Original: for any weights { w i } Ni =1 , M MME has higher certiﬁed robustness than M WE .
Revised: for any weights { w i } Ni =1 , M MME has higher certiﬁed robustness than M WE .

Original: Here, the certiﬁed robustness is given by Theorems 6 and 7.
Revised: Here, the certiﬁed robustness is given by Theorems 6 and 7.

Original: Proof of Corollary 5.
Revised: Proof of Corollary 5.

Original: According to Lemma D.4, we have
Revised: According to Lemma D.4, we have

Original: [Equation]
Revised: [Equation]

Original: According to Theorems 6 and 7, we know the RHS in Equation (44) is larger than the RHS in
Revised: According to Theorems 6 and 7, we know the RHS in Equation (44) is larger than the RHS in

Original: Equation (45), i.e., M WE has higher certiﬁed robustnesss than M MME .
Revised: Equation (45), i.e., M WE has higher certiﬁed robustnesss than M MME .

Original: According to Lemma D.4, we have
Revised: According to Lemma D.4, we have

Original: [Equation]
Revised: [Equation]

Original: According to Theorems 6 and 7, we know the RHS in Equation (45) is larger than the RHS in
Revised: According to Theorems 6 and 7, we know the RHS in Equation (45) is larger than the RHS in

Original: Equation (44), i.e., M MME has higher certiﬁed robustnesss than M WE .
Revised: Equation (44), i.e., M MME has higher certiﬁed robustnesss than M WE .

Original: Remark.
Revised: Remark.

Original: Given that λ 1 /λ 2 reﬂects the adversarial transferability among base models Appendix D.1, the corollary implies that, MME is more robust when the transferability is high; WE is more robust when the transferability is low.
Revised: Given that λ 1 /λ 2 reﬂects the adversarial transferability among base models Appendix D.1, the corollary implies that, MME is more robust when the transferability is high; WE is more robust when the transferability is low.

Original: (2) As we can observe in the proof, there is a gap between Equation (47) and Equation (48) — when λ 1 /λ 2 lies in between RHS of Equation (47) and RHS of Equation (48), it is undetermined which ensemble protocol has higher robustness.
Revised: (2) As we can observe in the proof, there is a gap between Equation (47) and Equation (48) — when λ 1 /λ 2 lies in between RHS of Equation (47) and RHS of Equation (48), it is undetermined which ensemble protocol has higher robustness.

Original: Indeed, this uncertainty is caused by the adjustable weights { w i } N i =1 of the Weighted Ensemble.
Revised: Indeed, this uncertainty is caused by the adjustable weights { w i } N i =1 of the Weighted Ensemble.

Original: If we only consider the average ensemble, then this gap is closed:
Revised: If we only consider the average ensemble, then this gap is closed:

Original: [Equation]
Revised: [Equation]

Original:  (3) Note that we assume that s f < s , where s 2 is the variance of single variable and s 2 f is the variance of minimum of N i.i.d.
Revised:  [Equation] (3) Note that we assume that s f < s , where s 2 is the variance of single variable and s 2 f is the variance of minimum of N i.i.d.

Original: variables.
Revised: variables.

Original: For common symmetry distributions, along with the increase of N , s f shrinks in the order of O (1 /N B ) where B ∈ (0 , 2] .
Revised: For common symmetry distributions, along with the increase of N , s f shrinks in the order of O (1 /N B ) where B ∈ (0 , 2] .

Original: Thus, as long as N is large, the assumption s f < s will always hold.
Revised: Thus, as long as N is large, the assumption s f < s will always hold.

Original: An exception is that when these random variables follow the exponential distribution, where s f does not shrink along with the increase of N .
Revised: An exception is that when these random variables follow the exponential distribution, where s f does not shrink along with the increase of N .

Original: However, since these random variables are conﬁdence scores which are in [0 , 1] , they cannot obey exponential distribution.
Revised: However, since these random variables are conﬁdence scores which are in [0 , 1] , they cannot obey exponential distribution.

Original: D. A C ONCRETE C ASE : U NIFORM D ISTRIBUTION
Revised: D. A C ONCRETE C ASE : U NIFORM D ISTRIBUTION

Original: As shown by Saremi & Srivastava (2020) (Remark 2.1), when the input dimension d is large, the
Revised: As shown by Saremi & Srivastava (2020) (Remark 2.1), when the input dimension d is large, the

Original: Gaussian noise ε ∼ N (0 , σ 2 I d ) ≈ Unif( σ √ dS d − 1 ) , i.e., x 0 + ε is highly uniformly distributed on the ( d − 1) -sphere centered at x 0 .
Revised: Gaussian noise ε ∼ N (0 , σ 2 I d ) ≈ Unif( σ √ dS d − 1 ) , i.e., x 0 + ε is highly uniformly distributed on the ( d − 1) -sphere centered at x 0 .

Original: Motivated by this, we study the case where the conﬁdence scores { f i ( x 0 + ε ) y 

Revised: Motivated by this, we study the case where the conﬁdence scores { f i ( x 0 + ε ) y

Original: Ni =1 are also uniformly distributed.
Revised: Ni =1 are also uniformly distributed.

Original: Under this additional assumption, we can further make the certiﬁed robustness for the single model and both ensembles more concrete.
Revised: Under this additional assumption, we can further make the certiﬁed robustness for the single model and both ensembles more concrete.

Original: D.4. C ERTIFIED R OBUSTNESS FOR S INGLE M ODEL
Revised: D.4. C ERTIFIED R OBUSTNESS FOR S INGLE M ODEL

Original: Proposition D.2 (Certiﬁed Robustness for Single Model under Uniform Distribution) .
Revised: Proposition D.2 (Certiﬁed Robustness for Single Model under Uniform Distribution) .

Original: Let ε be a random variable supported on R d .
Revised: Let ε be a random variable supported on R d .

Original: Let F be a classiﬁcation model, which is ( ε, λ 3 , p ) -single conﬁdent.
Revised: Let F be a classiﬁcation model, which is ( ε, λ 3 , p ) -single conﬁdent.

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth y 0 ∈
Revised: d be the input with ground-truth y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Suppose f ( x 0 + ε ) y 0 is uniformly distributed in [ a, b ] .
Revised: Suppose f ( x 0 + ε ) y 0 is uniformly distributed in [ a, b ] .

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: where clip( x ) = max(min
Revised: where clip( x ) = max(min

Original: ( x, 1) , 0) .
Revised: ( x, 1) , 0) .

Original: Proof of Proposition D.2.
Revised: Proof of Proposition D.2.

Original: We consider the distribution of quantity Y :
Revised: We consider the distribution of quantity Y :

Original: = f ( x 0 + ε )
Revised: = f ( x 0 + ε )

Original: y 

Revised: y

Original: − λ 3 (1 − f ( x 0 + ε ) y 0 ) .
Revised: − λ 3 (1 − f ( x 0 + ε ) y 0 ) .

Original: Since the model F is ( ε, λ 3 , p ) -single conﬁdent, with probability 1 − p , Y ≤ f ( x 0 + ε ) y 0 − max y j ∈
Revised: Since the model F is ( ε, λ 3 , p ) -single conﬁdent, with probability 1 − p , Y ≤ f ( x 0 + ε ) y 0 − max y j ∈

Original: [ C ]: y j (cid:54) =
Revised: [ C ]: y j (cid:54) =

Original: y 

Revised: y

Original: f ( x 0 + ε ) y j .
Revised: f ( x 0 + ε ) y j .

Original: At the same time, because f ( x 0 + (cid:15) )
Revised: At the same time, because f ( x 0 + (cid:15) )

Original: y 0 follows the distribution U ([ a, b ]) ,
Revised: y 0 follows the distribution U ([ a, b ]) ,

Original: Y =
Revised: Y =

Original: (1 + λ 3 ) f
Revised: (1 + λ 3 ) f

Original: ( x 0 + ε ) y 0 − λfollows the distribution U ([(1 + λ 3 ) a − λ 3 , (1 + λ 3 ) b − λ 3 ]) .
Revised: ( x 0 + ε ) y 0 − λfollows the distribution U ([(1 + λ 3 ) a − λ 3 , (1 + λ 3 ) b − λ 3 ]) .

Original: Therefore,
Revised: Therefore,

Original: [Equation]
Revised: [Equation]

Original: As the result,
Revised: As the result,

Original: [Equation]
Revised: [Equation]

Original: which is exactly
Revised: which is exactly

Original: [Equation]
Revised: [Equation]

Original: D.4. C ERTIFIED R OBUSTNESS FOR E NSEMBLES
Revised: D.4. C ERTIFIED R OBUSTNESS FOR E NSEMBLES

Original: Still, we deﬁne ˆ X 1 ( ε ) and ˆ X 2 ( ε ) according to Deﬁnitions D.1 and D.2.
Revised: Still, we deﬁne ˆ X 1 ( ε ) and ˆ X 2 ( ε ) according to Deﬁnitions D.1 and D.2.

Original: Under the uniform distribution assumption, we have the following lemma.
Revised: Under the uniform distribution assumption, we have the following lemma.

Original: Lemma D.5 (Expectation and Variance of ˆ X 1 and ˆ X 2 under Uniform Distribution) .
Revised: Lemma D.5 (Expectation and Variance of ˆ X 1 and ˆ X 2 under Uniform Distribution) .

Original: Let ˆ X 1 and ˆ Xbe deﬁned by Deﬁnition D.1 and Deﬁnition D.2 respectively.
Revised: Let ˆ X 1 and ˆ Xbe deﬁned by Deﬁnition D.1 and Deﬁnition D.2 respectively.

