Invariance-Aware Randomized Smoothing Certificates
Authors: Jan Schuchardt
Stephan Günnemann
Venue: NeurIPS 2022 Accept (2022)
Keywords: Robustness certification
Verification
Randomized smoothing
Invariances
Equivariances

Abstract: Building models that comply with the invariances inherent to different domains, such as invariance under translation or rotation, is a key aspect of applying machine learning to real world problems like molecular property prediction, medical imaging, protein folding or LiDAR classification. For the first time, we study how the invariances of a model can be leveraged to provably guarantee the robustness of its predictions. We propose a gray-box approach, enhancing the powerful black-box randomized smoothing technique with white-box knowledge about invariances. First, we develop gray-box certificates based on group orbits, which can be applied to arbitrary models with invariance under permutation and Euclidean isometries. Then, we derive provably tight gray-box certificates. We experimentally demonstrate that the provably tight certificates can offer much stronger guarantees, but that in practical scenarios the orbit-based method is a good approximation.

Invariance-Aware Randomized Smoothing Certificates
Jan Schuchardt Technical University of Munich
Stephan Günnemann Technical University Munich w.ggunnmmannttmmmcmmmmm de
schuchardt@tum. de
Abstract
Building models that comply with the invariances inherent to different domains, such as invariance under translation or rotation, is a key aspect of applying machine learning real world problems like molecular property prediction, medical imag- ing, protein folding or LiDAR classification. For the first time, we study how the invariances model can be leveraged to provably guarantee the robustness of its predictions. We propose a gray-box approach, enhancing the powerful black-box randomized smoothing technique with white-box knowledge about invariances. First, we develop gray-box certificates based group orbits, which can be applied to arbitrary models with invariance under permutation and Euclidean isometries. Then, we derive provably tight gray-box certificates. We experimentally demon- strate that the provably tight certificates can offer much stronger guarantees, but that in practical scenarios the orbit-bac based method is good approximation.
Introduction
is rell-established that machine learning models are susceptible to adversarial attacks 1 Even without malevolent actors, adversarial attacks be considered worst scenarios in environments with noisy, erroneous or otherwise corrupted data, thus necessitating robust machine learning methods.
Invariance is central design principle that has so far received little dedicated attention in the realm of adversarially robust machine learning. Over the past decades, there has been ongoing research into developing machine learning models that comply with the invariances inherent to different data types and tasks. Prominent recent examples include Deep Sets [5). PointNet [6), Group Equivariant CNNs 17), Spherical CNNs [8] and Graph Convolutional Networks D] but the study of invariant models significantly precedes the surge in popularity deep learning methods [5]
For the first time, we explore the following question: Can a-priori knowledge about invariances be leveraged in deriving provable guarantees for a model's 's robustness to adversarial attacks?
Going by a loose categorization of prior work, we could adopt one of two possible approaches for our exploration: A white-box black-box one. White-box certificates (e.g. (16-23] analyze model's internals, such at its weights and non-lineanee non-lincarities. to provably guarantee that prediction does not change under adversarial attack. Black box certificates specifically randomized smoothing (24 use statistical methods to provide provable guarantees that hold for all models sharing the same prediction probabilities under a random input distribution, irrespective of their internals.
We opt for randomized smoothing approach, as it allows us to focus on the interplay between invariances and robustness, rather than the specific means of implementing these invariances. By combining white-box knowledge about invariances with black-box knowledge about prediction probabilities obtain gray-box certificates. We first derive a gray-box certificate that follows post-processng paradigm: It takes an existing black-box certificate and augments the certified region using information about the model's invariances. This orbit-based certificate serves as a baseline for the provably tight gray-box certificates we derive in subsequent sections.
36th Conference on Neural Information Processing Systems (NcurIPS 2022).

---

For our exploration, we focus on models operating spatial data, rather than structured data (e.g. im- ages and sequences) - both because spatial symmetries can be elegantly formalized using algebraic concepts and because there is an ongoing trend towards using machine learning for real-world applications with inherent spatial invariances, e-g. molecular property prediction (27344) LiDAR classification 38) drug discovery [1),41, particle physics 42 and protein folding 44]
Our main contributions are
the first study on the interplay of invariance and certifiable robustness,
principled method for deriving tight invariance-aware randomized smoothing certificates, tight certificates for models invariant to translations and rotations.
We further demonstrate experimentally that the orbit-based certificates offer a good approximation of our tight certificates, if the variance of the smoothing distribution is small.
2 Related work
Invariant machine learning. Given the diversity of approaches to invariant machine learning, and the fact that our approach is model-agnostic, we refrain from attempting a survey and instead refer to (50) for principled, high-level introduction into the realm of learning with invariances and equivariances.
Invariance and robustness. Two recent empirical studies [51 52] demonstrate that data augmen-
tation meant to increase robustness to fy- no-mo ad advessaiaal attacks reduces robustness to semantically meaningful transformations (e.g. rotation) and vice-versa, suggesting an inherent invariance- robustness trade-off. However, neither study models that are invariant by design. In [53], the negative effect of iallattoonnnvaiinnee on the robustness of image classifiers is investigated. Note that our work is not meant to resolve potential trade-offs, but to tightly bound the actual robustness of models.
Gray-box certificates. While we propose the first gray-box certificate for invariant models, there exists prior work on combining white-box knowledge with black-box certification. In (54] and (55), knowledge about a classifier's gradients is used derive tighter randomized smoothing certificates. In [56]. knowledge about graph neural network's 's receptive fields is used to derive collective gray-box certificates for multiple predictions. In [57). the pesssage-passing scheme of graph neural networks is used for gray-box certification against adversaries that control all features of multiple nodes.
Adversarial attacks spatial data. Adversarial attacks spatial data either modify [58 (66.66) in- sert (65 67 68). or delete [69][]] points in space and have been particularly actively studied for point cloud-classificatie
While the earliest work simply adopted gradient- based attacks from the image do- main (58). more recent work has developed a rich assortment of domain-specific methods, for example preserve object smoothness [64 72). leverage critical points (69 70) craft physically realizable attacks (e.g. to attack models through LiDAR sensors) 73177 Of particular note are attacks via isometries (e.g. rotations and translations) 77 77). whose effectiveness motivates the use of invariant models. Note that we certify the robustness of invariant models to arbitrary point modification attacks not just isometry attacks (see also "orthogonal research directions" below). Like in other domains, empirical defenses have been proposed [59] 78 79] and subsequently broken [80-82), motivating the development of black-box 83 85 and white-box box [66 robustness certificates for spatial data. should be noted that Gaussian randomized smoothing, without invariance information, has already been used in prior work either as a baseline
83 or as a special case of the respective certificate [85).
Orthogonal research directions. One related but orthogonal research direction is transformation- specific certification 2 D33 There, a model is assumed potentially change its prediction under adversarial parametric transformations (e.g. rotations) and one certifies robustness for specific parameter ranges. White-box methods [23 86-89 over-approximate the set of inputs reachable by a transformation and then propagate it through a model using existing white-box techniques. Black-box methods- - namely
wwwoormmmtioonseciiiiiii randomized smoothing 990 94] randomize the transfor- mation parameters to provide robustness guarantees for arbitrary models via statistical methods. Later work generalized this principle to spatial data [85), vector-fiele field deformations [92] and multiplicative parameters [93]. Different from these methods, we assume our model to be invariant under a set of transformations, i.e. never change its prediction. We use this property as a tool for certification against arbitrary perturbations. Aside from that, there exist white-box certification techniques for specific operations with invariances (e.g. global max- pao-looling [86], message passing [95] (96] and batch nor-
malization 197). But prior work does not use or even discuss this property it treats these invariant

