Title: Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models
Venue: NeurIPS 2024
Accepted: yes
Keywords: Certified robustness

alpha-trimming

Probabilistic certificates

Robust regression

Randomized smoothing
Abstract: Certified adversarial robustness of large-scale deep networks has progressed substantially after the introduction of randomized smoothing. Deep net classifiers are now provably robust in their predictions against a large class of threat models, including $\ell_1$, $\ell_2$, and $\ell_\infty$ norm-bounded attacks. Certified robustness analysis by randomized smoothing has not been performed for deep regression networks where the output variable is continuous and unbounded. In this paper, we extend the existing results for randomized smoothing into regression models using powerful tools from robust statistics, in particular, $\alpha$-trimming filter as the smoothing function. Adjusting the hyperparameter $\alpha$ achieves a smooth trade-off between desired certified robustness and utility. For the first time, we propose a benchmark for certified robust regression in visual positioning systems using the Cambridge Landmarks dataset where robustness analysis is essential for autonomous navigation of AI agents and self-driving cars. Code is publicly available at \url{https://github.com/arekavandi/Certified_adv_RRegression/}.

Certified Adversarial Robustness via Randomized α -Smoothing for Regression Models

Abstract

Certified adversarial robustness of large-scale deep networks has progressed substantially after the introduction of randomized smoothing. Deep net classifiers are now provably robust in their predictions against a large class of threat models, including ℓ 1 , ℓ 2 , and ℓ ∞ norm-bounded attacks. Certified robustness analysis by randomized smoothing has not been performed for deep regression networks where the output variable is continuous and unbounded. In this paper, we extend the existing results for randomized smoothing into regression models using powerful tools from robust statistics, in particular, α -trimming filter as the smoothing function. Adjusting the hyperparameter α achieves a smooth trade-off between desired certified robustness and utility. For the first time, we propose a benchmark for certified robust regression in visual positioning systems using the Cambridge Landmarks dataset where robustness analysis is essential for autonomous navigation of AI agents and self-driving cars. Code is publicly available at https://github.com/arekavandi/Certified_adv_RRegression/ .

1 Introduction

Adversarial examples first swayed the narrative on deep models over a decade ago [2, 26]. Where deep nets had demonstrated remarkable generalization on classically challenging tasks [10], these small perturbations to an input sample that make no apparent change to the input's semantics or true class, yield high rates of misclassifications. While defenses had so far not tipped the balance away from the attacker, the combination of Certified Robustness (CR) with adversarial training has excited the security and ML communities recently [15]. For a given model and input sample, CR can guarantee the absence of any adversarial examples in close vicinity of the sample. Randomized Smoothing (RS) is a widely used technique for CR as it scales to arbitrary large-scale models as it requires only black-box access to model evaluations [12, 6]. Despite attacks targeting ML tasks beyond classification [5], little is known of certification (or RS) for other standard ML tasks such as regression. Robustness analysis for regression has been examined through Lipschitz continuity [27] which is only feasible for small-scale regression models with full access to the models' parameters and certain types of activation functions.

In this paper, we present a framework for black-box certification of arbitrary regression models with either bounded or unbounded outputs. Our results extend the findings of [17] which considers the class of bounded-output regression models with large sample sizes in the evaluation stage. While they introduce averaging as an aggregation operator in randomized smoothing for regression, without limits on output range, averaged predictions may not be stable. This boundedness assumption, however,

limits the applicability of their certificates. We present a superior approach through smoothing by α -trimming filter. Complementing experiments with synthetic data, we benchmark our CR and RS approaches with the Cambridge Landmarks [9] dataset and DSAC ∗ framework [3] for camera re-localization. The use of these benchmarks may be of independent interest for CR research.

2 Preliminaries

A base regression model parameterized with θ is denoted by f θ : R d → R t , where d and t are the input and output dimensions: f θ ( x ) maps input x to multivariate output y . We will use g α ( x ) to denote the smoothed version of f θ ( x ) , as defined later. The neighborhood centered around point z ∈ R s with radius ϵ with respect to a given dissimilarity function is denoted by N ( z , ϵ ) , where the dissimilarity function can be e.g., ℓ p norms as well as functional divergences such as KL or Bregman when dealing with normalized z . In other words, for any z ∈ R s ,

where diss ( ., . ) in general, can be any metric or function that the user is interested, and diss x (or diss y ) indicates dissimilarity in the input (or output) space. Throughout this paper, neighborhoods in input space are defined for all dimensions simultaneously as in Eq. (1), neighborhoods for outputs are analyzed separately using the neighboring function N y ( y , ϵ y ) = ∏ t i =1 N y ( y i , ϵ y i ) . The ℓ p -norm ( p ≥ 1 ) of a vector is denoted and defined as ∥ x ∥ p = ( ∑ i | x i | p ) 1 /p where x i indicates the i th entry of x . We denote the multivariate normal distribution with mean m and covariance σ 2 I as N ( m , σ 2 I ) , where I is the identity matrix. We denote the standard Gaussian CDF by Φ( · ) . P {·} and E {·} denote the probability and expected value operators, respectively. Finally, [ [ t ] ] indicates the set { 1 , 2 , · · · , t } and [ · ] rounds to the closest integer value.

Threat model. We consider a defender with only black-box access to model evaluations at test time: given an input point they may observe the output regressed value, but not model structure, gradients, parameters, or learning hyperparameters. On the other hand, we consider adversaries that have full information access to the model and certification algorithm. However, the attacker is limited to perturbing input data within small neighborhoods. This matches the typical threat model found in previous works on randomized smoothing in classification [6].

Randomized smoothing. Randomized smoothing is based on the ensemble of model outputs obtained over different perturbed inputs and is among the few techniques that are scalable to arbitrary, large models. Randomized smoothing was first adopted in seminal works of [6, 14, 12] for classification tasks to derive the maximum radii of input perturbations which maintain an invariant output prediction. In particular, in [6] it was shown that for the base classifier f θ ( x ) , the new smoothed classifier g ( x ) = arg max c ∈ Y P ( f θ ( x + e ) = c ) , e ∼ N ( 0 , σ 2 I ) , is certifiably robust against any ℓ 2 -normbounded adversary with radius ϵ = σ 2 ( Φ -1 ( p A ) -Φ -1 ( p B ) ) where p A ≥ p B are any lower bound of majority class scores, and any upper bound of runner-up class scores, respectively. While randomized smoothing has mostly been explored for classification problems with categorical outputs [8, 30, 11, 31, 28, 13], more recently research has begun to consider regression [17, 20, 7, 4, 16]. These works all exhibit some limitation, including: universality, theoretical support, practical applicability, reliance on large sample sizes of data points, bounded outputs, or analysis through the lens of certifying classification. Further explanation on the differences among these studies can be found in Section 5.

