Original: O N
Revised: O N

Original: THE
Revised: THE

Original: C ERTIFIED
Revised: C ERTIFIED

Original: R OBUSTNESS
Revised: R OBUSTNESS

Original: FOR
Revised: FOR

Original: E NSEMBLE
Revised: E NSEMBLE

Original: M ODELS AND B EYOND
Revised: M ODELS AND B EYOND

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Recent studies show that deep neural networks (DNN) are vulnerable to adversarial examples, which aim to mislead DNNs by adding perturbations with small magnitude.
Revised: Recent studies show that deep neural networks (DNN) are vulnerable to adversarial examples, which aim to mislead DNNs by adding perturbations with small magnitude.

Original: To defend against such attacks, both empirical and theoretical defense approaches have been extensively studied for a single ML model .
Revised: To defend against such attacks, both empirical and theoretical defense approaches have been extensively studied for a single ML model .

Original: In this work, we aim to analyze and provide the certiﬁed robustness for ensemble ML models , together with the sufﬁcient and necessary conditions of robustness for different ensemble protocols.
Revised: In this work, we aim to analyze and provide the certiﬁed robustness for ensemble ML models , together with the sufﬁcient and necessary conditions of robustness for different ensemble protocols.

Original: Although ensemble models are shown more robust than a single model empirically; surprisingly, we ﬁnd that in terms of the certiﬁed robustness the standard ensemble models only achieve marginal improvement compared to a single model.
Revised: Although ensemble models are shown more robust than a single model empirically; surprisingly, we ﬁnd that in terms of the certiﬁed robustness the standard ensemble models only achieve marginal improvement compared to a single model.

Original: Thus, to explore the conditions that guarantee to provide certiﬁably robust ensemble ML models, we ﬁrst prove that diversiﬁed gradient and large conﬁdence margin are sufﬁcient and necessary conditions for certiﬁably robust ensemble models under the model-smoothness assumption.
Revised: Thus, to explore the conditions that guarantee to provide certiﬁably robust ensemble ML models, we ﬁrst prove that diversiﬁed gradient and large conﬁdence margin are sufﬁcient and necessary conditions for certiﬁably robust ensemble models under the model-smoothness assumption.

Original: We then provide the bounded model-smoothness analysis based on the proposed Ensemble-before-Smoothing strategy.
Revised: We then provide the bounded model-smoothness analysis based on the proposed Ensemble-before-Smoothing strategy.

Original: We also prove that an ensemble model can always achieve higher certiﬁed robustness than a single base model under mild conditions.
Revised: We also prove that an ensemble model can always achieve higher certiﬁed robustness than a single base model under mild conditions.

Original: Inspired by the theoretical ﬁndings, we propose the lightweight Diversity Regularized Training (DRT) to train certiﬁably robust ensemble ML models.
Revised: Inspired by the theoretical ﬁndings, we propose the lightweight Diversity Regularized Training (DRT) to train certiﬁably robust ensemble ML models.

Original: Extensive experiments show that our DRT enhanced ensembles can consistently achieve higher certiﬁed robustness than existing single and ensemble ML models, demonstrating the state-of-the-art certiﬁed L 2 -robustness on MNIST, CIFAR-10, and ImageNet datasets.
Revised: Extensive experiments show that our DRT enhanced ensembles can consistently achieve higher certiﬁed robustness than existing single and ensemble ML models, demonstrating the state-of-the-art certiﬁed L 2 -robustness on MNIST, CIFAR-10, and ImageNet datasets.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Deep neural networks (DNN) have been widely applied in various applications, such as image classiﬁcation (Krizhevsky, 2012;
Revised: Deep neural networks (DNN) have been widely applied in various applications, such as image classiﬁcation (Krizhevsky, 2012;

Original: He et al., 2016), face recognition (Sun et al., 2014), and natural language processing (Vaswani et al., 2017; Devlin et al., 2019).
Revised: He et al., 2016), face recognition (Sun et al., 2014), and natural language processing (Vaswani et al., 2017; Devlin et al., 2019).

Original: However, it is well-known that DNNs are vulnerable to adversarial examples (Szegedy et al., 2013; Carlini & Wagner, 2017; Xiao et al., 2018a;b; Bhattad et al., 2020; Bulusu et al., 2020), and it has raised great concerns especially when
Revised: However, it is well-known that DNNs are vulnerable to adversarial examples (Szegedy et al., 2013; Carlini & Wagner, 2017; Xiao et al., 2018a;b; Bhattad et al., 2020; Bulusu et al., 2020), and it has raised great concerns especially when

Original: DNNs are deployed in safety-critical applications such as autonomous driving and facial recognition.
Revised: DNNs are deployed in safety-critical applications such as autonomous driving and facial recognition.

Original: To defend against such attacks, several empirical defenses have been proposed (Papernot et al., 2016b; Madry et al., 2018); however, many of them have been attacked again by strong adaptive attackers (Athalye et al., 2018; Tramer et al., 2020).
Revised: To defend against such attacks, several empirical defenses have been proposed (Papernot et al., 2016b; Madry et al., 2018); however, many of them have been attacked again by strong adaptive attackers (Athalye et al., 2018; Tramer et al., 2020).

Original: To end such repeated game between the attackers and defenders, certiﬁed defenses (Wong & Kolter, 2018; Cohen et al., 2019) have been proposed to provide the robustness guarantees for given ML models, so that no additional attack can break the model under certain adversarial constraints.
Revised: To end such repeated game between the attackers and defenders, certiﬁed defenses (Wong & Kolter, 2018; Cohen et al., 2019) have been proposed to provide the robustness guarantees for given ML models, so that no additional attack can break the model under certain adversarial constraints.

Original: For instance, randomized smoothing has been proposed as an effective defense providing certiﬁed robustness (Lecuyer et al., 2019;
Revised: For instance, randomized smoothing has been proposed as an effective defense providing certiﬁed robustness (Lecuyer et al., 2019;

Original: Cohen et al., 2019; Yang et al., 2020a).
Revised: Cohen et al., 2019; Yang et al., 2020a).

Original: Among different certiﬁed robustness approaches (Weng et al., 2018; Xu et al., 2020;
Revised: Among different certiﬁed robustness approaches (Weng et al., 2018; Xu et al., 2020;

Original: Li et al., 2020a), randomized smoothing provides a model-independent way to smooth a given ML model and achieves state-of-the-art certiﬁed robustness on large-scale datasets such as ImageNet.
Revised: Li et al., 2020a), randomized smoothing provides a model-independent way to smooth a given ML model and achieves state-of-the-art certiﬁed robustness on large-scale datasets such as ImageNet.

Original: Currently, all the existing certiﬁed defense approaches focus on the robustness of a single ML model.
Revised: Currently, all the existing certiﬁed defense approaches focus on the robustness of a single ML model.

Original: Given the observations that ensemble ML models are able to bring additional beneﬁts in standard learning (Opitz & Maclin, 1999; Rokach, 2010), in this work we aim to ask: Can an ensemble ML model provide additional beneﬁts in terms of the certiﬁed robustness compared with a single model?
Revised: Given the observations that ensemble ML models are able to bring additional beneﬁts in standard learning (Opitz & Maclin, 1999; Rokach, 2010), in this work we aim to ask: Can an ensemble ML model provide additional beneﬁts in terms of the certiﬁed robustness compared with a single model?

Original: If so, what are the sufﬁcient and necessary conditions to guarantee such certiﬁed robustness gain?
Revised: If so, what are the sufﬁcient and necessary conditions to guarantee such certiﬁed robustness gain?

Original: Empirically, we ﬁrst ﬁnd that standard ensemble models only achieve marginally higher certiﬁed robustness by directly appling randomized smoothing: with L 2 perturbation radius 1 . 5 , a single model achieves certiﬁed accuracy as 21 .
Revised: Empirically, we ﬁrst ﬁnd that standard ensemble models only achieve marginally higher certiﬁed robustness by directly appling randomized smoothing: with L 2 perturbation radius 1 . 5 , a single model achieves certiﬁed accuracy as 21 .

Original: 9% , while the average aggregation based ensemble of three models achieves certiﬁed accuracy as 24 . 2% on CIFAR-10 (Table 2).
Revised: 9% , while the average aggregation based ensemble of three models achieves certiﬁed accuracy as 24 . 2% on CIFAR-10 (Table 2).

Original: Given such observations, next we aim to answer: How to improve the certiﬁed robustness of ensemble ML models?
Revised: Given such observations, next we aim to answer: How to improve the certiﬁed robustness of ensemble ML models?

Original: What types of conditions are required to improve the certiﬁed robustness for ML ensembles?
Revised: What types of conditions are required to improve the certiﬁed robustness for ML ensembles?

Original: In particular, from the theoretical perspective, we analyze the standard Weighted Ensemble (WE) and
Revised: In particular, from the theoretical perspective, we analyze the standard Weighted Ensemble (WE) and

Original: Max-Margin Ensemble (MME) protocols, and prove the sufﬁcient and necessary conditions for the certiﬁably robust ensemble models under model-smoothness assumption.
Revised: Max-Margin Ensemble (MME) protocols, and prove the sufﬁcient and necessary conditions for the certiﬁably robust ensemble models under model-smoothness assumption.

Original: Speciﬁcally, we prove that: (1) an ensemble ML model is more certiﬁably robust than each single base model; (2) diversiﬁed gradients and large conﬁdence margins of base models are the sufﬁcient and necessary conditions for the certiﬁably robust ML ensembles.
Revised: Speciﬁcally, we prove that: (1) an ensemble ML model is more certiﬁably robust than each single base model; (2) diversiﬁed gradients and large conﬁdence margins of base models are the sufﬁcient and necessary conditions for the certiﬁably robust ML ensembles.

Original: We show that these two key factors would lead to higher certiﬁed robustness for ML ensembles.
Revised: We show that these two key factors would lead to higher certiﬁed robustness for ML ensembles.

Original: We further propose Ensemble-before-Smoothing as the model smoothing strategy and prove the bounded model-smoothness with such strategy, which realizes our model-smoothness assumption.
Revised: We further propose Ensemble-before-Smoothing as the model smoothing strategy and prove the bounded model-smoothness with such strategy, which realizes our model-smoothness assumption.

Original: Inspired by our theoretical analysis, we propose
Revised: Inspired by our theoretical analysis, we propose

Original: D iversity- R egularized T raining (DRT), a lightweight regularization-based ensemble training approach.
Revised: D iversity- R egularized T raining (DRT), a lightweight regularization-based ensemble training approach.

Original: DRT is composed of two simple yet effective and general regularizers to promote the diversiﬁed gradients and large conﬁdence margins respectively.
Revised: DRT is composed of two simple yet effective and general regularizers to promote the diversiﬁed gradients and large conﬁdence margins respectively.

Original: DRT can be easily combined with existing ML approaches for training smoothed models, such as Gaussian augmentation (Cohen et al., 2019) and adversarial smoothed training (Salman et al., 2019), with negligible training time overhead while achieves signiﬁcantly higher certiﬁed robustness than state-of-the-art approaches consistently.
Revised: DRT can be easily combined with existing ML approaches for training smoothed models, such as Gaussian augmentation (Cohen et al., 2019) and adversarial smoothed training (Salman et al., 2019), with negligible training time overhead while achieves signiﬁcantly higher certiﬁed robustness than state-of-the-art approaches consistently.

Original: We conduct extensive experiments on a wide range of datasets including MNIST, CIFAR-10, and ImageNet.
Revised: We conduct extensive experiments on a wide range of datasets including MNIST, CIFAR-10, and ImageNet.

Original: The experimental results show that DRT can achieve signiﬁcantly higher certiﬁed robustness compared to baselines with similar training cost as training a single model.
Revised: The experimental results show that DRT can achieve signiﬁcantly higher certiﬁed robustness compared to baselines with similar training cost as training a single model.

Original: Furthermore, as DRT is ﬂexible to integrate any base models, by using the pretrained robust single ML models as base models, DRT achieves the highest certiﬁed robustness so far to our best knowledge.
Revised: Furthermore, as DRT is ﬂexible to integrate any base models, by using the pretrained robust single ML models as base models, DRT achieves the highest certiﬁed robustness so far to our best knowledge.

Original: For instance, on CIFAR-10 under L 2 radius 1 . 5 , the DRT-trained ensemble with three base models improves the certiﬁed accuracy from SOTA 24 .
Revised: For instance, on CIFAR-10 under L 2 radius 1 . 5 , the DRT-trained ensemble with three base models improves the certiﬁed accuracy from SOTA 24 .

Original: 2% to 30 .
Revised: 2% to 30 .

Original: 3% ; and under L 2 radius 2 . 0 , DRT improves the certiﬁed accuracy from SOTA 16 .
Revised: 3% ; and under L 2 radius 2 . 0 , DRT improves the certiﬁed accuracy from SOTA 16 .

Original: 0% to 20 .
Revised: 0% to 20 .

Original: Technical Contributions.
Revised: Technical Contributions.

Original: In this paper, we conduct the ﬁrst study for the sufﬁcient and necessary conditions of certiﬁably robust ML ensembles and propose an efﬁcient training algorithm DRT to achieve the state-of-the-art certiﬁed robustness.
Revised: In this paper, we conduct the ﬁrst study for the sufﬁcient and necessary conditions of certiﬁably robust ML ensembles and propose an efﬁcient training algorithm DRT to achieve the state-of-the-art certiﬁed robustness.

Original: We make contributions on both theoretical and empirical fronts.
Revised: We make contributions on both theoretical and empirical fronts.

Original: • We provide the necessary and sufﬁcient conditions for robust ensemble ML models including Weighted Ensemble (WE) and Max-Margin Ensemble (MME) under the model-smoothness assumption.
Revised: • We provide the necessary and sufﬁcient conditions for robust ensemble ML models including Weighted Ensemble (WE) and Max-Margin Ensemble (MME) under the model-smoothness assumption.

Original: In particular, we prove that the diversiﬁed gradients and large conﬁdence margins of base models are the sufﬁcient and necessary conditions of certiﬁably robust ensembles.
Revised: In particular, we prove that the diversiﬁed gradients and large conﬁdence margins of base models are the sufﬁcient and necessary conditions of certiﬁably robust ensembles.

Original: We also prove the bounded model-smoothness via proposed Ensemble-before-Smoothing strategy, which realizes our model-smoothness assumption.
Revised: We also prove the bounded model-smoothness via proposed Ensemble-before-Smoothing strategy, which realizes our model-smoothness assumption.

Original: • To analyze different ensembles, we prove that when the adversarial transferability among base models is low, WE is more robust than MME.
Revised: • To analyze different ensembles, we prove that when the adversarial transferability among base models is low, WE is more robust than MME.

Original: We also prove that the ML ensemble is more robust than a single base model under the model-smoothness assumption.
Revised: We also prove that the ML ensemble is more robust than a single base model under the model-smoothness assumption.

Original: • Based on the theoretical analysis of the sufﬁcient and necessary conditions, we propose DRT, a lightweight regularization-based training approach that can be easily combined with different training approaches and ensemble protocols with small training cost overhead.
Revised: • Based on the theoretical analysis of the sufﬁcient and necessary conditions, we propose DRT, a lightweight regularization-based training approach that can be easily combined with different training approaches and ensemble protocols with small training cost overhead.

Original: • We conduct extensive experiments to evaluate the effectiveness of DRT on various
Revised: • We conduct extensive experiments to evaluate the effectiveness of DRT on various

Original: datasets, and we show that to the best of your knowledge, DRT can achieve the highest certiﬁed robustness, outperforming all existing baselines.
Revised: datasets, and we show that to the best of your knowledge, DRT can achieve the highest certiﬁed robustness, outperforming all existing baselines.

Original: Related work.
Revised: Related work.

Original: DNNs are known vulnerable to adversarial examples (Szegedy et al., 2013).
Revised: DNNs are known vulnerable to adversarial examples (Szegedy et al., 2013).

Original: To defend against such attacks, several empirical defenses have been proposed (Papernot et al.,
Revised: To defend against such attacks, several empirical defenses have been proposed (Papernot et al.,

Original: 2016b; Madry et al., 2018).
Revised: 2016b; Madry et al., 2018).