Original: Assume that under the distribution of ε , the base models’ conﬁdence scores for true class { f i ( x 0 + ε ) y 0 } Ni =1 are pairwise i.i.d and uniformly distributed in range [ a, b ] .
Revised: Assume that under the distribution of ε , the base models’ conﬁdence scores for true class { f i ( x 0 + ε ) y 0 } Ni =1 are pairwise i.i.d and uniformly distributed in range [ a, b ] .

Original: We have
Revised: We have

Revised: [Equation]

Revised: Var

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma D.5.
Revised: Proof of Lemma D.5.

Original: We start from analyzing ˆ X 1 .
Revised: We start from analyzing ˆ X 1 .

Original: From the deﬁnition
Revised: From the deﬁnition

Original: [Equation]
Revised: [Equation]

Original: where { f i ( x 0 + (cid:15) )
Revised: where { f i ( x 0 + (cid:15) )

Original: y 0 } Ni =1 are i.i.d.
Revised: y 0 } Ni =1 are i.i

Revised: [Equation]

Original:  variables obeying uniform distribution U ([ a, b ]) ,
Revised: d. variables obeying uniform distribution U ([ a, b ]) ,

Original: [Equation]
Revised: [Equation]

Original: Now analyze the expectation of ˆ X 2 .
Revised: Now analyze the expectation of ˆ X 2 .

Original: By the symmetry of uniform distribution, we know
Revised: By the symmetry of uniform distribution, we know

Original: [Equation]
Revised: [Equation]

Original: To reason about the variance, we need the following fact:
Revised: To reason about the variance [Equation] we need the following fact:

Original: Fact D.1.
Revised: Fact D.1.

Original: Let x 1 , x 2 , . . .
Revised: Let x 1 , x 2 , . . .

Original: , x n be uniformly distributed and independent random variables.
Revised: , x n be uniformly distributed and independent random variables.

Original: Speciﬁcally, for each 1 ≤ i ≤ n , x i ∼ U ([ a, b ]) .
Revised: Speciﬁcally, for each 1 ≤ i ≤ n , x i ∼ U ([ a, b ]) .

Original: Then we have
Revised: Then we have

Original: [Equation]
Revised: [Equation]

Original: Observing that each i.i.d.
Revised: Observing that each i.i.d.

Original: f i ( x 0 + ε ) y 0 is exactly identical to x i in Fact D.1, we have[Equation] min [Equation]
Revised: f i ( x 0 + ε ) y 0 is exactly identical to x i in Fact D.1, we have

Original: (cid:19) ≤

Original: N +(cid:18)

Original: N

Original: [Equation]
Revised: [Equation]

Original: −
Revised: −

Original: N

Original: [Equation]

Original: (cid:19)

Original: [Equation]

Original: b − a )

Original: [Equation]
Revised: [Equation]

Original: Therefore,
Revised: Therefore,

Original: Varˆ X
Revised: Var

Original: [Equation]
Revised: [Equation]

Original: N
Revised: −

Original: [Equation]
Revised: [Equation]

Original: (cid:19) ( b − a )
Revised: Proof of Fact D

Original: [Equation]
Revised: [Equation]

Original: Proof of Fact D.1.

Original: From symmetry of uniform distribution, we know Var (min 1 ≤ i ≤ n x i ) =
Revised: From symmetry of uniform distribution, we know Var (min 1 ≤ i ≤ n x i ) =

Original: Var (max 1 ≤ i ≤ n x i ) .
Revised: Var (max 1 ≤ i ≤ n x i ) .

Original: So here we only consider Y :=
Revised: So here we only consider Y :=

Original: min 1 ≤ i ≤ n x i .
Revised: min 1 ≤ i ≤ n x i .

Original: Its CDF F and PDF f can be easily computed:
Revised: Its CDF F and PDF f can be easily computed:

Original: [Equation]
Revised: [Equation]

Original: y ∈ [ a, b ] .
Revised: b [Equation]

Original: Hence,
Revised: Hence,

Original: [Equation]
Revised: [Equation]

Original: = − (cid:18) b − y b − a (cid:19) n y 2 (cid:12)(cid:12)(cid:12) b a +
Revised: b − y b [Equation] a (cid:19) n y 2 (cid:12)(cid:12)(cid:12) b a +

Original: [Equation]
Revised: [Equation]

Original: n +(cid:18)
Revised: n [Equation] (cid:18) [Equation]

Revised: b

Original: [Equation]
Revised: [Equation]

Revised: n

Revised: [Equation]

Original: ( b
Revised: ( b

Revised: [Equation]

Revised: a

Original: [Equation]
Revised: [Equation]

Revised: (cid:90) ( b

Revised: [Equation]

Original: ) n + ( b − a )n
Revised: n + ( b [Equation] a )

Original: [Equation]
Revised: [Equation]

Original: (cid:90) ( b − y ) n + ( b − a ) n d y (cid:19) (cid:12)(cid:12)(cid:12) b a
Revised: y (cid:19) (cid:12)(cid:12)(cid:12) b a

Original: [Equation]
Revised: [Equation]

Original: (cid:19)
Revised: (cid:19)

Original: [Equation]
Revised: [Equation]

Original: (cid:12)(cid:12)(cid:12)
Revised: (cid:12)(cid:12)(cid:12)

Original: [Equation]
Revised: [Equation]

Original: (cid:18)
Revised: (cid:18)

Original: [Equation]
Revised: [Equation]

Original: [Equation] + ( b 
Revised: ( b [Equation]

Original: [Equation]
Revised: [Equation]

Original: n +
Revised: n +

Original: [Equation]
Revised: [Equation]

Original: ( b
Revised: ( b

Original: [Equation]
Revised: [Equation]

Original: ) n + ( b
Revised: n + ( b

Original: [Equation]
Revised: [Equation]

Original: a ) n (cid:19) (cid:12)(cid:12)(cid:12) b a
Revised: a ) n (cid:19) (cid:12)(cid:12)(cid:12) b a

Original: [Equation]
Revised: [Equation]

Original: As the result, Var Y
Revised: As the result, Var Y

Original: =

Original: E Y 2 −

Original: [Equation]
Revised: [Equation]

Original: EY
Revised: E

Original: [Equation]
Revised: [Equation]

Original: Now, similarly, we use Lemma D.1 to derive the statistical robustness lower bound for WE and MME.
Revised: Now, similarly, we use Lemma D.1 to derive the statistical robustness lower bound for WE and MME.

Original: We omit the proofs since they are direct applications of Lemma D.5, Lemma D.1, and Lemma D.2.
Revised: We omit the proofs since they are direct applications of Lemma D.5, Lemma D.1, and Lemma D.2.

Original: Theorem 8 (Certiﬁed Robustness for WE under Uniform Distribution) .
Revised: Theorem 8 (Certiﬁed Robustness for WE under Uniform Distribution) .

Original: Let M WE be a Weighted
Revised: Let M WE be a Weighted

Original: Ensemble deﬁned over { F i } Ni =1 with weights { w i } Ni =1 .
Revised: Ensemble deﬁned over { F i } Ni =1 with weights { w i } Ni =1 .

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth label y 0 ∈
Revised: d be the input with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε be a random variable supported on R d .
Revised: Let ε be a random variable supported on R d .

Original: Under the distribution of ε , suppose { f i ( x 0 + ε ) y 0 }
Revised: Under the distribution of ε , suppose { f i ( x 0 + ε ) y 0 }

Original: Ni =1 are i.i.d.
Revised: Ni =1 are i.i.d.

Original: and uniformly distributed in [ a, b ] .
Revised: and uniformly distributed in [ a, b ] .

Original: The M WE is ( ε, λ 1 , p ) -WE conﬁdent.
Revised: The M WE is ( ε, λ 1 , p ) -WE conﬁdent.

Original: Assume a + b 2 > 1 1+ λ
Revised: Assume a + b 2 > 1 1+ λ

Original: [Equation]
Revised: [Equation]

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: Theorem 9 (Certiﬁed Robustness for MME under Uniform Distribution) .
Revised: Theorem 9 (Certiﬁed Robustness for MME under Uniform Distribution) .

Original: Let M MME be a MaxMargin Ensemble over { F i } Ni =1 .
Revised: Let M MME be a MaxMargin Ensemble over { F i } Ni =1 .

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth label y 0 ∈
Revised: d be the input with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε be a random variable supported on R d .
Revised: Let ε be a random variable supported on R d .

Original: Under the distribution of ε , suppose { f i ( x 0 + ε ) y 0 }
Revised: Under the distribution of ε , suppose { f i ( x 0 + ε ) y 0 }

Original: Ni =1 are i.i.d.
Revised: Ni =1 are i.i.d.

Original: and uniformly distributed in [ a, b ] .
Revised: and uniformly distributed in [ a, b ] .

Original: M MME is ( ε, λ 2 , p ) -MME conﬁdent.
Revised: M MME is ( ε, λ 2 , p ) -MME conﬁdent.

Original: Assume a + b 2 > 1 1+ λ − 1 2 .
Revised: Assume a + b 2 > 1 1+ λ − 1 2 .

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: where c N =
Revised: where c N =

Original: [Equation]
Revised: [Equation]

Original: D.4. C OMPARISON OF C ERTIFIED R OBUSTNESS FOR E NSEMBLES
Revised: D.4. C OMPARISON OF C ERTIFIED R OBUSTNESS FOR E NSEMBLES

Original: Now under the uniform distribution, we can also have the certiﬁed robustness comparison.
Revised: Now under the uniform distribution, we can also have the certiﬁed robustness comparison.

