This result allows turning predictions from any black-box model f into prediction sets with guaranteed risk level. However, this guarantee marginal: the error rate of a only bounds an average error over all possible values of Xuest-
2.2. Robust Conformal Prediction
(5) with 1-1 the inverse CDF of the standard normal dis- tribution of standard deviation a,, which satisfies for any (x, E EX y:
3(I, y) = --1 (EAEN(O.. + A A))),
Extending the CP guarantee of Theorem 2.1 to cover ad- versarial conditions was first explored in the seminal work of Gendler et al. (2022). In this paper, the following def- inition of Robust Conformal Prediction given. For any X. we write B. (x) {a' E X'; : || || =I1 S e).
SRSCp( v) = $(x, v) o¹
(6)
Definition 2.2 (Robust Conformal Prediction). Let Dext = {(X,, Ie) and (Xrest, Y(est) be exchangeable ran- dom variables. A prediction set Co, said to be robust to e-bounded perturbations for any random variable Xtest such that Xtest E B, (B((Xesst .eett) almost surely,
therefore providing a conservative score which will be used to enforce robust CP. However, due to the unknown nature of the expectation in Eq. (5), it is estimated by a Monte Carlo (MC) procedure for which no correction applied.
Later work (Yan et al., 2024) enables provable robustness coined as the RSCP+ method by introducing both a cor- rective factor on the expectation estimation and accounting for the error probability of the MC estimation process by adjusting the calibration threshold. Additionally, this paper introduces PTT, an extension to their method with the use of an extra Dholdous data split to obtain better robust CP met- rics. Similarly, the CAS method relies on CDF-Aware Sets (Zargarbashi et al., 2024) for certifiably robust CP. These CAS sets provide generally tighter bound for smoothed CP scores than RSCP. In independent work to ours, Zargar- bashi & Bojchevski (2025) propose binary-certificate based method (BinCP) for robust CP with improved sample efficiency and tighter binary certificate bounds.
P Yuus (Xess) 2 21-a.
Enforcing Def. 2.2 ensures the coverage guarantee of Theo- rem 2.1 in worst-case adversarial conditions for any sample under c-bounded adversarial perturbations.
The initial intuition behind robust CP methods is the fol- lowing: by computing provable lower bounds for conformal prediction scores under attack, it is possible to guarantee robust CP coverage as defined in Def. 2.2. We recall the following concepts, which appear under several wordings in the literature.
Definition 2.3. A conservative score under e-bounded ad- versarial perturbations any function s : X x y + R such
Deterministic methods The authors of VRCP (Jeary et al., 2024) leverage formal verification- based solvers (Katz et al., 2017) to provide a deterministic lower bound of Eq. (3) valid locally around x. Interestingly, they devise two methods
that, for all (a,, v) E X x
s( (x.. v) < inf s(ā.))
(3)
(x).
3

---

Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
to achieve robust CP: VRCP-/ uses standard vanilla CP calibration procedure, then computes conservative scores around each test point Ttest. These scores are then used to form the robust CP set (Trest) VRCP-C however com- putes conservative scores around each pair (Ni, 9e) E 'Dal and then calibrates the model using these conservative scores to provide a robust CP guarantee which holds at inference and requires no extra computations at test time. Unfortunately, computing exact bounds for Eq. (3) is often untractable for neural networks. Therefore, formal verifi- cation methods use incomplete solvers to compute loose bounds on small to medium size model architectures.
3. Certifiable Coverage Bounds for Vanilla CP Under Attack
In this section, we address the robustness of CP methods to adversarial attacks from different angle than in Sec- tions 2.2 and 2.3. Instead of enlarging vanilla CP's predic- tion sets to make them robust by design, we provide tools to reliably evaluate by how much the nominal - a cov- crage of vanilla CP for clean data is impacted under attack. This can be useful when prediction sets of small size are desired, yet knowledge of certifiable coverage guarantees under bounded perturbations are still required. The ques- tion of auditing vanilla CP under attacks was already raised earlier (Gendler et al., 2022: Zargarbashi et al., 2024). We provide a rigorous answer below. As a benefit, our guarantee holds simultaneously for all perturbation budgets > 0.
Independently, Ghosh et al. (2023) introduced a novel "quan- tile of quantiles" method for robust CP based on calibration- time operations. In order to mitigate the set size inflation phenomenon that is inherent to robust CP, the PRCP method provides relaxed "average" coverage guarantee over a pre- defined noise distribution. These guarantees are applica- ble on top of most robust CP methods and can be seen as orthogonal to all previously mentioned works, as argued in Zargarbashi et al. (2024). Moreover, complementing pre- vious methods, Aolaritei et al. (2025) propose an extended framework that also provides robustness against global per- turbations.
We show in Section 4 how to efficiently implement methods from both approaches (Section 2.2 and this section) when working with Lipschitz-bounded neural networks.
3.1. Setting: Vanilla CP Under Attack
Let h be any function that constructs an adversarial example M(,,)) 6) E (x) from any input x E X, with an attack budget at most of e, ie.. [[((z,)] e) - =|| S e. We define the coverage under attack by
Scaling robust CP Current methods for estimating con- servative scores exhibit severe scalability issues. Indeed, verification methods have computational complexities that grow quadratically with the number of neurons and layers of the model. Moreover, randomized smoothing methods require Te times more memory at inference time to run an MC estimation process. Also, some theoretical works indi- cate that the certifiable radii of smoothing methods suffers greatly from high input dimensionality (Wu et al., 2024).
The (E) =P Dence (Yrest E C. (h(Xeestt e))
where the probability is taken with respect to the random pair (Xtest, YLest). ). In more mathematical terms, the proba- bility is conditional to Deati all statements in this section are valid for any realization of Deat. Note that here, contrary to robust CP, we consider the vanilla CP set C..
In the sequel, we show how to provide bounds on 76 (e). Since the attack h is unknown, we introduce two functions 7 and र that can be reliably approximated, and for which ((t) < (c)(<) I F(c). To that end, we define both conserva- tive and restrictive prediction sets as follows; (x)) is a tight version of (4), while (x) is new
Overall, these different limitations represent an obstacle to scaling robust CP larger inputs, models and generally harder tasks such as the ImageNet dataset for example. In this paper, we present framework for robust CP with deter- ministic Lipschitz bounds that has no such limitations and avoids time or memory complexity issues at scale.
Definition 3.1 (ConservativeRRestiitiee Prediction Set). Consider the two scores
Paper Outline. The paper is organized as follows. In Section 3 we start by complementing theoretical guarantees on CP's robustness by designing a new auditing process for vanilla CP under attack. We prove coverage bounds that are valid simultaneously across all attack levels. In Section 4, we introduce our lip-rep method and leverage Lipschitz-bounded neural networks to efficiently and ac- curately approximate local variations of CP scores. This enables efficient robust CP set construction and vanilla CP auditing. Finally, when combined with Lipschitz- by-ttsg networks, we demonstrate the efficiency and superior per- formances of our approach on several image classification datasets (Section 5).
s(x, y) inf s(ā,y) (EB,(x)
(8)
5(x, v) sup
s(ā. v)
(x)
For any x E X, we define the conservative prediction set by (x) {y E y s(x, v) I ), and the restrictive prediction set by C... (x) (v E ) 8(x v) S g.
When x + s(x, y) is Lipschitz, both sets can be efficiently (and provably) approximated, as shown in Section 4. We are now ready to introduce the two functions 2 and 7
4

---

Efficient Robust Conformal Prediction via Sipschitz-Boundee Networks
defined for all E 2 by
Assumption 3.2.
(A1) X R is convex and closed (for some d 2 1);
2({) - PDicu (Yrett E (Xtss))
(10)
7(c) = Pene (Yrest E Caae (X(cs))
(11)
(A2) x E X + s(x, y) is continuous for all y E V.
Noting that s(x, v) & (), S ((x and there- fore C. _ (a))(.)) S C., we can see that 2(() S ((()) I 7(c) for all c 2 O. Therefore, though not used by vamilla CP, the sets Ca,c and Ca,e(Xues)) are instrumental in controlling the coverage under attack.
The first condition (A1) is satisfied, e.g., for classical vector spaces used to represent images (such as R RB-W-3, with H and W respectively the height and width of the images). Importantly, the assumption on the underlying space X' and not on the probability distribution over it. Therefore, in our application setting, it holds true even if the distri- bution of images has nonconvex support. The second condition (A2) is satisfied whenever the score is of the form s(z, y) = (f(()), y), for a continuous model f and some continuous function u + v/u, In our setting, the as- sumption always holds true, due to both f and s(,,)) being ppsschizz-continuout
3.2. A Provable and Tight Control on 2 and 7
The question of bounding 2(+) from below, i.e., guarantee- ing minimal coverage of vanilla CP under attack, already appeared in Theorem 2 by Gendler et al. (2022). We how- ever realized that a subtle mathematical mistake (of an over- fitting flavor) was unfortunately left aside, which impacts the correctness of their guarantee; see Appendix A for de- tails. The same mistake was reproduced in the second part of Proposition 5.1 by Zargarbashi et al. (2024).
The main result of this section is the following.
Theorem 3.3. Suppose that Assumption 3.2 holds true. As- sume also that Deal, Deval, Doest are made of i.idd. pairs (Xi, Y:). Let qa be the empirical quantile computed by vanilla CP using Deal, and let m 2 2 be the number of points in Deval-
To overcome this overfittin--type issue, we work with additional dataset Deval of m data points drawn i.i.d. from the same distribution but independently from Deat- Denote these points by (X,, Y.)igigm.
Let 8 E 10,1) and set 8' = 5/(2m 2). Then, for any attack function h and almost every Deal.
Let 1 denote the indicator function. We define empirical counterparts (based on Deval) of (c) and 7(c) as follows: for all é 220 0,
Preval (ve > 0, (e, S mm())= S (e) 2 21-6, 8,
(16)
(t(()=
1 m im
Σ 1Y (X,,)x.)))))
(12) where the probability is over the random draw of Deval."
The proof follows by combining 2(c) I (m(c) S 7()) with Theorems B.2 and B.3 in Appendix B (applied with the risk level 5/2), followed by a union bound. These theo- rems are similar in spirit to the DKW inequality (Dvoretzky et al., 1956; Massart, 1990) or variants (Vapnik & Chervo- nenkis, 1974; Anthony & Shawe-Taylor, 1993), which are useful concentration inequalities to estimate an unknown cumulative distribution function based on i.i.d. samples. In particular, borrow arguments from Ducoffe et al. (2020, Theorem 1), combined with a careful treatment of disconti- nuity points of and 7.
2m
(c)
10 (X,))
(13)
To account for statistical deviations, next we work with slightly corrected estimators studied earlier, e.g., by Lang- ford & Schapire (2005). For m 2 1, p E J0, 1]. and 0 S k S m, we write F E (7)) (7))'(( -p)d for the cumulative distribution function of the Binomial(m,,2 p) distribution. For any attack budget e 2 0 and any risk level
5 E (0, 1), we define
Ttt 5) = max p E [0, 1] Fm. (NF 2 {] (14)
Interpretation Our result provides a probabilistic guar- antee for robustness under adversarial attacks of arbitrary budgets. Specifically, for any calibration set Deal and any attack function h (regardless of the norm), the coverage under attack 7th bounded by Y and / with probabil- ity over the randomness in the holdout set Deval. simultancously for all perturbation budgets
2m 0)) = 1-max p E [0, 1]:Fmmmpp (m(1 (m(1- (e)) 2 8)
(15)
Though technical at first sight, these estimators tailored for the binomial distribution and thus tighter than, e.g., high- probability bounds obtained from Hoeffding's bound. Given (m)(c) and 2 (c), they can be efficiently computed with a binary search (by monotonicity of p + (k).
0. This
"Note that, this section, we do not assume that x ++ s(xr y) is smooth (beyond continuity), contrary to scores obtained after randomized smoothing.
Next we work under the following mild assumptions on the input space X' and the non-conformity score s(x, y).
'In more formal terms, the probability Po (.) is conditional to Deal, and our incquality holds almost surely.
5