Original: For ensemble models, existing work mainly focuses on empirical robustness (Pang et al., 2019; Li et al., 2020b; Cheng et al., 2021) where the robustness is measured by accuracy under existing attacks and no certiﬁed robustness guarantee could be provided or enhanced; or certify the robustness for a standard weighted ensemble (Zhang et al., 2019; Liu et al., 2020) using either LP-based (Zhang et al., 2018) veriﬁcation or randomized smoothing without considering the model diversity (Liu et al., 2020) to boost their certiﬁed robustness.
Revised: For ensemble models, existing work mainly focuses on empirical robustness (Pang et al., 2019; Li et al., 2020b; Cheng et al., 2021) where the robustness is measured by accuracy under existing attacks and no certiﬁed robustness guarantee could be provided or enhanced; or certify the robustness for a standard weighted ensemble (Zhang et al., 2019; Liu et al., 2020) using either LP-based (Zhang et al., 2018) veriﬁcation or randomized smoothing without considering the model diversity (Liu et al., 2020) to boost their certiﬁed robustness.

Original: In this paper, we aim to prove that the diversiﬁed gradient and large conﬁdence margin are the sufﬁcient and necessary conditions for certiﬁably robust ensemble ML models.
Revised: In this paper, we aim to prove that the diversiﬁed gradient and large conﬁdence margin are the sufﬁcient and necessary conditions for certiﬁably robust ensemble ML models.

Original: Moreover, to our best knowledge, we propose the ﬁrst training approach to boost the certiﬁed robustness of ensemble ML models.
Revised: Moreover, to our best knowledge, we propose the ﬁrst training approach to boost the certiﬁed robustness of ensemble ML models.

Original: Randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019) has been proposed to provide certiﬁed robustness for a single ML model.
Revised: Randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019) has been proposed to provide certiﬁed robustness for a single ML model.

Original: It achieved the state-of-the-art certiﬁed robustness on large-scale dataset such as ImageNet and CIFAR-10 under L 2 norm.
Revised: It achieved the state-of-the-art certiﬁed robustness on large-scale dataset such as ImageNet and CIFAR-10 under L 2 norm.

Original: Several approaches have been proposed to further improve it by: (1) choosing different smoothing distributions for different L p norms (Dvijotham et al., 2019; Zhang et al., 2020;
Revised: Several approaches have been proposed to further improve it by: (1) choosing different smoothing distributions for different L p norms (Dvijotham et al., 2019; Zhang et al., 2020;

Original: Yang et al., 2020a), and (2) training more robust smoothed classiﬁers, using data augmentation (Cohen et al., 2019), unlabeled data (Carmon et al., 2019), adversarial training (Salman et al., 2019), regularization (Li et al., 2019; Zhai et al., 2019), and denoising (Salman et al., 2020).
Revised: Yang et al., 2020a), and (2) training more robust smoothed classiﬁers, using data augmentation (Cohen et al., 2019), unlabeled data (Carmon et al., 2019), adversarial training (Salman et al., 2019), regularization (Li et al., 2019; Zhai et al., 2019), and denoising (Salman et al., 2020).

Original: In this paper, we compare and propose a suitable smoothing strategy to improve the certiﬁed robustness of ML ensembles.
Revised: In this paper, we compare and propose a suitable smoothing strategy to improve the certiﬁed robustness of ML ensembles.

Original:  C HARACTERIZING ML E NSEMBLE R OBUSTNESS
Revised:  C HARACTERIZING ML E NSEMBLE R OBUSTNESS

Original: In this section, we prove the sufﬁcient and necessary robustness conditions for both general and smoothed ML ensemble models.
Revised: In this section, we prove the sufﬁcient and necessary robustness conditions for both general and smoothed ML ensemble models.

Original: Based on these robustness conditions, we discuss the key factors for improving the certiﬁed robustness of an ensemble, compare the robustness of ensemble models with single models, and outline several ﬁndings based on additional theoretical analysis.
Revised: Based on these robustness conditions, we discuss the key factors for improving the certiﬁed robustness of an ensemble, compare the robustness of ensemble models with single models, and outline several ﬁndings based on additional theoretical analysis.

Original: 2. P RELIMINARIES
Revised: 2. P RELIMINARIES

Original: Notations.
Revised: Notations.

Original: Throughout the paper, we consider the classiﬁcation task with C classes.
Revised: Throughout the paper, we consider the classiﬁcation task with C classes.

Original: We ﬁrst deﬁne the classiﬁcation scoring function f : R d → ∆ C , which maps the input to a conﬁdence vector , and f ( x ) i represents the conﬁdence for the i th class.
Revised: We ﬁrst deﬁne the classiﬁcation scoring function f : R d → ∆ C , which maps the input to a conﬁdence vector , and f ( x ) i represents the conﬁdence for the i th class.

Original: We mainly focus on the conﬁdence after normalization, i.e., f ( x ) ∈ ∆ C
Revised: We mainly focus on the conﬁdence after normalization, i.e., f ( x ) ∈ ∆ C

Original: = { p ∈ R C ≥ 0 : (cid:107) p (cid:107) 1 = 1 } in the probability simplex.
Revised: = { p ∈ R C ≥ 0 : (cid:107) p (cid:107) 1 = 1 } in the probability simplex.

Original: To characterize the conﬁdence margin between two classes, we deﬁne f y 1 /y 2 ( x ) :
Revised: To characterize the conﬁdence margin between two classes, we deﬁne f y 1 /y 2 ( x ) :

Original: = f
Revised: = f

Original: ( x ) y 1 − f ( x ) y 2 .
Revised: ( x ) y 1 − f ( x ) y 2 .

Original: The corresponding prediction F : R d → [ C ] is deﬁned by F ( x ) := arg max i ∈
Revised: The corresponding prediction F : R d → [ C ] is deﬁned by F ( x ) := arg max i ∈

Original: [ C ] f ( x ) i .
Revised: [ C ] f ( x ) i .

Original: We are also interested in the runner-up prediction F (2) ( x ) :
Revised: We are also interested in the runner-up prediction F (2) ( x ) :

Original: = arg max i ∈
Revised: = arg max i ∈

Original: [ C ]: i (cid:54) =
Revised: [ C ]: i (cid:54) =

Original: F ( x ) f ( x ) i .
Revised: F ( x ) f ( x ) i .

Original: r -Robustness.
Revised: r -Robustness.

Original: For brevity, we consider the model’s certiﬁed robustness, against the L 2 -bounded perturbations as deﬁned below.
Revised: For brevity, we consider the model’s certiﬁed robustness, against the L 2 -bounded perturbations as deﬁned below.

Original: Our analysis can be generalizable for L 1 and L ∞ perturbations, leveraging existing work (Li et al., 2019; Yang et al., 2020a; Levine & Feizi, 2021).
Revised: Our analysis can be generalizable for L 1 and L ∞ perturbations, leveraging existing work (Li et al., 2019; Yang et al., 2020a; Levine & Feizi, 2021).

Original: Deﬁnition 1 ( r -Robustness) .
Revised: Deﬁnition 1 ( r -Robustness) .

Original: For a prediction function F : R d → [ C ] and input x 0 , if all instance x ∈ { x 

Revised: For a prediction function F : R d → [ C ] and input x 0 , if all instance x ∈ { x

Original: + δ : (cid:107) δ (cid:107) 2 ≤ r } satisﬁes F ( x ) =
Revised: + δ : (cid:107) δ (cid:107) 2 <r } satisﬁes F ( x ) =

Original: F ( x 0 ) , we say model F is r -robust (at point x 0 ).
Revised: F ( x 0 ) , we say model F is r -robust (at point x 0 ).

Original: Ensemble Protocols.
Revised: Ensemble Protocols.

Original: An ensemble model contains N base models { F i } Ni =1 , where F i ( x ) and
Revised: An ensemble model contains N base models { F i } Ni =1 , where F i ( x ) and

Original: F (2) i ( x ) are their top and runner-up predictions for given input x respectively.
Revised: F (2) i ( x ) are their top and runner-up predictions for given input x respectively.

Original: The ensemble prediction is denoted by M : R d → [ C ] , which is computed based on outputs of base models following certain ensemble protocols.
Revised: The ensemble prediction is denoted by M : R d → [ C ] , which is computed based on outputs of base models following certain ensemble protocols.

Original: In this paper, we consider both Weighted Ensemble (WE) and
Revised: In this paper, we consider both Weighted Ensemble (WE) and

Original: Maximum Margin Ensemble (MME).
Revised: Maximum Margin Ensemble (MME).

Original: Deﬁnition 2 (Weighted Ensemble (WE)) .
Revised: Deﬁnition 2 (Weighted Ensemble (WE)) .

Original: Given N base models { F i } Ni =1 , and the weight vector { w i } Ni =1 ∈ R N + , the weighted ensemble M WE : R d → [ C ] is deﬁned by
Revised: Given N base models { F i } Ni =1 , and the weight vector { w i } Ni =1 ∈ R N + , the weighted ensemble M WE : R d → [ C ] is deﬁned by

Original: [Equation]
Revised: [Equation]

Original: Deﬁnition 3 (Max-Margin Ensemble (MME)) .
Revised: Deﬁnition 3 (Max-Margin Ensemble (MME)) .

Original: Given N base models { F i } Ni =1 , for input x 0 , the max-margin ensemble model M MME : R d → [ C ] is deﬁned by
Revised: Given N base models { F i } Ni =1 , for input x 0 , the max-margin ensemble model M MME : R d → [ C ] is deﬁned by

Original: [Equation]
Revised: [Equation]

Original: F
Revised: F

Original: [Equation]
Revised: [Equation]

Original: x 0 ) where c = arg max
Revised: x 0 ) where c = arg max

Original: [Equation]
Revised: [Equation]

Original: The commonly-used WE (Zhang et al., 2019; Liu et al., 2020) sums up the weighted conﬁdence of base models { F i } Ni =1 with weight vector { w i } Ni =1 , and predicts the class with the highest weighted conﬁdence.
Revised: The commonly-used WE (Zhang et al., 2019; Liu et al., 2020) sums up the weighted conﬁdence of base models { F i } Ni =1 with weight vector { w i } Ni =1 , and predicts the class with the highest weighted conﬁdence.

Original: The standard average ensemble can be viewed as a special case of WE (where all w i ’s are equal).
Revised: The standard average ensemble can be viewed as a special case of WE (where all w i ’s are equal).

Original: MME chooses the base model with the largest conﬁdence margin between the top and the runner-up classes, which is a direct extension from max-margin training (Huang et al., 2008).
Revised: MME chooses the base model with the largest conﬁdence margin between the top and the runner-up classes, which is a direct extension from max-margin training (Huang et al., 2008).

Original: Randomized Smoothing.
Revised: Randomized Smoothing.

Original: Randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019) provides certiﬁed robustness by constructing a smoothed model from a given model.
Revised: Randomized smoothing (Lecuyer et al., 2019; Cohen et al., 2019) provides certiﬁed robustness by constructing a smoothed model from a given model.

Original: Formally, let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable, for any given model F : R d → [ C ] (can be an ensemble), we deﬁne smoothed conﬁdence function g εF : R d → ∆ C such that
Revised: Formally, let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable, for any given model F : R d → [ C ] (can be an ensemble), we deﬁne smoothed conﬁdence function g εF : R d → ∆ C such that

Original: [Equation]
Revised: [Equation]

Original: Intuitively, g εF ( x ) j is the probability of base model F ’s prediction on the j th class given Gaussian smoothed input.
Revised: Intuitively, g εF ( x ) j is the probability of base model F ’s prediction on the j th class given Gaussian smoothed input.

Original: The smoothed classiﬁer G εF : R d → [ C ] outputs the class with highest smoothed conﬁdence: G εF ( x ) :=
Revised: The smoothed classiﬁer G εF : R d → [ C ] outputs the class with highest smoothed conﬁdence: G εF ( x ) :=

Original: arg max j ∈ [ C ] g εF ( x ) j .
Revised: arg max j ∈ [ C ] g εF ( x ) j .

Original: Let c A be the predicted class for input x 0 ,
Revised: Let c A be the predicted class for input x 0 ,

Original: i.e., c A :=
Revised: i.e., c A :=

Original: G εF ( x 0 ) .
Revised: G εF ( x 0 ) .

Original: Cohen et al.
Revised: Cohen et al.

Original: show that G εF is ( σ Φ − 1 ( g εF ( x 0 )
Revised: show that G εF is ( σ Φ − 1 ( g εF ( x 0 )

Original: c A ))
Revised: c A ))

Original: -robust at input x 0 , i.e., the certiﬁed radius is σ Φ − 1 ( g εF ( x 0 )
Revised: -robust at input x 0 , i.e., the certiﬁed radius is σ Φ − 1 ( g εF ( x 0 )

Original: c A ) where Φ − 1 is the inverse cumulative distribution function of standard normal distribution.
Revised: c A ) where Φ − 1 is the inverse cumulative distribution function of standard normal distribution.

Original: In practice, we will leverage the smoothing strategy together with
Revised: In practice, we will leverage the smoothing strategy together with

Original: Monte-Carlo sampling to certify ensemble robustness.
Revised: Monte-Carlo sampling to certify ensemble robustness.

Original: More details can be found in Appendix A.
Revised: More details can be found in Appendix A.

Original: 2. R OBUSTNESS C ONDITIONS FOR G ENERAL E NSEMBLE M ODELS
Revised: 2. R OBUSTNESS C ONDITIONS FOR G ENERAL E NSEMBLE M ODELS

Original: We will ﬁrst provide sufﬁcient and necessary conditions for robust ensembles under the modelsmoothness assumption.
Revised: We will ﬁrst provide sufﬁcient and necessary conditions for robust ensembles under the modelsmoothness assumption.

Original: Deﬁnition 4 ( β -Smoothness) .
Revised: Deﬁnition 4 ( β -Smoothness) .

Original: A differentiable function f : R d (cid:55)→ R C is β -smooth, if for any x 1 , x 2 ∈ R d and any output dimension j ∈
Revised: A differentiable function f : R d (cid:55)→ R C is β -smooth, if for any x 1 , x 2 ∈ R d and any output dimension j ∈

Original: [ C ] ,
Revised: [ C ] ,

Original: [Equation]
Revised: [Equation]

Original: The deﬁnition of β -smoothness is inherited from optimization theory literature, and it is equivalent to the curvature bound in certiﬁed robustness literature (Singla & Feizi, 2020).
Revised: The deﬁnition of β -smoothness is inherited from optimization theory literature, and it is equivalent to the curvature bound in certiﬁed robustness literature (Singla & Feizi, 2020).

Original: β quantiﬁes the non-linearity of function f , where higher β indicates more rigid functions/models and smaller β indicates smoother ones.
Revised: β quantiﬁes the non-linearity of function f , where higher β indicates more rigid functions/models and smaller β indicates smoother ones.

Original: When β = 

Revised: When β =

Original: the function/model is linear.
Revised: the function/model is linear.

Original: For Weighted Ensemble (WE), we have the following robustness conditions.
Revised: For Weighted Ensemble (WE), we have the following robustness conditions.

Original: Theorem 1 (Gradient and Conﬁdence Margin Conditions for WE Robustness) .
Revised: Theorem 1 (Gradient and Conﬁdence Margin Conditions for WE Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] , and M WE as a WE deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .
Revised: [ C ] , and M WE as a WE deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .

Original: M WE ( x 0 ) =
Revised: M WE ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: All base models F i ’s are β -smooth.
Revised: All base models F i ’s are β -smooth.

