Original: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity
Revised: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity

Original: Anonymous Author(s)
Revised: Anonymous Author(s)

Original: AffiliationAddress email
Revised: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.
Revised: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.

Original: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.
Revised: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.

Original: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radiusof certification (under the L 2 norm) is possible given only these score.
Revised: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radiusof certification (under the L 2 norm) is possible given only these score.

Original: However,it is an open question as to whether such lower bounds can be improved usinglocal information around the instance under test.
Revised: However,it is an open question as to whether such lower bounds can be improved usinglocal information around the instance under test.

Original: In this work, we demonstratehow today’s “optimal” certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to whatwe term Geometrically-Informed Certified Robustness .
Revised: In this work, we demonstratehow today’s “optimal” certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to whatwe term Geometrically-Informed Certified Robustness .

Original: Essentially we search for,and merge with, larger certifiable balls nearby to an initial instance under test.
Revised: Essentially we search for,and merge with, larger certifiable balls nearby to an initial instance under test.

Original: Ourapproach improves certifications for more than 80% of instances in experimentswith Tiny-Imagenet, with an on average 5% increase in the associated certification.
Revised: Ourapproach improves certifications for more than 80% of instances in experimentswith Tiny-Imagenet, with an on average 5% increase in the associated certification.

Original:  Introduction
Revised:  Introduction

Original: Learned models, including neural networks, are well known to be susceptible having the outputchanged by crafted perturbations to an input, that preserve the inputs semantic properties [2].
Revised: Learned models, including neural networks, are well known to be susceptible having the outputchanged by crafted perturbations to an input, that preserve the inputs semantic properties [2].

Original: Neuralnetworks not only misclassify these perturbations—known as adversarial examples —but they alsoassign high confidence to these incorrect predictions.
Revised: Neuralnetworks not only misclassify these perturbations—known as adversarial examples —but they alsoassign high confidence to these incorrect predictions.

Original: These behaviours have been observed across awide range of models and datasets and appear to be a product of piecewise-linear interactions [12].
Revised: These behaviours have been observed across awide range of models and datasets and appear to be a product of piecewise-linear interactions [13].

Original: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.
Revised: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.

Original: These attacks have been applied to both black- and white-box models [27] and canbe used to target class changes, to attack all classes [9] or even introduce backdoors into modelbehaviour [5].
Revised: These attacks have been applied to both black- and white-box models [31] and canbe used to target class changes, to attack all classes [10] or even introduce backdoors into modelbehaviour [5].

Original: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).
Revised: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).

Original: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.
Revised: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.

Original: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.
Revised: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.

Original: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.
Revised: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.

Original: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance. Irrespective of the attack,all instances within a certain distancefrom an input (typically L 2 distance) are guaranteed notto be adversarial examples.
Revised: To circumvent these limitations, certified guarantees of adversarial robustness can be constructed toidentify class-constant regions around an input instance, that guarantee that all instances within a normbounded distance (typically L 2 ) are not adversarial examples.

Original: Certifications based on randomised smoothing of classifiers aroundan input point are in a sense optimal [7]: based only on the prediction class scores at the inputpoint, no better radius is in general possible.
Revised: Certifications based on randomisedsmoothing of classifiers around an input point are in a sense optimal [8]: based only on the predictionclass scores at the input point, no better radius is in general possible.

Original: Despite this, such certifications fail to use readilyavailable—yet still local—information: the certifiability of points nearby to the input of interest.
Revised: Despite this, such certificationsfail to use readily available—yet still local—information: the certifiability of points nearby to theinput of interest.

Original: The key insight of this work is that these neighbourhood points may generate certified radius largeenough to completely enclose that of the sample point, improving the radius of certification.
Revised: The key insight of this work is that these neighbourhood points may generate certified radius large enough to completely enclose that of a sample point, improving the radius ofcertification.

Original: Thisprocess canalso be extended to use the intersection of the regions of certification of multiple points,and the nature of the input domain itself to generate larger certifications.
Revised: This process can be extended to use the intersection of the regions of certification ofmultiple points, and the nature of the input domain itself to generate larger certifications.

Original: This leads to our maincontribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceedingthose of the hitherto best-case guaranteed approach of Cohen et al.
Revised: This leadsto our main contribution— Geometrically-Informed Certified Robustness —that enjoys certificationsexceeding those of the hitherto best-case guaranteed approach of Cohen et al.

Original:  Background and literature review
Revised:  Background and literature review

Original: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [23, 36, 39, 40, 32]. Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [30].
Revised: Bounding mechanisms Conservative bounds upon the impact of norm-bounded perturbations canbe constructed by way of either Interval Bound Propagation (IBP) which propagates interval boundsthrough the model; or Convex Relaxation, which utilise linear relaxation to construct bounding outputpolytopes over input bounded perturbations [34, 26, 41, 44, 45, 37, 28], in a manner that generallyprovides tighter bounds than IBP [25].

Original: These approaches employ adoptingaugmented loss functions during training to promote tight output bounds [37].
Revised: In contrast to Randomised Smoothing, bounding mechanismsemploy augmented loss functions during training, which promote tight output bounds [42] at the costof decreased applicability.

Original: While boundingmechanisms can produce valid certifications, they appear to exhibit a time and memory complexitythat makes them infeasible for complex model architectures or high-dimensional data [35].
Revised: Moreover they both exhibit a time and memory complexity that makesthem infeasible for complex model architectures or high-dimensional data [40, 6, 21].

Original: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [19], in which noise is applied to inputinstances to smooth model predictions, subject to a sampling distribution that is tied to the L P -normof adversarial perturbations being certified against.
Revised: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [20], in which noise is applied to inputinstances to smooth model predictions, subject to a sampling distribution that is tied to the L P -normof adversarial perturbations being certified against.

Original: In contrast to other robustness mechanisms, thisapplication of the noise is the only architectural change that is required to achieve certification.
Revised: In contrast to other robustness mechanisms, thisapplication of the noise is the only architectural change that is required to achieve certification.

Original: In thecase of L 2 -norm bounded attacks, Gaussian sampling of the form
Revised: In thecase of L 2 -norm bounded attacks, Gaussian sampling of the form

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: where
Revised: where

Original: [Equation]

Original: .i.

Original: [Equation]
Revised: [Equation]

Original: is employed for all test-time instances.
Revised: is employed for all test-time instances.

Original: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator
Revised: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator

Original: [Equation]
Revised: [Equation]

Original: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.
Revised: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.

Original: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.
Revised: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.

Original: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r , with recent work alsoconsidering rotational and/or translational semantic attacks [21, 6].
Revised: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r , with recent work alsoconsidering rotational and/or translational semantic attacks [23, 7].

Original: L p -norm certifications were firstdemonstrated by way of differential privacy [19, 10], with more recent approaches employing Rényidivergence [20], and parametrising worst-case behaviours [7, 29].
Revised: L p -norm certifications were firstdemonstrated by way of differential privacy [20, 11], with more recent approaches employing Rényidivergence [22], and parametrising worst-case behaviours [8, 33].

Original: By considering the worst-case
Revised: By considering the worst-case

Original: L 2 -perturbations, Cohen et al.
Revised: L 2 -perturbations, Cohen et al.

Original: (2019) purports that the largest achievable pointwise certification canis
Revised: (2019) purports that the largest achievable pointwise certification is

Original: [Equation]
Revised: [Equation]

Original: where { E 0 , E 1 } are the two largest class expectations (as per Equation (2)), σ is the noise, and Φ − 1is
Revised: Hhere { E 0 , E 1 } are the two largest class expectations (as per Equation (2)), σ is the noise, and Φ − 1is

Original: the inverse normal CDF, or Gaussian quantile function.
Revised: the inverse normal CDF, or Gaussian quantile function.

Original:  Geometrically-informed certified robustness
Revised:  Geometrically-informed certified robustness

Original: While the work contained within this paper can be applied generally, for this work we will focus uponcertifications of robustness about L 2 -norm bounded adversarial perturbations, for which we assumethat the difficulty of attacking a model is proportional to the size of the certification, based upon theneed to evade both human and machine scrutiny [11].
Revised: While the work contained within this paper can be applied generally, for this work we will focus uponcertifications of robustness about L 2 -norm bounded adversarial perturbations, for which we assumethat the difficulty of attacking a model is proportional to the size of the certification, based upon theneed to evade both human and machine scrutiny [12].

Original: Thus, constructing larger certifications in sucha context is inherently valuable.
Revised: Thus, constructing larger certifications in sucha context is inherently valuable.

Original: This specific L P space is of interest due to both its viability as a defence model, and the provableguarantee that Cohen et al.
Revised: This specific L P space is of interest due to both its viability as a defence model, and the provableguarantee that Cohen et al.

Original: produces the largest possiblecertification for any instance [7].
Revised: produces the largest possible

Original: Over theremainder of this section we will document how it is possible to improve upon this provably best-caseguarantee by exploiting several properties of certified robustness.

Original: [Figure]
Revised: [Figure]

Original: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.
Revised: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.

Original: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiusof x .
Revised: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiusof x .

Original: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.
Revised: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.

Original: Definition 3.1 ( Overlap Properties of Certification ) .
Revised: Definition 3.1 ( Overlap Properties of Certification ) .

Original: A radius of certification r i about x i can becalculated by evaluating Equation 3 at x i .
Revised: A radius of certification r i about x i can becalculated by evaluating Equation 3 at x i .

Original: This certification guarantees that no point x : ∥ x − x i ∥ P ≤ 89 r i can induce a chance in the predicted class.
Revised: This certification guarantees that no point x : ∥ x − x i ∥ P ≤ 88 r i can induce a chance in the predicted class.

Original: That this shape is a d -dimensional hypersphere forinput data x ∈ R d allows us to introduce the notational shorthand
Revised: That this shape is a d -dimensional hypersphere forinput data x ∈ R d allows us to introduce the notational shorthand

Original: [Equation]
Revised: [Equation]

Original: to represent the region covered by the hypersphere and its surface.
Revised: to represent the region covered by the hypersphere and its surface.

Original: It follows from this definition thatthat if B P ( x 1 , r 1 ) ∩ B P ( x 2 , r 2 ) ̸
Revised: It follows from this definition thatthat if B P ( x 1 , r 1 ) ∩ B P ( x 2 , r 2 ) ̸

Original: = ∅ , which ensures that the class predictions at x 1 and x 2 match, 93 then the region of certification about x 1 can be expressed as B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) .
Revised: = ∅ , which ensures that the class predictions at x 1 and x 2 match, 92 then the region of certification about x 1 can be expressed as B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) .

Original: However typically we are concerned not with the size of the region of classification invariance, butrather the distance to the nearest adversarial example.
Revised: However typically we are concerned not with the size of the region of classification invariance, butrather the distance to the nearest adversarial example.

Original: If it is possible to find some x ′ such that itsregion of certification completely encircles that of the certification at x , the following definitiondemonstrates that the certification radius about x can be increased.
Revised: If it is possible to find some x ′ such that itsregion of certification completely encircles that of the certification at x , the following definitiondemonstrates that the certification radius about x can be increased.

Original: Lemma 3.2 ( Set Unions Certified Radius ) .
Revised: Lemma 3.2 ( Set Unions Certified Radius ) .

Original: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance r ′ ≥ r from x 1 , where
Revised: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance r ′ ≥ r from x 1 , where

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .
Revised: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .

Original: Thus r ′ =
Revised: Thus r ′ =

Original: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (5).
Revised: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (5).

Original: As such, we can recast the task of constructing a certification from being a strictly analytic functionto the nonlinear optimisation problem in terms of a second ball with certified radius r 2 centred at x 

Revised: As such, we can recast the task of constructing a certification from being a strictly analytic functionto the nonlinear optimisation problem in terms of a second ball with certified radius r 2 centred at x

Original: [Equation]
Revised: [Equation]

Original: (6) with Figure 1a providing a two-dimensional exemplar.
Revised: (6) with Figure 1a providing a two-dimensional exemplar.

Original: Crucially, the above formalism does notrequire obtaining a global optima, as any r ′ > r 1 yields an improved certification at x 1 .
Revised: Crucially, the above formalism does notrequire obtaining a global optima, as any r ′ > r 1 yields an improved certification at x 1 .

Original: 3.2 Multiple transitivity
Revised: 3.2 Multiple transitivity

Original: To further enhance our ability to certify, let us consider the set of points and their associated certifications { x 1 , r 1 , x 2 , r 2 , . . .
Revised: To further enhance our ability to certify, let us consider the set of points and their associated certifications { x 1 , r 1 , x 2 , r 2 , . . .

Original: x n , r n } .
Revised: x n , r n } .

Original: If the union of ˆ B P = ∪ i ∈{ 1 ,...,n } B P ( x i , r i ) is simply-connected,then the certification across this set can be expressed as r ( n ) ′ =
Revised: If the union of ˆ B P = ∪ i ∈{ 1 ,...,n } B P ( x i , r i ) is simply-connected,then the certification across this set can be expressed as r ( n ) ′ =

Original: min x ∈ ∂ ˆ B P ∥ x − x 1 ∥ P , where ∂ ˆ B P is the boundary of ˆ B P .
Revised: min x ∈ ∂ ˆ B P ∥ x − x 1 ∥ P , where ∂ ˆ B P is the boundary of ˆ B P .

