Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models
Authors: Aref Miri Rekavandi
Farhad Farokhi
Olga Ohrimenko
Benjamin I. P. Rubinstein
Venue: NeurIPS 2024 poster (2024)
Keywords: Certified robustness
alpha-trimming
Probabilistic certificates
Robust regression
Randomized smoothing
Primary area: safety_in_machine_learning
TL;DR: This paper is among the first works which address the problem of certification against adversarial perturbation for regression models with unbounded outputs

Abstract: Certified adversarial robustness of large-scale deep networks has progressed substantially after the introduction of randomized smoothing. Deep net classifiers are now provably robust in their predictions against a large class of threat models, including $\ell_1$, $\ell_2$, and $\ell_\infty$ norm-bounded attacks. Certified robustness analysis by randomized smoothing has not been performed for deep regression networks where the output variable is continuous and unbounded. In this paper, we extend the existing results for randomized smoothing into regression models using powerful tools from robust statistics, in particular, $\alpha$-trimming filter as the smoothing function. Adjusting the hyperparameter $\alpha$ achieves a smooth trade-off between desired certified robustness and utility. For the first time, we propose a benchmark for certified robust regression in visual positioning systems using the Cambridge Landmarks dataset where robustness analysis is essential for autonomous navigation of AI agents and self-driving cars. Code is publicly available at \url{https://github.com/arekavandi/Certified_adv_RRegression/}.

Certified Adversarial Robustness via Randomized a-Smoothing for Regression Models
Aref Miri Rekavandi
Farhad Farokhi University of Melbourne edu. au
University of Melbourne
aref mirirekavandi @unimelb. edu. au
farhad.
Olga Ohrimenko
Benjamin I.P. Rubinstein
University of Melbourne
University of Melbourne
oohrimenko@unimmllb edu. au
iannjamii..ubbiitttiieeuunnmeee edu.
Abstract
Certified adversarial robustness of large-scale deep networks has progressed sub- stantially after the introduction of randomized smoothing. Deep net classifiers are now provably robust in their predictions against large class of threat models, including 1,, f2, and foe norm-bounded attacks. Certified robustness analysis by randomized smoothing has not been performed for deep regression networks where the output variable is continuous and unbounded. In this paper, we ex- tend the existing results for randomized smoothing into regression models us- ing powerful tools from robust statistics, in particular, a-trimming filter the smoothing function. Adjusting the hyperparameter a achieves a smooth trade-off between desired certified robustness and utility. For the first time, propose a benchmark for certified robust regression visual positioning systems using the Cambridge Landmarks dataset where robustness analysis is essential for au- tonomous navigation of Al agents and self-driving cars. Code is publicly available at htttss://gitiiiii /ttpb/ com/ CreeaavandiCeetiifee sedeeiiieed_ddddiieeeeessssooo
Introduction
Adversarial examples first swayed the narrative on deep models over a decade ago 12] 26 Where deep nets had demonstrated remarkable generalization on classically challenging tasks [T0, these small perturbations to input sample that make apparent change the input's 's semantics or true class, yield high rates of misclassifications. While defenses had so far not tipped the balance away from the attacker, the combination of Certified Robustness (CR) with adversarial training has excited the security and MI. communities recently [5]. For a given model and input sample, CR can guarantee the absence of any adversarial examples in close vicinity of the sample. Randomized Smoothing (RS) is a widely used technique for CR as it scales to arbitrary large-scale models as it requires only black-box access model evaluations [12 [6]. Despite attacks targeting ML tasks beyond classification [5] little is known of certification (or RS) for other standard ML tasks such as regression. Robustness analysis for regression has been examined through Lipschitz continuity [27) which is only feasible for small-scale regression models with full access to the models' parameters and certain types of activation functions.
In this paper, we present a framework for black-box certification of arbitrary regression models with either bounded unbounded outputs. Our results extend the findings of [17] which considers the class of bounded-output regression models with large sample sizes in the evaluation stage. While they introduce averaging aggregation operator in randomized smoothing for regression, without limits on output range, averaged predictions may not be stable. This boundedness assumption, however,
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

limits the applicability of their certificates. We present superior approach through smoothing by a-trimming filter. Complementing experiments with synthetic data, we benchmark our CR and RS approaches with the Cambridge Landmarks [9 dataset and DSAC' framework R for camera re-localization. The use of these benchmarks may be of independent interest for CR research.
2
Preliminaries
A base regression model parameterized with 0 is denoted by Ig RR + IR', where d and t are the input and output dimensions: (x) maps input x to multivariate output We will use g. (x) to denote the smoothed version of (x), as defined later. The neighborhood centered around point given dissimilarity function is denoted by N(z, c), where the dissimilarity function can be e.g., lp norms as well as functional divergences such as KL or Bregman when dealing with normalized z. In other words, for any E R,,
E I with radius with respect
c(z,c) {z' R' diss (z. z') c)
(1)
where diss(-,-) in general, can be any metric or function that the user is interested, and diss, (or dissy) indicates dissimilarity in the input (or output) space. Throughout this paper, neighborhoods in input space are defined for all dimensions simultaneously in Eq. ① neighborhoods for outputs are analyzed separately using the neighboring function Ny fy) II:-1 Ny, Ey.) The ny-norm (p 2 1) of a vector denoted and defined as ||x||p = EE, x; x2)11/> where x, indicates the 7th entry of x. We denote the multivariate normal distribution with mean m and covariance a² N o²I), where I is the identity matrix. We denote the standard Gaussian CDF by ((-). PP. and E{-) denote the probability and expected value operators, respectively. Finally, [t] indicates the set {1, 2. .t] and [-] rounds to the closest integer value.
Threat model. We consider defender with only black-box access to model evaluations at test time: given an input point they may observe the output regressed value, but not model structure, gradients, parameters, learning hyperparameters. On the other hand, consider adversaries that have full information access to the model and certification algorithm. However, the attacker is limited to perturbing input data within small neighborhoods. This matches the typical threat model found in previous works on randomized smoothing in classification [6]
Randomized smoothing. Randomized smoothing is based the ensemble of model outputs obtained over different perturbed inputs and is among the few techniques that are scalable to arbitrary, large models. Randomized smoothing was first adopted in seminal works of 66 14 12 for classification tasks to derive the maximum radii of input perturbations which maintain an invariant output prediction. In particular, in [6] it was shown that for the base classifier (x), the new smoothed classifier g(x) = arg m P(fo(x + e) = c), e ~ NO0 I2)), J, is certifiably robust against any f--norm- bounded adversary with radius = 5
(PA) ④ 16-1-PE (PE)) where PA 2 Pg are any lower bound of majority class scores, and any upper bound of rumner-up class scores, respectively. While randomized smoothing has mostly been explored for classification problems with categorical outputs [8] 30 [I
31 28 13] more recently research has begun to consider regression [17 20 [6] These works all exhibit some limitation, including: universality, theoretical support, practical applicability, reliance on large sample sizes of data points, bounded outputs, analysis through the lens of certifying classification. Further explanation on the differences among these studies can be found in Section 5
3 Method
3.1 Certified Regression
For many years, robustness analysis of regression models or estimators has been investigated using tools, such as Lipschitz continuity 27 or influence functions 23 where full access to the model parameters and its derivatives were required. Due to a lack of a proper definition of robustness in black-box access setup for large models, in contrast to classification problems, certified robustness has not been fully developed for regression problems. Until recently, motivated by probabilistic certified classification [18], the robustness definition for regression models has been introduced in [17), and some input perturbation bounds for base regression models, as well as their smoothed version with bounded outputs assumption using sample averaging, have been derived. In this paper, we extend