---

operations as coincidental building blocks of the models it is trying to certify. Our work is the first to study invariance itself in the context of provable robustness and how to leverage it for certification.
3 Background
3.1 Randomized smoothing
Randomized smoothing is black-box certification technique that can be adapted to various data types, tasks and threat models [98-103 91 [044106]. Instead of directly certifying a classifier it constructs smoothed classifier / that returns the most likely prediction under random perturbations of its input. It then certifies the robustness of this smoothed classifier. We present the tight Gaussian smoothing certificate derived by Cohen et al. (26) and its generalization to matrix data [8 85).
Assume a continuous (N x D)-dimensionall input space IR NRN label set Y and base classifier g: NR -> Y. Let Hxx [ I2 N (Z.. X_,d; ININ) be the isotropic matrix normal distribution with mean X and standard deviation a. Let px.y = =Prz=ux [9(Z) = yl be the probability of g predicting class y under this smoothing distribution. One can then define smoothed classifier ((X) = argmaxye=PXx. : that returns the most likely prediction of g under pxx.
Let F² = [(X be a smoothed prediction and X f(X') = y" by proving that, for perturbed input X', y is more likely than all other classes com- bined. That is, px'."" 0.5. A tighter certificate can be obtained by proving that y is more likely than the second most likely class, i.. p > mv Px',y'. For the sake of exposition, we use the first approach throughout the main text and generalize all results to the second one in Appendix H One can lower-bound y by finding the worst-case classifier from a set of functions H with E Hi
A
perturbed input, One can show
px 2 min Pr REE Z~
[M(
= -
For H = [h= R NND +Y Prz-ux [b(2) - =0] 2 px,y" }. the classifiers that are at least as likely
as g classify X as y", the exact solution is given by the Jeyman-Pearson lemma [107] (see Ap- pendix F.2 The optimal value is +b
( (px.,))
|ااهار]] where + is the standard- CDF
and || 12 Is the Frobenius norm. If ||اا 2 < . (px.,)) ). then ''' > 0.5 and the prediction is
provably robust. Because Eq. T was solved exactly, this a right certificate, i.e. the best possible cer- tificate that can be obtained by only using black-box knowledge about prediction probability Px.y'
Probabilistic certificates. For neural networks, the prediction probability px. can usually not be computed analytically. Instead, one has to use Monte Carlo sampling to compute a lower confidence bound Par .y that holds with high probability 1 a. The resulting certificate is probabilistic one.
3.2 Group invariance
Let f: RXD + Y be classifier and T group, i.e. a set and associated operator : x T - T that closed and associative under the operation, has an inverse 1-1 for each element E T. and features an identity element Further let T act on the input space via group action T x NxD + NxD that preserves the group structure, i.c. (t- t') o X = to (f' o X). Group actions naturally partition the domain into orbits, i.c. sets that can be reached by applying group actions to inputs:
Definition (Orbits). The orbit of an input X E R NxD w.n.. a group T is [X] = {t o X |t T}.
Classifier f is said to be invariant under group T X E ERRN
NxD VX E [ f(X) = f(X)).
3.3 Haar measures
Haar measures [08 are generalization of Lebesgue measures for integration over groups. Their key property is invariance, meaning the group operator does not affect the measure.
Definition 2 (Right Haar measure). Let nj be finite, regular measure on the Borel subsets T. If ())) = ( 1 & E S)) for all t E T. and Borel subsets $ C T, then 1) is a right Haar measure.
For the groups we consider, the Haar measure is unique up multiplicative constant 109 110
In Section 6. we use Haar measures as a notational tool to summarize certificates for different groups However, an understanding of measure theory is not required to follow any part of the derivations.
3

---

X
B
B
7,
71,1 (h) Augmented certified region
(a) Robustness individual points
Figure I: Orbit- gray-box certificate for translation invariance and N = =, D = a.) Input X' can be translated into certified region IB. It is not an adversarial example. Input X" can not be translated into B. It might be adversarial example. b.) The prediction y" f(X) is certifiably robust all perturbed inputs from augmented region IB, the union over all translations IB.
4 Problem setting
We consider similar setup to that described in Section
3.1 i.e. have smoothed classifier
f: N Y that is the result of randomly smoothing a base classifier g with an isotropic matrix normal distribution μxx Given clean prediction y² f(X) with clean prediction probability px."* we want to determine whether f(X') = =y" for an adversarially perturbed input X' =x A.
Different from all prior work, we additionally assume that the base classifier is invariant under group T. This does not necessarily mean that the smoothed classifier f shares the same invariances. But, we can use the isotropy of smoothing distribution jxx to prove (see Appendix D) that randomized smoothing preserves invariance under Euclidean isotropies (rotation, reflection and translation) and permutation, which we shall leverage in Section 5
Theorem 1. Let base classifier g ND + Y be invariant under group T with T C B(D) or S S(N), where E(D) is the Euclidean group and S(N) is the permutation group. Then the isotropically smoothed classifier f, as defined in Section 3.1 is also invariant under T.
Note that the above result also holds for subgroups of E(D), such as the translation group T(D), the rotation group (D) and the roto-translation group SE(D). We define these groups and their actions on R x more formally Appendix C
Orbit-based gray-box certificates
Since we are the first to consider robustness certification for invariant models, begin by defining baseline that other certificates can be benchmarked against: It is based on the insight that certificates correspond to sets of inputs C R N that preserve clean prediction y", and group T corresponds to sets of transformations that preserve predictions. By transitivity, perturbed input X that can a transformation from T, i.c. 3t e T t X' B, must fulfill f(X') = y and cannot be an adversarial example. Combining all such inputs, i.e. combining the orbits of elements of BB (see Definition I,, yields augmented certified region IB 2 B (proof in Appendix E.1
reach IB
Theorem 2 (Orbit-based certificates). Let f E ENND + Y be invariant under a group T. Let y" f(X) be a prediction that is certifiably robust
of perturbed inputs C NxD i.e.
ZZ E B f(Z)= = y". Let Uz Then VX B: f(X))= =
This brbit-based approach is illustrated in Fig. T While we focus randomized smoothing, Theorem holds for arbitrary models and certified regions B. However, obtaining via other means may not be possible. For instance, there exist white-box certificates for rotation-invarianl models.
Because randomized smoothing preserves invariance Euclidean isometries and permutation (see Theorem we may apply the orbit-based approach with T C E(D) T C S(N) to the certified region (X
|| < r) with o 11 (px.y*) that we derived Section 3.1
While B Uze [Z] is a valid certificate, one may desire an equivalent, but more explicit characterization the certified region B to determine whether a specific perturbed input preserves the prediction y² We discuss such explicit characterizations in Appendix E In particular, translation
invariance (i.c. T T(D)) leads to certified region a (X A
1, All2 < r). where

---

A E RIxD are column-wise averages and is defined as above. Rotation invariance (i.e. T = SO(D)) leads to certified region B = x I X||2 < <r), where R is an optimal rotation matrix defined by the singular value decomposition of X X' (see Appendix E.2.2
6 Tight gray-box certificates
Now that we have established a baseline for gray-box certification, one may naturally wonder about its optimality. We answer this by deriving tight gray-box certificates, i.e. the best certificates that can be obtained for prediction y" using only the invariances of base classifier under group T and its prediction probability px,y under clean smoothing distribution μa. Similar to Section 3.1 do so by finding a worst-case classifier. In addition to constraining its clean prediction probability, constrain the classifier to be invariant under T,, i.e. solve minselty Przzuxx [M( y"] with
HT h: R Y
Pr Z~px
[MZ =00==111 101 Px.y, VZ, VZ' E [Z h h(Z) h h( 22) (2)
where [r is the orbit of Z w.r.t. T (see Definition] 1. In the following, we show how to solve the above optimization problem and then apply our certification methodology specific invariances.
6.1 Certification methodology
To work with invariance constraints, convenient to not think of h as a function, but a family of variables (hz) Y indexed by ND The invariance constraint states that all variables from an orbit should have the same value, i.c. VZ, VZ' E 1 : hz = hzz. Intuitively, the constraint can be enforced by replacing all these variables with single variable. We propose to formalize this idea by using canonical maps, which map all inputs from an orbit to a single, distinct representative:
Definition 3 (Canonical map). A canonical map for invariance under group of transformations T is a function y RxD + R D with
ZZ NXD (Z) E [Z ZZ E NXD VZ' E 7 7 (Z) = (Z').
(3)
(4)
In Appendix F.T. we prove that canonical maps let us discard the invariance constraints:
Lemma 1. Let g : I. NxD + Y be invariant under group TT and let Hr be defined as in Eq. 2 If
y: RND + R Nx X is canonical map for invariance under T, then
min WEHr Z~Hxi
Pr (MZ v²]
min
Pr (h(+(Z)) y'I.s. s.t. Pr (M()(Z)) y01 Px." Z~px
ARR NRRXXD-I
Zraxx
the optimization problem without invariance constraints from Lemma could now be solved exactly using the Jeyman-Pearsee lemma - if we could find the distribution of 7 2 i.e. the distribution of representative! This can be achieved for groups T TDD), (D) and SE D) via careful change of variables into an alternative parameterization of R N XXD
Like Section 3.1
(see Appendix F.3
This leads us
main result, which derive more formally in Appendix F3 In the following,
let (A, B)F F be the Frobenius inner product ΣN= (A..)" B, and recall from Section 3.3 that a right Haar measure is measure for integration over a group T.
Theorem 3. Let N + Y be invariant under T with T chosen from T(D), SE))
For SO(D) and SE(D), let D E (2,3). Let lilly be defined in Eq. ( and be right Haar measure on T. Define the indicator function h- : :R + {0, 1} with
1xx (Z) he 1z
where 0x (Z) = [f exp ((t Z, x) p/ 0²) dn(t)
(5)
8x (Z)
and E IK such that Z~ux
E [h (Z)] px..'
(6)
Then
min Pr [hZ W
E [h'
(7)
Z~ドXx
Z~
which, by Definition 3 is equivalent a distribution over orbits.
5