3 Method

3.1 Certified Regression

For many years, robustness analysis of regression models or estimators has been investigated using tools, such as Lipschitz continuity [27] or influence functions [23], where full access to the model parameters and its derivatives were required. Due to a lack of a proper definition of robustness in black-box access setup for large models, in contrast to classification problems, certified robustness has not been fully developed for regression problems. Until recently, motivated by probabilistic certified classification [18], the robustness definition for regression models has been introduced in [17], and some input perturbation bounds for base regression models, as well as their smoothed version with bounded outputs assumption using sample averaging, have been derived. In this paper, we extend

these results for unbounded outputs in a small sample regime using a much more general form of smoothing function. We use the same definition of robustness in regression tasks given by:

Definition 1. (Probabilistic Robustness Certificate) [17]. Given an example ( x , y ) , a (possibly) randomized regression function g ( x ) : R d → R t is said to be certifiably robust with probability 0 ≤ P ≤ 1 in the randomness of g , with respect to the given input and output dissimilarity functions with radii ϵ x , ϵ y 1 , · · · , ϵ y t , If ∀ x ′ ∈ N x ( x , ϵ x )

This definition of robustness in black-box functions requires first analyzing the robustness of the base regressor and then establishing theoretical results for smoothing functions applied to this base regression as a wrapper. Based on Definition 1, users can define a region for i th continuous output variable by N y ( y i , ϵ y i ) or in other words { z | diss y ( z, y i ) ≤ ϵ y i } as the accepted/valid region where the output prediction can fit in without being considered as a wrong prediction. The term accepted/valid region will be used in the rest of the paper to refer to the output neighborhood. This region is set by the user around f ( x ) to determine how much deviation is acceptable. For example, in camera- re-localization in a 3D scene with size 100 m × 100 m , the user might reasonably accept up to 0.5m deviations in the predictions. The following result has been provided for the base regression function:

Theorem 1. (Certification of General Models Against ℓ 2 -Bounded Attack) [17]. Let f θ ( x ) : R d → R t be a (possibly) randomized base regressor and e ∼ N ( 0 , σ 2 I ) . Suppose for some example ( x , y ) ,

where p A i is the lower bound on the probability of accepting prediction in the i th output variable. Then referring to definition Eq. (2), f θ ( x + e ) is probabilistic certifiably robust at example ( x , y ) , for a ℓ 2 -norm dissimilarity in the input, chosen probability P ≤ min i ∈ [ [ t ] ] p A i , output radii ϵ y 1 , . . . , ϵ y t and input radius

The above result indicates a strong similarity between the certification of regression models and classification task since both radii are proportional to σ and Φ -1 ( p A ) . It is worth investigating the equivalence of these two tasks in terms of robustness radius formulation, i.e., Eq. (4):

Corollary 1. (On the Equivalence of Regression and Classification) The certificate radius for a univariate regression model, i.e., f θ ( x ) : R d → R using the robustness definition (2) with a userchosen P = 50% , is the same as the certified radius for a smoothed classifier made of f θ ( x ) : R d → R as the base binary classifier and dividing the space into class A and class not A, where A denotes the case where the output is within the defined output neighborhood.

Proof. Starting from (4) as the regression certificate bound and setting P = 50% , the regression certificate radius becomes

which is exactly the radius derived for a binary classifier using the same smoothed function with the majority voting as stated in [6].

This is an intuitive result stating that robustness in regression tasks can be reduced to the classification task when P is set to 50% , where the output of a regression model is in the maximum uncertainty level. In this case, there is a tie between class A and not A and this is exactly where the output of a classification model might change and break the robustness definition of the given classifier. Now we extend the results in Theorem 1 to the ℓ p attack with proof in Appendix A.

Proposition 1. (Certification of f θ ( x ) Against ℓ p Attack). Let f θ ( x ) : R d → R t be a (possibly) randomized base regressor and e ∼ N ( 0 , σ 2 I ) . Suppose

where p A i is the lower bound on the probability of accepting prediction in i th output variable. Then using (2) as the definition of certified robustness, f θ ( x + δ + e ) , ∀∥ δ ∥ p ≤ ϵ x ( p ≥ 2 ) is within the accepted region, with the user-defined probability P ≤ p A i , ∀ i ∈ [ [ t ] ] , where

9α(x)

Nx(x, Ex)

Ny(y,Ey1)

Ny(y,Ey1)

y1:k

y1:k

fe(x)

ymit

ymt

Ny(y,Ey)

Ny(y,Ey1)

It is worth pointing out that the upper bound of input perturbation in (7) is obtained by Gaussian smoothing, meaning that we only evaluate the model once with Gaussian smoothing, but the guarantee is valid for any ℓ p attack ( p ≥ 2 ).

3.2 Smoothing in Regression

Definition of the smoothing function in the classification task, i.e., g ( x ) = arg max c ∈ Y P ( f ( x + e ) = c ) , e ∼ N ( 0 , σ 2 I ) , is not feasible for application to regression and requires adjustments. One immediate change can be the use of an average function to compute g ( x ) , i.e., g ( x ) = E { f θ ( x + e ) } , e ∼ N ( 0 , σ 2 I ) or its Monte Carlo estimation. However, as shown in [17], even a single adversarial point (in unbounded scenarios) can entirely shift the result of averaging into the invalid zone (from the user's perspective). This behavior is known as the zero breakdown point of averaging in robust statistics [32]. To deal with such a worst-case scenario, in [17] the outputs of regression models were assumed to be bounded. Although this assumption helped to derive certificate bounds around the input, it was shown for some cases where these considered bounds in the output are loose, the certificate bound in the input becomes worse than the base regression model. This motivates use of a better smoothing function that can also tolerate unbounded outputs. Therefore, we use the α -trimming filter [1] to estimate the continuous output variable. Suppose that F is a finite set of N numbers (sorted in ascending order). The α -trimmed mean of F is obtained by removing α fraction of the samples ( 0 ≤ α < 0 . 5 ) from the high and low ends of the sorted set, and computing the average of the remaining values. In the extreme cases, when α → 1 2 , α -trimming is equivalent to median filtering [16], and when α = 0 it reduces to classical averaging [17]. In other words, we use the following general form of smoothing function denoted by g α ( x ) :

where n is the sampling size, F θ ( x + e ) i is the sorted form of f θ ( x + e ) i , and k is the index of the order statistics. In the above, we draw n realization from e to construct the set values. Here α is a hyperparameter and can be tuned based on the user-chosen value P or level of smoothing. One of the primary uses of the α -trimming filter is in data preprocessing and outlier rejection. The adjustment of α in this context typically relies on prior knowledge about the proportion of data points that deviate from the nominal distribution [22]. While this prior knowledge may not always be accurate, it has been widely utilized to reduce the sensitivity of estimators. Another method for tuning α in parameter estimation is to consider efficiency at the nominal density. For instance, if no outliers are present in the dataset, one may set α to achieve an estimation that closely matches the performance of its maximum likelihood counterpart [24].

n=100

1.0

q=0.7

q=0.9

0.8

-[αn],[αn]+1)

0.6

0.4

Iq(n

0.2

0.0

0.0

0.1

0.2

0.3

0.4

0.5

α

3.3 Certified Regression Against ℓ p Attack

In this section, we use α -trim smoothing function g α ( x ) as a wrapper around the base regression model using the same definition of the vicinity sets in both input and output as shown in Figure 1. Consequently, everything within the red dashed box is related to base regression certification. The corresponding output regions outside the red dashed box represent the certification analysis for the smoothed function with the accepted regions remaining consistent with those in the base regression model. Note that for the following results (proof in Appendix B), the neighborhood in the output can be in any convex region, but the input perturbation is only considered to be within a ℓ p ball around x .

