Hello and welcome to the presentation of the paper on certifiably adversarily robust detection of all of the distribution data that I did together with Alex Mankke and Matthias Haien at Uni tubing in. When we have a deep neural network classifier for C410, there is trained for distinguishing dogs and mine other classes like cats and chips and we now feed an input into this classifier that does not belong to any of these classes, like to simply see here on the right. Then the model is often still very confident that it classifies this input correctly, like here it is 100% certain that the chimpanzee is a dog. We call such inputs out of distribution, short OOD, and by confidence we mean the highest predicted probability in any of the classes. One problem with such high confidence predictions is that the model does not recognize that it operates outside of its specification and should trigger human intervention or for example if it's the self-driving vehicle it should better slow down. Now there are approaches like outlay exposure that produce models that do have low confidence on OOD inputs but for those models it can still be possible to construct imperceptible perturbations, to have it images like the slightly manipulated chimpanzee here on the right. Where even outlay exposure has 100% confidence. What we now aim to do is to guarantee that no such high confidence perturbation exists and for this we regard the context of an L infinity threat model which means that each individual pixel value can be changed by up to a certain epsilon to maximize confidence and then we look at the worst confidence that can occur this way. Using interval bound propagation we derive mathematical upper bounds on the confidence and then during training we minimize those upper bounds on OOD inputs and at the same time we keep the cross entropy loss on the indistribution. What we get from this procedure are good models that indeed provide low confidence guarantees on many kinds of OOD inputs and those guarantees even generalize to new distributions that have never been seen during training. While other programmable robustness methods severely worsen test error with good there is almost no drop in indistribution accuracy. Finally regarding the quality of the guarantees the guarantees are often better than worst case samples we can find for standard methods. For example we can guarantee that no small perturbation increases the confidence of good on this chimpanzee above 22.7%.