---

Efficient Robust Conformal Prediction via Lipschitz- Bounded Networks
simultaneity strengthens the practical utility of the bounds, as no prior assumptions about the adversary's strategy are required. Moreover, this result holds not only for the exact sets Ca.e and Co . but also for any Ca,e and Ca,, verifying S... Ca.e and Ca,e C Co..- This allows to approxi- mate sets from common robustness approaches, such as that of Section 4. Naturally, the informativeness of the bound is directly linked to the tightness of the estimate.
Pronss
Nervidbuun Coltmento
600
5000
0.00
VROP-C
VRDF1
RSOP
GAB
Jears]
Figure 2: Calibration and test time on the CIFAR-I 10 dataset for different robust CP methods. Our method has negligible overhead compared to vanilla CP. Here we use = 4750, Meeest 4750 and Nme 1024, CAS (lite) corresponds to the version of CAS that leverages CDF-Aware smoothed Prediction Sets only at calibration time.
4. Fast Computations for Robust and Vanilla CP with Lipschitz bounds
In this section, we introduce Lipschitz bounds for neural networks and use their validity across the totality of the support of X' to enable fast computations of conservative and restrictive scores.
schitz bounds. Finally, these constraints also mitigate the gradient vanishing problem (Li et al., 2019) and allow for more efficient training.
4.1. On the Lipschitz Constant of Neural Networks
Therefore, Lipschitz- networks have two main advantages: their training objective explicitly promotes ro- bustness and the estimation of the Lipschitz constant is locally tight. These particular traits will be key to getting fast and tight estimations of the conservative and restrictive scores.
Definition 4.1 (Lipschitz constant). A neural network clas- sifier f : X + R is said to be L-Lipschitz in lp norm if it verifies the following behavior:
V(z. v) E 11fx)) f(y)lp L.||x yllp
(17)
4.2. Computing Conservative and Restrictive Conformal Scores
Importantly, most deep neural networks -excluding atten- tion based architectures (Havens et al., 2024)- are Lipschitz continuous.
In this section, we use the global Lipschitz bound of our networks efficiently estimate the conservative and restric- tive prediction sets at model inference. We call our method lip-rcp. These estimations are then used to construct robust CP sets and audit the robustness of vanilla CP as per $ 3. Our approach can be connected to the Lipschitz properties exhibited by the smoothed classifier introduced in RSCP.
Estimating Lipschitz constants of neural networks Computing the exact Lipschitz constant of deep neural net- works is an NP-hard problem as stated in (Virmaux & Sca- man, 2018). In order to mitigate this issue, some methods like (Wang et al., 2024) compute over-estimations of the Lipschitz constant of the network, for instance by comput- ing the product of the Lipschitz constant of the network's 's layers. Unfortunately, these methods currently offer very loose estimations, any breakthroughs in that field would benefit our framework.
However, at inference time, most Lipschitz weight re- parametrization schemes can be exported as a set of reg- ular neural network weights to eliminate any computational overhead compared to their unconstrained counterparts.
more popular alternative ad-hoc computation lies in the field of "Lipschitz by design" architectures. This very active field relies on the seminal work of (Anil et al., 2019) to provide efficient weight re- ce-paameerrizatoons that ensure 1 I-Lipschitz behavior in & norm (in general). Some notable examples include Riemannian optimization inspired imple- mentations (Lezcano Casado, 2019), or even performance- focused implementations with reduced computational over- heads during training (Araujo et al., 2023; Boissin et al., 2025). Using Lipschit networks introduces the several advantages. First and foremost, Lipschitz- constrained networks allow explicit control of their place- ment on the caansttess-accurace trade-off (Béthune et al., 2022). Also, additional orthogonality constraints on these networks have been shown to result generally tighter Lip-
Lipsehitz score bounds Assuming the non-conformity score sax y) can be expressed as (ff()) y) such that f is an L. -ip-ichchitz classifier and v(.,)) v) is LipLiscchitz in ep norm for all y V,
write:
Vy E ), 1s(2, v) s(x + d, & Im T.g -|011p- (18)
This induces the following bounds Vā E (x)x), Vy y::
s(x, y) La Lo. - S s(ē, S s(x. v) + Ln La (19)
= - (2.9)
=Rigung (2.1)
Score function In the literature of CP, the Least Ambigu- ous Classifier (LAC) score, usually based on the softmax function, is classically used to provide conformal scores.
6

---

Efficient Robust Conformal Prediction via Lipschitz- Networks
CIFAR-10 Robust CP (e = 0.03)
CIFAR-100 Robust CP (E 0.02)
TinylmageNet Robust CP (E 0.02)
100
100
100
Robust CP Coverage
98
96
96
96
38
92
92
92
Lower
5
5
8
40
60
80
100
60
80
100
120
140
160
180
200
Robust CP Set Size
Robust CP Set Size
Robust Set Size
lip-rcp
VRCP-C
VRCP4
RSCP+ Aec
CAS
CAS
PTT ne--
Results taken from VRCP paper
Results from our experiments
Figure 3: Robust CP set sizes and empirical coverage values across different classification datasets for = 0.1. Ideally, the best robust CP sets small while nearly achieving the desired coverage guarantee (bottom left comner. We plot values that were taken from the VRCP paper with diamonds while our measurements are plotted crosses.
One alternative we propose is to use sigmoid based con- formal prediction score that we call the LAC sigmoid score:
Method
Cal. complexity
Test complexity
RSCP
O (1ma)
(
CAS
O (nim)
O O x tb) (tv))
s(z, y) sigmoid [[t) -
(20)
VRCP-I
(1)
T
VRCP-C
(tvy)
O (1) ((1)
lip-rep (ours)
(1)
Importantly, the Lipschitz constant of this score function is L, = 1/(4 T) w.r.t (x))-
Table I:
Time complexity for computing single non-conformity score. Here nam is the number of Monte Carlo samples, to the CAS-bound cost, the VRCP solver cost. lip-rep the only method with constant-ting time calibration and inference.
Note that this score differs from the PTT score of (Gendler al., 2022) given that the value of {1),, is directly passed through the sigmoid of temperature T and bias b. No rank- ing transformation requiring extra data split is applied. Furthermore, replacing sxx y) with 1 softmax (xr/TT) would be similar in spirit. However, some experiments suggest that it might lead to larger prediction sets; see Ap- pendix E.
5. Empirical Validation
To validate the performance of our method, test framework across multiple classification datasets. Our net- works are composed of 1-Lipschitz feature extractor fol- lowed by a classification layer that ensures that every output respects a 1-Lipschitz condition. We provide information about of the computational overhead of training Lipschitz- constrained networks and the model architectures used for other methods in Appendix F. Finally, our code will be made available on the following github repository.
Unified calibration and test-time process The certifi- cates provided by VRCP hold locally around data points N.),D.D and VRCP distinguishes two possible robust CP procedures: robust calibration (VRCP-C) or robust in- ference (VRCP-/). However, using global Lipschitz bounds eliminates that need. Indeed, robust calibration thresh- old fa.e defined scores Stiprep( (x. y) of Eq. (19) yields the same results as robust inference given that the quantile computation is translation equivariant.
Training scheme We leverage networks with Lipschitz and orthogonality constraints from the library introduced in Boissin et al. (2025) to balance both performance and minimal training overhead. More details are provided in Appendix G.
Efficient computation To estimate the conservative and restrictive scores of Def. 3.1, can simply leverage the expression of the bounds of Fq. 19. We detail the time complexities for the computation of non-conformity by different certifiably robust CP methods in Table 1. In ad- dition, we provide runtimes for the calibration and testing steps of different methods in Fig. 2.
5.1. Robust CP Comparison
We evaluate our method on the CIFAR-1O, CIFAR-100 and Tiny Imaeenteeeet datasets. Our methodology follows that of the benchmark of VRCP and we adopt the same calibra- tion, holdout and test set sizes as Jeary al. (2024) on

---

Efficient Robust Conformal Prediction via Lipschitz- Bounded Networks
CIFAR10
CFFA100
Tryiingehhet
Imagetet
94
26
54
Mean sizee of :10.7
Moan size of Cu : 32.9
Moan size of Cyle): :.29
Figure 4: (Left): Comparison between vanilla CP coverage bounds using Lipschitz bounds the CROWN method with ō 10" Approximate computation times also provided. (Right): Corrected Ym and Ym bounds for vanilla CP methods under bounded adversarial noise computed on I-Lipschitz networks given 10 4, Mean prediction set size on clean data indicated below each plot. We take Neal = 15000 and Neval = 35000 for ImageNet.
all these datasets. Also, we give the mean values of the robust CP set sizes and the conformal coverage of these robust sets across 25 different random samplings of Deal and Deest (as well as Dholdout for PTT) that were unseen during training. We report our results in Fig. where we also plot the measurements made by Jeary et al. (2024) with different markers. To allow fair comparison with verifica- tion methods, we train specific neural networks for VRCP on the CIFAR-10 dataset according Appendix B of the associated paper. This allows the CROWN (Zhang et al., 2018) method to run efficiently on this model. For CAS, we use ResNet50 networks. Finally, we do not benchmark the PRCP method whose robustness guarantees are specific to the type of adversarial perturbation.
Finally, we used restricted set of 500 data points to evaluate the CAS method done in Zargarbashi et al. (2024), given its intensive computational budget. For both methods we use 40% of the data points for calibration and the rest for testing. The obtained results are given in Table 2.
Method CAS lip-rcp 111.0
Set size
Cov. (%)
n
Time (s)
1000.0
100.0
5 10
7.920
97.4
5 . 104
0.012
Table 2: Robust set sizes and empirical test coverage at
0.02, a = 0.1 on ImageNet (using CAS with Ame = 1024). One additional run of our method at 5 10 yielded set size of 118.5 and 97.5% coverage. The time is given per sample.
Our method outperforms existing robust CP approaches across all tested datasets, Fig. 3, it provides smaller robust CP sets while maintaining conformal cover- age close to a. We give the following explanations to these results. First, the sipschitz-constraingg model training approach we use is more efficient at promoting robustness. Also, neural networks with orthogonality constraints allow tight estimations of their conservative scores. Additionally, smoothing methods suffer from finite sample MC estima- tions in more than one way: as both corrective factor is added to the smoothed scores, and the error probability of the MC estimation also necessitates adjusting the quantile computation. Finally, smoothing methods require an un- realistic number of MC samplings to obtain meaningful sets.
Interpretation
5.2. Certifiable Vanilla CP Coverage Bounds Results
In this section, we compute respectively lower and upper bounds of Y and T introduced in Section 3 by both Lipschitz and formal verification methods. We first perform vanilla split CP on Deal consisting of neca! = 3000 samples. Next, we compute empirical approximations 7m and y, as in (12) and (13) on an evaluation dataset Deval with neval 5000 samples with both Lipschitz bounds and the CROWN formal verification method. We then compute the corrected estimates 7h and 2, as in (14) and (15) guaranteed in Theorem 3.3 by binary search. We repeat this process over 20 randomly sampled, non-overlapping pairs of Deal and Doval, and plot the mean value with an uncertainty band of standard deviation. The resulting coverage metrics are shown on Fig. 4 (left) on the CIFAR- 10 dataset for both computation methods with their associated models.
Scaling to the ImageNet dataset In order to evaluate the scalability of our method, we also validate on the ImageNet dataset. Given the poor scalability of formal verification methods, we were not able to apply VRCP on the ImageNet dataset. We therefore compare our method to CAS on a ResNet50 network, being generally the best performing competing approach. Our model is described in Appendix G.4.
We further compute the worst-case conformal coverage values of standard conformal prediction (CP) sets under e-bounded perturbations across all previously mentioned datasets. Due to the larger scale of these tasks, we are only able to compute the bounds for 1-Lipschitz models. The results are presented in Fig. 4 (right).
8