Original: This can be further simplified by imposing that x j ∈ B P ( x 2 , r 2 ) ∀ j > 2 andthat B P ( x j , r j ) ̸⊂ B P ( x k , r k ) ∀ ( j > 2 , k > 2) to ensure that hyperspheres exist near the boundaryof S 2 and yielding a certification of 
Revised: This can be further simplified by imposing that x j ∈ B P ( x 2 , r 2 ) ∀ j > 2 andthat B P ( x j , r j ) ̸⊂ B P ( x k , r k ) ∀ ( j > 2 , k > 2) to ensure that hyperspheres exist near the boundaryof S 2 and yielding a certification of [Equation] n

Original: [Equation]
Revised: [Equation]

Original: Here S n is a ( d − 1) -dimensional manifold embedded in R d .
Revised: Here S n is a ( d − 1) -dimensional manifold embedded in R d .

Original: Lemma 3.3 ( Optimal positioning of x 3 in the case of n = 3 ) .
Revised: Lemma 3.3 ( Optimal positioning of x 3 in the case of n = 3 ) .

Original: Consider the addition of a newhypersphere at some point x 3 with associated radius r 3 , which has an associated boundary S 3 .
Revised: Consider the addition of a newhypersphere at some point x 3 with associated radius r 3 , which has an associated boundary S 3 .

Original: If itis true that
Revised: If itis true that

Revised: B P

Original: [Equation]
Revised: [Equation]

Original: P
Revised: x

Original: [Equation]
Revised: [Equation]

Original: r 
Revised: r 3 )

Original: [Equation]
Revised: [Equation]

Original: B P 
Revised: B P ( x 2 , r

Original: [Equation]
Revised: [Equation]

Original: x
Revised: and B P

Original: [Equation]
Revised: [Equation]

Original: r
Revised: x

Original: [Equation]
Revised: [Equation]

Original: and BP
Revised: B

Original: [Equation]
Revised: [Equation]

Original: x
Revised: x

Original: [Equation]
Revised: [Equation]

Original: r
Revised: r

Original: [Equation]
Revised: [Equation]

Original:  B
Revised: ̸⊂ B

Original: [Equation]
Revised: [Equation]

Original: r
Revised: ˜ x [Equation] ˜

Original: [Equation]
Revised: [Equation]

Original: ] d  with ˜ r
Revised: ˜ x [Equation] [Equation] d | ˜ x ̸ = x 3 } with ˜ r

Original: =
Revised: =

Original: σ
Revised: σ

Original: [Equation]
Revised: [Equation]

Original: then the largest possible certification r ′′ by Equation 7 is achieved at
Revised: then the largest possible certification r ′′ by Equation 7 is achieved at

Original: [Equation]
Revised: [Equation]

Original: for some s ∈ [ [Equation]
Revised: for some s ∈ [0 , 1] .

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: Proof.
Revised: Proof.

Original: The closest point to x 1 upon S 2 is located at
Revised: The closest point to x 1 upon S 2 is located at

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where r ′ is defined by Equation 6.
Revised: where r ′ is defined by Equation 6.

Original: Thus any improved radius of certification r ′′ > r ′ is only achievableif B P ( x 3 , r 3 ) satisfies ˘ x ∈ B P ( x 3 , r 3 ) and Equation 8.
Revised: Thus any improved radius of certification r ′′ > r ′ is only achievableif B P ( x 3 , r 3 ) satisfies ˘ x ∈ B P ( x 3 , r 3 ) and Equation 8.

Original: Then by symmetry, r ′′ is the maximallyachievable radius of certification if Equation 9 hold and if x 3 is defined by Equation 10.
Revised: Then by symmetry, r ′′ is the maximallyachievable radius of certification if Equation 9 hold and if x 3 is defined by Equation 10.

Original: While finding some x 3 satisfying Equations 8 and 10 is trivial, proving Equation 9 would requirean exhaustive search of the input space [0 , 1] d .
Revised: While finding some x 3 satisfying Equations 8 and 10 is trivial, proving Equation 9 would requirean exhaustive search of the input space [0 , 1] d .

Original: However, even in the absence of such a search,
Revised: However, even in the absence of such a search,

Original: Equation 10 still provides the framework for a simple search for x 3 , which follows Figure 1b.
Revised: Equation 10 still provides the framework for a simple search for x 3 , which follows Figure 1b.

Original: Lemma 3.4 ( Certification from two eccentric hyperspheres ) .
Revised: Lemma 3.4 ( Certification from two eccentric hyperspheres ) .

Original: If x 3 is defined by Equation 10 in afashion that satisfies Equation 8 then an updated certification can be achieved in terms of some x 3 ( s )defined by Equation 10 by way of
Revised: If x 3 is defined by Equation 10 in afashion that satisfies Equation 8 then an updated certification can be achieved in terms of some x 3 ( s )defined by Equation 10 by way of

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: If Equation 9 holds, then this is the largest achievable certification for n = 3 .
Revised: If Equation 9 holds, then this is the largest achievable certification for n = 3 .

Original: Proof.
Revised: Proof.

Original: By symmetry we can define the arbitrary rotational mapping f : R d → R d from x i (cid:55)→ 
Revised: By symmetry we can define the arbitrary rotational mapping f : R d → R d from x i (cid:55)→ y

Original: y i by 131 way of y i =
Revised: i by 130 way of y i =

Original: f ( x i − x 1 ) , subject to the conditiony i,j ̸ = 0 for i ∈ { 1 , 2 } and ∀ j ̸ = k , for some k such that j, k ∈ { 1 , 2 , . . .
Revised: f ( x i − x 1 ) , subject to the conditiony i,j ̸ = 0 for i ∈ { 1 , 2 } and ∀ j ̸ = k , for some k such that j, k ∈ { 1 , 2 , . . .

Original: , d } (13) then the intersection of the hyperspheres centred about x 2 and x 3 occurs at
Revised: , d } (13) then the intersection of the hyperspheres centred about x 2 and x 3 occurs at

Original: [Equation]
Revised: [Equation]

Revised: [Equation]

Original: This is a consequence of our mapping y =
Revised: This is a consequence of our mapping y =

Original: f
Revised: f

Original: ( x − x 1 ) preserving distances under rotation, giving that
Revised: ( x − x 1 ) preserving distances under rotation, giving that

Original: [Equation]
Revised: [Equation]

Original:  ∥ = d 2 , and with the equivalent also holding for y 3 ,k .
Revised: k = ∥ x 2 − x 1 ∥ = d 2 , and with the equivalent also holding for y 3 ,k .

Original: As a consequence of our choice of coordinate system, it follows that r ′′ = ∥
Revised: As a consequence of our choice of coordinate system, it follows that r ′′ = ∥

Original: y ∥ and
Revised: y ∥ and

Original: [Equation]
Revised: [Equation]

Original: which is an equivalence to Equation (12).
Revised: which is an equivalence to Equation (12).

Original: While Equation 7 holds for any n ≥ 2 , the certification radius beyond n = 3 cannot be enhanced byadding any one single additional hypersphere without contradicting Lemma 3.4.
Revised: While Equation 7 holds for any n ≥ 2 , the certification radius beyond n = 3 cannot be enhanced byadding any one single additional hypersphere without contradicting Lemma 3.4.

Original: This is a result of
Revised: This is a result of

Original: S 3 being a ( d − 1) -dimensional manifold in R d , the entirety of which must be enclosed to improvethe certification.
Revised: S 3 being a ( d − 1) -dimensional manifold in R d , the entirety of which must be enclosed to improvethe certification.

Original: An example of this can be seen with the two equidistant intersections between S 2(in Red) and S 3 (in Black) in Figure 1b.
Revised: An example of this can be seen with the two equidistant intersections between S 2(in Red) and S 3 (in Black) in Figure 1b.

Original: While multiple spheres could be constructed to completelyenclose S 3 , the number required grows exponentially with d due to the sphere packing kissing numberproblem [8].
Revised: While multiple spheres could be constructed to completelyenclose S 3 , the number required grows exponentially with d due to the sphere packing kissing numberproblem [9].

Original: This growth in complexity makes adding additional spheres beyond n = 3 infeasible.
Revised: This growth in complexity makes adding additional spheres beyond n = 3 infeasible.

Original: Further details of this are contained within Appendix A.2.
Revised: Further details of this are contained within Appendix A.2.

Original: 3.3 Boundary treatments
Revised: 3.3 Boundary treatments

Original: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .
Revised: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .

Original: However in the majority of cases a subset of B P ( x 1 , L 1 ) will exist outside [0 , 1] d .
Revised: However in the majority of cases a subset of B P ( x 1 , L 1 ) will exist outside [0 , 1] d .

Original: While this observation is trivially true, it has no influence on the radius of certification achievedby Equation 3 due to the symmetry of B P ( x 1 , r ) .
Revised: While this observation is trivially true, it has no influence on the radius of certification achievedby Equation 3 due to the symmetry of B P ( x 1 , r ) .

Original: However, the asymmetric nature of B P ( x 2 , r 2 )about x 1 guarantees that if B P ( x 2 , r 2 ) exceeds [0 , 1] d , then the closest point to x 1 within the feasibledomain must have an associated distance ˆ r > r ′ , as is demonstrated within Figure 1c.
Revised: However, the asymmetric nature of B P ( x 2 , r 2 )about x 1 guarantees that if B P ( x 2 , r 2 ) exceeds [0 , 1] d , then the closest point to x 1 within the feasibledomain must have an associated distance ˆ r > r ′ , as is demonstrated within Figure 1c.

Original: This allows usto make the following observation about improving the feasible radius of certification.
Revised: This allows usto make the following observation about improving the feasible radius of certification.

Original: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .
Revised: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .

Original: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside thefeasible space for instances allows us to construct an updated region of certification where
Revised: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside thefeasible space for instances allows us to construct an updated region of certification where

Original: [Equation]
Revised: [Equation]

Original: where z k =
Revised: where z k =

Original: (cid:26)if x 1 ,k < 0 . 
Revised: (cid:26)if x 1 ,k < 0 . [Equation] [Equation] > 0 .

Original: [Equation]
Revised: [Equation]

Original: where 1 is an indicator function acting upon its operator.
Revised: where 1 is an indicator function acting upon its operator.

Original: Proof.
Revised: Proof.

Original: In contrast to the prior proof, for this problem we retain the coordinate system of the inputspace.
Revised: In contrast to the prior proof, for this problem we retain the coordinate system of the inputspace.

Original: To support this, we introduce the notation that x n = { x n, 1 , x n, 2 , . . .
Revised: To support this, we introduce the notation that x n = { x n, 1 , x n, 2 , . . .

Original: , x n,d } .
Revised: , x n,d } .

Original: If we let 159 x k ∈ { 0 , 1 } , then the intersection between B P ( x 2 , L 2 ) and the bounding surface in dimension k 160 creates a bounding hypersphere of the form
Revised: If we let 158 x k ∈ { 0 , 1 } , then the intersection between B P ( x 2 , L 2 ) and the bounding surface in dimension k 159 creates a bounding hypersphere of the form

Original: [Equation]
Revised: [Equation]

Original: which yields an effective radius r r 2 =
Revised: which yields an effective radius r r 2 =

Original: [Equation]
Revised: [Equation]

Original: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (17) must take the formˆ[Equation] k
Revised: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (17) must take the formˆ

Original: [Equation]
Revised: [Equation]

Original: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radius of certification.
Revised: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radius of certification.

Original: 3.4 Algorithms
Revised: 3.4 Algorithms

Original: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (5) through a simple, gradient based solver.
Revised: To demonstrate how the above certification approaches can be applied in practice, Algorithm demonstrates the application of Equation (5) through a simple, gradient based solver.

Original: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.
Revised: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.

Original: To implement the multiple
Revised: To implement the multiple

Original: Algorithm
Revised: Algorithm

Original: 1: Input: data x , samples N , iterations M , true-label i 2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Algorithm` x ′ + N ` 0 , σ 2 I N ˘ , N, σ ˘ 4: if j = i then 5: r ′ =
Revised: 1: Input: data x , samples N , iterations M , true-label i 2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Algorithm` x ′ + N ` 0 , σ 2 I N ˘ , N, σ ˘ 4: if j = i then 5: r ′ =

Original: L 2 − ∥ x ′ − x ∥ 6: if r ′ >
Revised: L 2 − ∥ x ′ − x ∥ 6: if r ′ >

Original: r
Revised: r

Original: o
Revised: o

Original: then 7: r ′ o = r ′ 8: end if 9: x ′ = x ′ ±
Revised: then 7: r ′ o = r ′ 8: end if 9: x ′ = x ′ ±

Original: γ ∇ x ′ r ′
Revised: γ ∇ x ′ r ′

Original: ∥∇ x ′ r ′
Revised: ∥∇ x ′ r ′

Original: ∥ { γ calculated by Barzilai-Borwein [1].
Revised: ∥ { γ calculated by Barzilai-Borwein [1].

Original: Positive branch is selected if j = i , otherwise the negative branch brings x ′ towards the region in which j = i .} 10: end if 11: end for transitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (12).
Revised: Positive branch is selected if j = i , otherwise the negative branch brings x ′ towards the region in which j = i .} 10: end if 11: end for transitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (12).

Original: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (16) to the output of Algorithm 1.
Revised: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (16) to the output of Algorithm 1.

Original:  Extracting gradient information from non-differentiable functions
Revised:  Extracting gradient information from non-differentiable functions

Original: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.
Revised: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.

Original: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).
Revised: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).

Original: Within this work we haveimplemented two mechanisms to circumvent these conditions.
Revised: Within this work we haveimplemented two mechanisms to circumvent these conditions.

Original: The first substitutes the arg maxoperation with a Gumbel-Softmax [14].
Revised: The first substitutes the arg maxoperation with a Gumbel-Softmax [15].

Original: In doing so, the class expectations are rendered differentiable.
Revised: In doing so, the class expectations are rendered differentiable.

