Original: Invariance-Aware Randomized Smoothing Certificates
Revised: Invariance-Aware Randomized Smoothing Certificates

Original: Abstract
Revised: Abstract

Original: Building models that comply with the invariances inherent to different domains, such as invariance under translation or rotation, is a key aspect of applying machine learning to real world problems like molecular property prediction, medical imaging, protein folding or LiDAR classification.
Revised: Building models that comply with the invariances inherent to different domains, such as invariance under translation or rotation, is a key aspect of applying machine learning to real world problems like molecular property prediction, medical imaging, protein folding or LiDAR classification.

Original: For the first time, we study how the invariances of a model can be leveraged to provably guarantee the robustness of its predictions.
Revised: For the first time, we study how the invariances of a model can be leveraged to provably guarantee the robustness of its predictions.

Original: We propose a gray-box approach, enhancing the powerful black-box randomized smoothing technique with white-box knowledge about invariances.
Revised: We propose a gray-box approach, enhancing the powerful black-box randomized smoothing technique with white-box knowledge about invariances.

Original: First, we develop gray-box certificates based on group orbits, which can be applied to arbitrary models with invariance under permutation and Euclidean isometries.
Revised: First, we develop gray-box certificates based on group orbits, which can be applied to arbitrary models with invariance under permutation and Euclidean isometries.

Original: Then, we derive provably tight gray-box certificates.
Revised: Then, we derive provably tight gray-box certificates.

Original: We experimentally demonstrate that the provably tight certificates can offer much stronger guarantees, but that in practical scenarios the orbit-based method is a good approximation.
Revised: We experimentally demonstrate that the provably tight certificates can offer much stronger guarantees, but that in practical scenarios the orbit-based method is a good approximation.

Original:  Introduction
Revised:  Introduction

Original: It is well-established that machine learning models are susceptible to adversarial attacks [1–4].
Revised: It is well-established that machine learning models are susceptible to adversarial attacks [1–4].

Original: Even without malevolent actors, adversarial attacks can be considered worst case scenarios in environments with noisy, erroneous or otherwise corrupted data, thus necessitating robust machine learning methods.
Revised: Even without malevolent actors, adversarial attacks can be considered worst case scenarios in environments with noisy, erroneous or otherwise corrupted data, thus necessitating robust machine learning methods.

Original: Invariance is a central design principle that has so far received little dedicated attention in the realm of adversarially robust machine learning.
Revised: Invariance is a central design principle that has so far received little dedicated attention in the realm of adversarially robust machine learning.

Original: Over the past decades, there has been ongoing research into developing machine learning models that comply with the invariances inherent to different data types and tasks.
Revised: Over the past decades, there has been ongoing research into developing machine learning models that comply with the invariances inherent to different data types and tasks.

Original: Prominent recent examples include Deep Sets [5], PointNet [6], Group Equivariant
Revised: Prominent recent examples include Deep Sets [5], PointNet [6], Group Equivariant

Original: CNNs [7], Spherical CNNs [8] and Graph Convolutional Networks [9] but the study of invariant models significantly precedes the surge in popularity of deep learning methods [10–15].
Revised: CNNs [7], Spherical CNNs [8] and Graph Convolutional Networks [9] but the study of invariant models significantly precedes the surge in popularity of deep learning methods [10–15].

Original: For the first time we explore the following question: Can a-priori knowledge about invariances be leveraged in deriving provable guarantees for a model’s robustness to adversarial attacks?
Revised: For the first time we explore the following question: Can a-priori knowledge about invariances be leveraged in deriving provable guarantees for a model’s robustness to adversarial attacks?

Original: Going by a loose categorization of prior work, we could adopt one of two possible approaches for our exploration: A white-box or black-box one.
Revised: Going by a loose categorization of prior work, we could adopt one of two possible approaches for our exploration: A white-box or black-box one.

Original: White-box certificates (e.g. [16–23]) analyze a model’s internals, such at its weights and non-linearities, to provably guarantee that a prediction does not change under adversarial attack.
Revised: White-box certificates (e.g. [16–23]) analyze a model’s internals, such at its weights and non-linearities, to provably guarantee that a prediction does not change under adversarial attack.

Original: Black box certificates – specifically randomized smoothing [24–26] – use statistical methods to provide provable guarantees that hold for all models sharing the same prediction probabilities under a random input distribution, irrespective of their internals.
Revised: Black box certificates – specifically randomized smoothing [24–26] – use statistical methods to provide provable guarantees that hold for all models sharing the same prediction probabilities under a random input distribution, irrespective of their internals.

Original: We opt for a randomized smoothing approach, as it allows us to focus on the interplay between invariances and robustness, rather than the specific means of implementing these invariances.
Revised: We opt for a randomized smoothing approach, as it allows us to focus on the interplay between invariances and robustness, rather than the specific means of implementing these invariances.

Original: By combining white-box knowledge about invariances with black-box knowledge about prediction probabilities we obtain gray-box certificates.
Revised: By combining white-box knowledge about invariances with black-box knowledge about prediction probabilities we obtain gray-box certificates.

Original: We first derive a gray-box certificate that follows a post-processing paradigm: It takes an existing black-box certificate and augments the certified region using information about the model’s invariances.
Revised: We first derive a gray-box certificate that follows a post-processing paradigm: It takes an existing black-box certificate and augments the certified region using information about the model’s invariances.

Original: This orbit-based certificate serves as a baseline for the provably tight gray-box certificates we derive in subsequent sections.
Revised: This orbit-based certificate serves as a baseline for the provably tight gray-box certificates we derive in subsequent sections.

Original: For our exploration, we focus on models operating on spatial data, rather than structured data (e.g. images and sequences) – both because spatial symmetries can be elegantly formalized using algebraic concepts and because there is an ongoing trend towards using machine learning for real-world applications with inherent spatial invariances, e.g. molecular property prediction [27–34], LiDAR classification [35–38], drug discovery [39–41], particle physics [42–44] and protein folding [45–49].
Revised: For our exploration, we focus on models operating on spatial data, rather than structured data (e.g. images and sequences) – both because spatial symmetries can be elegantly formalized using algebraic concepts and because there is an ongoing trend towards using machine learning for real-world applications with inherent spatial invariances, e.g. molecular property prediction [27–34], LiDAR classification [35–38], drug discovery [39–41], particle physics [42–44] and protein folding [45–49].

Original: Our main contributions are
Revised: Our main contributions are

Original: • the first study on the interplay of invariance and certifiable robustness, • a principled method for deriving tight invariance-aware randomized smoothing certificates, • tight certificates for models invariant to translations and rotations.
Revised: • the first study on the interplay of invariance and certifiable robustness, • a principled method for deriving tight invariance-aware randomized smoothing certificates, • tight certificates for models invariant to translations and rotations.

Original: We further demonstrate experimentally that the orbit-based certificates offer a good approximation of our tight certificates, if the variance of the smoothing distribution is small.
Revised: We further demonstrate experimentally that the orbit-based certificates offer a good approximation of our tight certificates, if the variance of the smoothing distribution is small.

Original:  Related work
Revised:  Related work

Original: Invariant machine learning.
Revised: Invariant machine learning.

Original: Given the diversity of approaches to invariant machine learning, and the fact that our approach is model-agnostic, we refrain from attempting a survey and instead refer to [50] for a principled, high-level introduction into the realm of learning with invariances and equivariances.
Revised: Given the diversity of approaches to invariant machine learning, and the fact that our approach is model-agnostic, we refrain from attempting a survey and instead refer to [50] for a principled, high-level introduction into the realm of learning with invariances and equivariances.

Original: Invariance and robustness.
Revised: Invariance and robustness.

Original: Two recent empirical studies [51, 52] demonstrate that data augmentation meant to increase robustness to ℓ p -norm adversarial attacks reduces robustness to semantically meaningful transformations (e.g. rotation) and vice-versa, suggesting an inherent invariancerobustness trade-off.
Revised: Two recent empirical studies [51, 52] demonstrate that data augmentation meant to increase robustness to ℓ p -norm adversarial attacks reduces robustness to semantically meaningful transformations (e.g. rotation) and vice-versa, suggesting an inherent invariancerobustness trade-off.

Original: However, neither study models that are invariant by design.
Revised: However, neither study models that are invariant by design.

Original: In [53], the negative effect of translation-invariance on the robustness of image classifiers is investigated.
Revised: In [53], the negative effect of translation-invariance on the robustness of image classifiers is investigated.

Original: Note that our work is not meant to resolve potential trade-offs, but to tightly bound the actual robustness of models.
Revised: Note that our work is not meant to resolve potential trade-offs, but to tightly bound the actual robustness of models.

Original: Gray-box certificates.
Revised: Gray-box certificates.

Original: While we propose the first gray-box certificate for invariant models, there exists prior work on combining white-box knowledge with black-box certification.
Revised: While we propose the first gray-box certificate for invariant models, there exists prior work on combining white-box knowledge with black-box certification.

Original: In [54] and [55], knowledge about a classifier’s gradients is used to derive tighter randomized smoothing certificates.
Revised: In [54] and [55], knowledge about a classifier’s gradients is used to derive tighter randomized smoothing certificates.

Original: In [56], knowledge about a graph neural network’s receptive fields is used to derive collective gray-box certificates for multiple predictions.
Revised: In [56], knowledge about a graph neural network’s receptive fields is used to derive collective gray-box certificates for multiple predictions.

Original: In [57], the message-passing scheme of graph neural networks is used for gray-box certification against adversaries that control all features of multiple nodes.
Revised: In [57], the message-passing scheme of graph neural networks is used for gray-box certification against adversaries that control all features of multiple nodes.

Original: Adversarial attacks on spatial data.
Revised: Adversarial attacks on spatial data.

Original: Adversarial attacks on spatial data either modify [58–66], insert [65, 67, 68], or delete [69–71] points in space and have been particularly actively studied for point cloud-classification.
Revised: Adversarial attacks on spatial data either modify [58–66], insert [65, 67, 68], or delete [69–71] points in space and have been particularly actively studied for point cloud-classification.

Original: While the earliest work simply adopted gradient-based attacks from the image domain [58] more recent work has developed a rich assortment of domain-specific methods, for example to preserve object smoothness [64, 72], leverage critical points [69, 70] or craft physically realizable attacks (e.g. to attack models through LiDAR sensors) [61, 73–75].
Revised: While the earliest work simply adopted gradient-based attacks from the image domain [58] more recent work has developed a rich assortment of domain-specific methods, for example to preserve object smoothness [64, 72], leverage critical points [69, 70] or craft physically realizable attacks (e.g. to attack models through LiDAR sensors) [61, 73–75].

Original: Of particular note are attacks via isometries (e.g. rotations and translations)
Revised: Of particular note are attacks via isometries (e.g. rotations and translations)

Original: [76, 77], whose effectiveness motivates the use of invariant models.
Revised: [76, 77], whose effectiveness motivates the use of invariant models.

Original: Note that we certify the robustness of invariant models to arbitrary point modification attacks – not just isometry attacks (see also “orthogonal research directions” below).
Revised: Note that we certify the robustness of invariant models to arbitrary point modification attacks – not just isometry attacks (see also “orthogonal research directions” below).

Original: Like in other domains, empirical defenses have been proposed [59, 78, 79] and subsequently broken [80–82], motivating the development of black-box [83–85] and white-box [86] robustness certificates for spatial data.
Revised: Like in other domains, empirical defenses have been proposed [59, 78, 79] and subsequently broken [80–82], motivating the development of black-box [83–85] and white-box [86] robustness certificates for spatial data.

Original: It should be noted that Gaussian randomized smoothing, without invariance information, has already been used in prior work – either as a baseline [83] or as a special case of the respective certificate [85].
Revised: It should be noted that Gaussian randomized smoothing, without invariance information, has already been used in prior work – either as a baseline [83] or as a special case of the respective certificate [85].

Original: Orthogonal research directions.
Revised: Orthogonal research directions.

Original: One related but orthogonal research direction is transformationspecific certification [23, 85–93].
Revised: One related but orthogonal research direction is transformationspecific certification [23, 85–93].

Original: There, a model is assumed to potentially change its prediction under adversarial parametric transformations (e.g. rotations) and one certifies robustness for specific parameter ranges.
Revised: There, a model is assumed to potentially change its prediction under adversarial parametric transformations (e.g. rotations) and one certifies robustness for specific parameter ranges.

Original: White-box methods [23, 86–89] over-approximate the set of inputs reachable by a transformation and then propagate it through a model using existing white-box techniques.
Revised: White-box methods [23, 86–89] over-approximate the set of inputs reachable by a transformation and then propagate it through a model using existing white-box techniques.

Original: Black-box methods – namely transformation-specific randomized smoothing [90, 94] – randomize the transformation parameters to provide robustness guarantees for arbitrary models via statistical methods.
Revised: Black-box methods – namely transformation-specific randomized smoothing [90, 94] – randomize the transformation parameters to provide robustness guarantees for arbitrary models via statistical methods.

Original: Later work generalized this principle to spatial data [85], vector-field deformations [92] and multiplicative parameters [93].
Revised: Later work generalized this principle to spatial data [85], vector-field deformations [92] and multiplicative parameters [93].

Original: Different from these methods, we assume our model to be invariant under a set of transformations, i.e. never change its prediction.
Revised: Different from these methods, we assume our model to be invariant under a set of transformations, i.e. never change its prediction.

Original: We use this property as a tool for certification against arbitrary perturbations.
Revised: We use this property as a tool for certification against arbitrary perturbations.

Original: Aside from that, there exist white-box certification techniques for specific operations with invariances (e.g. global max-pooling [86], message passing [95, 96] and batch normalization [97]).
Revised: Aside from that, there exist white-box certification techniques for specific operations with invariances (e.g. global max-pooling [86], message passing [95, 96] and batch normalization [97]).

Original: But prior work does not use or even discuss this property – it treats these invariant operations as coincidental building blocks of the models it is trying to certify.
Revised: But prior work does not use or even discuss this property – it treats these invariant operations as coincidental building blocks of the models it is trying to certify.

Original: Our work is the first to study invariance itself in the context of provable robustness and how to leverage it for certification.
Revised: Our work is the first to study invariance itself in the context of provable robustness and how to leverage it for certification.

Original:  Background 3.1 Randomized smoothing
Revised:  Background 3.1 Randomized smoothing

Original: Randomized smoothing is a black-box certification technique that can be adapted to various data types, tasks and threat models [98–103, 91, 104–106].
Revised: Randomized smoothing is a black-box certification technique that can be adapted to various data types, tasks and threat models [98–103, 91, 104–106].

Original: Instead of directly certifying a classifier g , it constructs a smoothed classifier f that returns the most likely prediction under random perturbations of its input.
Revised: Instead of directly certifying a classifier g , it constructs a smoothed classifier f that returns the most likely prediction under random perturbations of its input.

Original: It then certifies the robustness of this smoothed classifier.
Revised: It then certifies the robustness of this smoothed classifier.

Original: We present the tight Gaussian smoothing certificate derived by Cohen et al.
Revised: We present the tight Gaussian smoothing certificate derived by Cohen et al.

Original: [26] and its generalization to matrix data [83, 85].
Revised: [26] and its generalization to matrix data [83, 85].

Original: Assume a continuous ( N × D ) -dimensional input space R N × D , label set Y and base classifier g :
Revised: Assume a continuous ( N × D ) -dimensional input space R N × D , label set Y and base classifier g :

Original: R N × D → Y .
Revised: R N × D → Y .

Original: Let µ X ( Z ) =
Revised: Let µ X ( Z ) =

Original: (cid:81)
Revised: (cid:81)

Original: Dd =1 N (cid:0) Z : ,d | X : ,d , σ 2 I N (cid:1) be the isotropic matrix normal distribution with mean X and standard deviation σ .
Revised: Dd =1 N (cid:0) Z : ,d | X : ,d , σ 2 I N (cid:1) be the isotropic matrix normal distribution with mean X and standard deviation σ .

Original: Let p X ,y =
Revised: Let p X ,y =

Original: Pr Z ∼ µ X [ g ( Z ) =
Revised: Pr Z ∼ µ X [ g ( Z ) =

Original: y ] be the probability of g predicting class y under this smoothing distribution .
Revised: y ] be the probability of g predicting class y under this smoothing distribution .

Original: One can then define a smoothed classifier f
Revised: One can then define a smoothed classifier f

Original: ( X ) =
Revised: ( X ) =

Original: argmax y ∈ Y p X ,y that returns the most likely prediction of g under µ X .
Revised: argmax y ∈ Y p X ,y that returns the most likely prediction of g under µ X .

Original: Let y ∗ =
Revised: Let y ∗ =

Original: f ( X ) be a smoothed prediction and X ′ =
Revised: f ( X ) be a smoothed prediction and X ′ =

Original: X + ∆ a perturbed input.
Revised: X + ∆ a perturbed input.

Original: One can show f ( X ′ )
Revised: One can show f ( X ′ )

Original: =
Revised: =

Original: y ∗ by proving that, for perturbed input X ′ , y ∗ is more likely than all other classes combined.
Revised: y ∗ by proving that, for perturbed input X ′ , y ∗ is more likely than all other classes combined.

Original: That is, p X ′ ,y ∗ > 0 .
Revised: That is, p X ′ ,y ∗ > 0 .

Original: A tighter certificate can be obtained by proving that y ∗ is more likely than the second most likely class, i.e. p X ′ ,y ∗ >
Revised: A tighter certificate can be obtained by proving that y ∗ is more likely than the second most likely class, i.e. p X ′ ,y ∗ >

Original: max y ′ ̸
Revised: max y ′ ̸

Original: =
Revised: =

Original: y ∗ p X ′ ,y ′ .
Revised: y ∗ p X ′ ,y ′ .

Original: For the sake of exposition, we use the first approach throughout the main text and generalize all results to the second one in Appendix H.
Revised: For the sake of exposition, we use the first approach throughout the main text and generalize all results to the second one in Appendix H.

Original: One can lower-bound p X ′ ,y ∗ by finding the worst-case classifier from a set of functions H with g ∈ H :
Revised: One can lower-bound p X ′ ,y ∗ by finding the worst-case classifier from a set of functions H with g ∈ H :

Original: [Equation]
Revised: [Equation]

Original: For H = (cid:8) h : R N × D
Revised: For H = (cid:8) h : R N × D

Original: → Y | Pr Z ∼ µ X [ h ( Z ) =
Revised: → Y | Pr Z ∼ µ X [ h ( Z ) =

Original: y ∗ ] ≥ p X ,y ∗ (cid:9) , the classifiers that are at least as likely as g to classify X as y ∗ , the exact solution is given by the Neyman-Pearson lemma [107] (see Appendix F.2).
Revised: y ∗ ] ≥ p X ,y ∗ (cid:9) , the classifiers that are at least as likely as g to classify X as y ∗ , the exact solution is given by the Neyman-Pearson lemma [107] (see Appendix F.2).

Original: The optimal value is Φ (cid:16)
Revised: The optimal value is Φ (cid:16)

Original: Φ − 1 ( p X ,y ∗ ) − || ∆ || 2 σ (cid:17) , where Φ is the standard-normal CDF and || · || 2 is the Frobenius norm.
Revised: Φ − 1 ( p X ,y ∗ ) − || ∆ || 2 σ (cid:17) , where Φ is the standard-normal CDF and || · || 2 is the Frobenius norm.

Original: If || ∆ || 2 < σ Φ − 1 ( p X ,y ∗ ) , then p X ′ ,y ∗ > 0 .
Revised: If || ∆ || 2 < σ Φ − 1 ( p X ,y ∗ ) , then p X ′ ,y ∗ > 0 .

Original: and the prediction is provably robust.
Revised: and the prediction is provably robust.

Original: Because Eq.
Revised: Because Eq.

Original: (1) was solved exactly, this is a tight certificate , i.e. the best possible certificate that can be obtained by only using black-box knowledge about prediction probability p X ,y ∗ .
Revised: (1) was solved exactly, this is a tight certificate , i.e. the best possible certificate that can be obtained by only using black-box knowledge about prediction probability p X ,y ∗ .

Original: Probabilistic certificates.
Revised: Probabilistic certificates.

Original: For neural networks, the prediction probability p X ,y ∗ can usually not be computed analytically.
Revised: For neural networks, the prediction probability p X ,y ∗ can usually not be computed analytically.

Original: Instead, one has to use Monte Carlo sampling to compute a lower confidence bound p x ′ ,y ∗ that holds with high probability 1 − α .
Revised: Instead, one has to use Monte Carlo sampling to compute a lower confidence bound p x ′ ,y ∗ that holds with high probability 1 − α .

Original: The resulting certificate is a probabilistic one.
Revised: The resulting certificate is a probabilistic one.

Original: 3.2 Group invariance
Revised: 3.2 Group invariance

Original: Let f : R N × D
Revised: Let f : R N × D

Original: → Y be a classifier and T a group, i.e. a set and associated operator · : T × T → T that is closed and associative under the operation, has an inverse t − 1 for each element t ∈ T and features an identity element e .
Revised: → Y be a classifier and T a group, i.e. a set and associated operator · : T × T → T that is closed and associative under the operation, has an inverse t − 1 for each element t ∈ T and features an identity element e .

Original: Further let T act on the input space via a group action ◦ :
Revised: Further let T act on the input space via a group action ◦ :

Original: T × R N × D → R N × D that preserves the group structure, i.e. ( t · t ′ ) ◦
Revised: T × R N × D → R N × D that preserves the group structure, i.e. ( t · t ′ ) ◦

Original: X = t ◦ ( t ′ ◦ X ) .
Revised: X = t ◦ ( t ′ ◦ X ) .

Original: Group actions naturally partition the domain into orbits , i.e. sets that can be reached by applying group actions to inputs:
Revised: Group actions naturally partition the domain into orbits , i.e. sets that can be reached by applying group actions to inputs:

Original: Definition 1 (Orbits) .
Revised: Definition 1 (Orbits) .

Original: The orbit of an input X ∈ R N × D w.r.t.
Revised: The orbit of an input X ∈ R N × D w.r.t.

Original: a group T is [ X ] T = { t ◦ X | t ∈ T } .
Revised: a group T is [ X ] T = { t ◦ X | t ∈ T } .

Original: Classifier f is said to be invariant under group T if ∀ X ∈ R N × D , ∀ X ′ ∈
Revised: Classifier f is said to be invariant under group T if ∀ X ∈ R N × D , ∀ X ′ ∈

Original: [ X ] T : f ( X ) = f
Revised: [ X ] T : f ( X ) = f

Original: ( X ′ ) .
Revised: ( X ′ ) .

Original: 3.3 Haar measures
Revised: 3.3 Haar measures

Original: Haar measures [108] are a generalization of Lebesgue measures for integration over groups.
Revised: Haar measures [108] are a generalization of Lebesgue measures for integration over groups.

Original: Their key property is invariance, meaning the group operator does not affect the measure.
Revised: Their key property is invariance, meaning the group operator does not affect the measure.

Original: Definition 2 (Right Haar measure) .
Revised: Definition 2 (Right Haar measure) .

Original: Let η be a finite, regular measure on the Borel subsets of T .
Revised: Let η be a finite, regular measure on the Borel subsets of T .

Original: If η ( S ) =
Revised: If η ( S ) =

Original: η ( { s · t | s ∈ S } ) for all t ∈ T and Borel subsets S ⊆ T , then η is a right Haar measure.
Revised: η ( { s · t | s ∈ S } ) for all t ∈ T and Borel subsets S ⊆ T , then η is a right Haar measure.

Original: For the groups we consider, the Haar measure is unique up to a multiplicative constant [109, 110].
Revised: For the groups we consider, the Haar measure is unique up to a multiplicative constant [109, 110].

Original: In Section 6.1 we use Haar measures as a notational tool to summarize certificates for different groups.
Revised: In Section 6.1 we use Haar measures as a notational tool to summarize certificates for different groups.