---

these results for unbounded outputs in small sample regime using much more general form of smoothing function. We use the same definition of robustness in regression tasks given by: Definition 1. ( (Probabilistic Robustness Certificate) KIZY. Given an example (x.y), a (possibly) randomized regression function g(x) R + R said to be certifiably robust with probability 0 < P < 1 in the randomness of g. with respect to the given input and output dissimilarity functions
with radii Ex. cy1."" Cyp vx'x E (x)
min PP (ddissy(g(x")) v.. S g =E((]
This definition of robustness in black-box functions requires first analyzing the robustness of the base regressor and then establishing theoretical results for smoothing functions applied to this base regression as a wrapper. Based on Definition 1, users can define a region for ith continuous output variable by N (y, Ey.) in other words (= disss(2. yz) S Cy; the accepted/valid region where the output prediction can fit in without being considered as a wrong prediction. The term accepted/valid region will be used in the rest of the paper refer to the output neighborhood. This region is set by the user around fxx to determine how much deviation is acceptable. For example, in camera- ce-localzzation in a 3D scene with size 100m x 100m, the user might reasonably accept up to 0.5m deviations in the predictions. The following result has been provided for the base regression function:
Theorem 1. (Certification of General Models Against lz- -oBunedd Attack) [I7]. Letfo(x): Rd + R be a (possibly) randomized base regressor and e ~ (N0 o² Suppose for some example yx. P(diss,(fol e): S c 2 PA Vi E [t]
where PA, is the lower bound on the probability of accepting prediction in the 8th output variable.
Then referring to definition Eq. fox +e is probabilistic certifiably robust at example (x, for a 2z-norm dissimilarity in the inpul, chosen probability P miinn [1] PA, output radii Eyrr. Ey and input radius
= min ( (pA,) - Φ (P)). .
(4)
The above result indicates a strong similarity between the certification of regression models and classification task since both radii are proportional to and 4 - (p4). It is worth investigating the cquivalence of these two tasks in terms of robustness radius formulation, i.c., Eq. 4h:
Corollary 1. (On the Equivalence of Regression and Classification) The certificate radius for univariate regression model, i.e. (x) Rdd > R using the robustness definition (2) with user- chosen P 50%, is the same as the certified radius for a smoothed classifier made offa(x) Rdd - TR. as the base binary classifier and dividing the space into class A and class not A, where A denotes the case where the output within the defined output neighborhood.
Proof. Starting from 4 as the regression certificate bound and setting P = 50%, the regression certificate radius becomes
Ear = の - (pa),
(5)
which is exactly the radius derived for a binary classifier using the same smoothed function with the majority voting stated in 6
This is an intuitive result stating that robustness in regression tasks can be reduced to the classification task when P is set to 50%, where the output of regression model is in the maximum uncertainty level. In this case, there is a tie between class A and not A and this is exactly where the output of a classification model might change and break the robustness definition of the given classifier. Now we extend the results in Theorem to the lp attack with proof in Appendix A
Propusition 1. (Certification of (x) Against lp Attack). Let fo(x) randomized base regressor and ~ N(0,021) Suppose
Rdd + IR be a (possibly)
Pldiss, (f (x e)..).) S & 2 PA, Vi E [[]
(6)
where PA, is the lower bound on the probability of accepting prediction in ith output variable. Then using (2) as the definition of certified robustness, fy (x + 5 + e), 0||00||p S cz (p 2 2) is within the accepted region, with the user deeieddf probability I PA Vi E [tt where
Ex min s
(PA.) - 2 (P)).
(7)
-
3

---

(x(()
Ny,,,yy))
Ny(,Ey
Nx (x, Ex)
Y1sk
y1:k
(x
Ym
Ymst
Ny(,)y))
Figure 1: General schematic of how a-trimming be applied to the base regressor with form ball (can be any l norm in this paper and can be any neighboring function in general) defined for input vicinity and any form of convex (in this paper) or nonconvex (in general) set for the output vicinity. Furthermore, outputs can be examined separately (in this paper) or jointly with other outputs (in the general
denoted by Nick and y mm::).
It is worth pointing out that the upper bound of input perturbation in 7 is obtained by Gaussian smoothing, meaning that we only evaluate the model once with Gaussian smoothing, but the guarantee valid for any Ep attack (p 2).
3.2 Smoothing in Regression
Definition of the smoothing function in the classification task, i.c., g(x) arg max,cy [x + +) c). e A0, I² not feasible for application regression and requires adjustments. One immediate change can be the use of an average function to compute g (xx). i.c., g(x) (x + e) its Monte Carlo estimation. However, as shown point (in unbounded scenarios) can entirely shift the result of averaging into the invalid zone (from the user's perspective). This behavior is known as the zero breakdown point of averaging in robust statistics 132 To deal with such worst-case scenario, in [17 the outputs of regression models were assumed to bounded. Although this assumption helped to derive certificate bounds around the input, it was shown for some cases where these considered bounds in the output are loose, the certificate bound in the input becomes worse than the base regression model. This motivates use of a better smoothing function that can also tolerate unbounded outputs. Therefore, we use the a-trimming filter [T] to estimate the continuous output variable. Suppose that E a finite set of N numbers (sorted in ascending order). The a-trimmed mean of F is obtained by removing fraction of the samples (0 S a < 0.5) from the high and low ends of the sorted set, and computing the average of the remaining values. In the extreme cases, when - 1. a-trimming is equivalent median filtering [16]. and when a = it reduces to classical averaging [17]. other words, we use the following general form of smoothing function denoted by g. (x):
e~N00, I²
even a single adversarial
[an]
8a (x); 2(an)
F e),, Vi [{] where ~00,
k=[on|+1
level of smoothing. One the where n is the sampling size, Fx e); the sorted form of of (x order statistics. In the above, we draw n realization from to construct the set values. Here a is hyperparameter and be tuned based on the user-chosen value primary uses of the a-trimming filter is in data preprocessing and outlier rejection. The adjustment of this context typically relies on prior knowledge about the proportion of data points that deviate from the nominal distribution [22]. While this prior knowledge may not always be accurate, it has been widely utilized to reduce the sensitivity estimators. Another method tuning a in parameter estimation is to consider efficiency at the nominal density. For instance, if no outliers are present in the dataset, one may set a achieve an estimation that closely matches the performance of its maximum likelihood counterpart [24).
e)., and k is the index of the

---

n=100
1.0
q=0.7
q-0.9
0.8
[an] +
I [an] [an]]
0.6
0.4
0.2
0.0
Figure 2: Improvement in the probability of observing predictions within defined accepted region
using a-trimming for different a values.
3.3 Certified Regression Against Ep Attack
In this section, c-trim smoothing function g., (x) as wrapper around the base regression model using the same definition of the vicinity sets in both input and output as shown in Figure T Consequently, everything within the red dashed box is related to base regression certification. The corresponding output regions outside the red dashed box represent the certification analysis for the smoothed function with the accepted regions remaining consistent with those in the base regression model. Note that for the following results (proof in Appendix BB, the neighborhood in the output can be in any convex region, but the input perturbation only considered be within lp ball around
Theorem 2. (Certification of g., (x) for fixed range lp Attack). Let (x) R - RR' be a (possibly) randomized base regressor, and let ga (x) be the one defined in (8) with 0 S 1/2. Let assume the accepted region (set) for each output target variable convex and the following inequality holds for N0, 2), user-defined Ey and V v11ō1pp 1pp S cx (p 2) and vi [t]
Pf + ),) S Cyss 29.
(9)
where 0 S q S 1, then Vn > 0 we have
Pidiss, (8. (x 8)..8)) S Eng) 2 11(n -n [am] + Vi E [4]
(10)
where (a, b) the regularized incomplete beta function defined as I,(a,b) Bla.b] So f3 and Baa,b b) is the complete beta function.
1--1(1-
l
Theorem states that after applying the a-trimming filter, the probability that the average prediction of the regression network satisfies the user-chosen constraint, the worst case scenario changes from q to (n [om], [om] + 1).
The result in Theorem 2 is general and several intuitive and interesting cases are worth mentioning, (i) in the case where 0, regardless of the number of samples and the value of trimming parameter a, Io [an], [am] + 1) 0. meaning that when all the generated outputs by the base regression model are outside the accepted region, there is no chance that a- a-trimming can generate valid result. (ii) When g + L, In [ann], [an] +
1, meaning that when almost all of the generated outputs are valid, the a-trimming approach with probability 1 returns a valid result regardless of the values of and n. (ii) When a + 0, (n [an], [an] + 1) - q", meaning that if no trimming applied, one single large invalid output can make the result invalid, then to get valid output, all the generated outputs by base regression model should within the defined acceptable zone, where the chance of this event is yt Note that d" for 0 much lower than the result obtained in the case of bounded output for the same smoothing in 17 which indicates the strong impact of the output range on the provided certificate.
5

