Original: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity
Revised: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity

Original: Anonymous Author(s)
Revised: Anonymous Author(s)

Original: AffiliationAddress email
Revised: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.
Revised: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.

Original: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.
Revised: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.

Original: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radiusof certification (under the L 2 norm) is possible given only these score.
Revised: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radiusof certification (under the L 2 norm) is possible given only these score.

Original: However,it is an open question as to whether such lower bounds can be improved usinglocal information around the instance under test.
Revised: However,it is an open question as to whether such lower bounds can be improved usinglocal information around the instance under test.

Original: In this work, we demonstratehow today’s “optimal” certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to whatwe term Geometrically-Informed Certified Robustness .
Revised: In this work, we demonstratehow today’s “optimal” certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to whatwe term Geometrically-Informed Certified Robustness .

Original: Essentially we search for,and merge with, larger certifiable balls nearby to an initial instance under test.
Revised: Essentially we search for,and merge with, larger certifiable balls nearby to an initial instance under test.

Original: Ourapproach improves certifications for more than 80% of instances in experimentswith Tiny-Imagenet, with an on average 5% increase in the associated radius ofcertification.
Revised: Ourapproach improves certifications for more than 80% of instances in experimentswith Tiny-Imagenet, with an on average 5% increase in the associated radius ofcertification.

Original:  Introduction
Revised:  Introduction

Original: Learned models, including neural networks, are well known to be susceptible to crafted perturbationsinducing changes in a model’s output without changing semantic propertiesof the input [2].
Revised: Learned models, including neural networks, are well known to be susceptible having the outputchanged by crafted perturbations to an input, that preserve the inputs semantic properties [2].

Original: Concerningly, neural networks not only misclassify these perturbations—known as adversarial examples —butthey also assign high confidence to these incorrect predictions.
Revised: Neuralnetworks not only misclassify these perturbations—known as adversarial examples —but they alsoassign high confidence to these incorrect predictions.

Original: These behaviours have been observedacross a wide range of models and datasets, and appear to be a product of piecewise-linear interactionswithin neural networks [9].
Revised: These behaviours have been observed across awide range of models and datasets and appear to be a product of piecewise-linear interactions [10].

Original: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.
Revised: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.

Original: These attacks have been applied to both black- and white-box models [21], and canbe used to target class changes, to attack all classes [6], or even introduce backdoors into modelbehaviour [4].
Revised: These attacks have been applied to both black- and white-box models [24], and canbe used to target class changes, to attack all classes [7] or even introduce backdoors into modelbehaviour [4].

Original: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).
Revised: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).

Original: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.
Revised: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.

Original: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.
Revised: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.

Original: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.
Revised: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.

Original: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.
Revised: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.

Original: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed not to beadversarial examples.
Revised: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed notto be adversarial examples.

Original: Certifications based on randomised smoothing of classifiers around an inputpoint are in a sense optimal [5]: based only on the prediction class scores at the input point, no better radius is in general possible.
Revised: Certifications based on randomised smoothing of classifiers aroundan input point are in a sense optimal [6]: based only on the prediction class scores at the inputpoint, no better radius is in general possible.

Original: Despite this, such certifications fail to use readily available—yet stilllocal—information: the certifiability of points nearby to the input of interest.
Revised: Despite this, such certifications fail to use readily available—yet still local—information: the certifiability of points nearby to the input of interest.

Original: The key insight ofthis work is that these neighbourhood points may generate certified radii large enough that we mayenlarge the certified region based solely on classifier information at the initial point.
Revised: The key insight of this work is that these neighbourhood points may generate certified radii largeenough to completely enclose that of the sample point, improving the radii of certification.

Original: This processis not just limited to a single neighbouring point either, as we can also  use the intersection of theregions of certification of multiple points, and the nature of the input domain itself to generate largercertifications.
Revised: Thisprocess can also be extended to use the intersection of the regions of certification of multiple points,and the nature of the input domain itself to generate larger certifications.

Original: This leads to our main contribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceeding those of the hitherto best-case guaranteed approach of Cohen etal.
Revised: This leads to our maincontribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceedingthose of the hitherto best-case guaranteed approach of Cohen et al.

Original:  Background and literature review
Revised:  Background and literature review

Original: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [19, 29, 32, 33, 25].
Revised: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [22, 32, 35, 36, 28].

Original: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [24].
Revised: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [27].

Original: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [30].
Revised: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [33].

Original: While bounding mechanisms can produce valid certifications, their time and memory complexitymakes them infeasible to address complex model architectures or high-dimensional data [28].
Revised: While bounding mechanisms can produce valid certifications, their time and memory complexitymakes them infeasible to address complex model architectures or high-dimensional data [31].

Original: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [17], in which noise is applied to input instancesto smooth model predictions.
Revised: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [18], in which noise is applied to inputinstances to smooth model predictions, subject to a sampling distribution that is tied to the L P -normof adversarial perturbations being certified against.

Original: In contrast to other robustness mechanisms, randomised smoothingonly requires minimal changes to a classifier, specifically the repeated sampling of noise-based perturbation of the inputs, where the choice of sampling distribution is tied to the L P -norm of adversarialperturbations being certified against.
Revised: In contrast to other robustness mechanisms, thisapplication of the noise is the only architectural change that is required to achieve certification.

Original: In the case of L 2 -norm bounded attacks, Gaussian sampling ofthe formx
Revised: In thecase of L 2 -norm bounded attacks, Gaussian sampling of the form

Original: [Equation]
Revised: [Equation]

Original: wherey i i.i.d.
Revised: where

Original: [Equation]
Revised: [Equation]

Original: is employed for all test-time instances.
Revised: is employed for all test-time instances.

Original: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator
Revised: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator

Original: [Equation]
Revised: [Equation]

Original: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.
Revised: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.

Original: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.
Revised: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.

Original: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r . Certified robustness hasnot, however, extended to rotational or translational modifications [27], nor functional attacks [15].
Revised: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r , with recent worksalso considering rotational and/or translational semantic attacks [20, 5], although we will not beaddressing such certifications within this work.

Original: That such guarantees are possible was first shown [17] by way of differential privacy [7], with morerecent works using Rényi divergence [18], and parametrising worst-case behaviours [5, 23].
Revised: That such guarantees are possible was first shown [18] by way of differential privacy [8], with morerecent works using Rényi divergence [19], and parametrising worst-case behaviours [6, 26].

Original: In thispaper, we focus on the influential work of Cohen et al.
Revised: In thispaper, we focus on the influential work of Cohen et al.

Original: (2019), and their lower-bound guarantee ofclassification invariance
Revised: (2019), and their lower-bound guarantee ofclassification invariance

Original: [Equation]
Revised: [Equation]

Original: where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denote the twolargest class expectations (of the winning class and runner).
Revised: where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denote thetwo largest class expectations (of the winning class and runner-up).

Original: These expectations capture the likelihoodthat the arg max of a single draw under noise would return a given class, as per Equation (2).
Revised: These expectations capturethe likelihood that the arg max of a single draw under noise would return a given class, as per Equation (2).

Original: Byparameterising the worst-case behaviour, their work purports to be the largest achievable pointwisecertification for any given instance [5].
Revised: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [6].

Original: Prior works have been able to generate improvements to Cohen et al.
Revised: Prior works have been able to generate improvements to Cohen et al.

Original: for binomial classifiers [20],in which it is assumed that E 1 = 1 − E 0 .
Revised: for binary certification [23],in which it is assumed that E 1 = 1 − E 0 .

