Original: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity
Revised: Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivity

Original: Anonymous Author(s)
Revised: Anonymous Author(s)

Original: AffiliationAddress email
Revised: AffiliationAddress email

Original: Abstract
Revised: Abstract

Original: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.
Revised: In response to subtle adversarial examples flipping classifications of neural networkmodels, recent research has promoted certified robustness as a solution.

Original: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.
Revised: There, invariance of predictions to all norm-bounded attacks is achieved through randomisedsmoothing of network inputs.

Original: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radiusof certification (under the L 2 norm) is possible given only these score.
Revised: Today’s state-of-the-art certifications make optimaluse of the class output scores at the input instance under test: no better radiusof certification (under the L 2 norm) is possible given only these score.

Original: However,it is an open question as to whether such lower bounds can be improved usinglocal information around the instance under test.
Revised: However,it is an open question as to whether such lower bounds can be improved usinglocal information around the instance under test.

Original: In this work, we demonstratehow today’s “optimal” certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to whatwe term Geometrically-Informed Certified Robustness .
Revised: In this work, we demonstratehow today’s “optimal” certificates can be improved by exploiting both the transitivity of certifications, and the geometry of the input space, giving rise to whatwe term Geometrically-Informed Certified Robustness .

Original: Essentially we search for,and merge with, larger certifiable balls nearby to an initial instance under test.
Revised: Essentially we search for,and merge with, larger certifiable balls nearby to an initial instance under test.

Original: Ourapproach improves certifications for more than 80% of instances in experimentswith Tiny-Imagenet, with an on average 5% increase in the associated radius ofcertification.
Revised: Ourapproach improves certifications for more than 80% of instances in experimentswith Tiny-Imagenet, with an on average 5% increase in the associated radius ofcertification.

Original:  Introduction
Revised:  Introduction

Original: Learned models, including neural networks, are well known to be susceptible having the outputchanged by crafted perturbations to an input, that preserve the inputs semantic properties [2].
Revised: Learned models, including neural networks, are well known to be susceptible having the outputchanged by crafted perturbations to an input, that preserve the inputs semantic properties [2].

Original: Neuralnetworks not only misclassify these perturbations—known as adversarial examples —but they alsoassign high confidence to these incorrect predictions.
Revised: Neuralnetworks not only misclassify these perturbations—known as adversarial examples —but they alsoassign high confidence to these incorrect predictions.

Original: These behaviours have been observed across awide range of models and datasets and appear to be a product of piecewise-linear interactions [10].
Revised: These behaviours have been observed across awide range of models and datasets and appear to be a product of piecewise-linear interactions [10].

Original: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.
Revised: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.

Original: These attacks have been applied to both black- and white-box models [24], and canbe used to target class changes, to attack all classes [7] or even introduce backdoors into modelbehaviour [4].
Revised: These attacks have been applied to both black- and white-box models [24], and canbe used to target class changes, to attack all classes [7] or even introduce backdoors into modelbehaviour [4].

Original: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).
Revised: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).

Original: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.
Revised: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.

Original: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.
Revised: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.

Original: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.
Revised: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.

Original: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.
Revised: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.

Original: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed notto be adversarial examples.
Revised: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed notto be adversarial examples.

Original: Certifications based on randomised smoothing of classifiers aroundan input point are in a sense optimal [6]: based only on the prediction class scores at the inputpoint, no better radius is in general possible.
Revised: Certifications based on randomised smoothing of classifiers aroundan input point are in a sense optimal [6]: based only on the prediction class scores at the inputpoint, no better radius is in general possible.

Original: Despite this, such certifications fail to use readily available—yet still local—information: the certifiability of points nearby to the input of interest.
Revised: Despite this, such certifications fail to use readily available—yet still local—information: the certifiability of points nearby to the input of interest.

Original: The key insight of this work is that these neighbourhood points may generate certified radii largeenough to completely enclose that of the sample point, improving the radii of certification.
Revised: The key insight of this work is that these neighbourhood points may generate certified radii largeenough to completely enclose that of the sample point, improving the radii of certification.

Original: Thisprocess can also be extended to use the intersection of the regions of certification of multiple points,and the nature of the input domain itself to generate larger certifications.
Revised: Thisprocess can also be extended to use the intersection of the regions of certification of multiple points,and the nature of the input domain itself to generate larger certifications.

Original: This leads to our maincontribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceedingthose of the hitherto best-case guaranteed approach of Cohen et al.
Revised: This leads to our maincontribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceedingthose of the hitherto best-case guaranteed approach of Cohen et al.

Original:  Background and literature review
Revised:  Background and literature review

Original: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [22, 32, 35, 36, 28].
Revised: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [22, 32, 35, 36, 28].

Original: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [27].
Revised: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [27].

Original: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [33].
Revised: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [33].

Original: While bounding mechanisms can produce valid certifications, their time and memory complexitymakes them infeasible to address complex model architectures or high-dimensional data [31].
Revised: While bounding mechanisms can produce valid certifications, their time and memory complexitymakes them infeasible to address complex model architectures or high-dimensional data [31].

Original: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [18], in which noise is applied to inputinstances to smooth model predictions, subject to a sampling distribution that is tied to the L P -normof adversarial perturbations being certified against.
Revised: Randomised smoothing Outside of bounding mechanisms, another common framework for developing certifications leverages randomised smoothing [18], in which noise is applied to inputinstances to smooth model predictions, subject to a sampling distribution that is tied to the L P -normof adversarial perturbations being certified against.

Original: In contrast to other robustness mechanisms, thisapplication of the noise is the only architectural change that is required to achieve certification.
Revised: In contrast to other robustness mechanisms, thisapplication of the noise is the only architectural change that is required to achieve certification.

Original: In thecase of L 2 -norm bounded attacks, Gaussian sampling of the form
Revised: In thecase of L 2 -norm bounded attacks, Gaussian sampling of the form

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: is employed for all test-time instances.
Revised: is employed for all test-time instances.

Original: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator
Revised: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator

Original: [Equation]
Revised: [Equation]

Original: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.
Revised: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.

Original: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.
Revised: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.

Original: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r , with recent worksalso considering rotational and/or translational semantic attacks [20, 5], although we will not beaddressing such certifications within this work.
Revised: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r , with recent worksalso considering rotational and/or translational semantic attacks [20, 5], although we will not beaddressing such certifications within this work.

Original: That such guarantees are possible was first shown [18] by way of differential privacy [8], with morerecent works using Rényi divergence [19], and parametrising worst-case behaviours [6, 26].
Revised: That such guarantees are possible was first shown [18] by way of differential privacy [8], with morerecent works using Rényi divergence [19], and parametrising worst-case behaviours [6, 26].

Original: In thispaper, we focus on the influential work of Cohen et al.
Revised: In thispaper, we focus on the influential work of Cohen et al.

Original: (2019), and their lower-bound guarantee ofclassification invariance
Revised: (2019), and their lower-bound guarantee ofclassification invariance

Original: [Equation]
Revised: [Equation]

Original: where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denote thetwo largest class expectations (of the winning class and runner-up).
Revised: where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denote thetwo largest class expectations (of the winning class and runner-up).

Original: These expectations capturethe likelihood that the arg max of a single draw under noise would return a given class, as per
Revised: These expectations capturethe likelihood that the arg max of a single draw under noise would return a given class, as per

Original: Equation (2).
Revised: Equation (2).

Original: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [6].
Revised: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [6].

Original: Prior works have been able to generate improvements to Cohen et al.
Revised: Prior works have been able to generate improvements to Cohen et al.

Original: for binary certification [23],in which it is assumed that E 1 = 1 − E 0 .
Revised: for binary certification [23],in which it is assumed that E 1 = 1 − E 0 .

Original: While any multivariate model can be mapped to a binaryoutput for the purposes of constructing a certification, artificially inflating E 1 inherently suppressesthe size of the certification, as per Equation (3).
Revised: While any multivariate model can be mapped to a binaryoutput for the purposes of constructing a certification, artificially inflating E 1 inherently suppressesthe size of the certification, as per Equation (3).

Original: In this paper we demonstrate a novel approach thatcan generate improvements to the certified robustness of multivariate classifiers.
Revised: In this paper we demonstrate a novel approach thatcan generate improvements to the certified robustness of multivariate classifiers.

Original: [Figure]
Revised: [Figure]

Original:  Geometrically-informed certified robustness
Revised:  Geometrically-informed certified robustness

Original: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [9].
Revised: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [9].

Original: Thus, constructing larger certificationsin such a context is inherently valuable.
Revised: Thus, constructing larger certificationsin such a context is inherently valuable.

Original: This specific L P space is of interest due to both its viability as a defence model, and the provableguarantee by Cohen et al.
Revised: This specific L P space is of interest due to both its viability as a defence model, and the provableguarantee by Cohen et al.

Original: that their certification technique produces the largest possible certificationfor any instance [6].
Revised: that their certification technique produces the largest possible certificationfor any instance [6].

Original: Over the remainder of this section we will document how it is possible to improveupon this provably best-case guarantee by exploiting several properties of certified robustness.
Revised: Over the remainder of this section we will document how it is possible to improveupon this provably best-case guarantee by exploiting several properties of certified robustness.

Original: 3.1 Exploiting transitivity
Revised: 3.1 Exploiting transitivity

Original: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.
Revised: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.

Original: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .
Revised: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .

Original: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.
Revised: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.

Original: Definition 3.1 ( Overlap Properties of Certification ) .
Revised: Definition 3.1 ( Overlap Properties of Certification ) .

Original:  If x 1 and x 2 have the same class associatedwith them, then the region of certification can be described in terms of two hyperspheres B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 )  , where r 1 and r 2 are respectively the radii of certification for x 1 and x 2 and BP ( x i , r i ) =
Revised: A region of certification r i about a pointx i guarantees that no point x can induce a chance in the predicted class within ∥ x − x i ∥ P ≤ r i , a 99 region that will henceforth denote as B P ( x i , r i ) . If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ∩ B P ( x 2 , r 2 ) ̸ = ∅ , then the region of certification about x 1 can be expressed 101 as B

Original: [Equation]
Revised: [Equation]

Original: When considering certification, we are often concerned not with the size of the region of classificationinvariance, but rather the distance to the nearest possible adversarial example.
Revised: When considering certification, we are often concerned not with the size of the region of classificationinvariance, but rather the distance to the nearest possible adversarial example.

Original: If it is possible to findsome x ′ such that its region of certification completely encircles that of the certification at x , thefollowing definition demonstrates that the certification radius about x can be increased.
Revised: If it is possible to findsome x ′ such that its region of certification completely encircles that of the certification at x , thefollowing definition demonstrates that the certification radius about x can be increased.

Original: Lemma 3.2 ( Set Unions Certified Radius ) .
Revised: Lemma 3.2 ( Set Unions Certified Radius ) .

Original: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance r ′ ≥ r from x 1 , where
Revised: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance r ′ ≥ r from x 1 , where

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .
Revised: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .

Original: Thus r ′ =
Revised: Thus r ′ =

Original: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).
Revised: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).

Original: As such, we can recast the task of constructing a certification from being a strictly analytic functionto the nonlinear optimisation problem
Revised: As such, we can recast the task of constructing a certification from being a strictly analytic functionto the nonlinear optimisation problem

Original: [Equation]
Revised: [Equation]

Original: with Figure 1a providing a two-dimensional representation of this process.
Revised: with Figure 1a providing a two-dimensional representation of this process.

Original: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >
Revised: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >

Original: r 1 is guaranteed to be animprovement to the certification at x 1 .
Revised: r 1 is guaranteed to be animprovement to the certification at x 1 .

Original: 3.2 Multiple transitivity
Revised: 3.2 Multiple transitivity

Original: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .
Revised: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .

Original: x n , r n } .
Revised: x n , r n } .

Original: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union of all
Revised: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union of all

Original: B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .
Revised: B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .

Original: Based upon theconstruction of S n , it follows that the radius of certification is r ′ ( n ) =
Revised: Based upon theconstruction of S n , it follows that the radius of certification is r ′ ( n ) =

Original: min s ∥ S n ( s ) − x 1 ∥ .
Revised: min s ∥ S n ( s ) − x 1 ∥ .

Original: Definition 3.3 ( Positioning of x 3 in the case of n = 3 ) .
Revised: Definition 3.3 ( Positioning of x 3 in the case of n = 3 ) .