Original: However, an understanding of measure theory is not required to follow any part of the derivations.
Revised: However, an understanding of measure theory is not required to follow any part of the derivations.

Original: [Figure]
Revised: [Figure]

Original:  Problem setting
Revised:  Problem setting

Original: We consider a similar setup to that described in Section 3.1, i.e. we have a smoothed classifier f : R N × D
Revised: We consider a similar setup to that described in Section 3.1, i.e. we have a smoothed classifier f : R N × D

Original: → Y that is the result of randomly smoothing a base classifier g with an isotropic matrix normal distribution µ X .
Revised: → Y that is the result of randomly smoothing a base classifier g with an isotropic matrix normal distribution µ X .

Original: Given a clean prediction y ∗
Revised: Given a clean prediction y ∗

Original: =
Revised: =

Original: f
Revised: f

Original: ( X ) with clean prediction probability p X ,y ∗ , we want to determine whether f ( X ′ )
Revised: ( X ) with clean prediction probability p X ,y ∗ , we want to determine whether f ( X ′ )

Original: =
Revised: =

Original: y ∗ for an adversarially perturbed input X ′ =
Revised: y ∗ for an adversarially perturbed input X ′ =

Original: X + ∆ .
Revised: X + ∆ .

Original: Different from all prior work, we additionally assume that the base classifier g is invariant under a group T .
Revised: Different from all prior work, we additionally assume that the base classifier g is invariant under a group T .

Original: This does not necessarily mean that the smoothed classifier f shares the same invariances.
Revised: This does not necessarily mean that the smoothed classifier f shares the same invariances.

Original: But, we can use the isotropy of smoothing distribution µ X to prove (see Appendix D) that randomized smoothing preserves invariance under Euclidean isotropies (rotation, reflection and translation) and permutation, which we shall leverage in Section 5.
Revised: But, we can use the isotropy of smoothing distribution µ X to prove (see Appendix D) that randomized smoothing preserves invariance under Euclidean isotropies (rotation, reflection and translation) and permutation, which we shall leverage in Section 5.

Original: Theorem 1.
Revised: Theorem 1.

Original: Let base classifier g : R N × D
Revised: Let base classifier g : R N × D

Original: → Y be invariant under group T with T ⊆
Revised: → Y be invariant under group T with T ⊆

Original: E ( D ) or T ⊆ S ( N ) , where E ( D ) is the Euclidean group and S ( N ) is the permutation group.
Revised: E ( D ) or T ⊆ S ( N ) , where E ( D ) is the Euclidean group and S ( N ) is the permutation group.

Original: Then the isotropically smoothed classifier f , as defined in Section 3.1, is also invariant under T .
Revised: Then the isotropically smoothed classifier f , as defined in Section 3.1, is also invariant under T .

Original: Note that the above result also holds for subgroups of E ( D ) , such as the translation group T ( D ) , the rotation group SO
Revised: Note that the above result also holds for subgroups of E ( D ) , such as the translation group T ( D ) , the rotation group SO

Original: ( D ) and the roto-translation group SE ( D ) .
Revised: ( D ) and the roto-translation group SE ( D ) .

Original: We define these groups and their actions on R N × D more formally in Appendix C.
Revised: We define these groups and their actions on R N × D more formally in Appendix C.

Original:  Orbit-based gray-box certificates
Revised:  Orbit-based gray-box certificates

Original: Since we are the first to consider robustness certification for invariant models, we begin by defining a baseline that other certificates can be benchmarked against: It is based on the insight that certificates correspond to sets of inputs B ⊆ R N × D that preserve clean prediction y ∗ , and group T corresponds to sets of transformations that preserve predictions.
Revised: Since we are the first to consider robustness certification for invariant models, we begin by defining a baseline that other certificates can be benchmarked against: It is based on the insight that certificates correspond to sets of inputs B ⊆ R N × D that preserve clean prediction y ∗ , and group T corresponds to sets of transformations that preserve predictions.

Original: By transitivity, a perturbed input X ′ that can reach B via a transformation from T , i.e. ∃ t ∈ T : t ◦ X ′ ∈ B , must fulfill f ( X ′ )
Revised: By transitivity, a perturbed input X ′ that can reach B via a transformation from T , i.e. ∃ t ∈ T : t ◦ X ′ ∈ B , must fulfill f ( X ′ )

Original: =
Revised: =

Original: y ∗ and cannot be an adversarial example.
Revised: y ∗ and cannot be an adversarial example.

Original: Combining all such inputs, i.e. combining the orbits of elements of B (see Definition 1), yields an augmented certified region ˜ B ⊇ B (proof in Appendix E.1):
Revised: Combining all such inputs, i.e. combining the orbits of elements of B (see Definition 1), yields an augmented certified region ˜ B ⊇ B (proof in Appendix E.1):

Original: Theorem 2 (Orbit-based certificates) .
Revised: Theorem 2 (Orbit-based certificates) .

Original: Let f ∈ R N × D
Revised: Let f ∈ R N × D

Original: → Y be invariant under a group T .
Revised: → Y be invariant under a group T .

Original: Let y ∗ =
Revised: Let y ∗ =

Original: f ( X ) be a prediction that is certifiably robust to a set of perturbed inputs B ⊆ R N × D , i.e.
Revised: f ( X ) be a prediction that is certifiably robust to a set of perturbed inputs B ⊆ R N × D , i.e.

Original: ∀ Z ∈ B : f ( Z ) =
Revised: ∀ Z ∈ B : f ( Z ) =

Original: y ∗ .
Revised: y ∗ .

Original: Let ˜ B
Revised: Let ˜ B

Original: = ∪ Z ∈ B
Revised: = ∪ Z ∈ B

Original: [ Z ] T .
Revised: [ Z ] T .

Original: Then ∀ X ′ ∈ ˜ B : f ( X ′ ) =
Revised: Then ∀ X ′ ∈ ˜ B : f ( X ′ ) =

Original: y ∗ .
Revised: y ∗ .

Original: This orbit-based approach is illustrated in Fig.
Revised: This orbit-based approach is illustrated in Fig.

Original: While we focus on randomized smoothing,
Revised: While we focus on randomized smoothing,

Original: Theorem 2 holds for arbitrary models and certified regions B .
Revised: Theorem 2 holds for arbitrary models and certified regions B .

Original: However, obtaining B via other means may not be possible.
Revised: However, obtaining B via other means may not be possible.

Original: For instance, there exist no white-box certificates for rotation-invariant models.
Revised: For instance, there exist no white-box certificates for rotation-invariant models.

Original: Because randomized smoothing preserves invariance to Euclidean isometries and permutation (see Theorem 1), we may apply the orbit-based approach with T
Revised: Because randomized smoothing preserves invariance to Euclidean isometries and permutation (see Theorem 1), we may apply the orbit-based approach with T

Original: ⊆
Revised: ⊆

Original: E ( D ) or T ⊆ S ( N ) to the certified region B = { X + ∆ | || ∆ ||
Revised: E ( D ) or T ⊆ S ( N ) to the certified region B = { X + ∆ | || ∆ ||

Original: 2 < r } with r = σ Φ − 1 ( p X ,y ∗ ) that we derived in Section 3.1.
Revised: 2 < r } with r = σ Φ − 1 ( p X ,y ∗ ) that we derived in Section 3.1.

Original: While ˜ B
Revised: While ˜ B

Original: = ∪ Z ∈ B
Revised: = ∪ Z ∈ B

Original: [ Z ] T , is a valid certificate, one may desire an equivalent, but more explicit characterization of the certified region ˜ B to determine whether a specific perturbed input preserves the prediction y ∗ .
Revised: [ Z ] T , is a valid certificate, one may desire an equivalent, but more explicit characterization of the certified region ˜ B to determine whether a specific perturbed input preserves the prediction y ∗ .

Original: We discuss such explicit characterizations in Appendix E.
Revised: We discuss such explicit characterizations in Appendix E.

Original: In particular, translation invariance (i.e. T = T ( D ) ) leads to certified region ˜ B
Revised: In particular, translation invariance (i.e. T = T ( D ) ) leads to certified region ˜ B

Original: = (cid:8) X + ∆ | || ∆ − 1 N ∆ || 2 < r (cid:9) , where
Revised: = (cid:8) X + ∆ | || ∆ − 1 N ∆ || 2 < r (cid:9) , where

Original: ∆ ∈ R 1 × D are column-wise averages and r is defined as above.
Revised: ∆ ∈ R 1 × D are column-wise averages and r is defined as above.

Original: Rotation invariance (i.e. T =
Revised: Rotation invariance (i.e. T =

Original: SO ( D ) ) leads to certified region ˜ B
Revised: SO ( D ) ) leads to certified region ˜ B

Original: = (cid:8) X ′ | ||
Revised: = (cid:8) X ′ | ||

Original: X ′ R T − X
Revised: X ′ R T − X

Original: || 2 < r (cid:9) , where R is an optimal rotation matrix defined by the singular value decomposition of X T X
Revised: || 2 < r (cid:9) , where R is an optimal rotation matrix defined by the singular value decomposition of X T X

Original: ′ [111, 112] (see Appendix E.2.2).
Revised: ′ [111, 112] (see Appendix E.2.2).

Original:  Tight gray-box certificates
Revised:  Tight gray-box certificates

Original: Now that we have established a baseline for gray-box certification, one may naturally wonder about its optimality.
Revised: Now that we have established a baseline for gray-box certification, one may naturally wonder about its optimality.

Original: We answer this by deriving tight gray-box certificates, i.e. the best certificates that can be obtained for prediction y ∗ using only the invariances of base classifier g under group T and its prediction probability p X ,y ∗ under clean smoothing distribution µ X .
Revised: We answer this by deriving tight gray-box certificates, i.e. the best certificates that can be obtained for prediction y ∗ using only the invariances of base classifier g under group T and its prediction probability p X ,y ∗ under clean smoothing distribution µ X .

Original: Similar to Section 3.1, we do so by finding a worst-case classifier.
Revised: Similar to Section 3.1, we do so by finding a worst-case classifier.

Original: In addition to constraining its clean prediction probability, we constrain the classifier to be invariant under T , i.e. solve min h ∈ H T Pr Z ∼ µ X ′
Revised: In addition to constraining its clean prediction probability, we constrain the classifier to be invariant under T , i.e. solve min h ∈ H T Pr Z ∼ µ X ′

Original: [ h ( Z ) =
Revised: [ h ( Z ) =

Original: y ∗ ] with
Revised: y ∗ ] with

Original: [Equation]
Revised: [Equation]

Original: where [ Z ] T is the orbit of Z w.r.t.
Revised: where [ Z ] T is the orbit of Z w.r.t.

Original: T (see Definition 1).
Revised: T (see Definition 1).

Original: In the following, we show how to solve the above optimization problem and then apply our certification methodology to specific invariances.
Revised: In the following, we show how to solve the above optimization problem and then apply our certification methodology to specific invariances.

Original: 6.1 Certification methodology
Revised: 6.1 Certification methodology

Original: To work with invariance constraints, it is convenient to not think of h as a function, but a family of variables ( h Z ) ∈ Y indexed by R N × D .
Revised: To work with invariance constraints, it is convenient to not think of h as a function, but a family of variables ( h Z ) ∈ Y indexed by R N × D .

Original: The invariance constraint states that all variables from an orbit should have the same value, i.e. ∀ Z , ∀ Z ′ ∈
Revised: The invariance constraint states that all variables from an orbit should have the same value, i.e. ∀ Z , ∀ Z ′ ∈

Original: [ Z ] T : h Z
Revised: [ Z ] T : h Z

Original: =
Revised: =

Original: h Z ′ .
Revised: h Z ′ .

Original: Intuitively, the constraint can be enforced by replacing all these variables with a single variable.
Revised: Intuitively, the constraint can be enforced by replacing all these variables with a single variable.

Original: We propose to formalize this idea by using canonical maps, which map all inputs from an orbit to a single, distinct representative:
Revised: We propose to formalize this idea by using canonical maps, which map all inputs from an orbit to a single, distinct representative:

Original: Definition 3 (Canonical map) .
Revised: Definition 3 (Canonical map) .

Original: A canonical map for invariance under a group of transformations T is a function γ : R N × D
Revised: A canonical map for invariance under a group of transformations T is a function γ : R N × D

Original: → R N × D with
Revised: → R N × D with

Original: [Equation]
Revised: [Equation]

Original: In Appendix F.1, we prove that canonical maps let us discard the invariance constraints:
Revised: In Appendix F.1, we prove that canonical maps let us discard the invariance constraints:

Original: Lemma 1.
Revised: Lemma 1.

Original: Let g : R N × D
Revised: Let g : R N × D

Original: → Y be invariant under group T and let H T be defined as in Eq.
Revised: → Y be invariant under group T and let H T be defined as in Eq.

Original: If γ : R N × D → R N × D is a canonical map for invariance under T , then
Revised: If γ : R N × D → R N × D is a canonical map for invariance under T , then

Original: [Equation]
Revised: [Equation]

Original: Like in Section 3.1, the optimization problem without invariance constraints from Lemma 1 could now be solved exactly using the Neyman-Pearson lemma – if we could find the distribution of γ ( Z ) , i.e. the distribution of representatives 1 .
Revised: Like in Section 3.1, the optimization problem without invariance constraints from Lemma 1 could now be solved exactly using the Neyman-Pearson lemma – if we could find the distribution of γ ( Z ) , i.e. the distribution of representatives 1 .

Original: This can be achieved for groups T ( D ) , SO ( D ) and SE ( D ) via careful change of variables into an alternative parameterization of R N × D (see Appendix F.3).
Revised: This can be achieved for groups T ( D ) , SO ( D ) and SE ( D ) via careful change of variables into an alternative parameterization of R N × D (see Appendix F.3).

Original: This leads us to our main result, which we derive more formally in Appendix F.3.
Revised: This leads us to our main result, which we derive more formally in Appendix F.3.

Original: In the following, let ⟨ A , B ⟩ F be the Frobenius inner product (cid:80)
Revised: In the following, let ⟨ A , B ⟩ F be the Frobenius inner product (cid:80)

Original: Nn =1 ( A n ) T B n and recall from Section 3.3 that a right
Revised: Nn =1 ( A n ) T B n and recall from Section 3.3 that a right

Original: Haar measure is a measure for integration over a group T .
Revised: Haar measure is a measure for integration over a group T .

Original: Theorem 3.
Revised: Theorem 3.

Original: Let g : R N × D
Revised: Let g : R N × D

Original: → Y be invariant under T with T chosen from { T ( D ) , SO ( D ) , SE ( D ) } .
Revised: → Y be invariant under T with T chosen from { T ( D ) , SO ( D ) , SE ( D ) } .

Original: For SO ( D ) and SE ( D ) , let D ∈ { 2 , 3 } .
Revised: For SO ( D ) and SE ( D ) , let D ∈ { 2 , 3 } .

Original: Let H T be defined as in Eq.
Revised: Let H T be defined as in Eq.

Original: (2) and η be a right Haar measure on T .
Revised: (2) and η be a right Haar measure on T .

Original: Define the indicator function h ∗ : R N × D → { 0 , 1 } with
Revised: Define the indicator function h ∗ : R N × D → { 0 , 1 } with

Original: [Equation]
Revised: [Equation]

Original: , where β X ( Z ) = (cid:90) t ∈ T exp (cid:0) ⟨ t ◦ Z , X ⟩ F / σ 2 (cid:1) dη ( t ) (5) and κ ∈ R such that
Revised: , where β X ( Z ) = (cid:90) t ∈ T exp (cid:0) ⟨ t ◦ Z , X ⟩ F / σ 2 (cid:1) dη ( t ) (5) and κ ∈ R such that

Original: [Equation]
Revised: [Equation]

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: The indicator function h ∗ in Eq.
Revised: The indicator function h ∗ in Eq.

Original: (5) corresponds to the worst-case invariant classifier for clean prediction probability p X ,y ∗ .
Revised: (5) corresponds to the worst-case invariant classifier for clean prediction probability p X ,y ∗ .

Original: To classify an input sample Z , it integrates Gaussian kernels of ( t ◦ Z , X ′ ) and ( t ◦ Z , X ) over group T (e.g. over all possible rotations).
Revised: To classify an input sample Z , it integrates Gaussian kernels of ( t ◦ Z , X ′ ) and ( t ◦ Z , X ) over group T (e.g. over all possible rotations).

Original: If the ratio of these integrals is below a threshold κ , it classifies Z as y ∗ .
Revised: If the ratio of these integrals is below a threshold κ , it classifies Z as y ∗ .

Original: The constraint in Eq.
Revised: The constraint in Eq.

Original: (6) ensures that the probability of predicting y ∗ under the clean smoothing distribution µ X matches that of the actual base classifier g .
Revised: (6) ensures that the probability of predicting y ∗ under the clean smoothing distribution µ X matches that of the actual base classifier g .

Original: The expected value with respect to perturbed smoothing distribution µ X ′ in Eq.
Revised: The expected value with respect to perturbed smoothing distribution µ X ′ in Eq.

Original: (7) is the optimal value of our optimization problem.
Revised: (7) is the optimal value of our optimization problem.

Original: As discussed in Section 3.1, the prediction is certifiably robust if this optimal value is greater than 1 / 2 .
Revised: As discussed in Section 3.1, the prediction is certifiably robust if this optimal value is greater than 1 / 2 .

Original: Applying the certificate to a group T requires three steps: 1.)
Revised: Applying the certificate to a group T requires three steps: 1.)

Original: Calculating the Haar integrals in Eq.
Revised: Calculating the Haar integrals in Eq.

Original: Solving Eq.
Revised: Solving Eq.

Original: (6) for classification threshold κ . 3.)
Revised: (6) for classification threshold κ . 3.)

Original: Evaluating the expected value in Eq.
Revised: Evaluating the expected value in Eq.

Original: Connection to prior work.
Revised: Connection to prior work.

Original: This result differs from black-box randomized smoothing with Gaussian noise, where the worst-case classifier is a linear model [26].
Revised: This result differs from black-box randomized smoothing with Gaussian noise, where the worst-case classifier is a linear model [26].

Original: The group averaging performed by the worst-case invariant classifier, i.e. integrating a function over group T , is a key technique for building invariant models [7, 113–117].
Revised: The group averaging performed by the worst-case invariant classifier, i.e. integrating a function over group T , is a key technique for building invariant models [7, 113–117].

Original: Group-averaged kernels have been proposed in [15].
Revised: Group-averaged kernels have been proposed in [15].

Original: It is fascinating to see them naturally materialize from nothing but an invariance constraint.
Revised: It is fascinating to see them naturally materialize from nothing but an invariance constraint.

Original: 6.2 Translation invariance
Revised: 6.2 Translation invariance

Original: In the case of translation invariance (i.e. T = T ( D ) ), we can evaluate the worst-case classifier (Eq.
Revised: In the case of translation invariance (i.e. T = T ( D ) ), we can evaluate the worst-case classifier (Eq.

Original: (5), solve for threshold κ (Eq.
Revised: (5), solve for threshold κ (Eq.

Original: and evaluate the perturbed prediction probability (Eq.
Revised: and evaluate the perturbed prediction probability (Eq.

Original: (7)) analytically.
Revised: (7)) analytically.

Original: This leads to the following result (proof in Appendix F.4.1):
Revised: This leads to the following result (proof in Appendix F.4.1):

Original: Theorem 4.
Revised: Theorem 4.

Original: Let g : R N × D
Revised: Let g : R N × D

Original: → Y be invariant under T
Revised: → Y be invariant under T

Original: = T ( D ) and H T be defined as in Eq.
Revised: = T ( D ) and H T be defined as in Eq.

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: where ∆ ∈ R 1 × D are the column-wise averages of ∆ =
Revised: where ∆ ∈ R 1 × D are the column-wise averages of ∆ =

Original: X ′ − X
Revised: X ′ − X

Original: and σ is the standard deviation of the isotropic matrix normal smoothing distribution µ X .
Revised: and σ is the standard deviation of the isotropic matrix normal smoothing distribution µ X .

Original: Certificate parameters.
Revised: Certificate parameters.

Original: For a fixed smoothing standard deviation σ , the certificate depends on a single parameter:
Revised: For a fixed smoothing standard deviation σ , the certificate depends on a single parameter:

Original: The norm (cid:12)(cid:12)(cid:12)(cid:12) ∆ − 1 N ∆ (cid:12)(cid:12)(cid:12)(cid:12) 2 of the mean-centered perturbation matrix ∆ .
Revised: The norm (cid:12)(cid:12)(cid:12)(cid:12) ∆ − 1 N ∆ (cid:12)(cid:12)(cid:12)(cid:12) 2 of the mean-centered perturbation matrix ∆ .

Original: Comparison to the orbit-based certificate.
Revised: Comparison to the orbit-based certificate.

Original: Substituting into robustness condition min h ∈ H T
Revised: Substituting into robustness condition min h ∈ H T

Original: Pr Z ∼ µ X ′
Revised: Pr Z ∼ µ X ′

Original: [ h ( Z ) =
Revised: [ h ( Z ) =

Original: y ∗ ] > 12 shows that f ( X ′ )
Revised: y ∗ ] > 12 shows that f ( X ′ )

Original: =
Revised: =

Original: y ∗ if (cid:12)(cid:12)(cid:12)(cid:12) ∆ − 1 N ∆ (cid:12)(cid:12)(cid:12)(cid:12) 2 <
Revised: y ∗ if (cid:12)(cid:12)(cid:12)(cid:12) ∆ − 1 N ∆ (cid:12)(cid:12)(cid:12)(cid:12) 2 <

Original: σ Φ − 1 ( p X ,y ∗ ) .
Revised: σ Φ − 1 ( p X ,y ∗ ) .

Original: This result, obtained via our tight certification methodology, is identical to the orbit-based certificate for translation invariance from the end of Section 5.
Revised: This result, obtained via our tight certification methodology, is identical to the orbit-based certificate for translation invariance from the end of Section 5.

Original: In other words: Despite its simplicity, the orbit-based certificate is the best possible gray-box certificate for translation invariance.
Revised: In other words: Despite its simplicity, the orbit-based certificate is the best possible gray-box certificate for translation invariance.

Original: 6.3 Rotation invariance in 2D
Revised: 6.3 Rotation invariance in 2D

Original: Considering the previous result, one may suspect the orbit-based certificate to be tight for arbitrary invariances.
Revised: Considering the previous result, one may suspect the orbit-based certificate to be tight for arbitrary invariances.

Original: This is not the case.
Revised: This is not the case.

Original: For instance, it is not tight for rotation invariance ( T = SO
Revised: For instance, it is not tight for rotation invariance ( T = SO

Original: ( D ) ):
Revised: ( D ) ):

Original: Theorem 5.
Revised: Theorem 5.

Original: Let g : R N × D
Revised: Let g : R N × D

Original: → Y be invariant under T =
Revised: → Y be invariant under T =

Original: SO ( D ) and H T be defined as in Eq.
Revised: SO ( D ) and H T be defined as in Eq.

Original: Assume that perturbed input X ′ is not obtained via rotation of X , i.e. ∄ R ∈
Revised: Assume that perturbed input X ′ is not obtained via rotation of X , i.e. ∄ R ∈

Original: SO ( D ) :
Revised: SO ( D ) :

Original: X ′ =
Revised: X ′ =

Original: XR T .
Revised: XR T .

Original: Further assume that p X ,y ∗ ∈ (0 , 1) .
Revised: Further assume that p X ,y ∗ ∈ (0 , 1) .

Original: Then, for all R ∈ SO ( D ) :
Revised: Then, for all R ∈ SO ( D ) :

Original: [Equation]
Revised: [Equation]

Original: In other words: The tight certificate is strictly stronger.
Revised: In other words: The tight certificate is strictly stronger.

Original: Proof in Appendix G.
Revised: Proof in Appendix G.