---

Efficient Robust Conformal Prediction via Lipschitz-Buunded Networks
Interpretation As illustrated in Fig. 4 (left), Lipschitz- constrained models yield less pessimistic bounds than ver- ification for the worst-case coverage of vanilla CP under e-bounded adversarial perturbations. This can be explained by the limited scalability of formal verification methods to larger neural networks. Also, Fig 4 (right) uncovers how providing coverage bounds for CP methods applied to ro- bust networks conserves the small and informative nature of CP sets while providing error guarantees under bounded attacks.
Impact Statement
This paper presents work whose goal is to advance the field of Machine Learning. There are many potential societal consequences of our work, none which we feel must be specifically highlighted here.
A Akknowledgmments
The authors would like to thank Agustin Martin Picard for his insights, along with Arthur Chiron and Luca Mossina for their careful proofreading.
6. Discussion
This work was carried out within the DEEL project, which is part of IRT Saint Exupéry and the ANITI Al cluster. The authors acknowledge the financial support from DEEL's Industrial and Academic Members and the France 2030 pro- gram Grant agreements n FANR-IO-AIRTA and n ANR- 23-IACL-0002.
Conclusion In this work, we propose novel method for fast computation of certifiably robust prediction sets, im- proving over SoTA methods both in terms of speed and conformal set sizes. First, through a careful analysis of vanilla CP under attack, we provide novel highh-robabiilty bounds on its coverage under attack. Our novel guarantees valid simultaneously for all attack budgets e and function e(, therefore not requiring assumptions on the attacker. Then, we use hipschitz-boundee networks to estimate ro- bust prediction sets, benefiting from three main advantages: better scalability, better overall robustness and the ability to tightly estimate worst-case variations with little compu- tational overhead. We apply our lip-rcp approach not only to compute efficiently bounds for vanilla CP under attack, but also for robust CP. Finally we validate our approaches on multiple classification datasets achieving best-in-clatt claassss performance with similar computational requirements as vanilla CP.
References
Andéol, L.., Fel, T., De Grancey, F., and Mossina, L. Confi- dent object detection via conformal prediction and con- formal risk control: an application railway signaling, In Conformal and Probabilistic Prediction with Applica- tions, pp. 36-55. PMLR, 2023.
Angelopoulos, A. N. and Bates, S. Conformal prediction: A gentle introduction. Found. Trends Mach. Learn., pp. 1994591, March 2023.
Anil, C., Lucas, J., and Grosse, R. Sorting out lipschitz function approximation. In International Conference on Machine Learning. pp. 291-301. PMLR, 2019.
Limitations and future work The method and results presented in this paper rely on some conditions on the model and perturbations, which would be worth generalizing.
Anthony, M. and Shawe-Taylor, J. A result of Vapnik with applications. Discrete Applied Mathematics, 47(3):207~ 217, 1993. ISSN 0166-218X.
Our approach delivers strong certifiable guarantees under l2 perturbations but does not generalize to other norms, such as & or 20.. Integrating advances from works like Biswas (2024) Zhang et al. (2021) could broaden its applicability and is left for future work. Moreover, while our method is applicable to any network whose Lipschitz constant is computable, we limit our study to Lipschitz-by- design architectures- whose Lipschitz constant is tightly controlled-to enable efficient robust conformal prediction. Note that this approach is not fully model-agnosee as other competing conformal methods, but that tight Lipschitz esti- mation would restore model agnosticism and pave the way for efficient robust conformal prediction in classification and regression settings.
Aolaritei, L., Jordan, M. I., Marzouk, Y., Wang, Z. O., and Zhu, J. Conformal prediction under I, ''eve--rote wry-prokhorov distribution shifts: Robustness to local and global pertur- bations. arXiv preprint arXiv:2502.1 /4/05, 2025.
Araujo. A., Havens, A. J., Delattre, B., Allauzen, A., and Hu, B. A unified algebraic perspective on lipschitz neural networks. In The Eleventh International Conference on Learning Representations, 2023.
Athalye, A., Carlini, N., and Wagner, D. Obfuscated gra- dients give a false sense of security: Cireumventing de- fenses to adversarial examples. In International confer- ence on machine learning, pp. 274-283. PMLR, 2018
Finally, it would be interesting to investigate whether our approach generalizes to higher values of c as, e.g., in the works of Gendler et al. (2022): Zargarbashi et al. (2024), while retaining our guarantees and computational efficiency.
Béthune, L.,, Boissin, T., Serrurier, M., Mamalet, F. Friedrich, C., and Gonzalez Sanz, A. Pay attention to
'nttps: httppp://wwwweere .ai/
9

---

Efficient Robust Conformal Prediction via Lipschitz-Boundee Networks
your loss: understanding misconceptions about lipschitz neural networks. Advances in Neural Information Pro- cessing Systems, 35:20077-2009) 2022.
Dvoretzky, A., Kiefer, J., Wolfowitz, J., et al. Asymptotic minimax character of the sample distribution function and of the classical multinomial estimator. The Annals of Mathematical Statistics, 27(():642-66) 1956.
Béthune, L., Masséna, T., Boissin, T., Friedrich, C., Ma- malet, F., Bellet, A., Serrurier, M., and Vigouroux, D. Dp-sgd without clipping: The lipschitz neural network way. In International Conference on Learning Represen- tations (ICLR), 2024.
Fel, T., Ducoffe, M., Vigouroux, D.. Cadène, R., Capelle, M., Nicodème, C., and Serre, T. Don't lie to me! ro- bust and efficient explainability with verified perturbation analysis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. (6153-16163, June 2023.
Biswas, A. Hidden synergy: 4 weight normaliza- tion and 1-path-norm regularization. arXiv preprint arXiv:2404.19112, 2024.
Gendler, A., Weng, T.-W., Daniel, L.. and Romano. Y. Ad- versarially robust conformal prediction. In International Conference on Learning Representations, 2022.
Boissin, T., Mamalet, F., Fel, T., Picard, A. M., Massena, T., and Serrurier, M. An adaptive orthogonal convolution scheme for efficient and flexible cnn architectures, 2025. URL httpt:tt////mm /esttps:/arxlie httpaaxxivvvvo//..a/aaa orgo abs/ 2501 07930.
Ghosh, S., Shi, Y., Belkhouja, T., Yan, Y., Doppa, J., and
Jones, B. Probabilistically robust conformal prediction. In Uncertainty in Artificial Intelligence, pp. 681-690.
Brunekreef, J., Marcus, E.. Sheombarsing, R., Sonke, J.-J., and Teuwen, J. Kandinsky conformal prediction: Effi- cient calibration of image segmentation algorithms. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 4135-4143, 2024.
PMLR, 2023.
Goodfellow, I., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
Carlini, N. and Wagner, D. Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium on security and privacy (sp). pp. 39-57. Icce, 2017.
Havens, A. J., Araujo, A., Zhang. H., and Hu, B. Fine- grained local sensitivity analysis of standard dot-product self-attention. In Forty-first International Conference on Machine Learning. 2024.
Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pp. 1310-1320. PMLR, 2019.
Jeary, L., Kuipers, T., Hosseini, M., and Paoletti, N. Veri- fiably robust conformal prediction. The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Corsi, D., Marchesini, E., Farinelli, A., and Fiorini, P. For- mal verification for safe deep reinforcement learning in trajectory generation. In 2020 Fourth IEEE International Conference on Robotic Computing (IRC), pp. 352-359, 2020. doi: 10. 10.1100 1011109C.2220000000000
Katz, G., Barrett, C., Dill, D. L., Julian, K., and Kochender- fer, M. Reluplex: An efficient smt solver for verifying deep neural networks. In Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part 30, pp. 97-117. Springer, 2017.
Delseny, H., Gabreau, C., Gauffriau, A., Beaudouin, B., Ponsolle, L., Alecu, L., Bonnin, H., Beltran, B., Duchel, D.. Ginestet, J..B., Hervieu, A., Martinez, G., Pasquet, S., Delmas, K., Pagetti, C., Gabriel, J.-M., Chapdelaine, C., Picard, S., Damour, M., Cappi, C., Gardès, L., Grancey, F. D.. Jenn, E., Lefevre, B., Flandin, G., Gerchinovitz, S., Mamalet, F., and Albore, A. White paper machine learning in certified systems, 2021. URL https:// arxiv v. orooorggaaoo abs///b///// 03.03.11 10529.
Langford, and Schapire, R. Tutorial on practical predic- tion theory for classification. Journal of machine learning research, 6(3), 2005.
Ledda, E., Angioni, D., Piras, G., Fumera, G., Biggio, B., and Roli, Adversarial attacks against uncertainty quan- tification. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4599-4608, 2023.
Ding, T., Angelopoulos. A., Bates, S., Jordan, M., and Tib- shirani, R. J. Class-conditional conformal prediction with many classes. Advances in Neural Information Process- ing Systems, 36, 2024.
Leino, K., Wang, 7.,, and Fredrikson, M. Globally-robust neural networks. In International Conference on Machine Learning, pp. 6212-6222. PMLR, 2021.
Ducoffe, M., Gerchinovitz, S., and Gupta, S. A high probability safety guarantee for shifted neural network surrogates. In SafeAI@ AAAL, pp. 82, 2020.
Lezcano Casado, M. Trivializations for gradient- opti- mization on manifolds. Advances in Neural Information Processing Systems, 32, 2019.
10