Original: While any multivariate model can be mapped to a binaryoutput for the purposes of constructing a certification, artificially inflating E 1 inherently suppressesthe size of the certification, as per Equation (3).
Revised: While any multivariate model can be mapped to a binaryoutput for the purposes of constructing a certification, artificially inflating E 1 inherently suppressesthe size of the certification, as per Equation (3).

Original: In this paper we demonstrate a novel approach thatcan generate improvements to the certified robustness of multivariate classifiers.
Revised: In this paper we demonstrate a novel approach thatcan generate improvements to the certified robustness of multivariate classifiers.

Original: [Figure]
Revised: [Figure]

Original:  Geometrically-informed certified robustness
Revised:  Geometrically-informed certified robustness

Original: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [8].
Revised: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [9].

Original: Thus, constructing larger certificationsin such a context is inherently valuable.
Revised: Thus, constructing larger certificationsin such a context is inherently valuable.

Original: This specific L P space is of interest due to both its viability as a defence model, and the existence ofa guarantee of adversarial robustness that is provably as large as can be achieved for any instance [5].
Revised: This specific L P space is of interest due to both its viability as a defence model, and the provableguarantee by Cohen et al. that their certification technique produces the largest possible certificationfor any instance [6].

Original: Over the remainder of this section we will document how it is possible to improve upon this provablybest-case guarantee by exploiting several properties of certified robustness.
Revised: Over the remainder of this section we will document how it is possible to improveupon this provably best-case guarantee by exploiting several properties of certified robustness.

Original: 3.1 Exploiting transitivity
Revised: 3.1 Exploiting transitivity

Original: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.
Revised: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.

Original: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .
Revised: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .

Original: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.
Revised: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.

Original: Definition 3.1 ( Overlap Properties of Certification ) .
Revised: Definition 3.1 ( Overlap Properties of Certification ) .

Original: If x 1 and x 2 have the same class associatedwith them, then the region of certification can be described as B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) , where r 1and r 2 are respectively the radii of certification for x 1 and x 2 .
Revised: If x 1 and x 2 have the same class associatedwith them, then the region of certification can be described in terms of two hyperspheres B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) , where r 1 and r 2 are respectively the radii of certification for x 1 and x 2 and B P ( x i , r i ) =

Original: However, when considering certification, we are often concerned not with the size of the regionof classification invariance, but rather the distance to the nearest possible adversarial example.
Revised: [Equation] When considering certification, we are often concerned not with the size of the region of classificationinvariance, but rather the distance to the nearest possible adversarial example.

Original: Ifit is possible to find some x ′ such that its region of certification completely encircles that of thecertification at x , the following definition demonstrates that the certification radius  can be increasedby way of Equation (4).
Revised: If it is possible to findsome x ′ such that its region of certification completely encircles that of the certification at x , thefollowing definition demonstrates that the certification radius about x can be increased.

Original: Lemma 3.2 ( Set Unions Certified Radius ) .
Revised: Lemma 3.2 ( Set Unions Certified Radius ) .

Original: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance of
Revised: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance r ′ ≥ r from x 1 , where

Original: [Equation]
Revised: [Equation]

Original: from x 1 , where r ′ ≥ r 1 .

Original: Proof.
Revised: Proof.

Original: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .
Revised: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .

Original: Thus r ′ =
Revised: Thus r ′ =

Original: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).
Revised: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).

Original: As such, we can recast the  certificationproblem from being a strictly analytic function, to thenonlinear optimisation problem
Revised: As such, we can recast the task of constructing a certification from being a strictly analytic functionto the nonlinear optimisation problem

Original: [Equation]
Revised: [Equation]

Original: with Figure 1a providing a two-dimensional representation of this process.
Revised: with Figure 1a providing a two-dimensional representation of this process.

Original: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >
Revised: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >

Original: r 1 is guaranteed to be animprovement to the certification at x 1 .
Revised: r 1 is guaranteed to be animprovement to the certification at x 1 .

Original: 3.2 Multiple transitivity
Revised: 3.2 Multiple transitivity

Original: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .
Revised: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .

Original: x n , r n } .
Revised: x n , r n } .

Original: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union of all
Revised: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union of all

Original: B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .
Revised: B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .

Original: Based upon theconstruction of S n , it follows that the radius of certification is r  n  =
Revised: Based upon theconstruction of S n , it follows that the radius of certification is r ′ ( n ) =

Original: min s ∥ S n ( s ) − x 1 ∥ .
Revised: min s ∥ S n ( s ) − x 1 ∥ .

Original: Definition 3.3 ( Optimal positioning of x 3 in the case of n = 3 ) . In the case where n = 3 , let usconsider two points x 3 and x  ′  3 , where
Revised: Definition 3.3 ( Positioning of x 3 in the case of n = 3 ) . In the case where n = 2 , the closestpoint to x 1 on the boundary of B P ( x 2 , r 2 ) is located on the vector spanning between x 1 and x 2 , atdistance r ′ from x 1 . This in turn suggests that the optimal positioning of x 3 should also exist alongthis vector, such that

Original: [Equation]
Revised: [Equation]

Original: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ 
Revised: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ [Equation] x

Original: [Equation]
Revised: [Equation]

Original: P ( x ′ 3 , r ′ 3 ) , then the optimalpositioning of x 3 must satisfy Equation (6).
Revised: 3 , r [Equation] 3 ) , then the optimalpositioning of x 3 must satisfy Equation (6).

Original: Assuming that the above definition is true allows us to define a new certification using the following Lemma, which aligns with the visual sketch outlined in Figure 1b.
Revised: Assuming that the above definition is true allows us to significantly reduce the potential search spacefor x 3 , and gives rise to enhanced certifications as described by the following Lemma, which alignswith the visual sketch outlined in Figure 1b.

Original: Lemma 3.4 ( Certification from two Eccentric Circles ) .
Revised: Lemma 3.4 ( Certification from two Eccentric Circles ) .

Original: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form
Revised: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: and where r 3 is the radius of certification about x 3 .
Revised: and where r 3 is the radius of certification about x 3 .

Original: Proof.
Revised: Proof.

Original: To begin with, we introduce the co-ordinate translation y = f
Revised: To begin with, we introduce the co-ordinate translation y = f

Original: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that
Revised: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such thaty 2 ,j ̸ = 0 and y 3 ,j ̸ = 0 only when j = k for any k .

Original: [Equation]
Revised: [Equation]

Original: In these coordinates the intersection of the hyperspheres centred about x 2 and x 3 occurs at
Revised: Under this coordinate system, the intersection of the hyperspheres centred about x 2 and x 3 occurs at

Original: [Equation]
Revised: [Equation]

Original: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =
Revised: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =

Original: d 2 , and with the equivalent also holding for y 3 ,k .
Revised: d 2 , and with the equivalent also holding for y 3 ,k .

Original: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥
Revised: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥

Original: y ∥ and
Revised: y ∥ and

Original: [Equation]
Revised: [Equation]

Original: which is equivalent to Equation (7).
Revised: which is equivalent to Equation (7).

Original: Intuitively we can assume that this logic should extend to S n for n > 3 .
Revised: Intuitively we can assume that this logic should extend to S n for n > 3 .

Original: However,while the nearestpoint from x 1 on S 3 is a point, if we consider x i for i ≤ 3 are fixed, then  the nearest point to x 1is no longer a point, but asurface in R d − 1  .
Revised: However, if we proceed byiteratively adding additional hyperspheres one at a time, then for n = 4 the closest point to x 1 onthe revised boundary hypersphere will a R d − 1 manifold embedded in R d .