Original: Corollary 6 (Comparison of Certiﬁed Robustness under Uniform Distribution) .
Revised: Corollary 6 (Comparison of Certiﬁed Robustness under Uniform Distribution) .

Original: Over base models { F i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted Ensemble with weights { w i } Ni =1 .
Revised: Over base models { F i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted Ensemble with weights { w i } Ni =1 .

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth label y 0 ∈
Revised: d be the input with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε be a random variable supported on R d .
Revised: Let ε be a random variable supported on R d .

Original: Under the distribution of ε , suppose { f i ( x 0 + ε ) y 0 }
Revised: Under the distribution of ε , suppose { f i ( x 0 + ε ) y 0 }

Original: Ni =1 are i.i.d.
Revised: Ni =1 are i.i.d.

Original: and uniformly distributed with mean µ .
Revised: and uniformly distributed with mean µ .

Original: Suppose M WE is ( ε, λ 1 , p ) -WE conﬁdent, and
Revised: Suppose M WE is ( ε, λ 1 , p ) -WE conﬁdent, and

Original: M MME is ( ε, λ 2 , p ) -MME conﬁdent.
Revised: M MME is ( ε, λ 2 , p ) -MME conﬁdent.

Original: Assume µ > max (cid:110)
Revised: Assume µ > max (cid:110)

Original: [Equation]
Revised: [Equation]

Original: When
Revised: When

Original: [Equation]
Revised: [Equation]

Original: M WE has higher certiﬁed robustness than M MME .
Revised: M WE has higher certiﬁed robustness than M MME .

Original: When
Revised: When

Original: [Equation]
Revised: [Equation]

Original: M MME has higher certiﬁed robustness than M WE .
Revised: M MME has higher certiﬁed robustness than M WE .

Original: When
Revised: When

Original: [Equation]
Revised: [Equation]

Original: for any λ 1 , M MME has higher or equal certiﬁed robustness than M WE .
Revised: for any λ 1 , M MME has higher or equal certiﬁed robustness than M WE .

Original: Here, the certiﬁed robustness is given by Theorems 8 and 9.
Revised: Here, the certiﬁed robustness is given by Theorems 8 and 9.

Original: Proof of Corollary 6.
Revised: Proof of Corollary 6.

Original: First, we notice that a uniform distribution with mean µ can be any distribution
Revised: First, we notice that a uniform distribution with mean µ can be any distribution

Original: U ([ a, b ]) where ( a + b ) / 2 = µ .
Revised: U ([ a, b ]) where ( a + b ) / 2 = µ .

Original: We replace µ by ( a + b ) / 2 .
Revised: We replace µ by ( a + b ) / 2 .

Original: Then (1) and (2) follow from Lemma D.4 similar to the proof of Corollary 5.
Revised: Then (1) and (2) follow from Lemma D.4 similar to the proof of Corollary 5.

Original: (3) Since
Revised: (3) Since

Original: N >(cid:18) [Equation] (cid:18) [Equation]
Revised: N >

Original: [Equation]

Original: (cid:19)

Original: + 1 − µ (cid:33)

Original: [Equation]

Original: [Equation]

Original: [Equation]

Original: [Equation]

Original: (cid:19)

Original: [Equation]

Original: (cid:33)

Original: [Equation]
Revised: [Equation]

Original: <
Revised: <

Original: [Equation]
Revised: [Equation]

Original: the RHS of Equation (52) is smaller than 0 .
Revised: the RHS of Equation (52) is smaller than 0 .

Original: Thus, for any λ 1 , since λ 1 /λ 2 > 0 , the Equation (48) is satisﬁed.
Revised: Thus, for any λ 1 , since λ 1 /λ 2 > 0 , the Equation (48) is satisﬁed.

Original: According to (2), M MME has higher certiﬁed robustnesss than M WE .
Revised: According to (2), M MME has higher certiﬁed robustnesss than M WE .

Original: Remark.
Revised: Remark.

Original: Comparing to the general corollary (Corollary 5), under the uniform distribution, we have an additional ﬁnding that when N is sufﬁciently large, we will always have higher certiﬁed robustness for Max-Margin Ensemble than Weighted Ensemble.
Revised: Comparing to the general corollary (Corollary 5), under the uniform distribution, we have an additional ﬁnding that when N is sufﬁciently large, we will always have higher certiﬁed robustness for Max-Margin Ensemble than Weighted Ensemble.

Original: This is due to the more efﬁcient variance reduction of Max-Margin Ensemble than Weighted Ensemble.
Revised: This is due to the more efﬁcient variance reduction of Max-Margin Ensemble than Weighted Ensemble.

Original: As shown in Lemma D.5, the quantity Var ˆ X ( ε ) /
Revised: As shown in Lemma D.5, the quantity Var ˆ X ( ε ) /

Original: ( E ˆ X ( ε )) 2 for Weighted Ensemble is Ω(1 /N ) , while for Max-Margin Ensemble is O (1 /N 2 ) .
Revised: ( E ˆ X ( ε )) 2 for Weighted Ensemble is Ω(1 /N ) , while for Max-Margin Ensemble is O (1 /N 2 ) .

Original: As the result, when N becomes larger, Max-Margin Ensemble has higher certiﬁed robustness.
Revised: As the result, when N becomes larger, Max-Margin Ensemble has higher certiﬁed robustness.

Original: We use uniform assumption here to give an illustration in a speciﬁc regime.
Revised: We use uniform assumption here to give an illustration in a speciﬁc regime.

Original: We think it would be an interesting future direction to generalize the analysis to other distributions such as the Gaussian distribution that corresponds to locally linear classiﬁers.
Revised: We think it would be an interesting future direction to generalize the analysis to other distributions such as the Gaussian distribution that corresponds to locally linear classiﬁers.

Original: The result from these distribution may be derived from their speciﬁc concentration bound for maximum/minimum i.i.d.
Revised: The result from these distribution may be derived from their speciﬁc concentration bound for maximum/minimum i.i.d.

Original: random variables as discussed at the end of Appendix D.3.
Revised: random variables as discussed at the end of Appendix D.3.

Original: D. N UMERICAL E XPERIMENTS
Revised: D. N UMERICAL E XPERIMENTS

Original: To validate and give more intuitive explanations for our theorems, we present some numerical experiments.
Revised: To validate and give more intuitive explanations for our theorems, we present some numerical experiments.

Original: D.5. E NSEMBLE C OMPARISON FROM N UMERICAL S AMPLING
Revised: D.5. E NSEMBLE C OMPARISON FROM N UMERICAL S AMPLING

Original: As discussed in Appendix D.1, λ 1 /λ 2 reﬂects the transferability across base models.
Revised: As discussed in Appendix D.1, λ 1 /λ 2 reﬂects the transferability across base models.

Original: It is challenging to get enough amount of different ensembles of various transferability levels while keeping all other variables controlled.
Revised: It is challenging to get enough amount of different ensembles of various transferability levels while keeping all other variables controlled.

Original: Therefore, we simulate the transferability of ensembles numerically by varying λ 1 /λ 2 (see the deﬁnitions of λ 1 and λ 2 in Deﬁnitions 9 and 10), and sampling the conﬁdence scores { f i ( x 0 + ε ) y 0 } and { max j ∈ [ C ]: j (cid:54) =
Revised: Therefore, we simulate the transferability of ensembles numerically by varying λ 1 /λ 2 (see the deﬁnitions of λ 1 and λ 2 in Deﬁnitions 9 and 10), and sampling the conﬁdence scores { f i ( x 0 + ε ) y 0 } and { max j ∈ [ C ]: j (cid:54) =

Original: y 

Revised: y

Original: f i ( x 0 + ε ) j } under determined λ 1 and λ 2 .
Revised: f i ( x 0 + ε ) j } under determined λ 1 and λ 2 .

Original: For each level of λ 1 /λ 2 , with the samples, we compute the certiﬁed robust radius r using randomized smoothing (Lemma A.1) and compare the radius difference of Weighted Ensemble and Max-Margin
Revised: For each level of λ 1 /λ 2 , with the samples, we compute the certiﬁed robust radius r using randomized smoothing (Lemma A.1) and compare the radius difference of Weighted Ensemble and Max-Margin

Original: Ensemble.
Revised: Ensemble.

Original: According to Corollary 5, we should observe the tendency that along with the increase of transferability λ 1 /λ 2 , Max-Margin Ensemble would gradually become more certiﬁably robust than
Revised: According to Corollary 5, we should observe the tendency that along with the increase of transferability λ 1 /λ 2 , Max-Margin Ensemble would gradually become more certiﬁably robust than

Original: Weighted Ensemble.
Revised: Weighted Ensemble.

Original: Figure 4 veriﬁes the trends: with the increase of λ 1 /λ 2 , MME model tends to achieve higher certiﬁed radius than WE model.
Revised: Figure 4 veriﬁes the trends: with the increase of λ 1 /λ 2 , MME model tends to achieve higher certiﬁed radius than WE model.

Original: Moreover, we notice that under the same λ 1 /λ 2 , with the larger number of base models N , the MME tends to be relatively more certiﬁably robust compared with WE.
Revised: Moreover, we notice that under the same λ 1 /λ 2 , with the larger number of base models N , the MME tends to be relatively more certiﬁably robust compared with WE.

Original: This is because we sample the conﬁdence score uniformly and under the uniform distribution, MME tends to be more certiﬁably robust than WE when the number of base models N becomes large, according to
Revised: This is because we sample the conﬁdence score uniformly and under the uniform distribution, MME tends to be more certiﬁably robust than WE when the number of base models N becomes large, according to

Original: Corollary 6.
Revised: Corollary 6.