---

Efficient Robust Conformal Prediction via Lipschitz-Bounder Networks
Li, Q., Haque, S., Anil, C., Lucas, J., Grosse, R. B., and Ja- cobsen, J.-H. Preventing gradient attenuation in lipschitz constrained convolutional networks. Advances in neural information processing systems, 32, 2019.
Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., and Yang. G. Provably robust deep learning via adversarially trained smoothed classifiers. Advances in neural information processing systems, 32, 2019.
Li, Y. Chen, A., Qian, W., Zhao, C., Lidder, D., and Huai, M. Data poisoning attacks against conformal predic- tion. In Forty-first International Conference on Machine Learning, 2024.
Serrurier, M., Mamalet, F., González-Sanz, A., Boissin, T., Loubes, J.-M., and Del Barrio, E. Achieving robustness in classification using optimal transport with hinge regular- ization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 2021.
Liu, Z., Yufei, C., Yan, Y., Xu, Y., Ji, X., Liu, X., and Chan, A. B. The pitfalls and promise of conformal inference under adversarial attacks. In Forty-first International Conference on Machine Learning, 2024.
Serrurier, M., Mamalet, F., Fel, T., Béthune, L., and Boissin, T. On the explainable properties of 1-lipschitz neural networks: An optimal transport perspective. Advances in Neural Information Processing Systems, 36, 2024.
Massart, P. The tight constant in the Dvoretzky-Kieferr Wolfowitz inequality. Ann. Probab., 18(3):126--1283, 07 1990.
Szegedy, C.,, Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. In 2nd International Conference on Learning Representations, ICLR 2014, 2014.
Meunier, L., Delattre, B. J., Araujo, A., and Allauzen, A. A dynamical system perspective for lipschitz neural net- works. In International Conference on Machine Learning, pp. 15484- 15500. PMLR, 2022.
Teneggi, J., Tivnan, M., Stayman, W., and Sulam, J. How to trust your diffusion model: A convex optimization approach conformal risk control. In International Con- ference on Machine Learning, pp. 33940-33966 PMLR, 2023.
Mohri, C. and Hashimoto, T. Language models with con- formal factuality guarantees. In Forty-first International Conference on Machine Learning, 2024.
Timans, A., Straehle, C.-N., Sakmann, K., and Nalisnick, E. Adaptive bounding box uncertainties via two-step con- formal prediction. In European Conference Computer Vision, pp. 363-398. Springer, 2025.
Mossina, L., Dalmau, J., and Andéol, L. Conformal se- mantic image segmentation: Post-hoc quantification of predictive uncertainty. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 3574-3584, 2024.
Vapnik, V. N. and Chervonenkis, Y. Theory of Pattern Recognition. Nauka, Moscow (in Russian), 1974. German translation: Theorie der Zeichenerkennung, Akademie Verlag, Berlin, 1979.
Papadopoulos, H., Proedrou, K., Vovk, V., and Gammerman, A. Inductive confidence machines for regression. In Ma- chine learning: ECML 2002: 13th European conference on machine learning Helsinki, Finland, August 19-23, 2002 proceedings 13, pp. 345-356. Springer, 2002.
Virmaux, A. and Scaman, K. Lipschitz regularity of deep neural networks: analysis and efficient estimation. In Bengio, S., Wallach, H., Larochelle, H., Grauman, K., Cesa-Biae Bisa-Bianchi, N., and Gamett, R. (eds.), Advances in Neural Information Processing Systems, volume 31. Cur- ran Associates, Inc., 2018.
Papadopoulos, H., Vovk, V., and Gammerman, A. Regres- sion conformal prediction with nearest neighbours. Jour- nal of Artificial Intelligence Research, 40:815-840 2011.
Vovk, V., Gammerman, A., and Shafer, G. Algorithmic Learning in a Random World. 01 2005, doi: 10.1007/ b106715.
Romano, Y., Patterson, E., and Candes, E. Conformalized quantile regression. Advances in neural information pro- cessing systems, 32, 2019.
Wang. Z., Havens, A. J., Araujo, A., Zheng, Y., Hu, B., Chen, Y., and Jha, S. On the scalability and memory efficiency of semidefinite programs for lipschitz constant estimation of neural networks. The Twelfth Interna- tional Conference on Learning Representations, 2024.
Russo, A. and Proutiere, A. Optimal attacks on reinforce- ment learning policies, 2019. URL https: /ttps://atie //axxv.. hrg//bb/// 1 907. 13548.
Sadinle, M., Lei, J., and Wasserman, L. Least ambiguous set-valued classifiers with bounded error levels. Journal of the American Statistical Association, 114(52)):223- 234, 2019.
Wu, J., Ghomi, A. A., Glukhov, D., Cresswell, J. C., Boenisch, F,, and Papernot, N. Augment then smooth: Reconciling differential privacy with certified robustness.

---

Efficient Robust Conformal Prediction via Lipschitz-Bouni Bounded Networks
Transactions on Machine Learning Research, 2024. ISSN 2835-8856.
Yan, G., Romano, Y., and Weng, T.-W. Provably robust conformal prediction with improved efficiency. In The Twelfth International Conference Learning Represen- fations, 2024.
Zargarbashi, S. H. and Bujchevski, A. Robust conformal pre- diction with single binary certificate. In The Thirteenth International Conference on Learning Representations, 2025.
Zargarbashi, S. H., Akhondzadeh, M. S., and Bojchevski, A. Robust yet efficient conformal prediction sets. In Pro- ceedings of the 41 International Conference on Machine Learning, pp. 171 17123-17147, 2024.
Zhang, B., Cai, T., Lu, Z., He, D., and Wang. L. Towards certifying l-infinity robustness using neural networks with l-inf-dist neurons. In International Conference on Ma- chine Learning, pp. 12368-12379, PMLR, 2021.
Zhang. H., Weng, T.W.., Chen, P.-Y,, Hsieh, C.-.,, and Daniel, L. Efficient neural network robustness certifica- tion with general activation functions. Advances in neural information processing systems, 31, 2018.
12

---

Efficient Robust Conformal Prediction via Lipschitz-Buunded Bounded Networks
Method
Certifiable
Fast cal.
Fast test
f1, loo
Poisoning
Nb hyperparams
aPRCP (Ghosh al., 2023)
2
RSCP (Gendler al., 2022)
X
X
3
RSCP+ (PTT/RCT) (Yan al., 2024)
V
X
X
4(6)
CAS (Zargarbashi et al., 2024)
X
X
V
2
VRCP-I (Jeary et al., 2024)
V
X
V
X
2
VRCP-C (Jeary et al., 2024)
V
X
2
lip-rcp
V
2
Table 3: Comparison of certified robustness methods, Note that aPRCP is not certifiable without assumptions on the adversarial distribution. See Section F.2 for details on hyperparameter counts.
A. On the Lower Bound of Gendler et al. (2022, Theorem 2)
Unfortunately, it seems that a subtle mathematical mistake was left aside in Theorem 2 by Gendler et al. (2022). It can be seen in the statement and in the proof.
In the statement, the deterministic quantity P[Y,+1 E c[))+1)] is bounded from below by the random quantity T (note that r depends on the calibration data); this lower bound can thus fail general.
In the proof, which appears in Gendler et al. (2022, Appendix $1, Proof of theorem 2), the authors use Lemma by Romano al. (2019) which only holds for deterministie values of (or a, following the notation in Romano et al. 2019). Since random, their lemma can unfortunately not be used here.
B. Proof of Theorem 3.3
Let X Rdd (Borel subset) and ||-|| norm on Rd. Let also y' (1,.... .K) and s: s x -> R be measurable function (non-conformity score).
For any x E X and 2 0, we set (x)) = ( E x
|| x||| s {)..
There are some minor measurability subtleties in the paper and the following proof, which are overlooked here for readability, but discussed in Section C.
B.1. On the continuity of ? and
In this section and the next We assume that Deal is fixed, that s(..) and qa are deterministic. All probabilities or expectations below taken w.r.t. the random draws of Deval and/or (Xtest, Yust). Furthermore, since in our paper (Deal) is independent from (Deval: (Xtestr Yist),, all inequalities below translate into inequalities that are valid for a.e. Deat. provided that P..) and E [...] are replaced with P(... (Dent) and [..... (Drat)
We now study 7 and y. For e 2 0, recall that
7<) IP (s, (Xtest, Yeest) ) S qa) and 2(c) IP (Xtest; Yesst) S 9a)
where, in order to emphasize the dependency in we wrote
(x, v)
inf s(ā,)) and 8, (x, = sup Be)
s(ā,
aEB.(x
Proposition B.1. Assume that Al and A2 from 3.2 hold true. Then, & is right-comtinuous on [0, +oo) and y is left-continuous on (0, (o.)
Proof. We start with 7. Let e 2 0 and 1) > 0. We show that there exists s.t. 7 + 6) S 7(6) + 7,, which will (by monotonicity of 7) imply that In(e') - 7 < 7) for all e' E je, 8].
TThis could make sense if the prohability P PYn++1 c((A+11) were conditional on the calibration data, hut it is not the case in the proof: the probability is with respect to the joint distribution of (X,, Yi)ssinn1.
"In fact, we also work conditionally to training set, which is treated as deterministic all the paper.

---

Efficient Robust Conformal Prediction via Lipschitz- Boundedd Networks
x
E 6
Figure 5: Illustration of the proof of (22). On the ball B.+5 (x), the score æ ++ s(x. v) is minimized at some ā. On the smaller ball B, (x), the minimum can only be larger, but not larger than s<x", v) which is close to s(i y) by continuity of s(:, v)-
Let K C X be any compact set such that P(Xtest E KK21- 3.2 By right-continuity of the edf + (t) == P (s. (Xtest, Yeest) I t|Xttst E K), there exists > 0 s.t. Fe + p) S
F.(g.) + 3
We now use the fact that, for each E y (with ) finite), the function s(.; y) is continuous and thus uniformly continuous on the compact set Ke+1 == {a + turr E K, Re ||u||| s E E 1}. Therefore, there exists 8 E (0, 1) s.t.,
Vy E V, Vx, x' E Ket1,1lx I'll s = (s(a, - s(z', S p.
(21)
Note that, for any y e y and x E K. by (21) above,
(x, = inf s(ē, v) S inf s(ē,0) + == S.t5(1, (I + p. (x).(z)
(22)
2cB.+
This follows from Figure More formally, let T E (e+s(x) be such that s(ē, v) (x y). Incquality (22) immediate if || z|I S We thus assume without loss of generality that || xll > Then, let x" E [x. 3] X be such that ||"" =|| = (recall that X' is convex). In this case || z"Il S 5 and thus (by (21)) s(x", v) S s(Ø y) + P which implies & (x, I s(x", ,y) S 8246 u) + This concludes the proof of (22).
We are ready to conclude:
7(E + 0) P (8e48 (Xtest, Yrest) S qn)
$ (Xeett E K) P (S (Xeest: Yrest) S qa Xtest K) + (Xrest & K)
by (22)
$ P ((Xtet E K) . (s, (Xtests Yrest) S 9a + pl Xtest E K) !
2
-F((a ((iatt))FF((aa)+
< P (Xeest E KK) [P (Xrest, Yrost) S gal Xrest E K) +
" 2 2
+
< P (g, (Xrest, Yrest) S go.) +1
7ee) +1
This entails hxc') - ((() < 1y for all [e, + 8). and proves that y right-continuous. The proof that 2 left-continuous follows from similar arguments. Put briefly: for all and n) > 0, there exist a
2

---

Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
compact subset K C X' and real numbers p 0 and å (0, such that
2(E - 8) IP (5e-6 (Xtest, rost) qa)
(Xeett E K) (8e-8 (Xerst: Yrest) S ya Xtest E (K)+ (Xuest & K) a(-2) K
P (Xeestt E K) (8c (Neest, Vlest) S qa + Xtest E K) +
P (Xust K)) [P(5. (Xrest Yues)) S qa Xtest K) + 9)
2
(5c (Xrests Yeest) S 9a) +1
(()) + !
N.B.
The proof is little easier if s(,,)) is uniformly continuous on X' (e.g. if X' compact or s(:,8) is Lipschitz). that case, there is need to work conditionally on {Xrest K}.
B.2. Concentration of Tm around 7 Let Deval = (X,, 1s)ss be m 2 2 independent copies of (Xrest Yess)
For > 0, let
m
mm (c)
2 (X.Y)
Let E 10. Since m),(() (t) ~ Binomial(m,, 7())), the estimator
The 8) = max {p [0, (m 28,
where Binm.p the c.d.f. of Binomial(m.p)) p). This estimator satisfies (c.g., Theorem 3.3 by Langford & Schapire 2005), for all and e (0, 1),
P (T((c) S (c, 2
(23)
Applying (23) m-1 1 times with properly chosen values of (of quantile flavor), and using the fact that both 7 and F. (+, 6) are a.s. right-cone cightcoontiuuou and non -on-eecr,,,,n,, we obtain the following "uniform" concentration inequality.
Theorem B.2. Assume that Al and A2 from 3.2 hold true. Let (X,; Vi) be m independent copies of (tests Ylost)- Then:
S (t, 8 Ve 2 2,200 (()
P
m - +)++ 2 1 8.
As in the proof below, and Tith (.:)) are right-continuous a.s., that the above probability is well defined (the Ve can be replaced with countable Veg).
Proof. We proceed in three steps.
Step 1: right-continuity of 7 and T.th (,,8)
the fact that 7 fight-continuous follows from Subsection B.
likewise, using this result with the empirical distribution 1 Σm 6(x,,)), we can see that the random function
+ (c) is fight-continuour and thus locally constant to the right of any e 2 0. This implics that e + 7 (e, 6) is also right-continuous (0, +00).
3

