Original: C ERTIFIABLY
Revised: C ERTIFIABLY

Original: R OBUST
Revised: R OBUST

Original: T RANSFORMERS
Revised: T RANSFORMERS

Original: WITH 1L IPSCHITZ S ELF -A TTENTION
Revised: WITH 1L IPSCHITZ S ELF -A TTENTION

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Recent works have shown that neural networks with Lipschitz constraints will lead to high adversarial robustness.
Revised: Recent works have shown that neural networks with Lipschitz constraints will lead to high adversarial robustness.

Original: In this work, we propose the first One-Lipschitz
Revised: In this work, we propose the first One-Lipschitz

Original: Self-Attention (OLSA) mechanism for Transformer models.
Revised: Self-Attention (OLSA) mechanism for Transformer models.

Original: In particular, we first orthogonalize all the linear operations in the self-attention mechanism.
Revised: In particular, we first orthogonalize all the linear operations in the self-attention mechanism.

Original: We then bound the overall Lipschitz constant by aggregating the Lipschitz of each element in the softmax with weighted sum.
Revised: We then bound the overall Lipschitz constant by aggregating the Lipschitz of each element in the softmax with weighted sum.

Original: Based on the proposed self-attention mechanism, we construct an OLSA Transformer to achieve model deterministic certified robustness .
Revised: Based on the proposed self-attention mechanism, we construct an OLSA Transformer to achieve model deterministic certified robustness .

Original: We evaluate our model on multiple natural language processing (NLP) tasks and show that it outperforms existing certification on Transformers, especially for models with multiple layers.
Revised: We evaluate our model on multiple natural language processing (NLP) tasks and show that it outperforms existing certification on Transformers, especially for models with multiple layers.

Original: As an example, for 3-layer Transformers we achieve an ℓ 2 deterministic certified robustness radius of 1.733 and 0.979 on the word embedding space for the Yelp and SST dataset, while the existing SOTA certification baseline of the same embedding space can only achieve 0.061 and 0.110.
Revised: As an example, for 3-layer Transformers we achieve an ℓ 2 deterministic certified robustness radius of 1.733 and 0.979 on the word embedding space for the Yelp and SST dataset, while the existing SOTA certification baseline of the same embedding space can only achieve 0.061 and 0.110.

Original: In addition, our certification is significantly more efficient than previous works, since we only need the output logits and Lipschitz constant for certification.
Revised: In addition, our certification is significantly more efficient than previous works, since we only need the output logits and Lipschitz constant for certification.

Original: We also fine-tune our OLSA Transformer as a downstream classifier of a pre-trained
Revised: We also fine-tune our OLSA Transformer as a downstream classifier of a pre-trained

Original: BERT model and show that it achieves significantly higher certified robustness on
Revised: BERT model and show that it achieves significantly higher certified robustness on

Original: BERT embedding space compared with previous works (e.g. from 0.071 to 0.
Revised: BERT embedding space compared with previous works (e.g. from 0.071 to 0.

Original: on the QQP dataset).
Revised: on the QQP dataset).

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep neural networks (DNNs) have been widely applied in different domains in recent years, including face recognition (He et al., 2016), machine translation (Bahdanau et al., 2014), and recommendation systems (Zhang et al., 2019b).
Revised: Deep neural networks (DNNs) have been widely applied in different domains in recent years, including face recognition (He et al., 2016), machine translation (Bahdanau et al., 2014), and recommendation systems (Zhang et al., 2019b).

Original: Specifically, on natural language processing (NLP) tasks, Transformer models (Vaswani et al., 2017) have been proposed and achieved outstanding performance on a variety of tasks.
Revised: Specifically, on natural language processing (NLP) tasks, Transformer models (Vaswani et al., 2017) have been proposed and achieved outstanding performance on a variety of tasks.

Original: Despite its impressive performance, people have shown that these
Revised: Despite its impressive performance, people have shown that these

Original: NLP models suffer from adversarial attacks (Zhang et al., 2020), where an adversary can intentionally inject unnoticeable perturbations on the inputs to fool the model to provide incorrect predictions.
Revised: NLP models suffer from adversarial attacks (Zhang et al., 2020), where an adversary can intentionally inject unnoticeable perturbations on the inputs to fool the model to provide incorrect predictions.

Original: Several works have been proposed to improve the empirical robustness of Transformers (Alzantot et al., 2018), but few have studied its certified robustness, i.e. theoretically guarantee that the model will not be attacked under certain conditions (e.g. within some perturbation range).
Revised: Several works have been proposed to improve the empirical robustness of Transformers (Alzantot et al., 2018), but few have studied its certified robustness, i.e. theoretically guarantee that the model will not be attacked under certain conditions (e.g. within some perturbation range).

Original: Recently, Shi et al.
Revised: Recently, Shi et al.

Original: (2020) proposes to rely on bound-propagation techniques to derive certified robustness for
Revised: (2020) proposes to rely on bound-propagation techniques to derive certified robustness for

Original: Transformers, which leads to a relatively loose bound and cannot certify on deep models given the looseness induced by propagating from each component in the attention.
Revised: Transformers, which leads to a relatively loose bound and cannot certify on deep models given the looseness induced by propagating from each component in the attention.

Original: In this work, we propose a One-Lipschitz Self-Attention (OLSA) algorithm which provides a robustness certificate for Transformers by bounding the Lipschitz constant of the model.
Revised: In this work, we propose a One-Lipschitz Self-Attention (OLSA) algorithm which provides a robustness certificate for Transformers by bounding the Lipschitz constant of the model.

Original: The
Revised: The

Original: Lipschitz constant of a model is naturally related to its robustness, as both require that model’s output should not change much when the input slightly changes.
Revised: Lipschitz constant of a model is naturally related to its robustness, as both require that model’s output should not change much when the input slightly changes.

Original: Previous works (Tsuzuku et al., 2018;
Revised: Previous works (Tsuzuku et al., 2018;

Original: Singla and Feizi, 2021) have investigated the 1-Lipschitz property on fully-connected and convolution neural networks, but the study of 1-Lipschitz on Transformer remains unexplored as its complicated non-linear self-attention mechanism are difficult to analyze and constrain.
Revised: Singla and Feizi, 2021) have investigated the 1-Lipschitz property on fully-connected and convolution neural networks, but the study of 1-Lipschitz on Transformer remains unexplored as its complicated non-linear self-attention mechanism are difficult to analyze and constrain.

Original: Thus, in this work, we will propose the first 1-Lipschitz Transformer network which allows us to achieve tighter deterministic certified robustness against adversarial attacks under different settings (e.g., training from scratch and fine-tuning).
Revised: Thus, in this work, we will propose the first 1-Lipschitz Transformer network which allows us to achieve tighter deterministic certified robustness against adversarial attacks under different settings (e.g., training from scratch and fine-tuning).

Original: In order to bound the Lipschitz of a self-attention layer, we will first enforce all the linear operations (keys, queries, values) to be orthogonal via re-parametrization techniques (Huang et al., 2020).
Revised: In order to bound the Lipschitz of a self-attention layer, we will first enforce all the linear operations (keys, queries, values) to be orthogonal via re-parametrization techniques (Huang et al., 2020).

Original: Next, we will upper bound the input norm by normalizing the word embedding layer.
Revised: Next, we will upper bound the input norm by normalizing the word embedding layer.

Original: As a result, we will be able to bound the overall Lipschitz by aggregating the change on each component of the softmax weighted sum.
Revised: As a result, we will be able to bound the overall Lipschitz by aggregating the change on each component of the softmax weighted sum.

Original: Finally, we add scaling factors to ensure 1-Lipschitzness of the OLSA layer.
Revised: Finally, we add scaling factors to ensure 1-Lipschitzness of the OLSA layer.

Original: In addition, we also bound the Lipschitz of the pooling layer and aggregate the component to get the final OLSA Transformer classification model.
Revised: In addition, we also bound the Lipschitz of the pooling layer and aggregate the component to get the final OLSA Transformer classification model.

Original: We evaluate our OLSA Transformer model under both train-from-scratch and fine-tuning scenarios.
Revised: We evaluate our OLSA Transformer model under both train-from-scratch and fine-tuning scenarios.

Original: In both settings, we show that OLSA achieves significantly higher certified robustness compared with existing bound-propagation-based methods (Shi et al., 2020).
Revised: In both settings, we show that OLSA achieves significantly higher certified robustness compared with existing bound-propagation-based methods (Shi et al., 2020).

Original: The improvement is larger, especially on deeper models.
Revised: The improvement is larger, especially on deeper models.

Original: For example, a 3-layer Transformer OLSA Transformer achieves an average certified radius of 1.733 on Yelp, while previous works can only achieve 0.061 under the train-fromscratch setting.
Revised: For example, a 3-layer Transformer OLSA Transformer achieves an average certified radius of 1.733 on Yelp, while previous works can only achieve 0.061 under the train-fromscratch setting.

Original: When fine-tuning over a BERT pre-trained model, OLSA Transformer achieves a radius of 0.071 on the QQP dataset while previous works can only achieve 0.368.
Revised: When fine-tuning over a BERT pre-trained model, OLSA Transformer achieves a radius of 0.071 on the QQP dataset while previous works can only achieve 0.368.