Original: Next, we apply Theorem 3 to obtain the strictly stronger, tight certificate for rotation invariance in 2D.
Revised: Next, we apply Theorem 3 to obtain the strictly stronger, tight certificate for rotation invariance in 2D.

Original: In the following, let R ( θ ) ∈
Revised: In the following, let R ( θ ) ∈

Original: SO (2) be the matrix that rotates counter-clockwise by angle θ and
Revised: SO (2) be the matrix that rotates counter-clockwise by angle θ and

Original: I 0 be the modified Bessel function of the first kind and order 0 .
Revised: I 0 be the modified Bessel function of the first kind and order 0 .

Original: The Haar integral from Eq.
Revised: The Haar integral from Eq.

Original: (5) that defines the worst-case classifier can be evaluated analytically (see Appendix F.4.2)):
Revised: (5) that defines the worst-case classifier can be evaluated analytically (see Appendix F.4.2)):

Original: [Equation]
Revised: [Equation]

Original: We can substitute this into Theorem 3 and use the fact that Eq.
Revised: We can substitute this into Theorem 3 and use the fact that Eq.

Original: (9) depends on linear transformations of the matrix normal random variable Z to obtain the following certificate (proof in Appendix F.4.2):
Revised: (9) depends on linear transformations of the matrix normal random variable Z to obtain the following certificate (proof in Appendix F.4.2):

Original: Theorem 6.
Revised: Theorem 6.

Original: Let g : R N × 2 → Y be invariant under T =
Revised: Let g : R N × 2 → Y be invariant under T =

Original: SO (2) and H T be defined as in Eq.
Revised: SO (2) and H T be defined as in Eq.

Original: Define the indicator function ρ : R 4 → { 0 , 1 } with
Revised: Define the indicator function ρ : R 4 → { 0 , 1 } with

Original: [Equation]
Revised: [Equation]

Original: with κ ∈ R such that
Revised: with κ ∈ R such that

Original: [Equation]
Revised: [Equation]

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: where m (1) , m (2) ∈ R 4 , Σ ∈ R 4 × 4 are linear combinations (see Appendix F.4.2) of || X
Revised: where m (1) , m (2) ∈ R 4 , Σ ∈ R 4 × 4 are linear combinations (see Appendix F.4.2) of || X

Original: || 22 / σ 2 , ||
Revised: || 22 / σ 2 , ||

Original: ∆ || 22 / σ 2 and parameters ϵ 1 = ⟨ X , ∆ ⟩ F , ϵ 2 = ⟨ XR ( − π / 2 ) T , ∆ ⟩ F .
Revised: ∆ || 22 / σ 2 and parameters ϵ 1 = ⟨ X , ∆ ⟩ F , ϵ 2 = ⟨ XR ( − π / 2 ) T , ∆ ⟩ F .

Original: Certificate parameters.
Revised: Certificate parameters.

Original: This certificate depends on the perturbation norm ||
Revised: This certificate depends on the perturbation norm ||

Original: ∆ || 2 and clean data norm ||
Revised: ∆ || 2 and clean data norm ||

Original: X
Revised: X

Original: || 2 , relative to the smoothing standard deviation σ .
Revised: || 2 , relative to the smoothing standard deviation σ .

Original: It further depends on parameters ϵ 1 and ϵ 2 , which are Frobenius inner products between ∆ and the clean input X before and after a rotation by − π / 2 .
Revised: It further depends on parameters ϵ 1 and ϵ 2 , which are Frobenius inner products between ∆ and the clean input X before and after a rotation by − π / 2 .

Original: These parameters capture the orientation of X ′ =
Revised: These parameters capture the orientation of X ′ =

Original: X + ∆ relative to X , as one would expect from a rotation-invariance aware certificate.
Revised: X + ∆ relative to X , as one would expect from a rotation-invariance aware certificate.

Original: Monte Carlo evaluation.
Revised: Monte Carlo evaluation.

Original: Evidently, we do not have a closed-form expression for the expectations in Eqs.
Revised: Evidently, we do not have a closed-form expression for the expectations in Eqs.

Original: (11) and (12).
Revised: (11) and (12).

Original: However, recall from Section 3.1 that randomized smoothing already involves an intractable expectation, namely the prediction probability p X ,y ∗ .
Revised: However, recall from Section 3.1 that randomized smoothing already involves an intractable expectation, namely the prediction probability p X ,y ∗ .

Original: One has to use Monte Carlo sampling to compute a lower confidence bound that hold with high probability 1 − α .
Revised: One has to use Monte Carlo sampling to compute a lower confidence bound that hold with high probability 1 − α .

Original: We adopt the same approach: First, we lower-bound threshold κ from Eq.
Revised: We adopt the same approach: First, we lower-bound threshold κ from Eq.

Original: (11), i.e. make the classifier slightly less likely to predict y ∗ .
Revised: (11), i.e. make the classifier slightly less likely to predict y ∗ .

Original: Then, we lower-bound bound expectation E q ∼N ( m (1) , Σ )
Revised: Then, we lower-bound bound expectation E q ∼N ( m (1) , Σ )

Original: [ ρ ( q )] from Eq.
Revised: [ ρ ( q )] from Eq.

Original: Because the resulting value is slightly smaller than than optimal value of our optimization problem
Revised: Because the resulting value is slightly smaller than than optimal value of our optimization problem

Original: min h ∈ H T
Revised: min h ∈ H T

Original: Pr Z ∼ µ X ′
Revised: Pr Z ∼ µ X ′

Original: [ h ( Z ) =
Revised: [ h ( Z ) =

Original: y ∗ ] , this procedure yields a valid certificate.
Revised: y ∗ ] , this procedure yields a valid certificate.

Original: We discuss the full algorithm and how to ensure that all bounds simultaneously hold in Appendix F.5.
Revised: We discuss the full algorithm and how to ensure that all bounds simultaneously hold in Appendix F.5.

Original: Because the expectations only require sampling from four-dimensional normal distributions and do not depend on base classifier g , one can use a large number of samples to obtain narrow bounds at little computational cost (e.g. 0 .
Revised: Because the expectations only require sampling from four-dimensional normal distributions and do not depend on base classifier g , one can use a large number of samples to obtain narrow bounds at little computational cost (e.g. 0 .

Original: 59s for 100000 samples per confidence bound on an Intel Xeon E5-2630 CPU).
Revised: 59s for 100000 samples per confidence bound on an Intel Xeon E5-2630 CPU).

Original: 6.4 Rotation invariance in 3D
Revised: 6.4 Rotation invariance in 3D

Original: To evaluate the tight certificate for 3D rotation invariance (i.e. T = SO (3) ), we adopt the same Monte
Revised: To evaluate the tight certificate for 3D rotation invariance (i.e. T = SO (3) ), we adopt the same Monte

Original: Carlo evaluation approach discussed in Section 6.3.
Revised: Carlo evaluation approach discussed in Section 6.3.

Original: Different from 2D rotation invariance, evaluating the worst-case classifier analytically is not tractable.
Revised: Different from 2D rotation invariance, evaluating the worst-case classifier analytically is not tractable.

Original: It can however be evaluated by numerical integration over an Euler angle parameterization of rotation group SO (3) (see Appendix F.4.3).
Revised: It can however be evaluated by numerical integration over an Euler angle parameterization of rotation group SO (3) (see Appendix F.4.3).

Original: 6.5 Roto-translation invariance in 2D and 3D
Revised: 6.5 Roto-translation invariance in 2D and 3D

Original: In Appendix F.4.4 we prove that additionally enforcing translation invariance (i.e. T = SE ( D ) ) is equivalent to centering X and ∆ before evaluating the certificates for rotation invariance.
Revised: In Appendix F.4.4 we prove that additionally enforcing translation invariance (i.e. T = SE ( D ) ) is equivalent to centering X and ∆ before evaluating the certificates for rotation invariance.

Original: This is consistent with our result from Section 6.2, i.e. the orbit-based approach being optimal for translation.
Revised: This is consistent with our result from Section 6.2, i.e. the orbit-based approach being optimal for translation.

Original:  Limitations and broader impact
Revised:  Limitations and broader impact

Original: The main limitation of our work lies in its exploratory nature.
Revised: The main limitation of our work lies in its exploratory nature.

Original: We have derived the first certificates for models invariant under arbitrary Euclidean isometries and/or permutation.
Revised: We have derived the first certificates for models invariant under arbitrary Euclidean isometries and/or permutation.

Original: While these invariances are of key importance to many practical applications , there is a vast swath of invariances that we have not covered, such as spatio-temporal invariances [44], invariance under graph isometries [9] or invariances for planar images [7].
Revised: While these invariances are of key importance to many practical applications , there is a vast swath of invariances that we have not covered, such as spatio-temporal invariances [44], invariance under graph isomorphisms [9] or invariances for planar images [7].

Original: Furthermore, we have not yet derived tight certificates for reflections and permutations (though our certification methodology could conceivably be applied to them).
Revised: Furthermore, we have not yet derived tight certificates for reflections and permutations (though our certification methodology could conceivably be applied to them).

Original: Broader impact.
Revised: Broader impact.

Original: With the growing prevalence of machine learning in safety-critical and sensitive domains like autonomous driving [118, 119] or healthcare [120, 121], trustworthy models promise to become increasingly important.
Revised: With the growing prevalence of machine learning in safety-critical and sensitive domains like autonomous driving [118, 119] or healthcare [120, 121], trustworthy models promise to become increasingly important.

Original: Certification is one pillar of trustworthiness, alongside concepts like fairness [122, 123] or differential privacy [124, 125].
Revised: Certification is one pillar of trustworthiness, alongside concepts like fairness [122, 123] or differential privacy [124, 125].

Original: Unique to our work is that we certify models
Revised: Unique to our work is that we certify models

Original: [Figure]
Revised: [Figure]

Original: ||
Revised: ||

Original: [Figure]
Revised: [Figure]

Original: |
Revised: |

Original: [Figure]
Revised: [Figure]

Original: ||X||
Revised: ||X||

Original: [Figure]
Revised: [Figure]

Original: ||X||=
Revised: ||X||=

Original: [Figure]
Revised: [Figure]

Original: ||X||
Revised: ||X||

Original: [Figure]
Revised: [Figure]

Original: and varying || ∆ || and || X
Revised: and varying || ∆ || and || X

Original: || (smaller p min is bet- ter).
Revised: || (smaller p min is bet- ter).

Original: As || X || increases, the difference between the certificates shrinks.
Revised: As || X || increases, the difference between the certificates shrinks.

Original: [Figure]
Revised: [Figure]

Original: ˜ (cid:15)
Revised: ˜ (cid:15)

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: ||
Revised: ||

Original: ∆ ||
Revised: ∆ ||

Original: =1.
Revised: =1.

Original: -   ˜ (cid:15)-  1 || ∆ ||
Revised: -   ˜ (cid:15)-  1 || ∆ ||

Original: =1.
Revised: =1.

Original: 0 .0 .0 .d ( p min ) with spatial invariances.
Revised: 0 .0 .0 .d ( p min ) with spatial invariances.

Original: These invariances naturally occur in the physical sciences, including those with a direct societal impact like pharmacology and biochemistry.
Revised: These invariances naturally occur in the physical sciences, including those with a direct societal impact like pharmacology and biochemistry.

Original: Our work can be seen as a first step towards provable trustworthiness for tasks like drug discovery [39–41] or protein folding [45–49].
Revised: Our work can be seen as a first step towards provable trustworthiness for tasks like drug discovery [39–41] or protein folding [45–49].

Original:  Experimental evaluation
Revised:  Experimental evaluation

Original: We already know that the orbit-based certificate for translation invariance is tight and certifies robustness for an infinitely larger volume than black-box randomized smoothing (see Fig. 1).
Revised: We already know that the orbit-based certificate for translation invariance is tight and certifies robustness for an infinitely larger volume than black-box randomized smoothing (see Fig. 1).

Original: Therefore, we focus our experiments on the certificates for rotation invariance.
Revised: Therefore, we focus our experiments on the certificates for rotation invariance.

Original: Recall that the orbit-based certificate guarantees robustness for the set ˜ B = (cid:8) X ′ |
Revised: Recall that the orbit-based certificate guarantees robustness for the set ˜ B = (cid:8) X ′ |

Original: ||
Revised: ||

Original: X ′ R T − X
Revised: X ′ R T − X

Original: || 2 < r (cid:9) with r = σ Φ − 1 ( p X ,y ∗ ) and optimal rotation matrix R .
Revised: || 2 < r (cid:9) with r = σ Φ − 1 ( p X ,y ∗ ) and optimal rotation matrix R .

Original: In other words: It certifies robustness for perturbations with rotational components that can be eliminated to bring X ′ into distance r of
Revised: In other words: It certifies robustness for perturbations with rotational components that can be eliminated to bring X ′ into distance r of

Original: X .
Revised: X .

Original: We want to understand whether the tight certificates offer any benefit beyond that, or if the strict inequality in Theorem 5 is due to some negligible ϵ .
Revised: We want to understand whether the tight certificates offer any benefit beyond that, or if the strict inequality in Theorem 5 is due to some negligible ϵ .

Original: To this end, we first thoroughly examine the four-dimensional parameter space of the tight certificate for rotation invariance in 2D, before applying our certificates to rotation invariant point cloud classifiers.
Revised: To this end, we first thoroughly examine the four-dimensional parameter space of the tight certificate for rotation invariance in 2D, before applying our certificates to rotation invariant point cloud classifiers.

Original: All parameters and experimental details are specified in Appendix B.
Revised: All parameters and experimental details are specified in Appendix B.

Original: We use 10000 samples per confidence bound and set α = 0 .
Revised: We use 10000 samples per confidence bound and set α = 0 .

Original: 001 , i.e. all certificates hold with 99 . 9% probability.
Revised: 001 , i.e. all certificates hold with 99 . 9% probability.

Original: A reference implementation will be made available at https://www.cs.cit.tum.de/daml/invariance-smoothing.
Revised: A reference implementation will be made available at https://www.cs.cit.tum.de/daml/invariance-smoothing.

Original: 8.1 Tight certificate parameter space
Revised: 8.1 Tight certificate parameter space

Original: The tight certificate for 2D rotation invariance depends on || X
Revised: The tight certificate for 2D rotation invariance depends on || X

Original: || 2 /σ , ||
Revised: || 2 /σ , ||

Original: ∆
Revised: ∆

Original: || 2 /σ and parameters ϵ 1 and ϵ 2 , which capture the orientation of the perturbed point cloud and
Revised: || 2 /σ and parameters ϵ 1 and ϵ 2 , which capture the orientation of the perturbed point cloud and

Original: fulfill (cid:112) ϵ 

Revised: fulfill (cid:112) ϵ

Original: + ϵ 22 ≤
Revised: + ϵ 22 ≤

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 · || ∆ || 2 (see Appendix J).
Revised: || 2 · || ∆ || 2 (see Appendix J).

Original: To avoid clutter, we define ˜ ϵ
Revised: To avoid clutter, we define ˜ ϵ

Original: k :=
Revised: k :=

Original: ϵ k / (
Revised: ϵ k / (

Original: || X || 2 · || ∆ || 2 ) .
Revised: || X || 2 · || ∆ || 2 ) .

Original: As our metric for this section, we report p min , the smallest probability p X ,y ∗ for which a prediction can still be certified
Revised: As our metric for this section, we report p min , the smallest probability p X ,y ∗ for which a prediction can still be certified

Original: Adversarial scaling.
Revised: Adversarial scaling.

Original: First, we assume that X ′ =
Revised: First, we assume that X ′ =

Original: (1 + c ) X , i.e. the input is adversarially scaled.
Revised: (1 + c ) X , i.e. the input is adversarially scaled.

Original: In this case, we have ˜ ϵ
Revised: In this case, we have ˜ ϵ

Original: = 1 and ˜ ϵ
Revised: = 1 and ˜ ϵ

Original: 2 = 0 .
Revised: 2 = 0 .

Original: We then vary || ∆ || 

Revised: We then vary || ∆ ||

Original: and || X
Revised: and || X

Original: || 

Revised: ||

Original: and evaluate our certificates.
Revised: and evaluate our certificates.

Original: Note that such attacks have no rotational component, i.e. the orbit-based certificate is identical to the black-box one.
Revised: Note that such attacks have no rotational component, i.e. the orbit-based certificate is identical to the black-box one.

Original: Fig.
Revised: Fig.

Original: 2 shows that, even in the absence of rotations, the tight certificate can yield significantly stronger guarantees.
Revised: 2 shows that, even in the absence of rotations, the tight certificate can yield significantly stronger guarantees.

Original: For σ = 0 .
Revised: For σ = 0 .

Original: 5 and || X
Revised: 5 and || X

Original: || 2 = 0 .
Revised: || 2 = 0 .

Original: 01 , the baseline can only certify robustness for a prediction with p X ,y ∗ = 0 .
Revised: 01 , the baseline can only certify robustness for a prediction with p X ,y ∗ = 0 .

Original: if || ∆ || 2 ≤ 0 . 4 .
Revised: if || ∆ || 2 ≤ 0 . 4 .

Original: The tight certificate can certify robustness up to || ∆ ||
Revised: The tight certificate can certify robustness up to || ∆ ||

Original: 2 = 0 .
Revised: 2 = 0 .

Original: However, the gap shrinks, as the norm of the clean data increases.
Revised: However, the gap shrinks, as the norm of the clean data increases.

Original: Effect of data norm.
Revised: Effect of data norm.

Original: We would like to see if this is a pervasive pattern.
Revised: We would like to see if this is a pervasive pattern.

Original: To this end, we fix || ∆ || 2 , gradually increase
Revised: To this end, we fix || ∆ || 2 , gradually increase

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 , and evaluate the tight certificate for ˜ ϵ 1 , ˜ ϵ 2 on a 100 × 100 rasterization of [0 , 1] ×
Revised: || 2 , and evaluate the tight certificate for ˜ ϵ 1 , ˜ ϵ 2 on a 100 × 100 rasterization of [0 , 1] ×

Original: We then measure the difference d ( p min ) to the black-box certificate (we will discuss
Revised: We then measure the difference d ( p min ) to the black-box certificate (we will discuss

Original: -   ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: -   ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =10.
Revised: || =10.

Original: .d
Revised: .d

Original: ( p min )
Revised: ( p min )

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: how these results relate to the orbit-based one shortly).
Revised: how these results relate to the orbit-based one shortly).

Original: Fig.
Revised: Fig.

Original: 4 shows that for small ||
Revised: 4 shows that for small ||

Original: X
Revised: X

Original: || 2 , the tight certificate outperforms the black-box certificate for arbitrary perturbations of norm ||
Revised: || 2 , the tight certificate outperforms the black-box certificate for arbitrary perturbations of norm ||

Original: ∆
Revised: ∆

Original: || 2 .
Revised: || 2 .

Original: But, as || X || 2 increases, the regions where it outperforms the black-box one shrink.
Revised: But, as || X || 2 increases, the regions where it outperforms the black-box one shrink.

Original: Rotational components.
Revised: Rotational components.

Original: Simple algebra (see Appendix J) shows that for any combination of || X || 2 and || ∆ || 2 , adversarial rotations, i.e. X ′ =
Revised: Simple algebra (see Appendix J) shows that for any combination of || X || 2 and || ∆ || 2 , adversarial rotations, i.e. X ′ =

Original: XR T such that || X
Revised: XR T such that || X

Original: ′ − X
Revised: ′ − X

Original: ||
Revised: ||

Original: =
Revised: =

Original: ||
Revised: ||

Original: ∆ || , correspond to two specific points with (cid:112) ˜
Revised: ∆ || , correspond to two specific points with (cid:112) ˜

Original: ϵ 

Revised: ϵ

Original: + ˜ ϵ 22 = 1 in the certificate’s parameter space.
Revised: + ˜ ϵ 22 = 1 in the certificate’s parameter space.

Original: In Fig.
Revised: In Fig.

Original: 3 we fix σ = 0 .
Revised: 3 we fix σ = 0 .

Original: 5 and || X
Revised: 5 and || X

Original: || 

Revised: ||

Original: = 1 , vary ||
Revised: = 1 , vary ||

Original: ∆ || and highlight these two points.
Revised: ∆ || and highlight these two points.

Original: We observe that the tight certificate only out- performs the black-box certificate for values of ˜ ϵ 1 , ˜ ϵ 2 that are close to adversarial rotations.
Revised: We observe that the tight certificate only out- performs the black-box certificate for values of ˜ ϵ 1 , ˜ ϵ 2 that are close to adversarial rotations.

Original: However, robustness to such attacks can also be readily certified by the orbit-based approach.
Revised: However, robustness to such attacks can also be readily certified by the orbit-based approach.

Original: Combined with our previous observations, and because the certificate only depends on norms relative to smoothing standard deviation σ ,
Revised: Combined with our previous observations, and because the certificate only depends on norms relative to smoothing standard deviation σ ,

Original: i.e. || X
Revised: i.e. || X

Original: || 2 /σ and || ∆
Revised: || 2 /σ and || ∆

Original: || 2 /σ , we expect the tight and the orbit-based certificate to perform similarly well, assuming that the smoothing standard deviation σ is small relative to ||
Revised: || 2 /σ , we expect the tight and the orbit-based certificate to perform similarly well, assuming that the smoothing standard deviation σ is small relative to ||

Original: X
Revised: X

Original: || 2 .
Revised: || 2 .

Original: 8.2 Application to point cloud classification
Revised: 8.2 Application to point cloud classification

Original: To verify whether our observations hold in practice, we apply our certificates to point cloud classification.
Revised: To verify whether our observations hold in practice, we apply our certificates to point cloud classification.

Original: We consider two datasets: 3D point cloud representations of ModelNet40 [126], which consists of CAD models from 40 different categories, and 2D point cloud representations of MNIST [127].
Revised: We consider two datasets: 3D point cloud representations of ModelNet40 [126], which consists of CAD models from 40 different categories, and 2D point cloud representations of MNIST [127].

Original: We apply the same pre-processing steps as in [6].
Revised: We apply the same pre-processing steps as in [6].

Original: Certification is performed on the default test sets.
Revised: Certification is performed on the default test sets.

Original: As our base classifiers, we use rotation and translation (i.e. SE ( D ) ) invariant versions of two well-established models that are used in prior work on robustness certification for point clouds:
Revised: As our base classifiers, we use rotation and translation (i.e. SE ( D ) ) invariant versions of two well-established models that are used in prior work on robustness certification for point clouds:

Original: PointNet [6] and DGCNN [128].
Revised: PointNet [6] and DGCNN [128].

Original: To implement the invariances, we center the input data, perform principal component analysis, apply the model to all possible poses (see discussion in [129, 130]) and average the output logits (EnsPointNet and EnsDGCNN).
Revised: To implement the invariances, we center the input data, perform principal component analysis, apply the model to all possible poses (see discussion in [129, 130]) and average the output logits (EnsPointNet and EnsDGCNN).

Original: In addition, we consider a more refined model [129] that combines canonical poses via a self-attention mechanism (AttnPointNet).
Revised: In addition, we consider a more refined model [129] that combines canonical poses via a self-attention mechanism (AttnPointNet).

Original: Throughout this section, we report both probabilistic upper and lower bounds for the Monte Carlo evaluation of the tight certificates (recall Section 6.3).
Revised: Throughout this section, we report both probabilistic upper and lower bounds for the Monte Carlo evaluation of the tight certificates (recall Section 6.3).

Original: θ / deg 0 .0 .0 .0 .0 .1 .
Revised: θ / deg 0 .0 .0 .0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: SE (2) Tight
Revised: SE (2) Tight

Original: SE (2) Orbit
Revised: SE (2) Orbit

Original: Black-box (a) EnsPointNet on MNIST      θ / deg 0 .0 .0 .