Original: The second approach involves recasting the Monte-Carlo estimators as integrals of the form
Revised: The second approach involves recasting the Monte-Carlo estimators as integrals of the form

Original: [Equation]
Revised: [Equation]

Original: [Equation] where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .
Revised: (19) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .

Original: This formalism,and the symmetry of the underlying space allows for the construction of undifferentiable gradients by
Revised: This formalism,and the symmetry of the underlying space allows for the construction of undifferentiable gradients by

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [29].
Revised: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [33].

Original: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [24].
Revised: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [27].

Original: The relative performance of these two approaches—respectively labelled ‘Approximate’ and ‘Full’for the above approach and the Gumbel-Softmax approaches—will be tested in the following section.
Revised: The relative performance of these two approaches—respectively labelled ‘Approximate’ and ‘Full’for the above approach and the Gumbel-Softmax approaches—will be tested in the following section.

Original: For the case of the double transitivity of Section 3.2 our experiments suggest that uncertainty in theanalytic derivatives produces deleterious results.
Revised: For the case of the double transitivity of Section 3.2 our experiments suggest that uncertainty in theanalytic derivatives produces deleterious results.

Original: As such derivatives for the multiple transitivityapproach are exclusively considered through autograd for both the Full and Approximate methods.
Revised: As such derivatives for the multiple transitivityapproach are exclusively considered through autograd for both the Full and Approximate methods.

Original:  Experiments
Revised:  Experiments

Original: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [18], CIFAR- 10 [17], and Tiny-Imagenet [15], the
Revised: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [19], CIFAR- 10 [18], and Tiny-Imagenet [16], the

Original: 5 R 0 .0 .0 .0 .0 .1 .
Revised: 5 R 0 .0 .0 .0 .0 .1 .

Original: C e rt
Revised: C e rt

Original: i ﬁ e d A cc u r a c y a) MNIST 0 .0 .1 .1 .
Revised: i ﬁ e d A cc u r a c y a) MNIST 0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .b)
Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .b)

Original: CIFAR0 .0 .1 .1 .
Revised: CIFAR0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Original: .c)
Revised: .c)

Original: Tiny-Imagenet
Revised: Tiny-Imagenet

Original: Cohen σ =0 .
Revised: Cohen σ =0 .

Original: 5 Best Approx σ =0 .
Revised: 5 Best Approx σ =0 .

Original: Best Full σ =0 .
Revised: Best Full σ =0 .

Original: 5 Cohen σ =1 .
Revised: 5 Cohen σ =1 .

Original: Best Approx σ =1 . 

Revised: Best Approx σ =1 .

Original: Best Full σ =1 .
Revised: Best Full σ =1 .

Original: latter of these is a 200 -class variant of Imagenet [38] which downsamples images to 3 × 60 × 60 .
Revised: latter of these is a 200 -class variant of Imagenet [43] which downsamples images to 3 × 60 × 60 .

Original: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [28], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.
Revised: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [32], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.

Original: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.
Revised: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.

Original: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.
Revised: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.

Original: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.
Revised: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.

Original: Parameter optimisation was performed with Adam [16],with the learning rate set as 0 .001 .
Revised: Parameter optimisation was performed with Adam [17],with the learning rate set as 0 .

Original: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.
Revised: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.

Original: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .
Revised: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .

Original: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .
Revised: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .

Original: The full code to implement our experiments can be found at anonymised link .
Revised: The full code to implement our experiments can be found at anonymised link .

Original: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.
Revised: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.

Original: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.
Revised: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.

Original: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.
Revised: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.

Original: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certified radius, as evidenced by the results for Tiny-Imagenet.
Revised: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certified radius, as evidenced by the results for Tiny-Imagenet.

Original: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .
Revised: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .

Original: While this process shrinks theachievable certified radius, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.
Revised: While this process shrinks theachievable certified radius, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.

Original: This property would suggestthat samples with a larger R would exhibit a decreased difference between our techniques and thatof Cohen et al.
Revised: This property would suggestthat samples with a larger R would exhibit a decreased difference between our techniques and thatof Cohen et al.

Original: would decrease, as smaller values of E 1 provide less search information.
Revised: would decrease, as smaller values of E 1 provide less search information.

Original: However,it appears that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 } counteract the decreasedinformation provided by the second highest class, leading to the contradictory performance bestobserved in the MNIST experiments of Figure 2 at σ = 0 .
Revised: However,it appears that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 } counteract the decreasedinformation provided by the second highest class, leading to the contradictory performance bestobserved in the MNIST experiments of Figure 2 at σ = 0 .

Original: Rather than strictly considering the best performing of the Approximate and Full solvers, we canalso delve into the relative performance of the underlying solvers.
Revised: Rather than strictly considering the best performing of the Approximate and Full solvers, we canalso delve into the relative performance of the underlying solvers.

Original: Notably there is a moderateincrease in the average percentage improvement of Figure 3 between the σ = 0 .
Revised: Notably there is a moderateincrease in the average percentage improvement of Figure 3 between the σ = 0 .

Original: 5 and σ = 1 . 0 cases.
Revised: 5 and σ = 1 . 0 cases.

Original: This would appear to belie our previous statement regarding larger certifications yielding smallerimprovements, due to the asymmetry of class information.
Revised: This would appear to belie our previous statement regarding larger certifications yielding smallerimprovements, due to the asymmetry of class information.

Original: However, an equivalent certificationfor σ = 1 . 0 has significantly more information about the second class (due to the multiplicativeinfluence of σ ) , allowing for greater improvements from our gradient based search.
Revised: However, an equivalent certificationfor σ = 1 . 0 has significantly more information about the second class (due to the multiplicativeinfluence of σ ) , allowing for greater improvements from our gradient based search.

Original: That there isa clear demarcation between the Full and Approximate solver variants reflects the uncertainties
Revised: That there isa clear demarcation between the Full and Approximate solver variants reflects the uncertainties

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: introduced by Equation (20).
Revised: introduced by Equation (20).

Original: That the approximate technique is still applicable verifies the utility ofour approach even when the final layer is a strict arg max function, rather than a Gumbel-Softmax.
Revised: That the approximate technique is still applicable verifies the utility ofour approach even when the final layer is a strict arg max function, rather than a Gumbel-Softmax.

Original: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .
Revised: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .

Original: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.
Revised: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.

Original: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.
Revised: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.

Original: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).
Revised: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).

Original: Numerical performance The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.
Revised: Numerical performance The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.

Original: While analytically approximating the derivatives for the first eccentric hypersphereyields a lower certified accuracy, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.
Revised: While analytically approximating the derivatives for the first eccentric hypersphereyields a lower certified accuracy, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.

Original: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.
Revised: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.

Original: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .
Revised: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .

Original: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.
Revised: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.

Original: Limitations While the principles of our Geometrically Informed Certified Robustness are extensibleto L p spaces, our experimental work has so far only considered L 2 -norm bounded perturbations
Revised: Limitations While the principles of our Geometrically Informed Certified Robustness are extensibleto L p spaces, our experimental work has so far only considered L 2 -norm bounded perturbations

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: due to the guarantee of best possible certification in this space provided by Cohen et al. .
Revised: due to the guarantee of best possible certification in this space provided by Cohen et al. .

Original: Furtherexperimentation could also consider both these general spaces and a broader range of trainingmethods, which have been shown to be able to tighten the achievable radius of certification [22].
Revised: Furtherexperimentation could also consider both these general spaces and a broader range of trainingmethods, which have been shown to be able to tighten the achievable radius of certification [24].

Original: We note that enhanced robustness certification have the potential to counter beneficial applications ofadversarial attacks, such as those used to promote stylometric privacy [3].
Revised: We note that enhanced robustness certification have the potential to counter beneficial applications ofadversarial attacks, such as those used to promote stylometric privacy [3].

Original: However, we believe thisdrawbacks is significantly outweighed by the potential for enhanced confidence about models forwhich adversarial incentives exist.
Revised: However, we believe thisdrawbacks is significantly outweighed by the potential for enhanced confidence about models forwhich adversarial incentives exist.

Original: Finally, we also emphasise that our optimisation driven process induces additional computationalcost relative to traditional certification, due to the need for multiple evaluations of the Monte-Carloexpectations, which in turn each require N ≫ 100 model draws.
Revised: Finally, we also emphasise that our approach requires M evaluations of the certified robustness,which each require N Monte-Carlo draws, resulting in time- and memory-complexity of O ( MN )and O ( NS ) respectively, where S is the size of the output logit vector. With respect to the memorycomplexity, this is shared by any randomised smoothing based approach, and could be improvedby implementing batching across the Monte-Carlo process.

Original: This computational cost may beburdensome in some contexts, and imposes additional energy and computational costs, however webelieve that the cost may be more than worth it for high-value models deployed in environmentsconsidered vulnerable to adversarial attacks.
Revised: While the time cost can be problematicin some contexts, we emphasise that this framework is both requires both fewer adaptations to thetraining loop and significantly less training time relative to bound propagation approaches [21, 36].

Original: While our current emphasis has been on demonstratingthe performance of Geometrically Informed Certified Robustness, we believe that the computationalcosts can be reduced by performing the optimisation stages with N ′ < N model draws, and bypotentially reusing model draws across the iterative process.
Revised: Moreover, we believe that the time-costs can be reduced by performing the optimisation stages with N ′ < N model draws, and by potentially reusing model draws across the iterative process to approachthe O ( N ) time-complexity of prior randomised smoothing based certifications.

Original: However even at present the increasedcomputational cost is not intractable, especially for human-in-the-loop certification systems.
Revised: Even at present, webelieve that the increased computational cost is not intractable, especially for human-in-the-loopcertification systems.

Original:  Conclusions
Revised:  Conclusions

Original: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.
Revised: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.

Original: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .
Revised: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .

Original: 5 , with the percentage increaseimproving quasi-linearly with σ .
Revised: 5 , with the percentage increaseimproving quasi-linearly with σ .

Original: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate.
Revised: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate.

Original: A Appendix
Revised: Checklist

Revised: For all authors...

Revised: (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s

Revised: contributions and scope?

Revised: [Yes]

Revised: (b) Did you describe the limitations of your work?

Revised: [Yes]

Revised: In the Limitations section of

Revised: Section

Revised: (c) Did you discuss any potential negative societal impacts of your work?

Revised: [Yes] In theLimitations section of Section 5(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?

Revised: [Yes]

Revised: If you are including theoretical results...

Revised: (a) Did you state the full set of assumptions of all theoretical results?

Revised: [Yes]

Revised: (b) Did you include complete proofs of all theoretical results?

Revised: [Yes]3.

Revised: If you ran experiments...

Revised: (a) Did you include the code, data, and instructions needed to reproduce the main experimental results (either in the supplemental material or as a URL)?

Revised: [Yes] This has been

Revised: included in the supplementary materials, with license details included therein.

Revised: (b) Did you specify all the training details (e

Revised: g., data splits, hyperparameters, how theywere chosen)?

Revised: [Yes]

Revised: In Section

Revised: (c) Did you report error bars (e

Revised: g., with respect to the random seed after running ex-

Revised: periments multiple times)?

Revised: [No] As all experimental results are based upon metrics

Revised: calculated over more than 1000 samples, the size of the underlying error bars are small

Revised: enough to be negligible.

Revised: (d) Did you include the total amount of compute and the type of resources used (e

Revised: g., type

Revised: of GPUs, internal cluster, or cloud provider)?

Revised: [Yes]

Revised: In Section

Revised: If you are using existing assets (e

Revised: g., code, data, models) or curating/releasing new assets...

Revised: (a)

Revised: If your work uses existing assets, did you cite the creators?

Revised: [Yes]

Revised: (b) Did you mention the license of the assets?

Revised: [Yes] In Appendix A.1.

Revised: (c) Did you include any new assets either in the supplemental material or as a URL?

Revised: [No]

Revised: (d) Did you discuss whether and how consent was obtained from people whose data you’re

Revised: using/curating?

Revised: [N/A]

Revised: (e) Did you discuss whether the data you are using/curating contains personally identifiable

Revised: information or offensive content?

Revised: [N/A]

Revised: If you used crowdsourcing or conducted research with human subjects...

Revised: (a) Did you include the full text of instructions given to participants and screenshots, if

Revised: applicable?

Revised: [N/A]

Revised: (b) Did you describe any potential participant risks, with links to Institutional Review

Revised: Board (IRB) approvals, if applicable?

Revised: [N/A]

Revised: (c) Did you include the estimated hourly wage paid to participants and the total amount

Revised: spent on participant compensation?

Revised: [N/A]

Revised: A Appendix

Original: A.1 Algorithmic details
Revised: A.1 Algorithmic details

Original: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.
Revised: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.

Original: Of note are two minor changes from prior implementations of this certification regime.
Revised: Of note are two minor changes from prior implementations of this certification regime.

Original: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the‘Full’ derivative approach.
Revised: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the‘Full’ derivative approach.

Original: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .
Revised: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .

Original: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .
Revised: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .

Original: Our initial testing revealed that when we employed either Sison-Glaz [33] or Goodman et al.[13] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.
Revised: Our initial testing revealed that when we employed either Sison-Glaz [38] or Goodman et al.[14] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.

Original: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .
Revised: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .

Original: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)
Revised: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)

Original: y j < 5 y j , which conforms with the requirements of
Revised: y j < 5 y j , which conforms with the requirements of

Original: Goodman et al.
Revised: Goodman et al.

Original: [13] that all class counts must be greater than 5 .
Revised: [14] that all class counts must be greater than 5 .