Original: Thus, finding additional hyperspheres that completelycover this R d − 1 surfaces is non-trivial. Similarly, any other arrangement of  bounding hyperspheresscales nonlinearly with the intrinsic dimensionality of the space, resulting in exponential growth inthe number of hyperspheres that  need to be solved for, and thus, in the overall computational cost. This effectively imposes that it is infeasible to solve for any S n where n > 3 .
Revised: This manifold cannot becovered by a single additional sphere, but rather requires an infeasible number of spheres to be addedto the boundary. While it may be possible to construct bounding spheres for n > 3 in a fashion thatdoes not require iteratively adding one additional sphere at a time, the complexity of doing so scalesnonlinearly with the underlying dimensionality, due to both the added complexity of the search space,and the size of the manifolds that would need to be covered by the additional set of boundary spheres.

Original: 3.3 Boundary treatments
Revised: 3.3 Boundary treatments

Original: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .
Revised: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .

Original: However, for the majority of certifications, a subset of B P ( x 1 , L 1 ) will be outsidethe feasible domain for x 1 .
Revised: However in the majority of cases a subset of B P ( x 1 , L 1 ) will exist outside [0 , 1] d .

Original: While this observation is trivially true,we are unable to leverage it toimprove the size of the certification, as the distance from B P ( x 1 , L 1 ) toany point of intersectionwith { 0 , 1 } d will still be of length L 1 away from x 1 . This property also holds for the intersection of B P ( x 2 , L 2 ) with the bounds of the feasible space.
Revised: While this observation is trivially true, it has no influence on the radius of certification achievedby Equation 3 due to the symmetry of B P ( x 1 , r ) .

Original: However,as the distance from x 1 to the intersection of B P ( x 2 , L 2 ) and the feasible space is largerthan that from x 1 to the boundary of the hypersphere about x 2 , as is demonstrated within Figure 1c.
Revised: However, the asymmetric nature of B P ( x 2 , r 2 )about x 1 guarantees that if B P ( x 2 , r 2 ) exceeds [0 , 1] d , then the closest point to x 1 within the feasibledomain must have an associated distance ˆ r > r ′ , as is demonstrated within Figure 1c.

Original: This allows us to make the following observation about improving the feasible radius of certification.
Revised: This allows usto make the following observation about improving the feasible radius of certification.

Original: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .
Revised: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .

Original: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside thefeasible space for instances allows us to construct an updated region of certification where
Revised: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside thefeasible space for instances allows us to construct an updated region of certification where

Original: [Equation]
Revised: [Equation]

Original: where z k =
Revised: where z k =

Original: (cid:26)if x 1 ,k < 0 .
Revised: (cid:26)if x 1 ,k < [Equation]

Original: if x 1 ,k > 0 . 
Revised: if x 1 ,k > 0 . [Equation]

Original: 5 , where 1 is an indicator function acting upon its operator.
Revised: where 1 is an indicator function acting upon its operator.

Original: Proof.
Revised: Proof.

Original: In contrast to the prior proof, for this problem we retain the coordinate system of the inputspace.
Revised: In contrast to the prior proof, for this problem we retain the coordinate system of the inputspace.

Original: To support this, we introduce the notation that x n is defined as as { x  1,n , x  2,n , . . .
Revised: To support this, we introduce the notation that x n = { x n, 1 , x n, 2 , . . .

Original: , x d,n } .
Revised: , x n,d } .

Original: Ifwe let  x k ∈ { 0 , 1 } , then the intersection between B P ( x 2 , L 2 ) and the bounding surface in dimension165 k  creates a bounding hypersphere of the form[Equation]
Revised: If we let 163 x k ∈ { 0 , 1 } , then the intersection between B P ( x 2 , L 2 ) and the bounding surface in dimension k 164 creates a bounding hypersphere of the form

Original: [Equation]
Revised: [Equation]

Original: which yields an effective radius r r 2 =a
Revised: which yields an effective radius r r 2 =

Original: [Equation]
Revised: [Equation]

Original: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the form
Revised: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the formˆ

Original: [Equation]
Revised: [Equation]

Original: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.
Revised: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.

Original: 3.4 Algorithms
Revised: 3.4 Algorithms

Original: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver. Such a solver is
Revised: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver. Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives. To implement the multiple

Original: Algorithm
Revised: Algorithm

Original:  ` 
Revised: 1: Input: data x , samples N , iterations M , true-label i 2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Algorithm` x ′ + N ` 0 , σ 2 I N , N ˘˘ 4: if j = i then 5: r ′ = L 2 − ∥ x ′ − x ∥ 6: if r ′ >

Original: `
Revised: r o

Original: N ˘˘ {Details of this can be found in Algorithm 2} 4: for highly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.
Revised: then 7: r ′ o = r ′ 8: end if 9: x ′ = x ′ ± γ ∇ x ′ r ′ ∥∇ x ′ r ′

Original: To implement the multipletransitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).
Revised: ∥ {Step size γ determined by Barzilai-Borwein [1]. Positive branch is selected if j = i , otherwise the negative branch is used to attempt to return to the region in which the predicted class matches the label. } 10: end if 11: end for transitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).

Original: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.
Revised: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.

Original:  Extracting gradient information from non-differentiable functions
Revised:  Extracting gradient information from non-differentiable functions

Original: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.
Revised: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.

Original: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).
Revised: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).

Original: Within this work we haveimplemented two mechanisms to circumvent these conditions.
Revised: Within this work we haveimplemented two mechanisms to circumvent these conditions.

Original: The first substitutes the arg maxoperation with a Gumbel-Softmax [11].
Revised: The first substitutes the arg maxoperation with a Gumbel-Softmax [12].

Original: In doing so, the class expectations are rendered differentiable.
Revised: In doing so, the class expectations are rendered differentiable.

Original: The second approach involves recasting the Monte-Carlo estimators as integrals of the form
Revised: The second approach involves recasting the Monte-Carlo estimators as integrals of the form

Original: [Equation]
Revised: [Equation]

Original:  where ω ( y , x ) is the multivariate-Normal probability distribution centred around x . 
Revised: (14) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x . This formalism,and the symmetry of the underlying space allows for the construction of undifferentiable gradients by [Equation]

Original: From thisformalism, the symmetry of the underlying space allows gradient free derivatives of ∇ x E to becalculated by way of 
Revised: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [26]. Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [23]. The relative performance of these two approaches—respectively labelled ‘Approximate’ and ‘Full’for the above approach and the Gumbel-Softmax approaches—will be tested in the following section. For the case of the double transitivity of Section 3.2 our experiments suggest that uncertainty in theanalytic derivatives produces deleterious results.

Original: [Equation]
Revised: As such derivatives for the multiple transitivityapproach are exclusively considered through autograd for both the Full and Approximate methods. 5 R 0 .0 .0 .0 .0 .1 . C e rt i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .

Original: where{+5 R 0 .0 .0 .0 .0 .0 .0 .b) CIFAR0 .0 .1 .1 . 5 R 0 .0 .0 .0 .0 .0 .0 .0 .
 .c)+}
Revised: {+5 R 0 .0 .0 .0 .0 .0 .0 .b) CIFAR0 .0 .1 .1 . 5 R 0 .0 .0 .0 .0 .0 .0 .0 .
 .c)+}

Revised: Tiny-Imagenet

Original: [Equation]
Revised: Cohen σ =0 . 5 Best Approx σ =0 . Best Full σ =0 . 5 Cohen σ =1 .