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: The M WE is r -robust at point x 0 if for any y i (cid:54) =
Revised: The M WE is r -robust at point x 0 if for any y i (cid:54) =

Original: y 0 , (cid:13)(cid:13)(cid:13) N (cid:88)
Revised: y 0 , (cid:13)(cid:13)(cid:13) N (cid:88)

Original: j = w j ∇ x f y 

Revised: j = w j ∇ x f y

Original: /y
Revised: /y

Original: i j ( x 0 ) (cid:13)(cid:13)(cid:13) 2 ≤ 1 r N (cid:88)
Revised: i j ( x 0 ) (cid:13)(cid:13)(cid:13) 2 ≤ 1 r N (cid:88)

Original: j = w j f y 

Revised: j = w j f y

Original: /y
Revised: /y

Original: i j ( x 0 ) − βr
Revised: i j ( x 0 ) − βr

Original: [Equation]
Revised: [Equation]

Original: • (Necessary Condition)
Revised: • (Necessary Condition)

Original: If M WE is r -robust at point x 0 , for any y i (cid:54) =
Revised: If M WE is r -robust at point x 0 , for any y i (cid:54) =

Original: y0 ,
Revised: y

Original: [Equation]
Revised: [Equation]

Original: The proof follows from Taylor expansion at x 0 and we leave the detailed proof in Appendix B.2.
Revised: The proof follows from Taylor expansion at x 0 and we leave the detailed proof in Appendix B.2.

Original: When it comes to Max-Margin Ensemble (MME), the derivation of robust conditions is more involved.
Revised: When it comes to Max-Margin Ensemble (MME), the derivation of robust conditions is more involved.

Original: Concretely, MME selects the base model that has the maximum margin between the top and runner-up class.

Original: This “maximum” is a discrete operator and poses challenges in the multi-class setting.

Original: [-We cannot assert that the model predicts the true label y 
 by only looking at the margins between yand other labels and ignoring other label pairs.-] In Theorem4 (Appendix B.2), we conduct a careful enumeration and analysis of all possible layouts of conﬁdence scores, i.e., enumerating the cases where y 0 is the top class, runner-up class, or one of other classes. Then in Theorem 3 (Appendix B.1.1) we derive the robustness conditions for Max-Margin Ensemble (MME) composed of two base models.
Revised: [-We cannot assert that the model predicts the true label y 
 by only looking at the margins between yand other labels and ignoring other label pairs.-] In Theorem 3 (Appendix B.1.1) we derive the robustness conditions for MME composed of two base models.

Original: The robustness conditions have highly similar forms as those for WE in Theorem 1.
Revised: The robustness conditions have highly similar forms as those for WE in Theorem 1.

Original: Thus, for brevity, we focus on discussing Theorem 1 for WE hereinafter and similar conclusions can be drawn for MME (details are in Appendix B.1.1).
Revised: Thus, for brevity, we focus on discussing Theorem 1 for WE hereinafter and similar conclusions can be drawn for MME (details are in Appendix B.1.1).

Original: To analyze Theorem 1, we deﬁne Ensemble Robustness Indicator (ERI) as such:
Revised: To analyze Theorem 1, we deﬁne Ensemble Robustness Indicator (ERI) as such:

Original: [Equation]
Revised: [Equation]

Original: ERI appears in both sufﬁcient (Equation (4)) and necessary (Equation (5)) conditions.
Revised: ERI appears in both sufﬁcient (Equation (4)) and necessary (Equation (5)) conditions.

Original: In both conditions, smaller ERI means more certiﬁably robust ensemble.
Revised: In both conditions, smaller ERI means more certiﬁably robust ensemble.

Revised: Note that we can analyze the robustness under different attack radius r by directly varying r in Equations (4) and (5).

Revised: When r becomes larger, the gap between the RHS of two inequalities ( 2 βr (cid:80) Nj =1 w j ) also becomes larger, and thus it becomes harder to determine robustness via Theorem 1.

Revised: This is because the ﬁrst-order condition implied by Theorem 1 becomes coarse when r is large.

Revised: However, due to bounded β as we will show, the training approach motivated by the theorem still empirically works well under large r .

Original: Diversiﬁed Gradients.
Revised: Diversiﬁed Gradients.

Original: The core of ﬁrst term in ERI is the magnitude of the vector sum of gradients: (cid:107) [-(cid:80) Nj =1 w j ∇ x f y 
-]
Revised: The core of ﬁrst term in ERI is the magnitude of the vector sum of [Equation] According to the law of cosines: (cid:107) [-(cid:80) Nj =1 w j ∇ x f y 
-]a + b (cid:107) 2 = (cid:112) [Equation]

Original: /y
Revised: + [Equation] (cid:107) [Equation]

Original: i j ( x 0 ) (cid:107) 2 .
Revised: 2 (cid:107) [Equation] (cid:107)

Original: According to the law of cosines: (cid:107) a + b (cid:107) 2 = (cid:112) (cid:107) a (cid:107) 22 + (cid:107) b (cid:107) 22 + 2 (cid:107) a (cid:107) 2 (cid:107) b (cid:107) 2 cos (cid:104) a , b (cid:105) , to reduce this term, we could either reduce the base models’ gradient magnitude or diversify their gradients (in terms of cosine similarity).
Revised: [Equation] a , b [Equation] , to reduce this term, we could either reduce the base models’ gradient magnitude or diversify their gradients (in terms of cosine similarity).

Original: Since simply reducing base models’ gradient magnitude would hurt model expressivity (Huster et al., 2018), during regularization the main functionality of this term would be promoting diversiﬁed gradients.
Revised: Since simply reducing base models’ gradient magnitude would hurt model expressivity (Huster et al., 2018), during regularization the main functionality of this term would be promoting diversiﬁed gradients.

Original: Large Conﬁdence Margins.
Revised: Large Conﬁdence Margins.

Original: The core of second term in ERI is the conﬁdence margin: (cid:80)
Revised: The core of second term in ERI is the conﬁdence margin: (cid:80)

Original: Nj =1 w j f y
Revised: Nj = [Equation]

Original: /y
Revised: i

Original: i j ( x 0 ) .
Revised: [Equation] ( x 0 ) .

Original: Due to the negative sign of second term in ERI, we need to increase this term, i.e., we need to increase conﬁdence margins to achieve higher ensemble robustness.
Revised: Due to the negative sign of second term in ERI, we need to increase this term, i.e., we need to increase conﬁdence margins to achieve higher ensemble robustness.

Original: In summary, the diversiﬁed gradients and large conﬁdence margins are the sufﬁcient and necessary conditions for high certiﬁed robustness of ensembles.
Revised: In summary, the diversiﬁed gradients and large conﬁdence margins are the sufﬁcient and necessary conditions for high certiﬁed robustness of ensembles.

Original: In Section 3, we will directly regularize these two key factors to promote certiﬁed robustness of ensembles.
Revised: In Section 3, we will directly regularize these two key factors to promote certiﬁed robustness of ensembles.

Original:  Model-Smoothness Bound β .
Revised: Impact of Model-Smoothness Bound β .

Original: From Theorem 1, we observe that: (1) if min y i (cid:54) =
Revised: From Theorem 1, we observe that: (1) if min y i (cid:54) =

Original: y 

Revised: y

Original: I y i ≤ − βr , M
Revised: I y i ≤ − βr , M

Original: WE is guaranteed to be r -robust (sufﬁcient condition); and (2) if min y i (cid:54) =
Revised: WE is guaranteed to be r -robust (sufﬁcient condition); and (2) if min y i (cid:54) =

Original: y 

Revised: y

Original: I y i > βr , M WE cannot be r -robust (necessary condition).
Revised: I y i > βr , M WE cannot be r -robust (necessary condition).

Original: However, if min y i (cid:54) =
Revised: However, if min y i (cid:54) =

Original: y 

Revised: y

Original: I y i ∈ ( − βr, βr ] , we only know
Revised: I y i ∈ ( − βr, βr ] , we only know

Original: M WE is possibly r -robust.
Revised: M WE is possibly r -robust.

Original: As a result, the model-smoothness bound β decides the correlation strength between min y i (cid:54) =
Revised: As a result, the model-smoothness bound β decides the correlation strength between min y i (cid:54) =

Original: y 

Revised: y

Original: I y i and the robustness of M WE : if β becomes larger, min y i (cid:54) =
Revised: I y i and the robustness of M WE : if β becomes larger, min y i (cid:54) =

Original: y 

Revised: y

Original: I y
Revised: I y

Original: i is more likely to fall in ( − βr, βr ] , inducing an undetermined robustness status from Theorem 1, vice versa.
Revised: i is more likely to fall in ( − βr, βr ] , inducing an undetermined robustness status from Theorem 1, vice versa.

Original: Speciﬁcally, when β = 0 , i.e., all base models are linear, the gap is closed and we can always certify the robustness of M WE via comparing min y i (cid:54) =
Revised: Speciﬁcally, when β = 0 , i.e., all base models are linear, the gap is closed and we can always certify the robustness of M WE via comparing min y i (cid:54) =

Original: y 0 with 0 .
Revised: y 0 with 0 .

Original: Similar observations can be drawn for MME.
Revised: Similar observations can be drawn for MME.

Original: Therefore, to strengthen the correlation between I y i and ensemble robustness, we would need model-smoothness bound β to be small.
Revised: Therefore, to strengthen the correlation between I y i and ensemble robustness, we would need model-smoothness bound β to be small.

Original: We will propose Ensemble-before-Smoothing strategy next and prove that this strategy provides bounded model-smoothness.

Original: 2. R OBUSTNESS C ONDITIONS FOR S MOOTHED E NSEMBLE M ODELS
Revised: 2. R OBUSTNESS C ONDITIONS FOR S MOOTHED E NSEMBLE M ODELS

Revised: Typically neural networks are nonsmooth or admit only coarse smoothness bounds (Sinha et al., 2018), i.e., β is large.

Revised: Therefore, applying Theorem 1 for normal nonsmooth models would lead to near-zero certiﬁed radius.

Original: We use Ensemble-before-Smoothing to construct the smoothed model for the ensemble.
Revised: Therefore, we propose soft smoothing to enforce the smoothness of base models.

Original: In Appendix C, we will discuss another smoothing strategy, Ensemble-after-Smoothing , and compare the  robustness certiﬁcation they can bring.
Revised: However, with the soft smoothed base models, directly applying Theorem 1 to certify robustness is still practically challenging, since the LHS of Equations (4) and (5) involves gradient of the soft smoothed conﬁdence.

Original: Deﬁnition 5 ( Ensemble-before-Smoothing (EBS) ) .
Revised: A precise computation of such gradient requires high-conﬁdence estimation of high-dimensional vectors via sampling, which requires linear number of samples with respect to input dimension (Mohapatra et al., 2020; Salman et al., 2019) and is thus too expensive in practice. To solve this issue, we then propose Ensemble-before-Smoothing as the practical smoothing protocol, which serves as an approximation of soft smoothing, so as to leverage the randomized smoothing based techniques for certiﬁcation. Soft Smoothing.

Original: Let M be an ensemble model over  base models { F i } Ni =1 and ε be a random variable. The EBS strategy construct smoothed classiﬁer G ε M : R d → [ C ] that picks the class with highest smoothed conﬁdence of M :G ε M ( x ) := arg max j ∈ [ C ] g ε M ( x  )j .
Revised: To impose base models’ smoothness, we now introduce soft smoothing (Kumar et al., 2020), which applies randomized smoothing over the conﬁdence scores . Given base model’s conﬁdence function f : R d → ∆ C (see Section 2.1), we deﬁne soft smoothed conﬁdence by ¯ g εf : x (cid:55)→ E ε f ( x + ε ) .

Original: Recall that the smoothed conﬁdence is  deﬁned in Equation (3): g ε M ( x )
Revised: Note that soft smoothed conﬁdence is different from smoothed conﬁdence g εF deﬁned in Equation (3).

Original: j = Pr ε ∼N (0 ,σ 2 I d ) ( M ( x + ε ) = j ) . Here, the ensemble could be either WE or MME.
Revised: We consider soft smoothing instead of classical smoothing in Equation (3) since soft smoothing reveals differentiable and thus practically regularizable training objectives.

Original: We present a model-smoothness bound for the smoothed conﬁdence g ε M as such.
Revised: The following theorem shows the smoothness bound for ¯ g εf .

Original: Theorem 2 (Model-Smoothness Upper Bound for EBS) .
Revised: Theorem 2 (Model-Smoothness Upper Bound for ¯ g ε f ) .

Original: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable. Then the  smoothed conﬁdence function  g ε M is (2 /σ 2 ) -smooth.
Revised: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable, then the soft smoothed conﬁdence function ¯ g εf is (2 /σ 2 ) -smooth.

Original: We defer the proof to Appendix B.4.
Revised: We defer the proof to Appendix B.4.

Original: The proof views the Gaussian smoothing as the Weierstrass transform (Weierstrass, 1885) of a function from R d to [0 , 1] C , leverages the symmetry property, and bounds the absolute value of diagonal elements of the Hessian matrix.
Revised: The proof views the Gaussian smoothing as the Weierstrass transform (Weierstrass, 1885) of a function from R d to [0 , 1] C , leverages the symmetry property, and bounds the absolute value of diagonal elements of the Hessian matrix.

Original: Note that a Lipschitz constant (cid:112) 2 / ( πσ 2 ) is derived for smoothed conﬁdence in previous work (Salman et al., 2019, Lemma 1), which characterizes only the ﬁrst-order smoothness property; while our bound in addition shows the second-order smoothness property.
Revised: Note that a Lipschitz constant (cid:112) 2 / ( πσ 2 ) is derived for smoothed conﬁdence in previous work (Salman et al., 2019, Lemma 1), which characterizes only the ﬁrst-order smoothness property; while our bound in addition shows the second-order smoothness property.

Original: The following proposition (proofs in Appendix B.4) shows that our model-smoothness bound inabove theorem is tight up to a constant factor (cid:0) 2 √ 2 πe ≈ 8 . 265 (cid:1) .
Revised: In Appendix B.4, we further show that our smoothness bound in

Original: Proposition 1 (Model-Smoothness Lower Bound for EBS) . There exists a smoothed conﬁdence function g ε M that is β -smooth if and only if β ≥ (cid:0) 1 / ( √ 2 πeσ 2 ) (cid:1) . To analyze the smoothed model, we follow the existing practice (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020) by using the soft smoothed model as the proxy for analysis purpose: We ﬁrst deﬁne soft smoothed conﬁdence by ˜ g εf ( x ) : =
Revised: Theorem 2 is tight up to a constant factor.

Original: E ε f ( x + ε ) , then revise the ensemble protocols of WE and MME by replacing the original conﬁdences { f i ( x 0 ) } Ni =1 with these  {˜ g εi ( x 0 ) }
Revised: Now, we apply WE and MME protocols with these soft smoothness conﬁdence {

Original: Ni =1 . These protocols then construct soft smoothed ensembles by treating these { ˜ g εi ( x 0 ) } Ni =1 asthe base models’ conﬁdence scores.
Revised: ¯ g εi ( x 0 ) } Ni =1 as base models’ conﬁdence scores, and obtain soft ensemble

Original: We denote ˜ G ε M WE to the soft smoothed weighted ensemble.
Revised: ¯ G ε M WE and ¯ G ε M MME

Original: In implementation, following the routine (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020), we use EBS to construct the smoothed ensemble as it gives higher certiﬁed radius in practice.
Revised: respectively.

Original: [-For soft smoothed weighted ensemble, we can plug in the smoothness bound β = 
-] /σ 2 with proper scaling into the  robustness condition (Theorem 1).
Revised: [-For soft smoothed weighted ensemble, we can plug in the smoothness bound β = 
-]Since each ¯ g εi is (2 /σ 2 ) -smooth, take WE as an example, we can study the ensemble robustness with Theorem 1.

Original: Due to the space limit, we state the full statement in Corollary 2 (and in Corollary 3 for MME) in Appendix B.1.3.
Revised: We state the full statement in Corollary 2 (and in Corollary 3 for MME) in Appendix B.1.3.

Original: From the corollary, we observe that the corresponding ERI for the soft smoothed WE can be written as
Revised: From the corollary, we observe that the corresponding ERI for the soft smoothed WE can be written as

Original: [Equation]
Revised: [Equation]

Original: We have following observations: (1) unlike for standard models with unbounded β , for the smoothed ensemble models, this ERI (Equation (7)) would have guaranteed correlation(Corollary 2) with the model robustness since β = Θ(1 /σ 2 ) is bounded and can be controlled by tuning σ for smoothing.
Revised: We have following observations: (1) unlike for standard models with unbounded β , for the smoothed ensemble models, this ERI (Equation (7)) would have guaranteed correlation with the model robustness since β = Θ(1 /σ 2 ) is bounded and can be controlled by tuning σ for smoothing.