---

The indicator function h" in Eq. 55) corresponds to the worst-case invariant classifier for clean prediction probability Px,y* To classify an input sample Z. integrates Gaussian kernels of ( Z, X') and (1. Z, X) over group T (e.g. over all possible rotations). If the ratio of these integrals below a threshold K, classifies Z as y² 'hee constraint in Eq. (6) ensures that the probability of predicting y" under the clean smoothing distribution _ matches that of the actual base classifier g.
The expected value with respect to perturbed smoothing distribution μxx in Eq. (7) is the optimal value of our optimization problem. As discussed in Section 3.1 the prediction is certifiably robust if this optimal value is greater than 1/2.
Applying the certificate to a group T requires three steps: 1.) Calculating the Haar integrals in Eq. ( 2.) Solving Eq. (6) for classification threshold λ. 3.) Evaluating the expected value in Eq. 7
Connection to prior work. This result differs from black-hox randomized smoothing with Gaussian noise, where the worst-case classifier is linear model
[26]. The group averaging performed by
the worst-case invariant classifier, i.e. integrating a function over group T, is a key technique for building invariant models [13) Group-averaged kernels have been proposed in [[5]. It is fascinating to see them naturally materialize from nothing but an invariance constraint.
6.2 Translation invariance
In the case of translation invariance (i.e. T= T(D)), we can evaluate the worst-case classifier
(Eq. 5). solve for threshold x (Eq. (6) and evaluate the perturbed prediction probability (Eq. analytically. This leads to the following result (proof in Appendix [F4.I):
Theorem Let g RNND X + Y be invariant under = ((D) and Hily be defined as in Eq.
2
Then
min Pr -()))yy1=00 KEET Z~pix!
(pxxv) A (A-1x4112) 1x
where A E RRIxD are the column-wise averuges of = X' X and a is the slandard deviation of the isotropic matrix normal smoothing distribution px.
Certificate parameters. For fixed smoothing standard deviation o, the certificate depends on single parameter: The norm A In 1|2 of the mean-centered perturbation matrix A.
Comparison to the orbit-based certificate.
Substituting into robustness condition
mingeE, Prz [h(Z) = y²] > 2 shows that f(X') = y² if A 1, A < a (px..' ). This result, obtained via our tight certification methodology, is identical to the orbit- based certificate for translation invariance from the end of Section [S] other words: Despite its simplicity, the orbit-based certificate is the best possible gray-box certificate for translation invariance.
6.3 Rotation invariance in 2D
Considering the previous result, one may suspect the arbit-based certificate to be tight for arbitrary
invariances. This is not the case. For instance, is not tight for rotation invariance (T = (O(D)):
Theorem 5. Let g : N -> W. be invariant under T. = SO D) and HoT be defined in Eq. (2) Assume that perturbed input X' is not obtained via rotation of X, i.e. 7R E SO(D) X' X
Further assume that px. y E (0, 1). Then, for all R E (S()D):
min Pr [M = 3²1 ④ (px.v 1 X - x112 NCR: Z~XXx
(8)
In other words: The tight certificate is strictly stronger. Proof in Appendix G
Next, we apply Theorem 3 to obtain the strictly stronger, tight certificate for rotation invariance in
2D. In the following. let R()0) E (2) be the matrix that rotates counter-clockwise by angle 0 and To be the modified Bessel function of the first kind and order O. The Haar integral from Eq. (5) that defines the worst-case classifier can be evaluated analytically (see Appendix F.4.2
xx 2 = To G2
(2, V (2,
We can substitute this into Theorem and use the fact that Fq.. (9) depends on linear transformations of the matrix normal random variable Z to obtain the following certificate (proof in Appendix F.4.2

---

Theorem 6. Let g RNx2 + Y be invariant under T = S0(2) and HiT be defined as in Eq. 2
Define the indicator function p:E. R + {0, 13 with
To (V
p(q)
2
Iu
(V + 93
SK
(10)
with R. R such that
[p(g)]
px,y"
(11)
(m
Then
min Pr [h(Z] = yy1 hE Z~
E q- qmM((m()))
[p(g)],
(12)
where m (2), m R4, E g4x4 are linear combinations (see Appendix F.4.2 of | 03
|| / / o² and parameters Ej = (X A p. 62 (X (X
A )..
Certificate parameters. This certificate depends on the perturbation norm | and clean data norm ||| relative to the smoothing standard deviation a. It further depends on parameters 6 and 62, which are Frobenius inner products between A and the clean input X before and after a rotation by- -7/2. These parameters capture the orientation of X' = X + A relative to X, one would expect from a rotation- -nveriinne aware certificate.
Monte Carlo evaluation. Evidently, we do not have a closed-form expression for the expectations in Eqs. M and (12). However, recall from Section 3.T that randomized smoothing already involves an intractable expectation, namely the prediction probability Px.y* One has to use Monte Carlo sampling to compute a lower confidence bound that hold with high probability 1- a. We adopt the same approach: First, we lower-bound threshold from Eq. (TT). i.c. make the classifier slightly less likely to predict y*. Then, we lower-bound bound expectation E (q-N(m(()) x)
[p(q)] from Eq. (2). Because the resulting value is slightly smaller than the optimal value of our optimization problem mingeR, Prz~ux/ [h = y²,, this procedure yields a valid certificate. We discuss the full algorithm and how to ensure that all bounds simultancously hold in Appendix F.5 Because the expec- tations only require sampling from four-dimensional normal distributions and do not depend on base classifier g, can a large number of samples to obtain narrow bounds at little computational cost (e.g. 0.59s for 100000 samples per confidence bound on an Intel Xeon E5-2630 CPU).
6.4 Rotation invariance in 3D
To evaluate the tight certificate for 3D rotation invariance (i.e. T SO(3)), we adopt the same Monte Carlo evaluation approach discussed Section 66.3 Different from 2DD rotation invariance, evaluating the worst-case classifier analytically is not tractable. It can however be evaluated by numerical integration over an Euler angle parameterization of rotation group (3) (see Appendix F.4.3
6.5 Roto-translation invariance 2D and
In Appendix F.4.4 we prove that additionally enforcing translation invariance (i.e. T= SE(D)) is equivalent to centering X and A before evaluating the certificates for rotation invariance. This consistent with our result from Section 6.2 i.e. the orbit-based approach being optimal for translation.
7 Limitations and broader impact
The main limitation of our work lies in its exploratory nature. We have derived the first certificates for models invariant under arbitrary Euclidean isometrics and/or permutation. While these invariances are of key importance to many practical applications there a vast swath of invariances that we have not covered, such spatio-temporal invariances E.] invariance under graph isomorphisms [9] or invariances for planar images 77. Furthermore, we have not yet derived tight certificates for reflections and permutations (though certification methodology could conceivably be applied to them).
Broader impact. With the growing prevalence of machine learning in safety-critical and sensitive domains like autonomous driving [118 119 or healthcare [20 121] trustworthy models promise to become increasingly important. Certification one pillar trustworthiness, alongside concepts like
fairness 222 [23 or differential privacy [144 [25]. Unique to our work is that we certify models
7

---

1.0
30(2) Tight
d Pmin
SO(2) Orbit
||||--1.0
|||| -
Pmin
0.8
0.4
IXII=0.5
IXII=0.25
0.6
IXI]=0.1
0.2
IXII=0.01
-1
0.00
0.25
0.50
0.75
1.00
1.25
1.50
-1 1
0.0
|||||
61
61
Figure 2: Comparison of tight and orbit- based cer- tificates applied to adversarial scaling for a = 0.5 and varying A and || (smaller Pmii is bet-
Figure 3: Difference in Pmii between the tight
tificate for 2D rotation invariance and the black- box baseline for 0.5, ||| 1.0. Crosses correspond to adversarial rotations. Large d(Puin) can be observed near adversarial rotations.
ter). As X increases, the difference between
the certificates shrinks.
with spatial invariances. These invariances naturally occur in the physical sciences, including those with direct socictal impact like pharmacology and biochemistry. Our work can be seen as a first step towards provable trustworthiness for tasks like drug discovery [1 or protein folding 45
Experimental evaluation
We already know that the orbit-based certificate for translation invariance tight and certifies robustness for infinitely larger volume than black-box randomized smoothing (see Fig. [ Therefore, we focus our experiments on the certificates for rotation invariance. Recall that the orbit-based certificate guarantees robustness for the set = (X' |X'R" -||22 < <r} with o (px.g") and optimal rotation matrix R. In other words: It certifies robustness for perturbations with rotational components that can be eliminated to bring X' into distance r of X. We want understand whether the tight certificates offer any benefit beyond that, or if the strict inequality in Theorem is due to some negligible e. To this end, we first thoroughly examine the four-dimensional parameter space of the tight certificate for rotation invariance in 2D, before applying our certificates to rotation invariant point cloud classifiers.
All parameters and experimental details are specified in Appendix B We 10000 samples per confidence bound and set a = 0.001, i.c. all certificates hold with 99.9% probability. A reference implementation will be made available at https//www....c..uu..e.ell////lm
8.1 Tight certificate parameter space
The tight certificate for 2D rotation invariance depends on |X 222 a, || / and parameters é1 and e2, which capture the orientation of the perturbed point cloud and fulfill / + o ||X||2 || (see Appendix D. To avoid clutter, we define éμ := E [||X]] ||2 section, we report Pmin. the smallest probability px,9" for which a prediction
|| 22). As our metric for this still be certified
Adversarial scaling. First, we assume that X' = (1 X, i.c. the input is adversarially scaled. In this case, we have é and é2 = O. We then vary | la and ||X| 2/2 and evaluate our certificates. Note that such attacks have no rotational component, i.. the orbit-based certificate is identical to the black-box one. Fig. 2 shows that,
in the absence of rotations, the tight certificate can 0.01, the baseline can only certify robustness for prediction with Px.,* 0.8 if A la < 0.4. The tight certificate can certify robustness up to
yield significantly stronger guarantees. For a 0.5 and X||2
A |a 0.73. However, the gap shrinks as the norm of the clean data increases.
Effect of data norm. We would like to see if this is pervasive pattern. To this end, we fix || A l2. gradually increase
X |/2, and evaluate the tight certificate for ē1, E2 on a 100 x 100 rasterization of [0, x (0, 1]. We then measure the difference d(pmin) to the black-box certificate (we will discuss
We discuss how to compute these inverse certificates in Appendix