Theorem 2. (Certification of g α ( x ) for fixed range ℓ p Attack). Let f θ ( x ) : R d → R t be a (possibly) randomized base regressor, and let g α ( x ) be the one defined in (8) with 0 ≤ α ≤ 1 / 2 . Let us assume the accepted region (set) for each output target variable is convex and the following inequality holds for e ∼ N ( 0 , σ 2 I ) , a user-defined ϵ y and ∀∥ δ ∥ p ≤ ϵ x ( p ≥ 2 ) and ∀ i ∈ [ [ t ] ] :

where 0 ≤ q ≤ 1 , then ∀ n > 0 we have

where I q ( a, b ) is the regularized incomplete beta function defined as I q ( a, b ) = 1 B ( a,b ) ∫ q 0 t a -1 (1 -t ) b -1 dt and B ( a, b ) is the complete beta function.

Theorem 2 states that after applying the α -trimming filter, the probability that the average prediction of the regression network satisfies the user-chosen constraint, in the worst case scenario changes from q to I q ( n -[ αn ] , [ αn ] + 1) .

The result in Theorem 2 is general and several intuitive and interesting cases are worth mentioning, (i) in the case where q = 0 , regardless of the number of samples and the value of trimming parameter α , I 0 ( n -[ αn ] , [ αn ] + 1) = 0 , meaning that when all the generated outputs by the base regression model are outside the accepted region, there is no chance that α -trimming can generate a valid result. (ii) When q → 1 , I q ( n -[ αn ] , [ αn ] + 1) → 1 , meaning that when almost all of the generated outputs are valid, the α -trimming approach with probability 1 returns a valid result regardless of the values of α and n . (iii) When α → 0 , I q ( n -[ αn ] , [ αn ] + 1) → q n , meaning that if no trimming is applied, one single large invalid output can make the result invalid, then to get valid output, all the generated outputs by base regression model should be within the defined acceptable zone, where the chance of this event is q n . Note that q n for α = 0 is much lower than the result obtained in the case of bounded output for the same smoothing in [17] which indicates the strong impact of the output range on the provided certificate.

Algorithm 1: Pseudocode for prediction and certification of smoothed regression model g α at x .

Input :x , p in ℓ p norm, σ , P , n , α , β , ϵ y , f θ ( . ) Output: Continuous variably ˆ y

1 - Draw n noise samples using e ∼ N ( 0 , σ 2 I ) and pass the noise-corrupted version of x through f θ ( . ) , and save the output values.

2 -n A i ← number of accepted outputs ∀ i ∈ [ [ t ] ] .

3 - Estimate p A i for ∀ i ∈ [ [ t ] ] using Clopper-Pearson interval prediction as stated in [17] with confidence 1 -β 2 .

4 -ˆ y i ← Apply the α -trimming filter (8) to the sorted output values ∀ i ∈ [ [ t ] ] .

5 -ˆ y i is valid with probability I p Ai ( n -[ αn ] , [ αn ] + 1) for ∀ i ∈ [ [ t ] ] .

6 - The certification radius of this prediction is ϵ x = min i ∈ [ [ t ] ] σ d 1 2 -1 p ( Φ -1 ( p A i ) -Φ -1 ( I -1 n,α ( P )) ) .

For other values of α , it is important to note that enhancing the robustness of the base regression model is not always guaranteed unless a certain minimum amount of trimming is performed. In the following proposition, we investigate the certificate improvement of α -trimming (with conservative α ) over the base regression model with proof in Appendix C.

Proposition 2. (Robustness Improvement via α -trimming). For any n ≥ 1 , 0 ≤ q ≤ 1 , if there exist an α such that α + ≤ α < 1 / 2 , where

and where I -1 q ( q ) is the inverse of I q ( n -x, x +1) with respect to x , then the following inequality holds:

Proposition 2 states that for sufficiently large α values, the α -trimming averaging technique, improves the probability of robustness and for larger values of α , the result gets better and better. As an example, suppose for a deep network that 90% of the generated outputs are valid, i.e., q = 0 . 9 . Assuming drawing only 50 samples to obtain the certificate, then I -1 0 . 9 (0 . 9) ≈ 7 . 3 and for any α which meets α ≥ 0 . 136 , the robustness probability, I 0 . 9 (50 -[50 α ] , [50 α ] + 1) is greater than q = 0 . 9 . For instance, when α = 0 . 15 and α = 0 . 2 , the robustness probability is 0 . 94 and 0 . 99 , respectively. Intuitively, the obtained range of α shows that to get improvement, α should be at least slightly greater than 1 -q ( 0 . 1 in our example) to be more confident that there will be less chance of observing some samples out of the accepted region defined by the user. Figure 2 shows two different models one with q = 0 . 7 and one with q = 0 . 9 . After applying α -trimming the obtained probability of validity in the results are shown in blue and orange colours, respectively. In both settings, α + values are demonstrated in vertical dashed lines and it can be observed that the success rate of the prediction ( I q ( n -[ αn ] , [ αn ] + 1) ) is always greater than the assumed q values for α ≥ α + . As described above, the corresponding α + values are slightly greater than 1 -q to ensure improvement even in worst-case scenarios. Now we must use the above results to propose the bound on ℓ p norm ( p ≥ 2 ) of the input perturbation for a user-given probability of success (P) when α -trimming is in place (proof in Appendix D).

Theorem 3. (Certification of g α ( x ) against ℓ p Attack). Let f θ ( x ) : R d → R t be a deterministic or random base regressor and let n ≥ 1 , 0 ≤ α < 1 / 2 , e ∼ N ( 0 , σ 2 I ) and suppose the α -trimming function g α ( x ) defined in (8) is used for smoothing. Then given

where p A i is the lower bound on the probability of accepting prediction in the i th output variable, then g α ( x + δ ) , ∀∥ δ ∥ p ≤ ϵ x ( p ≥ 2 ) is within accepted region, i.e., N y ( y , ϵ y ) = ∏ t i =1 N y ( y i , ϵ y i ) , with the user-defined probability P , s.t. I -1 n,α ( P ) ≤ p A i , ∀ i ∈ [ [ t ] ] , where

and where I -1 n,α ( x ) is the inverse of the regularized beta function w.r.t Bernoulli success rate parameter.

f(x)

f(x)

g(x), alpha=0.35

g(x),alpha=0.35

g（x),alpha=0.49

口

g(x), alpha=0.49

60

40

3

E

中

口

20

X:4.090909

0

y:0.9393939

义

2

2

中

中

口

Y

-20

Z:7.081292

-40

5

1

1

口

中

口

60

4

3

X2

0

0

X1

2

D

-1

0

1

2

3

4

5

0

1

2

3

4

5

X1

X1

(a)

(b)

(c)

The above result is valid for any regression model, either with bounded or unbounded outputs, and for large or small n . Note that the performance of the base model always impacts the overall performance of the smoothed function, irrespective of whether the setting is classification or regression. In classification tasks, this strong relationship is reflected in the gap between p A and p B . If a base classifier performs poorly under input perturbations, this gap will shrink, diminishing the effectiveness of the final certification. In classification, there is only one other parameter ( σ ) that can potentially compensate for this gap. In regression settings, a similar relationship applies: better performance in the base regression model results in a better value for q . However, as demonstrated in Theorem 3, the final performance is also influenced by σ , n and importantly α . Using an appropriate value for α can significantly enhance the certification even when the base regression model performs poorly. The step-by-step process of the method in prediction and certification is depicted in Algorithm 1.