Original: (2) we can still control ERI by diversifying gradients and ensuring large conﬁdence margins as discussed in Section 2.2, but need to compute on the noise augmented input x 0 + ε instead ofthe original input x 0 . 
Revised: (2) we can still control ERI by diversifying gradients and ensuring large conﬁdence margins as discussed in Section 2.2, but need to compute on the noise augmented input x 0 + ε instead of original input x 0 . Towards Practical Certiﬁcation.

Revised: As outlined at the beginning of this subsection, even with smoothed base models, certifying robustness using Theorem 1 is practically difﬁcult.

Original: 2. A DDITIONAL P ROPERTIES OF ML E NSEMBLES
Revised: Therefore, we introduce Ensemble-before-Smoothing strategy as below to construct G ε M WE and G ε M MME as approximations of soft ensemble ¯ G ε M WE and ¯ G ε M MME respectively. Deﬁnition 5 ( Ensemble-before-Smoothing (EBS) ) . Let M be an ensemble model over base models { F i } Ni =1 and ε be a random variable. The EBS strategy construct smoothed classiﬁer G ε M : R d →

Revised: [ C ] that picks the class with highest smoothed conﬁdence of M : G ε M ( x ) := arg max j ∈ [ C ] g ε M ( x ) j .

Revised: Here M could be either M WE or M MME .

Revised: EBS aims to approximate the soft smoothed ensemble.

Original: We outline several additional theoretical ﬁndings below, and more details are reported in the appendix.
Revised: Formally, use WE as an example, we let f M WE : [Equation] to be WE ensemble’s conﬁdence, then [Equation]

Revised: where LHS is the smoothed conﬁdence of EBS ensemble and RHS is the soft smoothed ensemble’s conﬁdence.

Revised: Such approximation is also adopted in existing work (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020) and shown effective and useful.

Revised: Therefore, our robustness analysis of soft smoothed ensemble still applies with EBS and we can control ERI in Equation (7) to improve the certiﬁed robustness of EBS ensemble.

Revised: For EBS ensemble, we can leverage randomized smoothing based techniques to compute the robustness certiﬁcation (see Proposition C.1 in Appendix C).

Revised: 2. A DDITIONAL P ROPERTIES OF ML E NSEMBLES

Original: Comparison between Ensemble and Single-Model Robustness.
Revised: Comparison between Ensemble and Single-Model Robustness.

Original: In Appendix B.1, we show
Revised: In Appendix B.1, we show

Original: Corollary 1, a corollary of Theorem 1, which indicates that when the base models are smooth enough, both WE and MME ensemble models are more certiﬁably robust than the base models.
Revised: Corollary 1, a corollary of Theorem 1, which indicates that when the base models are smooth enough, both WE and MME ensemble models are more certiﬁably robust than the base models.

Original: This aligns with our empirical observations (see Table 1 and Table 2), though without advanced training approaches such as DRT, the improvement of robustness brought by ensemble itself is marginal. 
Revised: This aligns with our empirical observations (see Table 1 and Table 2), though without advanced training approaches such as DRT, the improvement of robustness brought by ensemble itself is marginal. In

Revised: Appendix B.1, we also show larger number of base models N can lead to better certiﬁed robustness.

Original: Comparison between WE and MME Robustness.
Revised: Comparison between WE and MME Robustness.

Original: Since in actual computing, the certiﬁed radius of a smoothed model is directly correlated with the probability of correct prediction under smoothed input (see Equation (10) in Appendix A), we study the robustness of both WE and MME along with single models from the statistical robustness perspective in Appendix D. From the study, we have the following theoretical observations veriﬁed by numerical experiments: (1) MME is more robust when the adversarial transferability is high; while WE is more robust when the adversarial transferability is low.
Revised: Since in actual computing, the certiﬁed radius of a smoothed model is directly correlated with the probability of correct prediction under smoothed input (see Equation (11) in Appendix A), we study the robustness of both WE and MME along with single models from the statistical robustness perspective in Appendix D. From the study, we have the following theoretical observations veriﬁed by numerical experiments: (1) MME is more robust when the adversarial transferability is high; while WE is more robust when the adversarial transferability is low.

Original: (2) If we further assume that f i ( x 0 + ε ) y 0 follows marginally uniform distribution, when the number of base models N is sufﬁciently large, MME is always more certiﬁably robust.
Revised: (2) If we further assume that f i ( x 0 + ε ) y 0 follows marginally uniform distribution, when the number of base models N is sufﬁciently large, MME is always more certiﬁably robust.

Original: Appendix D. entails the numerical evaluations that verify our theoretical conclusions.
Revised: Appendix D. entails the numerical evaluations that verify our theoretical conclusions.

Original:  D IVERSITY - R EGULARIZED T RAINING
Revised:  D IVERSITY - R EGULARIZED T RAINING

Original: Inspired by the above key factors in the sufﬁcient and necessary conditions for the certiﬁably robust ensembles, we propose the D iversity- R egularized T raining (DRT).
Revised: Inspired by the above key factors in the sufﬁcient and necessary conditions for the certiﬁably robust ensembles, we propose the D iversity- R egularized T raining (DRT).

Original: In particular, let x 0 be a training sample, DRT contains the following two regularization terms in the objective function to minimize:
Revised: In particular, let x 0 be a training sample, DRT contains the following two regularization terms in the objective function to minimize:

Original: • Gradient Diversity Loss (GD Loss):
Revised: • Gradient Diversity Loss (GD Loss):

Original: [Equation]
Revised: [Equation]

Original: • Conﬁdence Margin Loss (CM Loss):
Revised: • Conﬁdence Margin Loss (CM Loss [Equation] [Equation] CM

Original: [Equation]
Revised: [Equation]

Original: In Equations (8) and (9), y 0 is the ground-truth label of x 0 , and y (2) i (or y (2) j ) is the runner-up class of base model F i (or F j ).
Revised: In Equations (9) and (10), y 0 is the ground-truth label of x 0 , and y (2) i (or y (2) j ) is the runner-up class of base model F i (or F j ).

Original: Intuitively, for each model pair ( F i , F j ) where i, j ∈
Revised: Intuitively, for each model pair ( F i , F j ) where i, j ∈

Original: [ N ] and i (cid:54) =
Revised: [ N ] and i (cid:54) =

Original: j , the GD loss promotes the diversity of gradients between the base model F i and F j .
Revised: j , the GD loss promotes the diversity of gradients between the base model F i and F j .

Original: Note that the gradient computed here is actually the gradient difference between different labels.
Revised: Note that the gradient computed here is actually the gradient difference between different labels.

Original: As our theorem reveals, it is the gradient difference between different labels instead of pure gradient itself that matters, which improves existing understanding of gradient diversity (Pang et al., 2019; Demontis et al., 2019).
Revised: As our theorem reveals, it is the gradient difference between different labels instead of pure gradient itself that matters, which improves existing understanding of gradient diversity (Pang et al., 2019; Demontis et al., 2019).

Original: Speciﬁcally, the GD loss encourages both large gradient diversity and small base models’ gradient magnitude in a naturally balanced way, and encodes the interplay between gradient magnitude and direction diversity.
Revised: Speciﬁcally, the GD loss encourages both large gradient diversity and small base models’ gradient magnitude in a naturally balanced way, and encodes the interplay between gradient magnitude and direction diversity.

Original: In contrast, solely regularizing the base models’ gradient would hurt the model’s benign accuracy, and solely regularizing gradient diversity is hard to realize due to the boundedness of cosine similarity.
Revised: In contrast, solely regularizing the base models’ gradient would hurt the model’s benign accuracy, and solely regularizing gradient diversity is hard to realize due to the boundedness of cosine similarity.

Original: The CM loss encourages the large margin between the true and runner-up classes for base models.
Revised: The CM loss encourages the large margin between the true and runner-up classes for base models.

Original: Both regularization terms are directly motivated by theoretical analysis in Section 2.
Revised: Both regularization terms are directly motivated by theoretical analysis in Section 2.

Original: For each input x 0 with ground truth y 0 , we use x 0 + ε with ε ∼ N (0 , σ 2 I d ) as training input for each base model (i.e., Gaussian augmentation).
Revised: For each input x 0 with ground truth y 0 , we use x 0 + ε with ε ∼ N (0 , σ 2 I d ) as training input for each base model (i.e., Gaussian augmentation).

Original: We call two base models (cid:0) F i , F j (cid:1) a valid model pair at ( x 0 , y 0 ) if both F i ( x 0 + ε ) and F j ( x 0 + ε ) equal to y 0 .
Revised: We call two base models (cid:0) F i , F j (cid:1) a valid model pair at ( x 0 , y 0 ) if both F i ( x 0 + ε ) and F j ( x 0 + ε ) equal to y 0 .

Original: For every valid model pair, we apply DRT:
Revised: For every valid model pair, we apply DRT:

Original: GD Loss and CM Loss with ρ 1 and ρ 2 as the weight hyperparameters as below.
Revised: GD Loss and CM Loss with ρ 1 and ρ 2 as the weight hyperparameters as below.

Original: [Equation]
Revised: [Equation]

Original: The standard training loss L std ( x 0 + ε, y 0 )
Revised: The standard training loss L std ( x 0 + ε, y 0 )

Original: i of each base model F i is either cross-entropy loss (Cohen et al., 2019), or adversarial training loss
Revised: i of each base model F i is either cross-entropy loss (Cohen et al., 2019), or adversarial training loss

Original: (Salman et al., 2019).
Revised: (Salman et al., 2019).

Original: This standard training loss will help to produce sufﬁcient valid model pairs with high benign accuracy for robustness regularization.
Revised: This standard training loss will help to produce sufﬁcient valid model pairs with high benign accuracy for robustness regularization.

Original: Speciﬁcally, as discussed in Section 2.3, we compute L GD and L CM on the noise augmented inputs ( x 0 + ε ) instead of x 0 to improve the certiﬁed robustness for the smoothed ensemble.
Revised: Speciﬁcally, as discussed in Section 2.3, we compute L GD and L CM on the noise augmented inputs ( x 0 + ε ) instead of x 0 to improve the certiﬁed robustness for the smoothed ensemble.

Original: Discussion.
Revised: Discussion.

Original: To our best knowledge, this is the ﬁrst training approach that is able to promote the certiﬁed robustness of ML ensembles, while existing work either only provide empirical robustness without guarantees (Pang et al., 2019; Kariyappa & Qureshi, 2019; Yang et al., 2020b; 2021), or tries to only optimize the weights of Weighted Ensemble (Zhang et al., 2019; Liu et al., 2020).
Revised: To our best knowledge, this is the ﬁrst training approach that is able to promote the certiﬁed robustness of ML ensembles, while existing work either only provide empirical robustness without guarantees (Pang et al., 2019; Kariyappa & Qureshi, 2019; Yang et al., 2020b; 2021), or tries to only optimize the weights of Weighted Ensemble (Zhang et al., 2019; Liu et al., 2020).

Original: We should notice that, though concepts similar with the gradient diversity have been explored in empirically robust ensemble training (e.g., ADP (Pang et al., 2019), GAL (Kariyappa & Qureshi, 2019)), directly applying these regularizers cannot train models with high certiﬁed robustness due to the lack of theoretical guarantees in their design.
Revised: We should notice that, though concepts similar with the gradient diversity have been explored in empirically robust ensemble training (e.g., ADP (Pang et al., 2019), GAL (Kariyappa & Qureshi, 2019)), directly applying these regularizers cannot train models with high certiﬁed robustness due to the lack of theoretical guarantees in their design.

Original: We indicate this through ablation studies in Appendix G. For the design of DRT, we also ﬁnd that there exist some variations.
Revised: We indicate this through ablation studies in Appendix G.4. For the design of DRT, we also ﬁnd that there exist some variations.

Original: We analyze them and show that the current design is usually better based on a series of ablation studies in Appendix E. Our approach is generalizable for other L p -bounded perturbations such as L 1 and L ∞ leveraging existing work (Li et al., 2019;Lecuyer et al., 2019;
Revised: We analyze them and show that the current design is usually better based on the analysis in Appendix E. Our approach is generalizable for other L p -bounded perturbations such as L 1 and L ∞ leveraging existing work (Li et al., 2019;

Original:  Yang et al., 2020a; Levine & Feizi, 2021).
Revised: Lecuyer et al., 2019; Yang et al., 2020a; Levine & Feizi, 2021).

Original:  E XPERIMENTAL E VALUATION
Revised:  E XPERIMENTAL E VALUATION

Original: To make a thorough comparison with existing certiﬁed robustness approaches (Cohen et al., 2019; Salman et al., 2019), we evaluate DRT on different datasets including MNIST (LeCun et al., 2010), 
Revised: To make a thorough comparison with existing certiﬁed robustness approaches, we evaluate DRT on different datasets including MNIST (LeCun et al., 2010), CIFAR-10 (Krizhevsky, 2012), and

Original: CIFAR-10 (Krizhevsky, 2012), and ImageNet (Deng et al., 2009), based on both MME and WE protocols.We consider two types of base models: Gaussian smoothing (Cohen et al., 2019) and SmoothAdv (Salman et al., 2019).
Revised: ImageNet (Deng et al., 2009), based on both MME and WE protocols.

Original: Overall, we show that the DRT enabled ensemble outperforms all baselines in terms ofthe certiﬁed robustness under different settings.
Revised: Overall, we show that the DRT enabled ensemble outperforms all baselines in terms of certiﬁed robustness under different settings.

Original: 4. E XPERIMENTAL S ETUP
Revised: 4. E XPERIMENTAL S ETUP

Original: Baselines.
Revised: Baselines.

Original: We consider the following state-of-the-art baselines for certiﬁed robustness:(1) Gaussian smoothing (Cohen et al., 2019) trains a smoothed classiﬁer by applying Gaussian augmentation. (2) SmoothAdv (Salman et al., 2019) combines adversarial training with Gaussian augmentation.
Revised: We consider the following state-of-the-art baselines for certiﬁed robustness: Gaussian smoothing (Cohen et al., 2019), SmoothAdv (Salman et al., 2019), MACER (Zhai et al., 2019),

Original: (3) MACER (Zhai et al., 2019) improves a single model ’s certiﬁed robustness by adding regularization terms to minimize the Negative Log Likelihood (NLL) between smoothed classiﬁer’s output g F ( x ) and label y , and maximize the certiﬁed radius R = σ 2 (Φ − 1 ( g εF ( x ) y ) − Φ − 1 (max y (cid:48) (cid:54) =
Revised: Stability (Li et al., 2019), and SWEEN (Liu et al., 2020).

Original: y g εF ( x ) y (cid:48) )) , where ε ∼ N (0 , σ 2 I d ) and g εF is as deﬁned in Equation (3). (4) Stability (Li et al., 2019) maintains the stability of the smoothed classiﬁer g F by minimizing the Rényi Divergence between g F ( x ) and g F ( x + ε ) where ε ∼ N (0 , σ 2 I d ) . (5) SWEEN (Liu et al., 2020) builds smoothed Weighted Ensemble (WE), which is the only prior work computing certiﬁed robustness for ensemble to our knowledge.
Revised: Detail description of these baselines can be found in Appendix F.

Original: We follow the conﬁgurations of baselines, and compare DRT-based ensemble with Gaussian Smoothing, SmoothAdv, and MACER on all datasets, and in addition compare it with other baselines on MNIST and CIFAR-10 considering the training efﬁciency.
Revised: We follow the conﬁgurations of baselines, and compare DRT-based ensemble with Gaussian Smoothing, SmoothAdv, and MACER on all datasets, and in addition compare it with other baselines on MNIST and CIFAR-10 considering the training efﬁciency.

Original: There are other baselines, e.g., (Jeong & Shin, 2020).
Revised: There are other baselines, e.g., (Jeong & Shin, 2020).

Original: However, SmoothAdv performs consistently better across different datasets, so we mainly consider SmoothAdv as our strong baseline.
Revised: However, SmoothAdv performs consistently better across different datasets, so we mainly consider SmoothAdv as our strong baseline.