Revised: Black-box (a) EnsPointNet on MNIST      θ / deg 0 .0 .0 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: SE (3) Tight
Revised: SE (3) Tight

Original: SE (3) Orbit
Revised: SE (3) Orbit

Original: Black-box (b) EnsDGCNN on ModelNet
Revised: Black-box (b) EnsDGCNN on ModelNet

Original: Practical smoothing parameters.
Revised: Practical smoothing parameters.

Original: Fig.
Revised: Fig.

Original: 5 shows the test set accuracies of randomly smoothed models under varying standard deviations σ .
Revised: 5 shows the test set accuracies of randomly smoothed models under varying standard deviations σ .

Original: Values of σ that preserve an accuracy above 50% are small, relative to the average norm of the test sets ( 10 .
Revised: Values of σ that preserve an accuracy above 50% are small, relative to the average norm of the test sets ( 10 .

Original: 67 for MNIST, 19 .
Revised: 67 for MNIST, 19 .

Original: 17 for ModelNet40).
Revised: 17 for ModelNet40).

Original: Going by our previous results, we expect the tight and orbit-based certificates to perform similarly well.
Revised: Going by our previous results, we expect the tight and orbit-based certificates to perform similarly well.

Original: Adversarial scaling.
Revised: Adversarial scaling.

Original: In Fig.
Revised: In Fig.

Original: 6 we again consider adversarial scaling, i.e. attacks without rotational components, but applied to the MNIST point cloud dataset with σ = 0 .
Revised: 6 we again consider adversarial scaling, i.e. attacks without rotational components, but applied to the MNIST point cloud dataset with σ = 0 .

Original: We report the certified accuracy, i.e. the percentage of correct and provably robust predictions, for certification with ( SE (2) ) and without ( SO (2) ) translation invariance.
Revised: We report the certified accuracy, i.e. the percentage of correct and provably robust predictions, for certification with ( SE (2) ) and without ( SO (2) ) translation invariance.

Original: The tight and orbit-based certificate yield similar results.
Revised: The tight and orbit-based certificate yield similar results.

Original: We further observe that enforcing translation invariance increases the certified accuracy and extends the range of || ∆ || for which robustness can be certified.
Revised: We further observe that enforcing translation invariance increases the certified accuracy and extends the range of || ∆ || for which robustness can be certified.

Original: Rotational components.
Revised: Rotational components.

Original: Finally, we study perturbations with rotational components.
Revised: Finally, we study perturbations with rotational components.

Original: We fix || ∆ || , randomly sample perturbations of the specified norm and then rotate Z = X + ∆ by a specified angle θ ∈ [0 , 10 ◦ ] (in the case of ModelNet40, around one randomly chosen axis).
Revised: We fix || ∆ || , randomly sample perturbations of the specified norm and then rotate Z = X + ∆ by a specified angle θ ∈ [0 , 10 ◦ ] (in the case of ModelNet40, around one randomly chosen axis).

Original: For each element of the test set and each θ , we generate 10 such samples.
Revised: For each element of the test set and each θ , we generate 10 such samples.

Original: We then compute the percentage of samples X ′ for which f ( X ) is correct and f ( X ′ )
Revised: We then compute the percentage of samples X ′ for which f ( X ) is correct and f ( X ′ )

Original: =
Revised: =

Original: f ( X ) is provably guaranteed (“probabilistic certified accuracy”).
Revised: f ( X ) is provably guaranteed (“probabilistic certified accuracy”).

Original: Fig.
Revised: Fig.

Original: 7 shows results for MNIST and ModelNet40 evaluated with || ∆ ||
Revised: 7 shows results for MNIST and ModelNet40 evaluated with || ∆ ||

Original: = σ = 0 .
Revised: = σ = 0 .

Original: The black-box baseline’s probabilistic certified accuracy drops close to 0 for θ = 2 ◦ .
Revised: The black-box baseline’s probabilistic certified accuracy drops close to 0 for θ = 2 ◦ .

Original: The gray-box certificates are almost constant in θ , i.e. effectively eliminate any induced rotation.
Revised: The gray-box certificates are almost constant in θ , i.e. effectively eliminate any induced rotation.

Original: However, the tight certificate did not offer any meaningful benefit beyond that.
Revised: However, the tight certificate did not offer any meaningful benefit beyond that.

Original: Using the lower bound for Monte Carlo evaluation, there was not a single sample for which only the tight certificate could guarantee robustness.
Revised: Using the lower bound for Monte Carlo evaluation, there was not a single sample for which only the tight certificate could guarantee robustness.

Original: In Appendix A we repeat the experiments from this and the previous section for various other combinations of parameter values.
Revised: In Appendix A we repeat the experiments from this and the previous section for various other combinations of parameter values.

Original: All results are consistent with the ones presented here, confirming that the orbit-based approach offers a good approximation of the tight certificates in practice.
Revised: All results are consistent with the ones presented here, confirming that the orbit-based approach offers a good approximation of the tight certificates in practice.

Original:  Conclusion
Revised:  Conclusion

Original: For the first time, we have studied the use of invariances for robustness certification.
Revised: For the first time, we have studied the use of invariances for robustness certification.

Original: We proposed a gray-box approach, combining white-box knowledge about invariances with black-box randomized smoothing.
Revised: We proposed a gray-box approach, combining white-box knowledge about invariances with black-box randomized smoothing.

Original: We have derived a orbit-based procedure for certification that can be applied to arbitrary models with invariance to permutations and Euclidean isometries.
Revised: We have derived a orbit-based procedure for certification that can be applied to arbitrary models with invariance to permutations and Euclidean isometries.

Original: We have proven that the orbit-based certificate for translation invariance is tight and derived strictly stronger certificates for rotation invariance.
Revised: We have proven that the orbit-based certificate for translation invariance is tight and derived strictly stronger certificates for rotation invariance.

Original: Our experiments are to be interpreted in two ways: Firstly, the fact that it is possible to derive tight invariance-aware certificates and that there exist scenarios in which they offer stronger guarantees for arbitrary perturbations should be an exciting inspiration for future work.
Revised: Our experiments are to be interpreted in two ways: Firstly, the fact that it is possible to derive tight invariance-aware certificates and that there exist scenarios in which they offer stronger guarantees for arbitrary perturbations should be an exciting inspiration for future work.

Original: Secondly, the fact that the orbit-based certificates are easily interpretable and offer good approximations of our tight certificates should invite their application to real-world tasks with inherent invariances.
Revised: Secondly, the fact that the orbit-based certificates are easily interpretable and offer good approximations of our tight certificates should invite their application to real-world tasks with inherent invariances.

Original: Acknowledgements.
Revised: Acknowledgements.

Original: The authors would like to thank Johannes Gasteiger for valuable discussions on invariant deep learning and Lukas Gosch for constructive criticism of the manuscript.
Revised: The authors would like to thank Johannes Gasteiger for valuable discussions on invariant deep learning and Lukas Gosch for constructive criticism of the manuscript.

Original: This research was supported by the German Research Foundation, grant GU 1409/4-1.
Revised: This research was supported by the German Research Foundation, grant GU 1409/4-1.

Original: A Additional experiments
Revised: A Additional experiments

Original: A.1 Tight certificate parameter space . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: A.1 Tight certificate parameter space . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: A.2 Application to point cloud classification . . . . . . . . . . . . . . . . . . . . . . .
Revised: A.2 Application to point cloud classification . . . . . . . . . . . . . . . . . . . . . . .

Original: BFull
Revised: B

Original:  experimental
Revised: Full experimental

Original: setup
Revised: setup

Original: B.1 Models, data and training parameters . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: B.1 Models, data and training parameters . . . . . . . . . . . . . . . . . . . . . . . . .

Original: B.2 Randomized smoothing parameters . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: B.2 Randomized smoothing parameters . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: B.3 Computational resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: B.3 Computational resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: B.4 Third-party assets . .
Revised: B.4 Third-party assets . .

Original: C Group definitions
Revised: C Group definitions

Original: D Proof of Theorem
Revised: D Proof of Theorem

Original: E Orbit-based gray-box certificates
Revised: E Orbit-based gray-box certificates

Original: E.1 Proof of Theorem 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: E.1 Proof of Theorem 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: E.2 Explicit characterizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: E.2 Explicit characterizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: F Tight gray-box certificates
Revised: F Tight gray-box certificates

Original: F.
Revised: F.

Original: Proof of Lemma 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: Proof of Lemma 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: F.
Revised: F.

Original: Neyman-Pearson Lemma . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: Neyman-Pearson Lemma . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: F.
Revised: F.

Original: Proof of Theorem 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: Proof of Theorem 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Original: F.
Revised: F.

Original: Group-specific certificates . .
Revised: Group-specific certificates . .

Original: F.4.
Revised: F.4.

Original: Translation invariance . . .
Revised: Translation invariance . . .

Original: F.4.
Revised: F.4.

Original: Rotation invariance in2D . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: Rotation invariance in

Original: F.4.
Revised: [Table]

Original:  Rotation invariance in 3D . . . . . . . . . . . . . . . . . . . . . . . . . .
Revised: [Table] Rotation invariance [Table]

Original: F.4.
Revised: F.4.

Original: Roto-translation invariance in
Revised: Roto-

Original: [Table]
Revised: [Table]

Original: and 3D . . . . . . . . . . . . . . . . . . F.
Revised: [Table]

Original: Monte Carlo certification . .
Revised: Monte Carlo certification . .

Original: G Proof of Theorem
Revised: G Proof of Theorem

Original: H Multi-class certificates
Revised: H Multi-class certificates

Original: I Inverse certificates
Revised: I Inverse certificates

Original: J Parameter space of the tight certificate for rotation invariance in 2D
Revised: J Parameter space of the tight certificate for rotation invariance in 2D

Original: J.
Revised: J.

Original: Feasible parameter range . .
Revised: Feasible parameter range . .

Original: J.
Revised: J.

Original: Adversarial rotations . .
Revised: Adversarial rotations . .

Original: A Additional experiments
Revised: A Additional experiments

Original: In the following, we repeat the experiments from Section 8 for a wider range of certificate and model parameters.
Revised: In the following, we repeat the experiments from Section 8 for a wider range of certificate and model parameters.

Original: In Appendix A.1, we investigate the parameter space of the tight certificate for rotation invariance in 2D. In Appendix A.2, we again apply our certificates to rotation invariant point cloud classifiers, this time considering all three models (EnsPointNet, AttnPointNet and EnsDGCNN) and different smoothing distribution parameters.
Revised: In Appendix A.1, we investigate the parameter space of the tight certificate for rotation invariance in 2D. In Appendix A.2, we again apply our certificates to rotation invariant point cloud classifiers, this time considering all three models (EnsPointNet, AttnPointNet and EnsDGCNN) and different smoothing distribution parameters.

Original: As before, we take 10000 samples per confidence bound and set α = 0 .
Revised: As before, we take 10000 samples per confidence bound and set α = 0 .

Original: 001 , i.e. all certificates hold with 99 . 9% probability.
Revised: 001 , i.e. all certificates hold with 99 . 9% probability.

Original: All results support our main conclusion from Section 8: The tight certificates for rotation invariance can offer much stronger robustness guarantees than their orbit-based counterparts.
Revised: All results support our main conclusion from Section 8: The tight certificates for rotation invariance can offer much stronger robustness guarantees than their orbit-based counterparts.

Original: However, in practical scenarios, where the smoothing standard deviation is small relative to the norm of the clean data, the orbit-based approach offers a very good approximation.
Revised: However, in practical scenarios, where the smoothing standard deviation is small relative to the norm of the clean data, the orbit-based approach offers a very good approximation.

Original: A.1 Tight certificate parameter space
Revised: A.1 Tight certificate parameter space

Original: For this section, recall that the tight certificate for 2D rotation invariance depends on || X
Revised: For this section, recall that the tight certificate for 2D rotation invariance depends on || X

Original: || 2 , ||
Revised: || 2 , ||

Original: ∆ ||and parameters ϵ 1 = ⟨ X , ∆ ⟩ F , ϵ 2 = (cid:68) XR ( − π / 2 ) T , ∆ (cid:69) F , as well as smoothing standard deviation σ .
Revised: ∆ ||and parameters ϵ 1 = ⟨ X , ∆ ⟩ F , ϵ 2 = (cid:68) XR ( − π / 2 ) T , ∆ (cid:69) F , as well as smoothing standard deviation σ .

Original: We define ˜ ϵ 

Revised: We define ˜ ϵ

Original: = ϵ 1 || X ||·|| ∆ ||
Revised: = ϵ 1 || X ||·|| ∆ ||

Original: and ˜ ϵ 

Revised: and ˜ ϵ

Original: = ϵ 2 || X ||·|| ∆ || .
Revised: = ϵ 2 || X ||·|| ∆ || .

Original: Note that (cid:112) ˜
Revised: Note that (cid:112) ˜

Original: ϵ 

Revised: ϵ

Original: + ˜ ϵ 22 ≤ 1 (see also Appendix J).
Revised: + ˜ ϵ 22 ≤ 1 (see also Appendix J).

Original: A.1.1 Adversarial scaling
Revised: A.1.1 Adversarial scaling

Original: We begin with adversarial scaling, which corresponds to ˜ ϵ 1 = 1 , ˜ ϵ 2 = 0 .
Revised: We begin with adversarial scaling, which corresponds to ˜ ϵ 1 = 1 , ˜ ϵ 2 = 0 .

Original: We consider σ ∈ { 0 . 1 , 0 .
Revised: We consider σ ∈ { 0 . 1 , 0 .

Original: For each σ , we vary ||
Revised: For each σ , we vary ||

Original: X
Revised: X

Original: || 2 and || ∆ ||
Revised: || 2 and || ∆ ||

Original: and compute p min , the smallest value of p
Revised: and compute p min , the smallest value of p

Original: X ,y ∗ for which a prediction can still be certified (see Appendix I).
Revised: X ,y ∗ for which a prediction can still be certified (see Appendix I).

Original: Lower p min mean that the certificate can guarantee robustness for models that are less consistent in their predictions.
Revised: Lower p min mean that the certificate can guarantee robustness for models that are less consistent in their predictions.

Original: Fig.
Revised: Fig.

Original: 8 shows that, if the clean data norm is small, e.g. ||
Revised: 8 shows that, if the clean data norm is small, e.g. ||

Original: X
Revised: X

Original: || = 0 .
Revised: || = 0 .

Original: 01 , then the tight certificate yields much lower p min than the orbit-based one, save for very small and very large values of || ∆ || .
Revised: 01 , then the tight certificate yields much lower p min than the orbit-based one, save for very small and very large values of || ∆ || .

Original: That is, the tight certificate for rotation invariance is beneficial even for adversarial perturbations that do not have any rotational components.
Revised: That is, the tight certificate for rotation invariance is beneficial even for adversarial perturbations that do not have any rotational components.

Original: However, as || X || approaches σ , this difference shrinks, i.e. both approaches offer guarantees of similar strength.
Revised: However, as || X || approaches σ , this difference shrinks, i.e. both approaches offer guarantees of similar strength.

Original: [Figure]
Revised: [Figure]

Original: .||
Revised: .||

Original: ∆ || 0 .0 .

Revised: ∆ || 0 .0 .

Original: .p
Revised: .p

Original: m i n
Revised: m i n

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit ||X||=0.
Revised: SO (2) Orbit ||X||=0.

Original: ||X||=0.
Revised: ||X||=0.

Original: ||X||=0. ||X||=0.
Revised: ||X||=0. ||X||=0.

Original: (b) σ = 0 .0 .

Revised: (b) σ = 0 .0 .

Original: .||
Revised: .||

Original: ∆ || 0 .0 .

Revised: ∆ || 0 .0 .

Original: .p
Revised: .p

Original: m i n
Revised: m i n

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit ||X||=0.
Revised: SO (2) Orbit ||X||=0.

Original: ||X||=0.
Revised: ||X||=0.

Original: ||X||=0. ||X||=0.
Revised: ||X||=0. ||X||=0.

Original: (c) σ = 0 .0 .0 .0 .0 .0 .0 .

Revised: (c) σ = 0 .0 .0 .0 .0 .0 .0 .

Original: .||
Revised: .||

Original: ∆ || 0 .0 .

Revised: ∆ || 0 .0 .

Original: .p
Revised: .p

Original: m i n
Revised: m i n

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit ||X||=0.
Revised: SO (2) Orbit ||X||=0.

Original: ||X||=0.
Revised: ||X||=0.

Original: ||X||=0. ||X||=0.
Revised: ||X||=0. ||X||=0.

Original: (d) σ = 0 .0 . 00 0 .
Revised: (d) σ = 0 .0 . 00 0 .

Original: 1 . 25 1 .|| ∆ || 0 .0 .

Revised: 1 . 25 1 .|| ∆ || 0 .0 .

Original: .p
Revised: .p

Original: m i n
Revised: m i n

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit ||X||=0.
Revised: SO (2) Orbit ||X||=0.

Original: ||X||=0.
Revised: ||X||=0.

Original: ||X||=0. ||X||=0.
Revised: ||X||=0. ||X||=0.

Original: (e) σ = 0 .0 .0 .1 .1 .2 .2 .||
Revised: (e) σ = 0 .0 .0 .1 .1 .2 .2 .||

Original: ∆ || 0 .0 .

Revised: ∆ || 0 .0 .

Original: .p
Revised: .p

Original: m i n
Revised: m i n

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit ||X||=1.
Revised: SO (2) Orbit ||X||=1.

Original: ||X||=0.
Revised: ||X||=0.

Original: ||X||=0. ||X||=0.
Revised: ||X||=0. ||X||=0.

Original: (f) σ = 1 .
Revised: (f) σ = 1 .

Original: A.1.2 Effect of clean data norm on certificates for arbitrary perturbations
Revised: A.1.2 Effect of clean data norm on certificates for arbitrary perturbations

Original: Next, we study whether the same effect can be observed with arbitrary perturbations, i.e. arbitrary values of ˜ ϵ 1 and ˜ ϵ 2 .
Revised: Next, we study whether the same effect can be observed with arbitrary perturbations, i.e. arbitrary values of ˜ ϵ 1 and ˜ ϵ 2 .

Original: In Fig.
Revised: In Fig.

Original: 4 from Section 8.1, we fixed a specific combination of σ and || ∆ || , varied
Revised: 4 from Section 8.1, we fixed a specific combination of σ and || ∆ || , varied

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 

Revised: ||

Original: and evaluated the tight certificate for ˜ ϵ 1 , ˜ ϵ 2 taken from a 100 × 100 rasterization of [0 , 1] × [0 , 1] .
Revised: and evaluated the tight certificate for ˜ ϵ 1 , ˜ ϵ 2 taken from a 100 × 100 rasterization of [0 , 1] × [0 , 1] .

Original: We then measured the difference d ( p min ) to the black-box certificate.
Revised: We then measured the difference d ( p min ) to the black-box certificate.

Original: Here, we consider different combinations of σ , || ∆ || and || X
Revised: Here, we consider different combinations of σ , || ∆ || and || X

Original: || .
Revised: || .

Original: We can reduce the dimensionality of the parameter space that needs to be explored by observing that both the tight gray-box and the black-box certificate do not depend on the absolute value of these parameters, but their value relative to σ .
Revised: We can reduce the dimensionality of the parameter space that needs to be explored by observing that both the tight gray-box and the black-box certificate do not depend on the absolute value of these parameters, but their value relative to σ .

Original: The black-box baseline has p min =
Revised: The black-box baseline has p min =

Original: Φ( || ∆ || 2 / σ ) .
Revised: Φ( || ∆ || 2 / σ ) .

Original: As specified in Appendix F.4.2, the tight certificate depends on || X
Revised: As specified in Appendix F.4.2, the tight certificate depends on || X

Original: || 22 / σ 2 , ||
Revised: || 22 / σ 2 , ||

Original: ∆ || 22 / σ 2 , ϵ 1 / σ 2 = 1 σ 

Revised: ∆ || 22 / σ 2 , ϵ 1 / σ 2 = 1 σ

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 · || ∆ || 2 · cos( θ 1 ) andσ 2 /
Revised: || 2 · || ∆ || 2 · cos( θ 1 ) andσ 2 /

Original: ||
Revised: ||

Original: X || 2 · || ∆ || 2 · cos( θ 1 ) , where θ 1 , θ 2 are angles between 2 N -dimensional vectors.
Revised: X || 2 · || ∆ || 2 · cos( θ 1 ) , where θ 1 , θ 2 are angles between 2 N -dimensional vectors.

Original: Therefore, we can fix an arbitrary value of σ and then choose ||
Revised: Therefore, we can fix an arbitrary value of σ and then choose ||

Original: X
Revised: X

Original: || 2 and || ∆ || 2 relative to it.
Revised: || 2 and || ∆ || 2 relative to it.

Original: We set set σ = 1 and consider || ∆ || 2 ∈ { 14 σ, 12 σ, σ, 2 σ, 3 σ } , i.e. perturbation norms that are much smaller, similar to or much larger than the smoothing standard deviation.
Revised: We set set σ = 1 and consider || ∆ || 2 ∈ { 14 σ, 12 σ, σ, 2 σ, 3 σ } , i.e. perturbation norms that are much smaller, similar to or much larger than the smoothing standard deviation.

Original: For each || ∆ || 2 , we evaluate the tight certificate
Revised: For each || ∆ || 2 , we evaluate the tight certificate

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 ∈ { 1100 σ, 12 σ, σ, 10 σ } , i.e. clean data norms that are much smaller, similar to or much larger than the smoothing standard deviation.
Revised: || 2 ∈ { 1100 σ, 12 σ, σ, 10 σ } , i.e. clean data norms that are much smaller, similar to or much larger than the smoothing standard deviation.

Original: Fig.
Revised: Fig.

Original: 9 shows the resulting d ( p min ) .
Revised: 9 shows the resulting d ( p min ) .

Original: In the case where || ∆ || 2 ≤ 2 ||
Revised: In the case where || ∆ || 2 ≤ 2 ||

Original: X
Revised: X

Original: || 

Revised: ||

Original: we have additionally
Revised: we have additionally

Original: J
Revised: J

Original: Note
Revised: Note

Original: , to scaled
Revised: , to scaled

Original: We can make four observations.
Revised: We can make four observations.

Original: Firstly, in the case that || ∆ || 2 ≤ σ and || X
Revised: Firstly, in the case that || ∆ || 2 ≤ σ and || X

Original: ||
Revised: ||

Original: =
Revised: =

Original: the tight certificate yields lower (i.e. better) p min for arbitrary perturbations, not just those corresponding to adversarial rotations.
Revised: the tight certificate yields lower (i.e. better) p min for arbitrary perturbations, not just those corresponding to adversarial rotations.

Original: Secondly, as the clean data norm ||
Revised: Secondly, as the clean data norm ||

Original: X
Revised: X

Original: || 2 increases, the region where the tight certificate outperforms the black-box baseline shrinks.
Revised: || 2 increases, the region where the tight certificate outperforms the black-box baseline shrinks.

Original: It concentrates around values of (˜ ϵ 1 , ˜ ϵ 2 ) corresponding to adversarial rotations.
Revised: It concentrates around values of (˜ ϵ 1 , ˜ ϵ 2 ) corresponding to adversarial rotations.

Original: Thirdly, the difference in p min is not as drastic when || ∆ || 2 is small.
Revised: Thirdly, the difference in p min is not as drastic when || ∆ || 2 is small.

Original: This is to be expected.
Revised: This is to be expected.

Original: For instance, with || ∆ || 2 = σ / 4 , the black-box certificate has p min =
Revised: For instance, with || ∆ || 2 = σ / 4 , the black-box certificate has p min =

Original: Φ( σ / 4) ≈ 0 . 6 .
Revised: Φ( σ / 4) ≈ 0 . 6 .

Original: Here, the difference to the smallest possible value 0 .
Revised: Here, the difference to the smallest possible value 0 .