Original: Our testing demonstrated that whilethis process slightly decreased the resulting radius of certification (due to small changes in z 0 andz 1 ), the associated decrease in computational time was significant enough to justify this modification.
Revised: Our testing demonstrated that whilethis process slightly decreased the resulting radius of certification (due to small changes in z 0 andz 1 ), the associated decrease in computational time was significant enough to justify this modification.

Original: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.
Revised: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.

Original: MNIST exists under a GNU v 3 . 0 license;
Revised: MNIST exists under a GNU v 3 . 0 license;

Original: CIFAR-
Revised: CIFAR-

Original: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.
Revised: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.

Original: A.2 Ramifications of the dimensionality for n > 3
Revised: A.2 Ramifications of the dimensionality for n > 3

Original: To improve the achieved certification in the case n > 3 , the added set of hyperspheres must fullyenclose the ( d − 1) -dimensional manifold that marks the intersection between S 2 and S 3 .
Revised: To improve the achieved certification in the case n > 3 , the added set of hyperspheres must fullyenclose the ( d − 1) -dimensional manifold that marks the intersection between S 2 and S 3 .

Original: In two- 456 dimensions—as is used in the examplar Figure 1a—this intersection takes the form of two points.
Revised: In two- 470 dimensions—as is used in the examplar Figure 1a—this intersection takes the form of two points.

Original: If
Revised: If

Original: Lemma’s 3.3 and 3.4 are to hold, then encompasing S 2 ∩ S 3 will require two additional certification 458 hyperspheres to be identified.
Revised: Lemma’s 3.3 and 3.4 are to hold, then encompasing S 2 ∩ S 3 will require two additional certification 472 hyperspheres to be identified.

Original: In the case where d = 3 , the intersection between these two hyperspheres is the boundary of thecircle (equivalent to a d = 2 hypersphere) with radius
Revised: In the case where d = 3 , the intersection between these two hyperspheres is the boundary of thecircle (equivalent to a d = 2 hypersphere) with radius

Original: [Equation]
Revised: [Equation]

Original: Thus any set of spheres {S 2 , S 3 , . .
Revised: Thus any set of spheres {S 2 , S 3 , . .

Original: . , S n } must uniformly cover all points on the boundary of this 462 surface if we seek to improve the achieved certification.
Revised: . , S n } must uniformly cover all points on the boundary of this 476 surface if we seek to improve the achieved certification.

Original: To provide an indicative example of how the complexity of the region that must be encircled growswith the underlying dimensionality, we now consider some properties of hyperspheres.
Revised: To provide an indicative example of how the complexity of the region that must be encircled growswith the underlying dimensionality, we now consider some properties of hyperspheres.

Original: In higher dimensions, prior work [34] has demonstrated that the volume contained within a d -dimensionalhypersphere can be expressed as
Revised: In higher dimensions, prior work [39] has demonstrated that the volume contained within a d -dimensionalhypersphere can be expressed as

Original: [Equation]
Revised: [Equation]

Original: 22) with an associated surface area of
Revised: (22) with an associated surface area of

Original: [Equation]
Revised: [Equation]

Original: Thus if S 2 and S 3 are d -dimensional hyperspheres, then their region of intersection would in turn bea ( d − 1) -dimensional hypersphere, the exterior boundary of which scales with ˜ r d − 2 .
Revised: Thus if S 2 and S 3 are d -dimensional hyperspheres, then their region of intersection would in turn bea ( d − 1) -dimensional hypersphere, the exterior boundary of which scales with ˜ r d − 2 .

Original: While ˜ r maybe less than 1 , it should also be true that any additional spheres would likely have an associated radiiless than ˜ r .
Revised: While ˜ r maybe less than 1 , it should also be true that any additional spheres would likely have an associated radiiless than ˜ r .

Original: As such there would appear to be a power-law proportionality with respect to ( d − 1)between the area covered by the intersection manifold and the size of spheres over which we wouldseek to enclose said manifold.
Revised: As such there would appear to be a power-law proportionality with respect to ( d − 1)between the area covered by the intersection manifold and the size of spheres over which we wouldseek to enclose said manifold.

Original: This underscores the complexity of finding a set of hyperspheres toencircle the boundary of S 2 ∩ S 3 .
Revised: This underscores the complexity of finding a set of hyperspheres toencircle the boundary of S 2 ∩ S 3 .

Original: To give further evidence in the growth of complexity, let us consider a unit-hypersphere in R d thatrepresents the intersection of two hyperspheres in R d +1 .
Revised: To give further evidence in the growth of complexity, let us consider a unit-hypersphere in R d thatrepresents the intersection of two hyperspheres in R d +1 .

Original: The task of covering such a hypersphereis similar to that of the sphere packing kissing number k ( d ) [8], which describes the number oftouching-but-not-overlapping unit-hyperspheres that can exist upon the surface of a d -dimensionalhypersphere.
Revised: The task of covering such a hypersphereis similar to that of the sphere packing kissing number k ( d ) [9], which describes the number oftouching-but-not-overlapping unit-hyperspheres that can exist upon the surface of a d -dimensionalhypersphere.

Original: To date, the kissing number has only been solved for the following dimensions outlinedin
Revised: To date, the kissing number has only been solved for the following dimensions outlinedin

Original: Table 2, however it has been shown to exhibit exponential growth [4].
Revised: Table 2, however it has been shown to exhibit exponential growth [4].

Original: d      k ( d )  12 [31] 24 [25] 240 [26] 196 , 560 [26]
Revised: d      k ( d )  12 [35] 24 [29] 240 [30] 196 , 560 [30]

Original: Within the context of this work, the kissing number must be considered to be a significant underestimate of the number of boundary spheres that would be required to be found, as we must coverall the space around the central sphere (rather than just maximising the number of hypersphereswithout intersection), and it is unlikely that the smallest of the set of encircling hyperspheres hasthe same radius as the region to be encircled.
Revised: Within the context of this work, the kissing number must be considered to be a significant underestimate of the number of boundary spheres that would be required to be found, as we must coverall the space around the central sphere (rather than just maximising the number of hypersphereswithout intersection), and it is unlikely that the smallest of the set of encircling hyperspheres hasthe same radius as the region to be encircled.

Original: As such, we can be highly confident that the growthin complexity of the task of enclosing the boundary of intersection beyond the set of hyperspheres{S 1 , S 2 , S 3 } is exponential.
Revised: As such, we can be highly confident that the growthin complexity of the task of enclosing the boundary of intersection beyond the set of hyperspheres{S 1 , S 2 , S 3 } is exponential.

Original: We must also note that even if it were possible to perform such a bounding operation, the gains incertified radius would be exceedingly minor.
Revised: We must also note that even if it were possible to perform such a bounding operation, the gains incertified radius would be exceedingly minor.

Original: If the region of intersection between S 2 and S 3 was a 490 hypersphere of radius ˘ r , then going from the case where n = 3 to n > 3 would only increase thecertified radius from a ( r ′ ) 

Revised: If the region of intersection between S 2 and S 3 was a 504 hypersphere of radius ˘ r , then going from the case where n = 3 to n > 3 would only increase thecertified radius from a ( r ′ )

Original: + (˘ r ) 2 to a ( r ′ ) 2 + 9(˘ r ) 2 , which is trivial relative to the increase incomputational complexity.
Revised: + (˘ r ) 2 to a ( r ′ ) 2 + 9(˘ r ) 2 , which is trivial relative to the increase incomputational complexity.

Original: A.3 Relative performance for MNIST and CIFAR-10
Revised: A.3 Relative performance for MNIST and CIFAR-10

Original: While Figure 2 presents the best performing certified accuracy, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.
Revised: While Figure 2 presents the best performing certified accuracy, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.

Original: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .
Revised: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .

Original: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.
Revised: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.

Original: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .
Revised: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .

Original: 0but not σ = 0 .
Revised: 0but not σ = 0 .

Original: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.
Revised: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.

Original: While CIFAR- 10 is a more complex predictive
Revised: While CIFAR- 10 is a more complex predictive

Original: [Figure]
Revised: [Figure]

Original: Equivalent figures for Tiny-Imagenet can be seen in Figure
Revised: Equivalent figures for Tiny-Imagenet can be seen in Figure

Original: [Figure]
Revised: [Figure]

Original: Equivalent figures for Tiny-Imagenet can be seen in
Revised: Equivalent figures for Tiny-Imagenet can be seen in

Original: environment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of therelative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-
Revised: environment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of therelative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-

Original: 10when
Revised: 10when

Original: σ = 0 .
Revised: σ = 0 .

Original: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,
Revised: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,

Original: MNIST again reveals interesting properties when we consider Figure 10.
Revised: MNIST again reveals interesting properties when we consider Figure 10.

Original: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.
Revised: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.

Original: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solvermay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.
Revised: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solvermay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.

Original: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .
Revised: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .

Original: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.
Revised: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.

Original: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in
Revised: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in

Original: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.
Revised: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.

Original: to be improvedupon in low semantic complexity datasets is smaller.
Revised: to be improvedupon in low semantic complexity datasets is smaller.

Original: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.
Revised: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.

Original: [Figure]
Revised: [Figure]

Original: rt i
Revised: rt i

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: each of our approaches relative to Cohen et al.
Revised: each of our approaches relative to Cohen et al.

Original: for MNIST across the level of additive noise σ .
Revised: for MNIST across the level of additive noise σ .

Original: The median was chosen to provide a fair and representative comparison to Cohen et al. , that filters out outliers in the percentage improvement when r ≪ 1 .
Revised: The median was chosen to provide a fair and representative comparison to Cohen et al. , that filters out outliers in the percentage improvement when r ≪ 1 .

Original: [Figure]
Revised: σ

Original: [Figure]
Revised: [Figure]

Original: n
Revised: n

Original: [Figure]
Revised: [Figure]

Original: ce n t ag e I m p
Revised: ce n t ag e I m p

Original: r
Revised: r

Original: o v e
Revised: o v e

Original: m e n t
Revised: m e n t

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: A.4 Influence of the starting step size
Revised: A.4 Influence of the starting step size

Original: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.
Revised: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.

Original: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .
Revised: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .

Original: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 .
Revised: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 .

Original: 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.
Revised: 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.

Original: This is likely due to the added uncertainty in the
Revised: This is likely due to the added uncertainty in the

Original: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.
Revised: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.

Original: Based upon these results, the starting step size was uniformly set to 0 .
Revised: Based upon these results, the starting step size was uniformly set to 0 .

Original: 01 for allexperiments.
Revised: 01 for allexperiments.

Original: [Figure]
Revised: [Figure]

Original: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity
Revised: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity

Original: Anonymous Author(s)
Revised: Anonymous Author(s)

Original: AffiliationAddress email
Revised: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.
Revised: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.

Original: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.
Revised: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.

Original: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radius ofcertification (under the L 2 norm) is possible given only these score.
Revised: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radius ofcertification (under the L 2 norm) is possible given only these score.

Original: However, itis an open question as to whether such lower bounds can be improved using localinformation around the instance under test.
Revised: However, itis an open question as to whether such lower bounds can be improved using localinformation around the instance under test.

Original: In this work, we demonstrate howtoday’s “optimal” certificates can be improved by exploiting both the transitivityof certifications, and the geometry of the input space, giving rise to what we term
Revised: In this work, we demonstrate howtoday’s “optimal” certificates can be improved by exploiting both the transitivityof certifications, and the geometry of the input space, giving rise to what we term

Original: Geometrically-Informed Certified Robustness .
Revised: Geometrically-Informed Certified Robustness .

Original: Essentially we search for, and mergewith, larger certifiable balls nearby to an initial instance under test.
Revised: Essentially we search for, and mergewith, larger certifiable balls nearby to an initial instance under test.

Original: Our approachimproves certifications for more than 80% of instances in experiments with TinyImagenet, with an on average 5% increase in the associated radius of certification.
Revised: Our approachimproves certifications for more than 80% of instances in experiments with TinyImagenet, with an on average 5% increase in the associated radius of certification.

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification

Original: (cid:58)
Revised: (cid:58)

Original:  Introduction
Revised:  Introduction

Original: Learned models, including neural networks, are well known to be susceptible to crafted perturbationsinducing changes in a model’s output without changing semantic properties of the input [2].
Revised: Learned models, including neural networks, are well known to be susceptible to crafted perturbationsinducing changes in a model’s output without changing semantic properties of the input [2].

Original: Concerningly, neural (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) output (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) changed (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) crafted (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) perturbations (cid:58)(cid:58) to (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) input, (cid:58)(cid:58)(cid:58)
Revised: Concerningly, neural (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) output (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) changed (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) crafted (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) perturbations (cid:58)(cid:58) to (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) input, (cid:58)(cid:58)(cid:58)

Original: that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) preserve(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) inputs (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) semantic (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) properties (cid:58)(cid:58)(cid:58) [2].
Revised: that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) preserve(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) inputs (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) semantic (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) properties (cid:58)(cid:58)(cid:58) [2].

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Neural (cid:58) networks not only misclassify these perturbations—known 20 as adversarial examples —but they also assign high confidence to these incorrect predictions.
Revised: Neural (cid:58) networks not only misclassify these perturbations—known 20 as adversarial examples —but they also assign high confidence to these incorrect predictions.

Original: Thesebehaviours have been observed across a wide range of models and datasets, and appear to be a productof piecewise-linear interactions within neural networks [12].
Revised: Thesebehaviours have been observed across a wide range of models and datasets, and appear to be a productof piecewise-linear interactions within neural networks [13].

Original: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.
Revised: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.

Original: These attacks have been applied to both black- and white-box models [26], and canbe used to target class changes, to attack all classes [9], or even introduce backdoors into modelbehaviour [5].
Revised: These attacks have been applied to both black- and white-box models [30] and can be used to target class changes, to attack all classes [10] or even introduce backdoors into modelbehaviour [5].