4 Experiments

This section provides some numerical results to validate the proposed theorems as well as to show their effectiveness in some real-world problems. All simulations and experiments were conducted using an Intel(R) Core(TM) i7-9750H CPU running at 2.60GHz (with a base clock speed of 2.59GHz) and 16GB of RAM.

Synthetic Simulations. For the first part of the experiments, we utilized the function f ( x ) = 10 sin(2 x 1 ) + 2( x 2 -2) 3 . Figure 3 (left) illustrates this function for the interval -1 < x 1 , x 2 < 5 . As certification is performed for each point individually, we derive the certified radii for this function at all the integer points in the considered intervals utilizing the formulas (4) and (14) with P = 0 . 8 , σ = 0 . 15 , ϵ y = 6 using ℓ 1 norm, n = 10 , 000 at two different rates of α = 0 . 35 and α = 0 . 49 . Figure 3 (middle & right) illustrates these radii in a 2D grid for the base regression model as well as its smoothed versions against both ℓ 2 and ℓ ∞ norm attacks. As it can be observed, as expected, for smoother areas these radii become larger, and an increase in α results in an increase in estimated certified radii as clear in Eq. (14). In addition to that, as expected, the certified radii become smaller as p increases in ℓ p norm attacks. Now to examine the derived radii, for each point (25 points in total which are raster ordered) we randomly select an adversarial example within the defined radius (we repeat this process) and then find the empirical probability of obtaining valid outputs using the base model and its smoothed version utilizing α -trimming filter ( α = 0 . 35 ) with the same hyperparameters with only 5 samples fed into the α -trimming filter. Figure 4 depicts the obtained empirical probabilities for both smoothed and base models in comparison to the required probability of valid outputs defined by the user ( P = 0 . 8 ). As shown, although the base regression model shows large variations in the empirical probabilities, with attacks in smaller neighborhoods, the α -trimming filter uniformly improves the empirical probability across all the evaluated points (almost equal to 1) for both types of attacks, despite adversarial examples being drawn from larger neighborhoods.

Camera Re-localization Task. In this application, we evaluate the robustness of the state-of-the-art image-based camera re-localization technique 'DSAC ∗ ' [3] against adversarial examples. In the

。

1.000

User defined P

1.000

0.975

0.975

0.950

。

0.950

0.925

。

0.900

百

0.900

User defined P

0.85-

.875

0.850

0.850

0.825

0.825

卓

0.800

0.800

Evaluated Points

Evaluated Points

(a)

(b)

1.000

口

S660

0.950

0.925

0.900

User defined P

0.875

0.850

0.825

0.800

EvaluatedPoints

(c)

camera re-localization pipeline, RGB images are fed into a trained system and the coordinates of the location where the camera was placed to take the images are predicted [21, 19]. For certifying such regression models, we use Cambridge Landmarks dataset [9] and in particular 3 of the largest scenes in this popular dataset namely Great Court, King's College, and St. Mary Church. For computing certified error for any image, we used the same formulation as in [17], given by

with K = 150 cm , and α = 0 . 35 . For learning of p A using Clopper-Pearson ( β = 0 . 5 : 75% confidence), we used 100 samples and then we used n = 10 per radius to examine ℓ 2 attack. For each scene, the adopted parameters are selected differently to cover various experimental setups.

Great Court: P = 0 . 8 , ϵ y = 5 m , output ℓ 1 norm, σ = 0 . 05 , and 760 images sized 480 × 854 .

King's College: P = 0 . 8 , ϵ y = 1 m , output ℓ 1 norm, σ = 0 . 08 , and 343 images sized 480 × 854 .

St. Mary Church: P = 0 . 9 , ϵ y = 5 m , output ℓ 1 norm, σ = 0 . 1 , and 530 images sized 480 × 854 .

Figure 5 illustrates the proposed certified radii along the predicted trajectory of the camera in the 3 considered scenes as well as sample images with no/negligible certificates. From the top: Great Court, King's College, and St. Mary Church. While brighter dots represent points with higher certificates, we did not clip the radii from below and kept the negative values as they are. Large negative radii are indicators of high expectations of users either in considered valid regions or the expected probability of success. While most of the points are highlighted with bright colors, some points are dark and considered as sensitive images which can be easily misled with a small portion of manipulation. Interestingly, all the points which are not on the trajectory of the camera, have returned negative radii. On the other hand, Figure 6 illustrates the certified median error of the proposed methods for the three scenes in comparison with the results shown in [17] for bounded and discounted outputs for the Great Court scene (discount factor makes the accepted region wider than that of the base regression model, aiming for better analytical results in worst-case scenarios). Note that results in RS-Reg [17] were obtained with 200% discount in the output validity range, and we now provide almost the same results with no discount in the output, and results are valid for a small number of samples. As shown in these plots, the α -trimming filter consistently decreased the certified median error (orange curve) across all input perturbation ranges ( r ) compared to the results obtained by the base regression model

0.05

0.00

-0.05

80

60

Ot

-0.10

20

60

80100120

0

0

20

X

0.10

0.0

0.05

0.5

1.0

0.00

Certified Radi

1.5

石

2.0

15

-20

-0.10

-25

-0.15

100

80

-35

60

40

X

20

0

-20_40

-45

-40

-0.20

0.1

-20

0.0

0

L

20

-0.1

40

60

-2.5D.5

-10

0

10

20

30

40

-0.2

X

(blue curve). The main reasons for this improvement are firstly, due to the better approximation of position parameters leveraging outlier removal and averaging using α -trimming filter. Secondly, because of better certificate radii for each image in the scene which decreases penalization in the process of certified median error calculation. Leveraging the α -trimming approach for smoothing, we are no longer worried about the output ranges, and no further assumptions such as large sample size or discount factor are required to provide a valid certificate. Sensitivity analysis of the proposed technique in this dataset can be found in Appendix E.

5 Related Work

Among the studies that adopted randomized smoothing for tasks other than classification, we can list smoothed embeddings [20] for few-shot learning models, certification of soft classifiers [25] where the output variables are continuous but bounded between 0 and 1, certification against poisoning

180

f（x),sigma=0.025

200

f（x),sigma=0.05

g(x),sigma=0.025

160

Dis.g（x),sigma=0.025

175

medianerror

140

f(x), sigma=0.05

error

120

Dis.g(x),sigma=0.05

median

150

100

125

certified

certified

80

100

60

40

75

20

50

0.00

0.02

0.04

0.06

0.08

0.10

0.00

0.02

0.04

0.06

0.08

0.10

0.12

0.14

radius

radius

250

f（x),sigma=0.08

f(x),sigma=0.1

180

g（x),sigma=0.08

225

g（x),sigma=0.1

160

200

error

error

140

175

certifiedmedian

nedian

120

150

100

certified

125

80

100

60

75

40

50

0.00

0.02

0.04

0.06

0.08

0.10

0.12

0.14

0.00

0.02

0.04

0.06

0.08

0.10

0.12

0.14

radius

radius

attacks [7] which have different threat models or learning tasks than this study. The most related works to our study are [4, 17] where in the former study, the object detection was investigated through the lens of certified regression, however, their analysis is relying on the scaling output of classifier models to expand the range of output values which constrains the architecture of considered models, and in the latter the certification was provided for a class of bounded output regression model in the asymptotic case. Compared to these methods, our approach provides a probabilistic certificate for all regression models (including models with a wide range of outputs) with a limited number of evaluations through drawing noisy samples.