Original: 5 is small, meaning there is little room for improvement.
Revised: 5 is small, meaning there is little room for improvement.

Original: We already observed this in Fig. 8.
Revised: We already observed this in Fig. 8.

Original: Finally, when || ∆ || 2 is large relative to σ , and so large that ∆ cannot be the result of an adversarial rotation (e.g.
Revised: Finally, when || ∆ || 2 is large relative to σ , and so large that ∆ cannot be the result of an adversarial rotation (e.g.

Original: ||
Revised: ||

Original: ∆ || 2 = 3 ,
Revised: ∆ || 2 = 3 ,

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 = 0 . 01 ), then the tight certificate is almost identical to the black-box baseline.
Revised: || 2 = 0 . 01 ), then the tight certificate is almost identical to the black-box baseline.

Original: But, as || X || 2 increases and an adversarial rotation becomes possible (e.g. || ∆ || 2 = 3 ,
Revised: But, as || X || 2 increases and an adversarial rotation becomes possible (e.g. || ∆ || 2 = 3 ,

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 = 10 ) then the tight certificate does again yield much better p min – but only for values of (˜ ϵ 1 , ˜ ϵ 2 ) that are very close to adversarial rotations.
Revised: || 2 = 10 ) then the tight certificate does again yield much better p min – but only for values of (˜ ϵ 1 , ˜ ϵ 2 ) that are very close to adversarial rotations.

Original: In summary, these observations support our claim that, if || X || is large relative to σ , then the tight certificate only improves upon the black-box baseline for perturbations that are similar to adversarial rotations.
Revised: In summary, these observations support our claim that, if || X || is large relative to σ , then the tight certificate only improves upon the black-box baseline for perturbations that are similar to adversarial rotations.

Original: Combined with the fact that the orbit-based gray-box certificate for rotation invariance also accounts for rotational components, this suggests that the orbit-based certificate should be a good approximation in practice.
Revised: Combined with the fact that the orbit-based gray-box certificate for rotation invariance also accounts for rotational components, this suggests that the orbit-based certificate should be a good approximation in practice.

Original: In Fig.
Revised: In Fig.

Original: 10, we repeat the same experiments with σ ,
Revised: 10, we repeat the same experiments with σ ,

Original: ||
Revised: ||

Original: X
Revised: X

Original: || 2 and ||
Revised: || 2 and ||

Original: ∆ || 2 scaled by a factor of 12 , to verify that it is indeed sufficient to only consider a single, arbitrary value of σ and the relative value of all other parameters.
Revised: ∆ || 2 scaled by a factor of 12 , to verify that it is indeed sufficient to only consider a single, arbitrary value of σ and the relative value of all other parameters.

Original: As expected, the results are identical to Fig.
Revised: As expected, the results are identical to Fig.

Original: In Fig.
Revised: In Fig.

Original: 11 we perform the same experiment for fixed values of σ and ||
Revised: 11 we perform the same experiment for fixed values of σ and ||

Original: X
Revised: X

Original: || 2 and two values of || ∆ || 2 chosen such that adversarial rotations correspond to ˜ ϵ
Revised: || 2 and two values of || ∆ || 2 chosen such that adversarial rotations correspond to ˜ ϵ

Original: = ≈ 0 .
Revised: = ≈ 0 .

Original: 5 and ˜ ϵ 2 ≈ ± 0 .
Revised: 5 and ˜ ϵ 2 ≈ ± 0 .

Original: 5 , respectively (similar to Fig.
Revised: 5 , respectively (similar to Fig.

Original: 3 from Section 8.1).
Revised: 3 from Section 8.1).

Original: In other words: The adversarial rotations move in 30 ◦ -increments in the parameter space.
Revised: In other words: The adversarial rotations move in 30 ◦ -increments in the parameter space.

Original: Again, we can observe that the regions with large p min move with the adversarial rotations.
Revised: Again, we can observe that the regions with large p min move with the adversarial rotations.

Original: [Table]
Revised: [Table]

Original: ˜
Revised: ˜

Original: [Table]
Revised: [Table]

Original: ||
Revised: ||

Original: X
Revised: X

Original: ||
Revised: ||

Original: [Table]
Revised: [Table]

Original: ||
Revised: ||

Original: X
Revised: X

Original: ||
Revised: ||

Original: [Table]
Revised: [Table]

Original: ˜ (cid:15)
Revised: ˜ (cid:15)

Original: [Table]
Revised: [Table]

Original: ||
Revised: ||

Original: X
Revised: X

Original: ||
Revised: ||

Original: [Table]
Revised: [Table]

Original: -   ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: -   ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: ||
Revised: ||

Original: =1.
Revised: =1.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =10.
Revised: || =10.

Original: 0 .0 .0 .d ( p min ) (d) ||
Revised: 0 .0 .0 .d ( p min ) (d) ||

Original: ∆ ||
Revised: ∆ ||

Original: = 2 σ -   ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: = 2 σ -   ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: ||
Revised: ||

Original: =1.
Revised: =1.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =10.
Revised: || =10.

Original: 0 .0 .0 .d ( p min ) (e) ||
Revised: 0 .0 .0 .d ( p min ) (e) ||

Original: ∆ ||
Revised: ∆ ||

Original: = 3 σ
Revised: = 3 σ

Original: -   ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: -   ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜
Revised: -   ˜

Original: (cid:15)-
Revised: (cid:15)-

Original: [Table]
Revised: [Table]

Original: ||
Revised: ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: d (
Revised: d (

Original: [Table]
Revised: [Table]

Original: ) (a) || ∆ ||
Revised: ) (a) || ∆ ||

Original: =
Revised: =

Original: σ /-   
Revised: σ /-

Original: ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: [Table] [Table]
Revised: [Table] [Table]

Original: d (
Revised: d (

Original: [Table]
Revised: [Table]

Original: ) (b) ||
Revised: ) (b) ||

Original: ∆ ||
Revised: ∆ ||

Original: =
Revised: =

Original: σ /-   
Revised: σ /-

Original: ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =5.
Revised: || =5.

Original: .d
Revised: .d

Original: ( p min ) (c) ||
Revised: ( p min ) (c) ||

Original: ∆ ||
Revised: ∆ ||

Original: = σ -   ˜
Revised: = σ -   ˜

Original: (cid:15)-   ˜ (cid:15)|| X
Revised: (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =5.
Revised: || =5.

Original: 0 .0 .0 .d ( p min ) (d) ||
Revised: 0 .0 .0 .d ( p min ) (d) ||

Original: ∆ ||
Revised: ∆ ||

Original: = 2 σ -   ˜ (cid:15)-   ˜ (cid:15)|| X
Revised: = 2 σ -   ˜ (cid:15)-   ˜ (cid:15)|| X

Original: || =0.
Revised: || =0.

Original: -   ˜ (cid:15)-  1 ||
Revised: -   ˜ (cid:15)-  1 ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =
Revised: || =

Original: -   ˜ (cid:15)-   ||
Revised: -   ˜ (cid:15)-   ||

Original: X
Revised: X

Original: || =5.
Revised: || =5.

Original: 0 .0 .0 .d ( p min ) (e) ||
Revised: 0 .0 .0 .d ( p min ) (e) ||

Original: [Figure] ||
Revised: ∆ ||

Original: = 3 σ
Revised: = 3 σ

Original: [Table]
Revised: [Table]

Original: ˜ (cid:15)-
Revised: ˜ (cid:15)-

Original: [Table]
Revised: [Table]

Original: ˜
Revised: ˜

Original: [Table]
Revised: [Table]

Original: ||
Revised: ||

Original: ∆ || =
Revised: ∆ || =

Original: [Table] [Table]
Revised: [Table] [Table]

Original: ˜ (cid:15)
Revised: ˜ (cid:15)

Original: [Table]
Revised: [Table]

Original: ||
Revised: ||

Original: ∆ ||
Revised: ∆ ||

Original: [Table] [Table]
Revised: [Table] [Table]

Original: ˜ (cid:15)
Revised: ˜ (cid:15)

Original: [Table] [Table]
Revised: [Table] [Table]

Original: ||
Revised: ||

Original: ∆ ||
Revised: ∆ ||

Original: =1.
Revised: =1.

Original: [Table]
Revised: [Table]

Original: ˜ (cid:15)-
Revised: ˜ (cid:15)-

Original: [Table]
Revised: [Table]

Original: 1 || ∆ ||
Revised: 1 || ∆ ||

Original: =1.
Revised: =1.

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: 0 .d ( p min ) (e) σ = 1 . 0 ,
Revised: 0 .d ( p min ) (e) σ = 1 . 0 ,

Original: ||
Revised: ||

Original: X
Revised: X

Original: || = 1 .-   ˜
Revised: || = 1 .-   ˜

Original: (cid:15)-   ˜ (cid:15)|| ∆ ||
Revised: (cid:15)-   ˜ (cid:15)|| ∆ ||

Original: =2.
Revised: =2.

Original: -   ˜ (cid:15)-  1 || ∆ || =3.
Revised: -   ˜ (cid:15)-  1 || ∆ || =3.

Original: 0 .0 .0 .d ( p min ) (f) σ = 1 . 0 , ||
Revised: 0 .0 .0 .d ( p min ) (f) σ = 1 . 0 , ||

Original: X
Revised: X

Original: ||
Revised: ||

Original: = 2 .
Revised: = 2 .

Original: A.2 Application to point cloud classification
Revised: A.2 Application to point cloud classification

Original: Next, we repeat the experiments from Section 8.2 for diverse combinations of parameters and classifier architectures.
Revised: Next, we repeat the experiments from Section 8.2 for diverse combinations of parameters and classifier architectures.

Original: We focus on the case σ ≤ 0 .
Revised: We focus on the case σ ≤ 0 .

Original: 25 , where the randomly smoothed models achieve at least 50% accuracy (see Fig. 5), as even smaller accuracies are too low to be of any practical use.
Revised: 25 , where the randomly smoothed models achieve at least 50% accuracy (see Fig. 5), as even smaller accuracies are too low to be of any practical use.

Original: We first consider adversarial scaling on the point clouds constructed from MNIST (Appendix A.2.1).
Revised: We first consider adversarial scaling on the point clouds constructed from MNIST (Appendix A.2.1).

Original: We then consider perturbations with random rotation components on MNIST (Appendix A.2.2) and
Revised: We then consider perturbations with random rotation components on MNIST (Appendix A.2.2) and

Original: ModelNet40 (Appendix A.2.3).
Revised: ModelNet40 (Appendix A.2.3).

Original: For the tight certificates, we show both probabilistic upper and lower bounds obtained via Monte Carlo evaluation (recall Section 6.3).
Revised: For the tight certificates, we show both probabilistic upper and lower bounds obtained via Monte Carlo evaluation (recall Section 6.3).

Original: Note that only the lower bound is guaranteed to be a valid certificate with high probability.
Revised: Note that only the lower bound is guaranteed to be a valid certificate with high probability.

Original: A.2.1 Adversarial scaling on MNIST
Revised: A.2.1 Adversarial scaling on MNIST

Original: Fig.
Revised: Fig.

Original: 12 shows the certified accuracy (i.e. the number of correct and certifiably robust predictions) under adversarial scaling (i.e. ˜ ϵ 1 = 1 , ˜ ϵ 2 = 0 ) for the randomly smoothed EnsPointNet with different σ on the MNIST test set.
Revised: 12 shows the certified accuracy (i.e. the number of correct and certifiably robust predictions) under adversarial scaling (i.e. ˜ ϵ 1 = 1 , ˜ ϵ 2 = 0 ) for the randomly smoothed EnsPointNet with different σ on the MNIST test set.

Original: We evaluate the tight and orbit-based certificate for rotation invariance ( SO (2) ) and those for simultaneous rotation and translation invariance ( SE (2) ).
Revised: We evaluate the tight and orbit-based certificate for rotation invariance ( SO (2) ) and those for simultaneous rotation and translation invariance ( SE (2) ).

Original: In all cases, the tight and orbit-based certificates yield similar certified accuracies.
Revised: In all cases, the tight and orbit-based certificates yield similar certified accuracies.

Original: The certified accuracies of the tight certificate deviate slightly from the orbit-based ones, because we compute a probabilistic bound that holds with high probability 1 − α , rather than evaluating it exactly.
Revised: The certified accuracies of the tight certificate deviate slightly from the orbit-based ones, because we compute a probabilistic bound that holds with high probability 1 − α , rather than evaluating it exactly.

Original: The gap between the probalistic lower bound and the orbit-based certificate is particularly large for σ = 0 . 1 , which can be explained by our observations from Appendix A.1: The smaller σ is, relative to || X
Revised: The gap between the probalistic lower bound and the orbit-based certificate is particularly large for σ = 0 . 1 , which can be explained by our observations from Appendix A.1: The smaller σ is, relative to || X

Original: || 2 (which is defined by each datapoint of the test set and thus constant), the smaller the benefit of using it over the orbit-based baseline becomes.
Revised: || 2 (which is defined by each datapoint of the test set and thus constant), the smaller the benefit of using it over the orbit-based baseline becomes.

Original: Additionally enforcing translation invariance yields stronger robustness guarantees.
Revised: Additionally enforcing translation invariance yields stronger robustness guarantees.

Original: For instance, with σ = 0 . 2 , the SE (2) certificates can still certify some predictions for || ∆ ||
Revised: For instance, with σ = 0 . 2 , the SE (2) certificates can still certify some predictions for || ∆ ||

Original: 2 = 0 .
Revised: 2 = 0 .

Original: 8 , whereas the SO (2) certificates can not certify robustness beyond || ∆ || 2 ≈ 0 .
Revised: 8 , whereas the SO (2) certificates can not certify robustness beyond || ∆ || 2 ≈ 0 .

Original: .||
Revised: .||

Original: ∆ || 0 .0 .0 .

Revised: ∆ || 0 .0 .0 .

Original: C e r ti fi e d
Revised: C e r ti fi e d

Original: A cc .
Revised: A cc .

Original: SE (2) Tight
Revised: SE (2) Tight

Original: SE (2) Orbit
Revised: SE (2) Orbit

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit (a) σ = 0 .0 .0 .0 .0 .0 .1 .||
Revised: SO (2) Orbit (a) σ = 0 .0 .0 .0 .0 .0 .1 .||

Original: ∆ || 0 .0 .0 .

Revised: ∆ || 0 .0 .0 .

Original: C e r ti fi e d
Revised: C e r ti fi e d

Original: A cc .
Revised: A cc .

Original: SE (2) Tight
Revised: SE (2) Tight

Original: SE (2) Orbit
Revised: SE (2) Orbit

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit (b) σ = 0 .0 .0 .0 .0 .0 .1 .||
Revised: SO (2) Orbit (b) σ = 0 .0 .0 .0 .0 .0 .1 .||

Original: ∆ || 0 .0 .0 .

Revised: ∆ || 0 .0 .0 .

Original: C e r ti fi e d
Revised: C e r ti fi e d

Original: A cc .
Revised: A cc .

Original: SE (2) Tight
Revised: SE (2) Tight

Original: SE (2) Orbit
Revised: SE (2) Orbit

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit (c) σ = 0 .0 .0 .0 .0 .0 .1 .||
Revised: SO (2) Orbit (c) σ = 0 .0 .0 .0 .0 .0 .1 .||

Original: ∆ || 0 .0 .0 .

Revised: ∆ || 0 .0 .0 .

Original: C e r ti fi e d
Revised: C e r ti fi e d

Original: A cc .
Revised: A cc .

Original: SE (2) Tight
Revised: SE (2) Tight

Original: SE (2) Orbit
Revised: SE (2) Orbit

Original: SO (2) Tight
Revised: SO (2) Tight

Original: SO (2) Orbit (d) σ = 0 .
Revised: SO (2) Orbit (d) σ = 0 .

Original: A.2.2 Perturbations with random rotation components on MNIST
Revised: A.2.2 Perturbations with random rotation components on MNIST

Original: Like in Section 8.2, we construct perturbations with rotational components by fixing || ∆ || , randomly sampling perturbations of the specified norm and then rotating Z = X + ∆ by a specified angle θ .
Revised: Like in Section 8.2, we construct perturbations with rotational components by fixing || ∆ || , randomly sampling perturbations of the specified norm and then rotating Z = X + ∆ by a specified angle θ .

Original: We obtain the original, unrotated perturbations via sampling from an isotropic matrix normal distribution and then scaling the sample to be of the desired norm.
Revised: We obtain the original, unrotated perturbations via sampling from an isotropic matrix normal distribution and then scaling the sample to be of the desired norm.

Original: Per value of θ , we sample ten such perturbed inputs per element of the test set (i.e. 100000 per θ ).
Revised: Per value of θ , we sample ten such perturbed inputs per element of the test set (i.e. 100000 per θ ).

Original: We then compare the tight and the orbit-based certificate for simultaneous rotation and translation invariance ( SE ), as well as the black-box baseline.
Revised: We then compare the tight and the orbit-based certificate for simultaneous rotation and translation invariance ( SE ), as well as the black-box baseline.

Original: As our metric, we use probabilistic certified accuracy, i.e. the percentage of samples X ′ for which f ( X ) is correct and f ( X ′ )
Revised: As our metric, we use probabilistic certified accuracy, i.e. the percentage of samples X ′ for which f ( X ) is correct and f ( X ′ )

Original: =
Revised: =

Original: f ( X ) is provably guaranteed.
Revised: f ( X ) is provably guaranteed.

Original: Fig.
Revised: Fig.

Original: 13 shows the results for σ ∈ { 0 . 05 , 0 . 1 , 0 . 2 } , || ∆ || 2 ∈ { σ / 2 , σ, 2 σ } and θ ∈ [0 ◦ , 90 ◦ ] .
Revised: 13 shows the results for σ ∈ { 0 . 05 , 0 . 1 , 0 . 2 } , || ∆ || 2 ∈ { σ / 2 , σ, 2 σ } and θ ∈ [0 ◦ , 90 ◦ ] .

Original: While the black-box baseline fails to certify robustness even for small rotation angles, both gray-box certificates effectively eliminate the rotations, i.e. are constant in θ .
Revised: While the black-box baseline fails to certify robustness even for small rotation angles, both gray-box certificates effectively eliminate the rotations, i.e. are constant in θ .

Original: However, the tight gray-box certificate does not offer any noteable benefit beyond that.
Revised: However, the tight gray-box certificate does not offer any noteable benefit beyond that.

Original: The probabilistic lower bound never yields better probabilistic certified accuracy than the orbit-based certificate.
Revised: The probabilistic lower bound never yields better probabilistic certified accuracy than the orbit-based certificate.

Original: These results are consistent with our observartions about the tight certificate’s parameter space: All values of σ that retain high accuracy are small, relative to the average norm of the test set ( 10 . 67 ).
Revised: These results are consistent with our observartions about the tight certificate’s parameter space: All values of σ that retain high accuracy are small, relative to the average norm of the test set ( 10 . 67 ).

Original: [Figure]
Revised: [Figure]

Original: (b) σ = 0 .
Revised: (b) σ = 0 .

Original: 05 , ||
Revised: 05 , ||

Original: ∆ ||
Revised: ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (c) σ = 0 . 05 , ||
Revised: (c) σ = 0 . 05 , ||

Original: ∆ ||
Revised: ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (d) σ = 0 . 1 , || ∆ ||
Revised: (d) σ = 0 . 1 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (e) σ = 0 . 1 , || ∆ ||
Revised: (e) σ = 0 . 1 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (f) σ = 0 . 1 , || ∆ ||
Revised: (f) σ = 0 . 1 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (g) σ = 0 .
Revised: (g) σ = 0 .

Original: 2 , || ∆ ||
Revised: 2 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (h) σ = 0 .
Revised: (h) σ = 0 .

Original: 2 , || ∆ ||
Revised: 2 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original:    θ / deg 0 .0 .1 .
Revised:    θ / deg 0 .0 .1 .

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (i) σ = 0 .
Revised: (i) σ = 0 .

Original: 2 , || ∆ ||
Revised: 2 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original: A.2.3 Perturbations with random elemental rotation components on ModelNet 
Revised: A.2.3 Perturbations with random elemental rotation components on ModelNet

Original: Next, we repeat the same experiment on ModelNet40.
Revised: Next, we repeat the same experiment on ModelNet40.

Original: After sampling a perturbation ∆ of specified norm || ∆ || 2 , we randomly rotate X ′ =
Revised: After sampling a perturbation ∆ of specified norm || ∆ || 2 , we randomly rotate X ′ =

Original: X + ∆ by angle θ around a random axis.
Revised: X + ∆ by angle θ around a random axis.

Original: We obtain this axis by sampling from a three-dimensional isotropic normal distribution and normalizing the result.
Revised: We obtain this axis by sampling from a three-dimensional isotropic normal distribution and normalizing the result.

Original: We then compare the tight certificate for simultaneous invariance under rotation and translation to the orbit-based one and the black-box baseline.
Revised: We then compare the tight certificate for simultaneous invariance under rotation and translation to the orbit-based one and the black-box baseline.

Original: Figs.
Revised: Figs.

Original: 14 to 16 show the results for EnsPointNet, AttnPointNet and EnsDGCNN.
Revised: 14 to 16 show the results for EnsPointNet, AttnPointNet and EnsDGCNN.

Original: In all cases, both the tight- and orbit-based certificate are constant in θ , but the tight certificate does not noticeably improve upon the orbit-based one w.r.t.
Revised: In all cases, both the tight- and orbit-based certificate are constant in θ , but the tight certificate does not noticeably improve upon the orbit-based one w.r.t.

Original: probabilistic certified accuracy.
Revised: probabilistic certified accuracy.

Original: [Figure]
Revised: [Figure]

Original: e r t
Revised: e r t

Original: [Figure]
Revised: [Figure]

Original: A cc
Revised: A cc

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: |
Revised: |

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: =
Revised: =

Original: [Figure]
Revised: [Figure]

Original: |
Revised: |

Original: [Figure]
Revised: [Figure]

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (d) σ = 0 . 1 , || ∆ ||
Revised: (d) σ = 0 . 1 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Original: [Figure]
Revised: [Figure]

Original: e) σ = 0 .
Revised: e) σ = 0 .

Original: 1 , || ∆ ||
Revised: 1 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Revised: [Figure]

Revised: [Figure]

Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (f) σ [Figure] ||
Revised: (f) σ = 0 . 1 , || ∆ ||

Original: ∆ ||
Revised: = 0 . [Figure] [Figure] [Figure]

Original: [Figure]
Revised: [Figure]

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (g) σ = 0 .
Revised: (g) σ = 0 .

Original: 2 , || ∆ ||
Revised: 2 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Revised:    θ / deg

Original: [Figure]
Revised: [Figure]

Original: θ /
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: (h) σ = 0 .
Revised: (h) σ = 0 .

Original: 2 , || ∆ ||
Revised: 2 , || ∆ ||

Original: = 0 .
Revised: = 0 .

Revised:    θ / deg

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: P r

Original: [Figure]
Revised: [Figure]

Revised: P r .

Original:  e r t .
Revised: C e r t .

Original: A cc 
Revised: A cc .

Revised: (i) σ = 0 .

Revised: 2 , || ∆ ||

Revised: = 0 .

Original: [Figure]
Revised: [Table]

Original: (i) σ =
Revised: P r . C e r t .

Original: [Figure]
Revised: A cc . [Table] P r . C e r t .

Revised: A cc .

Original: [Figure]
Revised: [Table]

Original: ||
Revised: [Table] [Table] P r . C e r t .

Original: ∆ ||
Revised: A c c . [Table] [Table] [Equation]

Original: = 0 .
Revised: [Table] P r . C e r t . A cc .

Original: [Table]
Revised: [Table]

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A cc .
Revised: A cc .

Original: [Table]
Revised: [Table]

Original: P r .

Original: C e r t . A cc . [Table] [Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: P r .
Revised: P r .

Original: C e r t .
Revised: C e r t .