Original: The concrete number settings of λ 1 , λ 2 , and the sampling interval of conﬁdence scores are entailed in the caption of Figure
Revised: The concrete number settings of λ 1 , λ 2 , and the sampling interval of conﬁdence scores are entailed in the caption of Figure

Original: . D.5. E NSEMBLE C OMPARISON FROM C ERTIFIED R OBUSTNESS P LOTTING
Revised: . D.5. E NSEMBLE C OMPARISON FROM C ERTIFIED R OBUSTNESS P LOTTING

Original: In Corollary 6, we derive the concrete certiﬁed robustness for both ensembles and the single model under i.i.d.
Revised: In Corollary 6, we derive the concrete certiﬁed robustness for both ensembles and the single model under i.i.d.

Original: and uniform distribution assumption.
Revised: and uniform distribution assumption.

Original: In fact, from the corollary, we can directly compute the certiﬁed robust radius without sampling, as long as we assume the added noise ε is Gaussian.
Revised: In fact, from the corollary, we can directly compute the certiﬁed robust radius without sampling, as long as we assume the added noise ε is Gaussian.

Original: In
Revised: In

Original: Figure 5, we plot out such certiﬁed robust radius for the single model, the WE, and the MME.
Revised: Figure 5, we plot out such certiﬁed robust radius for the single model, the WE, and the MME.

Original: [Figure]
Revised: [Figure]

Original: Concretely, in the ﬁgure, we assume that the true class conﬁdence score for each base model is i.i.d.
Revised: Concretely, in the ﬁgure, we assume that the true class conﬁdence score for each base model is i.i.d.

Original: and uniformly distributed in [ a, b ] .
Revised: and uniformly distributed in [ a, b ] .

Original: The Weighted Ensemble is ( ε, λ 1 , 0 . 01)
Revised: The Weighted Ensemble is ( ε, λ 1 , 0 . 01)

Original: -WE conﬁdent; the
Revised: -WE conﬁdent; the

Original: Max-Margin Ensemble is ( ε, λ 2 , 0 . 01)
Revised: Max-Margin Ensemble is ( ε, λ 2 , 0 . 01)

Original: -MME conﬁdent; and the single model is ( ε, λ 3 , 0 . 01)
Revised: -MME conﬁdent; and the single model is ( ε, λ 3 , 0 . 01)

Original: -MME conﬁdent.
Revised: -MME conﬁdent.

Original: We guarantee that λ 1 ≤ λ 3 ≤ λ 2 to simulate the scenario that ensembles are based on the same set of base models to make a fair comparison.
Revised: We guarantee that λ 1 ≤ λ 3 ≤ λ 2 to simulate the scenario that ensembles are based on the same set of base models to make a fair comparison.

Original: We directly apply the results from our analysis (Theorem 8, Theorem 9, Proposition D.2) to get the statistical robustness for single model and both ensembles.
Revised: We directly apply the results from our analysis (Theorem 8, Theorem 9, Proposition D.2) to get the statistical robustness for single model and both ensembles.

Original: Then, we leverage Lemma A.1 to get the certiﬁed robust radius (with σ = 1 . 0 , N = 100000 and failing probability α = 0 .
Revised: Then, we leverage Lemma A.1 to get the certiﬁed robust radius (with σ = 1 . 0 , N = 100000 and failing probability α = 0 .

Original: 001 which are aligned with realistic setting).
Revised: 001 which are aligned with realistic setting).

Original: The x -axis is the number of base models N and the y -axis is the certiﬁed robustness.
Revised: The x -axis is the number of base models N and the y -axis is the certiﬁed robustness.

Original: We note that N is not applicable to the single model, so we plot the single model’s curve by a horizontal red dashed line.
Revised: We note that N is not applicable to the single model, so we plot the single model’s curve by a horizontal red dashed line.

Original: From the ﬁgure, we observe that when the number of base models N becomes larger, both ensembles perform much better than the single model.
Revised: From the ﬁgure, we observe that when the number of base models N becomes larger, both ensembles perform much better than the single model.

Original: We remark that when N is small, the ensembles have 0 certiﬁed robustness mainly because our theoretical bounds for ensembles are not tight enough with the small N .
Revised: We remark that when N is small, the ensembles have 0 certiﬁed robustness mainly because our theoretical bounds for ensembles are not tight enough with the small N .

Original: Furthermore, we observe that the Max-Margin Ensemble gradually surpasses
Revised: Furthermore, we observe that the Max-Margin Ensemble gradually surpasses

Original: Weighted Ensemble when N is large, which conforms to our Corollary 6.
Revised: Weighted Ensemble when N is large, which conforms to our Corollary 6.

Original: Note that the left sub-ﬁgure has smaller transferability λ 1 /λ 

Revised: Note that the left sub-ﬁgure has smaller transferability λ 1 /λ

Original: and the right subﬁgure has larger transferability λ 1 /λ 2 , it again conforms to our Corollary 5 and its following remarks in Appendix D.

Revised: and the right subﬁgure has larger transferability λ 1 /λ 2 , it again conforms to our Corollary 5 and its following remarks in Appendix D.

Original: that in the left subﬁgure the
Revised: that in the left subﬁgure the

Original: Weighted Ensemble is relatively more robust than the Max-Margin Ensemble.
Revised: Weighted Ensemble is relatively more robust than the Max-Margin Ensemble.

Original: D.5. E NSEMBLE C OMPARISON FROM R EALISTIC D ATA
Revised: D.5. E NSEMBLE C OMPARISON FROM R EALISTIC D ATA

Original: We study the correlation between transferability λ 1 /λ 2 and whether Weighted Ensemble or MaxMargin Ensemble is more certiﬁably robust using realistic data.
Revised: We study the correlation between transferability λ 1 /λ 2 and whether Weighted Ensemble or MaxMargin Ensemble is more certiﬁably robust using realistic data.

Original: By varying the hyper-parameters of DRT, we ﬁnd out a setting where over the same set of base models, Weighted Ensemble and Max-Margin Ensemble have similar certiﬁed robustness, i.e., for about half of the test set samples, WE is more robust; for another half, MME is more robust.
Revised: By varying the hyper-parameters of DRT, we ﬁnd out a setting where over the same set of base models, Weighted Ensemble and Max-Margin Ensemble have similar certiﬁed robustness, i.e., for about half of the test set samples, WE is more robust; for another half, MME is more robust.

Original: We collect 1 , 000 test set samples in total.
Revised: We collect 1 , 000 test set samples in total.

Original: Then, for each test set sample, we compute the transferability λ 1 /λ 2 and whether WE or MME has the higher certiﬁed robust radius.
Revised: Then, for each test set sample, we compute the transferability λ 1 /λ 2 and whether WE or MME has the higher certiﬁed robust radius.

Original: We remark that λ 1 and λ 2 are difﬁcult to be practically estimated so we use the average conﬁdence portion as the proxy:
Revised: We remark that λ 1 and λ 2 are difﬁcult to be practically estimated so we use the average conﬁdence portion as the proxy:

Original: • For WE, λ
Revised: • For WE, λ

Original: [Equation] =
Revised: 1 =

Original: E ε maxy
Revised: E ε max

Original: [Equation] y 
Revised: y j ∈

Original: [Equation] [Equation]
Revised: [ C ]: y j (cid:54) =

Original:  x 
Revised: y 0 (cid:80) Ni =1 w i f i ( x 0 + ε ) y j (cid:80) Ni

Original: [Equation]{+=
 w i (1 − f i ( x 0 + ε ) y 0 ) .+}
Revised: {+=
 w i (1 − f i ( x 0 + ε ) y 0 ) .+}

Original: • For MME, λ {+
+}
Revised: • For MME, λ {+
+}

Original: [Equation]

Original: =
Revised: =

Original: E ε max i ∈
Revised: E ε max i ∈

Original: [ N ] max y [Equation] ∈ [Equation]
Revised: [ N ] max y j ∈ [ C ]: y j (cid:54) =

Original: [Equation]

Original: x{+y 
+}
Revised: {+y 
+}

Original: [Equation]
Revised: f i ( x 0 + ε ) y j (1 − f i ( x 0 + ε ) y 0 ) .

Original: [Figure]
Revised: [Figure]

Original: Now we study the correlation between
Revised: Now we study the correlation between

Original: X := λ 1 /λ 2 − RHS of Equation (48) and Y :=
Revised: X := λ 1 /λ 2 − RHS of Equation (48) and Y :=

Original: I [ MME has higher certiﬁed robustness ] .
Revised: I [ MME has higher certiﬁed robustness ] .

Original: To do so, we draw the ROC curve where the threshold on X does binary classiﬁcation on Y .
Revised: To do so, we draw the ROC curve where the threshold on X does binary classiﬁcation on Y .

Original: The curve and the AUC score is shown in Figure 6.
Revised: The curve and the AUC score is shown in Figure 6.

Original: From the ROC curve, we ﬁnd that X and Y are apparently positively correlated since AUC = 0 . 66 > 0 .
Revised: From the ROC curve, we ﬁnd that X and Y are apparently positively correlated since AUC = 0 . 66 > 0 .

Original: 5 , which again veriﬁes Corollary 5.
Revised: 5 , which again veriﬁes Corollary 5.

Original: We remark that besides X , other factors such as non-symmetric or non-i.i.d.
Revised: We remark that besides X , other factors such as non-symmetric or non-i.i.d.