---

Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
Step 2: pointwise concentration and union bound For every & E (1, ,m- 1]. we set eg inf {E 2 0: 7(t) 2
with the convention that inf Ø +oo. Let also Em := +00. Note that - 61 S E2 S ... S 6m +oo and that 7(Eu) 2
whenever Eę oo (by right-continuity of 7 on [0, +00)).
for all by def of c).. this case, the conclusion of Theorem B.2 would First note that, if 6₁ +oo, then 77c) m hold trivially.
We thus assume without loss of generality that 61 +00, and set
K max (K (1,... m : +00}.
Note that 0 61 S.... SE < EK+1 6m to0.
Combining (23) with union bound, and using K S 1, we get:
P vk {1, ,K),7(eN) 7th (ck. 8 -
Ko
1 21
2 1 8.
(24)
m
Step 3: bridging the gaps Let Ω2 = - T(x)) S Fm (Ek,
m be the event appearing in (24). We
now work on the event Uzg Let é 2 61- Note that e belongs to one of the following K disjoint (possibly empty) intervals:
4 [EE, (x+1), [I,...KK) (by convention, 4s = Ø if e Ek+1).
We let h: E (1, .,, K} be such that c E J, i.e., Cp I c < c++1
Recall that 7(cx) 2 and note that T(c) S k+1
Therefore,
7(c) S h ++ 1
1
< (Ex)
+
m
1
< 7m (Ebs
+
(we work on P23)
m -
m
8
< オサ (e,
(by S e and monotonicity of 7 (s m
m
Since also have 7(c) if 0 and e [0, ci) (by definition of e1), we just proved that, on the event Ωz
1
Ve 2 0, 7tt
1 m
Recalling that P((2)) concludes the proof.
We control 2 (Xrest; Viest) S {a) similarly (up to coin flip), using
1
2m
(X,,
m
and
2 (c, = - max {o E [0, 1]: Simmppm(1 -Im (c))) 8).
We have the following lower bound. Theorem B.3. Assume that Al and A2 from 3.2 hold true. Let (X,, Yi)sssmm be m independent copies of (Xrest Ytest). )
Then:
) 1
P Vc > 0,7(c)
2/ - 1 m
2 1- 5.
(25)

---

Efficient Robust Conformal Prediction via Lipschitz-Bounder Networks
First, that our high probability lower bound on 2(e) is similar our high probability upper bound on 7(e), by simple coin flip. Indeed, note that:
1 1-2(c) IP (Ne(st test Yuest) > qa)
1 Σ (X,,2)
2m (c)
(26)
- 2m (c,8) max/p [0,1] Binm.p (m 1m.(1-1))) (1- 2 26}
Issue Though these functions are non-decreasing in e, they are leff-continuous. This calls for additional technicalities, as seen in the proof below.
Proof. We also proceed with three steps: many arguments are identical, but not all.
Step 1: left continuity y and 2m (-, on (0, +20) This follows from similar arguments as in the proof of Theorem B.2.
Step 2: Pointwise concentration and union bound For every & f1, ,m 1}. set C₁. == inffe 0: 2()) 2
m J. with the convention that inf Ø = +oo. Let also 6m = +00.
Note that 0 S E2 S S cm S +o and that 1 - 7(Ex)
whenever 0 < EN too (by left continuity of on
(0, +oc)).
First note that, if = too, then 2(c) > 1 - for all e 2 0 (by def of e1). In this case, the conclusion of Theorem B.3 would hold trivially.
We can thus assume without loss of generality that 61 < +00, and set
K = max {k E (1,...,,. mm - 1:: : < +00).
Note that 0 S E1 S ... S E S EK+1 We now need additional technicalities.
6m t00.
For any g N {1, ......... and k E {1.... KJ. we set
Ek
Zext1
if K -1 ifk=
c
Ek
Note that
C < c
9 < 6k+1
if 6 < 6t1
Ek = Eg = cx+1
if = 6+1
and that ct c. By Langford (2005, Theorem 3.3), we have similarly to (23),
Ye 2 0, 4A E (0, 1). (()) 2 2 (c,)) 21-6.
(27)
Let E (0, 1). Combining (27) with union bound, we get, for any 2 1,
2 1 - P vk E f1. .K),((())))) 2 Im (c)
(28)
We now work on the event
[ vk E (1,... k)) 2 1 (c)
8
N3 =
We set 8" = (U (x+1)) U (Ek, +00), where (EL, 6x41 = if e = Ek+1 Note that 8 C g C (E1, +o0) and
U9 = (61, +00)
5

---

Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
Now, let E 89. There exists & (1...., K such that k K and (ek fk41), K and (ek +00). In particular, 6 o whatever the value of k.
Note that, if l: K- have cx+1 < +00 and therefore (((++1) S k+1 fact that y is non-decreasing)
This entails (using S 61+1 and the m
++1
1 1-21 (()) S
m
which is also true K (by def of cx+1 if K + S m - 1, or trivial if K == m== 1). Therefore, whatever the value of above,
1 1-(( x+1
m
1
(since 1 22((()) 2 k
$ 1 - <1-2(<))
+
by def of e, and o ax)
m
m
(29)
5
1
< 1 mm (c)
(we work on (23
m
8
1
$ 1 ? (c; m
(by c S and monotonicity of y m
(
m
Rearranging terms, we proved that, on the event Dg.
8
Ve 8", 7()) 2 Tm
(c, m
(30)
m
now let q + +00. More precisely, recalling that (e1: +00) U94
1
P Ye E (el, +00), 2 2 m
m
6
1
=P E"% Ex, 2 I.m (e,
m
m
8
1
= lim P
VEE 8" ,(c) 2 Y (c. m
(since 8d C
q ++0
m
2 d-
(since ((()) 2 8)
Nothing that, c, > 0, then - 2(c) s 1 m
for all e E [1, concludes the proof.
C. On Measurability Details
In this short section, we discuss minor mathematical details that are yet important to ensure that all probabilities under study are well defined. short, probabilities should be studied for sets that are measurable, which can fail in general when manipulating, e.g., continuously-infinie suprema or infima of measurable functions.
We start by describing two measurability issues in items and 2 below. We then explain that, if the assumptions of the paper hold true, then work with continuous and thus measurable functions, that these issues do not arise (see Proposition C.I).
1. The modified scores (x. sup s(ē, v) and (x, inf s(ā. y) might not be measurable functions (E),(x)
(E)
of (z,y). y). This condition is required so that the sets (Y (X) (X, s qo. and {Y Co,((X))
(X, S } are measurable (i.e., well defined events).
2. Even so, the function (x. + sup (, y) might not measurable, which is required for the quantity
(x).(*)
P (Vū Bx(X), Y E Ca,c (8)) to be well defined.
6

---

Efficient Robust Conformal Prediction via Buaschiz-Bounnde Networks
Recalling Assumptions 3.2
A1 X' a convex and closed subset of R
A2 8(:3) is continuous for all y E y
Proposition C.1. Let 2 and assume that Al and A2 from Assumption 3.2 hold true. Then the functions & (..)), sel. V). and & sup 3. (5. 3) are continuous for all y.
(EB,(x)
The proof follows from uniform continuity arguments that are very similar to those used in the proof Proposition B.1, and thus omitted.
D. Extending VRCP
In this section, we explictly develop extensions of formal verification methods for robust conformal prediction. First, we recall the following robustness regimes:
Robust conformal prediction set Here, return conformal prediction set that verifies user-specified conformal coverage under adversarial perturbations. However, this certificate yield overly conservative results on clean data resulting in increased conformal prediction set sizes.
Certifiably robust vanilla conformal prediction Through estimations of the conservative and restrictive prediction sets on an extra set of holdout data Deval, our theoretical results ensure that for a given adversarial attack budget, our conformal coverage on adversarially perturbed data will remain within range of [_me 7th with high probability.
In VRCP (Jeary et al., 2024), the authors develop a method allowing the computation of supersets of the conservative prediction set around a point leveraging formal verification methods. To this end, they prove that the conservative prediction set verifies robust coverage bounds under adversarial attacks. In order to extend verification methods to the computation of restrictive prediction set (necessary for coverage bounds on vanilla CP under attack) and the computation of a lower bound for the robustness radius of vanilla prediction set, we give the following insights.
Restrictive prediction set Given that formal verification methods often return the upper and lower bounds of every logit of the output layer. This facilitates the computation of a subset of the restrictive prediction with formal verification methods.
E. About Score Functions: Sigmoid vs Softmax
E.1. Vanilla CP Setting
We recall the following score definitions:
(f(x) T
SLAC Softmax (I. y) 1 softmax
(31)
f f((xx)
SLAC Sigmold y) = sigmoid
T
To evaluate the impact of using LAC Sigmoid score compared to classic LAC Softmax score function, provide the following empirical results for vanilla CP on the CIFAR-10 dataset with a ResNet50 model with 0.1:
Method
Coverage (%)
Set size
LAC Softmax
90.04
1.088 1.144
LAC Sigmoid
90.28
Table 4: Comparison of conformal score performance LAC Softmax vs LAC Sigmoid.
This ablation study results in marginally bigger vanilla CP set sizes for LAC Sigmoid scores compared to softmax ones with scaled temperature.

---

Efficient Robust Conformal Prediction via Lipschitz-Boundee Networks
E.2. Robust CP Setting
Using the 1-L.ipschitz nature of our models, we can also use exact worst-case LAC Sigmoid and Softmax score computations under adversarial logit perturbations. Instead of relying on Eq. 19, we can leverage the monotonicity of the sigmoid function compute tighter bounds, e.g:
[(3)
Ln x
sigmoid
<
mit SLAC Sigmoid (2,, y)
(32)
T
#E (EB,(5)
where T and b are the temperature and the bias of the score. This inequality yiclds tighter bounds than those based solely on global Lipschitz constants, with no extra cost.
Similarly, given that the softmax function exhibits monotonicity in each of its parameters (ceteris paribus), its maximum and minimum values within hyper-rectangular region attained the corners of that region, i.e.,
(f(0)) Ln x x)/T : (S(T), + Ln x)/TT : (f(3)--1 Ln e)/T)
- softmax
SLAC Softmax (I, y) (8)
min
(33)
where 7' is the temperature scaling factor of the softmax.
As shown below, for 1-Lipschitz VGG with 25M parameters on CIFAR-10 with 0.03 and = 0.1, LAC Sigmoid demonstrates considerably smaller robust prediction sets.
Method
Coverage (%)
Set size
LAC Softmax
95.6
2.38
LAC Sigmoid
94.9
1.72
Table Robust CP performance for different conformal scores on CIFAR-10. Under the same conditions Fig
Although the LAC Sigmoid score is marginally worse vanilla CP conditions, the superior performances obtained in Table 5 motivates its use in the paper.
F. Model Implementation
F.1. Training Time Overhead
In this section we deseribe the computational overhead of our implementation on a CIFAR-IO shaped set of random data. In experimental setup, we a standard neural network with convolutional layers followed by max pooling operations and linear layer. We study how drop-in replacement of the vanilla Py PoTch layers by our chosen Lipschitz constrained layers affects the overall training time of our network. Importantly, our implementation is batch-size independent since it only relies on the values of the weights. Therefore the overall cost of training Lipschitz constrained networks is mitigated when using large batch sizes.
Batch size
Train time (%)
1024
20.31
2048
10.26
Table 6: Training time random data of shape (32, 32, 3) when dropping the Lipschitz-constraing layers. For reference, ResNeXt model Figure introduces 9,6% runtime overhead on TinyImageNet compared to an identical unconstrained model.
For more information regarding the computational overhead of Lipschitz constrained architectures w.r.t standard uncon- strained architectures, we refer the reader to the comprehensive benchmark of (Boissin et al., 2025).
8