Original: A c c .
Revised: A c c .

Original: [Table]

Original: [Table]

Original: [Equation]

Original: [Table]
Revised: [Table]

Original: P r .

Original: C e r t .

Original: A cc .

Original: [Table]
Revised: [Table]

Original: P r .

Original: C e r t .

Original: A cc .

Original: [Table]

Original: [Table]

Original: [Table]

Original: P r .

Original: C e r t .

Original: A c c .

Original: [Table]

Original: [Table]

Original: C e r t .
Revised: C e r t .

Original: [Equation]
Revised: [Equation]

Original: c c
Revised: c c

Original: [Equation]
Revised: [Equation]

Original: B Full experimental setup
Revised: B Full experimental setup

Original: In the following, we provide a full specification of the used models, data sets and training parameters (Appendix B.1, randomized smoothing parameters (Appendix B.2), as well as the used computational resources (Appendix B.3) and third-party assets (Appendix B.4).
Revised: In the following, we provide a full specification of the used models, data sets and training parameters (Appendix B.1, randomized smoothing parameters (Appendix B.2), as well as the used computational resources (Appendix B.3) and third-party assets (Appendix B.4).

Original: The code and all configuration files needed for reproducing the experimental results will be made available at https://www.cs.cit.tum.de/daml/invariance-smoothing.
Revised: The code and all configuration files needed for reproducing the experimental results will be made available at https://www.cs.cit.tum.de/daml/invariance-smoothing.

Original: B.1 Models, data and training parameters B.1.1 Models
Revised: B.1 Models, data and training parameters B.1.1 Models

Original: The experiments in Section 8.2 and Appendix A.2 are performed with three models: EnsPointNet,
Revised: The experiments in Section 8.2 and Appendix A.2 are performed with three models: EnsPointNet,

Original: EnsDGCNN and AttnPointNet, which are rotation and translation invariant versions of PointNet [6], and the Dynamic Graph Convolutional Neural Network [128].
Revised: EnsDGCNN and AttnPointNet, which are rotation and translation invariant versions of PointNet [6], and the Dynamic Graph Convolutional Neural Network [128].

Original: EnsPointNet is based on a standard PointNet architecture with an input T-Net but without a feature
Revised: EnsPointNet is based on a standard PointNet architecture with an input T-Net but without a feature

Original: T-Net (we did not find the feature T-Net to improve the accuracy of the rotation invariant model).
Revised: T-Net (we did not find the feature T-Net to improve the accuracy of the rotation invariant model).

Original: The input T-Net uses three convolutional layers with kernel size 1 × 1 ( 64 , 128 and 1024 filters) and three linear layers ( 512 , 256 and 9 neurons).
Revised: The input T-Net uses three convolutional layers with kernel size 1 × 1 ( 64 , 128 and 1024 filters) and three linear layers ( 512 , 256 and 9 neurons).

Original: The PointNet itself uses three convolutional layers with kernel size 1 × 1 ( 64 , 128 and 1024 filters) and three linear layers ( 512 , 256 and | Y | neurons).
Revised: The PointNet itself uses three convolutional layers with kernel size 1 × 1 ( 64 , 128 and 1024 filters) and three linear layers ( 512 , 256 and | Y | neurons).

Original: All layers, except the last one, use BatchNorm ( ϵ = 1 e − 05 , momentum = 0 . 1 ).
Revised: All layers, except the last one, use BatchNorm ( ϵ = 1 e − 05 , momentum = 0 . 1 ).

Original: The second linear layer uses dropout ( p = 0 . 4 ).
Revised: The second linear layer uses dropout ( p = 0 . 4 ).

Original: To achieve rotation and translation invariance, the input data is centered and the two (for 2 D data) or three (for 3 D data) principal components are computed.
Revised: To achieve rotation and translation invariance, the input data is centered and the two (for 2 D data) or three (for 3 D data) principal components are computed.

Original: Principal components are not unique.
Revised: Principal components are not unique.

Original: One has to account for order and sign ambiguities to ensure rotation invariance (see discussion in [129, 130]).
Revised: One has to account for order and sign ambiguities to ensure rotation invariance (see discussion in [129, 130]).

Original: If two or more eigenvalues are numerically close (relative tolerance 1 e − 5 , absolute tolerance 1 e − 8 ) , we iterate over all possible eigenvector signs and orders ( 8 · 6 ), multiply the input data with the principal components, and pass it through the PointNet.
Revised: If two or more eigenvalues are numerically close (relative tolerance 1 e − 5 , absolute tolerance 1 e − 8 ) , we iterate over all possible eigenvector signs and orders ( 8 · 6 ), multiply the input data with the principal components, and pass it through the PointNet.

Original: If the eigenvalues are distinct, we sort them in ascending order and iterate over all possible signs ( 8 ).
Revised: If the eigenvalues are distinct, we sort them in ascending order and iterate over all possible signs ( 8 ).

Original: The 8 or 48 logit vectors are then averaged to obtain a prediction.
Revised: The 8 or 48 logit vectors are then averaged to obtain a prediction.

Original: EnsDGCNN is based on a standard DGCNN architecture with an input spatial transform.
Revised: EnsDGCNN is based on a standard DGCNN architecture with an input spatial transform.

Original: The spatial transform uses uses three convolutional layers with kernel size 1 × 1 ( 64 , 128 and 1024 filters) and three linear layers ( 512 , 256 and 9 neurons).
Revised: The spatial transform uses uses three convolutional layers with kernel size 1 × 1 ( 64 , 128 and 1024 filters) and three linear layers ( 512 , 256 and 9 neurons).

Original: The DGCNN encodes the spatially transformed input with three DGC layers ( 64 , 64 , 64 and 128 filters and k = 20 ).
Revised: The DGCNN encodes the spatially transformed input with three DGC layers ( 64 , 64 , 64 and 128 filters and k = 20 ).

Original: The encoder output and residuals are concatenated and passed through a convolution with kernel size 1 × 1 ( 1024 filters), followed by max-pooling and three linear layers ( 512 , 256 , | Y | neurons).
Revised: The encoder output and residuals are concatenated and passed through a convolution with kernel size 1 × 1 ( 1024 filters), followed by max-pooling and three linear layers ( 512 , 256 , | Y | neurons).

Original: All layers use BatchNorm ( ϵ = 1 e − 05 , momentum = 0 . 1 ).
Revised: All layers use BatchNorm ( ϵ = 1 e − 05 , momentum = 0 . 1 ).

Original: The first two linear layers use dropout ( p = 0 . 5 ).
Revised: The first two linear layers use dropout ( p = 0 . 5 ).

Original: We use the same ensembling approach as for EnsPointNet to achieve rotation and translation invariance.
Revised: We use the same ensembling approach as for EnsPointNet to achieve rotation and translation invariance.

Original: AttnPointNet combines PointNet with the attention-based mechanism for combining canonical poses proposed in [129].
Revised: AttnPointNet combines PointNet with the attention-based mechanism for combining canonical poses proposed in [129].

Original: It uses the same encoder as EnsPointNet.
Revised: It uses the same encoder as EnsPointNet.

Original: After passing the different PCA-based canonical poses through the encoder, the hidden vectors are combined via a self-attention layer (neurons each for query, key and value transform) and then passed through the same decoder as in
Revised: After passing the different PCA-based canonical poses through the encoder, the hidden vectors are combined via a self-attention layer (neurons each for query, key and value transform) and then passed through the same decoder as in

Original: EnsPointNet.
Revised: EnsPointNet.

Original: To reduce memory usage, we only consider sign combinations that correspond to proper rotation matrices (see discussion in [130]).
Revised: To reduce memory usage, we only consider sign combinations that correspond to proper rotation matrices (see discussion in [130]).

Original: B.1.2 Data
Revised: B.1.2 Data

Original: ModelNet40 [126] consists of 12311 CAD models from 40 categories, split into 9843 training samples and 2468 test samples.
Revised: ModelNet40 [126] consists of 12311 CAD models from 40 categories, split into 9843 training samples and 2468 test samples.

Original: We subdivide the original training set into 80% train data and 20% validation data.
Revised: We subdivide the original training set into 80% train data and 20% validation data.

Original: The same split is used for all experiments.
Revised: The same split is used for all experiments.

Original: Each CAD model is then transformed into a 3D point cloud with 1024 points using the same pre-processing steps as in [6], i.e. randomly sampling from the mesh faces according to surface area and normalizing the resulting point cloud into the unit sphere.
Revised: Each CAD model is then transformed into a 3D point cloud with 1024 points using the same pre-processing steps as in [6], i.e. randomly sampling from the mesh faces according to surface area and normalizing the resulting point cloud into the unit sphere.

Original: MNIST [127] consists of 70000 handwritten digits, split into 60000 training samples and 10000 test samples.
Revised: MNIST [127] consists of 70000 handwritten digits, split into 60000 training samples and 10000 test samples.

Original: We subdivide the original training set into 80% train data and 20% validation data.
Revised: We subdivide the original training set into 80% train data and 20% validation data.

Original: The same split is used for all experiments.
Revised: The same split is used for all experiments.

Original: Each image is transformed into a 2D point with 1024 points using the same pre-processing steps as in [6], i.e. mapping all pixels with values greater than 128 to x-y coordinates, then uniformly sub-sampling or padding with a randomly chosen point and finally normalizing into the unit sphere.
Revised: Each image is transformed into a 2D point with 1024 points using the same pre-processing steps as in [6], i.e. mapping all pixels with values greater than 128 to x-y coordinates, then uniformly sub-sampling or padding with a randomly chosen point and finally normalizing into the unit sphere.

Original: We additionally combine classes 6 and 9 , because these digits cannot be expected to be differentiated by a rotation-invariant model.
Revised: We additionally combine classes 6 and 9 , because these digits cannot be expected to be differentiated by a rotation-invariant model.

Original: B.1.3 Training parameters
Revised: B.1.3 Training parameters

Original: All models are trained on samples from the smoothing distribution (i.e. the model that is evaluated and certified with σ is trained on data augmented with Gaussian noise sampled from an isotropic normal distribution with standard deviation σ ).
Revised: All models are trained on samples from the smoothing distribution (i.e. the model that is evaluated and certified with σ is trained on data augmented with Gaussian noise sampled from an isotropic normal distribution with standard deviation σ ).

Original: Per element of a training batch, we take exactly one sample from the smoothing distribution.
Revised: Per element of a training batch, we take exactly one sample from the smoothing distribution.

Original: We do not use consistency regularization.
Revised: We do not use consistency regularization.

Original: EnsPointNet is trained with cross entropy loss and the TNet regularization from [6] (weight 0 . 0001 ).
Revised: EnsPointNet is trained with cross entropy loss and the TNet regularization from [6] (weight 0 . 0001 ).

Original: Training is performed for 200 epochs with batch size 128 using Adam ( β 1 = 0 .
Revised: Training is performed for 200 epochs with batch size 128 using Adam ( β 1 = 0 .

Original: 9 , β 2 = 0 .
Revised: 9 , β 2 = 0 .

Original: 99 , ϵ = 1 e − 8 , weight _ decay = 1 e − 4 ).
Revised: 99 , ϵ = 1 e − 8 , weight _ decay = 1 e − 4 ).

Original: The learning rate starts at 0 .
Revised: The learning rate starts at 0 .

Original: 001 and is multiplied with 0 .every 20 epochs.
Revised: 001 and is multiplied with 0 .every 20 epochs.

Original: The input data is randomly scaled by a factor from [0 . 8 , 1 . 25] and then transformed via principal component analysis, using a single set of eigenvectors with randomized sign and order.
Revised: The input data is randomly scaled by a factor from [0 . 8 , 1 . 25] and then transformed via principal component analysis, using a single set of eigenvectors with randomized sign and order.

Original: EnsDGCNN is trained in the same manner as EnsPointNet, but with batch size 32 , 400 epochs and learning rate decay every 40 epochs.
Revised: EnsDGCNN is trained in the same manner as EnsPointNet, but with batch size 32 , 400 epochs and learning rate decay every 40 epochs.

Original: AttnPointNet is trained with batch size 64 , 400 epochs and learning rate decay every 40 epochs.
Revised: AttnPointNet is trained with batch size 64 , 400 epochs and learning rate decay every 40 epochs.

Original: The other parameter values are identical to those for EnsPointNet.
Revised: The other parameter values are identical to those for EnsPointNet.

Original: In order to train the self-attention layer, we do not transform the input with a single set of eigenvectors, but pass all possible eigenvectors corresponding to rotations through the network.
Revised: In order to train the self-attention layer, we do not transform the input with a single set of eigenvectors, but pass all possible eigenvectors corresponding to rotations through the network.

Original: B.2 Randomized smoothing parameters
Revised: B.2 Randomized smoothing parameters

Original: We use 1000 samples from the smoothing distribution to compute smoothed predictions.
Revised: We use 1000 samples from the smoothing distribution to compute smoothed predictions.

Original: Abstentions, i.e. predictions for which we cannot guarantee that p X ,y ∗ ≥ 0 .
Revised: Abstentions, i.e. predictions for which we cannot guarantee that p X ,y ∗ ≥ 0 .

Original: 5 , are considered as incorrect.
Revised: 5 , are considered as incorrect.

Original: For certification, we set the significance parameter α to 0 .
Revised: For certification, we set the significance parameter α to 0 .

Original: i.e. each certificate holds with probability 99 .
Revised: i.e. each certificate holds with probability 99 .

Original: We use 10000 samples per confidence bound, i.e. 10000 samples to bound p X ,y ∗ .
Revised: We use 10000 samples per confidence bound, i.e. 10000 samples to bound p X ,y ∗ .

Original: For the tight gray-box certificates involving rotation invariance we additionally use 10000 samples to bound the threshold κ and 10000 samples to bound the optimal value itself (for more details, see Appendix F.5).
Revised: For the tight gray-box certificates involving rotation invariance we additionally use 10000 samples to bound the threshold κ and 10000 samples to bound the optimal value itself (for more details, see Appendix F.5).

Original: We then use Holm-Bonferroni correction ([131]) to ensure that all three confidence bounds hold simultaneously with probability 1 − α .
Revised: We then use Holm-Bonferroni correction ([131]) to ensure that all three confidence bounds hold simultaneously with probability 1 − α .

Original: Evaluating the tight certificates for SO (3) and SE (3) requires numerical integration over the twodimensional parameter space [ − π 2 , π 2 ] × [0 , 2 π ] (see Appendix F.4.3).
Revised: Evaluating the tight certificates for SO (3) and SE (3) requires numerical integration over the twodimensional parameter space [ − π 2 , π 2 ] × [0 , 2 π ] (see Appendix F.4.3).

Original: We use Clenshaw-Curtis quadrature with degree 20 in each dimension.
Revised: We use Clenshaw-Curtis quadrature with degree 20 in each dimension.

Original: B.3 Computational resources
Revised: B.3 Computational resources

Original: Training and Monte Carlo sampling of smoothed predictions was performed on a single NVIDIA
Revised: Training and Monte Carlo sampling of smoothed predictions was performed on a single NVIDIA

Original: A100 GPU ( 40 GB VRAM) with an AMD EPYC 7543 CPU @ 2 . 8 GHz .
Revised: A100 GPU ( 40 GB VRAM) with an AMD EPYC 7543 CPU @ 2 . 8 GHz .

Original: For EnsPointNet and
Revised: For EnsPointNet and

Original: AttnPointNet, 16 GB RAM were allocated.
Revised: AttnPointNet, 16 GB RAM were allocated.

Original: For EnsDGCNN, which requires additional memory for computation of k-nearest-neighbor graphs, 32 GB RAM were allocated.
Revised: For EnsDGCNN, which requires additional memory for computation of k-nearest-neighbor graphs, 32 GB RAM were allocated.

Original: The average time for training EnsPointNet on MNIST was 42 .
Revised: The average time for training EnsPointNet on MNIST was 42 .

Original: 8 min .
Revised: 8 min .

Original: The average time for training EnsPointNet, AttnPoint and EnsDGCNN on ModelNet40 was 20 .
Revised: The average time for training EnsPointNet, AttnPoint and EnsDGCNN on ModelNet40 was 20 .

Original: 2 min , 114 min and 158 min , respectively.
Revised: 2 min , 114 min and 158 min , respectively.

Original: The average time for obtaining 11000 samples from EnsPointNet on MNIST was 1 .
Revised: The average time for obtaining 11000 samples from EnsPointNet on MNIST was 1 .

Original: 1 s .
Revised: 1 s .

Original: The average time for obtaining 11000 samples from EnsPointNet, AttnPoint and EnsDGCNN on ModelNet40 was 1 .
Revised: The average time for obtaining 11000 samples from EnsPointNet, AttnPoint and EnsDGCNN on ModelNet40 was 1 .

Original: 59 s , 1 . 4 s and 24 .
Revised: 59 s , 1 . 4 s and 24 .

Original: 91 s , respectively.
Revised: 91 s , respectively.

Original: Computation of certificates was performed on an Intel Xeon E5-2630 v4 CPU @ 2 . 2 GHz , with 16 GB RAM allocated to each experiment.
Revised: Computation of certificates was performed on an Intel Xeon E5-2630 v4 CPU @ 2 . 2 GHz , with 16 GB RAM allocated to each experiment.

Original: The average time for computing a tight certificate for 2D rotation invarance (i.e. computing threshold κ and bounding the optimal value, using 10000 samples each), was 0 .
Revised: The average time for computing a tight certificate for 2D rotation invarance (i.e. computing threshold κ and bounding the optimal value, using 10000 samples each), was 0 .

Original: 05 s .
Revised: 05 s .

Original: The average time for computing a tight certificate for 3D rotation invariance was 6 .
Revised: The average time for computing a tight certificate for 3D rotation invariance was 6 .

Original: 3 s .
Revised: 3 s .

Original: The increase in computational cost is caused by the fact that we can only evaluate the worstcase classifier via numerical integration.
Revised: The increase in computational cost is caused by the fact that we can only evaluate the worstcase classifier via numerical integration.

Original: The average time for computing the black-box randomized smoothing certificate and the tight certificate for translation invariance was in the sub-milisecond range and can thus not be accurately reported.
Revised: The average time for computing the black-box randomized smoothing certificate and the tight certificate for translation invariance was in the sub-milisecond range and can thus not be accurately reported.

Original: B.4 Third-party assets
Revised: B.4 Third-party assets

Original: Our work uses the publicly available MNIST [127] and ModelNet40 [126] datasets, as well as the quadpy quadrature library [132].
Revised: Our work uses the publicly available MNIST [127] and ModelNet40 [126] datasets, as well as the quadpy quadrature library [132].

Original: Our implementation additionally uses code from a publicly available implementation of PointNet and PointNet++ [133], as well as the author’s reference implementation of DGCNN [128].
Revised: Our implementation additionally uses code from a publicly available implementation of PointNet and PointNet++ [133], as well as the author’s reference implementation of DGCNN [128].

Original: Both are available under MIT license.
Revised: Both are available under MIT license.

Original: C Group definitions
Revised: C Group definitions

Original: In the following, we define the different groups we consider in our work, each corresponding to a specific type of spatial invariance.
Revised: In the following, we define the different groups we consider in our work, each corresponding to a specific type of spatial invariance.

Original: Recall from Section 3.2 that a group is a set T , associated with a binary operator · : T × T → T that is closed and associative under the operation, has an inverse t − 1 for each element t ∈ T and features an identity element e .
Revised: Recall from Section 3.2 that a group is a set T , associated with a binary operator · : T × T → T that is closed and associative under the operation, has an inverse t − 1 for each element t ∈ T and features an identity element e .

Original: Further recall that we associate each group with a group action ◦ : T × R N × D → R N × D that describes how elements of the group modify elements of the input space.
Revised: Further recall that we associate each group with a group action ◦ : T × R N × D → R N × D that describes how elements of the group modify elements of the input space.

Original: C.1 Translation group T ( D )
Revised: C.1 Translation group T ( D )

Original: The translation group in D dimensions is the set of all D -dimensional continuous vectors, i.e.
Revised: The translation group in D dimensions is the set of all D -dimensional continuous vectors, i.e.

Original: T ( D ) =
Revised: T ( D ) =

Original: R D .
Revised: R D .

Original: Two group elements t , t ′ ∈ T ( D ) are combined via vector addition, i.e. t · t ′ =
Revised: Two group elements t , t ′ ∈ T ( D ) are combined via vector addition, i.e. t · t ′ =

Original: t + t ′ .
Revised: t + t ′ .

Original: A group element t ∈ T ( D ) acts on an input X ∈ R N × D via row-wise addition, i.e. t ◦ X
Revised: A group element t ∈ T ( D ) acts on an input X ∈ R N × D via row-wise addition, i.e. t ◦ X

Original: = X
Revised: = X

Original: + 1 N t T with all-ones vector 1 N ∈ R N .
Revised: + 1 N t T with all-ones vector 1 N ∈ R N .

Original: The identity element e is the all-zeros vector 0 D .
Revised: The identity element e is the all-zeros vector 0 D .

Original: C.2 Rotation group SO ( D )
Revised: C.2 Rotation group SO ( D )

Original: The rotation group in D dimensions, SO ( D ) (short for special orthogonal ), is the set of all Ddimensional rotation matrices, i.e. SO ( D ) =
Revised: The rotation group in D dimensions, SO ( D ) (short for special orthogonal ), is the set of all Ddimensional rotation matrices, i.e. SO ( D ) =

Original: (cid:8) R ∈ R D
Revised: (cid:8) R ∈ R D

Original: × D | R T R
Revised: × D | R T R

Original: =
Revised: =

Original: I N ∧ det( R ) = 1 (cid:9) .
Revised: I N ∧ det( R ) = 1 (cid:9) .

Original: Two group elements R , R ′ ∈
Revised: Two group elements R , R ′ ∈

Original: SO ( D ) are combined via matrix multiplication, i.e. R · R ′ =
Revised: SO ( D ) are combined via matrix multiplication, i.e. R · R ′ =

Original: RR ′ .
Revised: RR ′ .

Original: A group element R ∈ SO ( D ) acts on an input X ∈ R N × D via row-wise matrix-vector multiplication, i.e. R ◦ X =
Revised: A group element R ∈ SO ( D ) acts on an input X ∈ R N × D via row-wise matrix-vector multiplication, i.e. R ◦ X =

Original: XR T .
Revised: XR T .

Original: The identity element e is the identity matrix I D .
Revised: The identity element e is the identity matrix I D .

Original: C.3 Orthogonal group O ( D )
Revised: C.3 Orthogonal group O ( D )

Original: The orthogonal group in D dimensions, O ( D ) , is the set of all D -dimensional orthogonal matrices, i.e. O ( D ) =
Revised: The orthogonal group in D dimensions, O ( D ) , is the set of all D -dimensional orthogonal matrices, i.e. O ( D ) =

Original: (cid:8)
Revised: (cid:8)

Original: A ∈ R D
Revised: A ∈ R D

Original: × D | R T R
Revised: × D | R T R

Original: =
Revised: =

Original: I N (cid:9) .
Revised: I N (cid:9) .

Original: Note that O ( D ) ⊃
Revised: Note that O ( D ) ⊃

Original: SO ( D ) .
Revised: SO ( D ) .

Original: Like the rotation group, group elements are combined via matrix multiplication, i.e. A · A ′ =
Revised: Like the rotation group, group elements are combined via matrix multiplication, i.e. A · A ′ =

Original: AA ′ and act on an input
Revised: AA ′ and act on an input

Original: X ∈ A N × D via row-wise matrix-vector multiplication, i.e. A ◦ X = XA T .
Revised: X ∈ A N × D via row-wise matrix-vector multiplication, i.e. A ◦ X = XA T .

Original: The identity element e is the identity matrix I D .
Revised: The identity element e is the identity matrix I D .