Original: In addition, we show that our certification is 10,000 × faster than previous approaches, since we do not need complicated bound propagation processes and only need one forward pass to perform the certification.
Revised: In addition, we show that our certification is 10,000 × faster than previous approaches, since we do not need complicated bound propagation processes and only need one forward pass to perform the certification.

Original: Finally, we also evaluate different methods under adversarial attacks and show that OLSA achieves much higher empirical robustness than baselines as well.
Revised: Finally, we also evaluate different methods under adversarial attacks and show that OLSA achieves much higher empirical robustness than baselines as well.

Original: Meanwhile, we acknowledge a 1% to 2% performance drop on the clean accuracy for OLSA, as we impose the extra 1-Lipschitz constraint which limits the model expressiveness slightly.
Revised: Meanwhile, we acknowledge a 1% to 2% performance drop on the clean accuracy for OLSA, as we impose the extra 1-Lipschitz constraint which limits the model expressiveness slightly.

Original: Technical contributions .
Revised: Technical contributions .

Original: We summarize our contributions as follows:
Revised: We summarize our contributions as follows:

Original: • We propose the first One-Lipschitz Self-Attention mechanism (OLSA) and prove its Lipschitz bound with corresponding analysis.
Revised: • We propose the first One-Lipschitz Self-Attention mechanism (OLSA) and prove its Lipschitz bound with corresponding analysis.

Original: • We evaluate the proposed OLSA Transformer model on various NLP tasks and observe that it outperforms the state-of-the-art baselines.
Revised: • We evaluate the proposed OLSA Transformer model on various NLP tasks and observe that it outperforms the state-of-the-art baselines.

Original: In particular, the performance gap is larger on deeper models (e.g on 3-layer Transformers on Yelp, we achieve over 25 × average certified radius than previous works).
Revised: In particular, the performance gap is larger on deeper models (e.g on 3-layer Transformers on Yelp, we achieve over 25 × average certified radius than previous works).

Original: • The OLSA model requires significantly less time to certify the robustness radius as it only requires a forward pass to calculate the prediction gap.
Revised: • The OLSA model requires significantly less time to certify the robustness radius as it only requires a forward pass to calculate the prediction gap.

Original:  R ELATED W ORK
Revised:  R ELATED W ORK

Original: Adversarial Robustness for NLP Models
Revised: Adversarial Robustness for NLP Models

Original: Existing works have shown that NLP models suffer from adversarial attacks (Zhang et al., 2019c; 2020).
Revised: Existing works have shown that NLP models suffer from adversarial attacks (Zhang et al., 2019c; 2020).

Original: Adversarial training-based approaches have been proposed to enhance the model robustness during training (Alzantot et al., 2018).
Revised: Adversarial training-based approaches have been proposed to enhance the model robustness during training (Alzantot et al., 2018).

Original: In particular,
Revised: In particular,

Original: Ren et al.
Revised: Ren et al.

Original: propose to generate adversarial examples with word saliency information.
Revised: propose to generate adversarial examples with word saliency information.

Original: To improve the efficiency of adversarial training, Wang et al.
Revised: To improve the efficiency of adversarial training, Wang et al.

Original: propose a fast gradient projection method.
Revised: propose a fast gradient projection method.

Original: Besides these empirical robustness algorithms, different approaches have been proposed to provide certified robustness on NLP models with smoothing techniques (Ye et al., 2020; Wang et al., 2021a) or boundpropagation techniques (Jia et al., 2019; Shi et al., 2020).
Revised: Besides these empirical robustness algorithms, different approaches have been proposed to provide certified robustness on NLP models with smoothing techniques (Ye et al., 2020; Wang et al., 2021a) or boundpropagation techniques (Jia et al., 2019; Shi et al., 2020).

Original: However, the smoothing techniques cannot provide deterministic certification, while the bound-propagation techniques are relatively loose and cannot certify for deep models.
Revised: However, the smoothing techniques cannot provide deterministic certification, while the bound-propagation techniques are relatively loose and cannot certify for deep models.

Original: Recently, (Xu et al., 2020) also proposes a bound-propagation-based technique for NLP models.
Revised: Recently, (Xu et al., 2020) also proposes a bound-propagation-based technique for NLP models.

Original: Their certification is against word substitution attacks and does not directly apply to our scenario.
Revised: Their certification is against word substitution attacks and does not directly apply to our scenario.

Original: Lipschitz-constrained Models and Certified Robustness The Lipschitz-constrained models have been studied for their smoothness and robustness; however, existing works all focus on constraining the Lipschitz constant for fully-connected and convolutional neural networks.
Revised: Lipschitz-constrained Models and Certified Robustness The Lipschitz-constrained models have been studied for their smoothness and robustness; however, existing works all focus on constraining the Lipschitz constant for fully-connected and convolutional neural networks.

Original: Tsuzuku et al.
Revised: Tsuzuku et al.

Original: (2018) first bridges the Lipschitz constant of a network with its robustness and propose a Lipschitz-related loss to improve model robustness.
Revised: (2018) first bridges the Lipschitz constant of a network with its robustness and propose a Lipschitz-related loss to improve model robustness.

Original: In order to achieve 1-Lipschitzness, multiple works (Cisse et al., 2017; Miyato et al., 2018; Qian and Wegman, 2018) propose to regularize the spectral norm of the linear matrices for fully-connected layers so that the Lipschitz constant is smaller than 1.
Revised: In order to achieve 1-Lipschitzness, multiple works (Cisse et al., 2017; Miyato et al., 2018; Qian and Wegman, 2018) propose to regularize the spectral norm of the linear matrices for fully-connected layers so that the Lipschitz constant is smaller than 1.

Original: For convolution neural networks, a simple approach is applied to unroll the convolution into an equivalent linear layer, but this is shown to have a loose Lipschitz bound (Wang et al., 2020).
Revised: For convolution neural networks, a simple approach is applied to unroll the convolution into an equivalent linear layer, but this is shown to have a loose Lipschitz bound (Wang et al., 2020).

Original: Recent works (Li et al., 2019; Trockman and Kolter, 2021; Singla and Feizi, 2021) have proposed to directly parametrize a 1-Lipschitz convolutional neural network which achieves a good certified robustness on vision tasks.
Revised: Recent works (Li et al., 2019; Trockman and Kolter, 2021; Singla and Feizi, 2021) have proposed to directly parametrize a 1-Lipschitz convolutional neural network which achieves a good certified robustness on vision tasks.

Original: In addition, existing activation functions such as ReLU are shown not suitable for the 1-Lipschitz models, and better activation functions such as GroupSort (Anil et al., 2019) and Householder (Singla et al., 2021) are proposed.
Revised: In addition, existing activation functions such as ReLU are shown not suitable for the 1-Lipschitz models, and better activation functions such as GroupSort (Anil et al., 2019) and Householder (Singla et al., 2021) are proposed.

Original: Kim et al.
Revised: Kim et al.

Original: (2021) indeed focuses on the Lipschitz constant of Transformer models.
Revised: (2021) indeed focuses on the Lipschitz constant of Transformer models.

Original: They propose to use ℓ 2 distance instead of multiplication in the attention mechanism and show that the Lipschitz constant of such variant can be bounded.
Revised: They propose to use ℓ 2 distance instead of multiplication in the attention mechanism and show that the Lipschitz constant of such variant can be bounded.

Original: However, they aim to analyze and provide a (not necessarily tight) upper bound of the Transformer model, but not to propose construction methods for models with small Lipschitz constants.
Revised: However, they aim to analyze and provide a (not necessarily tight) upper bound of the Transformer model, but not to propose construction methods for models with small Lipschitz constants.

Original:  B ACKGROUND 3. 1-L IPSCHITZ N EURAL N ETWORKS AND C ERTIFIED R OBUSTNESS
Revised:  B ACKGROUND 3. 1-L IPSCHITZ N EURAL N ETWORKS AND C ERTIFIED R OBUSTNESS

Original: In this work, we focus on the Lipschitz measured under ℓ 2 -norm.
Revised: In this work, we focus on the Lipschitz measured under ℓ 2 -norm.

Original: We define the Lipschitz constant of a function f : R m → R n as :
Revised: We define the Lipschitz constant of a function f : R m → R n as :

Original: [Equation]
Revised: [Equation]

Original: We can observe that the Lipschitz property of a neural network is naturally related with its robustness property – both require that the model output should not change much when the input changes by a certain magnitude.
Revised: We can observe that the Lipschitz property of a neural network is naturally related with its robustness property – both require that the model output should not change much when the input changes by a certain magnitude.

Original: Specifically, If we define the prediction margin of f on a certain input x by M f ( x ) = max i f ( x ) i − max j ̸ =argmax i f ( x ) i f ( x ) j where f ( x ) i refers to the indexing operation, then we can guarantee that f ( x ) will not change its output class within radius | x − x ′ | < M f ( x ) / ( √ 2 Lip ( f )) .
Revised: Specifically, If we define the prediction margin of f on a certain input x by M f ( x ) = max i f ( x ) i − max j ̸ =argmax i f ( x ) i f ( x ) j where f ( x ) i refers to the indexing operation, then we can guarantee that f ( x ) will not change its output class within radius | x − x ′ | < M f ( x ) / ( √ 2 Lip ( f )) .