---

Efficient Robust Conformal Prediction via Lipschitz-Boundee Networks
Improvements In our paper we relatively standard implementation of Lipschitz parametrized networks with an orthogonality constraint. Many recent works have focused on providing efficient and expressive Lipschitz network implementations (Araujo et al., 2023; Leino et al., 2021; Meunier et al., 2022) that could be applied in the context of our study.
E.2. Placement of Method
Overall placement of method prediction.
See Table for an overall comparison of certifiably robust methods for conformal
Hyperparameters of all methods
We find that other methods have the following hyperparameters:
Method
Hyperparameters
RSCP
Smoothing strength o, Monte Carlo samplings Tome-
RSCP+
Smoothing strength a, Monte Carlo samplings me confidence of smoothing B.
PTT
Temperature T, bias b, number of holdout points Tholouu
RCT
Temperature r regularization factors À and
aPRCP
Conservativeness hyperparameter
CAS
Smoothing strength a, Monte Carlo samplings Tome.
VRCP
Choice of formal verification method (counts as one hyperparameter) plus any score specific parameters.
lip-rep
Score temperature and bias b.
Table 7: Hyperparameters for each certified-robustness method
G. Experimental Settings
Robust CP methods are heavily dependent the quality and compatibility of the underlying model. Therefore, separate neural networks to ensure fair evaluation of robust CP methods. In the following sections, we define the models we used for benchmarking both robust CP and worst-case vanilla CP coverage bounds.
G.1. System Requirements
All experiments were conducted on a system equipped with two NVIDIA GeForce RTX 4090 GPUs, each providing 24 GB of GDDR6X memory.
G.2. VRCP Models
Given that formal verification methods have an inherent trade-off between computational overhead and tightness of their estimations, we use specifically tailored models from Appendix B of Jeary et al. (2024). We then compare these models to Lipschitz by design models in the experiments Importantly, using larger and deeper models with verification methods not only computationally punitive, also usually tends worsen the obtained bounds they become looser and looser.
5.1 and $ 5.2.
G.3. Smoothing Models
We use ResNet50 architecture in the experiments we run using CAS as it offers a good baseline for robust CP results as done in (Zargarbashi et al., 2024). Given the already costly nature of smoothing methods at inference, we follow a standard scheme at training time to avoid additional computational burden. An exception stands for the CIFAR-1C dataset: models trained with Gaussian noise as per the procedure of Salman al. (2019) still fail in low MC iteration settings. Indeed, we test ResNetl 10 model trained with noise augmentation from the aforementioned procedure: yet still exhibits uninformative set sizes of 10 for Pime 64 every point of the test Moreover, every smoothing experiment conducted.
the recommended value of 2 for
G.4. Lipschitz Models
The architecture we use for our experiments on CIFAR-10, CIFAR- 100 and TinylmageNet datasets follows a ResNeXt-like
design, with an initial convolutional stem followed by four stages of increasing feature channels (64 - 128 256 - 512).

---

Efficient Robust Conformal Prediction via Lipschitz-Bounder Networks
Each stage comprises groupedd-onvolutiin residual blocks, with downsampling applied between stages reduce spatial dimensions. The network then employs global average pooling, fully connected bottleneck, and classification layer.
Regarding experiments on the ImageNet dataset, we leverage more efficient implementation of Lipschitz parametrized networks, as described in (Boissin al., 2025). This implementation can be found in the orthogoni um library.
Regarding our ImageNet model we use the following architecture. Starting with two strided convolutions (7x7 + 3x3 kernels) that reduce spatial resolution while expanding channels to 256. Four subsequent processing stages progressively double channel dimensions (256 + 512 + 1024 + 2048), each containing three residual blocks with depthwise 5x5 convolutions. Blocks employ channel expansion/contraction (2 x width), GroupSort2 activations, and learned residual mixing that respects 1-Lipschitz constraints. Then, the spatial features are condensed via global average pooling (7x7 window) before final classification by linear layer that enforces the 1-Lipschitz condition on each output.
Training objectives Our neural networks are trained with Optimal Transport inspired objectives such as the Hinge Kantorovich-Rubintte loss function introduced in (Serrurier et al., 2021). These loss functions are particularly effective enforce model robustness.
G.5. Training Hyperparameters
We train our Lipschitz neural networks with the A optimizer with a learning rate 1e-3. Also, we use the SoftHKRMulticlass.on from the deel stel-torchlip library with the following standard values:
Dataset
Margin
Temperature
Epochs
Alpha
CIFAR-10
0.6
5.0
130
0.975
CIFAR-100
0.6
5.0
220
0.975
TinylmageNet
0.3
5.0
80
0.975
Table 8: Standard training hyperparameter values for loss function on the different datasets.
H. Calibration Poisoning Results
Calibration time label flipping attacks Most conformal score functions are often not Lipschitz continuous with respect to E y. Therefore we devise no straightforward certificate for label flipping attacks. However, the defense to label flipping attacks defined in (Zargarbashi et al., 2024) that leverages the computation of a maximum quantile shift when scores are permuted valid for our networks too.
Calibration time feature poisoning attacks In the context of calibration-time feature poisoning however the Lipschitz condition of score with respect to X' becomes greatly advantageous. Indeed, the problem of computing the maximum quantile shift becomes simplified in the sense that every score verifies Lg Lipschitz condition and interdependent from the scores of other calibration samples for the true class. We devise a simple Linear Programming script described in Figure 6 to handle the computation of the maximum and minimum quantile shift under attack of budget (k, E). We verify our Linear Programming solution empirically on the CIFAR- /0 dataset (see Table 9).
NB Importantly, our algorithm assumes that the quantile computation done during the calibration step returns do R [(++))(--)]-
k
Metric
Mean
Std Dev
Val. accuracy
0.7260
Set size
2,0690
0.0387
0.25
6
Robust CP
0.8982
0.0085
Robust CP set size
2.0699
0.0467
0.25
50
Robust CP
0.9090
0.0068
Robust CP set size
2.1872
0.0466
Table 9: Summary of empirical coverage and prediction set sizes across different attack budgets (k, e) for feature poisoning on the calibration set (neat 4750). Each experiment was repeated 10 times with randomly selected calibration subset.
10

---

Efficient Robust Conformal Prediction via Sapschitz-Boundee Networks
def compute. robust thresholld sccores, k, epation, alpha, mun valuez Float
nucel Lent scores]
no.angsort(scoress
np. np-floortate (alpha inst
sorted, scores np-sert scores)
rera wwaining..k A
teragning_.
soxs _0xs_sort] sdr, threshold] La seen:
scoresfide Lides sors [ide thresshldd 131 spsilon
threshold]
seen.append(1de _drt_ (1kk_ borttttr_ttheeeeeeee j0__thressssd]]
scores Lides, sortlids
(dks idxs_sort sort tdxs, sort (mp.argaa.... www.argorttssoom scores sxrt]] resotning_k
return rp.sor sprtt scores tex thresholo)
Figure Our function for computing the maximum quantile shift and therefore certifying the robustness prediction sets under calibration time feature poisoning attacks.
I. About the Tightness of Score Bounds
To estimate how tight our score estimations are we evaluate all our methods on the same model. We train a VGG-like I-LipNet with 10.7M parameters from Boissin et al. (2025) on CIFAR-10. Then, we evaluate robust CP methods (average across 10 runs).
Method
Coverage (%)
Set size
Runtime (s)
CAS Ame 1024
94.60
2.302
2615
lip-rcp VRCP-I/C (CROWN)
92.83
1.889
10
OOM
OOM
N/A
Table 10: Average robust CP coverage, set size, and runtime (per run) with 0.03 across 10 runs.
CROWN does not scale to such a deep network due to inner complexity. Additionally, given the cost of the CAS method, we did not tune the smoothing hyperparameter it to 2.e as recommended in previous works (Yan al., 2024). Optimizing this hyperparameter could lead to better results obtained in (Zargarbashi & Bojchevski, 2025).