Original: C.4 Roto-translation group SE ( D )
Revised: C.4 Roto-translation group SE ( D )

Original: The roto-translation group in D dimensions, SE ( D ) (short for special Euclidean ), is composed of all pairs of D -dimensional rotation matrices and translation vectors.
Revised: The roto-translation group in D dimensions, SE ( D ) (short for special Euclidean ), is composed of all pairs of D -dimensional rotation matrices and translation vectors.

Original: That is, SE ( D ) =
Revised: That is, SE ( D ) =

Original: SO ( D ) × T ( D ) .
Revised: SO ( D ) × T ( D ) .

Original: Two group elements ( R , t ) , ( R ′ , t ′ )
Revised: Two group elements ( R , t ) , ( R ′ , t ′ )

Original: ∈ SE ( D ) are combined via a semidirect product, i.e. ( R , t ) · ( R ′ , t ′ )
Revised: ∈ SE ( D ) are combined via a semidirect product, i.e. ( R , t ) · ( R ′ , t ′ )

Original: =
Revised: =

Original: ( RR ′ , Rt ′ + t ) .
Revised: ( RR ′ , Rt ′ + t ) .

Original: A group element ( R , t ) ∈ SE ( D ) acts on an input X ∈ R N × D via rowwise matrix-vector multiplication, followed by a row-wise addition i.e. ( R , t ) ◦
Revised: A group element ( R , t ) ∈ SE ( D ) acts on an input X ∈ R N × D via rowwise matrix-vector multiplication, followed by a row-wise addition i.e. ( R , t ) ◦

Original: X =
Revised: X =

Original: XR T + 1 N t T .
Revised: XR T + 1 N t T .

Original: The identity element e is ( I D , 0 D ) .
Revised: The identity element e is ( I D , 0 D ) .

Original: C.5 Euclidean group E ( D )
Revised: C.5 Euclidean group E ( D )

Original: The Euclidean group in D dimensions, E ( D ) , corresponds to the set of all distance-preserving functions in Euclidean space.
Revised: The Euclidean group in D dimensions, E ( D ) , corresponds to the set of all distance-preserving functions in Euclidean space.

Original: It is composed of all pairs of D -dimensional orthonormal matrices and translation vectors.
Revised: It is composed of all pairs of D -dimensional orthonormal matrices and translation vectors.

Original: That is, E ( D ) =
Revised: That is, E ( D ) =

Original: O ( D ) × T ( D ) .
Revised: O ( D ) × T ( D ) .

Original: Note that E ( D ) ⊃ SE ( D ) .
Revised: Note that E ( D ) ⊃ SE ( D ) .

Original: Like the roto-translation group, group elements combined via a semidirect product, i.e. ( A , t ) · ( A ′ , t ′ )
Revised: Like the roto-translation group, group elements combined via a semidirect product, i.e. ( A , t ) · ( A ′ , t ′ )

Original: =
Revised: =

Original: ( AA ′ , At ′ + t ) and act on an input X ∈ R N × D via row-wise matrix-vector multiplication, followed by a row-wise addition
Revised: ( AA ′ , At ′ + t ) and act on an input X ∈ R N × D via row-wise matrix-vector multiplication, followed by a row-wise addition

Original: i.e. ( A , t ) ◦
Revised: i.e. ( A , t ) ◦

Original: X =
Revised: X =

Original: XA T + 1 N t T .
Revised: XA T + 1 N t T .

Original: The identity element e is ( I D , 0 D ) .
Revised: The identity element e is ( I D , 0 D ) .

Original: C.6 Permutation group S ( N )
Revised: C.6 Permutation group S ( N )

Original: The permutation group in N dimensions, S ( N ) , is the set 
Revised: The permutation group in N dimensions, S ( N ) , is the set permutation matrices i e S N P ∈ {

Revised: 1 } N × N

Original:  D Proof of Theorem
Revised: P T I N D Proof of Theorem

Original: Theorem 1.
Revised: Theorem 1.

Original: Let base classifier g : R N × D
Revised: Let base classifier g : R N × D

Original: → Y be invariant under group T with T ⊆
Revised: → Y be invariant under group T with T ⊆

Original: E ( D ) or T ⊆ S ( N ) , where E ( D ) is the Euclidean group and S ( N ) is the permutation group.
Revised: E ( D ) or T ⊆ S ( N ) , where E ( D ) is the Euclidean group and S ( N ) is the permutation group.

Original: Then the isotropically smoothed classifier f , as defined in Section 3.1, is also invariant under T .
Revised: Then the isotropically smoothed classifier f , as defined in Section 3.1, is also invariant under T .

Original: Recall that
Revised: Recall that

Original: [Equation]
Revised: [Equation]

Original: We shall prove Theorem 1 by showing that ∀ t ∈ T : p X ,y
Revised: We shall prove Theorem 1 by showing that ∀ t ∈ T : p X ,y

Original: = p ( t ◦ X ) ,y , i.e. the prediction probabilities are invariant.
Revised: = p ( t ◦ X ) ,y , i.e. the prediction probabilities are invariant.

Original: To do so, we need the following simple lemma:
Revised: To do so, we need the following simple lemma:

Original: Lemma 2.
Revised: Lemma 2.

Original: Consider an arbitrary invertible matrix A ∈ R N × N , vectors z , m ∈ R N and scalar σ > 0 .
Revised: Consider an arbitrary invertible matrix A ∈ R N × N , vectors z , m ∈ R N and scalar σ > 0 .

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: It follows from the change of variables formula for densitiy functions that the l.h.s.
Revised: It follows from the change of variables formula for densitiy functions that the l.h.s.

Original: term is the density function of random variable z ′ =
Revised: term is the density function of random variable z ′ =

Original: Az with z ∼ N (cid:0) m , σ 2 1 N (cid:1) .
Revised: Az with z ∼ N (cid:0) m , σ 2 1 N (cid:1) .

Original: Due to the behavior of multivariate normal distributions under affine transformation, the r.h.s.
Revised: Due to the behavior of multivariate normal distributions under affine transformation, the r.h.s.

Original: term is also the density function of z ′ .
Revised: term is also the density function of z ′ .

Original: We begin by proving Theorem 1 for T ⊆
Revised: We begin by proving Theorem 1 for T ⊆

Original: E ( D ) , before considering T ⊆ S ( N ) .
Revised: E ( D ) , before considering T ⊆ S ( N ) .

Original: In the following, let ˆ g ( Z ) =
Revised: In the following, let ˆ g ( Z ) =

Original: [ g ( Z ) =
Revised: [ g ( Z ) =

Original: y ∗ ] indicate whether base classifier g classifies input Z as y ∗ .
Revised: y ∗ ] indicate whether base classifier g classifies input Z as y ∗ .

Original: Case 1: Assume that T ⊆
Revised: Case 1: Assume that T ⊆

Original: E ( D ) and consider an arbitrary t ∈ T .
Revised: E ( D ) and consider an arbitrary t ∈ T .

Original: By definition of the Euclidean group and the associated group action (see Appendix C.5) we must have t =
Revised: By definition of the Euclidean group and the associated group action (see Appendix C.5) we must have t =

Original: ( A , b ) and t ◦ X =
Revised: ( A , b ) and t ◦ X =

Original: XA T + 1 N b T for some orthogonal matrix A ∈ R D × D and translation vector b ∈ R N .
Revised: XA T + 1 N b T for some orthogonal matrix A ∈ R D × D and translation vector b ∈ R N .

Original: By definition of the smoothing distribution, we have
Revised: By definition of the smoothing distribution, we have

Original: [Equation]
Revised: [Equation]

Original: where in the last equality we have used that N ( z | m + b ) =
Revised: where in the last equality we have used that N ( z | m + b ) =

Original: N ( z − b | m ) .
Revised: N ( z − b | m ) .

Original: We can now perform two substitutions, V = Z − 1 N b T and W = V ( A − 1 ) T , to transform this term into an expectation w.r.t.
Revised: We can now perform two substitutions, V = Z − 1 N b T and W = V ( A − 1 ) T , to transform this term into an expectation w.r.t.

Original: the original smoothing distribution µ X :
Revised: the original smoothing distribution µ X :

Original: [Equation]
Revised: [Equation]

Original: In the second step we have used the fact that A is orthogonal, i.e. AA T
Revised: In the second step we have used the fact that A is orthogonal, i.e. AA T

Original: =
Revised: =

Original: I N .
Revised: I N .

Original: In the third step, we have applied Lemma 2.
Revised: In the third step, we have applied Lemma 2.

Original: Note that, because | det( A ) | = 1 , we did not have to change the volume element.
Revised: Note that, because | det( A ) | = 1 , we did not have to change the volume element.

Original: Finally, we can use the fact that g is invariant w.r.t.
Revised: Finally, we can use the fact that g is invariant w.r.t.

Original: group T to prove that
Revised: group T to prove that

Original: [Equation]
Revised: [Equation]

Original: Case 2: Assume that T ⊆ S ( N ) and consider an arbitrary t ∈ T .
Revised: Case 2: Assume that T ⊆ S ( N ) and consider an arbitrary t ∈ T .

Original: By definition of the permutation group and the associated group action (see Appendix C.6)
Revised: By definition of the permutation group and the associated group action (see Appendix C.6)

Original: we must have t =
Revised: we must have t =

Original: P and t ◦ X
Revised: P and t ◦ X

Original: = P X for some orthogonal matrix P ∈ { 0 , 1 } N × N .
Revised: = P X for some orthogonal matrix P ∈ { 0 , 1 } N × N .

Original: The proof is virtually identical to that for the Euclidean group, except we now use the substitution V
Revised: The proof is virtually identical to that for the Euclidean group, except we now use the substitution V

Original: = P Z :
Revised: = P Z :

Original: [Equation]
Revised: [Equation]

Original: E Orbit-based gray-box certificates
Revised: E Orbit-based gray-box certificates

Original: In the following, we first prove the soundness of our orbit-based approach to gray-box robustness certification.
Revised: In the following, we first prove the soundness of our orbit-based approach to gray-box robustness certification.

Original: We then present more explicit characterizations of the orbit-based certificates, which let us determine whether a specific perturbed input is part of the augmented certified region.
Revised: We then present more explicit characterizations of the orbit-based certificates, which let us determine whether a specific perturbed input is part of the augmented certified region.

Original: E.1 Proof of Theorem
Revised: E.1 Proof of Theorem

Original: Theorem 2 (Orbit-based certificates) .
Revised: Theorem 2.

Original: Let f ∈ R N × D
Revised: Let f ∈ R N × D

Original: → Y be invariant under a group T .
Revised: → Y be invariant under a group T .

Original: Let y ∗ =
Revised: Let y ∗ =

Original: f ( X ) be a prediction that is certifiably robust to a set of perturbed inputs B ⊆ R N × D , i.e. ∀ Z ∈ B : f ( Z ) =
Revised: f ( X ) be a prediction that is certifiably robust to a set of perturbed inputs B ⊆ R N × D , i.e. ∀ Z ∈ B : f ( Z ) =

Original: y ∗ .
Revised: y ∗ .

Original: Let ˜ B
Revised: Let ˜ B

Original: = ∪ Z ∈ B
Revised: = ∪ Z ∈ B

Original: [ Z ] T .
Revised: [ Z ] T .

Original: Then ∀ X ′ ∈ ˜ B : f ( X ′ ) =
Revised: Then ∀ X ′ ∈ ˜ B : f ( X ′ ) =

Original: y ∗ .
Revised: y ∗ .

Original: Proof.
Revised: Proof.

Original: Consider an arbitrary X ′ ∈ ˜ B .
Revised: Consider an arbitrary X ′ ∈ ˜ B .

Original: Due to the definition of ˜ B , there must be a Z ∈ B and a t ∈ T such that X ′ =
Revised: Due to the definition of ˜ B , there must be a Z ∈ B and a t ∈ T such that X ′ =

Original: t ◦ Z .
Revised: t ◦ Z .

Original: Since t ∈ T , we know that f ( t ◦ Z ) =
Revised: Since t ∈ T , we know that f ( t ◦ Z ) =

Original: f ( Z ) .
Revised: f ( Z ) .

Original: Since Z ∈ B , we know that f ( Z ) =
Revised: Since Z ∈ B , we know that f ( Z ) =

Original: y ∗ .
Revised: y ∗ .

Original: By the transitive property, we have f ( X ′ )
Revised: By the transitive property, we have f ( X ′ )

Original: =
Revised: =

Original: y ∗ .
Revised: y ∗ .

Original: E.2 Explicit characterizations
Revised: E.2 Explicit characterizations

Original: Recall that, for randomly smoothed models, a prediction y ∗ =
Revised: Recall that, for randomly smoothed models, a prediction y ∗ =

Original: f ( X ) is certifiably robust within a
Revised: f ( X ) is certifiably robust within a

Original: Frobenius norm ball B = { Z | ||
Revised: Frobenius norm ball B = { Z | ||

Original: Z − X
Revised: Z − X

Original: || 2 < r } with r = σ Φ − 1 ( p X ,y ∗ ) .
Revised: || 2 < r } with r = σ Φ − 1 ( p X ,y ∗ ) .

Original: For this certificate, we can determine whether a specific perturbed input X ′ is in augmented certified region ˜ B = ∪ Z ∈ B
Revised: For this certificate, we can determine whether a specific perturbed input X ′ is in augmented certified region ˜ B = ∪ Z ∈ B

Original: [ Z ] T by finding a transformation that minimizes the Frobenius distance between X ′ and X :
Revised: [ Z ] T by finding a transformation that minimizes the Frobenius distance between X ′ and X :

Original: Corollary 1.
Revised: Corollary 1.

Original: Let f ∈ R N × D
Revised: Let f ∈ R N × D

Original: → Y be invariant under group T .
Revised: → Y be invariant under group T .

Original: Let y ∗ =
Revised: Let y ∗ =

Original: f ( X ) be a prediction that is certifiably robust to a set of perturbed inputs B = { Z | ||
Revised: f ( X ) be a prediction that is certifiably robust to a set of perturbed inputs B = { Z | ||

Original: Z − X
Revised: Z − X

Original: || 2 < r } , i.e. ∀ Z ∈ B : f
Revised: || 2 < r } , i.e. ∀ Z ∈ B : f

Original: ( Z ) =
Revised: ( Z ) =

Original: y ∗ .
Revised: y ∗ .

Original: If min t ∈ T || ( t ◦ X ′ )
Revised: If min t ∈ T || ( t ◦ X ′ )

Original: − X
Revised: − X

Original: || 2 < r , then f ( X ′ )
Revised: || 2 < r , then f ( X ′ )

Original: =
Revised: =

Original: y ∗ .
Revised: y ∗ .

Original: Proof.
Revised: Proof.

Original: Let t ∗ =
Revised: Let t ∗ =

Original: argmin t ∈ T || ( t ◦ X ′ )
Revised: argmin t ∈ T || ( t ◦ X ′ )

Original: − X
Revised: − X

Original: || 2 , define Z = t ∗ ◦ X ′ and assume that || Z − X
Revised: || 2 , define Z = t ∗ ◦ X ′ and assume that || Z − X

Original: || 2 < r .
Revised: || 2 < r .

Original: By definition of B , we have Z ∈ B .
Revised: By definition of B , we have Z ∈ B .

Original: Because T is a group, there must be an inverse element ( t ∗ ) − 1 ∈ T with ( t ∗ ) − 1 ◦ Z = X ′ .
Revised: Because T is a group, there must be an inverse element ( t ∗ ) − 1 ∈ T with ( t ∗ ) − 1 ◦ Z = X ′ .

Original: Thus, by definition of orbits (see Definition 1), we have X ′ ∈
Revised: Thus, by definition of orbits (see Definition 1), we have X ′ ∈

Original: [ Z ] T .
Revised: [ Z ] T .

Original: It follows from Theorem 2 that f ( X ′ )
Revised: It follows from Theorem 2 that f ( X ′ )

Original: =
Revised: =

Original: y ∗ .
Revised: y ∗ .

Original: In the following, we discuss how to solve the optimization problem min τ ∈ T
Revised: In the following, we discuss how to solve the optimization problem min τ ∈ T

Original: || τ ( X ′ )
Revised: || τ ( X ′ )

Original: − X
Revised: − X

Original: || 2 < r for invariance under different groups T .
Revised: || 2 < r for invariance under different groups T .

Original: Before proceeding, remember that solving this optimization problem is not necessary for certifying robustness, i.e. specifying a set of inputs ˜ B such that ∀ X ′ ∈ ˜ B : f ( X ′ )
Revised: Before proceeding, remember that solving this optimization problem is not necessary for certifying robustness, i.e. specifying a set of inputs ˜ B such that ∀ X ′ ∈ ˜ B : f ( X ′ )

Original: =
Revised: =

Original: y ∗ (see Theorem 2).
Revised: y ∗ (see Theorem 2).

Original: It is only a way of performing membership inference, i.e. determining whether X ′ ∈ ˜ B for a specific X ′ ∈ R N × D – just like computing the Frobenius distance between
Revised: It is only a way of performing membership inference, i.e. determining whether X ′ ∈ ˜ B for a specific X ′ ∈ R N × D – just like computing the Frobenius distance between

Original: X ′ and X can be used to determine whether X ′ is part of the original certified region B .
Revised: X ′ and X can be used to determine whether X ′ is part of the original certified region B .

Original: E.2.1 Translation invariance
Revised: E.2.1 Translation invariance

Original: By definition of the translation group T ( D ) and the associated group action (see Appendix C.1), we have t ◦ X ′ =
Revised: By definition of the translation group T ( D ) and the associated group action (see Appendix C.1), we have t ◦ X ′ =

Original: X ′ + 1 N b T for some translation vector b ∈ R D .
Revised: X ′ + 1 N b T for some translation vector b ∈ R D .

Original: Thus,
Revised: Thus,

Original: [Equation]
Revised: [Equation]

Original: where ∆ =
Revised: where ∆ =

Original: X ′ − X and ∆ ∈ R 1 × D are the column-wise averages.
Revised: X ′ − X and ∆ ∈ R 1 × D are the column-wise averages.

Original: The second equality can be shown by computing the gradients w.r.t.
Revised: The second equality can be shown by computing the gradients w.r.t.

Original: b and setting them to zero.
Revised: b and setting them to zero.

Original: E.2.2 Rotation invariance
Revised: E.2.2 Rotation invariance

Original: By definition of the rotation group SO ( D ) and the associated group action (see Appendix C.2), we have t ◦ X ′ =
Revised: By definition of the rotation group SO ( D ) and the associated group action (see Appendix C.2), we have t ◦ X ′ =

Original: X ′ R T for some rotation matrix R .
Revised: X ′ R T for some rotation matrix R .

Original: Thus,
Revised: Thus,

Original: [Equation]
Revised: [Equation]

Original: This is a special case of the orthogonal Procrustes problem, which can be solved via singular value decomposition [111].
Revised: This is a special case of the orthogonal Procrustes problem, which can be solved via singular value decomposition [111].

Original: The optimal rotation matrix R ∗ is given by R ∗ =
Revised: The optimal rotation matrix R ∗ is given by R ∗ =

Original: V ˆ S U T , where
Revised: V ˆ S U T , where

Original: USV = ( X ′ )
Revised: USV = ( X ′ )

Original: T X and ˆ S = diag (cid:0) 1 , . .
Revised: T X and ˆ S = diag (cid:0) 1 , . .

Original: , 1 , sign (cid:0) det (cid:0) V U T (cid:1)(cid:1)(cid:1) .
Revised: , 1 , sign (cid:0) det [Equation] V U T (cid:1)(cid:1)(cid:1) .

Original: E.2.3 Simultaneous rotation and reflection invariance
Revised: E.2.3 Simultaneous rotation and reflection invariance

Original: By definition of the orthogonal group O ( D ) and the associated group action (see Appendix C.3), we have t ◦ X ′ =
Revised: By definition of the orthogonal group O ( D ) and the associated group action (see Appendix C.3), we have t ◦ X ′ =

Original: X ′
Revised: X ′

Original: A T for some orthogonal matrix A .
Revised: A T for some orthogonal matrix A .

Original: Thus,
Revised: Thus,

Original: [Equation]
Revised: [Equation]

Original: This is the orthogonal Procrustes problem, which can again be solved via singular value decomposition [111].
Revised: This is the orthogonal Procrustes problem, which can again be solved via singular value decomposition [111].

Original: The optimal orthogonal matrix A ∗ is given by A ∗ =
Revised: The optimal orthogonal matrix A ∗ is given by A ∗ =

Original: V U T , where USV =
Revised: V U T , where USV =

Original: ( X ′ )
Revised: ( X ′ )

Original: T X .
Revised: T X .

Original: Here, accounting for the sign of the determinant is not necessary.
Revised: Here, accounting for the sign of the determinant is not necessary.

Original: E.2.4 Simultaneous rotation and translation invariance
Revised: E.2.4 Simultaneous rotation and translation invariance

Original: By definition of the special Euclidean group SE ( D ) and the associated group action (see Appendix C.4), we have t ◦ X ′ =
Revised: By definition of the special Euclidean group SE ( D ) and the associated group action (see Appendix C.4), we have t ◦ X ′ =

Original: X ′ R T
Revised: X ′ R T

Original: +
Revised: +

Original: 1 N b T for some rotation matrix R and translation vector b ∈ R D .
Revised: 1 N b T for some rotation matrix R and translation vector b ∈ R D .

Original: Thus,
Revised: Thus,

Original: [Equation]
Revised: [Equation]

Original: It can be shown that this is equivalent to centering X ′ and X
Revised: It can be shown that this is equivalent to centering X ′ and X

Original: and then solving the orthogonal
Revised: and then solving the orthogonal

Original: Procrustes problem [112], i.e.
Revised: Procrustes problem [112], i.e.

Original: [Equation]
Revised: [Equation]

Original: As discussed in Appendix E.2.2, this problem can be solved via singular value decomposition.
Revised: As discussed in Appendix E.2.2, this problem can be solved via singular value decomposition.

Original: E.2.5 Permutation invariance
Revised: E.2.5 Permutation invariance

Original: By definition of the permutation group S ( N ) and the associated group action (see Appendix C.6), we have t ◦ X ′ =
Revised: By definition of the permutation group S ( N ) and the associated group action (see Appendix C.6), we have t ◦ X ′ =

Original: P X ′ for some permutation matrix P .
Revised: P X ′ for some permutation matrix P .

Original: Thus,
Revised: Thus,

Original: [Equation]
Revised: [Equation]

Original: The inner optimization problem is equivalent to finding an optimal matching in a bipartite graph with 2 · N nodes whose cost matrix is given by C n,m = ||
Revised: The inner optimization problem is equivalent to finding an optimal matching in a bipartite graph with 2 · N nodes whose cost matrix is given by C n,m = ||

Original: X ′ n − X m ||
Revised: X ′ n − X m ||

Original: This problem can be solved in polynomial time, for example via the Hungarian algorithm [134].
Revised: This problem can be solved in polynomial time, for example via the Hungarian algorithm [134].

Original: E.2.6 Simultaneous permutation, rotation and translation invariance
Revised: E.2.6 Simultaneous permutation, rotation and translation invariance

Original: By definition of the permutation group S ( N ) and the special Euclidean group SE ( N ) , we have
Revised: By definition of the permutation group S ( N ) and the special Euclidean group SE ( N ) , we have

Original: [Equation]
Revised: [Equation]

Original: Different from the previously discussed problems, the above is a challenging optimization problem known as point cloud registration, which does not have an efficiently computable solution.
Revised: Different from the previously discussed problems, the above is a challenging optimization problem known as point cloud registration, which does not have an efficiently computable solution.

Original: Approximate solutions to this problem are being actively studied (for a comprehensive survey, see [135]).
Revised: Approximate solutions to this problem are being actively studied (for a comprehensive survey, see [135]).