---

Algorithm 1: Pseudocode for prediction and certification of smoothed regression model Ba, at X.
Input :x, p in Ey norm, 0, P. n, a, B, Ey, (.) Output: :oottiuuooss variably ý
1 Draw n noise samples using e ~ (00 21) and pass the noise-corrupted version of x through
fo(-), and save the output values.
2 -nA, + number of accepted outputs vi E [t]
Estimate PA, for Vi E [t] using Clopper-Pearseee Pearson interval prediction stated in 17 with
confidence
-y; < Apply the a- e--rrmming filter (8) to the sorted output values Vi E [t].
5 yy is valid with probability 1p,, (n [an], [am] + 1) for Vi E [tt]
The certification radius of this prediction is far min4e[1 2t
(pA,) $ (mmaa())))))
For other values of a, it is important to note that enhancing the robustness of the base regression model is not always guaranteed unless certain minimum amount of trimming is performed. In the following proposition, we investigate the certificate improvement of a-trimming (with conservative o) over the base regression model with proof Appendix C
Proposition 2. (Robustness Improvement via a-trimmingg) For any 1, و if there exist an a such that at S a < 1/2, where
at = (q) - 1/2
(11)
and where 11'(4) is the inverse of In - I, x + 1) with respect to x, then the following inequality holds:
(n - [am), [an] + 1) q.
(12)
PropositionnIstarnn statess that for sufficiently large values, the a- a-trimming averaging technique, improves the probability of robustness and for larger values of a, the result gets better and better. As an example, suppose for deep network that 90% of the generated outputs are valid, i.c., q 0.9. Assuming drawing only 50 samples to obtain the certificate, then / 1y. (0.9) = 7.3 and for any a which
meets a 2 0.136, the robustness probability, 15. - [50x]], [50a] + 1) is greater than g = 0.9. For instance, when = 0.15 and a 0.2, the robustness probability is 0.94 and 0.99, respectively, Intuitively, the obtained range of a shows that to get improvement, a should be at least slightly greater than 1 q (0.1 in our example) to be more confident that there will be less chance of observing some samples out of the accepted region defined by the user. Figure[sst shows two different models one with q 0.7 and one with g 0.9. After applying a-trimming the obtained probability of validity in the results are shown in blue and orange colours, respectively. In both settings, at values are demonstrated in vertical dashed lines and it can be observed that the success rate of the prediction (n [an]. [an] + 1)) is always greater than the assumed values for a 2 a+. As described above, the corresponding a* values are slightly greater than 1 q ensure improvement even in worst-case scenarios. Now we must use the above results to propose the bound on l, norm (p 2 2) of the input perturbation for user-given probability of success (P) when a-trimming is in place (proof in Appendix D)
Theorem 3. (Certification ofg. (x) against lp Attack). Let Rdd R' be a deterministic or random base regressor and let 1, S < 1/2, .N(0, 02) and suppose the a-trimming function (x) defined in (8) is used for smoothing. Then given
Pidiss, (x + e)....) S } PA Vi
(13)
where PA, is the lower bound the probability of accepting predictioo in the ith output variable, then g. (x + 5), VI[ōíI S tx (p 2 2) is within accepted region, i.e,, Ny(r, 1 with the user-defined probability P. s.t. 1-1 (P) PA, Vi [t]. where
Ny
min 1 d
( ( - (P)))
(14)
and where 1 (x) is the inverse of the regularized beta function w.r.t Bernoulli success rate parameter.

---

Ex gix) abph-00.35
g14), appha-0.33 alphamo
apham00.4
20
050009
7.081292
40
X2
-1
Figure Adopted regression function (a) with the estimated certified radii (against & and foo attacks) for evaluated points in the center for both base and smoothed outputs (b & c).
The above result is valid for any regression model, either with bounded or unbounded outputs, and for large small Note that the performance of the base model always impacts the overall performance of the smoothed function, irrespective of whether the setting is classification or regression. In classification tasks, this strong relationship is reflected in the gap between PA and 7B- If base classifier performs poorly under input perturbations, this gap will shrink, diminishing the effectiveness of the final certification. In classification, there is only one other parameter (o) that can potentially compensate for this gap. In regression settings, similar relationship applies: better performance in the base regression model results in a better value for q. However, as demonstrated in Theorem []] the final performance is also influenced by a, n and importantly a. Using appropriate value for a can significantly enhance the certification even when the base regression model performs poorly. The step-by-step process of the method in prediction and certification is depicted in Algorithm |
4 Experiments
This section provides some numerical results to validate the proposed theorems as well as to show their effectiveness in some using an Intel(R) Core(TM) 17-9750H CPU running at 2.60GHz (with base clock speed of 2.59GHz) and 16GB of RAM.
problems. All simulations and experiments were conducted
Synthetic Simulations. For the first part of the experiments, we utilized the function f(x)
10 sin(22: 2xx2 - 2) Figure (left) illustrates this function for the interval -1 < I1, 5. As certification is performed for each point individually, we derive the certified radii for this function
all the integer points in the considered intervals utilizing the formulas (4) and (14) with P 0.8. 0.15,
using & norm, n 10, 000 at two different rates of a 0.35 and a = 0.49. Figure (middle & right) illustrates these radii in 2D grid for the base regression model well as its smoothed versions against both &, and foo norm attacks. As it can be observed, as expected, for smoother areas these radii become larger, and increase certified radii as clear in Eq. (14). In addition to that, as expected, the certified radii become smaller as p increases in l, norm attacks. Now examine the derived radii, for each point (25 points in total which are raster ordered) we randomly select an adversarial example within the defined radius (we repeat this process) and then find the empirical probability of obtaining valid outputs using the base model and its smoothed version utilizing a- e-trimming filter (a = 0.35) with the same hyperparameters with only samples fed into the a-trimming filter. Figure depicts the obtained empirical probabilities for both smoothed and base models in comparison to the required probability of valid outputs defined by the user (P =P=00 0.8). As shown, although the base regression model shows large variations in the empirical probabilities, with attacks in smaller neighborhoods, the a-trimming filter uniformly improves the empirical probability across all the evaluated points (almost equal to 1) for both types of attacks, despite adversarial examples being drawn from larger neighborhoods.
results in an increase in estimated
Camera Re-localization Task. this application, we evaluate the robustness of the state-of-the-art image-based camera re-localization technique "DSAC"" [3] against adversarial examples. In the
7

---

0.9
1.99
4.00
030
(8)
(b)
6479
6356
4.00
[c]
Figure 4: Empirical probability of obtaining valid outputs in comparison with desired probability defined by the user (P 0.8) for the base model against ε attack (a), 9a (x) with a = 0.35 against l2 attack (b), and g.. (x) with 0.35 against to attack (c).
camera celoocalz pipeline, RGB images are fed into trained system and the coordinates the location where the camera was placed to take the images are predicted [21] 19]. For certifying such regression models, we use Cambridge Landmarks dataset (9] and particular 3 of the largest scenes in this popular dataset namely Great Court, King's College, and St. Mary Church. For computing certified error for any image, we used the same formulation as
given by
= ||g. (x + 5) p' 12 + 1,>0, K, V|10||2 ST,
with K = 150cm, and a = 0.35. For learning of PA using Clopper-Peane Praper- (3 = 0.5: 75% confidence), we used 100 samples and then we used n = TO per radius to examine E attack. For each scene, the adopted parameters are selected differently cover various experimental setups.
Great Court:
0.8, cy 5m, output E norm, 0.05, and 760 images sized 480 854.
King's 's College: P = 0.8, Ey = 1m, output & norm, o = 0.08, and 343 images sized 480 x 854.
St. Mary Church: P = 0.9, Ey 5m, output & norm, = 0.1, and 530 images sized 480 x 854.
Figure illlstrates the proposed certified radii along the predicted trajectory of the camera in the considered scenes as well as sample images with no/negligible certificates. From the top: Great Court, King's 's College, and St. Mary Church. While brighter dots represent points with higher certificates, we did not clip the radii from below and kept the negative values as they are. Large negative radii are indicators of high expectations of users either in considered valid regions the expected probability of success. While most the points are highlighted with bright colors, some points are dark and considered as sensitive images which can be easily misled with small portion of manipulation. Interestingly, all the points which are not on the trajectory of the camera, have returned negative radii. On the other hand, Figure illustrates the certified median error of the proposed methods for the three scenes in comparison with the results shown in [17] for bounded and discounted outputs for the Great Court scene (discount factor makes the accepted region wider than that of the base regression model, aiming for better analytical results in worst-case scenarios). Note that results in RS- RS-Reg [I7] were obtained with 200% discount the output validity range, and we now provide almost the same results with no discount in the output, and results are valid for small number of samples. As shown these plots, the trimmiig filter consistently decreased the certified median error (orange curve) across all input perturbation ranges (r) compared to the results obtained by the base regression model

---

0.05
-8
0.05
80
60
-0.00
8.05
10
Octiffee Neli
15
2.0
-0.05
-15
-00
0.10
-15
-20
2 20
40
-29088105
-42
Figure 5: Evaluated scenes from the Cambridge Landmarks dataset (from the top row: Great Court, King's College, and St. Mary Church). The middle column depicts the reconstructed 3d sparse point clouds using Structurefrom-MMotion (SIM) where the images are taken in red trajectories (predicted). The right column visualizes the derived certified radii for each image taken on these trajectories. For some images, they have shown robustness to input perturbation (bright points), and for some images, they have shown sensitive results (dark points). Examples of images with no/negligible certificates are provided in the left column. shown, these images suffer from lighting conditions, improper perspective, and obstructed content.
(blue curve). The main reasons for this improvement firstly, due the better approximation of position parameters leveraging outlier removal and averaging using a-trimming filter. Secondly, because of better certificate radii for each image in the scene which decreases penalization in the process certified median error calculation. Leveraging the a-trimming approach for smoothing, we are no longer worried about the output ranges, and no further assumptions such as large sample size or discount factor are required to provide a valid certificate. Sensitivity analysis of the proposed technique in this dataset be found in Appendix
5 Related Work
Among the studies that adopted randomized smoothing for tasks other than classification, we can list smoothed embeddings (00 for few-shot learning models, certification of soft classifiers (25 where the output variables are continuous but bounded between 0 and 1, certification against poisoning