Original: {+Best Approx σ =1 . 
+}
Revised: {+Best Approx σ =1 . 
+}

Revised: Best Full σ =1 .

Original: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [23].
Revised: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [17], CIFAR- 10 [15], and Tiny-Imagenet [13], thelatter of these is a 200 -class variant of Imagenet [34] which downsamples images to 3 × 60 × 60 . Alldatasets were modelled using the Resnet 18 architecture in PyTorch [25], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling. For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.

Revised: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.

Original: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with  the input dimensionality [20].
Revised: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation. Parameter optimisation was performed with Adam [14],with the learning rate set as 0 . Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples. Training occurred using SGD over 80 epochs, with a starting learning rate of0 .

Revised: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .

Original:  To explore the relative performance of these two approaches, both of these approaches will be testedin the following section, with the Gumbel-Softmax based approach labelled as ‘Full’, and the abovegradients as ‘Approximate’, which will be used to consider the transitivity approach of [-Section 3.
-]
Revised: The full code to implement our experiments can be found at anonymised link . Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al. against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2. While there are only minor differences betweenthe two derivative approaches, there are clear regions of [-Section 3.
-]out performance relative to Cohen across alltested datasets.

Revised: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.

Revised: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .

Revised: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.

Revised: This property would suggestthat samples with a larger R would exhibit a decreased difference between our techniques and thatof Cohen et al.

Revised: would decrease, as smaller values of E 1 provide less search information.

Revised: However,it appears that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 } counteract the decreasedinformation provided by the second highest class, leading to the contradictory performance bestobserved in the MNIST experiments of Figure 2 at σ = 0 .

Revised: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.

Revised: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .

Original: 5 R 0 .0 .0 .0 .0 .1 . 
Revised: 5 and σ = 1 . 0 cases. This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information. However, an equivalent radii for σ = 1 . 0 has significantly [Figure]

Original: C e rt
Revised: [Figure]

Original: i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .
Revised: more information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .b)
Revised: That there is a clear demarcation between the Full and Approximate solver variants reflects the uncertainties introduced by Equation (15). However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach. The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .

Original: CIFAR0 .0 .1 .1 .
Revised: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion. This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements. Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3). Numerical performance The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.

Original: [-5 R 0 .0 .0 .0 .0 .0 .0 .0 .
-]
Revised: [-5 R 0 .0 .0 .0 .0 .0 .0 .0 .
-]While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach. Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach. This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ . Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.

Original: .c)
Revised: [Table]

Original: Tiny-Imagenet
Revised: [Figure]

Original:  Cohen σ =0 . 5 Best Approx σ =0 . Best Full σ =0 . 5 Cohen σ =1 .
Revised: Limitations While our experimental works only considered L 2 -norm bounded perturbations due tothe guarantee of best possible certification in this space provided by Cohen et al.

Original: [-Best Approx σ =1 . 
-]
Revised: [-Best Approx σ =1 . 
-], the the principlesof our Geometrically Informed Certified Robustness are extensible to other spaces. However, at thisstage we have not tested the performance of this approach in other L P -norm spaces, nor across abroader range of training methods, which have been shown to be able to tighten the achievable radiusof certification [21]. We also must emphasise that there is an additional computational cost involved in our numericalprocess, due to the optimisation processes requiring multiple evaluations of the Monte-Carlo expectations, which in turn each require N ≫ 10 model draws. This computational cost may be burdensomein some contexts, however we believe that the cost may be more than worth it for high-value modelsdeployed in environments considered vulnerable to adversarial attacks.

Original: Best Full σ =1 .
Revised: While our current emphasishas been on demonstrating the performance of Geometrically Informed Certified Robustness, webelieve that the computational costs can be reduced by performing the optimisation stages with

Original: under the label ‘Single’, and  the boundary consideration of Section 3.3 as ‘Boundary’.
Revised: N ′ < N model draws, and by potentially reusing model draws across the iterative process.

Original: For the caseof the double transitivity of Section 3.2 our experiments suggest that uncertainty in the analyticderivatives produces deleterious results.
Revised: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3]. However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour. However, achieving this does increase the computational cost and associated energy use, however webelieve that the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.  Conclusions

Original: As such derivatives for the multiple transitivity approach areexclusively considered through autograd for both the Full and Approximate methods.
Revised: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks. In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 . 5 , with the percentage increaseimproving quasi-linearly with σ . Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate.

Original: Experiments
Revised: A Appendix

Original: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [16], CIFAR- 10 [14], and Tiny-Imagenet [12], thelatter of these is a 200 -class variant of Imagenet [31] which downsamples images to 3 × 60 × 60 .
Revised: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated. Of note are two minor changes from prior implementations of this certification regime. The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the‘Full’ derivative approach.

Revised: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .

Revised: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .

Revised: Our initial testing revealed that when we employed either Sison-Glaz [29] or Goodman et al.[11] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.

Revised: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .

Revised: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)

Revised: y j < 5 y j , which conforms with the requirements of

Revised: Goodman et al.

Revised: [11] that all class counts must be greater than 5 .

Revised: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.

Revised: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.

Revised: MNIST exists under a GNU v 3 . 0 license;

Revised: CIFAR-

Revised: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.

Revised: A.2 Relative performance for MNIST and CIFAR-10

Revised: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.

Revised: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .

Revised: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.

Revised: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .

Revised: 0but not σ = 0 .

Revised: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.

Revised: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of the

Original: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [22], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.
Revised: [Figure] be seen in [Figure] relative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-

Revised: 10when

Revised: σ = 0 .

Revised: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,

Revised: MNIST again reveals interesting properties when we consider Figure 10.

Revised: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.

Revised: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solvermay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.

Revised: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .

Revised: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.

Revised: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in

Revised: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.

Revised: to be improvedupon in low semantic complexity datasets is smaller.

Revised: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: P r o p o rt i o n a) Approximate 0.

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: to Cohen et al

Revised: σ

Revised: M

Revised: [Figure]

Revised: i a n

Revised: [Figure]

Revised: ce n t ag e I m p

Revised: r

Revised: o v e

Revised: m e n t

Revised: [Figure]

Revised: [Figure]

Revised: A.3 Influence of the starting step size

Original: For both MNIST and  CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.
Revised: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1. As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 . 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 . 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.

Revised: This is likely due to the added uncertainty in the

Revised: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.

Revised: Based upon these results, the starting step size was uniformly set to 0 .

Revised: 01 for allexperiments.

Revised: [Figure]

Revised: A

Revised: Abstract

Revised: In response to subtle adversarial examples flipping classifications of neural network models, recentresearch has promoted certified robustness as a solution.

Revised: There, invariance of predictions to allnorm-bounded attacks is achieved through randomised smoothing of network inputs.

Revised: Today’s stateof-the-art certifications make optimal use of the class output scores at the input instance under test:no better radius of certification (under the L 2 norm) is possible given only these score.

Revised: However,it is an open question as to whether such lower bounds can be improved using local informationaround the instance under test.

Revised: In this work, we demonstrate how today’s “optimal” certificates canbe improved by exploiting both the transitivity of certifications, and the geometry of the input space,giving rise to what we term Geometrically-Informed Certified Robustness .

Revised: Essentially we searchfor, and merge with, larger certifiable balls nearby to an initial instance under test.

Revised: Our approachimproves certifications for more than 80% of instances in experiments with Tiny-Imagenet, with anon average 5% increase in the associated radius of certification.