Original: Therefore, people have proposed to enforce 1-Lipschitz for models to achieve robustness.
Revised: Therefore, people have proposed to enforce 1-Lipschitz for models to achieve robustness.

Original: Note that the Lipschitz of a composed function f ◦ g satisfies
Revised: Note that the Lipschitz of a composed function f ◦ g satisfies

Original: Lip ( f ◦ g ) ≤
Revised: Lip ( f ◦ g ) ≤

Original: Lip ( f ) Lip ( g ) .
Revised: Lip ( f ) Lip ( g ) .

Original: As a result, we can upper bound the Lipschitz of a model by bounding the Lipschitz of each layer in the neural networks.
Revised: As a result, we can upper bound the Lipschitz of a model by bounding the Lipschitz of each layer in the neural networks.

Original: 3. O RTHOGONAL L INEAR L AYER IN DNN S
Revised: 3. O RTHOGONAL L INEAR L AYER IN DNN S

Original: Consider a linear layer y
Revised: Consider a linear layer y

Original: =
Revised: =

Original: Wx where x ∈ R m , W ∈ R n × m , and y ∈ R n .
Revised: Wx where x ∈ R m , W ∈ R n × m , and y ∈ R n .

Original: People have proposed a stronger constraint to ensure the 1-Lipschitz property: to require that W is orthogonal 1 .
Revised: People have proposed a stronger constraint to ensure the 1-Lipschitz property: to require that W is orthogonal 1 .

Original: The orthogonality not only guarantees that the layer is 1-Lipschitz but also ensures that the gradient norm is preserved during the backward pass, which helps with the training stability (Anil et al., 2019).
Revised: The orthogonality not only guarantees that the layer is 1-Lipschitz but also ensures that the gradient norm is preserved during the backward pass, which helps with the training stability (Anil et al., 2019).

Original: Several works have proposed re-parametrization techniques to achieve an orthogonal linear layer.
Revised: Several works have proposed re-parametrization techniques to achieve an orthogonal linear layer.

Original: For instance, Huang et al.
Revised: For instance, Huang et al.

Original: propose to parametrize the orthogonal matrix W with an unconstrained matrix
Revised: propose to parametrize the orthogonal matrix W with an unconstrained matrix

Original: V ∈ R n × m by W =
Revised: V ∈ R n × m by W =

Original: ( V V ⊺ ) − 12 V , where the inverse square root can be calculated by Newton’s iteration.
Revised: ( V V ⊺ ) − 12 V , where the inverse square root can be calculated by Newton’s iteration.

Original: In practice, we observe that the following Newton’s iteration (Lin and Maji, 2017) achieves a more stable result in calculating the inverse square root, given Y 

Revised: In practice, we observe that the following Newton’s iteration (Lin and Maji, 2017) achieves a more stable result in calculating the inverse square root, given Y

Original: = V V ⊺ and Z 

Revised: = V V ⊺ and Z

Original: = I :
Revised: = I :

Original: [Equation]
Revised: [Equation]

Original: Z will converge quadratically to ( V V ⊺ ) − 12 when || V V ⊺ − I || 2 < 1 , which in practice is achieved by scaling the parameter V to be small.
Revised: Z will converge quadratically to ( V V ⊺ ) − 12 when || V V ⊺ − I || 2 < 1 , which in practice is achieved by scaling the parameter V to be small.

Original: Existing works focus on constraining the Lipschitz constant on such linear operation or convolution operation (which is a type of linear operator in a more compact form).
Revised: Existing works focus on constraining the Lipschitz constant on such linear operation or convolution operation (which is a type of linear operator in a more compact form).

Original: However, no one has studied the Lipschitz property of the self-attention mechanism which is a non-linear function.
Revised: However, no one has studied the Lipschitz property of the self-attention mechanism which is a non-linear function.

Original: The focus of this paper is to construct the first 1-Lipschitz Transformer model, which we will introduce next.
Revised: The focus of this paper is to construct the first 1-Lipschitz Transformer model, which we will introduce next.

Original:  O NE -L IPSCHITZ S ELF -A TTENTION (OLSA) T RANSFORMER
Revised:  O NE -L IPSCHITZ S ELF -A TTENTION (OLSA) T RANSFORMER

Original: As we can see, the property of 1-Lipschitz for neural networks can improve model smoothness and provide certified robustness.
Revised: As we can see, the property of 1-Lipschitz for neural networks can improve model smoothness and provide certified robustness.

Original: However, it is often challenging to enforce the Lipschitz constraint while maintaining a good model capacity.
Revised: However, it is often challenging to enforce the Lipschitz constraint while maintaining a good model capacity.

Original: In this section, we will introduce the first 1-Lipschitz Transformer – One-Lipschitz Self-Attention (OLSA) Transformer.
Revised: In this section, we will introduce the first 1-Lipschitz Transformer – One-Lipschitz Self-Attention (OLSA) Transformer.

Original: We will first introduce the Lipschitz property in a self-attention layer with sequential input and output.
Revised: We will first introduce the Lipschitz property in a self-attention layer with sequential input and output.

Original: Then we introduce how we achieve 1Lipschitzness for self-attention layers and pooling layers.
Revised: Then we introduce how we achieve 1Lipschitzness for self-attention layers and pooling layers.

Original: Finally, we compose these layers and construct the 1-Lipschitz Transformer model.
Revised: Finally, we compose these layers and construct the 1-Lipschitz Transformer model.

Original: 4. L IPSCHITZ P ROPERTY IN S ELF -A TTENTION P IPELINE
Revised: 4. L IPSCHITZ P ROPERTY IN S ELF -A TTENTION P IPELINE

Original: First, we describe the setting of the self-attention pipeline as follows.
Revised: First, we describe the setting of the self-attention pipeline as follows.

Original: Suppose we have a sequence of input X ≜ [ x 1 , x 2 , . . .
Revised: Suppose we have a sequence of input X ≜ [ x 1 , x 2 , . . .

Original: , x N ] where x i ∈ R d .
Revised: , x N ] where x i ∈ R d .

Original: The self-attention pipeline can be formalized as a function F : R N × d
Revised: The self-attention pipeline can be formalized as a function F : R N × d

Original: → R N × d where the output Y ≜ [ y 1 , y 2 , . . .
Revised: → R N × d where the output Y ≜ [ y 1 , y 2 , . . .

Original: , y N ] =
Revised: , y N ] =

Original: F ( X ) .
Revised: F ( X ) .

Original: Under this setting, we define the Lipschitz of the pipeline based on the overall changes in the input sequence:
Revised: Under this setting, we define the Lipschitz of the pipeline based on the overall changes in the input sequence:

Original: Definition 4.1.
Revised: Definition 4.1.

Original: Given X ≜ [ x 1 , x 2 , . . .
Revised: Given X ≜ [ x 1 , x 2 , . . .

Original: , x N ] and Y ≜
Revised: , x N ] and Y ≜

Original: [ y 1 , y 2 , . . .
Revised: [ y 1 , y 2 , . . .

Original: , y N ] =
Revised: , y N ] =

Original: F ( X ) , we define the
Revised: F ( X ) , we define the

Original: Lipschitz of the function as:
Revised: Lipschitz of the function as:

Original: [Equation]
Revised: [Equation]

Original: where || · || F denotes the Frobenius norm of a matrix.
Revised: where || · || F denotes the Frobenius norm of a matrix.

Original: We can see that such definition of Lipschitz considers the overall potential changes within the input sequence.
Revised: We can see that such definition of Lipschitz considers the overall potential changes within the input sequence.

Original: We aim to bound such Lipschitz constant of the overall model so that we can provide certified robustness for the model against perturbations on the input sequence.
Revised: We aim to bound such Lipschitz constant of the overall model so that we can provide certified robustness for the model against perturbations on the input sequence.

Original: 4. O NE -L IPSCHITZ S ELF -A TTENTION (OLSA) L AYER
Revised: 4. O NE -L IPSCHITZ S ELF -A TTENTION (OLSA) L AYER

Original: The standard self-attention mechanism Y = F ( X ) in a Transformer with input x i ’s and output y
Revised: The standard self-attention mechanism Y = F ( X ) in a Transformer with input x i ’s and output y

Original: i ’s can be formalized as:
Revised: i ’s can be formalized as:

Original: [Equation]
Revised: [Equation]

Original: In order to achieve a tight bound of the Lipschitz constant, we will make two changes to the pipeline.
Revised: In order to achieve a tight bound of the Lipschitz constant, we will make two changes to the pipeline.

Original: First, we use additive attention instead of dot-product attention in order to provide a tighter bound.
Revised: First, we use additive attention instead of dot-product attention in order to provide a tighter bound.

Original: As shown in (Vaswani et al., 2017), these two mechanisms do not differ a lot in performance.
Revised: As shown in (Vaswani et al., 2017), these two mechanisms do not differ a lot in performance.

Original: Second, we add two scaling factors α 1 and α 2 to control the Lipschitz of the model.
Revised: Second, we add two scaling factors α 1 and α 2 to control the Lipschitz of the model.