Original: In the case where n = 2 , the closestpoint to x 1 on the boundary of B P ( x 2 , r 2 ) is located on the vector spanning between x 1 and x 2 , atdistance r ′  from x 1 .
Revised: In the case where n = 2 , the closestpoint to x 1 on the boundary of B P ( x 2 , r 2 ) is located on the vector spanning between x 1 and x 2 , at adistance r ′ (following Equation 5) from x 1 .

Original: This in turn suggests that the optimal positioning of x 3  should also  exist alongthis vector, such that
Revised: If we now introduce a third point x 3 , then to maximisethe associated certification r ′′ about x 1 it should also be true that x 3 exist along this vector, allowingits position to be expressed as

Original: [Equation]
Revised: [Equation]

Original:  If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂[Equation] x
Revised: in terms of some s ∈ [0 , 1] . If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂

Original: [Equation] 3 ,  r[Equation] 3 )  , then the optimalpositioning of x 3 must satisfy Equation (6).
Revised: B P (˜ x , ˜ r ) about some auxiliary point ˜ x , then the optimal positioning of x 3 must satisfy Equation (6).

Original: Assuming that the above definition is true allows us to significantly reduce the potential search spacefor x 3 , and gives rise to enhanced certifications as described by the  following Lemma, which alignswith the visual sketch outlined in Figure 1b.
Revised: Assuming that the above definition is true allows us to significantly reduce the potential search spacefor x 3 , and ensuring that { x 1 , x 2 , x 3 } exist upon a straight line in R d . Under this condition, thefollowing Lemma describes the certification r ′′ that results from these 3 hyperspheres, following thevisual sketch outlined in Figure 1b.

Original: Lemma 3.4 ( Certification from two Eccentric Circles ) .
Revised: Lemma 3.4 ( Certification from two Eccentric Circles ) .

Original: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form
Revised: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original: and where r 3 is the radius of certification about x 3 .
Revised: and where r 3 is the radius of certification about x 3 .

Original: Proof.
Revised: Proof.

Original: To begin with, we introduce the co-ordinate translation y = f
Revised: To begin with, we introduce the co-ordinate translation y = f

Original: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such thaty 2 ,j ̸ = 0 and y 3 ,j ̸ = 0 only when j = k for any k .
Revised: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that

Original: [Equation]
Revised: [Equation]

Original: Under this coordinate system, the intersection of the hyperspheres centred about x 2 and x 3 occurs at
Revised: Under this coordinate system, the intersection of the hyperspheres centred about x 2 and x 3 occurs at

Original: [Equation]
Revised: [Equation]

Original: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =
Revised: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =

Original: d 2 , and with the equivalent also holding for y 3 ,k .
Revised: d 2 , and with the equivalent also holding for y 3 ,k .

Original: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥
Revised: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥

Original: y ∥ and
Revised: y ∥ and

Original: [Equation]
Revised: [Equation]

Original: which is equivalent to Equation (7).
Revised: which is equivalent to Equation (7).

Original: Intuitively we can assume that this logic should extend to S n for n > 3 .
Revised: Intuitively we can assume that this logic should extend to S n for n > 3 .

Original: However, if we proceed byiteratively adding additional hyperspheres one at a time, then for n = 4 the closest point to x 1 onthe revised boundary hypersphere will a R d − 1 manifold embedded in R d .
Revised: However, if we proceed byiteratively adding additional hyperspheres one at a time, then for n = 4 the closest point to x 1 onthe revised boundary hypersphere will a R d − 1 manifold embedded in R d .

Original: This manifold cannot becovered by a single additional sphere, but rather requires an infeasible number of spheres to be addedto the boundary.
Revised: This manifold cannot becovered by a single additional sphere, but rather requires an infeasible number of spheres to be addedto the boundary.

Original: While it may be possible to construct bounding spheres for n > 3 in a fashion thatdoes not require iteratively adding one additional sphere at a time, the complexity of doing so scalesnonlinearly with the underlying dimensionality, due to both the added complexity of the search space,and the size of the manifolds that would need to be covered by the additional set of boundary spheres.
Revised: While it may be possible to construct bounding spheres for n > 3 in a fashion thatdoes not require iteratively adding one additional sphere at a time, the complexity of doing so scalesnonlinearly with the underlying dimensionality, due to both the added complexity of the search space,and the size of the manifolds that would need to be covered by the additional set of boundary spheres.

Original: 3.3 Boundary treatments
Revised: 3.3 Boundary treatments

Original: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .
Revised: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .

Original: However in the majority of cases a subset of B P ( x 1 , L 1 ) will exist outside [0 , 1] d .
Revised: However in the majority of cases a subset of B P ( x 1 , L 1 ) will exist outside [0 , 1] d .

Original: While this observation is trivially true, it has no influence on the radius of certification achievedby Equation 3 due to the symmetry of B P ( x 1 , r ) .
Revised: While this observation is trivially true, it has no influence on the radius of certification achievedby Equation 3 due to the symmetry of B P ( x 1 , r ) .

Original: However, the asymmetric nature of B P ( x 2 , r 2 )about x 1 guarantees that if B P ( x 2 , r 2 ) exceeds [0 , 1] d , then the closest point to x 1 within the feasibledomain must have an associated distance ˆ r > r ′ , as is demonstrated within Figure 1c.
Revised: However, the asymmetric nature of B P ( x 2 , r 2 )about x 1 guarantees that if B P ( x 2 , r 2 ) exceeds [0 , 1] d , then the closest point to x 1 within the feasibledomain must have an associated distance ˆ r > r ′ , as is demonstrated within Figure 1c.

Original: This allows usto make the following observation about improving the feasible radius of certification.
Revised: This allows usto make the following observation about improving the feasible radius of certification.

Original: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .
Revised: Lemma 3.5 ( Boundary Certifications by way of Eccentric Circles ) .

Original: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside thefeasible space for instances allows us to construct an updated region of certification where
Revised: The eccentricity of B P ( x 2 , L 2 )as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside thefeasible space for instances allows us to construct an updated region of certification where

Original: [Equation]
Revised: [Equation]

Original: where z k =
Revised: where z k =

Original: (cid:26)if x 1 ,k < 
Revised: (cid:26)if x 1 ,k < 0 .

Original: [Equation]

Original: if x 1 ,k > 0 .
Revised: if x 1 ,k > 0 .

Original: [Equation]
Revised: [Equation]

Original: where 1 is an indicator function acting upon its operator.
Revised: where 1 is an indicator function acting upon its operator.

Original: Proof.
Revised: Proof.

Original: In contrast to the prior proof, for this problem we retain the coordinate system of the inputspace.
Revised: In contrast to the prior proof, for this problem we retain the coordinate system of the inputspace.

Original: To support this, we introduce the notation that x n = { x n, 1 , x n, 2 , . . .
Revised: To support this, we introduce the notation that x n = { x n, 1 , x n, 2 , . . .

Original: , x n,d } .
Revised: , x n,d } .

Original: If we let 163 x k ∈ { 0 , 1 } , then the intersection between B P ( x 2 , L 2 ) and the bounding surface in dimension k 164 creates a bounding hypersphere of the form
Revised: If we let 166 x k ∈ { 0 , 1 } , then the intersection between B P ( x 2 , L 2 ) and the bounding surface in dimension k 167 creates a bounding hypersphere of the form

Original: [Equation]
Revised: [Equation]

Original: which yields an effective radius r r 2 =
Revised: which yields an effective radius r r 2 =

Original: [Equation]
Revised: [Equation]

Original: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the formˆ
Revised: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the form

Original: [Equation]
Revised: [Equation]

Original: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.
Revised: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.

Original: 3.4 Algorithms
Revised: 3.4 Algorithms

Original: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver.
Revised: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver.

Original: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.
Revised: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.

Original: To implement the multiple
Revised: To implement the multiple

Original: Algorithm
Revised: Algorithm

Original: 1: Input: data x , samples N , iterations M , true-label i 2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Algorithm` x ′ + N ` 0 , σ 2 I N , N ˘˘ 4: if j = i then 5: r ′ =
Revised: 1: Input: data x , samples N , iterations M , true-label i 2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Algorithm` x ′ + N ` 0 , σ 2 I N , N ˘˘ 4: if j = i then 5: r ′ =

Original: L 2 − ∥ x ′ − x ∥ 6: if r ′ >
Revised: L 2 − ∥ x ′ − x ∥ 6: if r ′ >

Original: r
Revised: r

Original: o
Revised: o

Original: then 7: r ′ o = r ′ 8: end if 9: x ′ = x ′ ±
Revised: then 7: r ′ o = r ′ 8: end if 9: x ′ = x ′ ±

Original: γ ∇ x ′ r ′
Revised: γ ∇ x ′ r ′

Original: ∥∇ x ′ r ′
Revised: ∥∇ x ′ r ′

Original: ∥ {Step size γ determined by Barzilai-Borwein [1].
Revised: ∥ {Step size γ determined by Barzilai-Borwein [1].

Original: Positive branch is selected if j = i , otherwise the negative branch is used to attempt to return to the region in which the predicted class matches the label.
Revised: Positive branch is selected if j = i , otherwise the negative branch is used to attempt to return to the region in which the predicted class matches the label.

Original: } 10: end if 11: end for transitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).
Revised: } 10: end if 11: end for transitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).

Original: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.
Revised: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.

Original:  Extracting gradient information from non-differentiable functions
Revised:  Extracting gradient information from non-differentiable functions

Original: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.
Revised: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.

Original: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).
Revised: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).

Original: Within this work we haveimplemented two mechanisms to circumvent these conditions.
Revised: Within this work we haveimplemented two mechanisms to circumvent these conditions.

Original: The first substitutes the arg maxoperation with a Gumbel-Softmax [12].
Revised: The first substitutes the arg maxoperation with a Gumbel-Softmax [12].

Original: In doing so, the class expectations are rendered differentiable.
Revised: In doing so, the class expectations are rendered differentiable.

Original: The second approach involves recasting the Monte-Carlo estimators as integrals of the form
Revised: The second approach involves recasting the Monte-Carlo estimators as integrals of the form

Original: [Equation]
Revised: [Equation]

Original: (14) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .
Revised: (14) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .

Original: This formalism,and the symmetry of the underlying space allows for the construction of undifferentiable gradients by
Revised: This formalism,and the symmetry of the underlying space allows for the construction of undifferentiable gradients by

Original: [Equation]
Revised: [Equation]

Original:  While this derivation is novel, the resultant gradient operator reflects those seen in prior works [26].
Revised: [Equation] While this derivation is novel, the resultant gradient operator reflects those seen in prior works [26].

Original: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [23].
Revised: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [23].

Original: The relative performance of these two approaches—respectively labelled ‘Approximate’ and ‘Full’for the above approach and the Gumbel-Softmax approaches—will be tested in the following section.
Revised: The relative performance of these two approaches—respectively labelled ‘Approximate’ and ‘Full’for the above approach and the Gumbel-Softmax approaches—will be tested in the following section.

Original: For the case of the double transitivity of Section 3.2 our experiments suggest that uncertainty in theanalytic derivatives produces deleterious results.
Revised: For the case of the double transitivity of Section 3.2 our experiments suggest that uncertainty in theanalytic derivatives produces deleterious results.

Original: As such derivatives for the multiple transitivityapproach are exclusively considered through autograd for both the Full and Approximate methods.
Revised: As such derivatives for the multiple transitivityapproach are exclusively considered through autograd for both the Full and Approximate methods.

Original: 5 R 0 .0 .0 .0 .0 .1 .
Revised: 5 R 0 .0 .0 .0 .0 .1 .

Original: C e rt
Revised: C e rt

Original: i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .
Revised: i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .b)
Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .b)

Original: CIFAR0 .0 .1 .1 .
Revised: CIFAR0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Original: .c)
Revised: .c)

Original: Tiny-Imagenet
Revised: Tiny-Imagenet

Original: Cohen σ =0 .
Revised: Cohen σ =0 .

Original: 5 Best Approx σ =0 .
Revised: 5 Best Approx σ =0 .

Original: Best Full σ =0 .
Revised: Best Full σ =0 .

Original: 5 Cohen σ =1 .
Revised: 5 Cohen σ =1 .

Original: Best Approx σ =1 . 

Revised: Best Approx σ =1 .