Original: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).
Revised: To mitigate the influence of these attacks, defences have typically been designed to minimise the effect of a specific attack (or attacks).

Original: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.
Revised: Such defences are known as best response strategies in a Stackelberg security game where the defender leads the attacker.

Original: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.
Revised: Best response defences inherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.

Original: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.
Revised: Moreover, the defender typically has to incorporate the defence at training time, and as such cannot response reactively to newly developed attacks.

Original: In an attempt to  circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.
Revised: In an attempt to (cid:58)(cid:58) To (cid:58) circumvent these limitations certified guarantees of adversarial robustness can be constructed , to identify class-constant regions around an input instance.

Original: Irrespective of the attack,all instances within a certain distancefrom aninput (typically L 2 distance) are guaranteed notto be adversarial examples.
Revised: Irrespective of the attack, distance an not examples.

Original: Certifications based on randomised smoothing of classifiers around an input point are in a sense optimal [7]: based only on the prediction class scores at the input point, nobetter radius is in general possible.
Revised: Certifications based on randomised smoothing of classifiers around an input point are in a sense optimal [8]: based onlyon the prediction class scores at the input point, no better radius is in general possible.

Original: Despite this, such certifications fail to use readily available—yetstill local—information: the certifiability of points nearby to the input of interest.
Revised: Despite this,such certifications fail to use readily available—yet still local—information: the certifiability ofpoints nearby to the input of interest.

Original: The key insightof this work is that these neighbourhood points may generate certified radii large enough that wemay enlarge the certified region based solely on classifier information at the initial point[Table] enough
Revised: The key insight of this work is that these neighbourhood pointsmay generate certified radii large enough that we may enlarge the certified region based solely onclassifier information at the initial point

Original: [Table]
Revised: [Table]

Original: certification.
Revised: certification.

Original: This42 process is not just limited to a single neighbouring point either, as we can also (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) extended(cid:58)(cid:58) to use the intersection of the regions of certification of multiple points, and the nature of the inputdomain itself to generate larger certifications.
Revised: This process is not just limited to a single neighbouringpoint either, as we can also (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) extended (cid:58)(cid:58) to use the intersection of the regions of certification ofmultiple points, and the nature of the input domain itself to generate larger certifications.

Original: This leads to our main contribution— GeometricallyInformed Certified Robustness —that enjoys certifications exceeding those of the hitherto best-caseguaranteed approach of Cohen et al.
Revised: This leadsto our main contribution— Geometrically-Informed Certified Robustness —that enjoys certificationsexceeding those of the hitherto best-case guaranteed approach of Cohen et al.

Original:  Background and literature review
Revised:  Background and literature review

Revised: Bounding mechanisms An alternate perspective on bounding

Revised: [Table]

Revised: Conservative

Original: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [24, 35, 38, 39, 30].
Revised: [Table] bounds [Table] upon (cid:58) the impact of norm-bounded perturbations has been to construct conservative bounds on the output ofa model[27, 40, 43, 44, 35].

Revised: Framed as convex relaxation, these techniques (cid:58)(cid:58)(cid:58) can

Revised: [Table]

Revised: be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) constructed

Original: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs  over input bounded perturbations [29].
Revised: [Table] by [Table] which utilise linear relaxation to construct bounding polytopes of amodel’s outputs (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) output (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) polytopes (cid:58) over input bounded perturbations [33]

Revised: These approaches havebeen leveraged by adopting (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [33, 27, 40, 43, 44, 35, 29] (cid:58) , (cid:58)(cid:58) in (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) manner (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) generally (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provides (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) tighter(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: These approaches have beenleveraged by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: bounds (cid:58)(cid:58)(cid:58)(cid:58) than (cid:58)(cid:58)(cid:58)(cid:58)

Original:  employ adopting augmented loss functions during training , to  promote tight outputbounds [36].
Revised: [Table] employ aug- 56 mented loss functions during training, to [Table] which promote tight output bounds [41]

Original: While bounding mechanisms can produce valid certifications, their(cid:58)(cid:58)(cid:58) they (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) appear (cid:58)(cid:58) to(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exhibit
Revised: While boundingmechanisms can produce valid certifications, their

Original: [Table]
Revised: [Table]

Original: a
Revised: at

Original: [Table]
Revised: [Table]

Original: time and memory complexity
Revised: the

Original: [Table]
Revised: [Table]

Original: that makes them infeasible to address
Revised: cost

Original: [Table]
Revised: [Table]

Original: complex model
Revised: applicability.

Original: [Table]
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Moreover(cid:58)(cid:58)(cid:58)

Original:  architectures or high-dimensional data [34].
Revised: they (cid:58)(cid:58)(cid:58)(cid:58) both (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exhibit (cid:58)(cid:58) a time and memory complexity (cid:58)(cid:58)(cid:58) that (cid:58) makes them infeasible to address (cid:58)(cid:58) for (cid:58) complex 59 model architectures or high-dimensional data[39]

Original: [Table]
Revised: [Table]

Original: Randomised smoothing Outside of bounding mechanisms, another common framework for de- [Table] veloping certifications leverages randomised smoothing [20] [Table]
Revised: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [21], in which noise is applied to inputinstances to smooth model predictions.

Original: in which noise is applied to input [Table] instances to smooth model predictions. In contrast to other robustness mechanisms, randomised
Revised: In contrast to other robustness mechanisms, randomisedsmoothing only requires minimal changes to a classifier, specifically the repeated sampling ofnoise-based perturbation of the inputs, where the choice of sampling distribution (cid:58) , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) subject (cid:58)(cid:58)(cid:58) to (cid:58) a(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sampling (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) distribution (cid:58)(cid:58)(cid:58)(cid:58) that is tied to the L P -norm of adversarial perturbations being certified against.

Original: [Table] smoothing only requires minimal changes to a classifier, specifically the repeated sampling of [Table] noise-based perturbation of  the inputs, where the choice of sampling distribution
Revised: In (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) contrast (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) other (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) robustness (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) mechanisms, (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) application (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) noise (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) only (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) architectural(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) change (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) required (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achieve (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.

Original: [Table] [Table]
Revised: (cid:58)(cid:58)

Original: is [Table] the  L P -norm  of adversarial perturbations being certified against [Table]
Revised: In (cid:58) the case of L 2 -norm bounded attacks, Gaussian 68 sampling of the form

Original: [Equation]
Revised: [Equation]

Original: where y i i.i.d.
Revised: where y i i.i.d.

Revised: [Equation]

Revised: i

Original: [Equation]
Revised: [Equation]

Original: is employed for all test-time instances.
Revised: is employed for all test-time instances.

Original: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator
Revised: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator

Original: [Equation]
Revised: [Equation]

Original: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.
Revised: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.

Original: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.
Revised: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.

Original: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r .
Revised: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r .

Original: Certified robustnesshas not, however, extended to rotational or translational modifications [33], nor functional attacks[18].
Revised: Certified robustnesshas not, however, extended to rotational or translational modifications [38], nor functional attacks[19].

Original: That such guarantees are possible was first shown [20] , (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) recent (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) work (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considering (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) rotational(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) and/or (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) translational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: That such guarantees are possible was first shown [21] , (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) recent (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) work (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considering (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) rotational

Original: [Table]
Revised: [Table]

Revised: and/or

Original: [Table]
Revised: [Table]

Original: differential
Revised: attacks

Original: [Table]
Revised: [Table]

Original: [Table] [20, 10], with more recent works using (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: were

Original: [Table]
Revised: [Table]

Original: employing (cid:58) Rényidivergence [21]
Revised: first

Original: [Table]
Revised: [Table]

Original:  and parametrising worst-case behaviours [7, 28]. In this paper, we focus on theinfluential work of (cid:58)(cid:58)(cid:58) By (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considering (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) worst-case (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) L 2 -perturbations, (cid:58) Cohen et al.
Revised: demonstrated (cid:58) by way 81 of differential privacy[11] (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [21, 11], with more recent works using (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approaches (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) employing (cid:58) Rényidivergence [23], and parametrising worst-case behaviours [8, 32].

Original: (2019) , and theirlower-bound guarantee of classification invariance (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) purports (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) pointwise(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) is [Equation] [Figure]
Revised: In this paper, we focus on the

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original:  Equation (cid:58)(cid:58) 3) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) points (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x i ∀ i ∈ { 1 , 2 , 3 } .
Revised: (by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 3) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) points (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x i ∀ i ∈ { 1 , 2 , 3 } .

Original: (cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)

Original: The (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) resulting (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ′ , r ′′ ,(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)
Revised: The (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) resulting (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ′ , r ′′ , and (cid:58) ˆ r

Original: ˆ r

Original: (cid:58)(cid:58)(cid:58) are (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) described (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equations (cid:58)(cid:58) 5, (cid:58)(cid:58)(cid:58) 12, (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denote (cid:58)(cid:58)(cid:58)(cid:58) where
Revised: (cid:58)(cid:58)(cid:58) are (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) described (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equations (cid:58)(cid:58) 5, (cid:58)(cid:58)(cid:58) 12, (cid:58)(cid:58)(cid:58) [Table] [Table] [Table]

Original: [Table]
Revised: [Table]

Revised: [Table]

Revised: [Table]

Original: { E 0 , E 1 }
Revised: [Table] [Table] [Table] [Table]

Revised: pointwise

Original: [Table]
Revised: [Table]

Original:  are the two largest class expectations (of the winning class and runner).
Revised: certification (cid:58) is [Equation] where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denote (cid:58)(cid:58)(cid:58)(cid:58) Hhere(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) { E 0 , E 1 } (cid:58)(cid:58)(cid:58) are the two largest class expectations (of the winning class and runner).

Original: These expectations 84 capture the likelihood that the arg max of a single draw under noise would return a given class, asper Equation (2).
Revised: These expectations 88 capture the likelihood that the arg max of a single draw under noise would return a given class, asper Equation (2).

Original: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [7].
Revised: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [8].

Original: [Table]
Revised: (cid:58) ),

Original: [Table]
Revised: [Table]

Original: σ
Revised: σ

Original: [Table]
Revised: [Table]

Original: is
Revised: is

Original: [Table]
Revised: [Table]

Original: the
Revised: the

Original: [Table]
Revised: [Table]

Original: noise
Revised: noise,

Original: [Table]
Revised: [Table]

Original: and
Revised: and

Original: [Table]
Revised: [Table]

Original: Φ 
Revised: Φ −

Original: [Table]
Revised: [Table]

Original: is
Revised: is

Original: [Table]
Revised: [Table]

Original: the
Revised: the

Original: [Table]
Revised: [Table]

Original: inverse
Revised: inverse

Original: [Table]
Revised: [Table]

Original: Prior works have been able to generate improvements to Cohen for binomial classifiers [25] [Table] inwhich it is assumed that E 1 = 1 − E 0 .
Revised: Prior works have been able to generate improvements to Cohen for binomial classifiers [28], inwhich it is assumed that E 1 = 1 − E 0 .

Original: While any multivariate model can be mapped to a binaryoutput for the purposes of constructing a certification, artificially inflating E 1 inherently suppressesthe size of the certification, as per Equation .
Revised: While any multivariate model can be mapped to a binaryoutput for the purposes of constructing a certification, artificially inflating E 1 inherently suppressesthe size of the certification, as per Equation .

Original: In this paper we demonstrate a novel approach that cangenerate improvements to the certified robustness of multivariate classifiers [Table]
Revised: In this paper we demonstrate a novel approach that cangenerate improvements to the certified robustness of multivariate classifiers.

Original:  Geometrically-informed certified robustness
Revised:  Geometrically-informed certified robustness

Original: While the work contained within this paper can be applied generally [Table] for this work we will focus uponcertifications of robustness about L 2 -norm bounded adversarial perturbations, for which we assumethat the difficulty of attacking a model is proportional to the size of the certification, based upon theneed to evade both human and machine scrutiny [11].
Revised: While the work contained within this paper can be applied generally, for this work we will focus uponcertifications of robustness about L 2 -norm bounded adversarial perturbations, for which we assumethat the difficulty of attacking a model is proportional to the size of the certification, based upon theneed to evade both human and machine scrutiny [12].

Original: Thus, constructing larger certifications in sucha context is inherently valuable.
Revised: Thus, constructing larger certifications in sucha context is inherently valuable.

Original: This specific L P space is of interest due to both its viability as a defence model, and the existence ofa guarantee of adversarial robustness that is provably as large as can be achieved [Table] provable [Table]
Revised: This specific L P space is of interest due to both its viability as a defence model, and the existence ofa guarantee of adversarial robustness that is provably as large as can be achieved (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) guarantee

Original: guarantee

Original: [Table]
Revised: [Table]

Original: for any instance [7].
Revised: for any instance [8].

Original: Over the remainder 102 of this section we will document how it is possible to improve upon this provably best-case guaranteeby exploiting several properties of certified robustness.
Revised: Over the remainder 106 of this section we will document how it is possible to improve upon this provably best-case guaranteeby exploiting several properties of certified robustness

Revised: [Table]

Original: 3.1 Exploiting transitivity
Revised: 3.1 Exploiting transitivity

Original: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.
Revised: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.

Original: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radii(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius of x .
Revised: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radii radius of x .

Original: As both points must correspond to the same class, it then follows that the union of theirregions of certification can be also be considered as a region of certification, leading to Definition 3.1.
Revised: As both points must correspond to the same class, it then follows that the union of theirregions of certification can be also be considered as a region of certification, leading to Definition 3.

Original: Definition 3.1 ( Overlap Properties of Certification ) .