6 Conclusion

In this paper, we proposed the first probabilistic certificate against ℓ p attack for all regression models with continuous output. We showed that the α -trimming filter is an appropriate smoothing candidate in regression models with the flexibility to trade-off between error rate and certification radii. In addition to the comprehensive synthetic simulations, we adopted the proposed method in the camera re-localization task using the Cambridge Landmarks dataset and benchmarked the result for this new line of research. As future work, this technique can be extended to attacks in the semantic space of the input, and for sampling techniques other than Gaussian sampling to further tighten the certificate radii.

Broader Impact Adversarial examples demonstrate the vulnerability of many machine learning models to manipulation in contested environments. This paper considers defenses (via randomized smoothing) and robustness quantification (via robustness certificates), which are important approaches to improving resistance to attacks, and in highlighting the limitations of learned models to practitioners. As such, we believe this work has potential for positive societal benefit.

References

Bednar, J., Watt, T.: Alpha-trimmed means and their relationship to median filters. IEEE Transactions on Acoustics, Speech, and Signal Processing 32 (1), 145-153 (1984)

Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šrndi´ c, N., Laskov, P., Giacinto, G., Roli, F.: Evasion attacks against machine learning at test time. In: European Conference on Machine Learning and Knowledge Discovery in Databases. pp. 387-402 (2013)

Brachmann, E., Rother, C.: Visual camera re-localization from RGB and RGB-D images using DSAC. IEEE Transactions on Pattern Analysis and Machine Intelligence 44 (9), 5847-5865 (2022)

Chiang, P.y., Curry, M., Abdelkader, A., Kumar, A., Dickerson, J., Goldstein, T.: Detection as regression: Certified object detection with median smoothing. Advances in Neural Information Processing Systems 33 , 1275-1286 (2020)

Cinà, A.E., Grosse, K., Demontis, A., Vascon, S., Zellinger, W., Moser, B.A., Oprea, A., Biggio, B., Pelillo, M., Roli, F.: Wild patterns reloaded: A survey of machine learning security against training data poisoning. ACM Computing Surveys 55 (13s), 1-39 (2023)

Cohen, J., Rosenfeld, E., Kolter, Z.: Certified adversarial robustness via randomized smoothing. In: International Conference on Machine Learning. pp. 1310-1320. PMLR (2019)

Hammoudeh, Z., Lowd, D.: Reducing certified regression to certified classification for general poisoning attacks. In: 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). pp. 484-523. IEEE (2023)

Huang, Z., Marchant, N.G., Lucas, K., Bauer, L., Ohrimenko, O., Rubinstein, B.I.: RS-Del: Edit distance robustness certificates for sequence classifiers via randomized deletion. In: Thirtyseventh Conference on Neural Information Processing Systems (2023)

Kendall, A., Grimes, M., Cipolla, R.: PoseNet: A convolutional network for real-time 6-DOF camera relocalization. In: Proceedings of the IEEE International Conference on Computer Vision. pp. 2938-2946 (2015)

Krizhevsky, A., Sutskever, I., Hinton, G.E.: ImageNet classification with deep convolutional neural networks. In: Advances in Neural Information Processing Systems (2012)

Kumar, A., Levine, A., Goldstein, T., Feizi, S.: Curse of dimensionality on randomized smoothing for certifiable robustness. In: International Conference on Machine Learning. pp. 5458-5467. PMLR (2020)

Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., Jana, S.: Certified robustness to adversarial examples with differential privacy. In: 2019 IEEE Symposium on Security and Privacy (SP). pp. 656-672. IEEE (2019)

Lee, G.H., Yuan, Y., Chang, S., Jaakkola, T.: Tight certificates of adversarial robustness for randomly smoothed classifiers. Advances in Neural Information Processing Systems 32 (2019)

Li, B., Chen, C., Wang, W., Carin, L.: Second-order adversarial attack and certifiable robustness (2018)

Li, L., Xie, T., Li, B.: SoK: Certified robustness for deep neural networks. In: 2023 IEEE Symposium on Security and Privacy (SP). pp. 1289-1310. IEEE (2023)

Liu, J., Levine, A., Lau, C.P., Chellappa, R., Feizi, S.: Segment and complete: Defending object detectors against adversarial patch attacks with robust patch detection. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 14973-14982 (2022)

Miri Rekavandi, A., Ohrimenko, O., Rubinstein, B.I.: RS-Reg: Probabilistic and robust certified regression through randomized smoothing. arXiv preprint arXiv:2405.08892 (2024)

Mohapatra, J., Ko, C.Y., Weng, T.W., Chen, P.Y., Liu, S., Daniel, L.: Higher-order certification for randomized smoothing. Advances in Neural Information Processing Systems 33 , 4501-4511 (2020)

Nadeem, U., Bennamoun, M., Togneri, R., Sohel, F., Miri Rekavandi, A., Boussaid, F.: Cross domain 2D-3D descriptor matching for unconstrained 6-DOF pose estimation. Pattern Recognition 142 , 109655 (2023)

Pautov, M., Kuznetsova, O., Tursynbek, N., Petiushko, A., Oseledets, I.: Smoothed embeddings for certified few-shot learning. Advances in Neural Information Processing Systems 35 , 2436724379 (2022)

Rekavandi, A.M., Boussaid, F., Seghouane, A.K., Bennamoun, M.: B-Pose: Bayesian deep network for camera 6-DoF pose estimation from RGB images. IEEE Robotics and Automation Letters (2023)

Rekavandi, A.M., Seghouane, A.K., Abed-Meraim, K.: TRPAST: A tunable and robust projection approximation subspace tracking method. IEEE Transactions on Signal Processing 71 , 2407-2419 (2023)

Rekavandi, A.M., Seghouane, A.K., Evans, R.J.: Robust subspace detectors based on α -divergence with application to detection in imaging. IEEE Transactions on Image Processing 30 , 5017-5031 (2021)

Rekavandi, A.M., Seghouane, A.K., Evans, R.J.: Learning robust and sparse principal components with the α -divergence. IEEE Transactions on Image Processing (2024)

Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., Yang, G.: Provably robust deep learning via adversarially trained smoothed classifiers. Advances in Neural Information Processing Systems 32 (2019)

Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. In: International Conference on Learning Representations (2014)

Tanielian, U., Biau, G.: Approximating Lipschitz continuous functions with GroupSort neural networks. In: International Conference on Artificial Intelligence and Statistics. pp. 442-450. PMLR (2021)

Teng, J., Lee, G.H., Yuan, Y.: ℓ 1 adversarial robustness certificates: a randomized smoothing approach (2019)

Wheeden, R.L., Zygmund, A.: Measure and integral, vol. 26. Dekker New York (1977)

Yang, G., Duan, T., Hu, J.E., Salman, H., Razenshteyn, I., Li, J.: Randomized smoothing of all shapes and sizes. In: International Conference on Machine Learning. pp. 10693-10705. PMLR (2020)

Zhang, D., Ye, M., Gong, C., Zhu, Z., Liu, Q.: Black-box certification with randomized smoothing: A functional optimization based framework. Advances in Neural Information Processing Systems 33 , 2316-2326 (2020)

Zoubir, A.M., Koivunen, V., Chakhchoukh, Y., Muma, M.: Robust estimation in signal processing: A tutorial-style treatment of fundamental concepts. IEEE Signal Processing Magazine 29 (4), 61-80 (2012)

A Proof of Robustness in f θ ( x ) against ℓ p attack

We repeat the proposition's statement here for convenience, followed by its proof.