Original: Best Full σ =1 .
Revised: Best Full σ =1 .

Original:  Experiments
Revised:  Experiments

Original: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [17], CIFAR- 10 [15], and Tiny-Imagenet [13], thelatter of these is a 200 -class variant of Imagenet [34] which downsamples images to 3 × 60 × 60 .
Revised: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [17], CIFAR- 10 [15], and Tiny-Imagenet [13], thelatter of these is a 200 -class variant of Imagenet [34] which downsamples images to 3 × 60 × 60 .

Original: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [25], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.
Revised: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [25], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.

Original: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.
Revised: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.

Original: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.
Revised: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.

Original: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.
Revised: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.

Original: Parameter optimisation was performed with Adam [14],with the learning rate set as 0 .
Revised: Parameter optimisation was performed with Adam [14],with the learning rate set as 0 .

Original: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.
Revised: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.

Original: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .
Revised: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .

Original: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .
Revised: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .

Original: The full code to implement our experiments can be found at anonymised link .
Revised: The full code to implement our experiments can be found at anonymised link .

Original: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.
Revised: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.

Original: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.
Revised: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.

Original: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.
Revised: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.

Original: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.
Revised: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.

Original: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .
Revised: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .

Original: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.
Revised: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.

Original: This property would suggestthat samples with a larger R would exhibit a decreased difference between our techniques and thatof Cohen et al.
Revised: This property would suggestthat samples with a larger R would exhibit a decreased difference between our techniques and thatof Cohen et al.

Original: would decrease, as smaller values of E 1 provide less search information.
Revised: would decrease, as smaller values of E 1 provide less search information.

Original: However,it appears that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 } counteract the decreasedinformation provided by the second highest class, leading to the contradictory performance bestobserved in the MNIST experiments of Figure 2 at σ = 0 .
Revised: However,it appears that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 } counteract the decreasedinformation provided by the second highest class, leading to the contradictory performance bestobserved in the MNIST experiments of Figure 2 at σ = 0 .

Original: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.
Revised: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.

Original: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .
Revised: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .

Original: 5 and σ = 1 . 0 cases.
Revised: 5 and σ = 1 . 0 cases.

Original: This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information.
Revised: This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information.

Original: However, an equivalent radii for σ = 1 . 0 has significantly
Revised: However, an equivalent radii for σ = 1 . 0 has significantly

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: more information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.
Revised: more information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.

Original: That there is a clear demarcation between the
Revised: That there is a clear demarcation between the

Original: Full and Approximate solver variants reflects the uncertainties introduced by Equation (15).
Revised: Full and Approximate solver variants reflects the uncertainties introduced by Equation (15).

Original: However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach.
Revised: However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach.

Original: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .
Revised: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .

Original: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.
Revised: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.

Original: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.
Revised: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.

Original: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).
Revised: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).

Original: Numerical performance The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.
Revised: Numerical performance The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.

Original: While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.
Revised: While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.

Original: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.
Revised: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.

Original: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .
Revised: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .

Original: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.
Revised: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: Limitations While our experimental works only considered L 2 -norm bounded perturbations due tothe guarantee of best possible certification in this space provided by Cohen et al.
Revised: Limitations While our experimental works only considered L 2 -norm bounded perturbations due tothe guarantee of best possible certification in this space provided by Cohen et al.

Original: , the the principlesof our Geometrically Informed Certified Robustness are extensible to other spaces.
Revised: , the the principlesof our Geometrically Informed Certified Robustness are extensible to other spaces.

Original: However, at thisstage we have not tested the performance of this approach in other L P -norm spaces, nor across abroader range of training methods, which have been shown to be able to tighten the achievable radiusof certification [21].
Revised: However, at thisstage we have not tested the performance of this approach in other L P -norm spaces, nor across abroader range of training methods, which have been shown to be able to tighten the achievable radiusof certification [21].

Original: We also must emphasise that there is an additional computational cost involved in our numericalprocess, due to the optimisation processes requiring multiple evaluations of the Monte-Carlo expectations, which in turn each require N ≫ 10 model draws.
Revised: We also must emphasise that there is an additional computational cost involved in our numericalprocess, due to the optimisation processes requiring multiple evaluations of the Monte-Carlo expectations, which in turn each require N ≫ 10 model draws.

Original: This computational cost may be burdensomein some contexts, however we believe that the cost may be more than worth it for high-value modelsdeployed in environments considered vulnerable to adversarial attacks.
Revised: This computational cost may be burdensomein some contexts, however we believe that the cost may be more than worth it for high-value modelsdeployed in environments considered vulnerable to adversarial attacks.

Original: While our current emphasishas been on demonstrating the performance of Geometrically Informed Certified Robustness, webelieve that the computational costs can be reduced by performing the optimisation stages with
Revised: While our current emphasishas been on demonstrating the performance of Geometrically Informed Certified Robustness, webelieve that the computational costs can be reduced by performing the optimisation stages with

Original: N ′ < N model draws, and by potentially reusing model draws across the iterative process.
Revised: N ′ < N model draws, and by potentially reusing model draws across the iterative process.

Original: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3].
Revised: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3].

Original: However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour.
Revised: However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour.

Original: However, achieving this does increase the computational cost and associated energy use, however webelieve that the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.
Revised: However, achieving this does increase the computational cost and associated energy use, however webelieve that the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.

Original:  Conclusions
Revised:  Conclusions

Original: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.
Revised: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.

Original: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .
Revised: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .

Original: 5 , with the percentage increaseimproving quasi-linearly with σ .
Revised: 5 , with the percentage increaseimproving quasi-linearly with σ .

Original: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate. 
Revised: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate. Checklist For all authors...

Original: A Appendix
Revised: (a) Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? [Yes] (b) Did you describe the limitations of your work?

Revised: [Yes]

Revised: In the Limitations section of

Revised: Section

Revised: (c) Did you discuss any potential negative societal impacts of your work?

Revised: [Yes] In theLimitations section of Section 5(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?

Revised: [Yes]2.

Revised: If you are including theoretical results...

Revised: (a) Did you state the full set of assumptions of all theoretical results?

Revised: [Yes](b) Did you include complete proofs of all theoretical results?

Revised: [Yes]3.

Revised: If you ran experiments...

Revised: (a) Did you include the code, data, and instructions needed to reproduce the main experi-

Revised: mental results (either in the supplemental material or as a URL)?

Revised: [Yes] This has been

Revised: included in the supplementary materials, with license details included therein.

Revised: (b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?

Revised: [Yes] In Section 5(c) Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?

Revised: [No] As all experimental results are based upon metrics

Revised: calculated over more than 1000 samples, the size of the underlying error bars are smallenough to be negligible.

Revised: (d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?

Revised: [Yes]

Revised: In Section 54.

Revised: If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...

Revised: (a)

Revised: If your work uses existing assets, did you cite the creators?

Revised: [Yes]

Revised: (b) Did you mention the license of the assets?

Revised: [Yes] In Appendix A.1.

Revised: (c) Did you include any new assets

Revised: either in the supplemental material or as a URL?

Revised: [No](d

Revised: ) Did you discuss

Revised: whether

Revised: and

Revised: how

Revised: consent was obtained from people whose data you’re

Revised: using

Revised: /curating?

Revised: [N/A

Revised: e) Did you discuss whether the data you are using/curating contains personally identifiable

Revised: information or offensive content?

Revised: [N/A

Revised: If you

Revised: used

Revised: crowdsourcing or conducted research with human subjects...

Revised: (a) Did you include the full text of instructions given to participants and screenshots, if

Revised: applicable?

Revised: [N/A

Revised: (b) Did you describe any potential participant risks, with links to Institutional Review

Revised: Board

Revised: (IRB) approvals, if applicable?

Revised: [N/A]

Revised: (c) Did you include the estimated hourly wage paid to participants and the total amount

Revised: spent on participant compensation?

Revised: [N/A]

Revised: A Appendix

Original: A.1 Algorithmic details
Revised: A.1 Algorithmic details

Original: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.
Revised: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.

Original: Of note are two minor changes from prior implementations of this certification regime.
Revised: Of note are two minor changes from prior implementations of this certification regime.

Original: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the‘Full’ derivative approach.
Revised: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the‘Full’ derivative approach.

Original: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .
Revised: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .

Original: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .
Revised: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .

Original: Our initial testing revealed that when we employed either Sison-Glaz [29] or Goodman et al.[11] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.
Revised: Our initial testing revealed that when we employed either Sison-Glaz [29] or Goodman et al.[11] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.

Original: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .
Revised: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .

Original: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)
Revised: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)

Original: y j < 5 y j , which conforms with the requirements of
Revised: y j < 5 y j , which conforms with the requirements of

Original: Goodman et al.
Revised: Goodman et al.

Original: [11] that all class counts must be greater than 5 .
Revised: [11] that all class counts must be greater than 5 .

Original: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.
Revised: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.

Original: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.
Revised: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.

Original: MNIST exists under a GNU v 3 . 0 license;
Revised: MNIST exists under a GNU v 3 . 0 license;

Original: CIFAR-
Revised: CIFAR-

Original: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.
Revised: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.

Original: A.2 Relative performance for MNIST and CIFAR-10
Revised: A.2 Relative performance for MNIST and CIFAR-10

Original: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.
Revised: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.

Original: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .
Revised: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .

Original: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.
Revised: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.

Original: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .
Revised: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .

Original: 0but not σ = 0 .
Revised: 0but not σ = 0 .

Original: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.
Revised: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.

Original: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of the
Revised: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of the

Original: [Figure]
Revised: [Figure]

Original: be seen in
Revised: be seen in

Original: [Figure]
Revised: [Figure]

Original: relative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-
Revised: relative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-

Original: 10when
Revised: 10when

Original: σ = 0 .
Revised: σ = 0 .

Original: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,
Revised: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,

Original: MNIST again reveals interesting properties when we consider Figure 10.
Revised: MNIST again reveals interesting properties when we consider Figure 10.

Original: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.
Revised: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.

Original: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solvermay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.
Revised: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solvermay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.

Original: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .
Revised: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .

Original: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.
Revised: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.

Original: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in
Revised: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in

Original: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.
Revised: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.

Original: to be improvedupon in low semantic complexity datasets is smaller.
Revised: to be improvedupon in low semantic complexity datasets is smaller.

Original: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.
Revised: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: P r o p o rt i o n a) Approximate 0.
Revised: P r o p o rt i o n a) Approximate 0.

Original: [Figure]
Revised: [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: to Cohen et al
Revised: to Cohen et al

Original: σ
Revised: σ

Original: M
Revised: M

Original: [Figure]
Revised: [Figure]

Original: i a n
Revised: i a n

Original: [Figure]
Revised: [Figure]

Original:  ce n t ag e I m p
Revised: r ce n t ag e I m p

Original: r
Revised: r

Original: o v e
Revised: o v e

Original: m e n t
Revised: m e n t

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: A.3 Influence of the starting step size
Revised: A.3 Influence of the starting step size

Original: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.
Revised: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.

Original: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .
Revised: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .

Original: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 .
Revised: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 .

Original: 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.
Revised: 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.

Original: This is likely due to the added uncertainty in the
Revised: This is likely due to the added uncertainty in the

Original: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.
Revised: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.

Original: Based upon these results, the starting step size was uniformly set to 0 .
Revised: Based upon these results, the starting step size was uniformly set to 0 .

Original: 01 for allexperiments.
Revised: 01 for allexperiments.

Original: [Figure]
Revised: [Figure]

Original: A
Revised: A

Original: Abstract
Revised: Abstract

Original: In response to subtle adversarial examples flipping classifications of neural network models, recentresearch has promoted certified robustness as a solution.
Revised: In response to subtle adversarial examples flipping classifications of neural network models, recentresearch has promoted certified robustness as a solution.

Original: There, invariance of predictions to allnorm-bounded attacks is achieved through randomised smoothing of network inputs.
Revised: There, invariance of predictions to allnorm-bounded attacks is achieved through randomised smoothing of network inputs.

Original: Today’s stateof-the-art certifications make optimal use of the class output scores at the input instance under test:no better radius of certification (under the L 2 norm) is possible given only these score.
Revised: Today’s stateof-the-art certifications make optimal use of the class output scores at the input instance under test:no better radius of certification (under the L 2 norm) is possible given only these score.