Revised: B Introduction

Revised: [Figure]

Revised: Learned models, including neural networks, are well known to be susceptible to crafted perturbationsinducing changes in a model’s output without changing semantic properties of the input [2].

Revised: Concerningly neural (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) output (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) changed (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) crafted (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Table]

Revised: networks not only misclassify these perturbations—known

Revised: [Table]

Revised: as adversarial examples —but they also assign high confidence to these incorrect predictions.

Revised: These

Revised: [Table]

Revised: behaviours have been observed across a wide range of models and datasets, and appear to be a product

Revised: [Table]

Revised: of piecewise-linear interactions within neural networks [10].

Revised: [Table]

Revised: Crafting these adversarial examples typically involves gradient-based optimisation to construct small

Revised: [Table]

Revised: perturbations.

Revised: These attacks have been applied to both black- and white-box models [24]

Revised: [Table]

Revised: and can

Revised: [Table]

Revised: be used to target class changes, to attack all classes [7]

Revised: [Table]

Revised: or even introduce backdoors into model

Revised: [Table]

Revised: behaviour [4].

Revised: To mitigate the influence of these attacks, defences have typically been designed

Revised: [Table]

Revised: to minimise the effect of a specific attack (or attacks).

Revised: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.

Revised: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.

Revised: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.

Revised: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.

Revised: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed not to beadversarial examples.

Revised: Certifications based on randomised smoothing of classifiers around an inputpoint are in a sense optimal [6]: based only on the prediction class scores at the input point, no betterradius is in general possible.

Revised: Despite this, such certifications fail to use readily available—yet stilllocal—information: the certifiability of points nearby to the input of interest.

Revised: The key insight of thiswork is that these neighbourhood points may generate certified radii large enough that we may enlargethe certified region based solely on classifier information at the initial point (cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) completely (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enclose(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sample (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improving (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) radii (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.

Revised: This process is not just limited to a 526 single neighbouring point either, as we can also (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) extended (cid:58)(cid:58) to use the intersection of the 527 regions of certification of multiple points, and the nature of the input domain itself to generate largercertifications.

Revised: This leads to our main contribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceeding those of the hitherto best-case guaranteed approach of Cohen etal.

Revised: C Background and literature review

Revised: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [22, 32, 35, 36, 28].

Revised: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [27].

Revised: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [33].

Revised: While bounding mechanisms can produce valid certifications

Revised: [Table]

Revised: their time and memory complexity

Revised: [Table]

Revised: makes them infeasible to address complex model architectures or high-dimensional data [31].

Revised: [Table]

Revised: Randomised smoothing Outside of bounding mechanisms

Revised: [Table]

Revised: another common framework for de-

Revised: [Table]

Revised: veloping certifications leverages randomised smoothing [18]

Revised: [Table]

Revised: in which noise is applied to input

Revised: [Table]

Revised: instances to smooth model predictions.

Revised: In contrast to other robustness mechanisms

Revised: [Table]

Revised: randomised

Revised: [Table]

Revised: smoothing only requires minimal changes to a classifier, specifically the repeated sampling of

Revised: [Table]

Revised: noise-based perturbation of the inputs, where the choice of sampling distribution

Revised: [Table]

Revised: [Table]

Revised: a

Revised: [Table]

Revised: is tied to the L P -norm of adversarial perturbations being certified against.

Revised: [Table]

Revised: In

Revised: [Table]

Revised: this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) application (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) noise (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)

Revised: the

Revised: [Table]

Revised: only

Revised: [Table]

Revised: architectural

Revised: [Table]

Revised: (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) required (cid:58)(cid:58)

Revised: to

Revised: [Table]

Revised: achieve (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.

Revised: (cid:58)(cid:58)

Revised: In (cid:58) the

Revised: [Table]

Revised: of L

Revised: [Table]

Revised: bounded

Revised: [Table]

Revised: , Gaussian

Revised: [Table]

Revised: sampling of the

Revised: [Table]

Revised: [Equation]

Revised: where y i i.i.d.

Revised: [Equation]

Revised: 16) is employed for all

Revised: [Table]

Revised: -time instances.

Revised: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator

Revised: [Equation]

Revised: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.

Revised: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.

Revised: [Table]

Revised: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r .

Revised: Certified robustness has

Revised: [Table]

Revised: not, however, extended to rotational or translational modifications [30], nor functional attacks [16] (cid:58) ,

Revised: [Table]

Revised: with

Revised: [Table]

Revised: recent

Revised: [Table]

Revised: works

Revised: [Table]

Revised: also (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considering (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) rotational

Revised: [Table]

Revised: and/or

Revised: [Table]

Revised: That such guarantees are possible was first shown [18] by way of differential privacy [8], with morerecent works using Rényi divergence [19]

Revised: [Table]

Revised: and parametrising worst-case behaviours [6, 26].

Revised: In thispaper, we focus on the influential work of Cohen et al.

Revised: [Table]

Revised: and their lower-bound guarantee ofclassification invariance

Revised: [Equation]

Revised: [Equation]

Revised: where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denotethe two largest class expectations (of the winning class and runner (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) runner-up).

Revised: These expectationscapture the likelihood that the arg max of a single draw under noise would return a given class, asper Equation (2).

Revised: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [6].

Revised: Prior works have been able to generate improvements to Cohen et al.

Revised: for binomial classifiers (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) binary(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification [23], in which it is assumed that E 1 = 1 − E 0 .

Revised: While any multivariate model can bemapped to a binary output for the purposes of constructing a certification, artificially inflating E 1inherently suppresses the size of the certification, as per Equation (3).

Revised: In this paper we demonstrate anovel approach that can generate improvements to the certified robustness of multivariate classifiers.

Revised: D Geometrically-informed certified robustness

Revised: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [9].

Revised: Thus, constructing larger certificationsin such a context is inherently valuable.

Revised: This specific L P space is of interest due to both its viability as a defence model, and the existence ofa guarantee of adversarial robustness that is provably as large as can be

Revised: [Table]

Revised: guarantee

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Table]

Revised: for any 582 instance [6].

Revised: Over the remainder of this section we will document how it is possible to improve uponthis provably best-case guarantee by exploiting several properties of certified robustness.

Revised: D.1 Exploiting transitivity

Revised: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.

Revised: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .

Revised: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.

Revised: Definition D.1 ( Overlap Properties of Certification ) .

Revised: If x 1 and x 2 have the same class associated with them, then the region of certification can be described as (cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) terms (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) two (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hyperspheres

Revised: B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) , where r 1 and r 2 are respectively the radii of certification for x 1 and x 2(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Equation]

Revised: However, when (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) When (cid:58) considering certification, we are often concerned not with the size of theregion of classification invariance, but rather the distance to the nearest possible adversarial example.

Revised: If it is possible to find some x ′ such that its region of certification completely encircles that of thecertification at x , the following definition demonstrates that the certification radius (cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58) x can beincreasedby way of Equation .

Revised: Lemma D.2 ( Set Unions Certified Radius ) .

Revised: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance of

Revised: [Equation]

Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ′ ≥ r (cid:58) from x 1 , where r ′ ≥ r 1 .

Revised: [Equation]

Revised: ∥ x 2 − x

Revised: [Equation]

Revised: P , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (19)

Revised: Proof.

Revised: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .

Revised: Thus r ′ =

Revised: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).