Proposition 1: (Certification of f θ ( x ) Against ℓ p Attack). Let f θ ( x ) : R d → R t be a (possibly) randomized base regressor and e ∼ N ( 0 , σ 2 I ) . Suppose

where p A i is the lower bound on the probability of accepting prediction in i th output variable. Then using (2) as the definition of certified robustness, f θ ( x + δ + e ) , ∀∥ δ ∥ p ≤ ϵ x ( p ≥ 2 ) is within the accepted region, with the user-defined probability P ≤ p A i , ∀ i ∈ [ [ t ] ] , where

Proof. For any x , y ∈ R d , let us define x ∗ y = ( x i y i ) i =1 , ··· ,d ∈ R d . Then using the generalization of Hoelder inequality [29], for any p, q, r ∈ [1 , ∞ ) such that 1 p + 1 q = 1 r , we have ∥ x ∗ y ∥ r ≤ ∥ x ∥ p ∥ y ∥ q . By setting x = δ and y = 1 d , we obtain ∥ δ ∥ r ≤ d 1 r -1 p ∥ δ ∥ p , (with 1 q = 1 r -1 p ). Using this inequality, and by setting r = 2 , the constraint ( p ≥ 2 ), and the results in Theorem 1, we conclude that if d 1 2 -1 p ∥ δ ∥ p ≤ min i ∈ [ [ t ] ] σ ( Φ -1 ( p A i ) -Φ -1 ( P ) ) , the output value is valid with probability at least P. This completes the proof.

B Proof of Robustness for g α ( x )

We repeat the theorem's statement here for convenience, followed by its proof.

Theorem 2: (Certification of g α ( x ) for fixed range ℓ p Attack). Let f θ ( x ) : R d → R t be a (possibly) randomized base regressor, and let g α ( x ) be the one defined in (8) with 0 ≤ α ≤ 1 / 2 . Let us assume the accepted region (set) for each output target variable is convex and the following inequality holds for e ∼ N ( 0 , σ 2 I ) , a user-defined ϵ y and ∀∥ δ ∥ p ≤ ϵ x ( p ≥ 2 ) and ∀ i ∈ [ [ t ] ] :

where 0 ≤ q ≤ 1 , then ∀ n > 0 we have

where I q ( a, b ) is the regularized incomplete beta function defined as I q ( a, b ) = 1 B ( a,b ) ∫ q 0 t a -1 (1 -t ) b -1 dt and B ( a, b ) is the complete beta function.

Proof. The proof of this theorem is based on the problem's geometry and admitting that simple averaging is prone to be shifted outside of the accepted set, only if a single large sample exists in the remaining samples after applying α -trimming. To prove the result, we consider the worst-case scenario and derive the lower bound probability of getting an accepted output within the desired range defined by users. Let us define a random variable W as the number of rejected outputs by the user (invalid outputs) after drawing n samples and passing then through the network f θ ( . ) . For a scalar output variable, three possible scenarios will occur after sorting output values, (i) all rejected outputs will be on the left side of the accepted region, (ii) all rejected outputs will be on the right side of the accepted region, (iii) rejected outputs will be both on the left and right with different portions. Figure 7 illustrates the geometry of these scenarios. Note that since the accepted zone is convex (green region), all the accepted outputs will be next to each other after sorting. As shown in (8), the trimming will be applied equally from both sides, so in the worst-case scenario (scenarios (i) and (ii)) both accepted and rejected outputs will be filtered with the same rate. In this case, in total 2[ αn ] outputs will be filtered out ( [ αn ] accepted outputs and [ αn ] rejected outputs) where the total number of leftover samples will be n -2[ αn ] . Now let us consider two cases:

1. The case W > [ αn ] : In this case after applying α -trimming, still W -[ αn ] rejected samples will remain in the bag (set of leftover data points after applying α -trimming filter) to be averaged, and

GeneralScenario

Fi+1

Fi+2

A

A

A

ff

JJ

fθ(x)

y

α-trimming（[an]samples)

α-trimming（[an]samples)

WorstCaseScenario

FFi

Fi+1

Fi+2

7

A

H

A

XffX

fe(x)

y

α-trimming（[an]samples)

α-trimming（[an]samples)

since in the worst-case scenario one single sample is enough to push the average value outside the accepted region, for this case we consider

2. The case W ≤ [ αn ] : In this case, there will be no rejected samples left in the bag to push the average outside the acceptable zone. Since all the output values are already within the convex set, the average value is also within the set and the average will always be valid to the user. Therefore, in this case,

The only variable that can put us in either of these two disjoint scenarios is the random variable W ( n and α are predefined values), which follows a Binomial distribution and in worst case scenario the success rate is q as assumed in Theorems's statement, i.e., W ∼ Bin ( n, 1 -q ) . Hence, ∀ i ∈ [ [ t ] ] we have

where I q ( a, b ) is the regularized incomplete beta function defined as I q ( a, b ) = 1 B ( a,b ) ∫ q 0 t a -1 (1 -t ) b -1 dt to compute the cumulative distribution of a binomial distribution where B ( a, b ) is the complete beta function.

C Robustness Improvement via α -trimming

We repeat the proposition's statement here for convenience, followed by its proof.

Proposition 2: (Robustness Improvement via α -trimming). For any n ≥ 1 , 0 ≤ q ≤ 1 , if there exist an α such that α + ≤ α < 1 / 2 , where

and where I -1 q ( q ) is the inverse of I q ( n -x, x +1) with respect to x , then the following inequality holds:

Proof. Note that I q ( n -x, x + 1) where x ∈ Z + , is the CDF of W ∼ Bin ( n, 1 -q ) , and is a monotonically increasing function with respect to x . To guarantee that the outcome CDF is greater than q , we first need to find the corresponding x which achieves equality, and then find the region where the inequality is always correct. To find the smallest x , we solve

Knowing that in our formulation x corresponds to [ αn ] , then to meet the Equality (24), α is required to meet

For a fixed n and q , this means the inequality I q ( n -[ αn ] , [ αn ] + 1) ≥ q holds if we select an α such that it satisfies α ≥ I -1 q ( q ) -1 / 2 n and this completes the proof.

D Certification of g α ( x )

We repeat the theorem's statement here for convenience, followed by its proof.

Theorem 3: (Certification of g α ( x ) against ℓ p Attack). Let f θ ( x ) : R d → R t be a deterministic or random base regressor and let n ≥ 1 , 0 ≤ α < 1 / 2 , e ∼ N ( 0 , σ 2 I ) and suppose the α -trimming function g α ( x ) defined in (8) is used for smoothing. Then given

where p A i is the lower bound on the probability of accepting prediction in the i th output variable, then g α ( x + δ ) , ∀∥ δ ∥ p ≤ ϵ x ( p ≥ 2 ) is within accepted region, i.e., N y ( y , ϵ y ) = ∏ t i =1 N y ( y i , ϵ y i ) , with the user-defined probability P , s.t. I -1 n,α ( P ) ≤ p A i , ∀ i ∈ [ [ t ] ] , where

and where I -1 n,α ( x ) is the inverse of the regularized beta function w.r.t Bernoulli success rate parameter.