---

d M(Pmin
|
|
- 10.0
-1
1
-1
1
1
0
-1
61
C1
Figure 4: Difference in Pmii between the tight certificate for 2D rotation invariance and the black-box
baseline for a = 0.5, ||||| 0.5 under varying || where the tight certificate outperforms the black-box baseline shrink.
|| é and é2. As |X] increases, the regions
1.0
1.0
MNIST
SE(2) Tight
0.8
ModelNet400
Certified Aec-
0.8
SF(() Orbir
Accuracy
SO(2) Tight
0.6
0.6
(0 Orbit
0.4
EasPointNet AunPointNet
0.2
0.2
EasDGCNN
0.0
0.0
0.0
0.1
0.2
0.3
0.4
0.5
0.2
0.4
0.6
0.8
|||||
Figure Test set accuracy of smoothed trans- lation and rotation invariant point cloud classi- fiers on the ModelNet40 and MNIST pointeloud datasets, under varying standard deviation a.
Figure Comparison of certificates for adver- sarial scaling of MNIST with EnsPointNet and = 0.15. The tight and orbit-based certificates yield similar certified accuracies.
how these results relate to the urbit-based one shortly). Fig. shows that for small || [|,, the tight certificate outperforms the black-box certificate for arbitrary perturbations of norm || 22 But, as ||X 22 increases, the regions where outperforms the black-box one shrink.
Rotational components. Simple algebra (see Appendix shows that for any combination of X| and || A |2. adversarial rotations, i.c. X' X such that || X = || correspond two specific points with V - 2 1 in the certificate's parameter space. In Fig. 3 we fix = 0.5 and |X 1, vary A and highlight these two points. We observe that the tighT certificate only out- performs the black-box certificate for values of é1, E2 that are close to adversarial rotations. However, robustness to such attacks can also be readily certified by the orbit-based approach. Combined with our previous observations, and because the certificate only depends on norms relative to smoothing standard deviation o, i.c. ||x||//
/// a and A 1l2 / o. we expect the tight and the orbit-based certificate to perform similarly well, assuming that the smoothing standard deviation is small relative to X 22-
8.2 Application to point cloud classification
To verify whether our observations hold in practice, apply our certificates point cloud classifica- tion. We consider two datasets: 3D point cloud representations of ModelNer40 [126), which consists of CAD models from 40 different categories, and 2D point cloud representations of MNIST [127] We apply the same pre-processing steps as in [6]. Certification is performed on the default test sets. As our base classifiers, we use rotation and translation (i.e. SE(D) invariant versions of two well-established models that are used in prior work on robustness certification for point clouds: PointNet [6] and DGCNN [28]. To implement the invariances, we center the input data, perform principal component analysis, apply the model to all possible poses (see discussion in [129 (30 and average the output logits (EnstointNet and EnsDGCNN).
addition, we consider a more refined model [129 that combines canonical poses via self-attention mechanism PAttnPointNet). Throughout this section, we report both probabilistic upper and lower bounds for the Monte Carlo evaluation of the tight certificates (recall Section 6.3

---

1.0
1.0
Pr. Cert. Acc.
0.8
Pr. Cert. Acc.
0.8
0.6
0.6
0.4
0.4
(2 light
(B(3) light
0.2
( Orhic
0.2
(3 Orhic
Black-hox
Black-hox
0.0
0.0
4
10
0
2
4
10
0 deg
0 deg
(a) EnsPointNet on MNIST
(b) EnsDGCNN on ModelNNe40
Figure 7: Comparison of tight, orbit-based and black-box certificates for randomly perturbed inputs with || = =a 0.1, rotated by angle 0. The gray-box certificates effectively eliminate the induced rotation, while the black-box method cannot certify robustness for large 0.
Practical smoothing parameters. Fig. shows the test set accuracies of randomly smoothed models under varying standard deviations Values of that preserve accuracy above 50% are small, relative to the average norm the test sets (10.67 for MNIST, 19.17 for ModelNet4O)). Going by our previous results, expect the tight and orbit-based certificates perform similarly well.
Adversarial scaling. In Fig- 6 we again consider adversarial scaling, i.e. attacks without rotational components, but applied to the MNIST point cloud dataset with 0.15. We report the certified accuracy, i.c. the percentage of correct and provably robust predictions, for certification with (2E(2)) and without (2) translation invariance. The tight and orbit-based certificate yield similar results. further observe that enforcing translation invariance increases the certified accuracy and extends the range of ||||| for which robustness be certified.
Rotational components. Finally, we study perturbations with rotational components. We fix ||||| randomly sample perturbations of the specified norm and then rotate Z = X + A by specified angle E [0, 10 (in the case of ModelNet40, around one randomly chosen axis). For each element test set and each 0, we generate 10 such samples. We then compute the percentage of samples X' for which ((X) is correct and (X') = s(X) is provably guaranteed ("probabilistic certified accuracy"). Fig. shows results for MNIST and ModelNet40 evaluated with |
0. The black-box baseline's 's probabilistic certified accuracy drops close to for = 29, The gray-box certificates are almost constant in 0, i.e. effectively climinate any induced rotation. However, the tight certificate did not offer any meaningful benefit beyond that. Using the lower bound for Monte Carlo evaluation, there not single sample for which only the tight certificate could guarantee robustness.
In Appendix A we repeat the experiments from this and the previous section for various other combinations of parameter values. All results are consistent with the ones presented here, confirming that the orbit-based approach offers good approximation tight certificates in practice.
Conclusion
For the first time, we have studied the use of invariances for robustness certification. We proposed a gray-box approach, combining white-box knowledge about invariances with black-box randomized smoothing. We have derived orbit-based procedure for certification that can be applied to arbitrary models with invariance to permutations and Euclidean isometries. We have proven that the orbit-based certificate for translation invariance is tight and derived strictly stronger certificates for rotation invariance. Our experiments are to be interpreted in two ways: Firstly, the fact that possible certificates and that there exist scenarios in which they offer stronger
to derive tight invariance-awen guarantees for arbitrary perturbations should be an exciting inspiration for future work. Secondly, the fact that the orbit-based certificates easily interpretable and offer good approximations of our tight certificates should invite their application to real-world tasks with inherent invariances.
The authors would like to thank Johannes Gasteiger for valuable discussions on invariant deep learning and Lukas Gosch for constructive criticism of the manuscript. This research was supported by the German Research Foundation, grant GU 1409/4-1.
Ackmowledgements.
10

---

References
[1] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations, 2014.
[2] lan Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamessiing adversar- ial examples. International Conference on Learning Representations, 2015.
[3] Naveed Akhtar and Ajmal Mian. Threat of adversarial attacks on deep learning in computer vision: A survey. IEEE Access, 6:14410-14430, 2018.
[4] Han Xu, Yao Ma, Hao-Chen Liu, Debayan Deb, Hui Liu, Ji-Liang Tang, and Anil K Jain. Adversarial attacks and defenses in images, graphs and text: review, International Journal of Automation and Computing, 17(2):151-77,, 2020.
[5] Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhutdinov, and Alexander J Smola. Deep sets. Advances in neural information processing systems, 30, 2017.
[6] Charles R Qi, Hao Su, Kaichun Mo, and Leonidas Guibas. Pointnet: Deep learning on point sets for 3d classification and segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 652-660, 2017.
[7] Taco Cohen and Max Welling, Group equivariant convolutional networks. In International conference on machine learning, 2016.
[8] Taco S Cohen, Mario Geiger, Jonas Köhler, and Max Welling. Spherical CNNs. In Interna- tional Conference on Learning Representations, 2018.
[9] Thomas N Kipf and Max Welling. Semi-supervised classification with graph convolutional networks. In International Conference on Learning Representations, 2017.
[10] Kumihiko Fukushima. Neural network model for mechanism of pattern recognition unaffected by shift in position - neocogmitron. IEICE Technical Report, A, 62((0):658-66) 1979.
[11] C Lee Giles and Tom Maxwell. Learning, invariance, and generalization in high-order neural networks. Applied optics, 26(23):4972-499 4978, 1987.
[12] Christopher J Burges and Bernhard Schölkopf. Improving the accuracy and speed of support vector machines. Advances neural information processing systems, 9, 1996.
[13] Olivier Chapelle and Bernhard Schölkopf. Incorporating invariances in non-linear support vector machines. Advances in neural information processing systems, 14, 2001.
[14] Dennis DeCoste and Bernhard Schölkopf. Training invariant support vector machines. Machine learning, 46(1): 1661):16,- 2002.
[15] Bernard Haasdonk, Vossen, and Hans Burkhardt. Invariance in kernel methods by Haar- integration kernels. In Scandinavian Conference on Image Analysis, pages 841-851. Springer, 2005.
[16] Chih-Hong Cheng, Georg Nührenberg, and Harald Ruess. Maximum resilience of artificial neural networks. In International Symposium on Automated Technology for Verification and Analysis, pages 251-268. Springer, 2017.
[17] Guy Katz, Clark Barrett, David Dill, Kyle Julian, and Mykel Kochenderfer. Reluplex: An efficient SMT solver for verifying deep neural networks. In International conference computer aided verification, pages 97-117. Springer, 2017.
[18] Ruediger Ehlers. Formal verification of piece-wise linear feed-forward neural networks. International Symposium on Automated Technology for Verification and Analysis, pages 269-286 Springer, 2017.
11