Original: However,it is an open question as to whether such lower bounds can be improved using local informationaround the instance under test.
Revised: However,it is an open question as to whether such lower bounds can be improved using local informationaround the instance under test.

Original: In this work, we demonstrate how today’s “optimal” certificates canbe improved by exploiting both the transitivity of certifications, and the geometry of the input space,giving rise to what we term Geometrically-Informed Certified Robustness .
Revised: In this work, we demonstrate how today’s “optimal” certificates canbe improved by exploiting both the transitivity of certifications, and the geometry of the input space,giving rise to what we term Geometrically-Informed Certified Robustness .

Original: Essentially we searchfor, and merge with, larger certifiable balls nearby to an initial instance under test.
Revised: Essentially we searchfor, and merge with, larger certifiable balls nearby to an initial instance under test.

Original: Our approachimproves certifications for more than 80% of instances in experiments with Tiny-Imagenet, with anon average 5% increase in the associated radius of certification.
Revised: Our approachimproves certifications for more than 80% of instances in experiments with Tiny-Imagenet, with anon average 5% increase in the associated radius of certification.

Original: B Introduction
Revised: B Introduction

Original: [Figure] Learned models, including neural networks, are well known to be susceptible to crafted perturbationsinducing changes in a model’s output without changing semantic properties of the input [2].
Revised: Learned models, including neural networks, are well known to be susceptible to crafted perturbationsinducing changes in a model’s output without changing semantic properties of the input [2].

Original: Concerningly neural (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) output (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) changed (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) crafted (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: Concerningly neural (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) output (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) changed (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) crafted (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: networks not only misclassify these perturbations—known
Revised: networks not only misclassify these perturbations—known

Original: [Table]
Revised: [Table]

Original: as adversarial examples —but they also assign high confidence to these incorrect predictions.
Revised: as adversarial examples —but they also assign high confidence to these incorrect predictions.

Original: These
Revised: These

Original: [Table]
Revised: [Table]

Original: behaviours have been observed across a wide range of models and datasets, and appear to be a product
Revised: behaviours have been observed across a wide range of models and datasets, and appear to be a product

Original: [Table]
Revised: [Table]

Original: of piecewise-linear interactions within neural networks [10].
Revised: of piecewise-linear interactions within neural networks [10].

Original: [Table] Crafting these adversarial examples typically involves gradient-based optimisation to construct small [Table] perturbations.
Revised: Crafting these adversarial examples typically involves gradient-based optimisation to construct smallperturbations.

Original: These attacks have been applied to both black- and white-box models [24][Table] and can
Revised: These attacks have been applied to both black- and white-box models [24]

Original: [Table]
Revised: [Table]

Original: be used to target class changes, to attack all classes [7]
Revised: and canbe used to target class changes, to attack all classes [7]

Original: [Table]
Revised: [Table]

Original: or even introduce backdoors into model [Table] behaviour [4].
Revised: or even introduce backdoors into modelbehaviour [4].

Original: To mitigate the influence of these attacks, defences have typically been designed [Table] to minimise the effect of a specific attack (or attacks).
Revised: To mitigate the influence of these attacks, defences have typically been designedto minimise the effect of a specific attack (or attacks).

Original: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.
Revised: Such defences are known as best responsestrategies in a Stackelberg security game where the defender leads the attacker.

Original: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.
Revised: Best response defencesinherently favour the attacker, as deployed mitigations can be defeated by identifying undefendedattack frameworks.

Original: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.
Revised: Moreover, the defender typically has to incorporate the defence at training time,and as such cannot response reactively to newly developed attacks.

Original: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.
Revised: In an attempt to circumvent these limitations, certified guarantees of adversarial robustness can beconstructed, to identify class-constant regions around an input instance.

Original: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed not to beadversarial examples.
Revised: Irrespective of the attack,all instances within a certain distance from an input (typically L 2 distance) are guaranteed not to beadversarial examples.

Original: Certifications based on randomised smoothing of classifiers around an inputpoint are in a sense optimal [6]: based only on the prediction class scores at the input point, no betterradius is in general possible.
Revised: Certifications based on randomised smoothing of classifiers around an inputpoint are in a sense optimal [6]: based only on the prediction class scores at the input point, no betterradius is in general possible.

Original: Despite this, such certifications fail to use readily available—yet stilllocal—information: the certifiability of points nearby to the input of interest.
Revised: Despite this, such certifications fail to use readily available—yet stilllocal—information: the certifiability of points nearby to the input of interest.

Original: The key insight of thiswork is that these neighbourhood points may generate certified radii large enough that we may enlargethe certified region based solely on classifier information at the initial point (cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) completely (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enclose(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sample (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improving (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) radii (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.
Revised: The key insight of thiswork is that these neighbourhood points may generate certified radii large enough that we may enlargethe certified region based solely on classifier information at the initial point (cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) completely (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) enclose(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sample (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improving (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) radii (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.

Original: This process is not just limited to a 526 single neighbouring point either, as we can also (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) extended (cid:58)(cid:58) to use the intersection of the 527 regions of certification of multiple points, and the nature of the input domain itself to generate largercertifications.
Revised: This process is not just limited to a 529 single neighbouring point either, as we can also (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) extended (cid:58)(cid:58) to use the intersection of the 530 regions of certification of multiple points, and the nature of the input domain itself to generate largercertifications.

Original: This leads to our main contribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceeding those of the hitherto best-case guaranteed approach of Cohen etal.
Revised: This leads to our main contribution— Geometrically-Informed Certified Robustness —that enjoys certifications exceeding those of the hitherto best-case guaranteed approach of Cohen etal.

Original: C Background and literature review
Revised: C Background and literature review

Original: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [22, 32, 35, 36, 28].
Revised: Bounding mechanisms An alternate perspective on bounding the impact of norm-bounded perturbations has been to construct conservative bounds on the output of a model [22, 32, 35, 36, 28].

Original: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [27].
Revised: Framed as convex relaxation, these techniques utilise linear relaxation to construct bounding polytopes of a model’s outputs over input bounded perturbations [27].

Original: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [33].
Revised: These approaches have beenleveraged by adopting augmented loss functions during training, to promote tight output bounds [33].

Original: While bounding mechanisms can produce valid certifications
Revised: While bounding mechanisms can produce valid certifications

Original: [Table]
Revised: [Table]

Original: their time and memory complexity
Revised: their time and memory complexity

Original: [Table]
Revised: [Table]

Original: makes them infeasible to address complex model architectures or high-dimensional data [31].
Revised: makes them infeasible to address complex model architectures or high-dimensional data [31].

Original: [Table]
Revised: [Table]

Original: Randomised smoothing Outside of bounding mechanisms
Revised: Randomised smoothing Outside of bounding mechanisms

Original: [Table]
Revised: [Table]

Original: another common framework for de-
Revised: another common framework for de-

Original: [Table]
Revised: [Table]

Original: veloping certifications leverages randomised smoothing [18]
Revised: veloping certifications leverages randomised smoothing [18]

Original: [Table]
Revised: [Table]

Original: in which noise is applied to input
Revised: in which noise is applied to input

Original: [Table]
Revised: [Table]

Original: instances to smooth model predictions.
Revised: instances to smooth model predictions.

Original: In contrast to other robustness mechanisms [Table] randomised
Revised: In contrast to other robustness mechanisms, randomised

Original: [Table]
Revised: [Table]

Original: smoothing only requires minimal changes to a classifier, specifically the repeated sampling of
Revised: smoothing only requires minimal changes to a classifier, specifically the repeated sampling of

Original: [Table]
Revised: [Table]

Original: noise-based perturbation of the inputs, where the choice of sampling distribution
Revised: noise-based perturbation of the inputs, where the choice of sampling distribution

Original: [Table]
Revised: [Table]

Original: [Table]

Original: a

Original: [Table]
Revised: [Table]

Original: is tied to the L P -norm of adversarial perturbations being certified against.
Revised: is tied to the L P -norm of adversarial perturbations being certified against.

Original: [Table]

Original: In

Original: [Table]
Revised: [Table]

Original: this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) application (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) noise (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)

Original: the

Original: [Table]

Original: only

Original: [Table]

Original: architectural

Original: [Table]

Original: (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) required (cid:58)(cid:58)

Original: to

Original: [Table]

Original: achieve (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification.

Original: (cid:58)(cid:58)

Original: In (cid:58) the

Original: [Table]

Original: of L

Original: [Table]

Original: bounded

Original: [Table]

Original: , Gaussian

Original: [Table]

Original: sampling of the

Original: [Table]

Original: [Equation]
Revised: [Equation]

Original: where y i i.i.d.
Revised: where y i i.i.d.

Original: [Equation]
Revised: [Equation]

Original: 16) is employed for all

Original: [Table]
Revised: [Table]

Original: -time instances.
Revised: -time instances.

Original: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator
Revised: These N samples are then used to estimate the expectedoutput of the predicted class of x by way of the Monte-Carlo estimator

Original: [Equation]
Revised: [Equation]

Original: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.
Revised: While this Monte Carlo estimation of output expectations under randomised smoothing is a test-timeprocess, model sensitivity to random perturbations may be decreased by performing adversarialtraining on such random perturbations.

Original: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.
Revised: To mitigate the computational expense of large N samplesizes during each training update, training typically employs single draws from the noise distribution.

Original: [Table] Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r .Certified robustness has [Table]
Revised: Smoothing-based certifications Based on randomised smoothing, certified robustness can guarantee classification invariance for additive perturbations up to some L p -norm r .

Original: not, however, extended to rotational or translational modifications [30], nor functional attacks [16] (cid:58) ,[Table] with [Table]
Revised: Certified robustness hasnot, however, extended to rotational or translational modifications [30], nor functional attacks [16] (cid:58) ,

Original: recent

Original: [Table]

Original: works

Original: [Table]
Revised: [Table]

Original:  also (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considering (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) rotational [Table] and/or 
Revised: with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) recent (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) works (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considering (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) rotational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) and/or (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: That such guarantees are possible was first shown [18] by way of differential privacy [8], with morerecent works using Rényi divergence [19]
Revised: That such guarantees are possible was first shown [18] by way of differential privacy [8], with morerecent works using Rényi divergence [19]

Original: [Table]
Revised: [Table]

Original: and parametrising worst-case behaviours [6, 26].
Revised: and parametrising worst-case behaviours [6, 26].

Original: In thispaper, we focus on the influential work of Cohen et al.
Revised: In thispaper, we focus on the influential work of Cohen et al.

Original: [Table]
Revised: [Table]

Original: and their lower-bound guarantee ofclassification invariance
Revised: and their lower-bound guarantee ofclassification invariance

Original: [Equation]
Revised: [Equation]

Original: [Equation] where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denotethe two largest class expectations (of the winning class and runner (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) runner-up).
Revised: (18) where Φ − 1 is the inverse normal CDF (the Gaussian quantile function), and E 0 and E 1 denotethe two largest class expectations (of the winning class and runner (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) runner-up).

Original: These expectationscapture the likelihood that the arg max of a single draw under noise would return a given class, asper Equation (2).
Revised: These expectationscapture the likelihood that the arg max of a single draw under noise would return a given class, asper Equation (2).

Original: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [6].
Revised: By parameterising the worst-case behaviour, their work purports to be the largestachievable pointwise certification for any given instance [6].

Original: Prior works have been able to generate improvements to Cohen et al.
Revised: Prior works have been able to generate improvements to Cohen et al.

Original: for binomial classifiers (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) binary(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification [23], in which it is assumed that E 1 = 1 − E 0 .
Revised: for binomial classifiers (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) binary(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification [23], in which it is assumed that E 1 = 1 − E 0 .

Original: While any multivariate model can bemapped to a binary output for the purposes of constructing a certification, artificially inflating E 1inherently suppresses the size of the certification, as per Equation (3).
Revised: While any multivariate model can bemapped to a binary output for the purposes of constructing a certification, artificially inflating E 1inherently suppresses the size of the certification, as per Equation (3).

Original: In this paper we demonstrate anovel approach that can generate improvements to the certified robustness of multivariate classifiers.
Revised: In this paper we demonstrate anovel approach that can generate improvements to the certified robustness of multivariate classifiers.