---

180
fx), sigma=
200
gixi. sigmamm.000
sigamooco
g(x), sigma-0.025
Dis. gix), sigma=0,025
certifed median error
140
fix), sigma-0.05
g(x), sigma=0.05
cortilod modia oiner
120
Dis. gix), sigma-0.05
150
101
60
20
50
0.00
0.02
0.04
0.06
0.08
0.10
0.10
250
110-
Fa), sigmem0.1
180
g000, sigmamm0.00
223
g(9), sgmazit11
200
200
125
80
100
75
59
0.00
0.02
0.24
0.08
0.00
0.10
0.32
0.14
3.00
0.02
0.08
0.00
0.00
0.30
0.12
0.14
adlus
radius
Figure 6: Certified median error in DSAC as a function r. These plots are for (top-left) RS-Reg with 200% discount in Great Court scene (figure from (17),, (top-right) proposed method in Great Court scene, (bottom-left) proposed method in King's College scene, and (bottom-right) proposed method in St. Mary Church scene. The parameters
0.35, 10, K 150em, and / 0.5.
attacks 7 which have different threat models learning tasks than this study. The most related works to our study are 17 where in the former study, the object detection was investigated through the scaling output of classifier
the lens of certified regression, however, their analysis is relying models to expand the range of output values which constrains the architecture of considered models, provided for a class of bounded output regression model in
and in the latter the certification the asymptotic case. Compared to these methods, our approach provides a probabilistic certificate for all regression models (including models with wide range of outputs) with limited number of evaluations through drawing noisy samples.
6 Conclusion
In this paper, we proposed the first probabilistic certificate against Ep attack for all regression models with continuous output. We showed that the a-trimming filter is an appropriate smoothing candidate in regression models with the flexibility to trade-off between enror rate and certification radii. In addition to the comprehensive synthetic simulations, we adopted the proposed method the camera re-localization task using the Cambridge Landmarks dataset and benchmarked the result for this new line research. As future work, this technique can be extended to attacks the semantic space of the input, and for sampling techniques other than Gaussian sampling to further tighten the certificate radii.
Broader Impact Adversarial examples demonstrate the vulnerability of many machine learning models to manipulation in contested environments. This paper considers defenses (via randomized smoothing) and robustness quantification (via robustness certificates), which are important approaches improving resistance attacks, and in highlighting the limitations of learned models to practitioners. As such, we believe this work has potential for positive societal benefit.
10

---

Acknowledgement
This work was supported in part by the Department Industry, Science, and Resources, Aus- tralia under AUSMURI CATCH, and the Australian Research Council under Discovery Project DP220102269.
References
[1] Bednar, J., Watt, T:: Alpha-trimmed means and their relationship to median filters. IEEE Transactions on Acoustics, Speech, and Signal Processing 32(1), 145-153 (1984)
[2] Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šindić, N., Laskov, P., Giacinto, G., Roli, F.: Evasion attacks against machine learning at test time. In: European Conference on Machine Learning and Knowledge Discovery in Databases, pp. 387-402 (2013)
[3] Brachmann, E., Rother, C.: Visual camera re-localization from RGB and RGB-D images using DSAC. IEEE Transactions on Pattern Analysis and Machine Intelligence 44(9), 5847-5865 (2022)
[4] Chiang, P.y., Curry, M., Abdelkader, A., Kumar, A., Dickerson, J., Goldstein, T.: Detection as regression: Certified object detection with median smoothing. Advances in Neural Information Processing Systems 33, 1275-1288 (2020)
[5] Cinà, A.E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B.A., Oprea, A., Biggio, B., Pelillo, M., Roli, F: Wild patterns reloaded: survey of machine learning security against training data poisoning. ACM Computing Surveys 55(13s), 1-39 (2023)
[6] Cohen, J., Rosenfeld, E., Kolter, Z.: Certified adversarial robustness via randomized smoothing. In: International Conference Machine Learning, pp. 13 1310-1320. PMLR (2019)
[7] Hammoudeh, Z., Lowd, D.: Reducing certified regression to certified classification for general poisoning attacks. In: 2023 IEEE Conference Secure and Trustworthy Machine Learning (SaTML). pp. 184-523. IEEE (2023)
[8] Huang, Z., Marchant, N.G., Lucas, K., Bauer, L.. Ohrimenko, O., Rubinstein, B.I.: RS-Del: Edit distance robustness certificates for sequence classifiers via randomized deletion. In: Thirty- seventh Conference Neural Information Processing Systems (2023)
[9] Kendall, A., Grimes, M., Cipolla, R.: PoseNet: convolutional network for real-time 6-DOF camera relocalization. In: Proceedings of the IEEE International Conference Computer Vision. pp. 2938-2946 (2015)
[10] Krizhevsky, A., Sutskever, I., Hinton, G.E.: ImageNet classification with deep convolutional neural networks. In: Advances in Neural Information Processing Systems (2012)
[11] Kumar, A., Levine, A., Goldstein, T., Feizi, S.: Curse of dimensionality on randomized
smoothing for certifiable robustness. In: International Conference on Machine Learning, pp.
5458 $458-5467. PMLR (2020)
[12] Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., Jana, S.: Certified robustness to adversarial examples with differential privacy. In: 2019 IEEE Symposium Security and Privacy (SP). pp. 656-672, IEEE (2019)
[13] Lee, G.H., Yuan, Y., Chang, S., Jaakkola, T.: Tight certificates of adversarial robustness for randomly smoothed classifiers. Advances in Neural Information Processing Systems 32 (2019)
[14] Li, B., Chen, C., Wang, W., Carin, L.: Second-order adversarial attack and certifiable robustness (2018)
[15] Li, L., Xie, T., Li, B.: SoK: Certified robustness for deep neural networks. In: 2023 IEFE Symposium Security and Privacy (SP), pp. 1289-13 1310. IEBE (2023)

---

[16] Liu, J., Levine, A.. Lau, C.P., Chellappa, R., Feizi, S.: Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In: Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 14973-14988 (2022)
[17] Miri Rekavandi, A., Ohrimenko, O., Rubinstein, B.I.: RS-Reg: Probabilistic and robust certified regression through randomized smoothing. arXiv preprint arXiv:2405.00:: (2024)
[18] Mohapatra, J., Ko, C.Y., Weng, T.W., Chen, P.Y., Liu, S., Daniel, L.: Higher-order certification for randomized smoothing. Advances in Neural Information Processing Systems 33, 4501-4511 (2020)
[19] Nadeem, U., Bennamoun, M., Togneri, R., Sohel, F., Miri Rekavandi, A., Boussaid, F: Cross do- main 2D-3D descriptor matching for unconstrained 6-DOF pose estimation. Pattern Recognition 142, 109655 (2023)
[20] Pautov, M., Kuznetsova, O., Tursynbek, N., Petiushko, A., Oseledets, I.: Smoothed embeddings for certified few-shot learning. Advances in Neural Information Processing Systems 35, 24367- 24379 (2022)
[21] Rekavandi, A.M., Boussaid, F., Seghouane, A.K., Bennamoun, M.: B-Pose: Bayesian deep network for camera 6-DoF pose estimation from RGB images. IEEE Robotics and Automation Letters (2023)
[22] Rekavandi, A.M., Seghouane, A.K., Abed-Meraim, K.: TRPAST: A tunable and robust pro- jection approximation subspace tracking method. IEEE Transactions on Signal Processing 71, 2407-2419 (2023)
[23] Rekavandi, A.M., Seghouane, A.K., Evans, R.J.: Robust subspace detectors based on a- divergence with application to detection in imaging. IEEE Transactions on Image Processing 30, 5017-5031 (2021)
[24] Rekavandi, A.M., Seghouane, A.K., Evans, R.J.: Learning robust and sparse principal compo- nents with the a-divergence. IEEE Transactions Image Processing (2024)
[25] Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., Yang. G.: Provably robust deep learning via adversarially trained smoothed classifiers. Advances in Neural Information Processing Systems 32 (2019)
[26] Szegedy, C., Zaremba, W., Sutskever, Bruna, J., Erhan, D., Goodfellow, Fergus, R.: Intrigu- ing properties of neural networks. In: International Conference on Learning Representations (2014)
[27] Tanielian, U., Biau, G.: Approximating Lipschitz continuous functions with GroupSort neural networks. In: International Conference on Artificial Intelligence and Statistics. pp. 442-450 450. PMLR (2021)
[28] Teng, J., Lee, G.H., Yuan, Y:: & adversarial robustness certificates: a randomized smoothing approach (2019)
[29] Wheeden, R.L.,, Zygmund, A.: Measure and integral, vol. 26. Dekker New York (1977)
[30] Yang, G., Duan, T., Hu, J.E., Salman, H., Razenshteyn, I., Li, J.: Randomized smoothing of all shapes and sizes. In: International Conference on Machine Learning. pp. 10693-10705. PMLR (2020)
[31] Zhang, D., Ye, M., Gong, C., Zhu, Z., Liu, Q.: Black-box certification with randomized smoothing: A functional optimization based framework. Advances in Neural Information Processing Systems 33, 2316-2326 (2020)
[32] Zoubir, A.M., Koivunen, V., Chakhchoukh. Y.. Muma, M.: Robust estimation signal pro- cessing: A tutorial-style treatment of fundamental concepts. IEBE Signal Processing Magazine 29(4), 61-80 (2012)
12