---

[19] Lily Weng, Huan Zhang, Hongge Chen, Zhao Song. Cho-Jui Hsieh, Luca Daniel, Duane Boning, and Inderjit Dhillon. Towards fast computation of certified robustness for relu networks. In International Conference on Machine Learning. 2018.
[20] Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning, 2018.
[21] Timon Gehr, Matthew Mirman, Dana Drachsler-Cohent Petar Tsankov, Swarat Chaudhuri, and Martin Vechev. A12: Safety and robustness certification of neural networks with abstract interpretation. IEEE Symposium on Security and Privacy (SP). IEEE, 2018.
[22] Huan Zhang. Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions. Advances in neural information processing systems, 31, 2018
[23] Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin Vechev. An abstract domain for certifying neural networks. Proceedings of the ACM on Programming Languages, 3(POPL): 1-30, 2019.
[24] Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsich. Towards robust neural networks via random self-ensemble. Computer Vision ECCV 2018, pages 381-397. 2018.
[25] Mathias Lécuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Cer- tified robustness to adversarial examples with differential privacy. In IEEE Symposium on Security and Privacy, pages 656 672. IEEE, 2019.
[26] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via random- ized smoothing. In International Conference on Machine Learning, 2019.
[27] David K Duvenaud, Dougal Maclaurin, Jorge Iparraguirre, Rafael Bombarell, Timothy Hirzel, Alán Aspuru-Guzia and Ryan P Adams. Convolutional networks graphs for learning molecular fingerprints. Advances in neural information processing systems, 28, 2015.
[28) Connor W Coley, Regina Barzilay, William H Green, Tommi S Jaakkola, and Klavs F Jensen. Convolutional embedding of attributed molecular graphs for physical property prediction. Journal of chemical information and modeling, 1757)1777 2017.
[29] Justin Gilmer, Samuel S Schoenholz, Patrick F Riley, Oriol Vinyals, and George E Dahl. Neural message passing for quantum chemistry. In International conference on machine learming, 2017.
[30] Kristof T Schütt, Huziel Sauceda, P-J Kindermans, Alexandre Tkatchenko, and K-R Müller. SchNet deep learning architecture for molecules and materials. The Journal of Chemical Physics, 148(24):241722,, 2018
[31] Johannes Gasteiger, Janek Groß, and Stephan Günnemann. Directional message passing for molecular graphs. International Conference on Learning Representations, 2019.
[32] Johannes Gasteiger, Florian Becker, and Stephan Günnemann. GemNet: Universal directional graph neural networks for molecules. Advances in Neural Information Processing Systems, 34, 2021.
[33] Johannes Gasteiger, Chandan Yeshwanth, and Stephan Günnemann. Directional message passing molecular graphs via synthetic coordinates. Advances in Neural Information Processing Systems, 34, 2021.
[34] Nicholas Gao and Stephan Günnemann. Ab-initio potential energy surfaces by pairing GNNs with neural wave functions. In International Conference on Learning Representations, 2022.
[35] Joachim Niemeyer, Franz Rottensteiner, and Uwe Soergel. Contextual classification of lidar data and building object detection in urban areas. ISPRS journal of photogrammetry and remote sensing, 87:152-165, 2014.
12

---

[36] Aili Wang, Xin He, Pedram Ghamisi, and Yushi Chen. Lidar data classification using mor- phological profiles and convolutional neural networks. IEEE Geoscience and Remote Sensing Letters, 15(5):774-778, 2018.
[37] Xin He, Aili Wang, Pedram Ghamisi, Guoyu Li, and Yushi Chen. Lidar data classification using spatial transformation and enn. IEEE Geoscience and Remote Sensing Letters, 16(1): 125- 129, 2018.
[38] Ying Li, Lingfei Ma, Zilong Zhong, Fei Liu, Michael A Chapman, Dongpu Cao, and Jonathan Li. Deep learning for lidar point clouds in autonomous driving: A review. IEEE Transactions on Neural Networks and Learning Systems, 32(8):3412 24322,33322222 2020.
[39] Zhaoping Xiong, Dingyan Wang, Xiaohong Liu, Feisheng Zhong, Xiaozhe Wan, Xutong Li, Zhaojun Li, Xiaomin Luo, Kaixian Chen, Hualiang Jiang, al. Pushing the boundaries of molecular representation for drug discovery with the graph attention mechanism. Journal of medicinal chemistry, 63(16))879-88760, 2019.
[40] Hubert Ramsauer, Bernhard Schäfl, Johannes Lehner, Philipp Seidl, Michael Widrich, Lukas Gruber, Markus Holzleitner, Thomas Adler, David Kreil, Michael K Kopp, et al. Hopfield networks all you need. International Conference on Learning Representations, 2020.
[41] Chenjing Cai, Shiwei Wang. Youjun Xu, Weilin Zhang, Ke Tang, Qi Ouyang, Luhua Lai, and Jianfeng Pei. Transfer learning for drug discovery. Journal of Medicinal Chemistry, 63(16); 8683-8694, 2020.
[42] Pierre Baldi, Peter Sadowski, and Daniel Whiteson. Searching for exotic particles in high- energy physics with deep learning. Nature communications, 5(1):1-9, 2014.
[43] Dan Guest, Kyle Cranmer, and Daniel Whiteson. Deep learning and its application to Ihe physics. Anmual Review of Nuclear and Particle Science, 68:161-181, 2018
[44] Alexander Bogatskiy, Brandon Anderson, Jan Offermann, Marwah Roussi, David Miller, and Risi Kondor. Lorentz group equivariant neural network for particle physics. In International Conference on Machine Learning, 2020.
[45] Ning Qian and Terrence Sejnowski. Predicting the secondary structure of globular proteins using neural network models. Journal of molecular biology, 202(4):865-884, 1988.
[46] Piero Fariselli, Osvaldo Olmea, Alfonso Valencia, and Rita Casadio. Prediction of contact maps with neural networks and correlated mutations. Protein engineering, 14(1 (1111)8335-44 2001.
[47] Jinbo Xu. Distance-based protein folding powered by deep learning. Proceedings of the National Academy of Sciences, 166(34) 2019.
[48] Mohammed AlQuraishi. End-to-end differentiable learning of protein structure. Cell systems, 8(4):292-301, 2019.
[49] Kiersten M Ruff and Rohit V Pappu. AlphaFold and implications for intrinsically disordered proteins. Journal of Molecular Biology, (23)))6:7720) 2021.
[50] Michael M Bronstein, Joan Bruna, Taco Cohen, and Petar Veličković. Geometric deep learning: Grids, groups, graphs, geodesics, and gauges. arXiv preprint arXiv:2104.134777 2021.
[51] Florian Tramèr, Jens Behrmann, Nicholas Carlini, Nicolas Papernot, and Jörn-Henria Jacobsen. Fundamental tradeoffs between invariance and sensitivity to adversarial perturbations. In International Conference Machine Learning, 2020.
[52] Sandesh Kamath, Amit Deshpande, Subrahmanyam Kambhampati Venkata, and Vineeth N Balasubramanian. Can we have it all? on the trade-off between spatial and adversarial robustness of neural networks. Advances in Neural Information Processing Systems, 34, 2021.
[53] Vasu Singla, Songwei Ge, Basri Ronen, and David Jacobs. Shift invariance can reduce adversarial robustness. Advances Neural Information Processing Systems, volume 34, 1021.
13