Revised: As such, we can recast the certification problem (cid:58)(cid:58)(cid:58)(cid:58) task (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) constructing (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58) from being astrictly analytic function , to the nonlinear optimisation problem

Revised: [Equation]

Revised: (20) with Figure 1a providing a two-dimensional representation of this process.

Revised: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >

Revised: r 1 is guaranteed to be animprovement to the certification at x 1 .

Revised: D.2 Multiple transitivity

Revised: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .

Revised: x n , r n } .

Revised: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union ofall B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .

Revised: Basedupon the construction of S n , it follows that the radius of certification is r n =

Revised: min s ∥ S n ( s ) − x 1 ∥ .

Revised: [Table]

Revised: Definition D.3 ( Positioning of x 3 in the case of n = 3 ) .

Revised: In the case where n = 3 , let us considertwo points x 3 and x ′ 3 , where

Revised: [Table]

Revised: boundary (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 2 , r 2 ) (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: located(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) vector (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) spanning (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) between (cid:58)(cid:58)(cid:58) x 1 (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) x 2 , (cid:58)(cid:58)(cid:58) at (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) distance (cid:58)(cid:58) r ′ (cid:58)(cid:58)(cid:58)(cid:58) from (cid:58)(cid:58)(cid:58)(cid:58) x 1 .

Revised: (cid:58)(cid:58)(cid:58)(cid:58)

Revised: This (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) turn (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) suggests (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) optimal (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) positioning (cid:58)(cid:58) of (cid:58)(cid:58) x 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) should (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) along (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) vector, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) such (cid:58)(cid:58)(cid:58)

Revised: that (cid:58)

Revised: [Equation]

Revised: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ B P ( x ′ 3 , r ′ 3 ) , then the optimalpositioning of x 3 must satisfy Equation (6).

Revised: Assuming that the above definition is true allows us to define a new certification using (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) significantly(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Table]

Revised: described

Revised: [Table]

Revised: by the 624 following Lemma, which aligns with the visual sketch outlined in Figure 1b

Revised: [Table]

Revised: Lemma D.4 ( Certification from two Eccentric Circles ) .

Revised: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form

Revised: [Equation]

Revised: where

Revised: [Equation]

Revised: and where r 3 is the radius of certification about x 3 .

Revised: Proof.

Revised: To begin with, we introduce the co-ordinate translation y = f

Revised: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that

Revised: [Equation]

Revised: and y

Revised: [Equation]

Revised: ̸ = 0 only when j = k for any k

Revised: [Equation]

Revised: [Equation]

Revised: In these coordinates (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Under (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) coordinate (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) system, (cid:58) the intersection of the hyperspheres centred about 633 x 2 and x 3 occurs at

Revised: [Equation]

Revised: [Equation]

Revised: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =

Revised: d 2 , and with the equivalent also holding for y 3 ,k .

Revised: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥

Revised: y ∥ and

Revised: [Equation]

Revised: which is equivalent to Equation (7).

Revised: Intuitively we can assume that this logic should extend to S n for n > 3 .

Revised: However, while the

Revised: [Table]

Revised: nearest point from x 1 on S 3 is a point, if we consider x i

Revised: [Table]

Revised: for i ≤ 3 are fixed, then the nearest point to x 1 is no

Revised: [Table]

Revised: longer a point

Revised: [Table]

Revised: but a surface in R d − 1 .

Revised: Thus, finding additional hyperspheres that completely cover

Revised: [Table]

Revised: surfaces is

Revised: [Table]

Revised: non-trivial.

Revised: Similarly

Revised: [Table]

Revised: any other arrangement of bounding hyperspheres

Revised: [Table]

Revised: be

Revised: [Table]

Revised: so scales nonlinearly with the intrinsic dimensionalityof the space,

Revised: [Table]

Revised: resulting in exponential growth in the number of hyperspheres that

Revised: [Table]

Revised: infeasible

Revised: [Table]

Revised: spheres.

Revised: D.3 Boundary treatments

Revised: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .

Revised: However , for (cid:58)(cid:58) in the majority of certifications, (cid:58)(cid:58)(cid:58)(cid:58) cases (cid:58) a subset of B P ( x 1 , L 1 ) willbe outside the feasible domain for x 1 (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) outside (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d .

Revised: While this observation is trivially true, weare unable to leverage it to improve the size of the certification , as the distance from B P ( x 1 , L 1 ) toany point of intersection with { 0 , 1 } d will still be of length L 1 away from x 1 .

Revised: This property also holds for the intersection of B P ( x 2 , L 2 ) with the bounds of the feasible space (cid:58) it(cid:58)(cid:58)(cid:58) has (cid:58)(cid:58) no (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Table]

Revised: [Table]

Revised: , as

Revised: [Table]

Revised: distance

Revised: [Table]

Revised: x 1 to

Revised: [Table]

Revised: B P ( x 2 , L 2 )

Revised: [Table]

Revised: the

Revised: [Table]

Revised: space is larger than

Revised: [Table]

Revised: x

Revised: [Table]

Revised: guarantees (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) if(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exceeds (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d ,

Revised: [Table]

Revised: then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58) to (cid:58) x 1 to the boundary of the hypersphere aboutx

Revised: [Table]

Revised: within

Revised: [Table]

Revised: the

Revised: [Table]

Revised: feasible

Revised: [Table]

Revised: domain

Revised: [Table]

Revised: must

Revised: [Table]

Revised: have

Revised: [Table]

Revised: an

Revised: [Table]

Revised: associated (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) distance (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: ˆ r > r ′ , as is demonstrated within 664 Figure 1c.

Revised: This allows us to make the following observation about improving the feasible radius ofcertification.

Revised: Lemma D.5 ( Boundary Certifications by way of Eccentric Circles ) .

Revised: The eccentricity of

Revised: B P ( x 2 , L 2 ) as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside the feasible space for instances allows us to construct an updated region of certificationwhere

Revised: [Equation]

Revised: where z k =

Revised: (cid:26)if x 1 ,k < 0 .

Revised: if x 1 ,k > 0 .

Revised: 5 , where 1 is an indicator function acting upon its operator.

Revised: Proof.

Revised: In contrast to the prior proof, for this problem we retain the coordinate systemof the input space.

Revised: To support this, we introduce the notation that x n is defined as as

Revised: [Equation]

Revised: x n = { x n, 1 , x n, 2 , . . .

Revised: , x n,d } .

Revised: If we let x k ∈ { 0 , 1 } , then the intersectionbetween B P ( x 2 , L 2 ) and the bounding surface in dimension k creates a bounding hypersphere of theform

Revised: [Equation]

Revised: [Equation]

Revised: which yields an effective radius r r 2 =

Revised: [Equation]

Revised: 1: Input: data x , samples N , iterations M , true-label i , cutoff c , multiplicative Lagrange multiplier scaling factor λ , penalty parameter Γ ≫2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Model `

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: ˘˘

Revised: [Table]

Revised: j = Algorithm` x ′ + N ` 0 , σ 2 I N , N ˘˘ (cid:58)

Revised: [Table]

Revised: : if j = i then

Revised: [Table]

Revised: [Table]

Revised: : if r ′ > r ′

Revised: o

Revised: then 7: r

Revised: [Table]

Revised: = r ′ 8: end if 9:

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: {Step size γ determined by

Revised: Barzilai-Borwein [1].

Revised: Positive branch is selected if j = i , otherwise the negative branch is used to attempt to return to the region in which the predicted class matches the label.

Revised: } 10: end if 11: end for

Revised: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the form

Revised: [Equation]

Revised: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.