---

A Proof of Robustness in (x) against ep attack
We repeat the proposition's 's statement here for convenience, followed by its proof.
(Certification of fx(x) Against Ep Attack). Let Let fo(x) R R' be (possibly) randomized buse regressor and e ~ N0, I))). Suppose
Proposition 1:
Pidiss fo (x + e)));) S cxp 2 PA. Vi E [t]
(15)
where PA, is the lower bound on the probability of accepting prediction in 8th oulput variable. Then using (2) the definition of certified robustmess, fg (x + 6 + te), 1l1ō I cz (p 2) is within the accepted region, with the user-de ther-defined probability P S PA. Vi E [tt. where
<x
min E
Φ (pa.) - Φ - (P)).
(16)
d
Proof. For any y E Rd, let us define xay (I: ) i= .d E Rd. Then using the generalization of Hoelder inequality (2)] for any p, p. E [1, 00) such that p + q
we have ||xxy||= |x|pp|yy|l
By setting x = 6 and y 1a. we obtain || S d² - ||0|pp (with 1- 3). Using this inequality, and by setting r 2. the constraint (p 2 2). and the results in Theorem [I we conclude that if
1 lp < min ( (pA,) - - the output value is valid with probability at least P.
This completes the proof.
B Proof of Robustness for g., (x)
We repeat the theorem's statement here for convenience, followed by its proof.
Theorem 2: (Certification of g. (x) for fixed range lp Attack). Let (x) Rd - Rt be (possibly)
:
randomized base regressor, and let ga (x) be the one defined in (8) with S a I 1/2. Let us assume the accepted region (set) for each output target variable is convex and the following inequality holds for ~ (0,00 I)), user-defined Ey and v1lō1lp I cr (p 2 2) and Vi E [t]]
Pfddis, + S cx2} 2 q.
(17)
where 0 S q S 1, then Vn > 0 we have Pddiss, (g.
(x, (g, 8),,,; S Cui) 1g(n (n [an] + 1) E [t]
(18)
where (a b) the regularized incomplete beta function defined as I,(a,b) b) Bla.j So d dt and (aa, b) is the complete beta function.
1
111
Proof. The proof of this theorem is based on the problem's 's geometry and admitting that simple averaging is prone to be shifted outside of the accepted set, only if single large sample exists in the remaining samples after applying a- e-trimming. To prove the result, we consider the worst-case scenario and derive the lower bound probability of getting an accepted output within the desired range defined by users. Let us define a random variable W as the number of rejected outputs by the user (invalid outputs) after drawing n samples and passing then through the network (.). For scalar output variable, three possible scenarios will occur after sorting output values, (i) all rejected outputs will be on the left side of the accepted region, (ii) all rejected outputs will be on the right side of the accepted region, (iii) rejected outputs will be both on the left and right with different portions. Figure 7 illustrates the geometry of these scenarios. Note that since the accepted zone is convex (green region), all the accepted outputs will be next to each other after sorting. As shown in (8). the trimming will be applied equally from both sides, so in the worst-case scenario (scenarios (i) and (ii) both accepted and rejected outputs will be filtered with the same rate. In this case, in total 2 2/om] outputs will be filtered out ([mm) accepted outputs and [aen] rejected outputs) where the total number of leftover samples will be [[om]. Now let us consider two cases:
The case W > [on]] this case after applying a-trimming, still W [arn]] rejected samples will remain in the bag (set of leftover data points after applying a-trimming filter) to be averaged, and
13

---

General Scenario
Fg
Fb
Fi+1 pi+2
pit +3 11
g
(x)
y
- trimming ([an) samples)
a trimming ([an) samples)
Worst Case Scenario
F9
FO
1i+1
88
ri+2
++ 8
F
fx(x)
a trimming ([em) samples)
a trimming ([an) samples)
Figure 7: Potential scattering plots for sorted outputs of a given regression model when fed with perturbed inputs. The general scenario which is most likely the case (top), and the worst-case scenario (bottom).
since in the worst-case scenario one single sample is enough push the average value outside the accepted region, for this case we consider
[ddiss,, (g. (x + 8,) S Ey: W > [an]] = 0.
(19)
The case W < [an]: this case, there will be no rejected samples left in the bag to push the average outside the acceptable zone. Since all the output values are already within the convex set, the average value also within the set and the average will always be valid to the user. Therefore, in this case,
P Pfdiss, (g. (x + 8),, S E W S [an]} =.
(20)
The only variable that can put us either of these disjoint scenarios the random variable W (n and a are predefined values), which follows a Binomial distribution and in worst case scenario the success rate q as assumed Theorems's 's statement, i.e., W Bin(n, 1 q). Hence, Vi e [t] we have
Pldiss, (g, (x + v1) S }
P Pldiss, (g. (x yz) S Ey: W k)P(W k3
11
P(diss, g, (x+ Cyi W = kt}
(1 ga
k.
k ASJon]
(x, S Ezg
W = k}
(m)
11
(1 x n
k=0
Pldiss, (g, (x 5),, S cv:
W = =k]
12
(1 9) gm" n-k
k
A> [cn]]]]]
[an]
x)*² -
(n [an], [an] +
(21)
where (a, b) the regularized incomplete beta function defined as b)(a,b) = Bla f r--1(1
1
1)0-1d' to compute the cumulative distribution of binomial distribution where B(a, b) is the complete beta function.
14

---

C Robustness Improvement via a-trimming
We repeat the proposition's statement here for convenience, followed by its proof.
Proposition 2: (Robustness Improvement via a-trimming). For any n 1, 1,59 S if there exist an such that ot S a < 1/2, where
a + = T (q) 1/2
(22)
and where 1/'(0) (q) is the inverse of In I, x + 1) with respect x, then the following inequality holds:
1 - [am]. [an] + +1)
(23)
Proof. Note that (n x. 1 +1 where x Zt, is the CDF W ~ Bin(n, 1 - q), and is a monotonically increasing function with respect To guarantee that the outcome CDF is greater than q. we first need to find the corresponding which achieves equality, and then find the region where the inequality is always correct. To find the smallest x, solve
(n(n I, 1) q r x= (g) (g)
(24)
Knowing that in our formulation r corresponds to [am]] then to meet the Equality (24), a is required to meet
(4) 1/2 on < (1) + 1/2
17 (g) + 1/2 17 1/2 < a
(25)
n
For fixed and q, this means the inequality I [an], [am] + 1) 2 q holds if select such that it satisfies (1) and this completes the proof.
n
D Certification of ga
We repeat the theorem's statement here for convenience, followed by its proof.
Theorem 3: (Certification of ga. (x) against lp Attack). Letfo(x) R + RK' be a deterministic or random base regressor and let 2 1, S < 1/2, NO, o²1) and suppose the a-trimming function & (x) defined { is used for smoothing. Then given
Pidiss (xx( e):.))) S c 2 PA e
(26)
where PA, is the lower bound the probability of accepting prediction the 8th output variable, then g., (x + 5). v|[ōí| eu (p 2 2) is within accepted region, i.e., N,(r, II: Ny C.
with the user-defined probability P. s.t. 1-1 (P) PA, Vi [t] where
④ (pA) - Φ ((ml
(27)
and where I (x) the inverse of the regularized beta function w.r.t Bernoulli success rate parameter.
Proof. We consider the following chain to derive this upper bound on the lp norm of
[x()) PP P(Valdd (x)) R.. pP [PValid g., (x)) 1 [an],, [an] + 1). (28)
111111 < Ex
Based on the Proposition if we select |+||p < min
--3 (Φ (PA,) 4b (q)). then fg (x)
is valid with probability g, and then based results in Theorem 2 g. (x) changes this probability
15

---

200
180
180
Ditiitie wunifeeerrtann Partana arree
10 1002 68T0
140
140
120
100
100
60
20
0.025
0.06
0.075
C.1
0.125
0.55
100
DM50
LM1200
Figure 8: Sensitivity certified median (left) and mean (right) error with changes in Tirr-
200
medannno
3.0
1.40
150
1000
0.025
0,055
0.125
0.005
3.555
0.55
Figure 9: Sensitivity of certified median (left) and mean (right) error with changes in n.
into (n [am], [am] 1) for fixed a and n, Therefore, if one asks the ga (x) to be valid with probability P. we first solve
(n [am], [am] 1) P:
(29)
for 0 5 9 1. Note that (n [am], [an] 1) x Jo [n-[on]- t) ()/m)] I dt and the right hand side is monotonically increasing function w.r.t when and a are fixed. Therefore, we can define the inverse m. (I)) = q such that (n(n - [am], [an] + 1) = r. Then, knowing this inverse, we can directly use Proposition find the bound || and this completes the proof.
E Sensitivity Analysis
In this section, perform sensitivity analysis of the proposed robust certification technique for the hyperparameters involved in our mechanism. The parameters under evaluation are number of samples to estimate PA (ner), number of samples for a-trimming filter (n), rate of filtering (a), and confidence level parameter (3). We use the Great Court scene with 50 randomly selected images for examination with the size of 480 854. The default parameters are 150cm, a 0.35, 0.5, = 100, 10, P 0.8, éy 5mn using & norm in output, 0.05, with robustness against l2 attack. For each parameter, we only change the parameter of interest and keep the other fixed.
Ny:: This is the parameter that determines the quality of the estimated PA,- In the reported empirical results, this parameter was set to 100. Here we examine the performance for values in the set (50, 100, 200} and report the certified median/mean error curve. Generally, we expect by increasing Aer no changes occur in the tails of the certified mean/median since this only determines how reliable the observed number of valid outputs is. ner is small, keep the confidence level fixed, the estimated lower bound of PA will be sacrificed, and that means the estimated radii will be small. While this does not affect curves' tails, the middle-range errors will significantly increased due to the penalty term imposed by the range of radii. Figure 8 validates this interpretation and depicts this effect for the middle parts of the eurves.
16