Original: conﬁdence score distribution may also play a role.
Revised: conﬁdence score distribution may also play a role.

Original: Closing Remarks.
Revised: Closing Remarks.

Original: The analysis in this appendix mainly shows two major ﬁndings theoretically and empirically: (1) MME is more robust when the adversarial transferability is high; while WE is more robust when the adversarial transferability is low; (2) If each f i ( x 0 + ε ) y 0 follows uniform distribution, when number of base models N is sufﬁciently large, the MME is always more certiﬁably robust.
Revised: The analysis in this appendix mainly shows two major ﬁndings theoretically and empirically: (1) MME is more robust when the adversarial transferability is high; while WE is more robust when the adversarial transferability is low; (2) If each f i ( x 0 + ε ) y 0 follows uniform distribution, when number of base models N is sufﬁciently large, the MME is always more certiﬁably robust.

Original: Our analysis does have limitations: we assume the symmetric and i.i.d.
Revised: Our analysis does have limitations: we assume the symmetric and i.i.d.

Original: distribution of f i ( x 0 + ε ) y 0 or even more strict uniform distribution to derive these ﬁndings.
Revised: distribution of f i ( x 0 + ε ) y 0 or even more strict uniform distribution to derive these ﬁndings.

Original: Though they model the real-world scenario in some extent as our realistic data results show, they are not perfect considering the transferability among base models and boundedness of conﬁdence scores.
Revised: Though they model the real-world scenario in some extent as our realistic data results show, they are not perfect considering the transferability among base models and boundedness of conﬁdence scores.

Original: We hope current analysis can open an angle of theoretical analysis of ensembles and leave a more general analysis as the future work.
Revised: We hope current analysis can open an angle of theoretical analysis of ensembles and leave a more general analysis as the future work.

Original: E A NALYSIS OF A LTERNATIVE D ESIGN OF DRT
Revised: E A NALYSIS OF A LTERNATIVE D ESIGN OF DRT

Original: In the main text, we design our DRT based on GD Loss
Revised: In the main text, we design our DRT based on GD Loss

Original: [Equation]
Revised: [Equation]

Original: and CM Loss
Revised: and CM Loss

Original: [Equation]
Revised: [Equation]

Original: Following the convention, we apply Gaussian augmentation to train the models, i.e., replacing x 0 by x 0 + ε where ε ∼ N (0 , σ 2 I d ) in Equation (9) and Equation (10).
Revised: Following the convention, we apply Gaussian augmentation to train the models, i.e., replacing x 0 by x 0 + ε where ε ∼ N (0 , σ 2 I d ) in Equation (9) and Equation (10).

Original: We apply these two regularizers to every valid base model pair ( F i , F j ) , where the valid pair means both base models predict the ground truth label y 0 : F i ( x 0 + ε ) =
Revised: We apply these two regularizers to every valid base model pair ( F i , F j ) , where the valid pair means both base models predict the ground truth label y 0 : F i ( x 0 + ε ) =

Original: F j ( x 0 + ε ) =
Revised: F j ( x 0 + ε ) =

Original: y 0 .
Revised: y 0 .

Original: One may concern that in the worst case, there could be O ( N 2 ) valid pairs, i.e., O ( N 2 ) regularization terms in the training loss.
Revised: One may concern that in the worst case, there could be O ( N 2 ) valid pairs, i.e., O ( N 2 ) regularization terms in the training loss.

Original: However, we should notice that each base model F i only appears in
Revised: However, we should notice that each base model F i only appears in

Original: O ( N ) valid pairs.
Revised: O ( N ) valid pairs.

Original: Therefore, when N is large, we can optimize DRT by training iteratively, i.e., by regularizing each base model one by one to save the computational cost.
Revised: Therefore, when N is large, we can optimize DRT by training iteratively, i.e., by regularizing each base model one by one to save the computational cost.

Original: An alternative design inspired from the theorems (e.g., Theorem 1) is to use overall summation instead of pairwise summation, which directly correlates with I
Revised: An alternative design inspired from the theorems (e.g., Theorem 1) is to use overall summation instead of pairwise summation, which directly correlates with I

Original: y i (Equation (6)):
Revised: y i (Equation (6)):

Original: [Equation]
Revised: [Equation]

Original: Although this design appears to be more aligned with the theorem and more efﬁcient with O ( N ) regularization terms, it also requires all base models
Revised: Although this design appears to be more aligned with the theorem and more efﬁcient with O ( N ) regularization terms, it also requires all base models

Original: F i to have the same runner-up prediction y (2) i as observed from both theorem and intuition (otherwise diversiﬁed gradients and conﬁdence margins are for different and independent labels that are meaningless to jointly optimize).
Revised: F i to have the same runner-up prediction y (2) i as observed from both theorem and intuition (otherwise diversiﬁed gradients and conﬁdence margins are for different and independent labels that are meaningless to jointly optimize).

Original: It is less likely to have all base models having the same runner-up prediction than a pair of base models having the same runner-up prediction especially in the initial training phase.
Revised: It is less likely to have all base models having the same runner-up prediction than a pair of base models having the same runner-up prediction especially in the initial training phase.

Original: Therefore, this alternative design will cause fewer chances of meaningful optimization than the previous design and we use the previous design for our DRT in practice.
Revised: Therefore, this alternative design will cause fewer chances of meaningful optimization than the previous design and we use the previous design for our DRT in practice.

Original: F E XPERIMENT D ETAILS
Revised: F E XPERIMENT D ETAILS

Original: Baselines.
Revised: Baselines.

Original: We consider the following state-of-the-art baselines for certiﬁed robustness: (1) Gaussian smoothing (Cohen et al., 2019) trains a smoothed classiﬁer by applying Gaussian augmentation.
Revised: We consider the following state-of-the-art baselines for certiﬁed robustness: (1) Gaussian smoothing (Cohen et al., 2019) trains a smoothed classiﬁer by applying Gaussian augmentation.

Original: MACER (Zhai et al., 2019):
Revised: MACER (Zhai et al., 2019):

Original: Adding the regularization term to maximize the certiﬁed radius
Revised: Adding the regularization term to maximize the certiﬁed radius

Original: R = σ 2 ( p A − p B ) on training instances.
Revised: R = σ 2 ( p A − p B ) on training instances.

Original: (2) SmoothAdv (Salman et al., 2019) combines adversarial training with Gaussian augmentation.
Revised: (2) SmoothAdv (Salman et al., 2019) combines adversarial training with Gaussian augmentation.

Original: (3) MACER (Zhai et al., 2019) improves a single model
Revised: (3) MACER (Zhai et al., 2019) improves a single model

Original: ’s certiﬁed robustness by adding regularization terms to minimize the Negative Log Likelihood (NLL) between smoothed classiﬁer’s output g F ( x ) and label y , and maximize the certiﬁed radius
Revised: ’s certiﬁed robustness by adding regularization terms to minimize the Negative Log Likelihood (NLL) between smoothed classiﬁer’s output g F ( x ) and label y , and maximize the certiﬁed radius

Original: R = σ 2 (Φ − 1 ( g εF ( x ) y ) − Φ − 1 (max y (cid:48)
Revised: R = σ 2 (Φ − 1 ( g εF ( x ) y ) − Φ − 1 (max y (cid:48)

Original: (cid:54) =
Revised: (cid:54) =

Original: y g εF ( x ) y (cid:48) )) , where ε ∼ N (0 , σ 2 I d ) and g εF is as deﬁned in Equation (3).
Revised: y g εF ( x ) y (cid:48) )) , where ε ∼ N (0 , σ 2 I d ) and g εF is as deﬁned in Equation (3).

Original: (4) Stability (Li et al., 2019) maintains the stability of the smoothed classiﬁer g F by minimizing the Rényi Divergence between g F ( x ) and g F ( x + ε ) where ε ∼ N (0 , σ 2 I d ) .
Revised: (4) Stability (Li et al., 2019) maintains the stability of the smoothed classiﬁer g F by minimizing the Rényi Divergence between g F ( x ) and g F ( x + ε ) where ε ∼ N (0 , σ 2 I d ) .

Original: (5) SWEEN (Liu et al., 2020) builds smoothed Weighted Ensemble (WE), which is the only prior work computing certiﬁed robustness for ensemble to our knowledge.
Revised: (5) SWEEN (Liu et al., 2020) builds smoothed Weighted Ensemble (WE), which is the only prior work computing certiﬁed robustness for ensemble to our knowledge.

Original: Evaluation Metric.
Revised: Evaluation Metric.

Original: We report the standard certiﬁed accuracy under different L 2 radii r ’s as our evaluation metric following Cohen et al.
Revised: We report the standard certiﬁed accuracy under different L 2 radii r ’s as our evaluation metric following Cohen et al.

Original: (2019), which is deﬁned as the fraction of the test set samples that the smoothed classiﬁer can certify the robustness within the L 2 ball of radius r .
Revised: (2019), which is deﬁned as the fraction of the test set samples that the smoothed classiﬁer can certify the robustness within the L 2 ball of radius r .

Original: Since the computation of the accurate value of this metric is intractable, we report the approximate certiﬁed test accuracy (Cohen et al., 2019) sampled through the Monte Carlo procedure.
Revised: Since the computation of the accurate value of this metric is intractable, we report the approximate certiﬁed test accuracy (Cohen et al., 2019) sampled through the Monte Carlo procedure.

Original: For each sample, the robustness certiﬁcation holds with probability at least 1 − α .
Revised: For each sample, the robustness certiﬁcation holds with probability at least 1 − α .