Original: The modified self-attention mechanism Y = F ( X ) is as follows:
Revised: The modified self-attention mechanism Y = F ( X ) is as follows:

Original: [Equation]
Revised: [Equation]

Original: where σ ( · ) denotes some non-linear activation function.
Revised: where σ ( · ) denotes some non-linear activation function.

Original: After we consider the multi-head mechanism with H headers, the final OLSA layer will be defined as follows:
Revised: After we consider the multi-head mechanism with H headers, the final OLSA layer will be defined as follows:

Original: Definition 4.2 (OLSA layer) .
Revised: Definition 4.2 (OLSA layer) .

Original: Given X ∈ R N × d , the OLSA layer F : R N × d → R N × d with H headers is calculated by:
Revised: Given X ∈ R N × d , the OLSA layer F : R N × d → R N × d with H headers is calculated by:

Original: [Equation]
Revised: [Equation]

Original: where { ( W Sh , W Qh , W Kh , W Vh ) } Hh =1 are model parameters in which W Sh ∈
Revised: where { ( W Sh , W Qh , W Kh , W Vh ) } Hh =1 are model parameters in which W Sh ∈

Original: R 1 × dH and
Revised: R 1 × dH and

Original: W Qh , W Kh , W Vh ∈ R dH × d .
Revised: W Qh , W Kh , W Vh ∈ R dH × d .

Original: For this mechanism, we can provide the following Lipschitz bound under the assumption that the linear transformations W ’s are orthogonal and the input norm is bounded.
Revised: For this mechanism, we can provide the following Lipschitz bound under the assumption that the linear transformations W ’s are orthogonal and the input norm is bounded.

Original: Theorem 4.1 (Lipschitz bound of OLSA layer) .
Revised: Theorem 4.1 (Lipschitz bound of OLSA layer) .

Original: Let W Q = Concat ([ W Q 1 , . .
Revised: Let W Q = Concat ([ W Q 1 , . .

Original: , W Q H ])
Revised: , W Q H ])

Original: ∈ R
Revised: ∈ R

Original: d × d denote the concatenated parameters of W Qh ’s; and W K and W V are defined similarly.
Revised: d × d denote the concatenated parameters of W Qh ’s; and W K and W V are defined similarly.

Original: Assume 1) W Q , W K , W V are orthogonal matrices; 2)
Revised: Assume 1) W Q , W K , W V are orthogonal matrices; 2)

Original: ||
Revised: ||

Original: W
Revised: W

Original: Sh || 

Revised: Sh ||

Original: = 1 for all h ∈ { 1 , . .
Revised: = 1 for all h ∈ { 1 , . .

Original: , H } ; 3) σ is a 1-Lipschitz activation function; 4) the overall input norm is bounded by || X
Revised: , H } ; 3) σ is a 1-Lipschitz activation function; 4) the overall input norm is bounded by || X

Original: || F ≤ c , then the Lipschitz constant of the function is bounded by:
Revised: || F ≤ c , then the Lipschitz constant of the function is bounded by:

Original: [Equation]
Revised: [Equation]

Original: where n is the length of the input sequence.
Revised: where n is the length of the input sequence.

Original: The main idea of the proof is to assume a perturbation δ on X , and gradually bound the perturbation from s hij ’s to y i ’s.
Revised: The main idea of the proof is to assume a perturbation δ on X , and gradually bound the perturbation from s hij ’s to y i ’s.

Original: The main non-linearity comes from the calculation of y hi which multiplies the calculated attention score p hij with the original input x j .
Revised: The main non-linearity comes from the calculation of y hi which multiplies the calculated attention score p hij with the original input x j .

Original: This can be bounded by considering the perturbation on both parts individually, noticing that the norm of both parts is bounded ( p hij is the output of SoftMax so it is norm-bounded; x j ’s norm is bounded in the assumption).
Revised: This can be bounded by considering the perturbation on both parts individually, noticing that the norm of both parts is bounded ( p hij is the output of SoftMax so it is norm-bounded; x j ’s norm is bounded in the assumption).

Original: The full proof of the theorem is shown in Appendix A. We can observe that the Lipschitz bound of the layer is related to the input sequence length and the input norm bound.
Revised: The full proof of the theorem is shown in Appendix A. We can observe that the Lipschitz bound of the layer is related to the input sequence length and the input norm bound.

Original: We will discuss how we control the input norm for each layer in Section 4.4.
Revised: We will discuss how we control the input norm for each layer in Section 4.4.

Original: Remark.
Revised: Remark.

Original: (1) We will train the orthogonal matrices parametrized with W =
Revised: (1) We will train the orthogonal matrices parametrized with W =

Original: ( V V ⊺ ) − 12 V with
Revised: ( V V ⊺ ) − 12 V with

Original: Newton’s iteration (Huang et al., 2020).
Revised: Newton’s iteration (Huang et al., 2020).

Original: (2) We would like to get a 1-Lipschitz layer such that the overall Lipschitz of the model is 1, and thus we will set α 2 = 1 + c √ N 4 α 1 .
Revised: (2) We would like to get a 1-Lipschitz layer such that the overall Lipschitz of the model is 1, and thus we will set α 2 = 1 + c √ N 4 α 1 .

Original: (3) We will set α 1 to be a trainable parameter.
Revised: (3) We will set α 1 to be a trainable parameter.

Original: Intuitively, α 1 will control the trade-off between self-attention expressiveness and linearity – when α 1 is very large, α 2 will be close to 1 so that the expressiveness of the final output is preserved, but s ij will all be close to 0, so the attention becomes a simple averaging operation; when α 1 is very small, the attention mechanism will work well, but the final output will be divided by a large α 2 , so the expressiveness of final output is limited.
Revised: Intuitively, α 1 will control the trade-off between self-attention expressiveness and linearity – when α 1 is very large, α 2 will be close to 1 so that the expressiveness of the final output is preserved, but s ij will all be close to 0, so the attention becomes a simple averaging operation; when α 1 is very small, the attention mechanism will work well, but the final output will be divided by a large α 2 , so the expressiveness of final output is limited.

Original: Comparison with the Lipschitz bound in (Kim et al., 2021)
Revised: Comparison with the Lipschitz bound in (Kim et al., 2021)

Original: In (Kim et al., 2021), the authors also propose a variant of the Transformer L2-MHA and upper bounded its Lipschitz constant with α = √ N (4 ϕ − 1 ( N − 1) + 1) · J ( W ) 2 , where J ( W ) is some term related to the spectral norm of
Revised: In (Kim et al., 2021), the authors also propose a variant of the Transformer L2-MHA and upper bounded its Lipschitz constant with α = √ N (4 ϕ − 1 ( N − 1) + 1) · J ( W ) 2 , where J ( W ) is some term related to the spectral norm of

Original: W and ϕ − 1 ( N ) grows slower than O (log N ) .
Revised: W and ϕ − 1 ( N ) grows slower than O (log N ) .

Original: Note that they only provide an upper bound of the
Revised: Note that they only provide an upper bound of the

Original: Lipschitz and do not constrain it to be small.
Revised: Lipschitz and do not constrain it to be small.

Original: We may also get a 1-Lipschitz model using their bound by orthogonalizing their weight matrices (such that J ( W ) = 1 ) and re-scaling the output with 1 /α .
Revised: We may also get a 1-Lipschitz model using their bound by orthogonalizing their weight matrices (such that J ( W ) = 1 ) and re-scaling the output with 1 /α .

Original: Theoretically, this bound is O ( √ N log N ) which is slightly favored than our bound O ( N ) 3 .
Revised: Theoretically, this bound is O ( √ N log N ) which is slightly favored than our bound O ( N ) 3 .

Original: However, 2 In (Kim et al., 2021, Theorem 3.2), the bound has a factor of 1 √ d/H , but this factor comes from the fact that they divide their output F ( X ) with (cid:112) d/H .
Revised: However, 2 In (Kim et al., 2021, Theorem 3.2), the bound has a factor of 1 √ d/H , but this factor comes from the fact that they divide their output F ( X ) with (cid:112) d/H .

Original: For a fair comparison, we do not consider this scaling factor on the output (which is α 2 in our case).
Revised: For a fair comparison, we do not consider this scaling factor on the output (which is α 2 in our case).

Original: Our bound 1 + c √ N 4 is O ( N ) because we view the embedding norm at each location
Revised: Our bound 1 + c √ N 4 is O ( N ) because we view the embedding norm at each location

Original: || x
Revised: || x

Original: i || 2 to be similar, so the input bound c
Revised: i || 2 to be similar, so the input bound c

Original: =
Revised: =

Original: ||
Revised: ||

Original: X
Revised: X

Original: || F is also O ( √ N ) .
Revised: || F is also O ( √ N ) .

Original: our bound has a significantly smaller constant factors than theirs, as we can observe the factor ofin their bound and the factor of 14 in ours.
Revised: our bound has a significantly smaller constant factors than theirs, as we can observe the factor ofin their bound and the factor of 14 in ours.

Original: As an example, under a popular case N = 20 and input norm is bounded to ||
Revised: As an example, under a popular case N = 20 and input norm is bounded to ||

Original: x
Revised: x

Original: i || 

Revised: i ||

Original: = 1 , their bound is √ N (4 ϕ − 1 ( N − 1) + 1) =
Revised: = 1 , their bound is √ N (4 ϕ − 1 ( N − 1) + 1) =

Original: 28 , while our bound is 1 + c √ N= 6 . 0 .
Revised: 28 , while our bound is 1 + c √ N= 6 . 0 .