Original: with GD loss & CM loss Eq. Smooth via EBS
Revised: [Figure]

Original: Strategy
Revised: [Table]

Original: Definition 5 Eq. (1) and (2)
Revised: [Figure] [Table] [Figure]

Original: Compute Certified
Revised: [Table]

Original: Radius
Revised: [Figure]

Original: Sec 2.1 and AppendixA
Revised: Sec 2.1 and Appendix

Original: Robust EnsembleTraining
Revised: [Figure] [Table]

Original: SmoothedEnsemble Construction RobustnessCertification Aggregate with WE or MME protocol
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: Models.
Revised: Models.

Original: For base models in our ensemble, we follow the conﬁgurations used in baselines: LeNet (LeCun et al., 1998), ResNet-110, and ResNet-50 (He et al., 2016) for MNIST, CIFAR-10, and ImageNet datasets respectively.
Revised: For base models in our ensemble, we follow the conﬁgurations used in baselines Le [Table] respectively.

Original: Throughout the experiments, we use N = 3 base models to construct the ensemble for demonstration.
Revised: Throughout the experiments, we use N = 3 base models to construct the ensemble for demonstration.

Original: We expect more base models would yield higher ensemble robustness.
Revised: We expect more base models would yield higher ensemble robustness.

Original: Training Details.
Revised: Training Details.

Original: We follow Section 3 to train the base models.
Revised: We follow Section 3 to train the base models.

Original: We combine DRT with Gaussian smoothing and SmoothAdv (i.e., instantiating L std by either cross-entropy loss (Cohen et al., 2019;
Revised: We combine DRT with Gaussian smoothing and SmoothAdv (i [Table] e., instantiating L std by either cross-entropy loss (Cohen et al., 2019;

Original: Yang et al., 2020a) or adversarial training loss (Salman et al., 2019)).
Revised: Yang et al., 2020a) or adversarial training loss (Salman et al., 2019)).

Original: We leave training details along with hyperparametes in Appendix F.
Revised: We leave training details along with hyperparametes in Appendix F.

Original: Pipeline.
Revised: Pipeline.

Original: After the base models are trained with DRT, we aggregate them to form the ensemble M , using either WE or MME protocol (see Deﬁnitions 2 and 3).
Revised: After the base models are trained with DRT, we aggregate them to form the ensemble M , using either WE or MME protocol (see Deﬁnitions 2 and 3).

Revised: If we use WE, to ﬁlter out the effect of different weights, we adopt the average ensemble where all weights are equal.

Revised: We also studied how optimizing weights can further improve the certiﬁed robustness in Appendix G.3.

Original: Then, we leverage Ensemble-beforeSmoothing strategy to form a smoothed ensemble (see Deﬁnition 5).
Revised: Then, we leverage Ensemble-before-Smoothing strategy to form a smoothed ensemble (see Deﬁnition 5).

Original: Finally, we compute the certiﬁed robustness for the smoothed ensemble based on Monte-Carlo sampling with high-conﬁdence ( 99 . 9% ).
Revised: Finally, we compute the certiﬁed robustness for the smoothed ensemble based on Monte-Carlo sampling with high-conﬁdence ( 99 . 9% ).

Original: The training pipeline is shown in Figure 2.
Revised: The training pipeline is shown in Figure 2.

Original: Evaluation Metric.
Revised: Evaluation Metric.

Original: We report the standard certiﬁed accuracy under different L 2 radii r ’s as our evaluation metric following existing work
Revised: We report the standard certiﬁed accuracy under different L 2 radii r ’s as our evaluation metric following existing work

Original: (Cohen et al., 2019;
Revised: (Cohen et al., 2019;

Original: Yang et al., 2020b; Zhai et al., 2019;
Revised: Yang et al., 2020b; Zhai et al., 2019;

Original: Jeong & Shin, 2020).
Revised: Jeong & Shin, 2020).

Original: More evaluation details are in Appendix F.
Revised: More evaluation details are in Appendix F.

Original: 4. E XPERIMENTAL R ESULTS
Revised: 4. E XPERIMENTAL R ESULTS

Original: Here we consider ensemble models consisting of three base models.
Revised: Here we consider ensemble models consisting of three base models.

Original: We show that 1) DRT-based ensembles outperform the SOTA baselines signiﬁcantly especially under large perturbation radii; 2) smoothed ensembles are always more certiﬁably robust than each base model (Corollary 1 in
Revised: We show that 1) DRT-based ensembles outperform the SOTA baselines signiﬁcantly especially under large perturbation radii; 2) smoothed ensembles are always more certiﬁably robust than each base model (Corollary 1 in

Original: Appendix B.1); 3) applying DRT for either MME or WE ensemble protocols achieves similar and consistent improvements on certiﬁed robustness.
Revised: Appendix B.1); 3) applying DRT for either MME or WE ensemble protocols achieves similar and consistent improvements on certiﬁed robustness.

Original: Certiﬁed Robustness of DRT with Different Ensemble Protocols.
Revised: Certiﬁed Robustness of DRT with Different Ensemble Protocols.

Original: The evaluation results on
Revised: The evaluation results on

Original: MNIST, CIFAR-10, ImageNet are shown in Tables 1, 2, 3 respectively.
Revised: MNIST, CIFAR-10, ImageNet are shown in Tables 1, 2, 3 respectively.

Original: It is clear that though the certiﬁed accuracy of a single model can be improved by directly applying either MME or WE ensemble training (proved in Corollary 1), such improvements are usually negligible (usually less than 2% ).
Revised: It is clear that though the certiﬁed accuracy of a single model can be improved by directly applying either MME or WE ensemble training (proved in Corollary 1), such improvements are usually negligible (usually less than 2% ).

Original: In contrast, in all tables we ﬁnd DRT provides signiﬁcant gains on certiﬁed robustness for both MME and WE (up to over 16% as Table 1 shows).
Revised: In contrast, in all tables we ﬁnd DRT provides signiﬁcant gains on certiﬁed robustness for both MME and WE (up to over 16% as Table 1 shows).

Original: From Tables 1 and 2 on MNIST and CIFAR-10, we ﬁnd that compared with all baselines, DRT-based ensemble achieves the highest robust accuracy, and the performance gap is more pronounced on large radii (over 8% for r = 2 .
Revised: From Tables 1 and 2 on MNIST and CIFAR-10, we ﬁnd that compared with all baselines, DRT-based ensemble achieves the highest robust accuracy, and the performance gap is more pronounced on large radii (over 8% for r = 2 .

Original: 50 on MNIST and 6% for r = 1 . 50 on CIFAR-10).
Revised: 50 on MNIST and 6% for r = 1 . 50 on CIFAR-10).

Original: We also demonstrate the scalability of DRT by training on ImageNet, and Table 3 shows that DRT achieves the highest certiﬁed robustness under large radii.
Revised: We also demonstrate the scalability of DRT by training on ImageNet, and Table 3 shows that DRT achieves the highest certiﬁed robustness under large radii.

Original: It is clear that DRT can be easily combined with existing training approaches (e.g. Gaussian smoothing or SmoothAdv), boost their certiﬁed robustness, and set the state-of-the-art results to the best of our knowledge.
Revised: It is clear that DRT can be easily combined with existing training approaches (e.g. Gaussian smoothing or SmoothAdv), boost their certiﬁed robustness, and set the state-of-the-art results to the best of our knowledge.

Original: [Table]
Revised: [Table]

Original: To evaluate the computational cost of DRT [Table] we  compare the efﬁciency of different methods in Appendix F.2.
Revised: To evaluate the computational cost of DRT, we analyze the theoretical complexity in Appendix E and compare the efﬁciency of different methods in practice in Appendices F.1 and F.2.

Original: In particular [Table] we show that DRT with Gaussian Smoothing base models even achieves around two times speedup compared with SmoothAdv with comparable or even higher certiﬁed robustness, since DRT does not require adversarial training.
Revised: In particular, we show that DRT with Gaussian Smoothing base models even achieves around two times speedup compared with SmoothAdv with comparable or even higher certiﬁed robustness, since DRT does not require adversarial training.

Original: More discussions about hyper-parameters settings for DRT can be found in Appendix F.In Appendix G
Revised: More discussions about hyper-parameters settings for DRT can be found in Appendix F.

Original: [Table] we also show that our proposed DRT approach could achieve 6% ∼ 10% higher certiﬁed accuracy compared to adapted 
Revised: In Appendix G.4, we also show that our proposed DRT approach could achieve 6% ∼ 10% higher certiﬁed accuracy compared to adapted ADP (Pang et al., 2019) and

Original: ADP (Pang et al., 2019) and GAL (Kariyappa & Qureshi, 2019) training on large radiifor both MNIST and CIFAR-10 datasets.
Revised: GAL (Kariyappa & Qureshi, 2019) training on large radii both MNIST and CIFAR-10 datasets.

Original: [Table]
Revised: [Table]

Original: Certiﬁed Accuracy with Different
Revised: Certiﬁed Accuracy with Different

Original: Perturbation Radius.
Revised: Perturbation Radius.

Original: We visualize the trend of certiﬁed accuracy along with different perturbation radii in Figure 3.
Revised: We visualize the trend of certiﬁed accuracy along with different perturbation radii in Figure 3.

Original: For each radius r , we present the best certiﬁed accuracy among different smoothing parameters σ ∈ { 0 . 25 , 0 .
Revised: For each radius r , we present the best certiﬁed accuracy among different smoothing parameters σ ∈ { 0 . 25 , 0 .

Original: We notice that while simply applying MME or WE protocol could slightly improve the certiﬁed accuracy, DRT could significantly boost the certiﬁed accuracy under different radii.
Revised: We notice that while simply applying MME or WE protocol could slightly improve the certiﬁed accuracy, DRT could significantly boost the certiﬁed accuracy under different radii.

Original: We also present the trends of different smoothing parameters separately in Appendix F which lead to similar conclusions.
Revised: We also present the trends of different smoothing parameters separately in Appendix F which lead to similar conclusions.

Original: [Figure]
Revised: [Figure]

Original: Effects of GD and CM Losses in DRT.
Revised: Effects of GD and CM Losses in DRT.

Original: To explore the effects of individual Gradient Diversity and Conﬁdence Margin
Revised: To explore the effects of individual Gradient Diversity and Conﬁdence Margin

Original: Losses in DRT [Figure] we set ρ 1 or ρ 2 to 0 separately and tune the other for evaluation on
Revised: Losses in DRT, we set ρ 1 or ρ 2 to 0 separately and tune the other for evaluation on

Original: MNIST and CIFAR-10.
Revised: MNIST and CIFAR-10.

Original: The full results are shown in Appendix F.4.
Revised: The full results are shown in Appendix G.1.

Original: We observe that both GD and CM losses have positive effects on improving the certiﬁed accuracy, and GD plays a major role on larger radii.
Revised: We observe that both GD and CM losses have positive effects on improving the certiﬁed accuracy, and GD plays a major role on larger radii.

Original: By combining these two regularization losses as DRT does, the ensemble model achieves the highest certiﬁed accuracy under all radii.
Revised: By combining these two regularization losses as DRT does, the ensemble model achieves the highest certiﬁed accuracy under all radii.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: In this paper [Figure] we explored and characterized the robustness conditions for certiﬁably robust ensemble
Revised: In this paper, we explored and characterized the robustness conditions for certiﬁably robust ensemble

Original: ML models theoretically, and proposed DRT for training a robust ensemble.
Revised: ML models theoretically, and proposed DRT for training a robust ensemble.

Original: Our analysis provided the justiﬁcation of the regularization-based training approach DRT.
Revised: Our analysis provided the justiﬁcation of the regularization-based training approach DRT.

Original: Extensive experiments showed that
Revised: Extensive experiments showed that

Original: DRT-enhanced ensembles achieve the highest certiﬁed robustness compared with existing baselines.
Revised: DRT-enhanced ensembles achieve the highest certiﬁed robustness compared with existing baselines

Original: Ethics Statement.
Revised: Ethics Statement.

Original: In this paper, we characterized the robustness conditions for certifying ML ensemble robustness.
Revised: In this paper, we characterized the robustness conditions for certifying ML ensemble robustness.

Original: Based on the analysis, we propose DRT to train a certiﬁably robust ensemble.
Revised: Based on the analysis, we propose DRT to train a certiﬁably robust ensemble.

Original: On the one hand, the training approach boosts the certiﬁed robustness of ML ensemble, thus signiﬁcantly reducing the security vulnerabilities of ML ensemble.
Revised: On the one hand, the training approach boosts the certiﬁed robustness of ML ensemble, thus signiﬁcantly reducing the security vulnerabilities of ML ensemble.

Original: On the other hand, the trained ML ensemble can only guarantee its robustness under speciﬁc conditions of the attack.
Revised: On the other hand, the trained ML ensemble can only guarantee its robustness under speciﬁc conditions of the attack.

Original: Speciﬁcally, we evaluate the trained ML ensemble on the held-out test set and constrain the attack to be within predeﬁned Ldistance from the original input.
Revised: Speciﬁcally, we evaluate the trained ML ensemble on the held-out test set and constrain the attack to be within predeﬁned Ldistance from the original input.

Original: We cannot provide robustness guarantee for all possible real-world inputs.
Revised: We cannot provide robustness guarantee for all possible real-world inputs.

Original: Therefore, users should be aware of such limitations of DRT-trained ensembles, and should not blindly rely on the ensembles when the attack can cause large deviations measured by L 2 distance.
Revised: Therefore, users should be aware of such limitations of DRT-trained ensembles, and should not blindly rely on the ensembles when the attack can cause large deviations measured by L 2 distance.

Original: As a result, we encourage researchers to understand the potential risks, and evaluate whether our attack constraints align with their usage scenarios when applying our DRT approach to real-world applications.
Revised: As a result, we encourage researchers to understand the potential risks, and evaluate whether our attack constraints align with their usage scenarios when applying our DRT approach to real-world applications.

Original: We do not expect any ethics issues raised by our work.
Revised: We do not expect any ethics issues raised by our work.

Original: Reproducibility Statement.
Revised: Reproducibility Statement.

Original: All the theorem statements are substantiated with rigorous proofs in Appendices B to D. In Appendix F, we list the details and hyperparameters for reproducing all experimental results.
Revised: All the theorem statements are substantiated with rigorous proofs in Appendices B to D. In Appendix F, we list the details and hyperparameters for reproducing all experimental results.

Original: Our evaluation is conducted on commonly accessible MNIST, CIFAR10, and ImageNet datasets.
Revised: Our evaluation is conducted on commonly accessible MNIST, CIFAR10, and ImageNet datasets.

Original: Finally, we upload the source code as the supplementary material for reproducibility purpose.
Revised: Finally, we upload the source code as the supplementary material for reproducibility purpose.

Original: A B ACKGROUND : R ANDOMIZED S MOOTHING
Revised: A B ACKGROUND : R ANDOMIZED S MOOTHING

Original: Cohen et al.
Revised: Cohen et al.

Original: (Cohen et al., 2019) leverage Neyman-Pearson Lemma Neyman & Pearson (1933) to provide a computable robustness certiﬁcation for the smoothed classiﬁer.
Revised: (Cohen et al., 2019) leverage Neyman-Pearson Lemma Neyman & Pearson (1933) to provide a computable robustness certiﬁcation for the smoothed classiﬁer.

Original: Lemma A.1 (Robustness Certiﬁcate of Randomized Smoothing; (Cohen et al., 2019)) .
Revised: Lemma A.1 (Robustness Certiﬁcate of Randomized Smoothing; (Cohen et al., 2019)) .

Original: At point x 0 , let random variable ε ∼ N (0 , σ 2 I d ) , a smoothed model G ε F is r -robust where
Revised: At point x 0 , let random variable ε ∼ N (0 , σ 2 I d ) , a smoothed model G εF is r -robust where

Original: [Equation]
Revised: [Equation]

Original: where
Revised: where

Original: c
Revised: c

Original: A = G εF ( x 0 ) and c B = G ε (2) F ( x 0 ) are the top and runner-up class respectively, and Φ − 1 is the inverse cumulative distribution function (CDF) of standard normal distribution.
Revised: A = G εF ( x 0 ) and c B = G ε (2) F ( x 0 ) are the top and runner-up class respectively, and Φ − 1 is the inverse cumulative distribution function (CDF) of standard normal distribution.