---

200
200
192
105
100
0.0/3
0.35
0.075
015
- 1g00000..55
Figure 10: Sensitivity certified median (left) and mean (right) error with changes in a.
200
200
300
200
80
80
40
0
022
8.00
0.000
0.1
0.120
C.00
0.023
9:50
0.01g
0.1
0,129
6.10
brb
brbb
brbb
Figure 11: Sensitivity of certified median (left) and mean (right) error with changes in 3,
n: This parameter indicates the number of samples which going to drawn in the output of the base regression model to be fed into the a-trimming filter. In the experimental results, this was set to n 10. Here we investigate the impact of this parameter in the obtained certified median/mean error rate by choosing the values among the set {10, 20, 30). As shown in Figure the obtained results are quite stable with changes in n for the considered range.
a: Parameter a in a-trimming filter determines the rate of sample rejection on both sides of the sorted values. While in the experiments, this value was set to a 0.35. in this analysis we investigate the role of this parameter the final error rate results by choosing the values from the (0.15, 0.25, 0.45). As illustrated in Figure 10 in terms of median error, for smaller when is also small, we obtained a slightly better error rate because of having more samples in the average computation of the filtered values. On the other hand, increasing leads to better certification radii and the jump to higher error rates occurred a larger range of r values. In terms of mean error rate, increasing the value of uniformly improved the performance because all the outliers came out of the bag of averaging.
B: This parameter indicates the amount of confidence required about the obtained results as com- pensation for the limited number of samples used in estimating PA,, In the experiments, this value was set to 3 0.5 provide confidence of 1 -/ 0.75. Now choose this value from the set (0.1, 0.3, 3.5) to examine robustness of the results. We expect as we decrease 3, as the result of increasing the required confidence level, the estimated lower bound of PA., Vi E [t]] decreases and the certified radii decrease as a result. These smaller certified radii cause more rapid growth in the certified error rate depicted in Figure II
17

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
The paper's main claim is new randomized smoothing for regression models with unbounded outputs and in Sections 3 and 4, such extensions are mathematically supported and evaluated.
Justification:
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations the work performed by the authors?
Answer: [Yes]
Justification: The only limitation of the work that the authors are aware of the assumption on the type of attacks, i.e., f--norm bounded attacks. This point has been mentioned in future work.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged
the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
18

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: For each statement, all the assumptions were clearly described and fully adopted in the proof steps.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proof' in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: A clear step-by-step procedure for estimating the certificate radii was presented in Section 3.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access hosted model (e.g.. in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily new algorithm, the paper should make it clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (c.g., to registered users), but it should be possible for other researchers to have some path to reproducing verifying the results.
19

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: While the dataset used in this study is publicly available, the code and in- structions on how to run the code is publicly available on GitHub: htttps://gtthu: com/
arekavandd/Gerttffiedd _dv___adv____ o.di
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cr cc/
httpeeeuuubmsssiooooooooo for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
guwdes/ CodeeSumieee onPolicy) for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data,
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: To the best of the authors' knowledge, all the critical parameters for the provided results reported with their exact values in Section 4.
Guidelines:
The answer NA means that the paper does include experiments.
The experimental setting should be presented in the core the paper to a level of detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, as supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
Justification: As the proposed method is probabilistic. the results were reported either with eтror bars (e.g.. Figure 3) were reported with confidence level or were averaged over large number of samples.
Guidelines:
The answer NA means that the paper does not include experiments.
20

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: As mentioned in the paper, all simulations and experiments were conducted using an Intel(R) CT))(TM) 17-9750H CPU running at 2.60GHz (with a base clock speed of 2.59GHz) and 16GB of RAM.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't I make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification: To the best of the authors' knowledge, there is no misalignment between this research and the code of ethics including but not limited to preserving anonymity, appropriate citations of other relavent studies, social impact, and privacy.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there special consid- eration due to laws or regulations in their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative socictal impacts of the work performed?
21

---

Answer: [Yes]
Justification: Potential positive societal impacts of the work have been discussed in Subsec- tion "Broader impact" right after Conclusion.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g.. deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: In this paper, the authors did not release any model, but just proposed an evaluation technique to measure models' sensitivity to adversaries.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification: The studies related to the DSAC" model and the evaluated dataset were appropriately cited and the URLs were provided in the GitHub page of this study.
Guidelines:
The answer NA means that the paper does not existing assets.
22

---

The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset is used and, if possible, include URL.
The name of the license ge.g.. CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, pappessitthheeeocc thoode com datasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-pase re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: As mentioned in the abstract, the code and the required documenta- tion are publicly available at https:///githn com/ arekavandd/Certtiieee adv RRegression/
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
23

---

Justification:
This paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with
human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
24