Original: Following the literature, we choose α = 0 .
Revised: Following the literature, we choose α = 0 .

Original: 001 , n 0 = 100 for Monte Carlo sampling during prediction phase, and n = 10 5 for Monte
Revised: 001 , n 0 = 100 for Monte Carlo sampling during prediction phase, and n = 10 5 for Monte

Original: Carlo sampling during certiﬁcation phase.
Revised: Carlo sampling during certiﬁcation phase.

Original: On MNIST and CIFAR-10 we evaluated every 10 -th image in the test set, for 1 , 000 images total.
Revised: On MNIST and CIFAR-10 we evaluated every 10 -th image in the test set, for 1 , 000 images total.

Original: On ImageNet we evaluated every 100 -th image in the validation set, for 500 images total.
Revised: On ImageNet we evaluated every 100 -th image in the validation set, for 500 images total.

Original: This evaluation protocol is the same as prior work (Cohen et al., 2019;
Revised: This evaluation protocol is the same as prior work (Cohen et al., 2019;

Original: Salman et al., 2019).
Revised: Salman et al., 2019).

Original: F. MNIST
Revised: F. MNIST

Original: Baseline Conﬁguration.
Revised: Baseline Conﬁguration.

Original: Following the literature (Salman et al., 2019; Jeong & Shin, 2020; Zhai et al., 2019), in each batch, each training sample is Gaussian augmented twice (augmenting more times yields negligible difference as Salman et al.
Revised: Following the literature (Salman et al., 2019; Jeong & Shin, 2020; Zhai et al., 2019), in each batch, each training sample is Gaussian augmented twice (augmenting more times yields negligible difference as Salman et al.

Original: (2019) show).
Revised: (2019) show).

Original: We choose Gaussian smoothing variance σ ∈ { 0 . 25 , 0 .
Revised: We choose Gaussian smoothing variance σ ∈ { 0 . 25 , 0 .

Original: 5 , 1 . 0 } for training and evaluation for all methods.
Revised: 5 , 1 . 0 } for training and evaluation for all methods.

Original: For SmoothAdv, we consider the attack to be 10 -step L 2 PGD attack with perturbation scale δ = 1 . 0 without pretraining and unlabelled data augmentation.
Revised: For SmoothAdv, we consider the attack to be 10 -step L 2 PGD attack with perturbation scale δ = 1 . 0 without pretraining and unlabelled data augmentation.

Original: We reproduced results similar to their paper by using their open-sourced code 1 .
Revised: We reproduced results similar to their paper by using their open-sourced code 1 .

Original: Training Details.
Revised: Training Details.

Original: First, we use LeNet architecture and train each base model for 90 epochs.
Revised: First, we use LeNet architecture and train each base model for 90 epochs.

Original: For the training optimizer, we use the SGD-momentum with the initial learning rate α = 0 .
Revised: For the training optimizer, we use the SGD-momentum with the initial learning rate α = 0 .

Original: The learning rate is decayed for every 30 epochs with decay ratio γ = 0 .
Revised: The learning rate is decayed for every 30 epochs with decay ratio γ = 0 .

Original: 1 and the batch size equals to 256 .
Revised: 1 and the batch size equals to 256 .

Original: Then, we apply DRT to ﬁnetune our model with small learning rate α for another 90 epochs.
Revised: Then, we apply DRT to ﬁnetune our model with small learning rate α for another 90 epochs.

Original: We explore different DRT hyper-parameters ρ 1 , ρ 2 together with the initial learning rate α , and report the best certiﬁed accuracy on each radius r among all the trained ensemble models.
Revised: We explore different DRT hyper-parameters ρ 1 , ρ 2 together with the initial learning rate α , and report the best certiﬁed accuracy on each radius r among all the trained ensemble models.

Original: Radius r [Table] [Table] [Table]
Revised: Radius r ρρ0.

Original: Gaussian (Cohen et al., 2019) - - 99.
Revised: Gaussian (Cohen et al., 2019) - - 99.

Original: SmoothAdv (Salman et al., 2019) - - 99.
Revised: SmoothAdv (Salman et al., 2019) - - 99.

Original: MME (Gaussian) - - 99.
Revised: MME (Gaussian) - - 99.

Original: 94.8 DRT + MME (Gaussian) 0.
Revised: 94.8 DRT + MME (Gaussian) 0.

Original: MME (SmoothAdv) - - 99.
Revised: MME (SmoothAdv) - - 99.

Original: 96.7 DRT + MME (SmoothAdv) 0.
Revised: 96.7 DRT + MME (SmoothAdv) 0.

Original: WE (Gaussian) - - 99.
Revised: WE (Gaussian) - - 99.

Original: 94.9 DRT + WE (Gaussian) 0.
Revised: 94.9 DRT + WE (Gaussian) 0.

Original: WE (SmoothAdv) - - 99.
Revised: WE (SmoothAdv) - - 99.

Original: [Table]
Revised: [Table]

Original:  WE (SmoothAdv)
Revised: DRT + WE (SmoothAdv)

Original: [Table]
Revised: [Table]

Original: Trend of Certiﬁed Accuracy with Perturbation Radius.
Revised: Trend of Certiﬁed Accuracy with Perturbation Radius.

Original: We visualize the trend of certiﬁed accuracy along with different perturbation radii on different smoothing parameters separately in Figureand Figure 8.
Revised: We visualize the trend of certiﬁed accuracy along with different perturbation radii on different smoothing parameters separately in Figureand Figure 8.

Original: For each radius r , we present the best certiﬁed accuracy among all the trained models.
Revised: For each radius r , we present the best certiﬁed accuracy among all the trained models.

Original: We can notice that while simply applying MME or WE protocol could slightly improve the certiﬁed accuracy, DRT could signiﬁcantly boost the certiﬁed accuracy on different radii.
Revised: We can notice that while simply applying MME or WE protocol could slightly improve the certiﬁed accuracy, DRT could signiﬁcantly boost the certiﬁed accuracy on different radii.

Original: Average Certiﬁed Radius .
Revised: Average Certiﬁed Radius .

Original: We report the Average Certiﬁed Radius (ACR) (Zhai et al., 2019):
Revised: We report the Average Certiﬁed Radius (ACR) (Zhai et al., 2019):

Original: ACR = 1 |S test | (cid:80) ( x,y ) ∈S test R ( x, y ) , where S test refers to the test set and R ( x, y ) the certifed radius on testing
Revised: ACR = 1 |S test | (cid:80) ( x,y ) ∈S test R ( x, y ) , where S test refers to the test set and R ( x, y ) the certifed radius on testing

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: sample ( x, y ) .
Revised: sample ( x, y ) .

Original: We evaluate ACR of our DRT-trained ensemble trained with σ ∈ { 0 . 25 , 0 .
Revised: We evaluate ACR of our DRT-trained ensemble trained with σ ∈ { 0 . 25 , 0 .

Original: 5 , 1 . 0 } smoothing parameter and compare it with other baselines.
Revised: 5 , 1 . 0 } smoothing parameter and compare it with other baselines.

Original: Results are shown in Table 7.
Revised: Results are shown in Table 7.

Original: We can clearly see that our DRT-trained ensemble could still achieve the highest ACR on all the smoothing parameter settings.
Revised: We can clearly see that our DRT-trained ensemble could still achieve the highest ACR on all the smoothing parameter settings.

Original: Especially on σ = 1 . 00 , our improvement is signiﬁcant.
Revised: Especially on σ = 1 . 00 , our improvement is signiﬁcant.

Original: [Table]
Revised: [Table]

Original: Effects of ρ 1 and ρ 2 .
Revised: Effects of ρ 1 and ρ 2 .

Original: We investigate the DRT hyper-parameters ρ 1 and ρ 2 corresponding to different smoothing parameter σ ∈ { 0 .
Revised: We investigate the DRT hyper-parameters ρ 1 and ρ 2 corresponding to different smoothing parameter σ ∈ { 0 .

Original: Here we put the detailed results for various hyperparameter settings in Tables 4 to 6 and bold the numbers with the highest certiﬁed accuracy on each radius r .
Revised: Here we put the detailed results for various hyperparameter settings in Tables 4 to 6 and bold the numbers with the highest certiﬁed accuracy on each radius r .

Original: From the experiments, we ﬁnd that the GD loss’s weight ρ 1 can have the major inﬂuence on the ensemble model’s functionality: if we choose larger ρ 1 , the model will achieve slightly lower certiﬁed accuracy on small radii, but higher certiﬁed accuracy on large radii.
Revised: From the experiments, we ﬁnd that the GD loss’s weight ρ 1 can have the major inﬂuence on the ensemble model’s functionality: if we choose larger ρ 1 , the model will achieve slightly lower certiﬁed accuracy on small radii, but higher certiﬁed accuracy on large radii.

Original: We also can not choose too large ρ 1 on small σ cases (e.g., σ = 0 . 25 ).
Revised: We also can not choose too large ρ 1 on small σ cases (e.g., σ = 0 . 25 ).

Original: Otherwise, model’s functionality will collapse.
Revised: Otherwise, model’s functionality will collapse.

Original: Here we show DRT-based models’ certiﬁed accuracy by applying different ρ 1 in Figure 9.
Revised: Here we show DRT-based models’ certiﬁed accuracy by applying different ρ 1 in Figure 9.

Original: Alternatively, we ﬁnd that the CM loss’s weight ρ 2 can also have positive inﬂuence on model’s performance: the larger ρ 2 we choose, the higher certiﬁed accuracy we could get.
Revised: Alternatively, we ﬁnd that the CM loss’s weight ρ 2 can also have positive inﬂuence on model’s performance: the larger ρ 2 we choose, the higher certiﬁed accuracy we could get.