Original: In practice, for ease of sampling, the standard way of computing the certiﬁed radius is using the lower bound of Equation (10): r = σ Φ − 1 ( g εF ( x 0 ) c A ) .
Revised: In practice, for ease of sampling, the standard way of computing the certiﬁed radius is using the lower bound of Equation (11): r = σ Φ − 1 ( g εF ( x 0 ) c A ) .

Original: Now we only need to ﬁgure out g εF ( x 0 )
Revised: Now we only need to ﬁgure out g εF ( x 0 )

Original: c A .
Revised: c A .

Original: The common way is to use Monte-Carlo sampling together with binomial conﬁdence interval Cohen et al.
Revised: The common way is to use Monte-Carlo sampling together with binomial conﬁdence interval Cohen et al.

Original: ; Yang et al.
Revised: ; Yang et al.

Original: (2020a)
Revised: (2020a)

Original: ; Zhai et al.
Revised: ; Zhai et al.

Original: ; Jeong & Shin (2020).
Revised: ; Jeong & Shin (2020).

Original: Concretely, from deﬁnition g εF ( x 0 ) c
Revised: Concretely, from deﬁnition g εF ( x 0 ) c

Original: A =
Revised: A =

Original: Pr ε ∼N (0 ,σ 2 I d ) ( F ( x 0 + ε ) =
Revised: Pr ε ∼N (0 ,σ 2 I d ) ( F ( x 0 + ε ) =

Original: c A ) , we sample n Gaussian noises: ε 1 , ε 2 , . . .
Revised: c A ) , we sample n Gaussian noises: ε 1 , ε 2 , . . .

Original: , ε n ∼
Revised: , ε n ∼

Original: N (0 , σ 2 I d ) and compute the empirical mean: ˆ g εF ( x 0 ) c
Revised: N (0 , σ 2 I d ) and compute the empirical mean: ˆ g εF ( x 0 ) c

Original: A = 1 n (cid:80) ni
Revised: A = 1 n (cid:80) ni

Original: =

Revised: =

Original: I [ F ( x 0 + ε i ) =
Revised: I [ F ( x 0 + ε i ) =

Original: c A ] .
Revised: c A ] .

Original: The binomial testing Clopper & Pearson (1934) then gives a high-conﬁdence lower bound of g εF ( x 0 )
Revised: The binomial testing Clopper & Pearson (1934) then gives a high-conﬁdence lower bound of g εF ( x 0 )

Original: c
Revised: c

Original: A based on ˆ g εF ( x 0 )
Revised: A based on ˆ g εF ( x 0 )

Original: c A .
Revised: c A .

Original: We follow the setting in the literature: sample n = 10 5 samples and set conﬁdence level be 99 .
Revised: We follow the setting in the literature: sample n = 10 5 samples and set conﬁdence level be 99 .

Original: 9% Cohen et al.
Revised: 9% Cohen et al.

Original: ; Yang et al.
Revised: ; Yang et al.

Original: (2020a)
Revised: (2020a)

Original: ; Zhai et al.
Revised: ; Zhai et al.

Original: ; Jeong & Shin (2020).
Revised: ; Jeong & Shin (2020).

Original: More details are available in Appendix F. Note that F could be either single model or any ensemble models with Ensemble-before-Smoothing strategy.
Revised: More details are available in Appendix F. Note that F could be either single model or any ensemble models with Ensemble-before-Smoothing strategy.

Original: B D ETAILED A NALYSIS AND P ROOFS IN S ECTION
Revised: B D ETAILED A NALYSIS AND P ROOFS IN S ECTION

Original: In this appendix, we ﬁrst show the omitted theoretical results in Section 2, which are the robustness conditions for Max-Margin Ensemble (MME) and the comparison between the robustness of ensemble model and single model.
Revised: In this appendix, we ﬁrst show the omitted theoretical results in Section 2, which are the robustness conditions for Max-Margin Ensemble (MME) and the comparison between the robustness of ensemble model and single model.

Original: We then present all proofs for these theoretical results.
Revised: We then present all proofs for these theoretical results.

Original: B. D ETAILED T HEORETICAL R ESULTS AND D ISCUSSION
Revised: B. D ETAILED T HEORETICAL R ESULTS AND D ISCUSSION

Original: Here we present the theoretical results omitted from Section 2 along with some discussions.
Revised: Here we present the theoretical results omitted from Section 2 along with some discussions.

Original: B.1. R OBUSTNESS C ONDITION OF MME
Revised: B.1. R OBUSTNESS C ONDITION OF MME

Original: For MME, we have the following robustness condition.
Revised: For MME, we have the following robustness condition.

Original: Theorem 3 (Gradient and Conﬁdence Margin Condition for MME Robustness) .
Revised: Theorem 3 (Gradient and Conﬁdence Margin Condition for MME Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] , and M MME as an MME deﬁned over base models { F 1 , F 2 } .
Revised: [ C ] , and M MME as an MME deﬁned over base models { F 1 , F 2 } .

Original: M MME ( x 0 ) =
Revised: M MME ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Both F 1 and F 2 are β -smooth.
Revised: Both F 1 and F 2 are β -smooth.

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: then M MME is r -robust at point x 0 .
Revised: then M MME is r -robust at point x 0 .

Original: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||
Revised: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||

Original: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either F i ( x ) =
Revised: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either F i ( x ) =

Original: y 0 or F (2) i ( x ) =
Revised: y 0 or F (2) i ( x ) =

Original: y 0 .
Revised: y 0 .

Original: If M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: Comparing with the robustness conditions of MME (Theorem 1), the conditions for MME have highly similar forms.
Revised: Comparing with the robustness conditions of MME (Theorem 1), the conditions for MME have highly similar forms.

Original: Thus, the discussion for ERI in main text (Equation (6)) still applies here, including the positive impact of diversiﬁed gradients and large conﬁdence margins towards MME ensemble robustness in both sufﬁcient and necessary conditions and the implication of small model-smoothness bound β .
Revised: Thus, the discussion for ERI in main text (Equation (6)) still applies here, including the positive impact of diversiﬁed gradients and large conﬁdence margins towards MME ensemble robustness in both sufﬁcient and necessary conditions and the implication of small model-smoothness bound β .

Original: A major distinction is that the condition for MME is limited to two base models.
Revised: A major distinction is that the condition for MME is limited to two base models.

Original: This is because the “maximum” operator in MME protocol poses difﬁculties for expressing the robust conditions in succinct continuous functions of base models’ conﬁdence.
Revised: This is because the “maximum” operator in MME protocol poses difﬁculties for expressing the robust conditions in succinct continuous functions of base models’ conﬁdence.

Original: Therefore, Taylor expansion cannot be applied.
Revised: Therefore, Taylor expansion cannot be applied.

Original: We leave the extension to N > 2 base models as future work, and we conjecture the tendency would be similar as Equation (5).
Revised: We leave the extension to N > 2 base models as future work, and we conjecture the tendency would be similar as Equation (5).

Original: The theorem is proved in Appendix B.2.
Revised: The theorem is proved in Appendix B.2.

Original: B.1. C OMPARISON BETWEEN E NSEMBLE R OBUSTNESS AND S INGLE -M ODEL R OBUSTNESS
Revised: B.1. C OMPARISON BETWEEN E NSEMBLE R OBUSTNESS AND S INGLE -M ODEL R OBUSTNESS

Original: To compare the robustness of ensemble models and single models, we have the following corollary that is extended from Theorem 1 and Theorem3.
Revised: To compare the robustness of ensemble models and single models, we have the following corollary that is extended from Theorem 1 and Theorem

Revised: [Equation]

Original: Corollary 1 (Comparison of Ensemble and Single-Model Robustness) .
Revised: Corollary 1 (Comparison of Ensemble and Single-Model Robustness) .

Original: Given an input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given an input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Suppose we have two β - smooth base models { F 1 , F 2 } , which are both r -robust at point x 0 .
Revised: Suppose we have two β -smooth base models { F 1 , F 2 } [Equation] which are both r -robust at point x 0 .

Original: For any ∆ ∈ [0 , 1) : • (Weighted Ensemble) Deﬁne
Revised: For any ∆ ∈ [0 , 1) : • (Weighted Ensemble) Deﬁne

Original: Weighted Ensemble M WE with base models { F 1 , F 2 } .
Revised: Weighted Ensemble M WE with base models { F 1 , F 2 } .

Original: Suppose M WE ( x0 ) =
Revised: Suppose M WE [Equation] x

Original: y 0 .
Revised: [Equation]

Original: If for any label y
Revised: If for any label y

Original: i
Revised: i

Original: (cid:54)
Revised: [Equation]

Original: = y 0 , the base models’ smoothness [-β ≤ ∆ · min { f y 
-]
Revised: y 0 , the base models’ smoothness [-β ≤ ∆ · min { f y 
-][Equation]

Original: /y i( x 0 ) , f y 0 /y
Revised: x [Equation] [Equation]

Original: i x 0 ) } / ( c 2 r 2 ) , and the gradient cosine similarity cos
Revised: c 2 r 2 ) , and the gradient cosine similarity cos

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: x ) (cid:105) ≤ cos θ , then the M WE with weights { w 1 , w 2 } is at least R -robust at point x 0 with
Revised: ≤ cos θ , then the M WE with weights { w 1 , w 2 } is at least R -robust at point x 0 with

Original: [Equation]
Revised: [Equation]

Revised: , where

Original: [Equation]
Revised: [Equation]

Original:  • (Max-Margin Ensemble) Deﬁne Max-Margin Ensemble M MME with the base models { F 1 , F 2 } .
Revised: [Equation] • (Max-Margin Ensemble) Deﬁne Max-Margin Ensemble M MME with the base models { F 1 , F 2 } .

Original: Suppose M MME ( x 
Revised: Suppose M MME ( x 0 ) =

Original: =

Original: y 0 .
Revised: y 0 .

Original: If for any label y 1 (cid:54) =
Revised: If for any label y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 , the base models’ smoothness β ≤ ∆  min 
Revised: y 0 , the base models’ smoothness β ≤ ∆ · min { f y 0 /y 1( x 0 ) , f y 0 /y 2( x 0 ) } /

Original: { f y

Original: /y

Original: ( x

Original: 0 ) , f y

Original: 0 /y (x 0 ) c 2 r 2 ) , and the gradient cosine similarity cos (cid:104)∇ x f y 0 /y 1( 
Revised: ( c 2 r 2 ) , and the gradient cosine similarity cos (cid:104)∇ x f y 0 /y 1( x 0 ) , ∇ x f y 0 /y 2( x 0 ) (cid:105) ≤ cos θ , then the M MME is at least R -robust at point xwith

Original: [Equation]
Revised: [Equation]

Original: 0 ) , ∇ x f [Equation] [Equation] x 0 )
Revised: where

Original: [Equation]
Revised: [Equation]

Original: ≤ cos θ , then the M MME is at least R -robust at point xwith

Original: [Equation]
Revised: [Equation]

Original: The proof is given in Appendix B.3.
Revised: The proof is given in Appendix B.3.

Original: Optimizing Weighted Ensemble.
Revised: Optimizing Weighted Ensemble.

Original: As we can observe from Corollary 1, we can adjust the weights { w 1 , w 2 } for Weighted Ensemble to change C WE and the certiﬁed robust radius (Equation (13)).
Revised: As we can observe from Corollary 1, we can adjust the weights { w 1 , w 2 } for Weighted Ensemble to change C WE and the certiﬁed robust radius (Equation (14)).

Original: Then comes the problem of which set of weights can achieve the highest certiﬁed robust radius.
Revised: Then comes the problem of which set of weights can achieve the highest certiﬁed robust radius.

Original: Since larger C WE results in higher radius, we need to choose
Revised: Since larger C WE results in higher radius, we need to choose

Original: [Equation]
Revised: [Equation]

Original: Since this quantity is scale-invariant, we can ﬁx w 1 and optimize over w 2 to get the optimal weights.
Revised: Since this quantity is scale-invariant, we can ﬁx w 1 and optimize over w 2 to get the optimal weights.

Original: In particular, if there are only two classes, we have a closed-form solution
Revised: In particular, if there are only two classes, we have a closed-form solution

Original: [Equation]
Revised: [Equation]

Original: and corresponding C WE achieves the maximum 1 / 2 .
Revised: and corresponding C WE achieves the maximum 1 / 2 .

Original: For a special case—average weighted ensemble, we get the corresponding certiﬁed robust radius by setting w 1 = w 2 and plug the yielded
Revised: For a special case—average weighted ensemble, we get the corresponding certiﬁed robust radius by setting w 1 = w 2 and plug the yielded

Original: [Equation]
Revised: [Equation]

Original: into Equation (13).
Revised: into Equation (14).

Original: Comparison between ensemble and single-model robustness.
Revised: Comparison between ensemble and single-model robustness.

Original: The similar forms of R in the corollary allow us to discuss the Weighted Ensemble and Max-Margin Ensemble together.
Revised: The similar forms of R in the corollary allow us to discuss the Weighted Ensemble and Max-Margin Ensemble together.

Original: Speciﬁcally, we let C be either C WE or C MME , then
Revised: Speciﬁcally, we let C be either C WE or C MME , then

Original: [Equation]
Revised: [Equation]

Original: Since when R > r , both ensembles have higher certiﬁed robustness than the base models, we solve this condition for cos θ :
Revised: Since when R > r , both ensembles have higher certiﬁed robustness than the base models, we solve this condition for cos θ :

Original: [Equation]
Revised: [Equation]

Original: Notice that C ∈ (0 , 1 / 2] .
Revised: Notice that C ∈ (0 , 1 / 2] .

Original: From this condition, we can easily observe that when the gradient cosine similarity is smaller, it is more likely that the ensemble has higher certiﬁed robustness than the base models.
Revised: From this condition, we can easily observe that when the gradient cosine similarity is smaller, it is more likely that the ensemble has higher certiﬁed robustness than the base models.

Original: When the model is smooth enough, according to the condition on β , we can notice that ∆ could be close to zero.
Revised: When the model is smooth enough, according to the condition on β , we can notice that ∆ could be close to zero.

Original: As a result, 1 − 4∆ C (1+∆) 2 is close to 1 .
Revised: As a result, 1 − 4∆ [Equation] 1+∆) 2 is close to 1 .

Original: Thus, unless the gradient of base models is (or close to) colinear, it always holds that the ensemble (either WE or MME) has higher certiﬁed robustness than the base models.
Revised: Thus, unless the gradient of base models is (or close to) colinear, it always holds that the ensemble (either WE or MME) has higher certiﬁed robustness than the base models.

Revised: Larger certiﬁed radius with larger number of base models N .

Revised: Following the same methodology, we can further observe that larger number of base models N can lead to larger certiﬁed radius as the following proposition shows.

Original: B.1. R OBUSTNESS C ONDITIONS FOR S MOOTHED E NSEMBLE M ODELS
Revised: Proposition B.1 (More Base Models Lead to Higher Certiﬁed Robustness of Weighted Ensemble) . At clean input x 0 ∈ R d with ground-truth label y 0 ∈ [ C ] , suppose all base models { f i } N + M i = are β -smooth. Suppose the Weighted Ensemble M 1 of base models { f i } Ni =1 and M 2 of base models { f i } N + M i = N +1 are both r -robust

Revised: according to the sufﬁcient condition in Theorem 1, and for any y i (cid:54)

Revised: =

Revised: ythe M 1 and M 2 ’s ensemble gradients ( (cid:80) Nj =1 w j ∇ x f y 0 /y

Original: {+i j ( x 0 ) and (cid:80) N + M j = N +1 w j ∇ x f y 
+}
Revised: {+i j ( x 0 ) and (cid:80) N + M j = N +1 w j ∇ x f y 
+}

Revised: /y

Revised: i j ( x 0 ) ) are non-zero and not colinear, then the Weighted Ensemble M of { f i } N + M i = is r (cid:48)

Revised: -robust for some r (cid:48)

Revised: > r .