Reviews:
[{"review_id": "WVz8aFoNz8", "reviewer": "Reviewer_wW8d", "summary": "This work extends current randomized smoothing on the regression task via the $\\alpha$-trimming filter. A new probabilistic certificate bound for is given against the $l_p$ norm attack for all regression models with the unconstrained output. Comprehensive synthetic simulations and evaluation on the real-world camera re-localization task are conducted to demonstrate the effectiveness of the proposed method", "questions": "I am curious about the probability calculated from equation (6) and (9). Is there a closed-form solution to get the probability or is the probability gotten by sampling? If is by sampling, will the sampling brought by smoothing delay the prediction process of the regression model?", "limitations": "See the weakness.", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. This work gives good theoretical insights and rigorous proof.\n\n2. The derived certification bound is valid for any regression model with bounded or unbounded output.", "weaknesses": "**Give more straightforward examples for equation (12).** As the main improvement brought by $\\alpha-$ trimming filter lies on $I_{n,\\alpha}^{-1}(P)$, it is recommended to give a more straightforward illustration of the situation when $I^{-1}_{n,\\alpha}(P)$  provides better certified robustness than $P$, such as a curve or a table which shows different certified bound with different $P$ and $\\alpha$.\n\n**More explanation in Figures 4 and 5.** In Figure 4, after reading the experiment part, I still feel confused about why the predicted location of the camera is a trajectory but not a point. Moreover, I have not found any further explanation for Figure 5. It's recommended to explain the experiment results more which may help readers understand easier.\n\n**Lack of comparative results.** This work lacks comprehensive comparative results with other certified robustness methods designed for the regression model.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "The authors appreciate the reviewer's recognition of the theoretical rigor in the paper. This work represents the first universal certification framework for regression models designed to defend against adversarial examples during the inference stage. Below, we provide a detailed response and further insights to support our proposed methodology, demonstrating the value of our analysis and we hope they help in receiving higher scores and increasing the chance of publication.\n\n**Give more straightforward examples for equation (12). As the main improvement brought by α− trimming filter lies on ...**\n\nEquation (12) states that for a base regression model that generates outputs within the accepted region with probability $q$, the chance of observing a valid output after applying $\\alpha$-trimming filter becomes $\\textit{{I}}_q(n-[\\alpha n],[\\alpha n]+1)$. In order to show this is an improvement even for worst-case scenario, we proved that the filtering rate should be greater than a threshold denoted by $\\alpha^+$. The inverse process has been used in Theorem 3 to estimate the certificate radii. Therefore, a plot for $\\textit{{I}}_q(n-[\\alpha n],[\\alpha n]+1)$ vs $\\alpha$ can better visualize this improvement. This visualization can be found in the attached PDF along with this rebuttal. This new visualization will be added to the final camera-ready version of the manuscript: *Figure 1 shows two different models one with $q=0.7$ and one with $q=0.9$. After applying $\\alpha$-trimming the obtained probability of validity in the results are shown in blue and orange colours, respectively. In both settings, $\\alpha^+$ values are demonstrated in vertical dashed lines and it can be observed that the success rate of the prediction ($\\textit{{I}}_q(n-[\\alpha n],[\\alpha n]+1)$) is always greater than the assumed $q$ values for $\\alpha \\geq \\alpha^+$. As described in the example in Lines 179- Line 189 of the manuscript, the corresponding $\\alpha^+$ values are slightly greater than $1-q$ to ensure improvement even in worst-case scenarios.*\n\n**More explanation in Figures 4 and 5. In Figure 4, after reading the experiment part, I still feel confused about why the predicted location of the camera is a trajectory but not a point. Moreover, I have not found any further explanation for Figure 5. It's recommended to explain the experiment results more which may help readers understand easier.**\n\nPlease note that for all these three evaluated scenes, a single camera is continuously moving along a path and taking images. For example, in Great Court scene as mentioned in the experiment, 760 images were taken in different locations within the scene. Therefore, when all the predicted positions are shown together, a trajectory from the locations of the camera can be obtained. However, for each predicted location, the estimated certification radius which is colour-coded for each point in Figure 4, gives a measure of how sensitive the prediction is against adversarial examples around the given image.\nFigure 5, on the other hand, reflects the certified median error as defined in Line 230 for the scenes in comparison with certification of models with bounded outputs. In sensitivity analysis section (Appendix E) some aspects of these curves have been explained in detail. However, the following detailed explanation has been added to the main experiment section as reviewer suggested to better explain settings and the take home messages of the results: *As shown in these plots, $\\alpha$-trimming filter consistently decreased the certified median error (orange curve) across all input perturbation ranges ($r$) compared to the results obtained by the base regression model (blue curve). The main reasons for this improvement are firstly, because of the better approximation of position parameters leveraging outlier removal and averaging using $\\alpha$-trimming filter . Secondly, because of better certificate radii for each image in the scene which decreases penalization in the process of certified median error calculation. Leveraging the $\\alpha$-trimming approach for smoothing, we are no longer worried about the output ranges, and no further assumptions such as large sample size or discount factor are required to provide a valid certificate.*\n\n**Lack of comparative results. This work lacks comprehensive comparative results with other certified robustness methods designed for the regression model.**\n\nPlease note that one of the main claims of the paper is that this study is the first that proposes a technique that enables to provide certification for regression models with unbounded outputs. None of the existing techniques [17,19,7,4,16] are feasible to be used in the context of unbounded outputs or certification in the inference stage, unless setting some assumed bounds for the output as authors did for the work [17] in Figure 5 (top left) which is the most related work to this study. Therefore, this study should be considered as a standalone work and as a baseline for future studies not as an incremental improvement of previous studies.\n\n**I am curious about the probability calculated from equation (6) and (9). Is there a closed-form solution to get the probability or is the probability gotten by sampling? If is by sampling, will the sampling brought by smoothing delay the prediction process of the regression model?**\n\nThanks for this question. Similar to the classification counterparts, the probability $ {p_A}_i$ should be estimated using sampling strategies and Monte Carlo estimation;  however, the lower bound estimate  $ \\underline{p_A}_i$ is obtained by Clopper-Pearson interval prediction which gives a lower bound estimate given number of samples and required confidence level. Therefore, the delay caused by sampling can be compromised with the tightness of the lower bound (using smaller number of samples) and this is fully under control of the user.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "l2x11ixsAc", "reviewer": "Reviewer_pBXb", "summary": "Prior work extends the notion of a 'certified robustness radius' from classification tasks to a regression task. The prior state-of-the art for calculating these certified robustness bounds in the regression setting had a major shortfall: it exhibited major instabilities when applied to values with an unbounded range. This paper suggests a method that is better conditioned for unbounded random variables.", "questions": "Suggestions/ Questions:\n\nline 19: I suggest you note that adversarial training does provide some defense\n\n\nline 43: it's not clear what 'normalized' $z$ means here\n\n\nlines 126-128: I couldn't understand what this meant\n\n\nfigure 2: I'm having a hard time interpreting b and c. What is the blue line? what is the function $g$?\n\n\nsection 3.3: it seems that the data points between the $\\alpha$th and $1-\\alpha$th percentiles are what you call the ``accepted region\" make sure the \"accepted region\" is defined!\n\n\n\nline 228: % is in the wrong place", "limitations": "It seems that there is a lot of prior work on $\\alpha$ filtering in other contexts. Is it discussed when $\\alpha$ filtering tends to work well/ not work well?", "rating": 5, "confidence": 3, "soundness": 3, "presentation": 1, "contribution": 3, "strengths": "The authors identify a popular bound in the classification case that currently does not have a practical analog for regression. They then develop a technique for extending such a bound to regression.", "weaknesses": "1. The authors write that the method suggested by prior work in [17] fails for unbounded quantities in regression because it is 'unstable' however, they do not back up this claim. It would be nice if the authors could demonstrate this with experiments or explain why the method of [17] could not be expected to work for unbounded quantities.\n\n2. There were some important terms that were not defined at all, like \"accepted region\" and \"bag\" in the appendix.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their valuable time spent on this manuscript, as well as their comments on the contribution of the work. Below, we reply to each comment separately.\n\n**The authors write that the method suggested by prior work in [17] fails for unbounded quantities in regression because it is 'unstable' however, they do not back up this claim. It would be nice if the authors could demonstrate this with experiments or explain why the method of [17] could not be expected to work for unbounded quantities.**\n\nA common assumption in [17] was the presence of lower and upper bounds for the model output for any input data. It was shown in [17] that as the difference between these bounds increases, the probabilistic certificate becomes impractical and approaches zero. This occurs because the averaging function used in the smoothing stage is highly sensitive to a single large outlier. Even one data point at the upper or lower bounds (assuming these bounds are large) can significantly alter the averaging function's result, making the output invalid (outside the accepted range). This fact was explained in Section 3.2. Therefore, in the unbounded scenario considered in this paper, the previous certificate is impractical due to the type of smoothing function used in that study. Figure 5 (top-left) illustrates the required discount factor (200%) as defined in [17] to achieve almost the same performance, highlighting the previous technique's failure for unbounded outputs.\n\n**There were some important terms that were not defined at all, like \"accepted region\" and \"bag\" in the appendix.**\n\nWhile the term “bag” simply refers to set of leftover data points after applying $\\alpha$-trimming filter, the term “accepted region” is now clearly defined after Definition 1: *Based on Definition 1, users can define a region for $i^{th}$ continuous output variable by $\\{z \\mid diss_y(z,\\textbf{y}_i) \\leq \\epsilon{y_i}\\}$ as the accepted region where the output prediction can fit in without being considered as a wrong prediction.* This region is set by the user around $f(\\textbf{x})$ to determine how much deviation is acceptable. For example, in camera- re-localization in a 3D scene with size $100m \\times 100m$, the user might reasonably accept up to 0.5m deviations in the predictions.\n\n**line 19: I suggest you note that adversarial training does provide some defense.**\n\nThanks for highlighting this important point. The authors believe that adversarial training is indeed one of the best strategies to defend against adversarial examples in the inference stage. This will be added to the camera-ready version for the sake of completeness.\n\n**line 43: it's not clear what 'normalized' z means here.**\n\nThe normalization of $\\textbf{z}$ is included because some divergences can only be applied to probability mass functions. This choice is up to the user, but in our paper, we used the $\\ell_p$ norm as the measure of similarity without imposing any constraints on $\\textbf{z}$.\n\n**lines 126-128: I couldn't understand what this meant.**\n\nThis has been explained in response to the above question regarding the method in [17].\n\n**figure 2: I'm having a hard time interpreting b and c. What is the blue line? what is the function g?