Original: If x 1 and x 2 have the same class associatedwith them (cid:58) A (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) r i (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58) x i (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) calculated (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) evaluating (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 3 (cid:58)(cid:58) at (cid:58)(cid:58)

Original: x i .

Original: (cid:58)(cid:58)(cid:58)(cid:58) This(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) guarantees (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)

Original: no (cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x

Original: [Table]
Revised: [Table]

Original: ∥

Original: [Table]

Original: − x

Original: [Table]

Original: ∥ P ≤

Original: [Table]

Original: i

Original: [Table]

Original: can

Original: [Table]

Original: induce

Original: [Table] a [Table] chance
Revised: Definition 3.1 ( Overlap Properties of Certification ) .

Original: [Table] in [Table] the 
Revised: If x 1 and x 2 have the same class associated

Original: [Table]
Revised: [Table]

Original: predicted [Table] [Table] That (cid:58)(cid:58)(cid:58) this
Revised: with them

Original: [Table]
Revised: [Table]

Original: shape

Original: [Table]

Original: is (cid:58)

Original: a
Revised: A

Original: [Table]
Revised: [Table]

Original: hypersphere
Revised: radius

Original: [Table]
Revised: [Table]

Original: for
Revised: of

Original: [Table]
Revised: [Table]

Original: ∈ R d (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) allows (cid:58)(cid:58)(cid:58) us (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) introduce (cid:58)(cid:58)(cid:58)

Original: the

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) notational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) shorthand (cid:58)

Original: [Equation]

Original: S i
Revised: r i

Original: = { x ∈ R d |∥ x − x i ∥ P

Original: [Equation]

Original: r i } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (4) (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: (cid:58)(cid:58)(cid:58) the

Original: [Table]

Original: region

Original: [Table]

Original: covered
Revised: about

Original: [Table]
Revised: [Table]

Original: by [Table]
Revised: at [Table]

Original: the
Revised: x

Original: [Table]
Revised: [Table]

Original: and
Revised: This

Original: [Table]
Revised: [Table]

Original: its
Revised: for

Original: [Table]
Revised: [Table]

Original: surface
Revised: allows

Original: [Table]
Revised: [Table]

Original: It [Table]
Revised: to [Table]

Revised: introduce

Revised: [Table]

Revised: the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Table]

Revised: (cid:58)

Revised: [Equation]

Revised: S i = {

Revised: [Equation]

Revised: ∈

Revised: [Equation]

Revised: d |∥ x

Revised: [Equation]

Revised: x i ∥ P

Revised: [Equation]

Original:  follows
Revised: r i } [Table] (4) (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) represent (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) region (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) covered (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hypersphere (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58) its (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) surface. (cid:58)(cid:58)(cid:58) It (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) follows

Original: [Table]
Revised: [Table]

Original: from
Revised: from

Original: [Table]
Revised: [Table]

Revised: this

Revised: [Table]

Original: [Table]
Revised: [Table]

Original: that
Revised: that

Original: [Table]
Revised: [Table]

Original: that
Revised: that

Original: [Table]
Revised: [Table]

Original: if
Revised: if

Original: [Table]
Revised: [Table]

Revised: which

Original: [Table]
Revised: [Table]

Original: where r 1 and r 2 are respectively the radii of certification for x 1 and x
Revised: and [Table] [Table] match, then the region of certification can be described

Revised: [Table]

Revised: about

Revised: [Table]

Revised: x

Revised: [Table]

Revised: can

Original: [Table]
Revised: [Table]

Original: However , when considering certification, we are often
Revised: be

Original: [Table]
Revised: [Table]

Original:  typically (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58) are (cid:58) concerned not with the sizeof the region of classification invariance, but rather the distance to the nearest possible adversarialexample.
Revised: expressed as B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) , where r 1 and r 2 are respectively the radii of certification for x 1 and x 2 . . (cid:58) However , when considering certification, we are often (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) typically (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58) are (cid:58) concerned not with the sizeof the region of classification invariance, but rather the distance to the nearest possible adversarialexample.

Original: If it is possible to find some x ′ such that its region of certification completely encircles thatof the certification at x , the following definition demonstrates that the certification radius (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58) x (cid:58) canbe increasedby way of Equation .
Revised: If it is possible to find some x ′ such that its region of certification completely encircles thatof the certification at x , the following definition demonstrates that the certification radius (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58) x (cid:58) canbe increasedby way of Equation .

Original: Lemma 3.2 ( Set Unions Certified Radius ) .
Revised: Lemma 3.2 ( Set Unions Certified Radius ) .

Original: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance of
Revised: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance of

Original: [Equation]
Revised: [Equation]

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ′ ≥ r (cid:58) from x 1 , where r ′ ≥ r 1 . 
Revised: [Table] r ′ ≥ r (cid:58) from x 1 , where r ′ ≥ r 1 . [Equation]

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .
Revised: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .

Original: Thus r ′ =
Revised: Thus r ′ =

Original: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (5).
Revised: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (5).

Revised: As such, we can recast the certification problem

Revised: [Table]

Revised: certification

Original: As such, we can recast the certification problem (cid:58)(cid:58)(cid:58)(cid:58) task (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) constructing (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58) from being astrictly analytic function , to the nonlinear optimisation problem (cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) terms (cid:58)(cid:58)(cid:58) of (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) second (cid:58)(cid:58)(cid:58) ball (cid:58)(cid:58)(cid:58)(cid:58) with(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certified (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) {+r 
+}
Revised: [Table] from being astrictly analytic function , to the nonlinear optimisation problem (cid:58) in [Table] ball (cid:58)(cid:58)(cid:58)(cid:58) with(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certified (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) {+r 
+}

Original: r 2 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) centred (cid:58)(cid:58) at (cid:58)(cid:58) x 2 (cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) centred (cid:58)(cid:58) at (cid:58)(cid:58) x 2 (cid:58)

Original: [Equation]
Revised: [Equation]

Original: (6) with Figure 1a providing a two-dimensional representation of this process (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exemplar.
Revised: 6) with Figure 1a providing a two-dimensional representation of this process (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exemplar.

Original: Crucially, theabove formalism does not require obtaining a global optima, as any r ′ >
Revised: Crucially, theabove formalism does not require obtaining a global optima, as any r ′ >

Original: r 1 is guaranteed to be animprovement to the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) yields (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improved (cid:58) certification at x 1 .
Revised: r 1 is guaranteed to be animprovement to the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) yields (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improved (cid:58) certification at x 1 .

Original: 3.2 Multiple transitivity
Revised: 3.2 Multiple transitivity

Original: The concept of transitivity can be further enhanced by considering the set(cid:58)(cid:58)
Revised: The concept of transitivity can be further enhanced by considering the set(cid:58)(cid:58)

Original: To (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) further (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enhance (cid:58)(cid:58)(cid:58)(cid:58) our (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ability (cid:58)(cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certify, (cid:58)(cid:58)(cid:58) let (cid:58)(cid:58)(cid:58)(cid:58) us (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) consider (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) set (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) points (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) their(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) associated (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certifications (cid:58) { x 1 , r 1 , x 2 , r 2 , . . .
Revised: To (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) further (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enhance (cid:58)(cid:58)(cid:58)(cid:58) our (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ability (cid:58)(cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certify, (cid:58)(cid:58)(cid:58) let (cid:58)(cid:58)(cid:58)(cid:58) us (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) consider (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) set (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) points (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) their(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) associated (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certifications (cid:58) { x 1 , r 1 , x 2 , r 2 , . . .

Original: x n , r n } .
Revised: x n , r n } .

Original: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) union (cid:58)(cid:58) of(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ˆ B P = ∪ i ∈{ 1 ,...,n } B P ( x i , r i ) (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) simply-connected, then the overall region of certification is nowthe the union of all B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) across  this  set (cid:58)(cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)  expressed (cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ( n ) ′ =
Revised: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) union (cid:58)(cid:58) of(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ˆ B P = ∪ i ∈{ 1 ,...,n } B P ( x i , r i ) (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) simply-connected, then the overall region of certification is nowthe the union of all B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) across (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58) set (cid:58)(cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) expressed (cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ( n ) ′ =

Original: min x ∈ ∂ ˆ B P ∥ x − x 1 ∥ P , where s ∈ R d − 1 .
Revised: min x ∈ ∂ ˆ B P ∥ x − x 1 ∥ P , where s ∈ R d − 1 .

Original: Based uponthe construction of S n , it follows that (cid:58)(cid:58)(cid:58)(cid:58) ∂ ˆ B P (cid:58)(cid:58) is the radius of certification is r n =
Revised: Based uponthe construction of S n , it follows that (cid:58)(cid:58)(cid:58)(cid:58) ∂ ˆ B P (cid:58)(cid:58) is the radius of certification is r n =

Original: min s ∥ S n ( s ) − x 1 ∥ .
Revised: min s ∥ S n ( s ) − x 1 ∥ .

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) boundary (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) ˆ B P .
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) boundary (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) ˆ B P .

Original: (cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)

Original: This (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) further (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) simplified (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) imposing (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x
Revised: This (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) further (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) simplified (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) imposing (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x

Original: j ∈ B P ( x 2 , r 2 ) ∀ j > 2 (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) that(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x j , r j )
Revised: j ∈ B P ( x 2 , r 2 ) ∀ j > 2 (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) that(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x j , r j )

Original: ̸⊂ B P ( x k , r k ) ∀ ( j > 2 , k > 2) (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ensure (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hyperspheres (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58) near (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) boundary (cid:58)(cid:58) of(cid:58)(cid:58)
Revised: ̸⊂ B P ( x k , r k ) ∀ ( j > 2 , k > 2) (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ensure (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hyperspheres (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58) near (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) boundary (cid:58)(cid:58) of(cid:58)(cid:58)

Original: S 2 (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) yielding (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) of (cid:58)r ( n ) ′ =
Revised: S 2 (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) yielding (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) of (cid:58)r ( n ) ′ =

Original: min x ∈ S n ∥ x − x 1 ∥ where S n = S 2 ∩ ` ∪ n +1 i =3 S
Revised: min x ∈ S n ∥ x − x 1 ∥ where S n = S 2 ∩ ` ∪ n +1 i =3 S

Original: i ˘ for n ≥ 2 .
Revised: i ˘ for n ≥ 2 .

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (7) (cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (7) (cid:58)(cid:58)(cid:58)(cid:58)

Original: Here (cid:58)(cid:58)(cid:58) S n (cid:58)(cid:58) is (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ( d − 1) -dimensional
Revised: Here (cid:58)(cid:58)(cid:58) S n (cid:58)(cid:58) is (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ( d − 1) -dimensional

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) manifold (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) embedded (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) 
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) manifold (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) embedded (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) R d .

Original: [Table]
Revised: (cid:58)

Original: Lemma 3.3 ( Optimal positioning of x 3 in the case of n = 3 ) .
Revised: Lemma 3.3 ( Optimal positioning of x 3 in the case of n = 3 ) .

Original: In the case where n = 3 , let us
Revised: In the case where n = 3 , let us

Original: [Table]
Revised: [Table]

Original: consider two points x 3 and x ′ 3 , where
Revised: consider two points x 3 and x ′ 3 , where

Original: [Table]
Revised: [Table]

Original: Consider
Revised: Consider

Original: [Table]
Revised: [Table]

Original: [0 , 1 (cid:58)(cid:58) ]
Revised: [0 , 1 (cid:58)(cid:58) ]

Original: d  with ˜ r =
Revised: d | ˜ x ̸ = x 3 } with ˜ r =

Original: σ` Φ − 1 ( E 

Revised: σ` Φ − 1 ( E

Original: [˜ x ]) − Φ − 1 ( E 1 [˜ x ]) ˘ , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (9) (cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) possible (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)certification (cid:58)(cid:58)
Revised: [˜ x ]) − Φ − 1 ( E 1 [˜ x ]) ˘ , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (9) (cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) possible (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 7 (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achieved (cid:58)(cid:58) at (cid:58)x 3 ( s ) = x 1 + sr ′ x 1 − x∥ x 1 − x 2 ∥for some s ∈ (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1 (cid:58)(cid:58) ] . (cid:58) (10)
Revised: [Table]

Original: Proof.
Revised: [Table]

Original: (cid:58)(cid:58)(cid:58) The (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58) to (cid:58)(cid:58) x 1 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) upon (cid:58)(cid:58) S 2 (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) located (cid:58) at (cid:58) 
Revised: upon (cid:58)(cid:58) S 2 (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) located (cid:58) at (cid:58) [Equation]

Original: [Equation]
Revised: [Equation]

Original: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ B P ( x ′ 3 , r ′ 3 ) , then the optimalpositioning of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) where (cid:58)(cid:58) r ′ (cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) defined (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 6.
Revised: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ B P ( x ′ 3 , r ′ 3 ) , then the optimalpositioning of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) where (cid:58)(cid:58) r ′ (cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) defined (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 6.

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Thus (cid:58)(cid:58)(cid:58) any (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improved (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ′′ > r ′(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58) only (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58) if (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 3 , r 3 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) satisfies (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ˘ x ∈ B P ( x 3 , r 3 ) (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 8.

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Then (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) symmetry, (cid:58)(cid:58)(cid:58) r ′′ (cid:58) is(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: Thus (cid:58)(cid:58)(cid:58) any (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improved (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: (cid:58)
Revised: (cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: (cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: (cid:58) Assuming that the above definition is true allows us to define a new certification using thefollowing Lemma, which aligns with the visual sketch outlined in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) While (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) finding (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) some (cid:58)(cid:58) x
Revised: Assuming that the above definition is true allows us to define a new certification using thefollowing Lemma

Original: [Table]
Revised: [Table]

Original:  satisfying(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: which aligns with the visual sketch outlined in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) While (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) finding (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) some (cid:58)(cid:58) x 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) satisfying(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Equations (cid:58)(cid:58) 8 (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) 10 (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) trivial, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) proving (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 9 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) would (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) require (cid:58)(cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exhaustive (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) input(cid:58)(cid:58)(cid:58)(cid:58) space (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: Equations (cid:58)(cid:58) 8 (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) 10 (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) trivial, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) proving (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 9 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) would (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) require (cid:58)(cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exhaustive (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) input(cid:58)(cid:58)(cid:58)(cid:58) space (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [0 , 1] d .
Revised: [0 , 1] d .