Original: D Geometrically-informed certified robustness
Revised: D Geometrically-informed certified robustness

Original: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [9].
Revised: While the work contained within this paper can be applied generally, for this work we will focusupon certifications of robustness about L 2 -norm bounded adversarial perturbations, for which weassume that the difficulty of attacking a model is proportional to the size of the certification, basedupon the need to evade both human and machine scrutiny [9].

Original: Thus, constructing larger certificationsin such a context is inherently valuable.
Revised: Thus, constructing larger certificationsin such a context is inherently valuable.

Original: This specific L P space is of interest due to both its viability as a defence model, and the existence ofa guarantee of adversarial robustness that is provably as large as can be
Revised: This specific L P space is of interest due to both its viability as a defence model, and the existence ofa guarantee of adversarial robustness that is provably as large as can be

Original: [Table]
Revised: [Table]

Original: guarantee

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Table]
Revised: [Table]

Original: for any 582 instance [6].
Revised: for any 585 instance [6].

Original: Over the remainder of this section we will document how it is possible to improve uponthis provably best-case guarantee by exploiting several properties of certified robustness.
Revised: Over the remainder of this section we will document how it is possible to improve uponthis provably best-case guarantee by exploiting several properties of certified robustness.

Original: D.1 Exploiting transitivity
Revised: D.1 Exploiting transitivity

Original: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.
Revised: While it is provably true that Equation (3) is the largest achievable certification for any point x , it ispossible to exploit the behaviour of points in the neighbourhood of x in order to enhance certifiableradius.

Original: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .
Revised: To achieve this, consider the case of a second point x ′ , that exists within the certifiable radiiof x .

Original: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.
Revised: As both points must correspond to the same class, it then follows that the union of their regionsof certification can be also be considered as a region of certification, leading to Definition 3.1.

Original: Definition D.1 ( Overlap Properties of Certification ) .
Revised: Definition D.1 ( Overlap Properties of Certification ) .

Original: If x 1 and x 2 have the same class associated with them, then the region  of  certification can be described as (cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) terms (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) two (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hyperspheres
Revised: (cid:58)(cid:58) A (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) region (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) r i [Table]

Revised: about

Original: B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) , where r 1 and r 2 are respectively the radii of certification for x 1 and x 2(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: [Table] a [Table] point

Original: [Equation]
Revised: [Table] [Table]

Revised: henceforth (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) denote (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x i , r i ) .

Revised: (cid:58)

Revised: If x 1 and x 2 have the same class associatedwith them (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 1 , r 1 ) ∩ B P ( x 2 , r 2 ) ̸

Revised: = ∅ , then the region of certification can be described (cid:58)(cid:58)(cid:58)(cid:58) about(cid:58)(cid:58) x 1 (cid:58)(cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) expressed (cid:58) as B P ( x 1 , r 1 ) ∪ B P ( x 2 , r 2 ) , where r 1 and r 2 are respectively the radii of 598 certification for x 1 and x 2 .

Original:  However, when (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) When (cid:58) considering certification, we are often concerned not with the size of theregion of classification invariance, but rather the distance to the nearest possible adversarial example.
Revised: (cid:58) . However, when (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) When (cid:58) considering certification, we are often concerned not with the size of theregion of classification invariance, but rather the distance to the nearest possible adversarial example.

Original: If it is possible to find some x ′ such that its region of certification completely encircles that of thecertification at x , the following definition demonstrates that the certification radius (cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58) x can beincreasedby way of Equation .
Revised: If it is possible to find some x ′ such that its region of certification completely encircles that of thecertification at x , the following definition demonstrates that the certification radius (cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58) x can beincreasedby way of Equation .

Original: Lemma D.2 ( Set Unions Certified Radius ) .
Revised: Lemma D.2 ( Set Unions Certified Radius ) .

Original: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance of
Revised: If x 1 and x 2 have the same class associated withthem and B P ( x 1 , r 1 ) ⊂ B P ( x 2 , r 2 ) , then the nearest possible adversarial example—and thus, thecertifiable radius—exists at a distance of

Original: [Equation]
Revised: [Equation]

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) r ′ ≥ r (cid:58) from x 1 , where r ′ ≥ r 1 .[Equation] ∥ x 2 − x
Revised: r ′ ≥ r (cid:58) from x 1 , where r ′ ≥ r 1 .

Original: [Equation]
Revised: [Equation]

Original: P , (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) (19)

Original: Proof.
Revised: Proof.

Original: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .
Revised: The closest point on the surface of B P ( x 2 , r 2 ) to x 1 must exist on the vector between x 1 andx 2 .

Original: Thus r ′ =
Revised: Thus r ′ =

Original: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).
Revised: min p r 2 ± ∥ x 2 − x 1 ∥ P q , which takes the form of Equation (4).

Original: As such, we can recast the certification problem (cid:58)(cid:58)(cid:58)(cid:58) task (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) constructing (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58) from being astrictly analytic function , to the nonlinear optimisation problem
Revised: As such, we can recast the certification problem (cid:58)(cid:58)(cid:58)(cid:58) task (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) constructing (cid:58)(cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58) from being a

Original: [Equation]
Revised: [Equation]

Original: (20) with Figure 1a providing a two-dimensional representation of this process.
Revised: with Figure 1a providing a two-dimensional representation of this process.

Original: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >
Revised: Crucially, the aboveformalism does not require obtaining a global optima, as any r ′ >

Original: r 1 is guaranteed to be animprovement to the certification at x 1 .
Revised: r 1 is guaranteed to be animprovement to the certification at x 1 .

Original: D.2 Multiple transitivity
Revised: D.2 Multiple transitivity

Original: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .
Revised: The concept of transitivity can be further enhanced by considering the set { x 1 , r 1 , x 2 , r 2 , . . .

Original: x n , r n } .
Revised: x n , r n } .

Original: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union ofall B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .
Revised: If x j ∈ B P ( x 1 , r 1 ) for all j > 1 , then the overall region of certification is now the the union ofall B P ( x i , r i ) , the exterior boundary of which we describe as S n ( s ) , where s ∈ R d − 1 .

Original: Basedupon the construction of S n , it follows that the radius of certification is r n =
Revised: Basedupon the construction of S n , it follows that the radius of certification is r n =

Original: min s ∥ S n ( s ) − x 1 ∥ .
Revised: min s ∥ S n ( s ) − x 1 ∥ .

Original: [Table]
Revised: [Table]

Original:  Definition D.3 ( Positioning of x 3 in the case of n = 3 ) .
Revised: [Equation] [Table] Definition D.3 ( Positioning of x 3 in the case of n = 3 ) .

Original: In the case where n = 3 , let us considertwo points x 3 and x ′ 3 , where 
Revised: In the case where n = 3 , let us considertwo points x 3 and x ′ 3 , where (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) n = 2 , (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest [Table] point [Table]

Revised: to

Original: [Table]
Revised: [Table]

Revised: x

Revised: [Table]

Revised: on

Revised: [Table]

Revised: the

Revised: [Table]

Revised: boundary

Revised: [Table]

Revised: of

Revised: [Table]

Revised: B P

Revised: [Table]

Original: boundary (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 2 , r 2 ) (cid:58)(cid:58) is (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: x 2 , [Table] 2 ) (cid:58)(cid:58) is [Table]

Revised: located

Revised: [Table]

Revised: on

Revised: [Table]

Revised: Equation (cid:58)(cid:58)(cid:58) 5)

Revised: [Table]

Original: located(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) vector (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) spanning (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) between (cid:58)(cid:58)(cid:58) x 1  (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) x 2 ,(cid:58)(cid:58)(cid:58) at (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) distance (cid:58)(cid:58) r ′ (cid:58)(cid:58)(cid:58)(cid:58) from (cid:58)(cid:58)(cid:58)(cid:58) x 1 .
Revised: from (cid:58)(cid:58)(cid:58) x 1 . (cid:58)(cid:58)(cid:58) If (cid:58)(cid:58) we(cid:58)(cid:58)(cid:58) now (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) introduce (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58) third (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58)(cid:58) x 3 , (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) maximise (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) associated [Table]

Revised: certification (cid:58)(cid:58) r ′′

Revised: [Table]

Original: (cid:58)(cid:58)(cid:58)(cid:58)
Revised: about (cid:58)(cid:58)(cid:58) x [Table] it

Original: This (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58) turn (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) suggests (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) optimal (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) positioning (cid:58)(cid:58) of (cid:58)(cid:58) x 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) should (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) along (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) vector, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) such (cid:58)(cid:58)(cid:58) 
Revised: [Table] should(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58) true (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) x 3 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) along (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) vector, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) allowing (cid:58)(cid:58)(cid:58) its (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) position (cid:58)(cid:58) to (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) expressed (cid:58)(cid:58)(cid:58) as [Equation] [Equation]

Original: that (cid:58)
Revised: ∥

Original: [Equation]
Revised: [Equation]

Revised: ., (21) (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) terms (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) some (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) s ∈ [0 , 1] .

Revised: (cid:58)(cid:58)(cid:58)

Original: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ B P ( x ′ 3 , r ′ 3 ) , then the optimalpositioning of x 3 must satisfy Equation (6).
Revised: If no pair of certification hyperspheres exists such that B P ( x 3 , r 3 ) ⊂ B P ( x ′ 3 , r ′ 3 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Revised: B P ( x 3 , r 3 ) ⊂ B P (˜ x , ˜ r ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58)(cid:58)(cid:58) some (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) auxiliary (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58)

Revised: ˜ x , then the optimalpositioning of x 3 must satisfy Equation (6).

Original: Assuming that the above definition is true allows us to define a new certification using (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) significantly(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: Assuming that the above definition is true allows us to define a new certification using (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) significantly [Table] reduce [Table]

Revised: the

Original: [Table]
Revised: [Table]

Original: described
Revised: potential [Table] search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) space (cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) x 3 , (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ensuring (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) { x 1 , x 2 , x 3 } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58) upon (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) straight (cid:58)(cid:58)(cid:58) line (cid:58)(cid:58) in(cid:58)(cid:58)(cid:58) R d . (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Under (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) condition, (cid:58) the following Lemma , which aligns with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) describes (cid:58)(cid:58)(cid:58) the

Original: [Table]
Revised: [Table]

Original: by the 624 following Lemma, which aligns with the visual sketch outlined in Figure 1b
Revised: the visual sketch outlined in Figure 1b.

Original: [Table]
Revised: [Table]

Original: Lemma D.4 ( Certification from two Eccentric Circles ) .
Revised: Lemma D.4 ( Certification from two Eccentric Circles ) .

Original: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form
Revised: In the case of where two additionaleccentric circles are used to construct a bounding region about x 1 , Definition 3.3 allows us todemonstrate that the largest achievable radii of certification takes the form

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation]
Revised: [Equation]

Original:  and where r 3 is the radius of certification about x 3 .
Revised: (22) and where r 3 is the radius of certification about x 3 .

Original: Proof.
Revised: Proof.

Original: To begin with, we introduce the co-ordinate translation y = f
Revised: To begin with, we introduce the co-ordinate translation y = f

Original: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that
Revised: ( x − x 1 ) , subject to a strictlyrotational mapping f ( x ) that allows us to state that the j -th components of y 2 and y 3 in this spaceare defined such that

Original: [Equation]
Revised: [Equation]

Original:  and y [Equation] ̸ = 0 only when j =k for any k
Revised: 0 and y 3 ,j ̸ =onlywhen ∀ (cid:58) j =

Original: [Equation] [Equation]
Revised: ̸ =

Original: In these coordinates (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Under (cid:58)(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) coordinate (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) system,(cid:58) the intersection of the hyperspheres centred about633 x 2 and x 3 occurs at
Revised: k , for some (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) k . (23)In these coordinates (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Under (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) coordinate (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) system, the intersection of the hyperspheres centred about x 2 and x 3 occurs at

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =
Revised: This is possible as our chosen mapping preserve distances under rotation, giving that y 2 ,k =∥ x 2 − x 1 ∥ =

Original: d 2 , and with the equivalent also holding for y 3 ,k .
Revised: d 2 , and with the equivalent also holding for y 3 ,k .

Original: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥
Revised: As the instance is the origin of our new coordinate system, it follows that r ′′ = ∥

Original: y ∥ and
Revised: y ∥ and

Original: [Equation]
Revised: [Equation]

Original: which is equivalent to Equation (7).
Revised: which is equivalent to Equation (7).

Original: Intuitively we can assume that this logic should extend to S n for n > 3 .
Revised: Intuitively we can assume that this logic should extend to S n for n > 3 .