**\n\nIn both figures in (b) and (c), blue lines demonstrate the certified range around the centre points as the input (e.g., $x_1=2, x_2=3$) for base regression model ($f(\\textbf{x})$) that is visualized in (a). On the other hand, $g(\\textbf{x})$ is the smoothing function defined in equation (8) applied to the results of base regression with different $\\alpha$ values. Figure 2 (b) demonstrates the certificate for $\\ell_2$ attack (circles around the evaluated points) and Figure 2 (c) demonstrates the certificate for $\\ell_{\\infty}$ attack (squares around the evaluated points). In both figures, smoothing using $\\alpha$-trimming increased the certification area while for higher $\\alpha$ values this range has been further increased.\n\n\n**section 3.3: it seems that the data points between the $\\alpha$-th and 1−$\\alpha$-th percentiles are what you call the ``accepted region\" make sure the \"accepted region\" is defined!**\n\nAccepted region around a given value $y$, motivated by Definition 1, includes points whose dissimilarity with $y$ is smaller than a threshold defined by the user. This definition has been added to the revised manuscript as the reviewer has requested.\n\n**line 228: % is in the wrong place.**\n\nThanks for mentioning this typo. It has been fixed in the revised manuscript.\n\n**It seems that there is a lot of prior work on α filtering in other contexts. Is it discussed when $\\alpha$-filtering tends to work well/ not work well?**\n\n$\\alpha$-trimming is a popular technique for outlier rejection in robust statistics. While the appropriate filter design might differ from one application to another depending on the criteria, Proposition 2 and Theorem 3 state how this filter should be designed in the context of certified robustness given a level of robustness and number of samples. A summary of other approaches in other contexts such as robust parameter estimation will be added to the camera-ready version of the paper.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9F31ICQ6F6", "reviewer": "Reviewer_ZCs7", "summary": "This paper considers randomized smoothing for (unbounded) regression models. An $\\alpha$-trimming procedure is proposed in order to increase certification strength. Experiments to illustrate the effectiveness of the approach are conducted on synthetic datasets as well as camera re-localization tasks.", "questions": "1. Line 68: You mention the prior works [17, 19, 7, 4, 16] that develop smoothing methods for regression models very briefly, and assert that they all suffer from limitations. However, more explanation is needed to distinguish your contributions from theirs. I suggest including more in-depth discussion on the contributions of these works, and clarify how your method differs/overcomes their particular limitations.\n2. In the introduction, you use the acronym CR to denote \"certified robustness,\" but in Section 3, you use CR to denote \"certified regression.\" Please only use this acronym to denote one thing throughout the paper.\n3. Lines 93 and 116: \"...is the lower bound on the probability of accepting prediction in ith output variable.\" What does this mean? If we're dealing with regression models, what does \"accepting prediction\" of a particular output variable mean?\n4. Line 118: What is the \"accepted region\"?\n5. Line 118: So does Proposition 1 not apply to $\\ell_1$ threats?\n6. Figure 1: I don't find this figure particularly enlightening/explanatory. For example, what is the index $m$ here? Also, what is the index $k$ here? In your explanation of $\\alpha$-trimming, you use $k$ to denote an arbitrary index (after computing the order statistics). Furthermore, why is the region around $y_{1:k}$ nonconvex, but the region around $y_{m:t}$ convex? In your Theorem 2 statement, you assume that the \"accepted region\" (again, this is not clearly defined anywhere) for each output is convex. Finally, what is the difference between the outputs and regions ($y_{1:k}$, $y_{m:t}$, and their green regions) within the red dashed box, and those same outputs and regions outside the red dashed box?\n7. Line 150: \"...the following equality holds...\" I think you mean inequality.\n8. Line 151: What is $q$ in (9)? Is this allowed to be any real number in $[0,1]$?\n9. Line 157: Is it ever possible for the change from $q$ to $I_q(n-[\\alpha n], n+[\\alpha n])$ to be a decrease?\n10. Theorem 2: One of the powers of randomized smoothing (for classification) is that it allows us to \"robustify\" a non-robust base classifier. However, it seems like the strength of your robustness certificate for your smoothed classifier depends heavily on the underlying robustness of the base classifier. That is, it appears as though in order for your smoothed classifier to have a high level of robustness, you need your base classifier to have a high level of robustness. Can you please discuss and clarify these aspects? If this interpretation is correct, this could result in significant limitations.\n11. Algorithm 1, Linw 5: What does it mean for a continuous-valued regression prediction to be \"correct\"? Isn't the \"correct\" output for a given input a singleton in $\\mathbb{R}^t$ and hence a measure-zero set?\n12. Line 249/Section 5: I suggest moving this paragraph to around Lines 68--71 to better clarify your contributions at the outset.", "limitations": "N/A.", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The problem of scaling up certified robustness (e.g., via randomized smoothing-based methods) to regression models is an important one to consider, and is certainly of interest to the Neurips audience.", "weaknesses": "Overall, the paper could use an extensive revision and polishing. There is quite a bit of terminology used throughout the paper that is not clearly defined, and the assumptions underlying some of the mathematical results are not made explicit/clear. In particular, some language from classification seems to be infiltrating the supposed regression setting of this paper, which makes things very difficult to understand. The paper seems to be heavily dependent on [17], with the only notable novelty being the incorporation of $\\alpha$-trimming into the smoothing framework.\n\nSee the Questions section below.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**The problem of scaling up certified robustness (e.g., via randomized smoothing-based methods) to regression models is an important one to consider, and is certainly of interest to the Neurips audience.**\n\nThe authors would like to express their gratitude to the reviewer for recognizing the significance of the defined problem for the NeurIPS audience. This study is the first to apply the randomized smoothing technique to a broad class of regression models with both bounded and unbounded outputs. It provides proofs of their performance under constraints such as maximum permitted latency and limited computational resources, which restrict the number of examination points. Additionally, the results are benchmarked against the critical task of camera re-localization, where reliability is crucial for robotic vision and autonomous systems.\n\n**Overall, the paper could use ...**\n\nWe appreciate the reviewer's efforts in reading the manuscript and providing feedback. Although the authors conducted several rounds of proofreading before the final submission, some typos might still be present, which will be corrected in the camera-ready revision, especially those mentioned by the reviewer in the following questions. In terms of underlying assumptions, to the best of our knowledge, there is no further assumptions needed in any of the results to be claimed. While the certification setup was designed for regression problems, we acknowledge that steps and model parameters are shared between classification and regression settings. The core concept of the randomized smoothing approach was initially developed for classification models and has been adapted for use in regression settings, leading to some similarities in terminology.\nAs noted in the manuscript and mentioned by the reviewer, this paper extends the results in [17] by incorporating $\\alpha$-trimming into the smoothing process to address a broader class of regression models, including those with unbounded outputs which is the main focus of this paper. This new smoothing approach includes an end-to-end analysis and demonstrates through various theorems that output predictions are certifiable even with limited data points, unlike in [17] which required a large discount factor. Additionally, we present a robustness analysis against $\\ell_p$ attacks, extending the $\\ell_2$ attack analysis in [17]. The connection between the certification of regression and classification models is also provided to give readers a deeper understanding of their similarities.\n\n**Line 68: You mention the prior works ...**\n\nWe thank the reviewer for highlighting the need to clarify the distinctions between this study and those referenced in [17, 19, 7, 4, 16]. Although these differences were briefly summarized in Line 68, the authors believe that a more detailed explanation in Section 5 (Related Work) provides a precise description of each study and their respective differences or limitations compared to our work. Our study presents a universal certification technique applicable to any regression model. If the explanations in Section 5 are deemed insufficient, we are happy to add further clarification. In summary, we noted that  *``The most related works to our study are [4,17] where in the former study, the object detection was investigated through the lens of certified regression, however, their analysis is relying on the scaling output of classifier models to expand the range of output values which constrains the architecture of considered models, and in the latter the certification was provided for a class of bounded output regression model in the asymptotic case. Compared to these methods, our approach provides a probabilistic certificate for all regression models (including models with a wide range of outputs) with a limited number of evaluations through drawing noisy samples.’’*\n\n**In the introduction, you use the acronym...**\n\nThank you for pointing out this typo. The redundant acronym for certified regression has been removed in the revised version.\n\n**Lines 93 and 116: \"...is the lower bound on ...**\n\nPlease note that in the context of classification, a model is considered certifiably robust if any perturbation in the input sample does not change the output label prediction. For example, if the predicted label for the input sample $\\textbf{x}$ is class A, it remains (or is highly likely to remain) class A for the perturbed sample $\\textbf{x} + \\boldsymbol{\\delta}$. However, in the context of regression, due to the continuity of the output variable, any perturbation in the input causes changes in the output, which are directly related to the model weights and the gradient of the output with respect to the input. Therefore, the notion of robustness in regression differs from that in classification. In this setting, robustness is defined by Definition 1. In summary, it states that for each output variable, the user can define an acceptable region around the model output ($\\textbf{y}_i$) for the input sample $\\textbf{x}$ using a chosen measure of dissimilarity ($diss_y(.,.)$) and a corresponding radius ($\\epsilon{y}_i$). If the output variability exceeds the defined region, the model is considered non-robust.\n\n**Line 118: What is the \"accepted region\"?**\n\nBased on Definition 1, the accepted region for the $i^{th}$ output variable, according to the user's level of tolerance, is defined by ${z \\mid diss_y(z,\\textbf{y}_i) \\leq \\epsilon{y_i}}$. This region represents a neighborhood around the observed output $\\textbf{y}_i$, within which the user is satisfied if the perturbed input data generates such outputs. This explanation has been added immediately after Definition 1 to reduce confusion.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:
The authors thank the reviewers for their feedback and constructive comments. Please find visualisation of the probabilistic certicates vs $\alpha$ in the attached PDF (Reply to reviewer wW8d).

Meta-review: This paper extends existing results on certified robustness of regression models.
By applying $alpha$-filtering (a tool from robust statistics), the authors are able to provide certificates for models with unbounded outputs, something which no prior work provides.
This is a meaningful contribution, which reviewers agree is worthy of publication.

Reviewers also raised a number of concerns about the submission, and I also asked them to discuss the practical relevance and significance of the contribution.
Reviewing the discussion, I believe the only remaining concern which might prevent publication of this work is the quality of the presentation, which all 3 reviewers critiqued.
In particular, several terms were not defined in the initial submission.
After looking at the paper myself, I believe the presentation is not bad enough to prevent publication, and as the authors have promised to address all of the specific issues of clarity raised by the reviewers, I am pleased to recommend acceptance.

I additionally ask the authors to revisit Figure 1, as I agree with Reviewer ZCs7 that the current version is not very enlightening, and I found the caption was insufficiently detailed to explain what the take-away is meant to be.  I also believe the work would benefit from further attention to presentation, so, contra the author's stated intentions, I recommend they seek and incorporate further feedback on how to improve clarity, as I believe it could significantly increase the impact of their work.
Decision: Accept (poster)