Reviews:
[{"review_id": "izSJTlk3q1", "reviewer": "Reviewer_X44i", "summary": "This paper uses 1-Lipschitz networks to estimate robust conformal prediction (CP) sets, leading to the new lip-rcp method. The proposed method achieves SOTA results in the size of the robust CP sets and computational efficiency. In addition, the authors also study vanilla CP under attack, and derive new worst-case coverage bounds of vanilla CP sets.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Common response:** \n\nFirst of all, we would like to thank our reviewers for their time spent reviewing our paper along with the insightful comments they provided. Their reviews highlight that our method is “highly efficient and scalable” while underlining its innovative nature and our comprehensive experiments. Moreover, reviewer X44i points out the novelty of the theoretical framework we developed to ensure worst-case coverage bounds of vanilla CP. We appreciate all these comments.\n\nTo address common questions shared among reviewer AUox and reviewer 3iVr, we add the following experiments which support our initial results:\n- **Shared model comparison:** we run a comparison of robust CP methods on an identical model, see answer to reviewer AUox.\n- **Lipschitz bound tightness estimation:** we empirically evaluate the Lipschitz constant of our network by running adversarial attacks, see answer to reviewer 3iVr.\n\n**Reviewer response:**\n\nWe would like to thank Reviewer X44i for the time dedicated to reviewing our paper and the suggestions they provided. Also, we appreciate the reviewer's comments regarding the soundness and novelty of our work. \n\nWe develop answers to the reviewer's questions below:\n\n**About the connection with robust learning:**\n\nThe field of Robust Conformal Prediction is quite specific, as it studies the robustness of *guaranteed prediction sets* under i.i.d conditions. It is not directly related to robust learning beyond reusing properties of a neural network, as the (split) Conformal procedure is post-hoc, and conducted on an already trained model.\n\nHowever, a comparison to any certifiably (or not) robust prediction set is feasible, based on other theories or heuristics. Yet, to our knowledge, robust prediction sets have only been studied in the Conformal Prediction setting.\n\n**About our theoretical contributions:**\n\nWhile one aspect of our work concerns developing a highly efficient method to compute certifiably robust prediction sets (lip-rcp) in the classic Robust CP setting of RSCP (Gendler et al., 2022). Our theoretical work of Section 3 introduces a novel complementary theoretical approach:\n\nIn essence, we conduct a vanilla CP procedure (without robust score computations) and use an additional holdout data split to estimate maximum coverage variations for worst-case attacks. Those estimates are guaranteed for any budget simultaneously (uniformly). As opposed to Robust CP, this implies that under normal conditions, our method allows to retain the superior informativeness of vanilla CP sets while having an associated guarantee on how significantly their coverage under attack may evolve. As mentioned in the article, two previous works have proposed a weaker although incorrect guarantee, but with a similar intuition. Finally, the general formulation of our theoretical work allows us to extend our method to formal verification solvers (cf. Fig 4 - left).", "claims_and_evidence": "The authors claim that their proposed lip-rcp method achieves SOTA in robust CP. It seems to me that this claim is supported by their study.", "methods_and_evaluation_criteria": "The empirical evaluation in this paper makes sense to me.", "theoretical_claims": "The theorem look plausible to me, though I have not checked all the details carefully.", "experimental_designs_or_analyses": "The experiments are solid, and seem to support the claimed contribution.", "relation_to_broader_scientific_literature": "The topic studied in this paper seems quite relevant to the deep learning community. There are a lot of previous results on Lipschitz networks. This paper seems to be the first in leveraging such Lipschitz network results for studying robust CP. To me, this connection is novel and interesting, worth being known to the deep learning community.", "essential_references_not_discussed": "I do not have a particular paper in mind that this paper misses citing.", "other_strengths_and_weaknesses": "The paper is well written. The work is quite solid. The connection between Lipschitz networks and robust CP seems to be simple yet novel.", "other_comments_or_suggestions": "One thing which is not that clear to me is how to compare lip-rcp with other robust learning methods which are not based on CP in the first place.", "questions_for_authors": "Can the authors clarify what is the technical novelty of their theoretical contribution other than just merging Lipschitz networks with robust CP?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZXJIwlddT9", "reviewer": "Reviewer_3iVr", "summary": "This paper addresses the limitations of robust conformal prediction (CP) under adversarial attacks. Traditional robust CP methods typically generate prediction sets that are either excessively large or computationally expensive for large-scale scenarios. To tackle these challenges, the authors introduce lip-rcp, which leverages Lipschitz-bounded neural networks to estimate robust prediction sets. By utilizing 1-Lipschitz constrained models, the proposed approach provides tighter and computationally efficient robust conformal prediction sets compared to existing methods.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Common response:**\n\nFirst of all, we would like to thank our reviewers for their time spent reviewing our paper along with the insightful comments they provided. Their reviews highlight that our method is “highly efficient and scalable” while underlining its innovative nature and our comprehensive experiments. Moreover, reviewer X44i points out the novelty of the theoretical framework we developed to ensure worst-case coverage bounds of vanilla CP. We appreciate all these comments.\n\nTo address common questions shared among reviewer AUox and reviewer 3iVr, we add the following experiments which support our initial results:\n- **Shared model comparison:** we run a comparison of robust CP methods on an identical model, see answer to reviewer AUox.\n- **Lipschitz bound tightness estimation:** we empirically evaluate the Lipschitz constant of our network by running adversarial attacks, see answer to reviewer 3iVr.\n\n**Reviewer response:**\n\nWe would like to thank Reviewer 3iVr for their insightful comments. Importantly we appreciate their comments about our methods' efficiency, scalability and performance.\n\nBelow we answer the reviewers main concerns.\n\n**About the tightness of Lipschitz bound estimations (Questions 1 & 3):**\n\nWe run a direct tightness estimation of our Lipschitz upper bound with Lipschitz-by-design networks. We compute the maximum ratio between logit variations under attack and adversarial attack budgets on the CIFAR-10 test set. \n\nThis quantity offers a lower bound to the actual Lipschitz-constant of our network.  Using PGD attacks of budget $\\epsilon=0.05$ we get a Lipschitz constant lower bound of **0.917** when our by-design Lipschitz bound is **1**. This demonstrates that our bound is relatively tight in practice.\n\nUnder these same attacks, the empirical coverage of our $\\epsilon$-robust CP sets on the test split is 92.06% (94.7% under AutoAttack attacks) which approaches the desired robust coverage of 90% under $\\alpha=0.1$. \n\n**About the choice of $L_n$ (Theoretical Claim 1):**\n\nTo avoid any ambiguities, we address your question from two different angles.\n- Setting any $L_n \\neq 1$ as the network constraint: this would have limited impact since constraining the Lipschitz constant of a classifier is not a limitation when using an appropriate optimization objective (Béthune et al. 2022). Moreover, $L_n = 1$  avoids gradient vanishing or explosion (Béthune et al. 2024, Thm 1). \n- Computing robust prediction sets using the l.h.s. of (19) and other values for $L_n$​: the approximation quality for the Lipschitz constant of the network is crucial, under-approximating it leads to uncertifiable results, while strongly over-estimating would lead to pathologically large prediction sets. Theory-wise, the impact of $L_n$​ can also be analyzed in a toy setting, with data points $(X_i,Y_i)$ drawn i.i.d. from a mixture of two Gaussians, and a model given by the Bayes rule. \n\n**About the LAC sigmoid score (Question 2):**\n\nUpon further inspection, the LAC sigmoid score yields a slight degradation of vanilla CP.\n\nCIFAR-10 / ResNet50 / $\\alpha=0.1$:\n- LAC softmax coverage & set size: 90.04% / 1.088\n- LAC sigmoid coverage & set size: 90.28% / 1.144\n\nWith similar tendencies for lower $\\alpha$. We will add the following sentence to our paper:\n\n“This ablation study results in marginally bigger vanilla CP set sizes for LAC sigmoid scores compared to softmax ones with scaled temperature. Investigating Lipschitz conformal scores represents a promising direction for future research to further enhance robust CP performance.”\n\n**Regarding the tradeoff between accuracy and robustness (Theoretical claim 2 & Question 5):**\n\nInterestingly, the trade-off between accuracy and robustness for robust CP is not straightforward. \n\nIndeed, robust networks exhibit poorer accuracy which penalizes vanilla CP performance in small $\\alpha$ regimes, consequently impacting robust CP performance. Similarly, accurate but brittle classifiers exhibit smaller vanilla CP set sizes yet the robust CP sets are large given the fine margins between conformal scores. To keep our method as simple, reliable and reproducible as possible we used standard hyperparameter values (which will be detailed in the Appendix) since our method exhibits SOTA behaviour without tuning.\n\nWe would like to thank the reviewer for pointing out this promising aspect. \n\n**Details:**\n\nWe will fix the typos that Reviewer 3iVr kindly pointed out. Furthermore, we propose the following caption for Figure 5: \n\n\"Illustration of the proof. On the ball $\\mathcal{B}\\_{\\epsilon + \\delta}(x) $, the score $x \\mapsto s(x,y)$ is minimized at some $\\tilde{x}$. On the smaller ball $\\mathcal{B}_{\\epsilon}(x)$, the minimum can only be larger, but not larger than $s(x'',y)$, which is close to $s(\\tilde{x},y)$ by continuity of $s(\\cdot,y)$\".", "claims_and_evidence": "Although the authors propose using Lipschitz-bounded neural networks to efficiently compute conservative and restrictive conformal scores, they acknowledge that accurately estimating the Lipschitz constant for deep neural networks remains computationally challenging and can result in overly conservative bounds if the estimates are loose. Thus, while their method claims efficiency and scalability, the precise tightness of these Lipschitz bounds and its corresponding impact over CP are not discussed in this paper.", "methods_and_evaluation_criteria": "Equation (20) modifies the standard LAC conformity score by replacing softmax with sigmoid. Since softmax has no simple Lipschitz bound, sigmoid is used to maintain tractability. However, does this change affect the calibration of the non-conformity score? Could this lead to overly conservative or loose prediction sets depending on the logit scaling?", "theoretical_claims": "1. Your method relies on 1-Lipschitz constrained networks. How does the setting of Lipschitz constant (e.g., different values of $L_n$) impact the robustness and efficiency of the prediction sets? Could you provide theoretical analysis?\n\n2. Figure 5 is a good example of illustrating the proof. Could you provide more explanation of Figure 5 in the caption or appendix?", "experimental_designs_or_analyses": "1. Could you provide additional results on how accurate the estimation of the Lipschitz constant of the neural network? \n\n2. How does lip-rcp perform in terms of robustness and accuracy trade-offs under different attack models?", "relation_to_broader_scientific_literature": "The key contributions of this paper build upon and extend several lines of research in robust conformal prediction (CP), adversarial robustness, and Lipschitz-bounded neural networks. Prior work on robust CP has primarily focused on randomized smoothing methods (Gendler et al., 2022; Yan et al., 2024) and formal verification-based approaches (Jeary et al., 2024), both of which provide robustness guarantees but suffer from either high computational costs or excessively large prediction sets. The paper improves upon these methods by introducing lip-rcp, inspired by work in certifiable adversarial robustness (Anil et al., 2019; Boissin et al., 2025).", "essential_references_not_discussed": "This paper has discussed the essential works.", "other_strengths_and_weaknesses": "The key strength of this paper is its development of a highly efficient and scalable method, lip-rcp, that integrates Lipschitz-bounded neural networks into robust CP. Unlike previous robust CP methods, the proposed approach provides robust prediction sets with minimal computational cost. By leveraging networks designed with Lipschitz constraints, the authors achieve precise and certifiable bounds on prediction scores under adversarial perturbations.", "other_comments_or_suggestions": "Some typos:\n\nuntractable $\\rightarrow$ intractable\n\nvalid simultaneously for $\\rightarrow$ valid simultaneously across\n\nTiny ImageNet $\\rightarrow$ Tiny-ImageNet", "questions_for_authors": "1. How tight are the Lipschitz bounds in practice? Have you quantified the potential gap between the estimated and actual Lipschitz constants?\n\n2. Equation (20) modifies the standard LAC conformity score by replacing softmax with sigmoid. Since softmax has no simple Lipschitz bound, sigmoid is used to maintain tractability. However, does this change affect the calibration of the non-conformity score? Could this lead to overly conservative or loose prediction sets depending on the logit scaling?\n\n3. Could you provide additional results on how accurate the estimation of the Lipschitz constant of the neural network? \n\n4. Do the different choice of Lipschitz parametrized networks affect the coverage and efficiency of lip-rcp? Could you provide empirical results?\n\n5. How does lip-rcp perform in terms of robustness and accuracy trade-offs under different attack models?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "n7PfsCa9vD", "reviewer": "Reviewer_AUox", "summary": "- This paper proposes a novel method, lip-rcp, for efficient robust conformal prediction (CP) by leveraging Lipschitz-bounded neural networks. The key contributions include:\n\n- Theoretical analysis: Deriving worst-case coverage bounds for vanilla CP under l2 adversarial attacks, valid simultaneously for all perturbation budgets.\n\n- Efficient robust CP: Introducing a method to compute robust prediction sets using globally Lipschitz-constrained networks, achieving state-of-the-art performance in terms of set size and computational efficiency.\n\n- Scalability: Demonstrating applicability to large-scale datasets (e.g., ImageNet) with negligible computational overhead compared to vanilla CP.\n\n- The experiments validate the method on CIFAR-10, CIFAR-100, TinyImageNet, and ImageNet, showing superior results over existing approaches like VRCP and CAS.\n\n\n## update after rebuttal\n\nAfter rebuttal, I still worry about the potential limitation in terms of its scope of applicability and the rationality of the theory. I maintain my original score, and am inclined to recommend a Weak Reject.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Common response:**\n\nFirst of all, we would like to thank our reviewers for their time spent reviewing our paper along with the insightful comments they provided. Their reviews highlight that our method is “highly efficient and scalable” while underlining its innovative nature and our comprehensive experiments. Moreover, reviewer X44i points out the novelty of the theoretical framework we developed to ensure worst-case coverage bounds of vanilla CP. We appreciate all these comments.\n\nTo address common questions shared among reviewer AUox and reviewer 3iVr, we add the following experiments which support our initial results:\n- **Shared model comparison:** we run a comparison of robust CP methods on an identical model, see answer to reviewer AUox.\n- **Lipschitz bound tightness estimation:** we empirically evaluate the Lipschitz constant of our network by running adversarial attacks, see answer to reviewer 3iVr.\n\n\n**Reviewer response:**\n\nForemost, we would like to thank Reviewer AUox for their comprehensive comments. We appreciate the comments about our methods' novelty and empirical validation. \n\nIn the following paragraphs, we address their main concerns. \n\n**About comparing with different models (experimental weakness 1):**\n\n“The experiments comparison use different backbone model [...] potentially biasing results” \n\nTo alleviate these concerns: we train a VGG-like 1-LipNet with 10.7M parameters from Boissin et al. 2025 on CIFAR-10. Then, we evaluate robust CP methods on this network under the conditions of Figure 3 .\n\n|Method|Coverage|Set size|Runtime(1 run)|\n|---|---|---|---|\n|CAS n_mc=1024 |94.6%|2.302|2615s|\n|CAS n_mc=10000|93.8%|2.057|5+ hours|\n|lip-rcp|**92.83%**|**1.889**|**10s**|\n|VRCP-I/C (CROWN)|OOM|OOM|N/A|\n\nCROWN does not scale to such a deep network due to its inner complexity.\n\nTherefore: \n- Using a deeper network further improves our results (10.7M parameters compared to 4.5M parameters for the ResNeXt).\n- LipNets allow for tighter conservative score estimations than CAS since its certificate is deterministic and does not require finite sample corrections.\n- This LipNet makes the CAS method perform better than with a ResNet50 due to its robustness (cf. Figure 3).\n\nThese results will be added to the final version of the paper. We thank the reviewers for their comments which prompted this evaluation highlighting the performance and efficiency of our method.\n\n**About the ImageNet split sizes (experimental weakness 2):**\n\nTo validate lip-rcp's performance without calibration set size differences we evaluate our method using only 500 calibration samples as done in the CAS article due to the method's high computational demands:\n\nSet sizes: 118.5  (111.0 originally)                                                                                          \t \nCoverage : 97.6% (97.4% originally)\n\nThe performance gap between methods remains.\n\n**Theoretical questions (Claims 2 & 3):**\n\nWhile the manifold of images encountered in practice is typically nonconvex, Theorem 3.3 only requires that the input distribution and the score $x \\mapsto s(x,y)$ be defined on a subset of a convex space such as $\\mathcal{X}=[0,1]^{3 n_{\\mathrm{pix}}}$, where $n_{\\mathrm{pix}}$ is the number of pixels. Theorem 3.3 is then valid for any such distribution, even with finite support included in that space $\\mathcal{X}$. We will add this fact within footnote 3 of Page 5.\n\nAlso, our coverage bounds (15) are not closed-form, but (as mentioned after (15)) they can be quickly and tightly computed via a binary search. See also Langford and Schapire (2005, after Def 3.2) for closed-form yet looser bounds. \n\n**About model independence (Claim 1):**\n\nAs correctly pointed out by the reviewer, we use additional information on the model to improve over black-box (model-free) approaches. We propose to insert the following clarification in Section 4:\n\n``In practice, our method uses Lipschitz-by-design networks. This limits the model independence of our robust CP method, but it was key to obtaining efficient and competitive robust CP metrics for the first time. Interestingly, our methodology, which applies more generally to any network and score that are Lipschitz continuous, can also benefit from future research on Lipschitz constant estimation.''\n\n**About computational efficiency (Claim 5):**\n\nWith several recent developments mentioned in the related works of our article, Lipschitz-by-design networks have become easier to train, and well performing, and libraries exist to train LipNets with minimal effort (cf geotorch, deel-lip, etc…).\nTraining overheads are described in Appendix E, for an exhaustive study of the overheads of LipNets, we refer the reviewer to (Boissin et al. 2025, Table 3). \n\nFor reference, our ResNeXt model of Figure 3 introduces a 9.6% runtime overhead on TinyImageNet compared to an identical unconstrained model.\n\n**Details:**\nThe article by Liu et al. (2024) mentioned by the Reviewer is already cited in Page 1 L46.", "claims_and_evidence": "The claims are generally supported by theoretical proofs and empirical results but also some problem exist. For example:\n\n- Claim 1: The authors call their method a CP method, but highly rely on training a specific classifier, which contradicts the model-independence of the CP method.\n\n- Claim 2: Although author stated \"We derive the first sound coverage bounds for vanilla CP that are valid simultaneously across all attack levels\", it does not give an explicit quantification form, only gives a definition of the coverage bound. \n\n- Claim 3: The worst-case coverage bounds (Theorem 3.3) are rigorously proven in Appendix B, assuming input space convexity and continuity of the non-conformity score. But the convex assumptions are unreasonable for image data in experiment.\n\n- Claim 4: Although they provide a method to compute lower and upper bounds on CP, the discussion about the tightness of  bounds based the method is missing;\n\n- Claim 5: The efficiency of lip-rcp is evidenced by Table 1 and Figure 2, showing O(1) complexity for non-conformity scores. However, the training overhead of Lipschitz networks (10–20% longer, per Appendix E) is not compared to baseline models.\n\n- Claim 6: ImageNet scalability (Table 2) is demonstrated, but CAS is evaluated on only 500 samples versus lip-rcp’s 50,000, raising concerns about fairness.", "methods_and_evaluation_criteria": "Strengths:\n- The use of Lipschitz networks to bound adversarial score variations is innovative and aligns well with the goal of robust CP. \nThe evaluation on standard benchmarks (CIFAR, ImageNet) is appropriate.\n\nWeaknesses:\n- The method is highly dependent on the specific Lipschitz network, but the estimation of the Lipschitz constant of common SOTA models is NP-hard, and the Lipschitz network is hard to obtain,  so the practical application of the method is limited\n- The experiment focus on l2-bounded attacks limits practical relevance, as $\\ell_\\infty$ and $\\ell_1$-attacks are more common in adversarial ML.", "theoretical_claims": "The proofs in Appendix B assume convex and closed input spaces (Assumption 3.2). But it is not valid for pixel-space images, which are not verified to be  convex and closed.", "experimental_designs_or_analyses": "Strengths: \n- Comprehensive experiments across datasets and comparison to VRCP/CAS.\n\nWeaknesses:\n\n- The experiments comparison use different backbone model (ResNet50 in CAS vs. ResNeXt in lip-rcp). potentially biasing results.\n\n- The ImageNet comparison uses unequal evaluation sizes (500 vs. 50k), potentially biasing results.", "relation_to_broader_scientific_literature": "The work effectively bridges robust ML (Lipschitz networks) and uncertainty quantification (conformal prediction). It appropriately cites foundational CP works (Vovk et al., 2005) and recent robust CP methods  (Gendler et al., 2022; Jeary et al., 2024).", "essential_references_not_discussed": "Recent works CP vulnerabilities under adaptive attacks (Liu et al., 2024) are missing.", "other_strengths_and_weaknesses": "No.", "other_comments_or_suggestions": "NO.", "questions_for_authors": "- The CP method is a model-independent and data distribution-free technique. \nAs the authors state “the CP approach has the advantage of being applicable to any model, \neven pre-trained on a different dataset” in introduction section. But the authors' proposed method relies on training \na specific 1-Lipschitz network which contradicts the model-independence of the CP approach. \nHow does it perform against other CP method based on the same backbone model, such as ResNet 50 e.t.? \nHow much influence does the structure of 1-Lipschitz network have on the effect? \nFor example, what is the result of CAS/RSCP method  combined with 1-Lipschitz network?\n\n- Although the author mention the eq.19 is a estimate of Def 3.1. However, the Def 3.1 is defined in terms of upper (lower) infimum.\nAs the authors state \"the informativeness of the bound is\ndirectly linked to the tightness of the estimate\" in Page 5. \nAn in-depth discussion for the tightness of eq.19 is missing.\n \n-  Despite the author providing a definition of the Conservative/Restrictive Prediction Set in Def. 3.1, \nfurther clarification is required regarding the practical application of this set of predictions.\nIt is necessary to elucidate the conditions under which the Conservative Prediction Set and the Restrictive Prediction Set are employed. \nAdditionally, the methods employed by the authors to calculate the prediction set in the experiment must be thoroughly explained.\n\n- The experiments of work is focused on l2 attack, the l1 and l∞ results is missing, which is common in adversarial attacks. \nThe performance results of the method in these scenarios should be shown.\n\n- Why is CAS evaluated on only 500 ImageNet samples but the lip-cp use 50000 samples in Table 2? \nWould results hold with balanced sample sizes?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "QzaVhKlODI", "reviewer": "Reviewer_XbCa", "summary": "This paper explores how to leverage LipNet and a novel robust conformal score algorithm for robust prediction. Previously proposed robust conformal prediction methods each have their own limitations, such as high computational complexity, making them difficult to scale to large datasets like ImageNet. By utilizing the properties of LipNet, this paper introduces a simple conformal score estimation method with lower computational complexity. The effectiveness of the proposed approach is validated on large-scale datasets, including CIFAR and ImageNet, in the latter part of the paper.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Common response:**\n\nFirst of all, we would like to thank our reviewers for their time spent reviewing our paper along with the insightful comments they provided. Their reviews highlight that our method is “highly efficient and scalable” while underlining its innovative nature and our comprehensive experiments. Moreover, reviewer X44i points out the novelty of the theoretical framework we developed to ensure worst-case coverage bounds of vanilla CP. We appreciate all these comments.\n\nTo address common questions shared among reviewer AUox and reviewer 3iVr, we add the following experiments which support our initial results:\n- **Shared model comparison:** we run a comparison of robust CP methods on an identical model, see answer to reviewer AUox.\n- **Lipschitz bound tightness estimation:** we empirically evaluate the Lipschitz constant of our network by running adversarial attacks, see answer to reviewer 3iVr.\n\n**Reviewer response:**\n\nWe thank the reviewer for their positive feedback and strong endorsement of our work. We have incorporated an impact statement, as well as additional experiments (shared model comparison and empirical tightness estimation) to further highlight the strengths of our approach. We hope these enhancements further clarify and strengthen our contribution.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "Yes", "theoretical_claims": "Yes", "experimental_designs_or_analyses": "Yes", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "N/A", "other_strengths_and_weaknesses": "Strengths: \n1. The paper is clearly written, with well-designed illustrations and elegant notation. Even readers unfamiliar with LipNet and conformal prediction can quickly grasp the key ideas presented.\n2. This paper contributes to two fields. In the domain of conformal prediction, it introduces a new perspective of robustness and proposes a new approach to enhance the robustness of vanilla CP. In the field of Lipschitz neural networks, it leverages existing LipNet techniques to estimate the robust CP score.\n3. The experiments in this paper are conducted on various real-world datasets, ensuring a high level of reliability.\n\nWeaknesses/suggestions: Based on my knowledge, this paper does not exhibit any obvious weaknesses in technical parts. Although the proposed method is relatively simple and may lack significant technical novelty, I believe the new insight this paper provides is valuable. \n\nAccording to the requirement of the ICML 2025, the author should add a impact statement section.", "other_comments_or_suggestions": "This paper is clear and well-structured, with substantial theoretical contributions and a comprehensive set of experiments. The proposed method has the potential to attract significant interest from various fields, such as conformal prediction and Lipschitz neural networks. Hence, I am inclined to accept it.\n\n## update after rebuttal: The authors have addressed my concerns, so I recommend acceptance.", "questions_for_authors": "See above", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "N/A"}}]