Original: Therefore, we can actually provide a tighter Lipschitz guarantee and robustness certification in practice.
Revised: Therefore, we can actually provide a tighter Lipschitz guarantee and robustness certification in practice.

Original: We include the comparison of using this bound to construct 1-Lipschitz
Revised: We include the comparison of using this bound to construct 1-Lipschitz

Original: Transformers in Appendix D and observe that OLSA can indeed achieve higher certified robustness than directly adapting (Kim et al., 2021) for certification.
Revised: Transformers in Appendix D and observe that OLSA can indeed achieve higher certified robustness than directly adapting (Kim et al., 2021) for certification.

Original: 4. L IPSCHITZ OF P OOLING L AYER
Revised: 4. L IPSCHITZ OF P OOLING L AYER

Original: In many tasks, we need a pooling layer after several self-attention mechanisms in order to get a final embedding vector for the entire sequence: G : R n × d → R d .
Revised: In many tasks, we need a pooling layer after several self-attention mechanisms in order to get a final embedding vector for the entire sequence: G : R n × d → R d .

Original: The popular approach in standard self-attention layers is to add an extra output token into the sequence and use the embedding of that token for the overall sequence.
Revised: The popular approach in standard self-attention layers is to add an extra output token into the sequence and use the embedding of that token for the overall sequence.

Original: We intuitively find this approach a “waste of resource” in the 1-Lipschitz case – only one token value is used for pooling while others are dropped, while such information is usually important to achieve a tight bound.
Revised: We intuitively find this approach a “waste of resource” in the 1-Lipschitz case – only one token value is used for pooling while others are dropped, while such information is usually important to achieve a tight bound.

Original: In practice, we propose to use the average of all the embeddings of the pooling layer, i.e. G ( X ) =
Revised: In practice, we propose to use the average of all the embeddings of the pooling layer, i.e. G ( X ) =

Original: 1 N (cid:80) i x i .
Revised: 1 N (cid:80) i x i .

Original: We show that this approach has good Lipschitz properties:
Revised: We show that this approach has good Lipschitz properties:

Original: Theorem 4.2.
Revised: Theorem 4.2.

Original: For the pooling function G ( X ) = 1 N (cid:80) x
Revised: For the pooling function G ( X ) = 1 N (cid:80) x

Original: i , we have:
Revised: i , we have:

Original: [Equation]
Revised: [Equation]

Original: See Appendix B for the proof.
Revised: See Appendix B for the proof.

Original: Thus, we can further multiply a factor of √ N to get a 1-Lipschitz pooling layer and maximize the output expressiveness.
Revised: Thus, we can further multiply a factor of √ N to get a 1-Lipschitz pooling layer and maximize the output expressiveness.

Original: The resulting pooling layer is:
Revised: The resulting pooling layer is:

Original: [Equation]
Revised: [Equation]

Original: 4. O VERALL OLSA T RANSFORMER
Revised: 4. O VERALL OLSA T RANSFORMER

Original: Aggregating different layers we introduced above, we can construct the overall OLSA Transformer, which consists of one word embedding layer, several OLSA layers, one pooling layer and a final linear layer f : R d → R c for prediction, where c is the number of classes.
Revised: Aggregating different layers we introduced above, we can construct the overall OLSA Transformer, which consists of one word embedding layer, several OLSA layers, one pooling layer and a final linear layer f : R d → R c for prediction, where c is the number of classes.

Original: However, there are still some challenges in constructing the OLSA Transformer.
Revised: However, there are still some challenges in constructing the OLSA Transformer.

Original: The first challenge is how to bound the input norm for each self-attention layer.
Revised: The first challenge is how to bound the input norm for each self-attention layer.

Original: Note that, the norm of the output layer of self-attention layers will not increase, since it is a weighted average of all the processed input divided by a factor α 2 > 1 .
Revised: Note that, the norm of the output layer of self-attention layers will not increase, since it is a weighted average of all the processed input divided by a factor α 2 > 1 .

Original: Therefore, the norm of each layer can be bounded as long as the input to the first layer is bounded.
Revised: Therefore, the norm of each layer can be bounded as long as the input to the first layer is bounded.

Original: Thus, we will normalize the embedding vector for each token with norm c , so that the input to each self-attention layer satisfies
Revised: Thus, we will normalize the embedding vector for each token with norm c , so that the input to each self-attention layer satisfies

Original: ||
Revised: ||

Original: X || F ≤ √ Nc .
Revised: X || F ≤ √ Nc .

Original: The second challenge is how to simulate other components with 1-Lipschitz constraint in a standard Transformer.
Revised: The second challenge is how to simulate other components with 1-Lipschitz constraint in a standard Transformer.

Original: We will remove the LayerNorm and Dropout layers and we use the average y = 0 .
Revised: We will remove the LayerNorm and Dropout layers and we use the average y = 0 .

Original: 5 x + 0 .
Revised: 5 x + 0 .

Original: 5 f ( x ) instead of the residual addition connections.
Revised: 5 f ( x ) instead of the residual addition connections.

Original: We use GroupSort (Anil et al., 2019) as the activation function which is shown to work better than ReLU in 1-Lipschitz networks.
Revised: We use GroupSort (Anil et al., 2019) as the activation function which is shown to work better than ReLU in 1-Lipschitz networks.

Original: Let T : R N × d → R c denote the OLSA Transformer classification model.
Revised: Let T : R N × d → R c denote the OLSA Transformer classification model.

Original: We can calculate the certified radius on a given input X with T ( X ) and Lip ( T ) .
Revised: We can calculate the certified radius on a given input X with T ( X ) and Lip ( T ) .

Original: In particular, we can certify that the model prediction will not change within || X − X
Revised: In particular, we can certify that the model prediction will not change within || X − X

Original: ||
Revised: ||

Original: F < r where:
Revised: F < r where:

Original: [Equation]
Revised: [Equation]

Original: Comparison with the certification in (Shi et al., 2020)
Revised: Comparison with the certification in (Shi et al., 2020)

Original: As the best existing work on robustness certification for Transformers, (Shi et al., 2020) provides certification assuming that only one or two words are perturbed by the adversary.
Revised: As the best existing work on robustness certification for Transformers, (Shi et al., 2020) provides certification assuming that only one or two words are perturbed by the adversary.

Original: In particular, in their ℓ 2 certification, they provide certificates that the prediction will not change within || X − X
Revised: In particular, in their ℓ 2 certification, they provide certificates that the prediction will not change within || X − X

Original: ′ ||
Revised: ′ ||

Original: F < r , but with the restriction that X ′ differs with X on only one or two positions of word embedding.
Revised: F < r , but with the restriction that X ′ differs with X on only one or two positions of word embedding.

Original: Therefore, our work provides a more generalized ℓ 2 certification.
Revised: Therefore, our work provides a more generalized ℓ 2 certification.

Original: In addition, we explicitly impose the 1-Lipschitz constraint during training, and therefore the model is optimized to have a better certification radius; by comparison, they will directly certify on a vanilla-trained model, so their certification might not be tight, especially for relatively deep models.
Revised: In addition, we explicitly impose the 1-Lipschitz constraint during training, and therefore the model is optimized to have a better certification radius; by comparison, they will directly certify on a vanilla-trained model, so their certification might not be tight, especially for relatively deep models.

Original:  E VALUATION
Revised:  E VALUATION

Original: In this section, we compare our OLSA Transformer with the state-of-the-art baseline on different datasets under different settings.
Revised: In this section, we compare our OLSA Transformer with the state-of-the-art baseline on different datasets under different settings.

Original: We observe that our model achieves much higher certified robustness under both train-from-scratch and fine-tuning scenarios.
Revised: We observe that our model achieves much higher certified robustness under both train-from-scratch and fine-tuning scenarios.

Original: In addition, OLSA is much more efficient during the certification process.
Revised: In addition, OLSA is much more efficient during the certification process.

Original: We also evaluate our model against the empirical attacks and observe that OLSA also enhances the model empirical robustness.
Revised: We also evaluate our model against the empirical attacks and observe that OLSA also enhances the model empirical robustness.

Original: 5. E XPERIMENTAL S ETUP
Revised: 5. E XPERIMENTAL S ETUP

Original: Dataset We consider three datasets in our evaluation: Yelp (Zhang et al., 2015), SST (Socher et al., 2013) and QQP (Wang et al., 2018).
Revised: Dataset We consider three datasets in our evaluation: Yelp (Zhang et al., 2015), SST (Socher et al., 2013) and QQP (Wang et al., 2018).

Original: Yelp consists of 560,000/38,000 examples in the training/test set; SST consists of 67,349/872/1,821 examples in the training/development/test set; QQP consists of 363,846/40,430 examples in the training/test set.
Revised: Yelp consists of 560,000/38,000 examples in the training/test set; SST consists of 67,349/872/1,821 examples in the training/development/test set; QQP consists of 363,846/40,430 examples in the training/test set.