Original: However, while the [Table] nearest point from x 1 on S 3 is a point, if we consider x i 
Revised: However, while thenearest point from x 1 on S 3 is a point, if we consider x i (cid:58) if (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) proceed (cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) iteratively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) adding(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) additional (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) hyperspheres (cid:58)(cid:58)(cid:58)(cid:58) one (cid:58)(cid:58) at (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) time, (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58) for i ≤ 3 are fixed, then the nearest point to x 1 is nolonger a point

Original: [Table]
Revised: [Table]

Original: for i ≤ 3 are fixed, then the nearest point to x 1 is no
Revised: but a surface in R d − 1 . Thus, finding additional hyperspheres that completely coverthis

Original: [Table]
Revised: [Table]

Original: longer a point
Revised: n =

Original: [Table]
Revised: [Table]

Original: but a surface in R d − 1 . Thus, finding additional hyperspheres that completely cover
Revised: the

Original: [Table]
Revised: [Table]

Original: surfaces is
Revised: closest [Table] to [Table]

Revised: x

Original: [Table]
Revised: [Table]

Revised: on

Original: non-trivial.
Revised: [Table] will [Table] surfaces isnon-trivial.

Original: Similarly
Revised: Similarly

Original: [Table]
Revised: [Table]

Original: any other arrangement of bounding hyperspheres 
Revised: any other arrangement of bounding hyperspheres (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [Table] embedded

Original: [Table]
Revised: [Table]

Original: be
Revised: in

Revised: [Table]

Revised: R

Revised: [Table]

Original: [Table]
Revised: [Table]

Original:  so scales nonlinearly with the intrinsic dimensionalityof the space, 
Revised: require (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) iteratively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) adding (cid:58)(cid:58)(cid:58) one (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) additional (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) sphere (cid:58)(cid:58) at (cid:58) a(cid:58)(cid:58)(cid:58)(cid:58) time, (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) complexity (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) doing (cid:58)(cid:58)(cid:58) so scales nonlinearly with the intrinsic dimensionalityof the space, 656 resulting in exponential growth in the number of hyperspheres that (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) underlying (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) dimensionality, (cid:58)(cid:58)(cid:58) due [Table] to

Original: [Table]
Revised: [Table]

Original: resulting in exponential growth in the number of hyperspheres that 
Revised: need to be 658 solved for, and thus, in the overall computational cost. This effectively imposes that it is infeasibleto solve for any S n where n >

Original: [Table]
Revised: [Table]

Original: infeasible
Revised: additional

Original: [Table]
Revised: [Table]

Original: spheres.
Revised: spheres.

Original: D.3 Boundary treatments
Revised: D.3 Boundary treatments

Original: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .
Revised: Without loss of performance or accuracy, we can freely scale the inputs of neural networks suchthat x 1 ∈ [0 , 1] d .

Original: However , for (cid:58)(cid:58) in the majority of certifications, (cid:58)(cid:58)(cid:58)(cid:58) cases (cid:58) a subset of B P ( x 1 , L 1 ) willbe outside the feasible domain for x 1 (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) outside (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d .
Revised: However , for (cid:58)(cid:58) in the majority of certifications, (cid:58)(cid:58)(cid:58)(cid:58) cases (cid:58) a subset of B P ( x 1 , L 1 ) willbe outside the feasible domain for x 1 (cid:58)(cid:58)(cid:58)(cid:58) exist (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) outside (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d .

Original: While this observation is trivially true, weare unable to leverage it to improve the size of the certification , as the distance from B P ( x 1 , L 1 ) toany point of intersection with { 0 , 1 } d will still be of length L 1 away from x 1 .
Revised: While this observation is trivially true, weare unable to leverage it to improve the size of the certification , as the distance from B P ( x 1 , L 1 ) toany point of intersection with { 0 , 1 } d will still be of length L 1 away from x 1 .

Original: This property also holds for the intersection of B P ( x 2 , L 2 ) with the bounds of the feasible space (cid:58) it(cid:58)(cid:58)(cid:58) has (cid:58)(cid:58) no (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58)the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [Table] [Table] , as
Revised: This property also holds for the intersection of B P ( x 2 , L 2 ) with the bounds of the feasible space (cid:58) it(cid:58)(cid:58)(cid:58) has (cid:58)(cid:58) no (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]

Original: distance

Original: [Table]

Original: x 1 to

Original: [Table]

Original: B P ( x 2 , L 2 )

Original: [Table]

Original: the

Original: [Table]

Original: space is larger than

Original: [Table]
Revised: [Table]

Original: x [Table] guarantees (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) if(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exceeds (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d ,
Revised: of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) about (cid:58)(cid:58)(cid:58) x 1 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) guarantees (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58) if(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]

Original:  then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58) to (cid:58) x 1 to the boundary of the hypersphere aboutx [Table] within [Table]
Revised: B P ( x 2 , r 2 ) (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) exceeds (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [0 , 1] d , (cid:58)(cid:58)(cid:58)(cid:58) then (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) closest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) point (cid:58)(cid:58) to (cid:58) x 1 to the boundary of the hypersphere aboutx 2 (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) within (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: the

Original: [Table]

Original: feasible

Original: [Table]

Original: domain

Original: [Table]

Original: must

Original: [Table]

Original: have

Original: [Table]

Original: an

Original: [Table]
Revised: [Table]

Original: associated (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) distance (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: ˆ r > r ′ , as is demonstrated within 664 Figure 1c.
Revised: ′ , as is demonstrated within 672 Figure 1c.

Original: This allows us to make the following observation about improving the feasible radius ofcertification.
Revised: This allows us to make the following observation about improving the feasible radius ofcertification.

Original: Lemma D.5 ( Boundary Certifications by way of Eccentric Circles ) .
Revised: Lemma D.5 ( Boundary Certifications by way of Eccentric Circles ) .

Original: The eccentricity of
Revised: The eccentricity of

Original: B P ( x 2 , L 2 ) as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside the feasible space for instances allows us to construct an updated region of certificationwhere
Revised: B P ( x 2 , L 2 ) as a bounding region about x 1 , and the potential for a subset of B P ( x 2 , L 2 ) to exist outside the feasible space for instances allows us to construct an updated region of certificationwhere

Original: [Equation]
Revised: [Equation]

Original: where z k =
Revised: where z k =

Original: (cid:26)if x 1 ,k < 0 .
Revised: (cid:26)if x 1 ,k < 0 .

Original: if x 1 ,k > 0 .
Revised: if x [Equation] > 0 .

Original: 5 , where 1 is an indicator function acting upon its operator.
Revised: 5 , where 1 is an indicator function acting upon its operator.

Original: Proof.
Revised: Proof.

Original: In contrast to the prior proof, for this problem we retain the coordinate systemof the input space.
Revised: In contrast to the prior proof, for this problem we retain the coordinate systemof the input space.

Original: To support this, we introduce the notation that x n is defined as as
Revised: To support this, we introduce the notation that x n is defined as as{ x 1 ,n , x 2 ,n , . . .

Original: [Equation]

Original:  x n = { x n, 1 , x n, 2 , . . . , x n,d } .If we let x k ∈ { 0 , 1 } , then the intersectionbetween B P ( x 2 , L 2 ) and the bounding surface in dimension k creates a bounding hypersphere of theform [Equation]
Revised: , x d,n } (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) x n = { x n, 1 , x n, 2 , . . . , x n,d } .

Original: [Equation] which yields an effective radius r r 2 = [Equation]
Revised: If we let x k ∈ { 0 , 1 } , then the intersection

Original: 1: Input: data x , samples N , iterations M , true-label i , cutoff c , multiplicative Lagrange multiplier scaling factor λ , penalty parameter Γ ≫2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Model `
Revised: 1: Input: data x , samples N , iterations M , true-label i , cutoff c , multiplicative Lagrange multiplier scaling factor λ , penalty parameter Γ ≫2: for 1 to M do 3: q E 0 , p E 1 , L 2 , j = Model `

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: ˘˘
Revised: ˘˘

Original: [Table]
Revised: [Table]

Original: j = Algorithm` x ′ + N ` 0 , σ 2 I N , N ˘˘ (cid:58)
Revised: j = Algorithm` x ′ + N ` 0 , σ 2 I N , N ˘˘ (cid:58)

Original: [Table]
Revised: [Table]

Original: : if j = i then
Revised: : if j = i then

Original: [Table] [Table]
Revised: [Table] [Table]

Original: : if r ′ > r ′
Revised: : if r ′ > r ′

Original: o
Revised: o

Original: then 7: r
Revised: then 7: r

Original: [Table]
Revised: [Table]

Original: = r ′ 8: end if 9:
Revised: = r ′ 8: end if 9:

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original: [Table]
Revised: [Table]

Original: {Step size γ determined by
Revised: {Step size γ determined by

Original: Barzilai-Borwein [1].
Revised: Barzilai-Borwein [1].

Original: Positive branch is selected if j = i , otherwise the negative branch is used to attempt to return to the region in which the predicted class matches the label.
Revised: Positive branch is selected if j = i , otherwise the negative branch is used to attempt to return to the region in which the predicted class matches the label.

Original: } 10: end if 11: end for 
Revised: } 10: end if 11: end for between B P ( x 2 , L 2 ) and the bounding surface in dimension k creates a bounding hypersphere of theform [Equation] 27) which yields an effective radius r r 2 = [Equation]

Original: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the form
Revised: By denoting the projection of x 1 and x 2 onto the bounding hyperplane in the k -th dimension as Ă x 1and Ă x 2 , then the distance from x 1 to Equation (12) must take the form

Original: [Equation]
Revised: [Equation]

Original: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.
Revised: By imposing that z k = 1 when the k -th component of x 1 is greater than 0 . 5 , and 0 otherwise, itfollows that max k ∈{ 0 , 1 ,...,d } z k must be an improved radii of certification.

Original: D.4 Algorithms
Revised: D.4 Algorithms

Original: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver.
Revised: To demonstrate how the above certification approaches can be applied in practice, Algorithm 1demonstrates the application of Equation (4) through a simple, gradient based solver.

Original: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.
Revised: Such a solver ishighly applicable for solving such problems, due to the inherent smoothing nature of randomisedsmoothing being applicable both to the function space and its derivatives.

Original: To implement the multipletransitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).
Revised: To implement the multipletransitivity based approach of Section 3.2, Algorithm 1 can trivially be adapted to evaluate derivativeswith respect to Equation (7).

Original: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.
Revised: The boundary treatment of Section 3.3 does not require any additionalcalculations, but instead is simply the result of applying Equation (11) to the output of Algorithm 1.

Original: E Extracting gradient information from non-differentiable functions
Revised: E Extracting gradient information from non-differentiable functions

Original: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.
Revised: Implementing the aformentioned process requires the ability to evaluate the gradient of the classexpectations.

Original: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).
Revised: This is problematic, as each class expectation is described in terms of a finite sumof non-differentiable indicator functions, as is seen in Equation (2).

Original: Within this work we haveimplemented two mechanisms to circumvent these conditions.
Revised: Within this work we haveimplemented two mechanisms to circumvent these conditions.

Original: The first substitutes the arg maxoperation with a Gumbel-Softmax [12].
Revised: The first substitutes the arg maxoperation with a Gumbel-Softmax [12].

Original: In doing so, the class expectations are rendered differentiable.
Revised: In doing so, the class expectations are rendered differentiable.

Original: The second approach involves recasting the Monte-Carlo estimators as integrals of the form
Revised: The second approach involves recasting the Monte-Carlo estimators as integrals of the form

Original: [Equation]
Revised: [Equation]

Original: [Equation] [Equation] where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .
Revised: (29) where ω ( y , x ) is the multivariate-Normal probability distribution centred around x .

Original: From thisformalism, (cid:58)(cid:58)(cid:58)(cid:58)
Revised: From thisformalism, (cid:58)(cid:58)(cid:58)(cid:58)

Original: This (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) formalism, (cid:58)(cid:58)(cid:58) and (cid:58) the symmetry of the underlying space allows gradient free derivatives of ∇ x E to be calculated by way of
Revised: This (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) formalism, (cid:58)(cid:58)(cid:58) and (cid:58) the symmetry of the underlying space allows gradient free derivatives of ∇ x E to be calculated by way of

Original: [Table]
Revised: [Table]

Original: for
Revised: for

Original: [Table]
Revised: [Table]

Original: the
Revised: the

Original: [Table]
Revised: [Table]

Original: construction
Revised: construction

Original: [Table]
Revised: [Table]

Original: of

Original: [Table]

Original: by
Revised: by

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [26].
Revised: While this derivation is novel, the resultant gradient operator reflects those seen in prior works [26].