Author rebuttal:

Meta-review: Two reviewers recommend acceptance and two reviewers recommend rejection. 

Reviewer AUox that recommends a weak reject raises a few issues most of which seems to be resolved. Some of the remaining issues are not problematic in my opinion and do not warrant rejection. Specifically:
- Model-independence: While this is desirable it is not necessary, providing guarantees only for Lipschitz networks is interesting enough. However, I do agree that training "good" Lipschitz networks is hard in general, which somewhat limits the applicability. This must be clearly highlighted as a limitation by the authors in the final version.
- Convexity: As the authors explained in the rebuttal their result does not depend on the image space being convex or not, since assumption A1 holds. However, I recommend that the authors spend some time clarifying this matter in the paper (e.g. appendix) to avoid future confusion. Similarly, they should discuss when and why A2 holds for the models they consider.

In my opinion, the issues raised by Reviewer 3iVr who also recommends weak reject have been sufficiently addressed in the rebuttal, even though the reviewer did not change the score.

Another limitation that should be discussed and highlighted by the authors is the magnitude of the perturbation. Here $\epsilon$ ranges up to 0.05, while in the smoothing-based baselines (RSCP+, CAS) it is one order of magnitude higher (up to 0.5 and more).

Taken all together, I believe the paper has enough technical and experimental contributions to warrant acceptance.
Decision: Accept (poster)