Original: Each example in Yelp and SST is a sentence labelled with a binary class for its sentiment; each example in QQP consists of two quora questions and labelled with a binary value on whether the two questions are equivalent.
Revised: Each example in Yelp and SST is a sentence labelled with a binary class for its sentiment; each example in QQP consists of two quora questions and labelled with a binary value on whether the two questions are equivalent.

Original: Implementation Details We train and evaluate our 1-Lipschitz OLSA Transformer under both trainfrom-scratch and fine-tuning scenarios.
Revised: Implementation Details We train and evaluate our 1-Lipschitz OLSA Transformer under both trainfrom-scratch and fine-tuning scenarios.

Original: In the train-from-scratch scenario, we randomly initialize the model and word embeddings and train it from scratch.
Revised: In the train-from-scratch scenario, we randomly initialize the model and word embeddings and train it from scratch.

Original: In the fine-tuning scenario, we use a pre-trained
Revised: In the fine-tuning scenario, we use a pre-trained

Original: BERT model (Devlin et al., 2018) and use its output for a downstream OLSA Transformer model.
Revised: BERT model (Devlin et al., 2018) and use its output for a downstream OLSA Transformer model.

Original: The
Revised: The

Original: BERT model is kept unchanged and we only train the downstream model.
Revised: BERT model is kept unchanged and we only train the downstream model.

Original: In the train-from-scratch setting, we use the Yelp and SST datasets which are also adopted in the baseline (Shi et al., 2020).
Revised: In the train-from-scratch setting, we use the Yelp and SST datasets which are also adopted in the baseline (Shi et al., 2020).

Original: We consider N -layer models ( N ≤ 3 ) and normalize the word embedding and position embedding to a norm of 2, so that the overall input norm is bounded by ||
Revised: We consider N -layer models ( N ≤ 3 ) and normalize the word embedding and position embedding to a norm of 2, so that the overall input norm is bounded by ||

Original: x i || 2 ≤ 4 .
Revised: x i || 2 ≤ 4 .

Original: For the fine-tuning setting, we evaluate on Yelp, SST and QQP datasets.
Revised: For the fine-tuning setting, we evaluate on Yelp, SST and QQP datasets.

Original: We normalize the output of BERT to a norm of 2 and use our OLSA Transformer as the downstream model.
Revised: We normalize the output of BERT to a norm of 2 and use our OLSA Transformer as the downstream model.

Original: For both settings, we use the number of attention heads 8 and hidden dimension 256.
Revised: For both settings, we use the number of attention heads 8 and hidden dimension 256.

Original: We train the model with batch size 32 for 50 epochs on SST and 10 epochs on Yelp.
Revised: We train the model with batch size 32 for 50 epochs on SST and 10 epochs on Yelp.

Original: For QQP we use Adam optimizer with learning rate 10 − 5 and decays by 0.
Revised: For QQP we use Adam optimizer with learning rate 10 − 5 and decays by 0.

Original: at the 40-th epoch.
Revised: at the 40-th epoch.

Original: We include certificate regularizer loss (Singla et al., 2021) which adds a term − γ ReLU (cid:20)
Revised: We include certificate regularizer loss (Singla et al., 2021) which adds a term − γ ReLU (cid:20)

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: (cid:21) to maximize the prediction margin with a gradually increasing γ with final value γ = 2 . 

Revised: (cid:21) to maximize the prediction margin with a gradually increasing γ with final value γ = 2 .

Original: for the train-from-scratch case.
Revised: for the train-from-scratch case.

Original: We use γ = 0 . 0 in the fine-tuning scenario as the margin is already large.
Revised: We use γ = 0 . 0 in the fine-tuning scenario as the margin is already large.

Original: We will not orthogonalize the final prediction layer; instead, we calculate its Lipschitz and include it in the final certification.
Revised: We will not orthogonalize the final prediction layer; instead, we calculate its Lipschitz and include it in the final certification.

Original: For the evaluation time, we compare the time to certify one batch evaluated on an RTX 3090 GPU.
Revised: For the evaluation time, we compare the time to certify one batch evaluated on an RTX 3090 GPU.

Original: Baselines There are few baselines on the certifiable robustness of Transformer models and (Shi et al., 2020) achieved state-of-the-art certification results.
Revised: Baselines There are few baselines on the certifiable robustness of Transformer models and (Shi et al., 2020) achieved state-of-the-art certification results.

Original: Their model is trained using the standard architecture and training algorithm.
Revised: Their model is trained using the standard architecture and training algorithm.

Original: We will fix the word embedding to be the same as in our model to perform a fair comparison.
Revised: We will fix the word embedding to be the same as in our model to perform a fair comparison.

Original: To certify the robustness within the region, they propose a bound propagation-based method that tightly bounds the cross-position dependency in the attention mechanism.
Revised: To certify the robustness within the region, they propose a bound propagation-based method that tightly bounds the cross-position dependency in the attention mechanism.

Original: They evaluate the certification on Yelp and SST datasets on which we will make the comparison and we will also evaluate it on the QQP dataset.
Revised: They evaluate the certification on Yelp and SST datasets on which we will make the comparison and we will also evaluate it on the QQP dataset.

Original: Note that since the certification time of their approach is slow, we will only evaluate on a sampled test set with 5% instances for Yelp and
Revised: Note that since the certification time of their approach is slow, we will only evaluate on a sampled test set with 5% instances for Yelp and

Original: QQP and.
Revised: QQP and.

Original: The comparison with the Lipschitz bound in Kim et al.
Revised: The comparison with the Lipschitz bound in Kim et al.

Original: (2021) is shown in Appendix D, where we adapt their bound to construct the 1-Lipschitz model and observe that our bound provides a better robustness guarantee.
Revised: (2021) is shown in Appendix D, where we adapt their bound to construct the 1-Lipschitz model and observe that our bound provides a better robustness guarantee.

Original: Evaluation Metrics To evaluate the certified robustness, we use the certified radius as the metric following the setting in (Shi et al., 2020).
Revised: Evaluation Metrics To evaluate the certified robustness, we use the certified radius as the metric following the setting in (Shi et al., 2020).

Original: Given model T and input X ∈ R N × d on the word embedding space, the certified radius is defined as the maximum perturbation radius within which we
Revised: Given model T and input X ∈ R N × d on the word embedding space, the certified radius is defined as the maximum perturbation radius within which we

Original: [Table] [Table]
Revised: [Table] [Table]

Original: can guarantee that the model prediction will not be changed:
Revised: can guarantee that the model prediction will not be changed:

Original: [Equation]
Revised: [Equation]

Original: and we calculate the average certified radius over the test dataset.
Revised: and we calculate the average certified radius over the test dataset.

Original: 5. T RAINING OLSA FROM SCRATCH
Revised: 5. T RAINING OLSA FROM SCRATCH

Original: We show the results of our certification on the train-from-scratch model in Table 1.
Revised: We show the results of our certification on the train-from-scratch model in Table 1.

Original: We can observe that our OLSA model indeed achieves higher certified robustness compared with Shi et al., especially on deeper layers.
Revised: We can observe that our OLSA model indeed achieves higher certified robustness compared with Shi et al., especially on deeper layers.

Original: We owe it to the reason that the OLSA network is trained to achieve a tight Lipschitz bound and therefore more robust; by comparison, Shi et al.
Revised: We owe it to the reason that the OLSA network is trained to achieve a tight Lipschitz bound and therefore more robust; by comparison, Shi et al.

Original: verify on the vanilla model and therefore cannot guarantee a tight bound for each layer.
Revised: verify on the vanilla model and therefore cannot guarantee a tight bound for each layer.

Original: Note that we cannot directly use our certification method to certify their model given that their models do not satisfy 1-Lipschitz so the bound will be very loose.
Revised: Note that we cannot directly use our certification method to certify their model given that their models do not satisfy 1-Lipschitz so the bound will be very loose.

Original: As a cost of improved certified robustness, our models suffer from a 1% to 2% vanilla accuracy drop compared with the vanilla (no regularization) model.
Revised: As a cost of improved certified robustness, our models suffer from a 1% to 2% vanilla accuracy drop compared with the vanilla (no regularization) model.

Original: We think this is an inevitable performance drop, as shown in previous works (Zhang et al., 2019a) that there exists a trade-off between vanilla accuracy and robustness when comparing vanilla and adversarially robust models.
Revised: We think this is an inevitable performance drop, as shown in previous works (Zhang et al., 2019a) that there exists a trade-off between vanilla accuracy and robustness when comparing vanilla and adversarially robust models.

Original: As for the certification time, we can observe that our certification is over 10,000 times faster than previous works.
Revised: As for the certification time, we can observe that our certification is over 10,000 times faster than previous works.

Original: This is because we only need one forward pass to calculate the prediction gap for certification; by comparison, Shi et al.
Revised: This is because we only need one forward pass to calculate the prediction gap for certification; by comparison, Shi et al.

Original: (2020) needs to do a binary search and bound-propagation on each location of the input, which leads to a large number of forward passes.
Revised: (2020) needs to do a binary search and bound-propagation on each location of the input, which leads to a large number of forward passes.

Original: Empirical robustness Besides the certified accuracy, we also perform ℓ 2 -PGD attack (Madry et al., 2017) against the models over the word embedding space to check their empirical robustness as shown in Table 1.
Revised: Empirical robustness Besides the certified accuracy, we also perform ℓ 2 -PGD attack (Madry et al., 2017) against the models over the word embedding space to check their empirical robustness as shown in Table 1.