Revised: D.4 Algorithms

Revised: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver.

Revised: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.

Revised: To implement the multipletransitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).

Revised: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.

Revised: E Extracting gradient information from non-differentiable functions

Revised: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.

Revised: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).

Revised: Within this work we haveimplemented two mechanisms to circumvent these conditions.

Revised: The first substitutes the arg maxoperation with a Gumbel-Softmax [12].

Revised: In doing so, the class expectations are rendered differentiable.

Revised: The second approach involves recasting the Monte-Carlo estimators as integrals of the form

Revised: [Equation]

Revised: [Equation]

Revised: [Equation]

Revised: where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .

Revised: From thisformalism, (cid:58)(cid:58)(cid:58)(cid:58)

Revised: This (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) formalism, (cid:58)(cid:58)(cid:58) and (cid:58) the symmetry of the underlying space allows gradient free derivatives of ∇ x E to be calculated by way of

Revised: [Table]

Revised: for

Revised: [Table]

Revised: the

Revised: [Table]

Revised: construction

Revised: [Table]

Revised: of

Revised: [Table]

Revised: by

Revised: [Equation]

Revised: where

Revised: [Equation]

Revised: [Equation]

Revised: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [26].

Revised: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [23].

Revised: To explore the (cid:58)(cid:58)(cid:58)(cid:58)

Revised: The relative performance of these two approaches, both of these approacheswill be tested in the following section, with the Gumbel-Softmax based approach labelled as‘Full’ , and the above gradients as ‘ (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approaches—respectively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) labelled (cid:58)(cid:58) ‘Approximate’ , whichwill be used to consider the transitivity approach of Section 3.1 under the label ‘Single’, and theboundary consideration of Section 3.3 as ‘Boundary’ (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ‘Full’ (cid:58)(cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) above (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approach (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: [Table]

Revised: [Table]

Revised: section.

Revised: For the case of the dou-

Revised: [Table]

Revised: ble transitivity of Section 3.2 our experiments suggest that uncertainty in the analytic derivativesproduces deleterious results.

Revised: As such derivatives for the multiple transitivity approach are exclusivelyconsidered through autograd for both the Full and Approximate methods.

Revised: F Experiments

Revised: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [17], CIFAR- 10 [15], and Tiny-Imagenet [13], thelatter of these is a 200 -class variant of Imagenet [34] which downsamples images to 3 × 60 × 60 .

Revised: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [25], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.

Revised: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.

Original: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.
Revised: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.

Original: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.
Revised: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.

Original: Parameter optimisation was performed with Adam [13],with the learning rate set as 0 .
Revised: Parameter optimisation was performed with Adam [14],with the learning rate set as 0 .

Original: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.
Revised: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.

Original: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .
Revised: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .

Original: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .
Revised: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .

Original: The full code to implement our experiments can be found at anonymised link .
Revised: The full code to implement our experiments can be found at anonymised link .

Original: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.
Revised: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.

Original: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.
Revised: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.

Original: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.
Revised: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.

Original: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.
Revised: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.

Original: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .
Revised: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .

Original: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications. 
Revised: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications. This property would suggest thatas (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) samples (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) larger R is increased, the difference in the certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) would (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [Table]

Original: This property would suggestthat as R is increased, the difference in the certifications between our techniques and that of Cohen etal.
Revised: decreased(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) difference (cid:58) between our techniques and that of Cohen et al.

Original: would decrease, as smaller values of E 1 provide less information for the search.
Revised: would decrease, as smaller values of E 1provide less information for the search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) information.

Original: However, thevery opposite appears to occur, a property that is particularly visible in the MNIST experiments of
Revised: However, the very opposite appears to 5 R 0 .0 .0 .0 .0 .1 . C e rt i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .

Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .b)

Revised: CIFAR0 .0 .1 .1 .

Original: {+5 R 0 .0 .0 .0 .0 .0 .0 .0 .
+}
Revised: {+5 R 0 .0 .0 .0 .0 .0 .0 .0 .
+}

Original: Figure 2 at σ = 0 .
Revised: .c) Tiny-Imagenet Cohen σ =0 . 5 Best Approx σ =0 .

Original: This appears to be a product of the singularities in the derivatives of Φ − 1 [ E ] as{+Best Full σ =0 . 5 Cohen σ =1 . Best Approx σ =1 . 
+}
Revised: {+Best Full σ =0 . 5 Cohen σ =1 . Best Approx σ =1 . 
+}

Original:  E → { 0 , 1 } , which counteracts  the decreased information provided by the second highest class. 
Revised: Best Full σ =1 . occur, a property that is particularly visible in the MNIST experiments of Figure 2 at σ = 0 . Thisappears to be a product of the (cid:58) it (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) appears (cid:58)(cid:58)(cid:58)(cid:58) that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 }, which counteracts (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) counteract the decreased information provided by the second highest class. (cid:58) ,(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure] [Figure]
Revised: leading (cid:58)(cid:58) [Table] [Table]

Original: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.
Revised: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.

Original: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .
Revised: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .

Original: 5 and σ = 1 . 0 cases.
Revised: 5 and σ = 1 . 0 cases.

Original: This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information.
Revised: This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information.

Original: However, an equivalent radii for σ = 1 . 0 has significantlymore information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.
Revised: However, an equivalent radii for σ = 1 . 0 has significantlymore information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.

Original: That there is a clear demarcation between the
Revised: That there is a clear demarcation between the

Original: Full and Approximate solver variants reflects the uncertainties introduced by Equation (15).
Revised: Full and Approximate solver variants reflects the uncertainties introduced by Equation (15).

Original: However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach.
Revised: However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach.

Original: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .
Revised: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .

Original: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.
Revised: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.

Original: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.
Revised: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.

Original: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).
Revised: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).

Original: Numerical performance
Revised: Numerical performance

Original: The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, as [Table]
Revised: The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.

Original: [Figure] shown in Table 1. While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.
Revised: While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.

Original: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.
Revised: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.

Original: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .
Revised: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .

Original: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.
Revised: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.

Original: Limitations While our focus was on  L 2 -norm bounded perturbations was driven by the Cohenet al.
Revised: Limitations While our focus was on (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) experimental (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) works (cid:58)(cid:58)(cid:58)(cid:58) only (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considered L 2 -norm bounded perturbations was driven by the Cohen (cid:58)(cid:58) due (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) the (cid:58) guarantee of best possible certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) in(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) space (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provided (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Cohen et al.

Original: guarantee of best possible certifications, the the principles of our Geometrically Informed 
Revised: , the the principles of our Geometrically Informed Certified Ro- [Figure] current (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) value. Equiva- lent figures for MNIST and CIFAR- 10 are found in Appendix A.

Revised: [Figure]

Original: Certified Robustness are extensible to other spaces.
Revised: ties Cohen et al. [Table] [Table] [Table]

Revised: [Table]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Original:  However, as with prior certification approacheswe have only considered bounded perturbations without extending to translations, rotations, or otherfunctional attacks.
Revised: bustness are extensible to other spaces. However, as with prior certification approaches we have onlyconsidered bounded perturbations without extending to translations, rotations, or other functionalattacks (cid:58) at (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) stage (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58)(cid:58)(cid:58) [Table] [Table]

Revised: which (cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58)(cid:58)(cid:58) been (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) shown (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58) able (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) tighten (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)

Original: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3].
Revised: [21].(cid:58)(cid:58)(cid:58) We (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) emphasise (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58) [Table] [Table] [Table]

Original: However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour.
Revised: be [Table] (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [Table]

Original: However, achieving this does increase the computational cost and associated energy use, however webelieve that  the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.
Revised: been (cid:58)(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) demonstrating (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) performance (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Geometrically (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Informed (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Certified(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Robustness, (cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) believe (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) computational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) costs (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) reduced (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) performing (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) optimisation(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) stages (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) N ′ < N (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) model (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) draws, (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) potentially (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) reusing (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Conclusions
Revised: [Table]

Original: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks. In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees byon average more than 5% at σ = 0 . 5 , with the percentage increaseimproving quasi-linearly with σ .
Revised: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3]. However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour.