Original: Choosing larger and larger ρ 2 does not harm model’s functionality too much, but the improvement on certiﬁed accuracy will become more and more marginal.
Revised: Choosing larger and larger ρ 2 does not harm model’s functionality too much, but the improvement on certiﬁed accuracy will become more and more marginal.

Original: Efﬁciency Analysis.
Revised: Efﬁciency Analysis.

Original: We regard the execution time per mini-batch as our efﬁciency criterion.
Revised: We regard the execution time per mini-batch as our efﬁciency criterion.

Original: For
Revised: For

Original: MNIST with batch size equals to 256 , DRT with the Gaussian smoothing base model only requires 1.04s to ﬁnish one mini-batch training to achieve the comparable results to the SmoothAdv method which requires 1.86s.
Revised: MNIST with batch size equals to 256 , DRT with the Gaussian smoothing base model only requires 1.04s to ﬁnish one mini-batch training to achieve the comparable results to the SmoothAdv method which requires 1.86s.

Original: Moreover, DRT with the SmoothAdv base model requires 2.52s per training batch but achieves much better results.
Revised: Moreover, DRT with the SmoothAdv base model requires 2.52s per training batch but achieves much better results.

Original: The evaluation is on single NVIDIA GeForce GTX 

Revised: The evaluation is on single NVIDIA GeForce GTX

Original: Ti
Revised: Ti

Original: GPU.
Revised: GPU.

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: + WE (Gaussian)
Revised: + WE (Gaussian)

Original: [Table]
Revised: [Table]

Original: WE (SmoothAdv)
Revised: WE (SmoothAdv)

Revised: [Table]

Revised: DRT + WE

Original: [Table]
Revised: [Table]

Original: SmoothAdv
Revised: SmoothAdv)

Original: [Table]
Revised: [Table]

Original: F. CIFAR- 
Revised: F. CIFAR-

Original: Baseline Conﬁguration.
Revised: Baseline Conﬁguration.

Original: Following the literature (Salman et al., 2019; Jeong & Shin, 2020; Zhai et al., 2019), in each batch, each training sample is Gaussian augmented twice (augmenting more times yields negligible difference as Salman et al.
Revised: Following the literature (Salman et al., 2019; Jeong & Shin, 2020; Zhai et al., 2019), in each batch, each training sample is Gaussian augmented twice (augmenting more times yields negligible difference as Salman et al.

Original: (2019) show).
Revised: (2019) show).

Original: We choose Gaussian smoothing variance σ ∈ { 0 . 25 , 0 .
Revised: We choose Gaussian smoothing variance σ ∈ { 0 . 25 , 0 .

Original: 5 , 1 . 0 } for training and evaluation for all methods.
Revised: 5 , 1 . 0 } for training and evaluation for all methods.

Original: For SmoothAdv, we consider the attack to be 10 -step L 2 PGD attack with perturbation scale δ = 1 . 0 without pretraining and unlabelled data augmentation.
Revised: For SmoothAdv, we consider the attack to be 10 -step L 2 PGD attack with perturbation scale δ = 1 . 0 without pretraining and unlabelled data augmentation.

Original: We also reproduced the similar results mentioned in baseline papers.
Revised: We also reproduced the similar results mentioned in baseline papers.

Original: Training Details.
Revised: Training Details.

Original: First, we use ResNet-110 architecture and train each base model for 150 epochs.
Revised: First, we use ResNet-110 architecture and train each base model for 150 epochs.

Original: For the training optimizer, we use the SGD-momentum with the initial learning rate α = 0 .
Revised: For the training optimizer, we use the SGD-momentum with the initial learning rate α = 0 .

Original: The learning rate is decayed for every 50 -epochs with decay ratio γ = 0 . 1 .
Revised: The learning rate is decayed for every 50 -epochs with decay ratio γ = 0 . 1 .

Original: Then, we use DRT to ﬁnetune our model with small learning rate α for another 150 epochs.
Revised: Then, we use DRT to ﬁnetune our model with small learning rate α for another 150 epochs.

Original: We also explore different DRT hyper-parameters ρ 1 , ρ 2 together with the initial learning rate α , and report the best certiﬁed accuracy on each radius r among all the trained ensemble models.
Revised: We also explore different DRT hyper-parameters ρ 1 , ρ 2 together with the initial learning rate α , and report the best certiﬁed accuracy on each radius r among all the trained ensemble models.

Original: Trend of Certiﬁed Accuracy with Perturbation Radius.
Revised: Trend of Certiﬁed Accuracy with Perturbation Radius.

Original: We visualize the trend of certiﬁed accuracy along with different perturbation radii on different smoothing parameters separately in Figureand Figure 11.
Revised: We visualize the trend of certiﬁed accuracy along with different perturbation radii on different smoothing parameters separately in Figureand Figure 11.

Original: For each radius r , we present the best certiﬁed accuracy among all the trained models.
Revised: For each radius r , we present the best certiﬁed accuracy among all the trained models.

Original: We can see the similar trends: Applying either MME or WE ensemble protocol will only give slight improvement while DRT can help make this improvement signiﬁcant.
Revised: We can see the similar trends: Applying either MME or WE ensemble protocol will only give slight improvement while DRT can help make this improvement signiﬁcant.

Original: Average Certiﬁed Radius .
Revised: Average Certiﬁed Radius .

Original: We report the Average Certiﬁed Radius (ACR) (Zhai et al., 2019):
Revised: We report the Average Certiﬁed Radius (ACR) (Zhai et al., 2019):

Original: ACR = 1 |S test | (cid:80) ( x,y ) ∈S test R ( x, y ) , where S test refers to the test set and R ( x, y ) the certifed radius on testing sample ( x, y ) .
Revised: ACR = 1 |S test | (cid:80) ( x,y ) ∈S test R ( x, y ) , where S test refers to the test set and R ( x, y ) the certifed radius on testing sample ( x, y ) .

Original: We evaluate ACR of our DRT-trained ensemble trained with σ ∈ { 0 . 25 , 0 .
Revised: We evaluate ACR of our DRT-trained ensemble trained with σ ∈ { 0 . 25 , 0 .

Original: 5 , 1 . 0 } smoothing parameter and compare it with other baselines.
Revised: 5 , 1 . 0 } smoothing parameter and compare it with other baselines.

Original: Results are shown in Table 11.
Revised: Results are shown in Table 11.

Original: Results shows that, DRT-trained ensemble has the highest ACR on almost all the settings.
Revised: Results shows that, DRT-trained ensemble has the highest ACR on almost all the settings.

Original: Especially on σ = 1 . 00 , our improvement is signiﬁcant.
Revised: Especially on σ = 1 . 00 , our improvement is signiﬁcant.

Original: Effects of ρ 1 and ρ 2 .
Revised: Effects of ρ 1 and ρ 2 .

Original: We study the DRT hyper-parameter ρ 1 and ρ 2 corresponding to different smoothing parameters σ ∈ { 0 . 25 , 0 .
Revised: We study the DRT hyper-parameter ρ 1 and ρ 2 corresponding to different smoothing parameters σ ∈ { 0 . 25 , 0 .

Original: 5 , 1 . 0 } and put the detailed results in Tables 8 to 10.
Revised: 5 , 1 . 0 } and put the detailed results in Tables 8 to 10.

Original: We bold the
Revised: We bold the

Original: [Table]
Revised: [Table]

Original: DRT + WE ( [Table]
Revised: DRT + WE (Gaussian) 20.

Original: 12.8 WE (SmoothAdv) - - 61.
Revised: 12.8 WE (SmoothAdv) - - 61.

Original: [Table]
Revised: [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Original: [Table]
Revised: [Table]

Original: DRT + WE
Revised: [Table] [Table] [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Revised: 6 DRT + WE

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: numbers with the highest certiﬁed accuracy on each radius r .
Revised: numbers with the highest certiﬁed accuracy on each radius r .

Original: The results show similar conclusion to our understanding from MNIST.
Revised: The results show similar conclusion to our understanding from MNIST.

Original: Efﬁciency Analysis.
Revised: Efﬁciency Analysis.

Original: We also use the execution time per mini-batch as our efﬁciency criterion.
Revised: We also use the execution time per mini-batch as our efﬁciency criterion.

Original: For
Revised: For

Original: CIFAR-10 with batch size equals to 256 , DRT with the Gaussian smoothing base model requires 3.82s to ﬁnish one mini-batch training to achieve the competitive results to 10 -step PGD attack based SmoothAdv method which requires 6.39s.
Revised: CIFAR-10 with batch size equals to 256 , DRT with the Gaussian smoothing base model requires 3.82s to ﬁnish one mini-batch training to achieve the competitive results to 10 -step PGD attack based SmoothAdv method which requires 6.39s.

Original: All the models are trained in parallel on 4 NVIDIA
Revised: All the models are trained in parallel on 4 NVIDIA

Original: GeForce GTX 1080 Ti GPUs.
Revised: GeForce GTX 1080 Ti GPUs.

Original: F. I MAGE N ET
Revised: F. I MAGE N ET

Original: For ImageNet, we utilize ResNet-50 architecture and train each base model for 90 epochs using
Revised: For ImageNet, we utilize ResNet-50 architecture and train each base model for 90 epochs using

Original: SGD-momentum optimizer.
Revised: SGD-momentum optimizer.

Original: The initial learning rate α is set to 0 .
Revised: The initial learning rate α is set to 0 .