Original: We see that OLSA indeed achieves a much higher empirical robustness compared with vanilla models.
Revised: We see that OLSA indeed achieves a much higher empirical robustness compared with vanilla models.

Original: This confirms that enforcing the 1-Lipschitz constraint indeed helps with the model robustness.
Revised: This confirms that enforcing the 1-Lipschitz constraint indeed helps with the model robustness.

Original: Ablation studies - Different γ
Revised: Ablation studies - Different γ

Original: The γ in the certificate regularizer loss can control the tradeoff between vanilla accuracy and certified radius — with larger γ , the model is trained to have a larger
Revised: The γ in the certificate regularizer loss can control the tradeoff between vanilla accuracy and certified radius — with larger γ , the model is trained to have a larger

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: output prediction gap and thus a larger certified radius, at a cost of vanilla accuracy.
Revised: output prediction gap and thus a larger certified radius, at a cost of vanilla accuracy.

Original: In Table 2, we show the performance of varying the value of γ .
Revised: In Table 2, we show the performance of varying the value of γ .

Original: From the tables, we can indeed observe the trade-off between vanilla accuracy and certified radius.
Revised: From the tables, we can indeed observe the trade-off between vanilla accuracy and certified radius.

Original: In particular, even with small γ we can still achieve a large certified radius, while larger γ provides a higher certification result.
Revised: In particular, even with small γ we can still achieve a large certified radius, while larger γ provides a higher certification result.

Original: We set γ = 2 .as
Revised: We set γ = 2 .as

Original: a reasonable choice for the trade-off.
Revised: a reasonable choice for the trade-off.

Original: Interestingly, the best empirical robustness is achieved at some intermediate value of γ .
Revised: Interestingly, the best empirical robustness is achieved at some intermediate value of γ .

Original: This may be because empirical robustness is not always aligned with certified radius and may be affected by the drop of vanilla accuracy.
Revised: This may be because empirical robustness is not always aligned with certified radius and may be affected by the drop of vanilla accuracy.

Original: 5. F INE - TUNING OLSA OVER P RETRAINED BERT
Revised: 5. F INE - TUNING OLSA OVER P RETRAINED BERT

Original: We show the certified robustness in the fine-tuning scenario in Table 3.
Revised: We show the certified robustness in the fine-tuning scenario in Table 3.

Original: The certified robustness is computed over the BERT output embedding space.
Revised: The certified robustness is computed over the BERT output embedding space.

Original: We mainly evaluate the 1-layer case as it is uncommon to use multi-layer Transformers on top of BERT for downstream tasks (although we expect a larger performance gap for those models).
Revised: We mainly evaluate the 1-layer case as it is uncommon to use multi-layer Transformers on top of BERT for downstream tasks (although we expect a larger performance gap for those models).

Original: We can see that our OLSA model again achieves a larger certified radius on all three tasks at a small cost of vanilla accuracy.
Revised: We can see that our OLSA model again achieves a larger certified radius on all three tasks at a small cost of vanilla accuracy.

Original: Also, OLSA achieves higher empirical robustness compared with vanilla models.
Revised: Also, OLSA achieves higher empirical robustness compared with vanilla models.

Original: These results show that our OLSA model can be applied in both train-from-scratch and fine-tuning scenarios to enhance model robustness.
Revised: These results show that our OLSA model can be applied in both train-from-scratch and fine-tuning scenarios to enhance model robustness.

Original: We provide the training curve in Appendix F.
Revised: We provide the training curve in Appendix F.

Original: In addition, we evaluate the model robustness on
Revised: In addition, we evaluate the model robustness on

Original: PAWS-QQP (Zhang et al., 2019c), an adversarial dataset of QQP, and also observe that OLSA achieves high empirical robustness, as we show in Appendix C.
Revised: PAWS-QQP (Zhang et al., 2019c), an adversarial dataset of QQP, and also observe that OLSA achieves high empirical robustness, as we show in Appendix C.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper, we propose OLSA, the first 1-Lipschitz self-attention mechanism for sequential input.
Revised: In this paper, we propose OLSA, the first 1-Lipschitz self-attention mechanism for sequential input.

Original: Based on OLSA layer and 1-Lipschitz pooling, we propose the first 1-Lipschitz Transformer model for NLP classification tasks.
Revised: Based on OLSA layer and 1-Lipschitz pooling, we propose the first 1-Lipschitz Transformer model for NLP classification tasks.

Original: We show that OLSA Transformer is able to achieve the state-of-the-art certified robustness on various tasks under both train-from-scratch and fine-tuning scenarios.
Revised: We show that OLSA Transformer is able to achieve the state-of-the-art certified robustness on various tasks under both train-from-scratch and fine-tuning scenarios.

Original: Our certification is also significantly more efficient.
Revised: Our certification is also significantly more efficient.

Original: We believe this work will provide a new research direction toward certifiably robust language models.
Revised: We believe this work will provide a new research direction toward certifiably robust language models.

Original: A P ROOF OF T HEOREM 4. 
Revised: A P ROOF OF T HEOREM 4.

Original: Proof.
Revised: Proof.

Original: Consider two inputs X and X +∆ X , where ||
Revised: Consider two inputs X and X +∆ X , where ||

Original: X || F ≤ c , || X +∆ X || F ≤ c and || ∆ X || F ≤ δ .
Revised: X || F ≤ c , || X +∆ X || F ≤ c and || ∆ X || F ≤ δ .

Original: We will use the symbol ∆ to denote the changes given X and X +∆ X if it does not lead to confusion.
Revised: We will use the symbol ∆ to denote the changes given X and X +∆ X if it does not lead to confusion.

Original: For example, ∆ Y = F ( X + ∆ X ) − F ( X ) .
Revised: For example, ∆ Y = F ( X + ∆ X ) − F ( X ) .

Original: Our goal is to bound the difference at the output layer ||
Revised: Our goal is to bound the difference at the output layer ||

Original: ∆ Y || F .
Revised: ∆ Y || F .

Original: First, we will define the symbols for intermediate results as follows:
Revised: First, we will define the symbols for intermediate results as follows:

Original: [Equation]
Revised: [Equation]

Original: Now, we are going to bound the difference ||
Revised: Now, we are going to bound the difference ||

Original: ∆ Y || F
Revised: ∆ Y || F

Original: by considering the perturbations of ∆ Q , ∆ K , ∆ S h and ∆ P
Revised: by considering the perturbations of ∆ Q , ∆ K , ∆ S h and ∆ P

Original: h step-by-step.
Revised: h step-by-step.

Original: [Equation]
Revised: [Equation]

Original: We can observe that Q = W Q X , K = W K X and V = W V X .
Revised: We can observe that Q = W Q X , K = W K X and V = W V X .

Original: Since all matrices are orthogonal, the linear operation is 1-Lipschitz.
Revised: Since all matrices are orthogonal, the linear operation is 1-Lipschitz.

Original: Thus || ∆ Q || F ≤ || ∆ X || F ≤
Revised: Thus || ∆ Q || F ≤ || ∆ X || F ≤

Original: δ and same for ∆ K and ∆ V .
Revised: δ and same for ∆ K and ∆ V .

Original: Step 2 (cid:112)(cid:80)
Revised: Step 2 (cid:112)(cid:80)

Original: [Equation]
Revised: [Equation]

Original: First, notice that the operation W Sh σ ( · ) is 1-Lipschitz since || W
Revised: First, notice that the operation W Sh σ ( · ) is 1-Lipschitz since || W

Original: Sh || 

Revised: Sh ||

Original: = 1 and σ is 1-Lipschitz.
Revised: = 1 and σ is 1-Lipschitz.

Original: Next, notice that every entry in Q and K will appear N times among the calculation of all the s hij .
Revised: Next, notice that every entry in Q and K will appear N times among the calculation of all the s hij .

Original: Therefore, the overall change of (cid:80) i,j,h (∆ s hij ) 2 is N/ ((2 α 1 ) 2 ) times the overall change of || ∆ Q || F and || ∆ K || F .
Revised: Therefore, the overall change of (cid:80) i,j,h (∆ s hij ) 2 is N/ ((2 α 1 ) 2 ) times the overall change of || ∆ Q || F and || ∆ K || F .

Original: So:
Revised: So:

Original: [Equation]
Revised: [Equation]

Original: This can be proved by noticing that the Lipschitz constant of a SoftMax function is 14 .
Revised: This can be proved by noticing that the Lipschitz constant of a SoftMax function is 14 .

Original: [Equation]
Revised: [Equation]

Original: Note that the change of ˜ Y h comes from both V h and P h and the inequality || AB || F ≤
Revised: Note that the change of ˜ Y h comes from both V h and P h and the inequality || AB || F ≤

Original: || A
Revised: || A

Original: || 2 || B || F ≤ ||
Revised: || 2 || B || F ≤ ||

Original: A
Revised: A

Original: || F || B
Revised: || F || B

Original: || F holds true.
Revised: || F holds true.