Revised: Proof of Proposition B.1.

Revised: For any y i (cid:54) =

Revised: y 0 , since both M 1 and M 2 are r -robust

Revised: according to the sufﬁcient condition of Theorem 1, we have

Revised: [Equation]

Revised: [Equation]

Revised: Adding above two inequalties we get

Revised: [Equation]

Revised: Since gradients of ensemble are not colinear and non-zero, from the triangle inequality,

Revised: [Equation]

Revised: (19) and thus (cid:13)(cid:13)(cid:13)

Revised: N + M (cid:88)

Original: {+j = w j ∇ x f y 
+}
Revised: {+j = w j ∇ x f y 
+}

Revised: /y

Revised: i j ( x 0 ) (cid:13)(cid:13)(cid:13) 2 < 1 r

Revised: N + M (cid:88)

Original: {+j = f y 
+}
Revised: {+j = f y 
+}

Revised: /y

Revised: i j ( x 0 ) − βr

Revised: N + M (cid:88)

Revised: j = w j , (20) which means we can increase r to r (cid:48) and still keep the inequality hold with “ ≤ ”, and in turn certify a larger radius r (cid:48)

Revised: according to Theorem 1.

Revised: Since DRT imposes diversiﬁed gradients via GD Loss, the “not colinear” condition easily holds for

Revised: DRT ensemble, and therefore the proposition implies larger number of base models N lead to higher certiﬁed robustness of WE.

Revised: For MME, we empirically observe similar trends.

Revised: B.1. R OBUSTNESS C ONDITIONS FOR S MOOTHED E NSEMBLE M ODELS

Original: Following the discussion in Section 2.3, for smoothed WE and MME, with the model-smoothness bound (Theorem 2), we can concretize the general robustness conditions in this way.
Revised: Following the discussion in Section 2.3, for smoothed WE and MME, with the model-smoothness bound (Theorem 2), we can concretize the general robustness conditions in this way.

Original: We deﬁne the soft smoothed conﬁdence function ˜ g εf ( x ) :=
Revised: We deﬁne the soft smoothed conﬁdence function ¯ g εf ( x ) :=

Original: E ε f ( x + ε ) .
Revised: E ε f ( x + ε ) .

Original: This deﬁnition is also used in the literature (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020).
Revised: This deﬁnition is also used in the literature (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020).

Original: As a result, we revise the ensemble protocols of WE and MME by replacing the original conﬁdences { f i ( x 0 ) }
Revised: As a result, we revise the ensemble protocols of WE and MME by replacing the original conﬁdences { f i ( x 0 ) }

Original: Ni =1 with these soft smoothed conﬁdences { ˜ g εi ( x 0 ) }
Revised: Ni =1 with these soft smoothed conﬁdences { ¯ g εi ( x 0 ) }

Original: Ni =1 .
Revised: Ni =1 .

Original: These protocols then choose the predicted class by treating these { ˜ g εi ( x 0 ) } Ni =1 as the base models’ conﬁdence scores.
Revised: These protocols then choose the predicted class by treating these { ¯ g εi ( x 0 ) } Ni =1 as the base models’ conﬁdence scores.

Original: In the experiments, we did not actually evaluate these revised protocols since their robustness performance are expected to be similar as original ones (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020).
Revised: In the experiments, we did not actually evaluate these revised protocols since their robustness performance are expected to be similar as original ones (Salman et al., 2019; Zhai et al., 2019; Kumar et al., 2020).

Original: The derived results connect smoothed ensemble robustness with the conﬁdence scores.
Revised: The derived results connect smoothed ensemble robustness with the conﬁdence scores.

Original: Corollary 2 (Gradient and Conﬁdence Margin Conditions for Smoothed WE Robustness ( Second Way )) .
Revised: Corollary 2 (Gradient and Conﬁdence Margin Conditions for Smoothed WE Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.
Revised: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.

Original: Deﬁne soft smoothed conﬁdence ˜ g εi ( x ) :=
Revised: Deﬁne soft smoothed conﬁdence ¯ g ε i ( x ) :

Original:  E ε f i ( x + ε ) for each base model F i ( 1 ≤ i ≤ N ).
Revised: = E ε f i ( x + ε ) for each base model F i ( 1 ≤ i ≤ N ).

Original: The ˜ G ε M WE is a WE deﬁned over soft smoothed base models { ˜ g εi } Ni =1 with weights { w i } Ni =1 .
Revised: The ¯ G ε M WE is a WE deﬁned over soft smoothed base models { ¯ g εi } Ni =1 with weights { w i } Ni =1 .

Original: ˜
Revised: ¯

Original: G
Revised: [Equation]

Original: ε M WE ( x 0 ) =
Revised: ε M WE [Equation] =

Original: y 0 .
Revised: [Equation]

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: The ˜ G ε M WE is r -robust at point x 0 if for any y i (cid:54) =y 0 , [Equation]
Revised: The ¯ G ε M WE is r -robust at point x 0 if for any y i (cid:54) =

Original: N
Revised: y

Original: [Equation]
Revised: [Equation]

Original: • (Necessary Condition)
Revised: • (Necessary Condition)

Original: If ˜ G ε M WE is r -robust at point x 0 , for any y i (cid:54) =
Revised: If ¯ G ε M WE is r -robust at point x 0 , for any y i (cid:54) =

Original: y 
Revised: y 0 , (cid:13) (cid:13) (cid:13) N (cid:88)

Original: [Equation]
Revised: [Equation]

Original: Corollary 3 (Gradient and Conﬁdence Margin Condition for Smoothed MME Robustness ( Second Way )) .
Revised: Corollary 3 (Gradient and Conﬁdence Margin Condition for Smoothed MME Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.
Revised: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.

Original: Deﬁne soft smoothed conﬁdence ˜ g εi ( x ) :=
Revised: Deﬁne soft smoothed conﬁdence ¯ g εi ( x ) :=

Original: E ε f i ( x + ε ) for either base model For F 2 .
Revised: E ε f i ( x + ε ) for either base model F 1 or F 2 .

Original: The ˜ G ε M MME is a MME deﬁned over soft smoothed base models { ˜ g ε 1 , ˜ g ε 2 } .˜
Revised: The ¯ G ε M MME is a MME deﬁned over soft smoothed base models { ¯ g ε 1 , ¯ g ε 2 } .

Original:  G ε M MME ( x 0 ) =
Revised: ¯ G ε M MME ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: then ˜ G ε M MME is r -robust at point x 0 .
Revised: then ¯ G ε M MME is r -robust at point x 0 .

Original: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||
Revised: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||

Original: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either G F i ( x ) =
Revised: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either G F i ( x ) =

Original: y 0 or G (2) F i ( x ) =
Revised: y 0 or G (2) F i ( x ) =

Original: y 0 .
Revised: y 0 .

Original: If ˜ G ε M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If ¯ G ε M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y [Equation]

Original: [Equation]
Revised: [Equation]

Original: Remark.
Revised: Remark.

Original: The above two corollaries are extended from Theorem 1 and Theorem 3 respectively, and correspond to our discussion in Section 2.3.
Revised: The above two corollaries are extended from Theorem 1 and Theorem 3 respectively, and correspond to our discussion in Section 2.3.

Original: We defer the proofs to Appendix B.5.
Revised: We defer the proofs to Appendix B.5.

Original: From these two corollaries, we can explicit see that the Ensemble-before-Smoothing (see Deﬁnition 5) provides smoothed classiﬁers ˜ G ε M WE and ˜ G ε M MME with bounded model-smoothness; and we can see the correlation between the robustness conditions and gradient diversity/conﬁdence margin for smoothed ensembles.
Revised: From these two corollaries, we can explicit see that the Ensemble-before-Smoothing (see Deﬁnition 5) provides smoothed classiﬁers ¯ G ε M WE and ¯ G ε M MME with bounded model-smoothness; and we can see the correlation between the robustness conditions and gradient diversity/conﬁdence margin for smoothed ensembles.

Original: B. P ROOFS OF R OBUSTNESS C ONDITIONS FOR G ENERAL E NSEMBLE M ODELS
Revised: B. P ROOFS OF R OBUSTNESS C ONDITIONS FOR G ENERAL E NSEMBLE M ODELS

Original: This subsection contains the proofs of robustness conditions.
Revised: This subsection contains the proofs of robustness conditions.

Original: First, we connect the prediction of ensemble models with the arithmetic relations of conﬁdence scores of base models.
Revised: First, we connect the prediction of ensemble models with the arithmetic relations of conﬁdence scores of base models.

Original: This connection is straightforward to establish for Weighted Ensemble (shown in Proposition B.1), but nontrivial for
Revised: This connection is straightforward to establish for Weighted Ensemble (shown in Proposition B.2), but nontrivial for

Original: Max-Margin Ensemble (shown in Theorem 4).
Revised: Max-Margin Ensemble (shown in Theorem 4).

Original: Then, we prove the desired robustness conditions using Taylor expansion with Lagrange reminder.
Revised: Then, we prove the desired robustness conditions using Taylor expansion with Lagrange reminder.

Original: Proposition B.1 (Robustness Condition for WE) .
Revised: Proposition B.2 (Robustness Condition for WE) .

Original: Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Consider an input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] , and an ensemble model M WE constructed by base models { F i } Ni =1 with weights { w i } Ni =1 .
Revised: [ C ] , and an ensemble model M WE constructed by base models { F i } Ni =1 with weights { w i } Ni =1 .

Original: Suppose M WE ( x 0 ) =
Revised: Suppose M WE ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Then, the ensemble M WE is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ 
Revised: Then, the ensemble M WE is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) [Equation]

Original: [Equation]
Revised: [Equation]

Original: Proof of Proposition B.1.
Revised: Proof of Proposition B.2.

Original: According the the deﬁnition of r -robust, we know M WE is r -robust
Revised: According the the deﬁnition of r -robust, we know M WE is r -robust

Original: if and only if for any point x := x 0 + δ where (cid:107) δ (cid:107) 2 ≤ r , M WE ( x 0 + δ ) =
Revised: if and only if for any point x := x 0 + δ where (cid:107) δ (cid:107) 2 ≤ r , M WE ( x 0 + δ ) =

Original: y 0 , which means that for any other label
Revised: y 0 , which means that for any other label

Original: y i (cid:54) =
Revised: y i (cid:54) =

Original: y 0 , the conﬁdence score for label y 0 is larger or equal than the conﬁdence score for label y
Revised: y 0 , the conﬁdence score for label y 0 is larger or equal than the conﬁdence score for label y

Original: i .
Revised: i .

Original: It means that
Revised: It means that

Original: [Equation]
Revised: [Equation]

Original: for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } .
Revised: for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } .

Original: Since this should hold for any y i (cid:54) =
Revised: Since this should hold for any y i (cid:54) =

Original: y 0 , we have the sufﬁcient and necessary condition
Revised: y 0 , we have the sufﬁcient and necessary condition

Original: [Equation]
Revised: [Equation]

Original: Theorem 4 (Robustness Condition for MME) .
Revised: Theorem 4 (Robustness Condition for MME) .

Original: Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Consider an input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let M MME be an MME deﬁned over base models { F i } Ni =1 .
Revised: Let M MME be an MME deﬁned over base models { F i } Ni =1 .

Original: Suppose: (1) M MME ( x 0 ) =
Revised: Suppose: (1) M MME ( x 0 ) =

Original: y 0 ; (2) for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } , given any base model i ∈
Revised: y 0 ; (2) for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } , given any base model i ∈

Original: [ N ] , either F i ( x ) =
Revised: [ N ] , either F i ( x ) =

Original: yor F (2) i ( x ) = y 0 .
Revised: yor F (2) i ( x ) = y 0 .

Original: Then, the ensemble M MME is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } ,
Revised: Then, the ensemble M MME is r -robust at point x 0 if and only if for any x ∈ { x 0 + δ : (cid:107) δ (cid:107) 2 ≤ r } ,

Original: [Equation]
Revised: [Equation]

Original: The theorem states the sufﬁcient and necessary robustness condition for MME.
Revised: The theorem states the sufﬁcient and necessary robustness condition for MME.

Original: We divide the two directions into the following two lemmas and prove them separately.
Revised: We divide the two directions into the following two lemmas and prove them separately.

Original: We mainly use the alternative form of Equation (20) as such in the following lemmas and their proofs:
Revised: We mainly use the alternative form of Equation (26) as such in the following lemmas and their proofs:

Original: [Equation]
Revised: [Equation]

Original: Lemma B.1 (Sufﬁcient Condition for MME) .
Revised: Lemma B.1 (Sufﬁcient Condition for MME) .

Original: Let M MME be an MME deﬁned over base models { F i } Ni =1 .
Revised: Let M MME be an MME deﬁned over base models { F i } Ni =1 .

Original: For any input x 0 ∈ R d , the Max-Margin Ensemble M MME predicts M MME {+( x 0 ) = y 
 if+}
Revised: For any input x 0 ∈ R d , the Max-Margin Ensemble M MME predicts M MME {+( x 0 ) = y 
 if+}

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma B.1.
Revised: Proof of Lemma B.1.

Original: For brevity, for i ∈ [ N ] , we denote y i :
Revised: For brevity, for i ∈ [ N ] , we denote y i :

Original: =
Revised: =

Original: F i ( x 0 ) , y (cid:48) i := F (2) i ( x 0 ) for each base model’s top class and runner-up class at point x 0 .
Revised: F i ( x 0 ) , y (cid:48) i := F (2) i ( x 0 ) for each base model’s top class and runner-up class at point x 0 .

Original: Suppose M MME ( x 0 ) (cid:54) =
Revised: Suppose M MME ( x 0 ) (cid:54) =

Original: y 0 , then according to ensemble deﬁnition (see Deﬁnition 3), there exists c ∈
Revised: y 0 , then according to ensemble deﬁnition (see Deﬁnition 3), there exists c ∈

Original: [ N ] , such that M MME ( x 0 )
Revised: [ N ] , such that M MME ( x 0 )

Original: =
Revised: =

Original: F c ( x 0 ) =
Revised: F c ( x 0 ) =

Original: y c , and∀ i ∈ [ N
Revised: y c , and

Original: [Equation]
Revised: [Equation]

Original: Because y c (cid:54) =
Revised: Because y c (cid:54) =

Original: y 0 , we have f c ( x 0 ) y 0 ≤ f c ( x 0 ) y (cid:48) c , so that f c ( x 0 ) y c /y 0 ≥ f c ( x 0 ) y c /y (cid:48) c .
Revised: y 0 , we have f c ( x 0 ) y 0 ≤ f c ( x 0 ) y (cid:48) c , so that f c ( x 0 ) y c /y 0 ≥ f c ( x 0 ) y c /y (cid:48) c .