Original: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [23].
Revised: Itis important to note that such a sampling process is inherently noisy, and it has previously suggestedthat the underlying uncertainty scales with the input dimensionality [23].

Original: To explore the (cid:58)(cid:58)(cid:58)(cid:58)
Revised: To explore the (cid:58)(cid:58)(cid:58)(cid:58)

Original: The relative performance of these two approaches, both of these approacheswill be tested in the following section, with the Gumbel-Softmax based approach labelled as‘Full’ , and the above gradients as ‘ (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approaches—respectively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) labelled (cid:58)(cid:58) ‘Approximate’ , whichwill be used to consider the transitivity approach of Section 3.1 under the label ‘Single’, and theboundary consideration of Section 3.3 as ‘Boundary’ (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ‘Full’ (cid:58)(cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) above (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approach (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) 
Revised: The relative performance of these two approaches, both of these approacheswill be tested in the following section, with the Gumbel-Softmax based approach labelled as‘Full’ , and the above gradients as ‘ (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approaches—respectively (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) labelled (cid:58)(cid:58) ‘Approximate’ , whichwill be used to consider the transitivity approach of Section 3.1 under the label ‘Single’, and theboundary consideration of Section 3.3 as ‘Boundary’ (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) ‘Full’ (cid:58)(cid:58)(cid:58)(cid:58) for (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) above (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) approach (cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) [Table]

Original: [Table]
Revised: [Table]

Revised: be

Original: [Table]
Revised: [Table]

Original: section.
Revised: section.

Original: For the case of the dou- [Table] ble transitivity of Section 3.2 our experiments suggest that uncertainty in the analytic derivativesproduces deleterious results.
Revised: For the case of the dou- 716 ble transitivity of Section 3.2 our experiments suggest that uncertainty in the analytic derivativesproduces deleterious results.

Original: As such derivatives for the multiple transitivity approach are exclusivelyconsidered through autograd for both the Full and Approximate methods.
Revised: As such derivatives for the multiple transitivity approach are exclusivelyconsidered through autograd for both the Full and Approximate methods.

Original: F Experiments
Revised: F Experiments

Original: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [17], CIFAR- 10 [15], and Tiny-Imagenet [13], thelatter of these is a 200 -class variant of Imagenet [34] which downsamples images to 3 × 60 × 60 .
Revised: Configuration To evaluate the performance of our proposed certification improvements, we considered the certified radius produced for MNIST [17], CIFAR- 10 [15], and Tiny-Imagenet [13], thelatter of these is a 200 -class variant of Imagenet [34] which downsamples images to 3 × 60 × 60 .

Original: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [25], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.
Revised: Alldatasets were modelled using the Resnet 18 architecture in PyTorch [25], with Tiny-Imagenet alsoutilising 2 D adaptive average pooling.

Original: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.
Revised: For both MNIST and CIFAR- 10 , our experimentation utiliseda single NVIDIA P 100 GPU core with 12 GB of GPU RAM, with expectations estimated over 1500samples.

Original: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.
Revised: Training employed Cross Entropy loss with a batch size of 128 over 50 epochs.

Original: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.
Revised: Each epochinvolved every training example was perturbed with a single perturbation drawn from N (0 , σ 2 ) ,which was added prior to normalisation.

Original: Parameter optimisation was performed with Adam [14],with the learning rate set as 0 .
Revised: Parameter optimisation was performed with Adam [14],with the learning rate set as 0 .

Original: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.
Revised: Tiny-Imagenet training and evaluation utilised 3 P 100 GPU’s andutilised 1000 samples.

Original: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .
Revised: Training occurred using SGD over 80 epochs, with a starting learning rate of0 .

Original: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .
Revised: 1 , decreasing by a factor of 10 after 30 and 60 epochs, and momentum set to 0 .

Original: The full code to implement our experiments can be found at anonymised link .
Revised: The full code to implement our experiments can be found at anonymised link .

Original: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.
Revised: Certified accuracy To explore the performance advantage provided by our technique, we beginby considering the performance of Cohen et al.

Original: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.
Revised: against the best of our approaches using both theapproximate and full derivatives, as seen in Figure 2.

Original: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.
Revised: While there are only minor differences betweenthe two derivative approaches, there are clear regions of out performance relative to Cohen across alltested datasets.

Original: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.
Revised: The proportion of this increase appears to be tied to the semantic complexity of theunderlying dataset, with decreases in predictive accuracy (visible at R = 0 ) appearing to elicit greaterpercentage changes in the achieved certification radii, as evidenced by the results for Tiny-Imagenet.

Original: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .
Revised: Semantic complexity drives a decrease in the overall confidence of models, inducing a decrease inthe separation between the highest class expectations E 0 and E 1 .

Original: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.
Revised: While this process shrinks theachievable certification radii, a higher E 1 provides more information to inform our gradient basedsearch process, allowing for the identification of larger certifications.

Original: This property would suggest thatas (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) samples (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) larger R is increased, the difference in the certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) would (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: This property would suggest thatas (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) samples (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58) a (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) larger R is increased, the difference in the certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) would (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: decreased(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) difference (cid:58) between our techniques and that of Cohen et al.
Revised: decreased(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) difference (cid:58) between our techniques and that of Cohen et al.

Original: would decrease, as smaller values of E 1provide less information for the search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) information.
Revised: would decrease, as smaller values of E 1provide less information for the search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) search (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) information.

Original: However, the very opposite appears to
Revised: However, the very opposite appears to

Original: 5 R 0 .0 .0 .0 .0 .1 .
Revised: 5 R 0 .0 .0 .0 .0 .1 .

Original: C e rt
Revised: C e rt

Original: i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .
Revised: i ﬁ e d P r o p o rt i o n a) MNIST 0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .b)
Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .b)

Original: CIFAR0 .0 .1 .1 .
Revised: CIFAR0 .0 .1 .1 .

Original: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Revised: 5 R 0 .0 .0 .0 .0 .0 .0 .0 .

Original: .c)
Revised: .c)

Original: Tiny-Imagenet
Revised: Tiny-Imagenet

Original: Cohen σ =0 .
Revised: Cohen σ =0 .

Original: 5 Best Approx σ =0 .
Revised: 5 Best Approx σ =0 .

Original: Best Full σ =0 .
Revised: Best Full σ =0 .

Original: 5 Cohen σ =1 .
Revised: 5 Cohen σ =1 .

Original: Best Approx σ =1 . 

Revised: Best Approx σ =1 .

Original: Best Full σ =1 .
Revised: Best Full σ =1 .

Original: occur, a property that is particularly visible in the MNIST experiments of Figure 2 at σ = 0 .
Revised: occur, a property that is particularly visible in the MNIST experiments of Figure 2 at σ = 0 .

Original: Thisappears to be a product of the (cid:58) it (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) appears (cid:58)(cid:58)(cid:58)(cid:58) that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 }, which counteracts (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) counteract the decreased information provided by the second highest class.
Revised: Thisappears to be a product of the (cid:58) it (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) appears (cid:58)(cid:58)(cid:58)(cid:58) that singularities in the derivatives of Φ − 1 [ E ] as E → { 0 , 1 }, which counteracts (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) counteract the decreased information provided by the second highest class.

Original: (cid:58) ,(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58) ,(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: leading (cid:58)(cid:58)
Revised: leading (cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.
Revised: Rather than strictly considering the best performing of the Approximate and Full solvers, we can alsodelve into the relative performance of the underlying solvers.

Original: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .
Revised: Notably there is a moderate increase inthe average percentage improvement of Figure 3 between the σ = 0 .

Original: 5 and σ = 1 . 0 cases.
Revised: 5 and σ = 1 . 0 cases.

Original: This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information.
Revised: This wouldappear to belie our previous statement regarding larger certifications yielding smaller improvements,due to the asymmetry of class information.

Original: However, an equivalent radii for σ = 1 . 0 has significantlymore information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.
Revised: However, an equivalent radii for σ = 1 . 0 has significantlymore information about the second class (due to the multiplicative influence of σ ) , allowing forgreater improvements from our gradient based search.

Original: That there is a clear demarcation between the
Revised: That there is a clear demarcation between the

Original: Full and Approximate solver variants reflects the uncertainties introduced by Equation (15).
Revised: Full and Approximate solver variants reflects the uncertainties introduced by Equation (15).

Original: However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach.
Revised: However,that the approximate technique is still applicable verifies the utility of our approach even when thefinal layer is a strict arg max function, rather than our Gumbel-Softmax based approach.

Original: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .
Revised: The trends in performance across σ are further explored in Figures 4 and 5, the latter of whichdemonstrates that the median performance improvement increases quasi-linearly with σ .

Original: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.
Revised: This isdriven by both an increase in the performance of the certifications themselves, and in the number ofinstances able to be certified in an improved fashion.

Original: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.
Revised: This later property stems from the smoothinginfluence of σ , with larger levels of added noise inducing decreases in the difference betweenthe highest class expectations, improving the ability for our search based mechanisms to identifyperformance improvements.

Original: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).
Revised: Here increases in the performance of the boundary treatment arecorrelated with larger radii of certification, due to the multiplicative influence of σ upon Equation (3).

Original: Numerical performance
Revised: Numerical performance

Original: The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.
Revised: The numerical optimisation process at the core of our certification processinherently induces increases in the computational cost of finding these improved certifications, asshown in Table 1.

Original: While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.
Revised: While analytically approximating the derivatives for the first eccentric hypersphereyields lower Certified Proportions, the fact that the corresponding computational cost decreases by afactor of more than 4 emphasises the value of this approach.

Original: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.
Revised: Interestingly, while the Approximatemethod does also utilise auto-differentiation for the Double variant, the increase in computationalcost from the Single to Double variants is significantly higher than for the Actual approach.

Original: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .
Revised: This issurprising, as the Approx variant derives smaller values of r ′ , which should in turn lead to a smaller,easier to navigate search space for r ′′ .

Original: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.
Revised: Instead it counter-intuitively appears that a smaller r ′ inducesa search space for r ′′ which is less convex, and more difficult to converge upon.

Original: Limitations While our focus was on (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) experimental (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) works (cid:58)(cid:58)(cid:58)(cid:58) only (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considered L 2 -norm bounded perturbations was driven by the Cohen (cid:58)(cid:58) due (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) the (cid:58) guarantee of best possible certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) in(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) space (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provided (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: Limitations While our focus was on (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) experimental (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) works (cid:58)(cid:58)(cid:58)(cid:58) only (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) considered L 2 -norm bounded perturbations was driven by the Cohen (cid:58)(cid:58) due (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) the (cid:58) guarantee of best possible certifications (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58) in(cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) space (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) provided (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Cohen et al.
Revised: Cohen et al.

Original: , the the principles of our Geometrically Informed Certified Ro-
Revised: , the the principles of our Geometrically Informed Certified Ro-

Original: [Figure]
Revised: [Figure]

Original: current (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) value.
Revised: current (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) value.

Original: Equiva- lent figures for MNIST and CIFAR- 10 are found in Appendix A.
Revised: Equiva- lent figures for MNIST and CIFAR- 10 are found in Appendix A.

Original: [Figure]
Revised: [Figure]

Original: ties Cohen et al.
Revised: ties Cohen et al.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: bustness are extensible to other spaces.
Revised: bustness are extensible to other spaces.