Proof. We consider the following chain to derive this upper bound on the ℓ p norm of δ .

Based on the Proposition 1, if we select ∥ δ ∥ p ≤ min i ∈ [ [ t ] ] σ d 1 2 -1 p ( Φ -1 ( p A i ) -Φ -1 ( q ) ) , then f θ ( x ) is valid with probability q , and then based on results in Theorem 2, g α ( x ) changes this probability

200

200

180

180

certified medianerror

160

certifiedmeanerror

160

140

140

120

120

100

100

80

80

60

60

40

40

20

20

0

0

0

0.025

0.05

0.075

0.1

0.125

0.15

0

0.025

0.05

0.075

0.1

0.125

0.15

r

r

n_tr=50

n_tr=100

n_tr=200

n_tr=50

n_tr=100

n_tr=200

200

200

180

180

certified medianerror

160

meanerror

160

140

140

120

120

100

100

certifiedr

80

80

60

60

40

40

20

20

0

0

0

0.025

0.05

0.075

0.1

0.125

0.15

0

0.025

0.05

0.075

0.1

0.125

0.15

n=10

n=30

n=10

n=30

into I q ( n -[ αn ] , [ αn ] + 1) for a fixed α and n , Therefore, if one asks the g α ( x ) to be valid with probability P , we first solve

for 0 ≤ q ≤ 1 . Note that I q ( n -[ αn ] , [ αn ] + 1) ∝ ∫ q 0 t n -[ αn ] -1 (1 -t ) [ αn ] dt and the right hand side is monotonically increasing function w.r.t q when n and α are fixed. Therefore, we can define the inverse I -1 n,α ( x ) = q such that I q ( n -[ αn ] , [ αn ] + 1) = x . Then, knowing this inverse, we can directly use Proposition 1 to find the bound on ∥ δ ∥ p , and this completes the proof.

E Sensitivity Analysis

In this section, we perform a sensitivity analysis of the proposed robust certification technique for the hyperparameters involved in our mechanism. The parameters under evaluation are number of samples to estimate p A ( n tr ), number of samples for α -trimming filter ( n ), rate of filtering ( α ), and confidence level parameter ( β ). We use the Great Court scene with 50 randomly selected images for examination with the size of 480 × 854 . The default parameters are K = 150 cm , α = 0 . 35 , β = 0 . 5 , n tr = 100 , n = 10 , P = 0 . 8 , ϵ y = 5 m using ℓ 1 norm in output, σ = 0 . 05 , with robustness against ℓ 2 attack. For each parameter, we only change the parameter of interest and keep the other fixed.

n tr : This is the parameter that determines the quality of the estimated P A i . In the reported empirical results, this parameter was set to 100 . Here we examine the performance for values in the set { 50 , 100 , 200 } and report the certified median/mean error curve. Generally, we expect by increasing n tr no changes occur in the tails of the certified mean/median since this only determines how reliable the observed number of valid outputs is. If n tr is small, to keep the confidence level fixed, the estimated lower bound of p A will be sacrificed, and that means the estimated radii will be small. While this does not affect the curves' tails, the middle-range errors will be significantly increased due to the penalty term imposed by the range of radii. Figure 8 validates this interpretation and depicts this effect for the middle parts of the curves.

200

200

180

180

certifiedmedianerror

160

certifiedmedianerror

160

140

140

120

120

100

100

80

80

60

60

40

40

20

20

0

0

0

0.025

0.05

0.075

0.1

0.125

0.15

0

0.025

0.05

0.075

0.1

0.125

0.15

r

alpha=0.15

alpha=0.25

alpha=0.45

alpha=0.15

alpha=0.25

alpha=0.45

200

200

180

180

certifiedmedianerror

160

certifiedmeanerror

160

140

140

120

120

100

100

80

80

60

60

40

40

20

20

0

0

0

0.025

0.05

0.075

0.1

0.125

0.15

0

0.025

0.05

0.075

0.1

0.125

0.15

r

r

beta=0.5

beta=0.3

beta=0.1

beta=0.5

beta=0.3

beta=0.1

n : This parameter indicates the number of samples which is going to be drawn in the output of the base regression model to be fed into the α -trimming filter. In the experimental results, this was set to n = 10 . Here we investigate the impact of this parameter in the obtained certified median/mean error rate by choosing the values among the set { 10 , 20 , 30 } . As shown in Figure 9 the obtained results are quite stable with changes in n for the considered range.

α : Parameter α in α -trimming filter determines the rate of sample rejection on both sides of the sorted values. While in the experiments, this value was set to α = 0 . 35 , in this analysis we investigate the role of this parameter in the final error rate results by choosing the values from the { 0 . 15 , 0 . 25 , 0 . 45 } . As illustrated in Figure 10, in terms of median error, for smaller α when r is also small, we obtained a slightly better error rate because of having more samples in the average computation of the filtered values. On the other hand, increasing α leads to better certification radii and the jump to higher error rates occurred in a larger range of r values. In terms of mean error rate, increasing the value of α uniformly improved the performance because all the outliers came out of the bag of averaging.

β : This parameter indicates the amount of confidence required about the obtained results as compensation for the limited number of samples used in estimating p A i . In the experiments, this value was set to β = 0 . 5 to provide confidence of 1 -β 2 = 0 . 75 . Now we choose this value from the set { 0 . 1 , 0 . 3 , 0 . 5 } to examine the robustness of the results. We expect as we decrease β , as the result of increasing the required confidence level, the estimated lower bound of p A i , ∀ i ∈ [ [ t ] ] decreases and the certified radii decrease as a result. These smaller certified radii cause more rapid growth in the certified error rate as depicted in Figure 11.

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: The paper's main claim is a new randomized smoothing for regression models with unbounded outputs and in Sections 3 and 4, such extensions are mathematically supported and evaluated.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: The only limitation of the work that the authors are aware of is the assumption on the type of attacks, i.e., ℓ p -norm bounded attacks. This point has been mentioned in future work.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: For each statement, all the assumptions were clearly described and fully adopted in the proof steps.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: A clear step-by-step procedure for estimating the certificate radii was presented in Section 3.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: While the dataset used in this study is publicly available, the code and instructions on how to run the code is publicly available on GitHub: https://github.com/ arekavandi/Certified_adv_RRegression/ .

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: To the best of the authors' knowledge, all the critical parameters for the provided results were reported with their exact values in Section 4.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [Yes]

Justification: As the proposed method is probabilistic, the results were reported either with error bars (e.g., Figure 3) or were reported with a confidence level or were averaged over a large number of samples.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: As mentioned in the paper, all simulations and experiments were conducted using an Intel(R) Core(TM) i7-9750H CPU running at 2.60GHz (with a base clock speed of 2.59GHz) and 16GB of RAM.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: To the best of the authors' knowledge, there is no misalignment between this research and the code of ethics including but not limited to preserving anonymity, appropriate citations of other relavent studies, social impact, and privacy.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: Potential positive societal impacts of the work have been discussed in Subsection 'Broader impact' right after Conclusion.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: In this paper, the authors did not release any model, but just proposed an evaluation technique to measure models' sensitivity to adversaries.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: The studies related to the DSAC ∗ model and the evaluated dataset were appropriately cited and the URLs were provided in the GitHub page of this study.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: As mentioned in the abstract, the code and the required documentation are publicly available at https://github.com/arekavandi/Certified_adv_ RRegression/ .