---

[54] Ject Mohapatra, Ching- Yun Ko, Tsui- Wei Weng, Pin- Yu Chen, Sijia Liu, and Luca Daniel. Higher-order certification for randomized smoothing. In Advances in Neural Information Processing Systems, volume 33, 2020.
[55] Alexander Levine, Aounon Kumar, Thomas Goldstein, and Soheil Feizi Tight second-order certificates for randomized smoothing. arXiv preprint arXiv:2010. 2020.
[56] Jan Schuchardt, Aleksandar Bojchevski, Johannes Klicpera, and Stephan Günnemann. Col- lective robustness certificates: Exploiting interdependence in graph neural networks. In International Conference on Learning Representations, 2021.
[57] Yan Scholten, Jan Schuchardt, Simon Geisler, Aleksandar Bojchevski, and Stephan Günne- mann. Randomized message-interceptine smoothing: Gray-box certificates for graph neural networks. Advances in Neural Information Processing Systems, 35, 2022.
[58] Jong-Chyi Su, Matheus Gadelha, Rui Wang. and Subhransu Maji. A deeper look at 3d shape classifiers. In Proceedings of the European Conference Computer Vision (ECCV) Workshops, 2018.
[59] Daniel Liu, Ronald Yu, and Hao Su. Extending adversarial attacks and defenses to deep 3d point cloud classifiers. In IEEE International Conference on Image Processing (ICIP), pages 2019.
[60] Hang Zhou, Dongdong Chen, Jing Liao, Kejiang Chen, Xiaoyi Dong, Kunlin Liu, Weiming Zhang. Gang Hua, and Nenghai Yu. LG-GAN: Label guided adversarial network for flex- ible targeted attack of point cloud based deep networks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 00356-10365 2020.
[61] Tzungyu Tsai, Kaichen Yang. Tsung- Yi Ho, and Yier Jin, Robust adversarial objects against deep learning models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 954-962, 2020.
[62] Kibok Lee, Zhuoyuan Chen, Xinchen Yan, Raquel Urtasun, and Ersin Yumer. ShapeAdv: Generating shape-aware adversarial 3d point clouds. arXiv preprint vrXiv:2005.11626 2020.
[63] Yiren Zhao, Ilia Shumailov, Robert Mullins, and Ross Anderson. Nudge attacks on point-cloud dnns. arXiv preprint arXiv:2011. 1637, 2020.
[64] Yuxin Wen, Jiehong Lin, Ke Chen, CL Philip Chen, and Kui Jia. Geometry-aware generation of adversarial point clouds. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2020.
[65] Jaeyeon Kim, Binh-Son Hua, Thanh Nguyen, and Sii-Kit Yeung. Minimal adversarial examples for deep learning on 3d point clouds. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 7797-7806, 2021.
[66] Yiming Sun, Feng Chen, Zhiyu Chen, and Mingjie Wang. Local aggressive adversarial attacks on 3d point cloud. In Asian Conference on Machine Learning, pages 65-80 PMLR, 2021.
[67] Chong Xiang, Charles R Qi, and Bo Li. Generating 3d adversarial point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2019.
[68] Atrin Arya, Hanieh Naderi, and Shohreh Kasaei. Adversarial attack by limited point cloud surface modifications. arXiv preprint arXiv:21 2021.
[69] Matthew Wicker and Marta Kwiatkowska. Robustness of 3d deep learning in an adversar- ial setting. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 11767-11775, 2019.
[70] Jiancheng Yang, Qiang Zhang, Rongyao Fang, Bingbing Ni, Jinxian Liu, and Qi Tian. Adver- sarial attack and defense on point sets. arXiv preprint arXiv:1902.10899, 2019.
14

---

[71] Tianhang Zheng, Changyou Chen, Junsong Yuan, Bo Li, and Kui Ren. Pointcloud salieney maps. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1598-1606, 2019.
[72] Qidong Huang, Xiaoyi Dong, Dongdong Chen, Hang Zhou, Weiming Zhang, and Nenghai Yu. Shape-invariant 3d adversarial point clouds. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages
June 2022.
[73] Yulong Cao, Chaowei Xiao, Dawei Yang, Jing Fang, Ruigang Yang, Mingyan Liu, and Bo Li. Adversarial objects against lidar-based autonomous driving systems. arXiv preprint arXiv: 19X.:v/907.054/: 2019.
[74] James Tu, Mengye Ren, Sivabalan Manivasagam, Ming Liang, Bin Yang, Richard Du, Frank Cheng, and Raquel Urtasun. Physically realizable adversarial examples for lidar object detection. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, pages 13716-13725, 2020.
[75] Mazen Abdelfattah, Kaiwen Yuan, Jane Wang, and Rabab Ward. Towards universal physical attacks on cascaded camera-lidar 3d object detection models. In 202/ IEEE International Conference on Image Processing (ICIP), pages 3592-3596. IEEE, 2021.
[76] Yue Zhao, Yuwei Wu, Caihua Chen, and Andrew Lim. On isometry robustness of deep 3d point cloud models under adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 1201-1210, 2020.
[77] Wen Shen, Qihan Ren, Dongrui Liu, and Quanshi Zhang. Interpreting representation quality of dans for 3d point cloud processing. Advances in Neural Information Processing Systems, 34, 2021.
[78] Hang Zhou, Kejiang Chen, Weiming Zhang, Han Fang, Wenbo Zhou, and Nenghai Yu. DUP- Net: Denoiser and upsampler network for 3d adversarial point clouds defense. In Proceedings of the IEEE/CVF International Conference Computer Vision, pages 1961-1970, 2019.
[79] Xiaoyi Dong, Dongdong Chen, Hang Zhou, Gang Hua, Weiming Zhang, and Nenghai Yu. Self-robust 3d point recognition via gether-vector guidance. In IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2020.
[80] Daniel Liu, Ronald Yu, and Hao Su. Adversarial shape perturbations on 3d point clouds. In European Conference on Computer Vision, pages 88-104. Springer, 2020.
[81] Chengcheng Ma. Weiliang Meng, Baoyuan Wu, Shibiao Xu, and Xiaopeng Zhang. Efficient joint gradient based attack against sor defense for 3d point cloud classification. In Proceedings of the 28th ACM International Conference on Multimedia, pages 1819-1827, 2020.
[82] Jiachen Sun, Karl Koenig, Yulong Cao, Qi Alfred Chen, and Zhuoqing Morley Mao. On adversarial robustness of 3d point cloud classification under adaptive attacks. In 32nd British Muchine Vision Conference, 2021.
[83] Hongbin Liu, Jinyuan Jia, and Neil Zhenqiang Gong. PointGuard: Provably robust 3d point cloud classification. In Proceedingy of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pages 61 8695, 2021.
[84] Dishanika Dewani Denipitiyage, Thalaiyasingam Ajanthan, Parameswaran Kamalaruban, and Adrian Weller. Provable defense against clustering attacks on 3d point clouds. In The AAAI-22 Workshop on Adversarial Machine Learning and Beyond, 2021.
[85] Wenda Chu, Linyi Li, and Bo Li. TPC: Transformatioo-speecfic smoothing for point cloud models. In International Conference on Machine Learning, 2022.
[86] Tobias Lorenz, Anian Ruoss, Mislav Balunović, Gagandeep Singh, and Martin Vechev. Ro- bustness certification for point cloud models. Proceedings of the IEEF/CVF International Conference on Computer Vision, pages 7608-7618, 2021.
15

---

[87] Mislav Balunovic, Maximilian Baader, Gagandeep Singh, Timon Gehr, and Martin Vechev. Certifying geometric robustness of neural networks. Advances in Neural Information Process- ing Systems, 32, 2019.
[88] Anian Ruoss, Maximilian Baader, Mislav Balunović, and Martin Vechev. Efficient certification of spatial robustness. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 35, pages 2504-2513, 2021.
[89] Jeet Mohapatra, Tsui- Wei Weng. Pin-Yo Chen, Sijia Liu, and Luca Daniel. Towards verifying robustness of neural networks against family of semantic perturbations. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition (CVPR), June 2020.
[90] Linyi Li, Maurice Weber, Xiaojun Xu, Luka Rimanic, Bhavya Kailkhura, Tao Xie, Ce Zhang, and Bo Li. TSS: Transformation sppciffc smoothing for robustness certification. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, pages 535 557, 2021.
[91] Marc Fischer, Maximilian Baader, and Martin Vechev. Scalable certified segmentation via randomized smoothing. In International Conference on Machine Learning, 2021.
[92] Motasem Alfarra, Adel Bibi, Naeemullah Khan, Philip HS Torr, and Bernard Ghanem. De- formRS: Certifying input deformations with randomized smoothing. In Proceedings of the AAAI Conference on Artificial Intelligence, number 6, pages 6001-6009, 2022.
[93] Nikita Muravev and Aleksandr Petiushko. Certified robustness via randomized smoothing over multiplicative parameters of input transformations. In Proceedings of the Thirty-First International Joint Conference Artificial Intelligence, IJCAI-22, pages 3366-3372, 2022.
[94] Mare Fischer, Maximilian Baader, and Martin Vechev. Certified defense to image transfor- mations via randomized smoothing. Advances in Neural Information Processing Systems, 33, 2020.
[95] Daniel Zügner and Stephan Günnemann. Certifiable robustness and robust training for graph convolutional networks. In Proceedings of the 25th ACM SIGKDD International Conference Knowledge Discovery & Data Mining, pages 246-256, 2019.
[96] Daniel Zügner and Stephan Günnemann. Certifiable robustness of graph convolutional net- works under structure perturbations. In Proceedings of the 26th ACM SIGKDD international conference on knowledge discovery & data mining, pages 1656-1665, 2020.
[97] Akhilan Boopathy, Tsui-Wei Weng, Pin- Yu Chen, Sijia Liu, and Luca Daniel. CNN-cert: An efficient framework for certifying robustness convolutional neural networks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 33, pages 3240-3247, 2019.
[98] Guang-He He Lee, Yang Yuan, Shiyu Chang, and Tommi Jaakkola. Tight certificates of adversarial robustness for randomly smoothed classifiers. Advances in Neural Information Processing Systems, 32, 2019.
[99] Aleksandar Bojchevski, Johannes Klicpera, and Stephan Günnemann. Efficient robustness certificates for discrete data: Sparsity-aware randomized smoothing for graphs, images and more. In International Conference on Machine Learning, 2020.
[100] Alexander Levine and Soheil Feizi. Improved, deterministic smoothing for I_ certified robustness. In International Conference on Machine Learning, 2021.
[101] Jinyuan Jia, Xiaoyu Cao, Binghui Wang, and Neil Zhenqiang Gong. Certified robustness for top-k predictions against adversarial perturbations via randomized smoothing. urXiv preprint arXiv:19/2.09899 2019.
[102] Ping-yeh Chiang, Michael Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. Detection as regression: Certified object detection with median smoothing. Advances in Neural Information Processing Systems, 33, 2020.
16