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: However, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) even (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) absence (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) such (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 10 (cid:58)(cid:58)(cid:58)(cid:58) still (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provides (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) framework (cid:58)(cid:58)(cid:58) for (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) simple (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) x 3 , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) which (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) follows (cid:58) Figure 1b.
Revised: However, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) even (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) absence (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) such (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 10 (cid:58)(cid:58)(cid:58)(cid:58) still (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provides (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) framework (cid:58)(cid:58)(cid:58) for (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) simple (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) x 3 , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) which (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) follows (cid:58) Figure 1b.

Original: In the case of where two additional eccentric circles are used to construct a bounding region aboutx 1 , Definition 3.3 allows us to demonstrate that the largest achievable radii of certification takes theform
Revised: In the case of where two additional eccentric circles are used to construct a bounding region aboutx 1 , Definition 3.3 allows us to demonstrate that the largest achievable radii of certification takes theform

Original: Lemma 3.4 ( Certification from two eccentric hyperspheres ) .
Revised: Lemma 3.4 ( Certification from two eccentric hyperspheres ) .

Original: (cid:58)
Revised: (cid:58)

Original: If (cid:58)(cid:58)(cid:58) x 3 (cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) defined (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 10 (cid:58)(cid:58) in(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) fashion (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) satisfies (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 8 (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) updated (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achieved (cid:58)(cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) terms (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) some(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: If (cid:58)(cid:58)(cid:58) x 3 (cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) defined (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 10 (cid:58)(cid:58) in(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) fashion (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) satisfies (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 8 (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) updated (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achieved (cid:58)(cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) terms (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) some(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: x 3 ( s ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) defined (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58)(cid:58) 10 (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58) way (cid:58)(cid:58) of 
Revised: x 3 ( s ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) defined (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58)(cid:58) 10 (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58) way (cid:58)(cid:58) of [Equation] d [Equation]

Revised: d

Original: [Equation]
Revised: [Equation]

Original: where
Revised: dwhere

Original: [Equation]
Revised: [Equation]

Original:  and where r 3 is the radius of certification about x 3 .(cid:58)
Revised: E [Equation] 12) and where r 3 is the radius of certification about x 3 . (cid:58)

Original: If (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 9 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) holds, (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) n = 3 .
Revised: If (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 9 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) holds, (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) n = 3 .

Original: (cid:58)
Revised: (cid:58)

Original: Proof.
Revised: Proof.

Original: To begin with, we introduce the co-ordinate translation y = f
Revised: To begin with, we introduce the co-ordinate translation y = f

Original: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that (cid:58)(cid:58) By (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) symmetry (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) define (cid:58)(cid:58)(cid:58) the  (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)arbitrary (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) rotational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) mapping (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that (cid:58)(cid:58) By (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) symmetry (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) define (cid:58)(cid:58)(cid:58) the [Table] (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Table]

Original: f : R d → R d(cid:58)(cid:58)(cid:58)(cid:58) from (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x i (cid:55)→ y i (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58) way (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) y i = 
Revised: d → R d(cid:58)(cid:58)(cid:58)(cid:58) from (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x i (cid:55)→ y i (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58) way (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) y i = f

Original: f ( x i − x 1 ) , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) subject (cid:58)(cid:58) to(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) condition y 2 ,j ̸ = 0 and y 3 ,ji,j (cid:58) ̸
Revised: ( x i − x 1 ) , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [Table] (cid:58)(cid:58) to

Original:  = 0 for i ∈ { 1 , 2 } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) only when (cid:58)(cid:58)(cid:58) and (cid:58) ∀ (cid:58)
Revised: [Table] the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) conditiony 2 ,j ̸ = 0 and y 3 ,ji,j (cid:58) ̸ = 0 for i ∈ { 1 , 2 } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) only when (cid:58)(cid:58)(cid:58) and (cid:58) ∀ (cid:58)

Original: j = ̸ =
Revised: j = ̸ =

Original: (cid:58) k. , for some k
Revised: (cid:58) k. , for some k

Original: such that j, k ∈ { 1 , 2 , . . .
Revised: such that j, k ∈ { 1 , 2 , . . .

Original: , d } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (13)
Revised: , d } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (13)

Original: In these coordinates (cid:58)(cid:58)(cid:58)(cid:58) then the intersection of the hyperspheres centred about x 2 and x 3 occurs at
Revised: In these coordinates (cid:58)(cid:58)(cid:58)(cid:58) then the intersection of the hyperspheres centred about x 2 and x 3 occurs at

Original: [Equation]
Revised: [Equation]

Original: This is possible as our chosen mapping preserve (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) consequence (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) our (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) mapping (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: This is possible as our chosen mapping preserve (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) consequence (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) our (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) mapping (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: y =
Revised: y =

Original: f ( x − x 1 )(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) preserving (cid:58) distances under rotation, giving that y 2 ,k = ∥
Revised: f ( x − x 1 )(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) preserving (cid:58) distances under rotation, giving that y 2 ,k = ∥

Original: x 2 − x 1 ∥ = d 2 , and with the equivalent also 180 holding for y 3 ,k .
Revised: x 2 − x 1 ∥ = d 2 , and with the equivalent also 184 holding for y 3 ,k .

Original: As the instance is the origin of our new (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) consequence (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) our (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) choice (cid:58)(cid:58) of (cid:58) coordinate system, it followsthat r ′′ = ∥
Revised: As the instance is the origin of our new (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) consequence (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) our (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) choice (cid:58)(cid:58) of (cid:58) coordinate system, it followsthat r ′′ = ∥

Original: y ∥ and
Revised: y ∥ and

Original: [Equation]
Revised: [Equation]

Original: which is equivalent (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) equivalence to Equation (12).
Revised: which is equivalent (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) equivalence to Equation (12).

Original: Intuitively we can assume that this logic should extend to S n for n > 3 .
Revised: Intuitively we can assume that this logic should extend to S n for n > 3 .

Original: However, while the nearestpoint from x 1 on S 3 is a point, if we consider x i for i ≤ 3 are fixed, then the nearest point to x 1is no longer a point, but a surface in R d − 1 .
Revised: However, while the nearestpoint from x 1 on S 3 is a point, if we consider x i for i ≤ 3 are fixed, then the nearest point to x 1is no longer a point, but a surface in R d − 1 .

Original: Thus, finding additional hyperspheres that completelycover this R d − 1 surfaces is non-trivial.
Revised: Thus, finding additional hyperspheres that completelycover this R d − 1 surfaces is non-trivial.

Original: Similarly, any other arrangement of bounding hyperspheresscales nonlinearly with the intrinsic dimensionality of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) While (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 7 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) holds (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) any (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: Similarly, any other arrangement of bounding hyperspheresscales nonlinearly with the intrinsic dimensionality of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) While (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 7 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) holds (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) any (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: n ≥ 2 , (cid:58) the 189 space, resulting in exponential growth in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) 
Revised: n ≥ 2 , (cid:58) the 193 space, resulting in exponential growth in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: beyond (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) n = 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) cannot (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enhanced (cid:58)(cid:58)(cid:58) by(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) adding (cid:58)(cid:58)(cid:58)(cid:58) any (cid:58)(cid:58)(cid:58) one (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) single (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) additional (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hypersphere (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) without (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) contradicting (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: contradicting (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Lemma (cid:58)(cid:58)(cid:58)(cid:58) 3.4.
Revised: Lemma (cid:58)(cid:58)(cid:58)(cid:58) 3.4.

Original: (cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)

Original: This (cid:58)(cid:58) is (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) result (cid:58)(cid:58) of(cid:58)(cid:58)
Revised: This (cid:58)(cid:58) is (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) result (cid:58)(cid:58) of(cid:58)(cid:58)

Original: S 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) being (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ( d − 1) -dimensional
Revised: S 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) being (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ( d − 1) -dimensional

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) manifold (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) R d , (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) entirety (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) which (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enclosed (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) manifold (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) R d , (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) entirety (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) which (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enclosed (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: improve(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.
Revised: improve(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.

Original: (cid:58)(cid:58)(cid:58) An (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) example (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58) seen (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) two (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) equidistant (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) intersections (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) between (cid:58)(cid:58)(cid:58) S 2(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58) An (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) example (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58) seen (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) two (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) equidistant (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) intersections (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) between (cid:58)(cid:58)(cid:58) S 2(cid:58)(cid:58)

Original: (in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) required (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) grows (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exponentially (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58) d (cid:58)(cid:58)(cid:58)
Revised: (in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) required (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) grows [Table] exponentially (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58) d (cid:58)(cid:58)(cid:58)

Original: due (cid:58)(cid:58) to (cid:58) the number of hyperspheres that 195 need to be solved for, and thus, in the overall computational cost.
Revised: due (cid:58)(cid:58) to (cid:58) the number of hyperspheres that 199 need to be solved for, and thus, in the overall computational cost.

Original: This effectively imposes that itis infeasibleto solve for any S n where n > 3 .
Revised: This effectively imposes that itis infeasibleto solve for any S n where n > 3 .

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sphere (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) packing(
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sphere (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) packing

Revised: [Table]

Original: cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) kissing (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) number (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) problem (cid:58)(cid:58)(cid:58) [8] (cid:58) .
Revised: kissing (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) number (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) problem (cid:58)(cid:58)(cid:58) [9] (cid:58) .

Original: (cid:58)(cid:58)(cid:58)(cid:58) This(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) growth (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) complexity (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) makes (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) adding (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) additional (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) spheres (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) beyond (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) n = 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) infeasible.
Revised: (cid:58)(cid:58)(cid:58)(cid:58) This(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) growth (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) complexity (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) makes (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) adding (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) additional (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) spheres (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) beyond (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) n = 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) infeasible.

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Further (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) details (cid:58)(cid:58) of(cid:58)(cid:58)(cid:58)
Revised: Further (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) details (cid:58)(cid:58) of(cid:58)(cid:58)(cid:58)

Original: this (cid:58)(cid:58)(cid:58) are (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) contained (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Appendix (cid:58)(cid:58)(cid:58)(cid:58) A.2.
Revised: this (cid:58)(cid:58)(cid:58) are (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) contained (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Appendix (cid:58)(cid:58)(cid:58)(cid:58) A.2.

Original: (cid:58)
Revised: (cid:58)

Original: 3.3 Boundary treatments
Revised: 3.3 Boundary treatments

Original: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .
Revised: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .

Original: However , for (cid:58)(cid:58) in the majority of certifications, (cid:58)(cid:58)(cid:58)(cid:58) cases (cid:58) a subset of B P ( x 1 , L 1 ) willbe outside the feasible domain for x 1 (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) outside (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d .
Revised: However , for (cid:58)(cid:58) in the majority of certifications, (cid:58)(cid:58)(cid:58)(cid:58) cases (cid:58) a subset of B P ( x 1 , L 1 ) willbe outside the feasible domain for x 1 (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) outside (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d .

Original: While this observation is trivially true, weare unable to leverage it to improve the size of the certification , as the distance from B P ( x 1 , L 1 ) toany point of intersection with { 0 , 1 } d will still be of length L 1 away from x 1 .
Revised: While this observation is trivially true, weare unable to leverage it to improve the size of the certification , as the distance from B P ( x 1 , L 1 ) toany point of intersection with { 0 , 1 } d will still be of length L 1 away from x 1 .

Original: This property also holds for the intersection of B P ( x 2 , L 2 ) with the bounds of the feasible space (cid:58) it(cid:58)(cid:58)(cid:58) has (cid:58)(cid:58) no (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achieved (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58) 

Revised: This property also holds for the intersection of B P ( x 2 , L 2 ) with the bounds of the feasible space (cid:58) it(cid:58)(cid:58)(cid:58) has (cid:58)(cid:58) no (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achieved (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Equation (cid:58)(cid:58)

Original: (cid:58)(cid:58)(cid:58)(cid:58) due (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) symmetry (cid:58)(cid:58) of(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58) due (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) symmetry (cid:58)(cid:58) of(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: B P ( x 1 , r ) .
Revised: B P ( x 1 , r ) .

Original: However, as the distance from x 1 to the intersection of B P ( x 2 , L 2 ) and the feasiblespace is larger than that from (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) asymmetric (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) nature (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58)(cid:58) x 1 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) guarantees (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) if(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: However, as the distance from x 1 to the intersection of B P ( x 2 , L 2 ) and the feasiblespace is larger than that from (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) asymmetric (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) nature (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58)(cid:58) x 1 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) guarantees (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) if(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exceeds (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d , (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58) to (cid:58) x 1 to the boundary of the hypersphere aboutx 2 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) feasible (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) domain (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exceeds (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d , (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58) to (cid:58) x 1 to the boundary of the hypersphere aboutx 2 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) feasible (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) domain (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58) an (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: r > r ′ , as is demonstrated within 211 Figure 1c.
Revised: r > r ′ , as is demonstrated within 215 Figure 1c.

Original: This allows us to make the following observation about improving the feasible radius ofcertification.
Revised: This allows us to make the following observation about improving the feasible radius ofcertification.

Original: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .
Revised: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .

Original: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside the feasible space for instances allows us to construct an updated region of certification where
Revised: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside the feasible space for instances allows us to construct an updated region of certification where

Original: [Equation]
Revised: [Equation]

Original: where z k = (cid:26)
Revised: where z k = (cid:26)

Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where 1 is an indicator function acting upon its operator.
Revised: where 1 is an indicator function acting upon its operator.

Original: Proof.
Revised: Proof.

Original: In contrast to the prior proof, for this problem we retain the coordinate systemof the input space.
Revised: In contrast to the prior proof, for this problem we retain the coordinate systemof the input space.

Original: To support this, we introduce the notation that x n is defined as as{ x 1 ,n , x 2 ,n , [Equation]
Revised: To support this, we introduce the notation that x n is defined as as{ x 1 ,n , x 2 ,n , . . .

Original: , x
Revised: , x

Original: [Equation]
Revised: [Equation]

Original: ,n }
Revised: ,n }

Original: [Equation]
Revised: [Equation]

Original: x n = { x n, 1 , x n, 2 , . . .
Revised: x n = { x n, 1 , x n, 2 , . . .

Original: , x n,d } .
Revised: , x n,d } .

Original: If we let x k ∈ { 0 , 1 } , then the intersectionbetween B P ( x 2 , L 2 ) and the bounding surface in dimension k creates a bounding hypersphere of theformd (cid:88)
Revised: If we let x k ∈ { 0 , 1 } , then the intersectionbetween B P ( x 2 , L 2 ) and the bounding surface in dimension k creates a bounding hypersphere of theformd (cid:88)

Original: [Equation]
Revised: [Equation]

Original: (17) which yields an effective radius r r
Revised: (17) which yields an effective radius r r

Original: [Equation]
Revised: [Equation]

Original: =
Revised: =

Original: [Equation]
Revised: [Equation]

Original: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (17) must take the form
Revised: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (17) must take the form

Original: [Equation]
Revised: [Equation]

Original: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius of certification.
Revised: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius of certification.

Original: 3.4 Algorithms
Revised: 3.4 Algorithms

Original: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (5) through a simple, gradient based solver.
Revised: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (5) through a simple, gradient based solver.

Original: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.
Revised: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.

Original: To implement the multipletransitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (12).
Revised: To implement the multipletransitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (12).

Original: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (16) to the output of Algorithm 1.
Revised: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (16) to the output of Algorithm 1.

Original:  Extracting gradient information from non-differentiable functions
Revised:  Extracting gradient information from non-differentiable functions

Original: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.
Revised: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.

Original: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).
Revised: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).

Original: Within this work we haveimplemented two mechanisms to circumvent these conditions.
Revised: Within this work we haveimplemented two mechanisms to circumvent these conditions.

Original: The first substitutes the arg maxoperation with a Gumbel-Softmax [14].
Revised: The first substitutes the arg maxoperation with a Gumbel-Softmax [15].

Original: In doing so, the class expectations are rendered differentiable.
Revised: In doing so, the class expectations are rendered differentiable.

Original: The second approach involves recasting the Monte-Carlo estimators as integrals of the form
Revised: The second approach involves recasting the Monte-Carlo estimators as integrals of the form

Original: E [arg
Revised: E [arg

Original: [Equation]
Revised: [Equation]

Original: (19) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .
Revised: (19) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .

Original: From thisformalism, (cid:58)(cid:58)(cid:58)(cid:58)
Revised: From thisformalism, (cid:58)(cid:58)(cid:58)(cid:58)

Original: This (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) formalism, (cid:58)(cid:58)(cid:58) and (cid:58) the symmetry of the underlying space allows gradient free derivatives
Revised: This (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) formalism, (cid:58)(cid:58)(cid:58) and (cid:58) the symmetry of the underlying space allows gradient free derivatives

Original: [Table]
Revised: [Table]

Original: i
Revised: i

Original: [Table]
Revised: [Table]

Original: c
Revised: c

Original: [Table]
Revised: [Table]

Original: Lagrange
Revised: Lagrange

Original: [Table]
Revised: [Table]

Original: : for 1 to M do
Revised: : for 1 to M do

Original: [Table] [Table]
Revised: [Table] [Table]

Original: `
Revised: `

Original: [Table]
Revised: [Table]

Original: `
Revised: `

Original: [Table]
Revised: [Table]

Original: if
Revised: if

Original: [Table]
Revised: [Table]

Original: if
Revised: if

Original: [Table]
Revised: [Table]

Original: then
Revised: then

Original: [Table]
Revised: [Table]

Original: end if
Revised: end if

Original: [Table]
Revised: [Table]

Original: calculated by BarzilaiBorwein [1].
Revised: calculated by BarzilaiBorwein [1].

Original: Positive branch is selected if j = i , otherwise the negative branch brings x ′ towards the region in which j = i .} 10: end if 11: end for of ∇ x E to be calculated by way of (cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) construction (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) undifferentiable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) gradients (cid:58)(cid:58)(cid:58) by
Revised: Positive branch is selected if j = i , otherwise the negative branch brings x ′ towards the region in which j = i .} 10: end if 11: end for of ∇ x E to be calculated by way of (cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) construction (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) undifferentiable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) gradients (cid:58)(cid:58)(cid:58) by

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [28].
Revised: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [32].

Original: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [25].
Revised: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [28].

Original: To explore the (cid:58)(cid:58)(cid:58)(cid:58)
Revised: To explore the (cid:58)(cid:58)(cid:58)(cid:58)

Original: The relative performance of these two approaches, both of these approacheswill be tested in the following section, with the Gumbel-Softmax based approach labelled as‘Full’ , and the above gradients as ‘ (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approaches—respectively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) labelled (cid:58)(cid:58) ‘Approximate’ , whichwill be used to consider the transitivity approach of Section 3.1 under the label ‘Single’, and theboundary consideration of Section 3.3 as ‘Boundary’ (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ‘Full’ (cid:58)(cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) above (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approach (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: The relative performance of these two approaches, both of these approacheswill be tested in the following section, with the Gumbel-Softmax based approach labelled as‘Full’ , and the above gradients as ‘ (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approaches—respectively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) labelled (cid:58)(cid:58) ‘Approximate’ , whichwill be used to consider the transitivity approach of Section 3.1 under the label ‘Single’, and theboundary consideration of Section 3.3 as ‘Boundary’ (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ‘Full’ (cid:58)(cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) above (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approach (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: section .
Revised: section .

Original: For the case of the dou-
Revised: For the case of the dou-

Original: [Table]
Revised: [Table]

Original: ble transitivity of Section 3.2 our experiments suggest that uncertainty in the analytic derivativesproduces deleterious results.
Revised: ble transitivity of Section 3.2 our experiments suggest that uncertainty in the analytic derivativesproduces deleterious results.

Original: As such derivatives for the multiple transitivity approach are exclusivelyconsidered through autograd for both the Full and Approximate methods.
Revised: As such derivatives for the multiple transitivity approach are exclusivelyconsidered through autograd for both the Full and Approximate methods.

Original:  Experiments
Revised:  Experiments

Original: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [19], CIFAR- 10 [17], and Tiny-Imagenet [15], thelatter of these is a 200 -class variant of Imagenet [37] which downsamples images to 3 × 60 × 60 .
Revised: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [20], CIFAR- 10 [18], and Tiny-Imagenet [16], thelatter of these is a 200 -class variant of Imagenet [42] which downsamples images to 3 × 60 × 60 .

Original: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [27], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.
Revised: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [31], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.

Original: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.
Revised: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.

Original: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.
Revised: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.

Original: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.
Revised: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.

Original: Parameter optimisation was performed with Adam [16],with the learning rate set as 0 .001 .
Revised: Parameter optimisation was performed with Adam [17],with the learning rate set as 0 .

Original: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s and
Revised: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s and

Original: 5 R 0 .0 .0 .0 .0 .1 .
Revised: 5 R 0 .0 .0 .0 .0 .1 .

Original: C e rt
Revised: C e rt

Original: i ﬁ e d A cc u r a c y a) MNIST 0 .0 .1 .1 .
Revised: i ﬁ e d A cc u r a c y a) MNIST 0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .b)
Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .b)

Original: CIFAR0 .0 .1 .1 .
Revised: CIFAR0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Original: .c)
Revised: .c)

Original: Tiny-Imagenet
Revised: Tiny-Imagenet

Original: Cohen
Revised: Cohen

Original: [Figure]

Original: [Figure]

Original: σ

Original: [Figure]

Original: [Figure]

Original: Full

Original: [Figure]
Revised: [Figure]

Original: Best

Original: [Figure]
Revised: [Figure]

Original: utilised 1000 samples.
Revised: utilised 1000 samples.

Original: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .
Revised: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .

Original: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .
Revised: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .

Original: The full code to implement our experiments can be found at anonymised link .
Revised: The full code to implement our experiments can be found at anonymised link .

Original: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.
Revised: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.

Original: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.
Revised: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.

Original: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.
Revised: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.

Original: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certified (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius, as evidenced by the results for
Revised: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certified (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius, as evidenced by the results for

Original: Tiny-Imagenet.
Revised: Tiny-Imagenet.

Original: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .
Revised: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .

Original: While this process shrinks theachievable certification radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certified (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius, a higher E 1 provides more information to inform ourgradient based search process, allowing for the identification of larger certifications.
Revised: While this process shrinks theachievable certification radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certified (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius, a higher E 1 provides more information to inform ourgradient based search process, allowing for the identification of larger certifications.

Original: This propertywould suggest that as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) samples (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) larger (cid:58) R is increased, the difference in the certifications (cid:58)(cid:58)(cid:58)(cid:58) would(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exhibit (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) decreased (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) difference (cid:58) between our techniques and that of Cohen et al.
Revised: This propertywould suggest that as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) samples (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) larger (cid:58) R is increased, the difference in the certifications (cid:58)(cid:58)(cid:58)(cid:58) would(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exhibit (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) decreased (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) difference (cid:58) between our techniques and that of Cohen et al.

Original: would decrease,as smaller values of E 1 provide less information for the search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) information.
Revised: would decrease,as smaller values of E 1 provide less information for the search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) information.

Original: However, thevery opposite appears to occur, a property that is particularly visible in the MNIST experiments of
Revised: However, thevery opposite appears to occur, a property that is particularly visible in the MNIST experiments of

Original: Figure 2 at σ = 0 .
Revised: Figure 2 at σ = 0 .

Original: This appears to be a product of the (cid:58) it (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) appears (cid:58)(cid:58)(cid:58)(cid:58) that singularities in the derivativesof Φ − 1 [ E ] as E → { 0 , 1 } , which counteracts (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) counteract (cid:58) the decreased information provided bythe second [Table] class.
Revised: This appears to be a product of the (cid:58) it (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) appears (cid:58)(cid:58)(cid:58)(cid:58) that singularities in the derivativesof Φ − 1 [ E ] as E → { 0 , 1 } , which counteracts (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) counteract (cid:58) the decreased information provided bythe second highest class.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: to
Revised: to

Original: [Table]
Revised: [Table]

Original: Rather than strictly considering the best performing of the Approximate and Full solvers, we canalso delve into the relative performance of the underlying solvers.
Revised: Rather than strictly considering the best performing of the Approximate and Full solvers, we canalso delve into the relative performance of the underlying solvers.

Original: Notably there is a moderateincrease in the average percentage improvement of Figure 3 between the σ = 0 .
Revised: Notably there is a moderateincrease in the average percentage improvement of Figure 3 between the σ = 0 .

Original: 5 and σ = 1 . 0 cases.
Revised: 5 and σ = 1 . 0 cases.

Original: This would appear to belie our previous statement regarding larger certifications yielding smallerimprovements, due to the asymmetry of class information.
Revised: This would appear to belie our previous statement regarding larger certifications yielding smallerimprovements, due to the asymmetry of class information.

Original: However, an equivalent radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certificationfor σ = 1 . 0 has significantly more information about the second class (due to the multiplicativeinfluence of σ ) , allowing for greater improvements from our gradient based search.
Revised: However, an equivalent radii (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certificationfor σ = 1 . 0 has significantly more information about the second class (due to the multiplicativeinfluence of σ ) , allowing for greater improvements from our gradient based search.

Original: That there isa clear demarcation between the Full and Approximate solver variants reflects the uncertaintiesintroduced by Equation (20).
Revised: That there isa clear demarcation between the Full and Approximate solver variants reflects the uncertaintiesintroduced by Equation (20).

Original: However, that (cid:58)(cid:58)(cid:58) That (cid:58) the approximate technique is still applicable verifiesthe utility of our approach even when the final layer is a strict arg max function, rather than our a
Revised: However, that (cid:58)(cid:58)(cid:58) That (cid:58) the approximate technique is still applicable verifiesthe utility of our approach even when the final layer is a strict arg max function, rather than our a

Original: Gumbel-Softmaxbased
Revised: Gumbel-Softmaxbased

Original: approach
Revised: approach

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: improvement (cid:58)(cid:58)(cid:58)(cid:58) over (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [ r − 0 .
Revised: improvement (cid:58)(cid:58)(cid:58)(cid:58) over (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [ r − 0 .

Original: 075 , r + 0 . 075] .
Revised: 075 , r + 0 . 075] .

Original: (cid:58) Equivalent figures for MNIST and CIFAR- 10 are found in Appendix A.
Revised: (cid:58) Equivalent figures for MNIST and CIFAR- 10 are found in Appendix A.

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ . 
Revised: The trends in performance across σ are further explored in Figures 4 and 5, the latter of which [Table] demonstrates that the median performance improvement increases quasi-linearly with σ . This is

Revised: [Table]