Original: Note that, if some upper bound ˆ m with min τ ∈ T || ( τ ◦ X ′ )
Revised: Note that, if some upper bound ˆ m with min τ ∈ T || ( τ ◦ X ′ )

Original: − X
Revised: − X

Original: || 2 <
Revised: || 2 <

Original: ˆ m fulfills ˆ m < r , then min τ ∈ T
Revised: ˆ m fulfills ˆ m < r , then min τ ∈ T

Original: ||
Revised: ||

Original: ( τ ◦ X ′ )
Revised: ( τ ◦ X ′ )

Original: − X
Revised: − X

Original: || 2 < r .
Revised: || 2 < r .

Original: Thus, any approximate solution to the point cloud registration problem can be used for certification.
Revised: Thus, any approximate solution to the point cloud registration problem can be used for certification.

Original: If ˆ m < r , we provably know that X ′ ∈ ˜ B and thus f ( X ′ )
Revised: If ˆ m < r , we provably know that X ′ ∈ ˜ B and thus f ( X ′ )

Original: =
Revised: =

Original: y ∗ .
Revised: y ∗ .

Original: However, there may be some X ′ ∈ ˜ B with ˆ m > r , which would be incorrectly declared as potential adversarial examples.
Revised: However, there may be some X ′ ∈ ˜ B with ˆ m > r , which would be incorrectly declared as potential adversarial examples.

Original: Thus, an explicit characterization based on approximate solutions to the point cloud registration problem is sound, but not optimal.
Revised: Thus, an explicit characterization based on approximate solutions to the point cloud registration problem is sound, but not optimal.

Original: F Tight gray-box certificates
Revised: F Tight gray-box certificates

Original: In the following, we first prove Lemma 1, which lets us reduce the invariance-constrained optimization problem from Section 6 to a problem that is only constrained by the classifier’s clean prediction probability.
Revised: In the following, we first prove Lemma 1, which lets us reduce the invariance-constrained optimization problem from Section 6 to a problem that is only constrained by the classifier’s clean prediction probability.

Original: Then, we restate the Neyman-Pearson lemma from statistical testing, which provides an exact solution for the worst-case classifier, given its clean prediction probability.
Revised: Then, we restate the Neyman-Pearson lemma from statistical testing, which provides an exact solution for the worst-case classifier, given its clean prediction probability.

Original: After that, we use the two lemmeta in proving Theorem 3, which summarizes tight certificates for translation, rotation and roto-translation invariance.
Revised: After that, we use the two lemmeta in proving Theorem 3, which summarizes tight certificates for translation, rotation and roto-translation invariance.

Original: Next, we discuss the certificates for each type of invariance in more detail and derive the results presented in Sections 6.2 to 6.5 from Theorem 3.
Revised: Next, we discuss the certificates for each type of invariance in more detail and derive the results presented in Sections 6.2 to 6.5 from Theorem 3.

Original: We conclude by showing how to use Monte Carlo sampling to obtain narrow probabilistic bounds on the certificates involving rotation invariance (Appendix F.5).
Revised: We conclude by showing how to use Monte Carlo sampling to obtain narrow probabilistic bounds on the certificates involving rotation invariance (Appendix F.5).

Original: F.1 Proof of Lemma
Revised: F.1 Proof of Lemma

Original: Recall from Section 6 that, in order to obtain tight gray-box certificates, we need to find the worst-case invariant classifier.
Revised: Recall from Section 6 that, in order to obtain tight gray-box certificates, we need to find the worst-case invariant classifier.

Original: That is, we need to solve min h ∈ H T Pr Z ∼ µ X ′
Revised: That is, we need to solve min h ∈ H T Pr Z ∼ µ X ′

Original: [ h ( Z ) =
Revised: [ h ( Z ) =

Original: y ∗ ] , where H T is the set of all classifiers that are at least as likely as base classifier g to predict class p X ,y ∗ and have the same invariances.
Revised: y ∗ ] , where H T is the set of all classifiers that are at least as likely as base classifier g to predict class p X ,y ∗ and have the same invariances.

Original: We want to prove that the invariance constraint can be eliminated via a canonical map γ ( Z ) , which maps each input Z ∈ R N × D to a distinct representative of its orbit [ Z ] T .
Revised: We want to prove that the invariance constraint can be eliminated via a canonical map γ ( Z ) , which maps each input Z ∈ R N × D to a distinct representative of its orbit [ Z ] T .

Original: Lemma 1.
Revised: Lemma 1.

Original: Let g : R N × D
Revised: Let g : R N × D

Original: → Y be invariant under group T and let H T be defined as in Eq.
Revised: → Y be invariant under group T and let H T be defined as in Eq.

Original: If γ : R N × D → R N × D is a canonical map for invariance under T , then min
Revised: If γ : R N × D → R N × D is a canonical map for invariance under T , then min

Original: [Equation]
Revised: [Equation]

Original: T
Revised: T

Original: [Equation]
Revised: [Equation]

Original: For the proof, recall
Revised: For the proof, recall

Original: Definition 1 (Orbits) .
Revised: Definition 1.

Original: The orbit of an input X ∈ R N × D w.r.t.
Revised: The orbit of an input X ∈ R N × D w.r.t.

Original: a group T is [ X ] T = { t ◦ X | t ∈ T } .
Revised: a group T is [ X ] T = { t ◦ X | t ∈ T } .

Original: and
Revised: and

Original: Definition 3 (Canonical map) .
Revised: Definition 3.

Original: A canonical map for invariance under a group of transformations T is a function γ : R N × D
Revised: A canonical map for invariance under a group of transformations T is a function γ : R N × D

Original: → R N × D with
Revised: → R N × D with

Original: [Equation]
Revised: [Equation]

Original: ) and
Revised: and

Original: [Equation]
Revised: [Equation]

Original: We begin our proof by deriving two lemmeta.
Revised: We begin our proof by deriving two lemmeta.

Original: The first lemma states that, if an input Z is not the representative of its own orbit, then it cannot be the representative of any orbit.
Revised: The first lemma states that, if an input Z is not the representative of its own orbit, then it cannot be the representative of any orbit.

Original: Lemma 3.
Revised: Lemma 3.

Original: Let γ be a canonical map for invariance under T .
Revised: Let γ be a canonical map for invariance under T .

Original: Then, for all Z ∈ R N × D
Revised: Then, for all Z ∈ R N × D

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: Proof by contraposition.
Revised: Proof by contraposition.

Original: Assume there was some Z ′ with γ ( Z ′ )
Revised: Assume there was some Z ′ with γ ( Z ′ )

Original: =
Revised: =

Original: Z .
Revised: Z .

Original: Eq.
Revised: Eq.

Original: (3) from Definition 1 would imply that Z ∈ [ Z ′ ] T .
Revised: (3) from Definition 1 would imply that Z ∈ [ Z ′ ] T .

Original: Eq.
Revised: Eq.

Original: (4) from Definition 1 would then imply that γ ( Z ′ ) =
Revised: (4) from Definition 1 would then imply that γ ( Z ′ ) =

Original: γ ( Z ) .
Revised: γ ( Z ) .

Original: By the transitive property, we would have Z = γ ( Z ′ )
Revised: By the transitive property, we would have Z = γ ( Z ′ )

Original: =
Revised: =

Original: γ ( Z ) .
Revised: γ ( Z ) .

Original: The second lemma allows us to replace all equality constraints ∀ Z
Revised: The second lemma allows us to replace all equality constraints ∀ Z

Original: ′ ∈
Revised: ′ ∈

Original: [ Z ] T : h ( Z ) =
Revised: [ Z ] T : h ( Z ) =

Original: h ( Z ′ ) involving input Z and element of its equivalence class with a single equality constraint h ( Z )
Revised: h ( Z ′ ) involving input Z and element of its equivalence class with a single equality constraint h ( Z )

Original: =
Revised: =

Original: h ( γ ( Z )) .
Revised: h ( γ ( Z )) .

Original: Lemma 4.
Revised: Lemma 4.

Original: Let γ be a canonical map for invariance under T .
Revised: Let γ be a canonical map for invariance under T .

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: ⇒ Consider an arbitrary Z ∈ R N × D .
Revised: ⇒ Consider an arbitrary Z ∈ R N × D .

Original: Due to Eq.
Revised: Due to Eq.

Original: (3) from Definition 1, we know that γ ( Z ) ∈
Revised: (3) from Definition 1, we know that γ ( Z ) ∈

Original: [ Z ] T .
Revised: [ Z ] T .

Original: Therefore, ∀ Z ′ ∈
Revised: Therefore, ∀ Z ′ ∈

Original: [ Z ] T : h ( Z ) =
Revised: [ Z ] T : h ( Z ) =

Original: h ( Z ′ ) implies h ( Z )
Revised: h ( Z ′ ) implies h ( Z )

Original: =
Revised: =

Original: h ( γ ( Z )) .
Revised: h ( γ ( Z )) .

Original: ⇐ Assume that ∀ Z : h ( Z )
Revised: ⇐ Assume that ∀ Z : h ( Z )

Original: =
Revised: =

Original: h ( γ ( Z )) .
Revised: h ( γ ( Z )) .

Original: Consider an arbitrary pair of inputs Z ∈ R N × D ,
Revised: Consider an arbitrary pair of inputs Z ∈ R N × D ,

Original: Z ′ ∈
Revised: Z ′ ∈

Original: [ Z ] T .
Revised: [ Z ] T .

Original: Due to our assumption, we know that h ( Z )
Revised: Due to our assumption, we know that h ( Z )

Original: =
Revised: =

Original: h ( γ ( Z )) .
Revised: h ( γ ( Z )) .

Original: Due to Eq.
Revised: Due to Eq.

Original: (4) from Definition 3, we know that γ ( Z ) =
Revised: (4) from Definition 3, we know that γ ( Z ) =

Original: γ ( Z ′ ) and thus h ( γ ( Z ))
Revised: γ ( Z ′ ) and thus h ( γ ( Z ))

Original: =
Revised: =

Original: h ( γ ( Z ′ )) .
Revised: h ( γ ( Z ′ )) .

Original: Again, due to our assumption, we know that h ( γ ( Z ′ ))
Revised: Again, due to our assumption, we know that h ( γ ( Z ′ ))

Original: =
Revised: =

Original: h ( Z ′ ) .
Revised: h ( Z ′ ) .

Original: By the transitive property, we have h ( Z )
Revised: By the transitive property, we have h ( Z )

Original: =
Revised: =

Original: h ( Z ′ ) .
Revised: h ( Z ′ ) .

Original: We can now apply the two lemmata to prove Lemma 1.
Revised: We can now apply the two lemmata to prove Lemma 1.

Original: Lemma 4 allows us to restate H T as follows:
Revised: Lemma 4 allows us to restate H T as follows:

Original: [Equation]
Revised: [Equation]

Original: Thus, the optimization problem min h ∈ H T
Revised: Thus, the optimization problem min h ∈ H T

Original: Pr Z ∼ µ X ′
Revised: Pr Z ∼ µ X ′

Original: [ h ( Z ) =
Revised: [ h ( Z ) =

Original: y ∗ ] can be written as
Revised: y ∗ ] can be written as

Original: [Equation]
Revised: [Equation]

Original: Since we already know from the second constraint that any feasible solution must fulfill h ( Z )
Revised: Since we already know from the second constraint that any feasible solution must fulfill h ( Z )

Original: =
Revised: =

Original: h ( γ ( Z )) , we may as well substitute h ( γ ( Z )) for h ( Z ) before solving the problem:
Revised: h ( γ ( Z )) , we may as well substitute h ( γ ( Z )) for h ( Z ) before solving the problem:

Original: [Equation]
Revised: [Equation]

Original: For each Z ∈ R N × D , we can now distinguish two cases: If Z = γ ( Z ) , then the constraint h ( Z ) =
Revised: For each Z ∈ R N × D , we can now distinguish two cases: If Z = γ ( Z ) , then the constraint h ( Z ) =

Original: h ( γ ( Z )) is trivially fulfilled and can thus be dropped.
Revised: h ( γ ( Z )) is trivially fulfilled and can thus be dropped.

Original: If Z ̸ = γ ( Z ) , then Lemma 3 shows that h ( Z ) does not appear in the objective function or first constraint of Eq.
Revised: If Z ̸ = γ ( Z ) , then Lemma 3 shows that h ( Z ) does not appear in the objective function or first constraint of Eq.

Original: (13), because there is no other Z ′ with γ ( Z ′ )
Revised: (13), because there is no other Z ′ with γ ( Z ′ )

Original: =
Revised: =

Original: Z .
Revised: Z .

Original: We can thus ignore the second constraint, solve the optimization problem
Revised: We can thus ignore the second constraint, solve the optimization problem

Original: [Equation]
Revised: [Equation]

Original: and then let h ( Z ) ← h ( γ ( Z )) to obtain an optimal, feasible solution to Eq.
Revised: and then let h ( Z ) ← h ( γ ( Z )) to obtain an optimal, feasible solution to Eq.

Original: F.2 Neyman-Pearson Lemma
Revised: F.2 Neyman-Pearson Lemma

Original: For our purposes, the Neyman-Pearson lemma [107] can be formulated as follows:
Revised: For our purposes, the Neyman-Pearson lemma [107] can be formulated as follows:

Original: Lemma 5 (Neyman-Pearson lower bound) .
Revised: Lemma 5 (Neyman-Pearson lower bound) .

Original: Let µ X ′ , µ X , be two continuous distributions over a measurable set
Revised: Let µ X ′ , µ X , be two continuous distributions over a measurable set

Original: A such that, for all κ ∈ R + , the set (cid:110) z | µ X ′ ( z ) µ X ( z ) =
Revised: A such that, for all κ ∈ R + , the set (cid:110) z | µ X ′ ( z ) µ X ( z ) =

Original: κ (cid:111) has measure zero.
Revised: κ (cid:111) has measure zero.

Original: Consider an arbitrary label set Y , a specific class label y ∈ Y and scalar p ∈ [0 , 1] .
Revised: Consider an arbitrary label set Y , a specific class label y ∈ Y and scalar p ∈ [0 , 1] .

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: min
Revised: min

Original: [Equation]
Revised: [Equation]

Original: z
Revised: z

Original: [Equation]
Revised: [Equation]

Original: with h ∗ ( z ) = 1 (cid:20)
Revised: with h ∗ ( z ) = 1 (cid:20)

Original: [Equation]
Revised: [Equation]

Original: X
Revised: X

Original: [Equation]
Revised: [Equation]

Original: ( z ) µ X ( z ) ≤ κ (cid:21) and κ ∈ R + such that
Revised: ( z ) µ X ( z ) ≤ κ (cid:21) and κ ∈ R + such that

Original: [Equation]
Revised: [Equation]

Original: Here, indicator function h ∗ corresponds to a classifier that predicts class y if and only if the likelihood ratio is below a specific threshold κ .
Revised: Here, indicator function h ∗ corresponds to a classifier that predicts class y if and only if the likelihood ratio is below a specific threshold κ .

Original: For an application of this variant of the Neyman-Pearson lemma to black-box robustness certification, as well as a discussion of its relation to most powerful hypothesis tests, see [26].
Revised: For an application of this variant of the Neyman-Pearson lemma to black-box robustness certification, as well as a discussion of its relation to most powerful hypothesis tests, see [26].

Original: For various other formulations of the lemma, see [136].
Revised: For various other formulations of the lemma, see [136].

Original: One can use the same approach to obtain an upper bound on the probability of predicting a specific class.
Revised: One can use the same approach to obtain an upper bound on the probability of predicting a specific class.

Original: This will be relevant for our discussion of multi-class certificates in Appendix H.
Revised: This will be relevant for our discussion of multi-class certificates in Appendix H.

Original: Lemma 6 (Neyman-Pearson upper bound) .
Revised: Lemma 6 (Neyman-Pearson upper bound) .

Original: Let µ X ′ , µ X , be two continuous distributions over a measurable set
Revised: Let µ X ′ , µ X , be two continuous distributions over a measurable set

Original: A such that, for all κ ∈ R + , the set (cid:110) z | µ X ′ ( z ) µ X ( z ) =
Revised: A such that, for all κ ∈ R + , the set (cid:110) z | µ X ′ ( z ) µ X ( z ) =

Original: κ (cid:111) has measure zero.
Revised: κ (cid:111) has measure zero.

Original: Consider an arbitrary label set Y , a specific class label y ∈ Y and scalar p ∈ [0 , 1] .
Revised: Consider an arbitrary label set Y , a specific class label y ∈ Y and scalar p ∈ [0 , 1] .

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: with h ∗ ( z ) = 1 (cid:20) µ X ′ ( z ) µ X ( z ) ≥ κ (cid:21) and κ ∈ R + such that
Revised: with h ∗ ( z ) = 1 (cid:20) µ X ′ ( z ) µ X ( z ) ≥ κ (cid:21) and κ ∈ R + such that

Original: [Equation]
Revised: [Equation]

Original: F.3 Proof of Theorem
Revised: F.3 Proof of Theorem

Original: Theorem 3.
Revised: Theorem 3.

Original: Let g : R N × D
Revised: Let g : R N × D

Original: → Y be invariant under T with T chosen from { T ( D ) , SO ( D ) , SE ( D ) } .
Revised: → Y be invariant under T with T chosen from { T ( D ) , SO ( D ) , SE ( D ) } .

Original: For SO ( D ) and SE ( D ) , let D ∈ { 2 , 3 } .
Revised: For SO ( D ) and SE ( D ) , let D ∈ { 2 , 3 } .

Original: Let H T be defined as in Eq.
Revised: Let H T be defined as in Eq.

Original: (2) and η be a right Haar measure on T .
Revised: (2) and η be a right Haar measure on T .

Original: Define the indicator function h ∗ : R N × D → { 0 , 1 } with
Revised: Define the indicator function h ∗ : R N × D → { 0 , 1 } with

Original: [Equation]
Revised: [Equation]

Original: , where β X ( Z
Revised: , where β X ( Z

Original: [Equation]
Revised: [Equation]

Original: and κ ∈ R such that
Revised: and κ ∈ R such that

Original: [Equation]
Revised: [Equation]

Original: Then
Revised: Then

Original: [Equation]
Revised: [Equation]

Original: We begin our proof by applying Lemma 1, which lets us restate the l.h.s.
Revised: We begin our proof by applying Lemma 1, which lets us restate the l.h.s.

Original: optimization problem from Eq.
Revised: optimization problem from Eq.

Original: (7) as
Revised: (7) as

Original: [Equation]
Revised: [Equation]

Original: with canonical map γ : R N × D
Revised: with canonical map γ : R N × D

Original: → R N × D .
Revised: → R N × D .

Original: Note that Eq.
Revised: Note that Eq.

Original: (14) has the same form as the optimization problem solved by the Neyman Perason lemma (Lemma 5), save for the canonical representation in the probability terms.
Revised: (14) has the same form as the optimization problem solved by the Neyman Pearson lemma (Lemma 5), save for the canonical representation in the probability terms.

Original: Our goal is to 1.)
Revised: Our goal is to 1.)

Original: specify a canonical map γ for invariance w.r.t.
Revised: specify a canonical map γ for invariance w.r.t.

Original: group T 2.) bring the two probability terms from Eq.
Revised: group T 2.) bring the two probability terms from Eq.

Original: (14) into a form that does not depend γ , so that we can solve Eq.
Revised: (14) into a form that does not depend γ , so that we can solve Eq.

Original: (14) exactly via the
Revised: (14) exactly via the

Original: Neyman-Pearson lemma.
Revised: Neyman-Pearson lemma.

Original: To this end, we make the following proposition, which we shall later verify for the different considered groups T :
Revised: To this end, we make the following proposition, which we shall later verify for the different considered groups T :

Original: Proposition 1.
Revised: Proposition 1.

Original: Let T ∈ { T ( D ) , SO ( D ) , SE ( D ) } .
Revised: Let T ∈ { T ( D ) , SO ( D ) , SE ( D ) } .

Original: For SO ( D ) and SE ( D ) , let D ∈ { 2 , 3 } .
Revised: For SO ( D ) and SE ( D ) , let D ∈ { 2 , 3 } .

Original: Let e ∈ T be the group’s identity element and ◦ : T × R N × D → R N × D be the group action (see Appendix C).
Revised: Let e ∈ T be the group’s identity element and ◦ : T × R N × D → R N × D be the group action (see Appendix C).

Original: There exist a parameter space Ω ⊆ R K , a function τ : Ω → T with τ ( 0 ) =
Revised: There exist a parameter space Ω ⊆ R K , a function τ : Ω → T with τ ( 0 ) =

Original: e , as well as a parameter space Ψ ⊆
Revised: e , as well as a parameter space Ψ ⊆

Original: R N · D − K and a function ξ : ψ → R N × D with K ∈ { 1 , . . .
Revised: R N · D − K and a function ξ : ψ → R N × D with K ∈ { 1 , . . .

Original: , N · D − 1 } such that
Revised: , N · D − 1 } such that

Original: [Equation]
Revised: [Equation]

Original: is a differentiable, surjective function from Ω × Ψ to R N × D , injective almost everywhere and fulfills
Revised: is a differentiable, surjective function from Ω × Ψ to R N × D , injective almost everywhere and fulfills

Original: [Equation]
Revised: [Equation]

Original: That is, the input space R N × D can be parameterized by a matrix ξ ( ψ ) ∈ R N × D that is transformed by a group element τ ( ω ) ∈ T .
Revised: That is, the input space R N × D can be parameterized by a matrix ξ ( ψ ) ∈ R N × D that is transformed by a group element τ ( ω ) ∈ T .

Original: As formalized in Eq.
Revised: As formalized in Eq.

Original: (16), this alternative parameterization lets us neatly disentagle the effect of a group action, which is a translation and/or rotation of the coordinate system, from the (group-invariant) geometry of Z , i.e. ξ ( ψ ) .
Revised: (16), this alternative parameterization lets us neatly disentagle the effect of a group action, which is a translation and/or rotation of the coordinate system, from the (group-invariant) geometry of Z , i.e. ξ ( ψ ) .

Original: Canonical map.
Revised: Canonical map.

Original: Based on Proposition 1, we can define the following canonical map γ : R N × D
Revised: Based on Proposition 1, we can define the following canonical map γ : R N × D

Original: → R N × D for Z = λ ( ω , ψ ) :
Revised: → R N × D for Z = λ ( ω , ψ ) :

Original: [Equation]
Revised: [Equation]

Original: Note that ( τ ( ω ))
Revised: Note that ( τ ( ω ))

Original: − 1 ∈ T is the inverse of group element τ ( ω ) ∈ T and not the inverse of the function τ .
Revised: − 1 ∈ T is the inverse of group element τ ( ω ) ∈ T and not the inverse of the function τ .

Original: Further note that by Eq.
Revised: Further note that by Eq.

Original: (15), it holds for arbitrary Z = λ ( ω , ψ ) that
Revised: (15), it holds for arbitrary Z = λ ( ω , ψ ) that

Original: [Equation]
Revised: [Equation]

Original: We can verify that γ is indeed a valid canonical map by testing the two criteria from Definition 3.
Revised: We can verify that γ is indeed a valid canonical map by testing the two criteria from Definition 3.

Original: Because γ ( Z ) applies a group action, we have γ ( Z ) ∈
Revised: Because γ ( Z ) applies a group action, we have γ ( Z ) ∈

Original: [ Z ] T , where [ Z ] T is the orbit of Z w.r.t.
Revised: [ Z ] T , where [ Z ] T is the orbit of Z w.r.t.

Original: T .
Revised: T .

Original: Due to Eq.
Revised: Due to Eq.

Original: (16), we have ∀ Z
Revised: (16), we have ∀ Z

Original: , ∀ Z ∈ [ Z ] T : γ ( Z ) =
Revised: , ∀ Z ∈ [ Z ] T : γ ( Z ) =

Original: γ ( λ ( ω , z )) =
Revised: γ ( λ ( ω , z )) =