---

[103] Aounon Kumar and Tom Goldstein. Center smoothing: Certified robustness for networks with structured outputs. Advances Neural Information Processing Systems, 34, 2021.
[104] Linyi Li, Maurice Weber, Xiaojun Xu, Luka Rimanic, Tao Xie, Ce Zhang, and Bo Li. Provable robust learning based transformation-specife smoothing. arXiv preprint ar 123998
4, 2020.
[105] Binghui Wang, Xiaoyu Cao, Neil Zhenqiang Gong, et al. On certifying robustness against backdoor attacks via randomized smoothing. arXiv preprint arXiv:2002.17500, 2020.
[106] Elan Rosenfeld, Ezra Winston, Pradeep Ravikumar, and Zico Kolter. Certified robustness to label-flipping attacks via randomized smoothing. In International Conference Machine Learning, 2020.
[107] Jerzy Neyman and Egon Sharpe Pearson. On the problem of the most efficient tests of statistical hypotheses. Philosophical Transactions of the Royal Society London. Series A, Containing Papers of a Mathematical or Physical Character, 23 2316699470)) 1933.
[108] Alfred Haar. Der Massbegriff in der Theorie der kontinuierlichen Gruppen. Annals of mathematics, pages 147-169, 1933.
[109] Henri Cartan. Sur le mesure de Haar. Comptes Rendus de l'Académie des Sciences de Paris, 211:759-762, 1940.
[110] Erik M Alfsen. A simplified constructive proof of the existence and uniqueness of Haar measure. Mathematica Scandinavica, 12(1))106-11 1963.
[111] Peter H Schönemann. A generalized solution of the orthogonal procrustes problem. Psychome- trika, 3101) 1966.
[112] Wolfgang Kabsch. A solution for the best rotation to relate two sets of vectors. Acta Crystallo- graphica Section A: Crystal Physics, Diffraction, Theoretical and General Crystallography, 32(5):922-99) 923,, 1976.
[113] Joan Bruna and Stéphane Mallat. Invariant scattering convolution networks. IEEE transactions on pattern analysis and machine intelligence, 35(8):1872-1888) 1886, 2013.
[114] Ryan L Murphy, Balasubramaniam Srinivasan, Vinayak Rao, and Bruno Ribeiro. Janossy pooling: Learning deep permutation-invariint functions for variable-size inputs. arXiv preprint arXiv:1811.01100 2018
[115] Ryan Murphy, Balasubramaniam Srinivasan, Vinayak Rao, and Bruno Ribeiro. Relational pooling for graph representations. In International Conference on Machine Learning, 2019.
[116] Omri Puny, Matan Atzmon, Edward J. Smith, Ishan Misra, Aditya Grover, Heli Ben-Hamu, and Yaron Lipman. Frame averaging for invariant and equivariant network design. In International Conference on Learning Representations, 2022.
[117] Dmitry Yarotsky. Universal approximations of invariant maps by neural networks. Constructive Approximation, 55(1):407-474, 2022.
[118] Sorin Grigorescu, Bogdan Trasnea, Tiberiu Cocias, and Gigel Macesanu. A survey of deep learning techniques for autonomous driving. Journal of Field Robotics, 37(3):362-333 1-.362238,,11 2020.
[119] Khan Muhammad, Amin Ullah. Jaime Lloret, Javier Del Ser, and Victor Hugo C de Albu- querque. Deep learning for safe autonomous driving: Current challenges and future directions. IEEE Transactions Intelligent Transportation Systems, 22(7):4316-4336 2020.
[120] Riccardo Miotto, Fei Wang, Shuang Wang, Xiaoqian Jiang, and Joel T Dudley, Deep learning for healthcare: review, opportunities and challenges. Briefings in bioinformatics, 19(6): 1236-1246. 2018.
[121] Beau Norgeot, Benjamin S Glicksherg, and Atul Butte. call for deep-learning healthcare. Nature medicine, 25(1):14-15, 2019.
17

---

[122] Sam Corbett-Davies and Sharad Goel. The measure and mismeasure of faimess: A critical review of fair machine learning. arXiv preprint arXiv: 00003, 2018.
[123] Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. A survey on bias and fairness in machine learning. ACM Computing Surveys (CSUR), 54(6): 1-35, 2021.
[124] Cynthia Dwork. Differential privacy: A survey of results. In International conference theory and applications of models of computation, pages 1-19. Springer, 2008.
[125] Zhanglong Ji, Zachary C Lipton, and Charles Elkan. Differential privacy and machine learning: a survey and review. arXiv preprint arXiv:1412.7560 2014.
[126] Zhirong Wu, Shuran Song, Aditya Khosla, Fisher Yu, Linguang Zhang, Xiaoou Tang, and Jianxiong Xiao. 3D ShapeNets: A deep representation for volumetric shapes. Proceedings of the IEEE conference computer vision and pattern recognition, pages 1912-1920, 2015.
[127] Yann LeCun, Léon Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- learning applied to document recognition. Proceedings of the IEEE, 86(1 11:1272222223333 1998.
[128] Yue Wang, Yongbin Sun, Ziwei Liu, Sanjay E Sarma, Michael M Bronstein, and Justin M Solomon. Dynamic graph CNN for learning on point clouds. Acm Transactions On Graphics (log). --- 2019.
[129] Zelin Xiao, Hongxin Lin, Renjie Li, Lishuai Geng, Hongyang Chao, and Shengyong Ding. Endowing deep 3d models with rotation invariance based on principal component analysis. In 2020 IEEE International Conference on Multimedia and Expo (ICME), pages 1-6. IEEE, 2020.
[130] Feiran Li, Kent Fujiwara, Fumio Okura, and Yasuyuki Matsushita. closer look at rotation- invariant deep point cloud analysis. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16218-16227, 2021.
[131] Sture Holm, A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics, 6(2):65-70, 1979. ISSN 03036898, 14679469.
[132] Nico Schlömer. quadpy. URL httph: com/ sigma- papaa-py/quue quadyyyyyyppu
[133] Xu Yan. Pointnet/pointneet++ pytorch, 2019. Pointuuet_Poinnnet2_ppp
URL https//githu..co/yyaagg
[134] Harold W Kuhn. The hungarian method for the assignment problem. Naval research logistics quarterly, 2(1-2):83997 1955.
[135] Xiaoshui Huang. Guofeng Mei, Jian Zhang, and Rana Abbas. A comprehensive survey point cloud registration. arXiv preprint N.XIv:2003.0699, 2021.
[136] William Jake Johnson. Comparing variations of the leyman-pearson lemma. Master's thesis, Montana State University, 2016.
[137] Mark Aronovich Naimark. Linear representations of the Lorentz group. Elsevier, 1964.
[138] Francisco Eiras, Motasem Alfarra, Philip Tomr, M. Pawan Kumar, Puneet K. Dokania, Bernard Ghanem, and Adel Bibi. ANCER: Anisotropic certification via sample-wise volume maxi- mization. Transactions of Machine Learning Research, 2022.
[139] Emily A Cooper and Hany Farid, A toolbox for the radial and angular marginalization of bivariate normal distributions. arXiv preprint Skt1:20005006996 2020.
[140] DLMF, NIST Digital Library of Mathematical Functions. http://dmmfnnis..ovvv Release 1.1.5 of 2022-03-15. URL URL.ttpp: Lozier, Schneider, R. F. Boisvert, C. W. Clark, B. Miller, B. Saunders, H. Cohl, and M. A. McClain, eds.
nist. gov/ F. W. J. Olver, A. B. Olde Daalhuis, D. W.
18

---

[141] Charles J Clopper and Egon S Pearson. The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika, 26(4):4044113, 1934.
[142] Gerald Hahn and William Q. Meeker. Statistical Intervals. Wiley, August 1991.
[143]
George Dantzig and Abraham Wald. On the fundamental lemma of neyman and pearson. The Annals of Mathematical Statistics, 22(1):87-93, 1951.
[144] Kenneth Hung and William Fithian. Rank verification for exponential families. The Annals of Statistics, 47(2):758-7722 2019.
19