Original: However, as with prior certification approaches we have onlyconsidered bounded perturbations without extending to translations, rotations, or other functionalattacks (cid:58) at (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) stage (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58)(cid:58)(cid:58)[Table]
Revised: However, as with prior certification approaches we have onlyconsidered bounded perturbations without extending to translations, rotations, or other functionalattacks (cid:58) at (cid:58)(cid:58)(cid:58) this (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) stage (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: which (cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58)(cid:58)(cid:58) been (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) shown (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58) able (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) tighten (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)
Revised: which (cid:58)(cid:58)(cid:58)(cid:58) have (cid:58)(cid:58)(cid:58)(cid:58) been (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) shown (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58) able (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) tighten (cid:58)(cid:58)(cid:58) the(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) achievable (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) radius (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58)(cid:58)

Original: [21].(cid:58)(cid:58)(cid:58) We (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) emphasise (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)
Revised: [21].(cid:58)(cid:58)(cid:58) We (cid:58)(cid:58)(cid:58)(cid:58) also (cid:58)(cid:58)(cid:58)(cid:58) must (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) emphasise (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: [Table] [Table] be [Table]
Revised: computational (cid:58)(cid:58)(cid:58)(cid:58) cost (cid:58)(cid:58)(cid:58)(cid:58) may (cid:58)(cid:58) be(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) burdensome (cid:58)(cid:58) in (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) some (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) contexts, (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) however (cid:58)(cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) believe (cid:58)(cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) cost (cid:58)(cid:58)(cid:58)(cid:58)

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: may (cid:58)(cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) more (cid:58)(cid:58)(cid:58)(cid:58) than (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) worth (cid:58) it (cid:58)(cid:58)(cid:58)(cid:58) for

Original: [Table]
Revised: [Table]

Original: been (cid:58)(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) demonstrating (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) performance (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Geometrically (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Informed (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Certified(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: been (cid:58)(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) demonstrating (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) performance (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Geometrically (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Informed (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) Certified(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Robustness, (cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) believe (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) computational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) costs (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) reduced (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) performing (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) optimisation(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) stages (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) N ′ <
Revised: Robustness, (cid:58)(cid:58) we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) believe (cid:58)(cid:58)(cid:58) that (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) computational (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) costs (cid:58)(cid:58)(cid:58) can (cid:58)(cid:58) be (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) reduced (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) performing (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) optimisation(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) stages (cid:58)(cid:58)(cid:58)(cid:58) with (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) N ′ <

Original: N (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) model (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) draws, (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) potentially (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) reusing (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: N (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) model (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) draws, (cid:58)(cid:58)(cid:58)(cid:58) and (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) potentially (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) reusing (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Table]
Revised: [Table]

Original: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3].
Revised: Finally we note that the generation of guarantees of certified robustness have the potential to counterbeneficial applications of adversarial attacks, such as those used to promote stylometric privacy [3].

Original: However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour.
Revised: However, we believe that these drawbacks are significantly outweighed by the advantage of beingable to understand the behaviour of models for which incentives exist for adversarial behaviour.

Original: However, achieving this does increase the computational cost and associated energy use, however webelieve that the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.
Revised: However, achieving this does increase the computational cost and associated energy use, however webelieve that the increased computational cost is not intractable, especially when these techniques areincorporated into human-in-the-loop certification systems.

Original: G Conclusions
Revised: G Conclusions

Original: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.
Revised: This work has presented mechanisms that can be exploited to improve achievable levels of certifiedrobustness, based upon exploiting underlying geometric properties of robust neural networks.

Original: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .
Revised: In doingso our Geometrically Informed Certified Robustness approach has been able to generate certificationsthat exceed prior guarantees by on average more than 5% at σ = 0 .

Original: 5 , with the percentage increaseimproving quasi-linearly with σ .
Revised: 5 , with the percentage increaseimproving quasi-linearly with σ .

Original: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate.
Revised: Being able to improve upon the size of these guarantees inherentlyincreases the cost of constructing adversarial attacks against systems leveraging machine learning,especially in the case where the attacker has no ability to observe the size of the robustness certificate.

Original: H
Revised: H

Original: Appendix
Revised: Appendix

Original: H.1 Algorithmic details
Revised: H.1 Algorithmic details

Original: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.
Revised: Algorithm 2 supports Algorithm 1 by demonstrating how the class prediction and expectations arecalculated.

Original: Of note are two minor changes from prior implementations of this certification regime.
Revised: Of note are two minor changes from prior implementations of this certification regime.

Original: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the
Revised: The first is the addition of the Gumbel-Softmax on line 4 , although this step is only required for the

Original: ‘Full’ derivative approach.
Revised: ‘Full’ derivative approach.

Original: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .
Revised: In contrast th ‘Approximate’ techniques able to circumvent this limitationand can be applied directly to the case where the class election is determined by an arg max .

Original: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .
Revised: The second difference to prior works is the calculation of the lower and upper bounds on z 0 and z 1 online 8 .

Original: Our initial testing revealed that when we employed either Sison-Glaz [29] or Goodman et al.[11] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.
Revised: Our initial testing revealed that when we employed either Sison-Glaz [29] or Goodman et al.[11] to estimate the multivariate class uncertainties, some Tiny-Imagenet samples devoted more than95% of their computational time of the process to evaluating the confidence intervals, significantlyoutweighing even the costly process of model sampling.

Original: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .
Revised: Further investigation revealed that this wasoccurring when there were a significant number of classes reporting counts of approximately 0 , thelikelihood for which was higher in Tiny-Imagenet due to the increased class count relative to MNISTand CIFAR- 10 .

Original: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)
Revised: To resolve this, we coalesced all classes where y j < 5 into one single meta-classwith an associated class-count y ′ = max(5 , (cid:80)

Original: y j < 5 y j , which conforms with the requirements of
Revised: y j < 5 y j , which conforms with the requirements of

Original: Goodman et al.
Revised: Goodman et al.

Original: [11] that all class counts must be greater than 5 .
Revised: [11] that all class counts must be greater than 5 .

Original: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.
Revised: Our testing demonstrated that whilethis process slightly decreased the resulting radii of certification (due to small changes in z 0 and z 1 ),the associated decrease in computational time was significant enough to justify this modification.

Original: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.
Revised: We also note that all the experiments contained within this work have been conducted againstpublically releaed datasets with established licenses.

Original: MNIST exists under a GNU v 3 . 0 license;
Revised: MNIST exists under a GNU v 3 . 0 license;

Original: CIFAR-
Revised: CIFAR-

Original: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.
Revised: 10 employs a MIT license; and Imagenet employs a BSD 3 − Clause license.

Original: H.2 Relative performance for MNIST and CIFAR-10
Revised: H.2 Relative performance for MNIST and CIFAR-10

Original: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.
Revised: While Figure 2 presents the best performing certified proportion, it is important to understand therelative performance of the Single Transitivity, Double Transitivity, and Boundary treatments, in asimilar fashion to Figures 3 and 4.

Original: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .
Revised: In the case of MNIST, while the percentage increases exhibitedin Figure 6 as r 1 → 1 are broadly similar to their Tiny-Imagenet counterpart for the Approximatesolver, the difference between those results and the Full derivative treatment is significantly smaller,especially at σ = 1 .

Original: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.
Revised: This may, in part, be driven by the 1500 samples employed when using MNISTand CIFAR- 10 , in contrast to 1000 for Tiny-Imagenet, which should decrease the uncertainty of thegradient estimation steps.

Original: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .
Revised: However, the fact that this decreased difference in performance holds for CIFAR- 10 at σ = 1 .

Original: 0but not σ = 0 .
Revised: 0but not σ = 0 .

Original: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.
Revised: 5 suggests that the performance difference between the techniques is also dependentupon the semantic complexity of the prediction task.

Original: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of therelative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-
Revised: While CIFAR- 10 is a more complex predictiveenvironment than MNIST, which should increase the complexity of the gradient based search routineemployed within this work, the increased level of noise at σ = 1 . 0 has a smoothing influence thatdecreases the complexity of the search task, and it would appear that this is the primary driver of therelative under performance of the Approximate derivatives in both Tiny-Imagenet and CIFAR-

Original: 10when
Revised: 10when

Original: σ = 0 .
Revised: σ = 0 .

Original: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,
Revised: When considering the median percentage improvement (relative to Cohen et al. ) of these techniques,

Original: MNIST again reveals interesting properties when we consider Figure 10.
Revised: MNIST again reveals interesting properties when we consider Figure 10.

Original: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.
Revised: When compared to CIFAR10 and Tiny-Imagenet (in Figures 11 and 5) it becomes apparent that the Approximate approachonly produces consistently larger certifications in MNIST.

Original: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solver
Revised: Given the increased uncertainty in thederivatives calculated by the Approximate technique, this would suggest that the approximate solver

Original: r± 0 .
Revised: r± 0 .

Original: A v e r ag e
Revised: A v e r ag e

Original: P
Revised: P

Original: e r ce n t ag e I m
Revised: e r ce n t ag e I m

Original: p
Revised: p

Original: r
Revised: r

Original: o v e
Revised: o v e

Original: m e n t a)
Revised: m e n t a)

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: current (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) value, (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) explore (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) size (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) radii (cid:58)(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) average (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improvement.
Revised: current (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) value, (cid:58)(cid:58) to (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) explore (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) influence (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) size (cid:58)(cid:58) of (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58) radii (cid:58)(cid:58)(cid:58) on (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) average (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) improvement.

Original: Equivalent figures for Tiny-Imagenet can be seen in Figure
Revised: Equivalent figures for Tiny-Imagenet can be seen in Figure

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: improvement.
Revised: improvement.

Original: Equivalent figures for Tiny-Imagenet can be seen in Figuremay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.
Revised: Equivalent figures for Tiny-Imagenet can be seen in Figuremay be improved by considering common improvements to gradient descent methods like momentumor the addition of calibrated noise.

Original: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .
Revised: While MNIST may be the simplest of all the prediction tasks, Figure 8 demonstrates that at lowσ < 0 .

Original: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.
Revised: 5 the majority of samples cannot be improved upon by any of the certification enhancementsdeveloped within this paper.

Original: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in
Revised: Given that this does not hold for CIFAR- 10 nor Tiny-Imagenet (in

Original: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.
Revised: Figure 9 and 4 respectively) this would suggest that the potential for Cohen et al.

Original: to be improvedupon in low semantic complexity datasets is smaller.
Revised: to be improvedupon in low semantic complexity datasets is smaller.

Original: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.
Revised: That this behaviour is predominantly seen forsmall σ also suggests that our initial step size may be too large in these particular cases.

Original: H.3 Influence of the starting step size
Revised: H.3 Influence of the starting step size

Original: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.
Revised: The one heretofore un-considered feature is the influence of the initial step-size γ within Algorithm 1.

Original: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .
Revised: As is shown in Figures 12 and 13, while the Full solver only exhibits sensitivity to γ when γ > 0 .

Original: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 .
Revised: 1 , theapproximate solvers are far more sensitive, with deleterious performance being observed for γ > 0 .

Original: 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.
Revised: 01in CIFAR- 10 , and even earlier for Tiny-Imagenet.

Original: This is likely due to the added uncertainty in the
Revised: This is likely due to the added uncertainty in the

Original: 3.2 σ 0 .0 .0 .0 .0 .1 .
Revised: 3.2 σ 0 .0 .0 .0 .0 .1 .

Original: P r o p o rt i o n a) Approximate 0.
Revised: P r o p o rt i o n a) Approximate 0.

Original: 3.2 σ b) Full
Revised: 3.2 σ b) Full

Original: [Figure]
Revised: [Figure]

Original: upon (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)
Revised: upon (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: , (cid:58)(cid:58)(cid:58)
Revised: , (cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) assign (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58)(cid:58) been (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) calculated (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)
Revised: we (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) assign (cid:58)(cid:58)(cid:58) the (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) largest (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) certification (cid:58)(cid:58)(cid:58) as (cid:58)(cid:58)(cid:58)(cid:58)(cid:58) having (cid:58)(cid:58)(cid:58)(cid:58) been (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58) calculated (cid:58)(cid:58)(cid:58) by (cid:58)(cid:58)(cid:58)(cid:58)(cid:58)(cid:58)

Original: Cohen et al.
Revised: Cohen et al.

Original: (cid:58) .
Revised: (cid:58) .

Original: [Figure]
Revised: [Figure]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: ce
Revised: ce

Original: [Figure]
Revised: [Figure]

Original: ag e I m p
Revised: ag e I m p

Original: r
Revised: r

Original: o v e
Revised: o v e

Original: m e n t
Revised: m e n t

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.
Revised: Approximate derivatives leading to convergence upon local sub-optima in the more semanticallycomplex datasets.

Original: Based upon these results, the starting step size was uniformly set to 0 .
Revised: Based upon these results, the starting step size was uniformly set to 0 .

Original: 01 for allexperiments.
Revised: 01 for allexperiments.

Original: [Figure]
Revised: [Figure]