Original: During training, the learning rate is decayed for every 30 -epochs with decay ratio γ = 0 .
Revised: During training, the learning rate is decayed for every 30 -epochs with decay ratio γ = 0 .

Original: We tried different Gaussian smoothing parameter σ ∈ { 0 . 50 , 1 . 00 } , and consider the best hyper-parameter conﬁguration for each σ .
Revised: We tried different Gaussian smoothing parameter σ ∈ { 0 . 50 , 1 . 00 } , and consider the best hyper-parameter conﬁguration for each σ .

Original: Then, we use DRT to ﬁnetune base models with the learning rate α = 5 × 10 − 3 for another 90 epochs.
Revised: Then, we use DRT to ﬁnetune base models with the learning rate α = 5 × 10 − 3 for another 90 epochs.

Original: Due
Revised: Due

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: DRT + WE (Gaussian)
Revised: DRT + WE (Gaussian)

Original: [Table]
Revised: [Table]

Revised: WE (SmoothAdv) - -

Original: [Table]
Revised: [Table]

Original: WE (SmoothAdv) - - 48.
Revised: [Table] [Table] [Table] [Table]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Revised: [Table]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Original: [Table] 
Revised: [Table] [Table] [Table] [Table]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original: [Table][Table] [Table] [Table]
Revised: [Table]

Original: [Table][Table] [Table] [Table]
Revised: [Table]

Original: [Table][Table] [Table] [Table]
Revised: [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table] [Table][Table]
Revised: [Table] [Table]

Original: [Table] [Table][Table]
Revised: [Table] [Table]

Original: [Table] [Table][Table]
Revised: [Table] [Table]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: 20.3 DRT + WE (SmoothAdv)1.
Revised: DRT + WE (SmoothAdv)

Original: [Table]
Revised: [Table]

Revised: [Table]

Revised: [Table]

Original: [Table]
Revised: [Table]

Original: to the consideration of achieving high certiﬁed accuracy on large radii
Revised: to the consideration of achieving high certiﬁed accuracy on large radii

Original: [Table]
Revised: [Table]

Original: we choose large DRT training hyper-parameter ρ 1 and ρ 2 in practice
Revised: we choose large DRT training hyper-parameter ρ 1 and ρ 2 in practice

Original: [Table]
Revised: [Table]

Original: which lead to relatively low benign accuracy.
Revised: which lead to relatively low benign accuracy.

Original: G A BLATION STUDIES G. T HE E FFECTS OF G RADIENT D IVERSITY L OSS AND C ONFIDENCE M ARGIN L OSS
Revised: G A BLATION STUDIES G. T HE E FFECTS OF G RADIENT D IVERSITY L OSS AND C ONFIDENCE M ARGIN L OSS

Original: To explore the effects of individual Gradient Diversity and Conﬁdence Margin Losses in DRT
Revised: To explore the effects of individual Gradient Diversity and Conﬁdence Margin Losses in DRT

Original: [Table]
Revised: [Table]

Original: we set ρ 1 or ρ 2 to 0 and tune the other for evaluation on MNIST and CIFAR-10.
Revised: we set ρ 1 or ρ 2 to 0 and tune the other for evaluation on MNIST and CIFAR-10.

Original: The results are shown in
Revised: The results are shown in

Original: Table 12 and 13.
Revised: Table 12 and 13.

Original: We observe that both GD and CM losses have positive effects on improving the
Revised: We observe that both GD and CM losses have positive effects on improving the

Original: [Figure] [Figure]
Revised: [Figure] [Figure]

Original: certiﬁed accuracy while GD plays a major role on larger radii.
Revised: certiﬁed accuracy while GD plays a major role on larger radii.

Original: By combining these two regularization losses together in DRT, the ensemble model achieves the highest certiﬁed accuracy under all radii.
Revised: By combining these two regularization losses together in DRT, the ensemble model achieves the highest certiﬁed accuracy under all radii.

Original: [Table]
Revised: [Table]

Original: G. C ERTIFIED R OBUSTNESS OF SINGLE BASE MODEL WITHIN DRT- TRAINED ENSEMBLE
Revised: G. C ERTIFIED R OBUSTNESS OF SINGLE BASE MODEL WITHIN DRT- TRAINED ENSEMBLE

Original: We also conduct ablation study on how the single base models’ certiﬁed accuracy can be improved after applying DRT to the whole ensemble for both MNIST and CIFAR-10 datasets.
Revised: We also conduct ablation study on how the single base models’ certiﬁed accuracy can be improved after applying DRT to the whole ensemble for both MNIST and CIFAR-10 datasets.

Original: Results are shown in in Table 14 and 15.
Revised: Results are shown in in Table 14 and 15.

Original: We are surprised to ﬁnd that the single base model within our DRTtrained ensemble are more robust compared to single base model within other baseline ensembles.
Revised: We are surprised to ﬁnd that the single base model within our DRTtrained ensemble are more robust compared to single base model within other baseline ensembles.

Original: Also, integrating them together could achieve higher robustness.
Revised: Also, integrating them together could achieve higher robustness.

Original: G. O PTIMIZING THE W EIGHTS OF DRT- TRAINED E NSEMBLE
Revised: G. O PTIMIZING THE W EIGHTS OF DRT- TRAINED E NSEMBLE

Original: While we adapt average weights in our WE ensemble protocol in our experiments, we are also interested in how tuning the optimal weights could further improve the certiﬁed accuracy of our
Revised: While we adapt average weights in our WE ensemble protocol in our experiments, we are also interested in how tuning the optimal weights could further improve the certiﬁed accuracy of our

Original: DRT-trained ensemble.
Revised: DRT-trained ensemble.

Original: We conduct this ablation study on both MNIST and CIFAR-10 datasets by grid-searching all the possible weights combination with step size as 0 . 1 .
Revised: We conduct this ablation study on both MNIST and CIFAR-10 datasets by grid-searching all the possible weights combination with step size as 0 . 1 .

Original: Results are shown in
Revised: Results are shown in

Original: Table 16 and 17.
Revised: Table 16 and 17.

Original: ( AE here refers to the average ensemble protocol and WE the weighted ensemble protocol by adapting the tuned optimal weights)
Revised: ( AE here refers to the average ensemble protocol and WE the weighted ensemble protocol by adapting the tuned optimal weights)

Original: [Table] [Table]
Revised: [Table] [Table]

Original: [Table]
Revised: [Table]

Original: We can see that, by learning the optimal weights, the certiﬁed accuracy could be only slightly improved compared to the average weights setting, which indicates that, average weights can be a good choice in practice.
Revised: We can see that, by learning the optimal weights, the certiﬁed accuracy could be only slightly improved compared to the average weights setting, which indicates that, average weights can be a good choice in practice.

Original: [Table]
Revised: [Table]

Original: G. C OMPARISON WITH O THER G RADIENT D IVERSITY R EGULARIZERS
Revised: G. C OMPARISON WITH O THER G RADIENT D IVERSITY R EGULARIZERS

Original: We notice that out of the certiﬁably robust ensemble ﬁeld, there exist two representatives of gradient diversity promoting regularizers:
Revised: We notice that out of the certiﬁably robust ensemble ﬁeld, there exist two representatives of gradient diversity promoting regularizers:

Original: ADP (Pang et al., 2019) and GAL (Kariyappa & Qureshi, 2019).
Revised: ADP (Pang et al., 2019) and GAL (Kariyappa & Qureshi, 2019).

Original: They achieved notable improvements on empirical ensemble robustness.
Revised: They achieved notable improvements on empirical ensemble robustness.

Original: For an ensemble consisting of base models { F i } Ni =1 and input x and ground truth label y , the ADP regularizer is deﬁned as
Revised: For an ensemble consisting of base models { F i } Ni =1 and input x and ground truth label y , the ADP regularizer is deﬁned as

Original: [Equation]
Revised: [Equation]

Original: [Table] [Table]
Revised: [Table] [Table]

Original: where H ( · ) refers to the Shannon Entropy Loss function and ED the square of the spanned volume of base models’ logit vectors.
Revised: where H ( · ) refers to the Shannon Entropy Loss function and ED the square of the spanned volume of base models’ logit vectors.

Original: GAL regularizer minimizes the cosine similarity value between base models’ loss gradient vectors, which is deﬁned as:
Revised: GAL regularizer minimizes the cosine similarity value between base models’ loss gradient vectors, which is deﬁned as:

Original: [Equation]
Revised: [Equation]

Original: Under the smoothed ensemble training setting, the ﬁnal training loss is represented by
Revised: Under the smoothed ensemble training setting, the ﬁnal training loss is represented by

Original: [Equation]
Revised: [Equation]

Original: where we consider standard training loss L std ( x 0 + ε, y 0 )
Revised: where we consider standard training loss L std ( x 0 + ε, y 0 )

Original: i of each base model F i to be the standard cross-entropy loss.
Revised: i of each base model F i to be the standard cross-entropy loss.

Original: Table 18 shows the certiﬁed accuracy of {ADP, GAL, DRT}-trained ensemble under different radii with WE protocol on MNIST and CIFAR-10 dataset.
Revised: Table 18 shows the certiﬁed accuracy of {ADP, GAL, DRT}-trained ensemble under different radii with WE protocol on MNIST and CIFAR-10 dataset.

Original: We notice that DRT outperforms both ADP and
Revised: We notice that DRT outperforms both ADP and

Original: GAL signiﬁcantly in terms of the certiﬁed accuracy on different datasets.
Revised: GAL signiﬁcantly in terms of the certiﬁed accuracy on different datasets.