Reviews:
[{"review_id": "qHa_YIu4KC6", "reviewer": "Reviewer_XHgH", "summary": "The paper develops a number of robustness certificates for models applied on spatial data (e.g. point-clouds). It builds upon prior work on using randomized smoothing to derive provable robustness certificates for models in a black box manner, and extends the scope of certificates by leveraging information about model invariances to create what the authors call \"gray-box certificates\". For example, if a model is known to be translation invariant, then any input that can be moved to a region covered by a certified to receive a specific output, will also receive the same output under the model.\nUsing this approach, the paper introduces certificates leveraging invariances to Euclidean isometries (translations, rotations, reflections) and and permutations. It proves that the certificates for translation and certain rotation transformations are tight and conducts empirical experiments to support the findings as well.", "questions": "- In theorem 6, shouldn't g have the property of being rotation instead of translation invariant?\n- I am not an expert in the spatial-data domain, so I am not sure how realistic for instance attacks using point translations or rotations are, it might be worth to discuss the threat-model or other ways in which such transformations might enter the test data in more detail.\n- Could you clarify why the set of invariance transformations need to form a group?", "limitations": "The limitations of the paper seem to be sufficiently addressed.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n- Robustness certificates are usually used to prove that certain invariances hold for a model. Using a-priori knowledge about invariances to increase the scope of provable (derived) robustness is an interesting avenue.\n- The paper conducts a solid theoretical analysis and further supports its conclusions using empirical evidence.\n\n### Weaknesses\n- The applicability of the work might be somewhat limited, because it is difficult to construct models that are provably robust to certain input transformations, and not just weakly invariant due to training. The certificates developed in the paper only hold when strict invariance can be assumed. \n- There are some clarity issues, especially regarding the different types of certificates. There are a number of different certificates (black-box, gray-box, post-processing, pre-processing, tight), and it's difficult to keep track of their meanings relationships. The different types of certificates should be clearly defined (ideally already in the intro, at least roughly) and delineated. For instance, it's not clear to me what the role of the pre-processing certificates is? Are they more than post-processing certificates proven to be tight?\n- A central quantity in the theoretical analysis is the probability $p_{X', y^\\ast}$ (line 92) of predicting the target class under randomized smoothing, which is used to bound classification probabilities. However, in the original randomized smoothing work, this quantity is compared to the probability of the next most likely class, which is absent from the analysis here. As far as I can see the workaround is to assume that $p_{X', y^\\ast} > 0.5$, though this seems like an overly strict assumption in a multi-class scenario. Wouldn't comparing $p_{X', y^\\ast}$ against the next most likely probability allow for deriving tighter bounds? Or is the analysis limited to binary classification? Footnote 2 seems to suggest something like that, but the definition of g only mentions a general label set $\\mathbb{Y}$. Please clarify this.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "kq4C4Xmtm87", "reviewer": "Reviewer_nCYS", "summary": "This paper considers the issue of certifiably-robust machine learning\npredictors in the 'randomized smoothing' framework of Cohen et al. (take a\nclassifier $g$; add isotropic gaussian noise to the input to generate a\ndistribution over predictions $g(x + \\varepsilon)$, and let $f$ denote the\npredictor that selects the most probable output; prove robustness guarantees\nabout $f$ using Neyman-Pearson), but with the additional consideration that the\nbase classifier $g$ is invariant to certain transformations. The authors focus\non the case where the input to $g$ is a batch of physical data $\\mathbf{X} \\in\n\\mathbb{R}^{N \\times D}$ in $\\mathbb{R}^D$ (e.g., point clouds, molecular data, ...), and\nthe group actions are rigid motions acting on the rows of $\\mathbf{X}$ and\npermutations of the rows. To make the randomized smoothing approach\ncomputational, probabilities are estimated in a Monte-Carlo fashion and\nrobustness guarantees are probabilistic; the authors extend the same\ncomputational procedures to the 'invariant $g$' setting by arguing that for the\nspecific invariances they consider, the randomized smoothing procedure also\nyields an invariant classifier $f$, and that the certification procedure on a\nnew test input can be done efficiently (minimization over the group action for\nthis family of invariances can be done simply in closed form, e.g. mean\nsubtraction, orthogonal procrustes). These extensions give exact (the authors\nuse 'tight') certificates for translation invariance, meaning that the\nrobustness guarantee matches the lower bound given by Neyman-Pearson; for more\ngeneral transformations there is some looseness, and the authors provide\ntheoretical studies of the gap in the case of 2D rotations and experiments\nwhich show that the gap is often small (but there is extra Monte Carlo\ncomplexity/error associated with the tight certificate approach here that makes\nsome experimental results contrary to what one would expect).\n\n", "questions": "- I would appreciate some clarifications on the contributions and the\n  relationship to prior work. The contributions claimed at line 40 are quite\n  narrow -- is this also the first work that takes up the systematic study of\n  randomized smoothing combined with invariant classifiers? The section in the\n  related work at line 52 seems to suggest this is the case, but doesn't claim\n  it directly. \n\n- The expressions in Theorem 7 seem a bit too complex to easily parse, even\n  when looking at the full details in the appendix -- one is curious whether\n  some pathological behavior emerges for 'strange' values of $\\mathbf{X}$,\n  $\\mathbf{X}'$, and $\\boldsymbol{\\Delta}$; whether there is a 'typical'\n  setting (random? incoherent?) where it is possible to get more insight into\n  the result's predictions; etc. If the authors can point to any details in the\n  appendices that help interpret these issues + could be integrated into the\n  main body, this could help.\n\n", "limitations": "Yes. The authors provide a concrete Limitations and Broader Impact section\n(Section 7). \n", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "\n## Strengths\n\n- Invariant models for computing with point cloud data are becoming more and\n  more prevalent, and understanding issues of robustness with these models and\n  their connection to certified robustness seems timely. This paper seems to\n  initiate this line of work.\n- The paper is well-written, with ample details on background material,\n  derivations, and technical points. The appendices are extensive and catalogue\n  conceptual/computational aspects of the experiments.\n- It seems to be a useful methodological contribution to show that it is\n  'enough' in some practical cases to use the simple post-processing approach\n  to certification, even if it is not Neyman-Pearson-exact (although see some\n  caveats below).\n\n## Weaknesses\n\n- The contributions here seem somewhat narrow -- it would be better if theory\n  and experiments relevant to the case of 3D rotations were presented, given\n  that this seems to be most important for the applications used as motivation\n  (point cloud nets, molecular prediction, ...). Most of the experiments are\n  used to motivate the idea that the 'post-processing' invariance approach is\n  comparable to the tight certificates approach for 2D rotations; one would\n  like to see that this continues to hold in 3D.\n- It seems strange that the tight certificates approach does not yield superior\n  accuracy in Figure 6. \n- The theorems and derivations throughout the paper are presented in a\n  formalism-heavy way that often belies significant underlying conceptual\n  simplicity. I think the clarity of the paper could be improved as a whole by\n  also mentioning some of these simple conceptual intuitions: for example, \n  eventually the post-processing approach that is argued to be sufficient\n  (Theorem 2) is quite intuitive (it might be nice to have an Algorithm\n  environment somewhere that summarizes exactly what approach the authors are\n  ultimately proposing that one takes away from the paper, to have a useful\n  methodological contribution -- with all the competing approaches it is easy\n  to get a bit lost reading through); the proof of Theorem 3 essentially only\n  depends on rotation invariance of the gaussian distribution; the 'canonical\n  representation' formalism from definition 3 (is this a standard term?) and\n  its instantiations throughout section 6 seem to be understandable in terms of\n  whether or not you can quotient $\\mathbb{R}^{N \\times D}$ in a sufficiently nice\n  sense by the action of the symmetry group; the observation discussed in the\n  paragraph at line 217 can probably be explained using some classical insights\n  from invariant theory. \n- It seems that generalizing this to images will be infeasible in general,\n  given that invariances one is interested in here act on the image plane\n  rather than on the image values, which means that the analogue of Theorem 3\n  will not transfer. (c.f. Section 7) More generally, one imagines it would be\n  challenging to extend this approach to any similar 'homogeneous space'\n  setting of the invariant group action.\n\n## Minor Issues\n\n- Line 45: it seems perhaps premature to call a method from 2019 \"classic\".\n- Line 84: spurious period\n- Line 91: should this line 'First, one can use the fact that ...' state\n  $f(\\mathbf{X}) = y^\\ast$ rather than $\\mathbf{X'}$? The discussion below\n  seems to demand that this is true.\n- Line 92: I would recommend stating the restriction to binary classification\n  outside of a footnote, as it is done systematically throughout the paper. \n  In appendix F, it would make sense to reference the general version of the\n  Neyman-Pearson calculation proved in [27] for general values of the\n  probabilities -- I imagine the current omission won't bother a reader who is\n  familiar with randomized smoothing, but I found it necessary to do the\n  calculation myself and then reference what was shown in [27] to convince\n  myself that something wasn't being omitted here.\n- Equation (5): why is there a slash through the bottom line on the $\\geq$\n  symbol? I do not understand this result.\n", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ""}, "extra_text": {}}, {"review_id": "HfMMU-7hd7G", "reviewer": "Reviewer_nK8B", "summary": "This paper proposes an approach, leveraging the invariance property of the base classifier to enhance the randomized smoothing certificate. ", "questions": "1. Is Eq. (91) in Lemma 14 (appendix) wrong? It might be a typo. I think the left-hand side is the same as the right-hand side.\n2. Is group averaging (line 222) a common technique for improving classification performance, or just for the invariance property in the field of 2D/3D point cloud classification?\n3. This paper should include more discussions on the connection to [Li et al., 2021], which is also an important work on transformation-specific smoothing\n\n[Li et al., 2021] Tss: Transformation-specific smoothing for robustness certification, CCS 2021.", "limitations": "The contribution of this paper is limited since invariant models are rarely studied for some reasons (might be the poor performance or the limited generalization ability?).", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strength:\n1. The paper is quite complete.\n2. The presentation is good.\n\nWeaknesses:\n1. The contribution of this paper is a bit incremental. Specifically, Theorem1,2,5 are obvious to me.\n2. The significance of invariance-aware randomized smoothing is limited. The neural network classifiers that satisfy invariance are extremely rare, so the author needs to construct invariant versions of PointNet and DGCNN via some tricks. ", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {"ethics_review_area": ["I don’t know"]}, "extra_text": {}}]

Author rebuttal:

Decision: Accept