Original: Being able to improve upon the size of these guarantees inherentlyincreases the  costof constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate. Checklist For all authors... (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
Revised: However, achieving this does increase the computational cost and associated energy use, however webelieve that the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.

Original: contributions and scope?

Original: [Yes] (b) Did you describe the limitations of your work? [Yes] In the Limitations section of
Revised: G Conclusions

Original: Section (c) Did you discuss any potential negative societal impacts of your work? [Yes] In theLimitations section of Section 5(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem? [Yes]
Revised: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.

Original: If you are including theoretical results... (a) Did you state the full set of assumptions of all theoretical results? [Yes] (b) Did you include complete proofs of all theoretical results?
Revised: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .

Original: [Yes]

Original: If you ran experiments...

Original: (a) Did you include the code, data, and instructions needed to reproduce the main experi-

Original: mental results (either in the supplemental material or as a URL)?

Original: [Yes] This has been

Original: included in the supplementary materials, with license details included therein.

Original: (b) Did you specify all the training details (e g., data splits, hyperparameters, how theywere chosen)? [Yes] In Section
Revised: 5 , with the percentage increaseimproving quasi-linearly with σ .

Original: (c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)? [No] As all experimental results are based uponmetrics calculated over more than 1000 samples, the size of  the underlying error bars are small enough to be negligible.
Revised: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate.

Original: (d) Did you include the total amount of compute and the type of resources used (e g., typeof GPUs, internal cluster, or cloud provider)? [Yes] In Section
Revised: H

Original: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets... (a) If your work uses existing assets, did you cite the creators? [Yes] (b) Did you mention the license of the assets?
Revised: Appendix

Original: [Yes] In Appendix A.1. (c) Did you include any new assets either in the supplemental material or as a URL? [No](d) Did you discuss whether and how consent was obtained from people whose data you’reusing/curating?
Revised: H.1 Algorithmic details

Original: [N/A]

Original: [Table] (e) Did you discuss whether the data you are using/curating contains personally identifiable [Table] information or offensive content?
Revised: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.

Original: [N/A]

Original: If you used crowdsourcing or conducted research with human subjects...

Original: (a) Did you include the full text of instructions given to participants and screenshots, ifapplicable?

Original: [N/A] (b) Did you describe any potential participant risks, with links to Institutional Review Board (IRB) approvals, if applicable? [N/A]
Revised: Of note are two minor changes from prior implementations of this certification regime.

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount spent on participant compensation? [N/A] A Appendix
Revised: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the

Original: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated. Of note are two minor changes from prior implementations of this certification regime. The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the‘Full’ derivative approach.
Revised: ‘Full’ derivative approach.

Original: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .
Revised: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .

Original: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .
Revised: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .

Original: Our initial testing revealed that when we employed either Sison-Glaz [26] or Goodman et al.[10] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.
Revised: Our initial testing revealed that when we employed either Sison-Glaz [29] or Goodman et al.[11] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.

Original: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .
Revised: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .

Original: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)
Revised: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)

Original: y j < 5 y j , which conforms with the requirements of
Revised: y j < 5 y j , which conforms with the requirements of

Original: Goodman et al.
Revised: Goodman et al.

Original: [10] that all class counts must be greater than 5 .
Revised: [11] that all class counts must be greater than 5 .

Original: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.
Revised: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.

Original: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.
Revised: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.

Original: MNIST exists under a GNU v 3 . 0 license;
Revised: MNIST exists under a GNU v 3 . 0 license;

Original: CIFAR-
Revised: CIFAR-

Original: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.
Revised: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.

Original: A.2 Relative performance for MNIST and CIFAR-
Revised: H.2 Relative performance for MNIST and CIFAR-10

Original: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.
Revised: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.

Original: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .
Revised: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .

Original: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.
Revised: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.

Original: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .
Revised: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .

Original: 0but not σ = 0 .
Revised: 0but not σ = 0 .

Original: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.
Revised: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.

Original: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of  the [Figure] figures for can be seen in Figure [Figure]
Revised: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of therelative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-

Original: relative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-

Original: 10when
Revised: 10when

Original: σ = 0 .
Revised: σ = 0 .

Original: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,
Revised: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,

Original: MNIST again reveals interesting properties when we consider Figure 10.
Revised: MNIST again reveals interesting properties when we consider Figure 10.

Original: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST. 
Revised: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST. Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solver r± 0 . A v e r ag e

Original: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solvermay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.
Revised: P e r ce n t ag e I m p

Original: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .
Revised: r o v e m e n t a) [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: current (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) value, (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) explore (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) size (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) radii (cid:58)(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) average (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improvement.

Revised: Equivalent figures for Tiny-Imagenet can be seen in Figure

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Revised: (cid:58)(cid:58)(cid:58)

Revised: [Figure]

Revised: [Table]

Revised: improvement.

Revised: Equivalent figures for Tiny-Imagenet can be seen in Figuremay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.

Revised: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .

Original: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.
Revised: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.

Original: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in
Revised: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in

Original: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.
Revised: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.

Original: to be improvedupon in low semantic complexity datasets is smaller.
Revised: to be improvedupon in low semantic complexity datasets is smaller.

Original: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.
Revised: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.

Original: A.3 Influence of the starting step size
Revised: H.3 Influence of the starting step size

Original: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.
Revised: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.

Original: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .
Revised: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .

Original: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 . 
Revised: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 . 01in CIFAR- 10 , and even earlier for Tiny-Imagenet. This is likely due to the added uncertainty in the 3.2 σ 0 .0 .0 .0 .0 .1 .

Revised: P r o p o rt i o n a) Approximate 0.

Original: 3.2 σ 
Revised: 3.2 σ b) Full

Original: [Figure]
Revised: [Figure]

Original: P r o p o rt i o n a) Approximate 0.
Revised: upon (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: b)
Revised: , (cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure] 
Revised: [Figure] (cid:58)(cid:58)(cid:58) [Figure]

Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Revised: (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Revised: (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure] 
Revised: [Figure] [Table]

Revised: we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) assign (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58)(cid:58) been (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) calculated (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original:  [Figure] 
Revised: Cohen et al. (cid:58) . [Figure] [Table]

Revised: [Table]

Original: [Figure] 
Revised: [Figure] [Figure]

Original: ce n t ag e I m p
Revised: ce [Figure] ag e I m p

Original: r
Revised: r

Original: o v e
Revised: o v e

Original: m e n t
Revised: m e n t

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: in CIFAR- 10 , and even earlier for Tiny-Imagenet.

Original: This is likely due to the added uncertainty in the

Original: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.
Revised: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.

Original: Based upon these results, the starting step size was uniformly set to 0 .
Revised: Based upon these results, the starting step size was uniformly set to 0 .

Original: 01 for allexperiments.
Revised: 01 for allexperiments.

Original: [Figure]
Revised: [Figure]