Original: Therefore, we have:
Revised: Therefore, we have:

Original: [Equation]
Revised: [Equation]

Original: The last inequality comes from (1) P h is the matrix after SoftMax, so its spectral norm is no larger than 1; (2) ||
Revised: The last inequality comes from (1) P h is the matrix after SoftMax, so its spectral norm is no larger than 1; (2) ||

Original: V h +
Revised: V h +

Original: ∆ V h || F ≤ || X + ∆ X || F ≤ c since V comes from an orthogonal operation of X .
Revised: ∆ V h || F ≤ || X + ∆ X || F ≤ c since V comes from an orthogonal operation of X .

Original: Step
Revised: Step

Original: [Equation]
Revised: [Equation]

Original: We notice that Y = 1 α 2 Concat ([ ˜ Y 1 , . . .
Revised: We notice that Y = 1 α 2 Concat ([ ˜ Y 1 , . . .

Original: , ˜ Y H ]) .
Revised: , ˜ Y H ]) .

Original: In addition, we have inequality (cid:112)(cid:80) h ( a h + b h ) 2 ≤ ( (cid:112)(cid:80) h a 2 h
Revised: In addition, we have inequality (cid:112)(cid:80) h ( a h + b h ) 2 ≤ ( (cid:112)(cid:80) h a 2 h

Original: + (cid:112)(cid:80) h b 2 h ) from Cauchy’s inequality.
Revised: + (cid:112)(cid:80) h b 2 h ) from Cauchy’s inequality.

Original: Therefore, we have:
Revised: Therefore, we have:

Original: [Equation]
Revised: [Equation]

Original: B P ROOF OF T HEOREM 4. 
Revised: B P ROOF OF T HEOREM 4.

Original: Proof.
Revised: Proof.

Original: Let || ∆ X
Revised: Let || ∆ X

Original: || F = δ = (cid:113)(cid:80)
Revised: || F = δ = (cid:113)(cid:80)

Original: Ni
Revised: Ni

Original: =1 || ∆ x
Revised: =1 || ∆ x

Original: i || 2 F be the perturbation on the input.
Revised: i || 2 F be the perturbation on the input.

Original: We have: || ∆ G ( X ) ||
Revised: We have: || ∆ G ( X ) ||

Original: F = 1 N ||
Revised: F = 1 N ||

Original: N (cid:88) i =
Revised: N (cid:88) i =

Original: [Equation]
Revised: [Equation]

Original: N
Revised: N

Original: [Equation]
Revised: [Equation]

Original: where the last inequality is derived from the Cauchy’s inequality.
Revised: where the last inequality is derived from the Cauchy’s inequality.

Original: C E VALUATION ON PAWS-QQP
Revised: C E VALUATION ON PAWS-QQP

Original: [Table]
Revised: [Table]

Original: We show the evaluation results where we fine-tune the model on QQP and evaluate on the adversarial dataset PAWS-QQP Zhang et al. (2019c) in Table 4.
Revised: We show the evaluation results where we fine-tune the model on QQP and evaluate on the adversarial dataset PAWS-QQP Zhang et al. (2019c) in Table 4.

Original: We can observe that our OLSA model still achieves a better performance with arbitrary choice of γ .
Revised: We can observe that our OLSA model still achieves a better performance with arbitrary choice of γ .

Original: In particular, larger γ can provide a better adversarial robustness, but it may hurt the vanilla accuracy.
Revised: In particular, larger γ can provide a better adversarial robustness, but it may hurt the vanilla accuracy.

Original: D C OMPARISON WITH (K IM ET AL ., 2021)
Revised: D C OMPARISON WITH (K IM ET AL ., 2021)

Original: We compare our bound with the one in (Kim et al., 2021) as in Table 5 for the train-from-scratch scenario and Table 6 for the finetuning scenario.
Revised: We compare our bound with the one in (Kim et al., 2021) as in Table 5 for the train-from-scratch scenario and Table 6 for the finetuning scenario.

Original: In particular, we will follow their L2-MHA pipeline and (1) orthogonalize all the linear matrices (2) divide the output by their Lipschitz constant bound in
Revised: In particular, we will follow their L2-MHA pipeline and (1) orthogonalize all the linear matrices (2) divide the output by their Lipschitz constant bound in

Original: [Table]
Revised: [Table]

Original: [Table]

Original: [Figure] [Table] 
Revised: [Table] [Figure]

Original: Robust Accuracy under
Revised: Robust Accuracy under

Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: order to get a 1-Lipschitz self-attention layer.
Revised: order to get a 1-Lipschitz self-attention layer.

Original: Other settings follow the same way as OLSA.
Revised: Other settings follow the same way as OLSA.

Original: We can observe that our model achieves a larger certified radius as well as a vanilla model accuracy.
Revised: We can observe that our model achieves a larger certified radius as well as a vanilla model accuracy.

Original: This is understandable as we discussed that our bound is tighter in practice.
Revised: This is understandable as we discussed that our bound is tighter in practice.

Original: E P ERFORMANCE WITH D IFFERENT L AYERS OF BERT
Revised: E P ERFORMANCE WITH D IFFERENT L AYERS OF BERT

Original: In the previous evaluation, we use the standard 12-layer BERT architecture followed by a downstream self-attention layer for fine-tuning.
Revised: In the previous evaluation, we use the standard 12-layer BERT architecture followed by a downstream self-attention layer for fine-tuning.

Original: In Table 7, we show the results using the output of the 11-th layer in BERT and concatenate it with the downstream layer for finetuning.
Revised: In Table 7, we show the results using the output of the 11-th layer in BERT and concatenate it with the downstream layer for finetuning.

Original: We view such architecture as a fair analogy of BERT, since it also consists of 12 layers in total.
Revised: We view such architecture as a fair analogy of BERT, since it also consists of 12 layers in total.

Original: We can observe that there is a slight performance drop compared with the original version, which is understandable as we are only using part of the pretrained BERT.
Revised: We can observe that there is a slight performance drop compared with the original version, which is understandable as we are only using part of the pretrained BERT.

Original: Nevertheless, our model still has a good performance under such circumstance.
Revised: Nevertheless, our model still has a good performance under such circumstance.

Original: F T RAINING AND C ERTIFICATION C URVE
Revised: F T RAINING AND C ERTIFICATION C URVE

Original: We show the curve of vanilla accuracy and certified radius for the OLSA model on Yelp during training under both scenarios in Figure 1.
Revised: We show the curve of vanilla accuracy and certified radius for the OLSA model on Yelp during training under both scenarios in Figure 1.

Original: We have two observations from the curves.
Revised: We have two observations from the curves.

Original: First, the model can achieve a good vanilla accuracy at early epochs, while the certified radius is gradually increased during the training process.
Revised: First, the model can achieve a good vanilla accuracy at early epochs, while the certified radius is gradually increased during the training process.

Original: Note that we have a gradually increasing γ which may hurt vanilla accuracy, so the relatively stable accuracy indicates that the model is trained well.
Revised: Note that we have a gradually increasing γ which may hurt vanilla accuracy, so the relatively stable accuracy indicates that the model is trained well.

Original: Second, we notice that the training and test performance trend is similar as the 1-Lipschitz constraint is a strong regularizer on the model, and thus the model will not overfit on the training set which is desired. 
Revised: Second, we notice that the training and test performance trend is similar as the 1-Lipschitz constraint is a strong regularizer on the model, and thus the model will not overfit on the training set which is desired. G A BLATION STUDY

Revised: In Table 8, we show the performance of the OLSA network with different features in the tranditional

Revised: Transformers, including Dropout, ReLU and LayerNorm.

Revised: In particular, 1) for dropout, we use the

Revised: PyTorch implementation where we randomly drop out some neurons and scale up other neurons during training, and perform identity transformation during evaluation; 2) for ReLU, we replace all the GroupSort activation with ReLU activation; 3) for LayerNorm, we only include the bias term and not use the variance term, which is also used in Shi et al.

Revised: We can observe that these features have little impact on the final model performance.

Revised: [Table]

Revised: H D EEPER MODELS

Revised: We provide the results with 4/5/6-layer Transformers on the SST-2 dataset as in Table 9.

Revised: We can observe that our model can still outperform Shi et al.

Revised: In addition, the performance has a slight drop as training deeper models on a single task usually cannot achieve a good performance.

Revised: [Table]

Revised: I E VALUATION ON A DV GLUE

Revised: In order to validate the empirical performance of our work, we evaluate our approach over the advGLUE Wang et al.

Revised: (2021b) dataset, which consists of adversarial examples on SST and QQP generated with different existing attacks.

Revised: We show the results in Table 10.

Revised: We can observe that our approach indeed performs better on these adversarially attacked datasets.

Revised: These results show that

Revised: Lipschitz is helpful in improving model robustness.

Revised: [Table]

Revised: J C OMPARISON WITH B ONAERT ET AL .

Revised: As a recent baseline, Bonaert et al.

Revised: (2021) improves over Shi et al.

Revised: (2020) to certify the robustness of a Transformer with bounding propagation techniques.

Revised: We evaluate their certification approach and provide the comparison of average certified radius in Table 11.

Revised: Note that the models in this work are the same as in Shi et al.

Revised: (2020), so their vanilla accuracy is the same as we show in Table 1.

Revised: We can observe that our approach still outperforms this work, since their approach is still certifying the vanilla-trained model which intrinsically does not have good robustness.

Revised: [Table]