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: This paper does not involve crowdsourcing nor research with human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: This paper does not involve crowdsourcing nor research with human subjects. Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper considers randomized smoothing for (unbounded) regression models. An $\\alpha$-trimming procedure is proposed in order to increase certification strength. Experiments to illustrate the effectiveness of the approach are conducted on synthetic datasets as well as camera re-localization tasks.\n\nSTRENGTHS:\nThe problem of scaling up certified robustness (e.g., via randomized smoothing-based methods) to regression models is an important one to consider, and is certainly of interest to the Neurips audience.\n\nWEAKNESSES:\nOverall, the paper could use an extensive revision and polishing. There is quite a bit of terminology used throughout the paper that is not clearly defined, and the assumptions underlying some of the mathematical results are not made explicit/clear. In particular, some language from classification seems to be infiltrating the supposed regression setting of this paper, which makes things very difficult to understand. The paper seems to be heavily dependent on [17], with the only notable novelty being the incorporation of $\\alpha$-trimming into the smoothing framework.\n\nSee the Questions section below.\n\nQUESTIONS:\n1. Line 68: You mention the prior works [17, 19, 7, 4, 16] that develop smoothing methods for regression models very briefly, and assert that they all suffer from limitations. However, more explanation is needed to distinguish your contributions from theirs. I suggest including more in-depth discussion on the contributions of these works, and clarify how your method differs/overcomes their particular limitations.\n2. In the introduction, you use the acronym CR to denote \"certified robustness,\" but in Section 3, you use CR to denote \"certified regression.\" Please only use this acronym to denote one thing throughout the paper.\n3. Lines 93 and 116: \"...is the lower bound on the probability of accepting prediction in ith output variable.\" What does this mean? If we're dealing with regression models, what does \"accepting prediction\" of a particular output variable mean?\n4. Line 118: What is the \"accepted region\"?\n5. Line 118: So does Proposition 1 not apply to $\\ell_1$ threats?\n6. Figure 1: I don't find this figure particularly enlightening/explanatory. For example, what is the index $m$ here? Also, what is the index $k$ here? In your explanation of $\\alpha$-trimming, you use $k$ to denote an arbitrary index (after computing the order statistics). Furthermore, why is the region around $y_{1:k}$ nonconvex, but the region around $y_{m:t}$ convex? In your Theorem 2 statement, you assume that the \"accepted region\" (again, this is not clearly defined anywhere) for each output is convex. Finally, what is the difference between the outputs and regions ($y_{1:k}$, $y_{m:t}$, and their green regions) within the red dashed box, and those same outputs and regions outside the red dashed box?\n7. Line 150: \"...the following equality holds...\" I think you mean inequality.\n8. Line 151: What is $q$ in (9)? Is this allowed to be any real number in $[0,1]$?\n9. Line 157: Is it ever possible for the change from $q$ to $I_q(n-[\\alpha n], n+[\\alpha n])$ to be a decrease?\n10. Theorem 2: One of the powers of randomized smoothing (for classification) is that it allows us to \"robustify\" a non-robust base classifier. However, it seems like the strength of your robustness certificate for your smoothed classifier depends heavily on the underlying robustness of the base classifier. That is, it appears as though in order for your smoothed classifier to have a high level of robustness, you need your base classifier to have a high level of robustness. Can you please discuss and clarify these aspects? If this interpretation is correct, this could result in significant limitations.\n11. Algorithm 1, Linw 5: What does it mean for a continuous-valued regression prediction to be \"correct\"? Isn't the \"correct\" output for a given input a singleton in $\\mathbb{R}^t$ and hence a measure-zero set?\n12. Line 249/Section 5: I suggest moving this paragraph to around Lines 68--71 to better clarify your contributions at the outset.\n\nLIMITATIONS:\nN/A.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2024-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nPrior work extends the notion of a 'certified robustness radius' from classification tasks to a regression task. The prior state-of-the art for calculating these certified robustness bounds in the regression setting had a major shortfall: it exhibited major instabilities when applied to values with an unbounded range. This paper suggests a method that is better conditioned for unbounded random variables.\n\nSTRENGTHS:\nThe authors identify a popular bound in the classification case that currently does not have a practical analog for regression. They then develop a technique for extending such a bound to regression.\n\nWEAKNESSES:\n1. The authors write that the method suggested by prior work in [17] fails for unbounded quantities in regression because it is 'unstable' however, they do not back up this claim. It would be nice if the authors could demonstrate this with experiments or explain why the method of [17] could not be expected to work for unbounded quantities.\n\n2. There were some important terms that were not defined at all, like \"accepted region\" and \"bag\" in the appendix.\n\nQUESTIONS:\nSuggestions/ Questions:\n\nline 19: I suggest you note that adversarial training does provide some defense\n\n\nline 43: it's not clear what 'normalized' $z$ means here\n\n\nlines 126-128: I couldn't understand what this meant\n\n\nfigure 2: I'm having a hard time interpreting b and c. What is the blue line? what is the function $g$?\n\n\nsection 3.3: it seems that the data points between the $\\alpha$th and $1-\\alpha$th percentiles are what you call the ``accepted region\" make sure the \"accepted region\" is defined!\n\n\n\nline 228: % is in the wrong place\n\nLIMITATIONS:\nIt seems that there is a lot of prior work on $\\alpha$ filtering in other contexts. Is it discussed when $\\alpha$ filtering tends to work well/ not work well?", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work extends current randomized smoothing on the regression task via the $\\alpha$-trimming filter. A new probabilistic certificate bound for is given against the $l_p$ norm attack for all regression models with the unconstrained output. Comprehensive synthetic simulations and evaluation on the real-world camera re-localization task are conducted to demonstrate the effectiveness of the proposed method\n\nSTRENGTHS:\n1. This work gives good theoretical insights and rigorous proof.\n\n2. The derived certification bound is valid for any regression model with bounded or unbounded output.\n\nWEAKNESSES:\n**Give more straightforward examples for equation (12).** As the main improvement brought by $\\alpha-$ trimming filter lies on $I_{n,\\alpha}^{-1}(P)$, it is recommended to give a more straightforward illustration of the situation when $I^{-1}_{n,\\alpha}(P)$  provides better certified robustness than $P$, such as a curve or a table which shows different certified bound with different $P$ and $\\alpha$.\n\n**More explanation in Figures 4 and 5.** In Figure 4, after reading the experiment part, I still feel confused about why the predicted location of the camera is a trajectory but not a point. Moreover, I have not found any further explanation for Figure 5. It's recommended to explain the experiment results more which may help readers understand easier.\n\n**Lack of comparative results.** This work lacks comprehensive comparative results with other certified robustness methods designed for the regression model.\n\nQUESTIONS:\nI am curious about the probability calculated from equation (6) and (9). Is there a closed-form solution to get the probability or is the probability gotten by sampling? If is by sampling, will the sampling brought by smoothing delay the prediction process of the regression model?\n\nLIMITATIONS:\nSee the weakness.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-12"}