Original: Now consider any model F i where i ∈ [ N ] , we would like to show that there exists y ∗ (cid:54)
Revised: Now consider any model F i where i ∈ [ N ] , we would like to show that there exists y ∗ (cid:54)

Original: =
Revised: =

Original: y 0 , such that f i ( x 0 )
Revised: y 0 , such that f i ( x 0 )

Original: y i /y (cid:48)
Revised: y i /y (cid:48)

Original: i ≥ f i ( x 0 )
Revised: i ≥ f i ( x 0 )

Original: y 0 /y ∗ :
Revised: y 0 /y ∗ :

Original: • If y i =
Revised: • If y i =

Original: y 0 , let y ∗ :
Revised: y 0 , let y ∗ :

Original: = y (cid:48)
Revised: = y (cid:48)

Original: i , trivially f i ( x 0 )
Revised: i , trivially f i ( x 0 )

Original: y i /y (cid:48)
Revised: y i /y (cid:48)

Original: i =
Revised: i =

Original: f i ( x 0 )
Revised: f i ( x 0 )

Original: y 0 /y ∗ ;
Revised: y 0 /y ∗ ;

Original: • If y i (cid:54) = y 0 , and y (cid:48)
Revised: • If y i (cid:54) = y 0 , and y (cid:48)

Original: i (cid:54) =
Revised: i (cid:54) =

Original: y 0 , we let y ∗ :
Revised: y 0 , we let y ∗ :

Original: = y (cid:48)
Revised: = y (cid:48)

Original: i , then f i ( x 0 )
Revised: i , then f i ( x 0 )

Original: y i /y (cid:48)
Revised: y i /y (cid:48)

Original: i =
Revised: i =

Original: f i ( x 0 )
Revised: f i ( x 0 )

Original: y i /y
Revised: y i /y

Original: ∗ ≥ f i ( x 0 )
Revised: ∗ ≥ f i ( x 0 )

Original: y 0 /y ∗ ;
Revised: y 0 /y ∗ ;

Original: • If y i (cid:54) = y 0 , but y (cid:48)
Revised: • If y i (cid:54) = y 0 , but y (cid:48)

Original: i =
Revised: i =

Original: y 0 , we let y ∗ :
Revised: y 0 , we let y ∗ :

Original: = y i , then f i ( x 0 )
Revised: = y i , then f i ( x 0 )

Original: y i /y (cid:48)
Revised: y i /y (cid:48)

Original: i =
Revised: i =

Original: f i ( x 0 )
Revised: f i ( x 0 )

Original: y
Revised: y

Original: i /y 0 ≥ f i ( x 0 )
Revised: i /y 0 ≥ f i ( x 0 )

Original: y 

Revised: y

Original: /y i =
Revised: /y i =

Original: f i ( x 0 )
Revised: f i ( x 0 )

Original: y 0 /y ∗ .
Revised: y 0 /y ∗ .

Original: Combine the above ﬁndings with Equation 21, we have:
Revised: Combine the above ﬁndings with Equation 27, we have:

Original: [Equation]
Revised: [Equation]

Original: Therefore, its negation∃ i ∈ [ N ] , i (cid:54) =
Revised: Therefore, its negation

Original: c, ∀ y ∗ c ∈ [ C ] and y ∗ c (cid:54) =
Revised: [Equation] y ∗ c ∈ [ C ] and y ∗ c (cid:54) =

Original: y 0 , ∀ y ∗ i ∈
Revised: y 0 , ∀ y ∗ i ∈

Original: [ C ] and y ∗ 
Revised: [ C ] and y ∗ i (cid:54) [Equation]

Original: i
Revised: y

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: implies M ( x 0 ) =
Revised: implies M ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Since Equation (22) holds for any y ∗ c and y ∗ i , the equation is equivalent to ∃ i ∈ [ N ] , i (cid:54)
Revised: Since Equation (28) holds for any y ∗ c and y ∗ i , the equation is equivalent to ∃ i ∈ [ N ] , i (cid:54)

Original: =
Revised: =

Original: c,
Revised: c,

Original: [Equation]
Revised: [Equation]

Original: The existence qualiﬁer over i can be replaced by maximum:
Revised: The existence qualiﬁer over i can be replaced by maximum:

Original: [Equation]
Revised: [Equation]

Original: It is implied by
Revised: It is implied by

Original: [Equation]
Revised: [Equation]

Original: Thus, Equation (20) is a sufﬁcient condition for M MME ( x 0 ) =
Revised: Thus, Equation (26) is a sufﬁcient condition for M MME ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Lemma B.2 (Necessary Condition for MME) .
Revised: Lemma B.2 (Necessary Condition for MME) .

Original: For any input x 0 ∈ R d , if for any base model i ∈
Revised: For any input x 0 ∈ R d , if for any base model i ∈

Original: [ N ] , either F i ( x 0 ) =
Revised: [ N ] , either F i ( x 0 ) =

Original: y 0 or F (2) i ( x 0 ) =
Revised: y 0 or F (2) i ( x 0 ) =

Original: y 0 , then Max-Margin Ensemble M MME predicting
Revised: y 0 , then Max-Margin Ensemble M MME predicting

Original: M MME ( x 0 ) =
Revised: M MME ( x 0 ) =

Original: y 0 implies
Revised: y 0 implies

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma B.2.
Revised: Proof of Lemma B.2.

Original: Similar as before, for brevity, for i ∈ [ N ] , we denote y i :
Revised: Similar as before, for brevity, for i ∈ [ N ] , we denote y i :

Original: = F i ( x 0 ) , y (cid:48) i :=
Revised: = F i ( x 0 ) , y (cid:48) i :=

Original: F (2) i ( x 0 ) for each base model’s top class and runner-up class at point x 0 .
Revised: F (2) i ( x 0 ) for each base model’s top class and runner-up class at point x 0 .

Original: Suppose Equation (20) is not satisﬁed, it means that ∃ c ∈ [ N ] , ∃ y ∗ c ∈
Revised: Suppose Equation (26) is not satisﬁed, it means that ∃ c ∈ [ N ] , ∃ y ∗ c ∈

Original: [ C ] and y ∗ c (cid:54) =
Revised: [ C ] and y ∗ c (cid:54) =

Original: y 0 , ∀ i ∈
Revised: y 0 , ∀ i ∈

Original: [ N ] , ∃ y ∗ i ∈
Revised: [ N ] , ∃ y ∗ i ∈

Original: [ C ] and y ∗ i (cid:54) =
Revised: [ C ] and y ∗ i (cid:54) =

Original: y 0 , f y ∗ c /y 

Revised: y 0 , f y ∗ c /y

Original: c 
Revised: c ( x 0 ) > f y 0 /y ∗ i

Original: [Equation]
Revised: i ( x 0 ) .

Original: • If y c = y 0 , then f y ∗ c /y 

Revised: • If y c = y 0 , then f y ∗ c /y

Original: c ( x 0 ) ≤ 0 , which implies that f y 0 /y ∗ i
Revised: c ( x 0 ) ≤ 0 , which implies that f y 0 /y ∗ i

Original: i ( x 0 ) < 0 , and hence F i ( x 0 ) (cid:54) =
Revised: i ( x 0 ) < 0 , and hence F i ( x 0 ) (cid:54) =

Original: y 0 .
Revised: y 0 .

Original: Moreover, we know that f y i /y (cid:48)
Revised: Moreover, we know that f y i /y (cid:48)

Original: i i
Revised: i i

Revised: x

Original: [Equation]
Revised: [Equation]

Original: =
Revised: y i / [Equation] [Equation]

Original:  f y c /y (cid:48)
Revised: [Equation] ( x 0 ) = f y c /y [Equation]

Original: cc ( x 0 )
Revised: c ( x 0 )

Original: so M ( x 0 ) (cid:54) =
Revised: so M ( x [Equation]

Original:  F c ( x 0 ) =
Revised: = F [Equation] ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: • If y c (cid:54) =
Revised: • If y c (cid:54) =

Original: y 0 , i.e., y (cid:48)
Revised: y 0 , i e., y (cid:48)

Original: c
Revised: c

Original: = y 0 , then f y c /y 

Revised: = y 0 , then f y c /y

Original: c ( x 0 ) ≥ f y ∗ c /y 

Revised: c ( x 0 ) ≥ f y ∗ c /y

Original: c ( x 0 ) >
Revised: c ( x 0 ) >

Original: f y 0 /y ∗1 i ( x 0 ) .
Revised: f y 0 /y ∗ i ( x 0 ) .

Original: If F i ( x 0 ) = y 0 , then f y 0 /y
Revised: If F i ( x 0 ) = y 0 , then f y 0 /y

Original: ∗
Revised: ∗

Original: i
Revised: i

Original: i ( x 0 ) ≥
Revised: i ( x 0 ) ≥

Original: f y 0 /y (cid:48)
Revised: f y 0 /y (cid:48)

Original: i i ( x 0 ) =
Revised: i i ( x 0 ) =

Original: f y i /y (cid:48)
Revised: f y i /y (cid:48)

Original: i i ( x 0 ) .
Revised: i i ( x 0 ) .

Original: Thus, f y c /y (cid:48)
Revised: Thus, f y c /y (cid:48)

Original: c c ( x 0 ) =
Revised: c c ( x 0 ) =

Original: f y c /y 

Revised: f y c /y

Original: c ( x 0 ) >
Revised: c ( x 0 ) >

Original: f y i /y (cid:48)
Revised: f y i /y (cid:48)

Original: i i ( x 0 ) .
Revised: i i ( x 0 ) .

Original: As the result, M ( x 0 )
Revised: As the result, M ( x 0 )

Original: =
Revised: =

Original: F c ( x 0 ) (cid:54) =
Revised: F c ( x 0 ) (cid:54) =

Original: y 0 .
Revised: y 0 .

Original: For both cases, we show that M MME ( x 0 ) (cid:54) =
Revised: For both cases, we show that M MME ( x 0 ) (cid:54) =

Original: y 0 , i.e., Equation (20) is a necessary condition for
Revised: y 0 , i.e., Equation (26) is a necessary condition for

Original: M ( x 0 ) =
Revised: M ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Proof of Theorem 4.
Revised: Proof of Theorem 4.

Original: Lemmas B.1 and B.2 are exactly the two directions (necessary and sufﬁcient condition) of M MME predicting label y 

Revised: Lemmas B.1 and B.2 are exactly the two directions (necessary and sufﬁcient condition) of M MME predicting label y

Original: at point x .
Revised: at point x .

Original: Therefore, if the condition (Equation (20)) holds for any x ∈ { x 

Revised: Therefore, if the condition (Equation (26)) holds for any x ∈ { x

Original: + δ : (cid:107) δ (cid:107) 2 ≤ r } , the ensemble M MME is r -robust at point x 0 ; vice versa.
Revised: + δ : (cid:107) δ (cid:107) 2 ≤ r } , the ensemble M MME is r -robust at point x 0 ; vice versa.

Original: For comparison, here we list the trivial robustness condition for single model.
Revised: For comparison, here we list the trivial robustness condition for single model.

Original: Fact B.1 (Robustness Condition for Single Model) .
Revised: Fact B.1 (Robustness Condition for Single Model) .

Original: Consider an input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Consider an input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Suppose a model F satisﬁes F ( x 0 ) =
Revised: Suppose a model F satisﬁes F ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Then, the model F is r -robust at point xif and only if for any x ∈ { x 

Revised: Then, the model F is r -robust at point xif and only if for any x ∈ { x

Original: + δ : (cid:107) δ (cid:107) 
Revised: + δ : (cid:107) δ (cid:107) 2 ≤ r } ,

Original: [Equation]
Revised: [Equation]

Original: The fact is apparent given that the model predicts the class with the highest conﬁdence.
Revised: The fact is apparent given that the model predicts the class with the highest conﬁdence.

Original: Now we are ready to apply Taylor expansion to derive the robustness conditions shown in main text.
Revised: Now we are ready to apply Taylor expansion to derive the robustness conditions shown in main text.

Original: Theorem 1 (Gradient and Conﬁdence Margin Condition for WE Robustness) .
Revised: Theorem 1 (Gradient and Conﬁdence Margin Condition for WE Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] , and M WE as a WE deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .
Revised: [ C ] , and M WE as a WE deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .

Original: M WE ( x 0 ) =
Revised: M WE ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: All base model F i ’s are β -smooth.
Revised: All base model F i ’s are β -smooth.

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: M WE is r -robust at point x 0 if for anyy i (cid:54) =
Revised: M WE is r -robust at point x 0 if for any

Original: y 
Revised: y i

Original: [Equation]
Revised: [Equation]

Revised: [Equation]

Original: • (Necessary Condition)
Revised: • (Necessary Condition)

Original: If M WE is r -robust at point x 0 , then for any y i (cid:54) =
Revised: If M WE is r -robust at point x 0 , then for any y i (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: Proof of Theorem 1.
Revised: Proof of Theorem 1.

Original: From Taylor expansion with Lagrange remainder and the β -smoothness assumption on the base models, we have
Revised: From Taylor expansion with Lagrange remainder and the β -smoothness assumption on the base models [Equation] we have

Original: [Equation]
Revised: [Equation]

Original: where the term − 1 2 r 2 (cid:80) Nj =1 (2 βw j ) and 1 2 r 2 (cid:80) Nj =1 (2 βw j ) are bounded from Lagrange remainder.
Revised: where the term − 1 2 r 2 (cid:80) Nj =1 (2 βw j ) and 1 2 r 2 (cid:80) Nj =1 (2 βw j ) are bounded from Lagrange remainder.

Original: Note that the difference f y 0 /y
Revised: Note that the difference f y 0 /y

Original: i j is (2 β ) -smooth instead of β -smooth since it is the difference of two β -smooth function, and
Revised: i j is (2 β ) -smooth instead of β -smooth since it is the difference of two β -smooth function, and

Original: thus (cid:80) Nj =1 w j f y 

Revised: thus (cid:80) Nj =1 w j f y

Original: /y
Revised: /y

Original: i j is (cid:80) Nj =

Revised: i j is (cid:80) Nj =

Original: (2 βw j ) -smooth.
Revised: (2 βw j ) -smooth.

Original: From Proposition B.1, the sufﬁcient and necessary condition of WE’s r -robustness is (cid:80) Nj =
Revised: From Proposition B.2, the sufﬁcient and necessary condition of WE’s r -robustness is (cid:80) Nj =

Original: 1 w j f y
Revised: 1 w j f y

Original: /y
Revised: /y

Original: i j ( x ) ≥ 0 for any y i ∈
Revised: i j ( x ) ≥ 0 for any y i ∈

Original: [ C ] such that y i (cid:54) =
Revised: [ C ] such that y i (cid:54) =

Original: y 0 , and any x = x 0 + δ where (cid:107) δ (cid:107) 2 ≤ r .
Revised: y 0 , and any x = x 0 + δ where (cid:107) δ (cid:107) 2 ≤ r .

Original: Plugging this term into Equation (23) we get the theorem.
Revised: Plugging this term into Equation (29) we get the theorem.

Original: Theorem 3 (Gradient and Conﬁdence Margin Condition for MME Robustness) .
Revised: Theorem 3 (Gradient and Conﬁdence Margin Condition for MME Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] , and M MME as an MME deﬁned over base models { F 1 , F 2 } .
Revised: [ C ] , and M MME as an MME deﬁned over base models { F 1 , F 2 } .

Original: M MME ( x 0 ) =
Revised: M MME ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: Both F 1 and F 2 are β -smooth.
Revised: Both F 1 and F 2 are β -smooth.

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) 
Revised: y 0 and y 2 (cid:54) =

Revised: y 0 , (cid:107)∇

Original: [Equation]
Revised: [Equation]

Revised: 0 /y

Original: [Equation]
Revised: [Equation]

Original: then M MME is r -robust at point x 0 .
Revised: then M MME is r -robust at point x 0 .

Original: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||
Revised: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||

Original: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either F i ( x ) =
Revised: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either F i ( x ) =

Original: y 0 or F (2) i ( x ) =
Revised: y 0 or F (2) i ( x ) =

Original: y 0 .
Revised: y 0 .

Original: If M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: Proof of Theorem 3.
Revised: Proof of Theorem 3.

Original: We prove the sufﬁcient condition and necessary condition separately.
Revised: We prove the sufﬁcient condition and necessary condition separately.

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: From Lemma B.1, since there are only two base models, we can simplify the sufﬁcient condition for M MME ( x ) =
Revised: From Lemma B.1, since there are only two base models, we can simplify the sufﬁcient condition for M MME ( x ) =

Original: y 

Revised: y

Original: as
Revised: as

Original: [Equation]
Revised: [Equation]

Original: In other words, for any y 1 (cid:54) =
Revised: In other words, for any y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: With Taylor expansion and model-smoothness assumption, we have
Revised: With Taylor expansion and model-smoothness assumption, we have

Original: [Equation]
Revised: [Equation]

Original: Plugging this into Equation (24) yields the sufﬁcient condition.
Revised: Plugging this into Equation (30) yields the sufﬁcient condition.

Original: In the above equation, the term − 12 ·4 βr 2 is bounded from Lagrange remainder. 
Revised: In the above equation, the term − 12 · βr 2 is bounded from Lagrange remainder. Here,

Original: Here, the 4 β term comes from the fact that f y 0 /y 1( x ) + f y 0 /y 2({+
 [Equation]+} x ) is (4 β ) -smooth since it is the sum of difference of β -smooth function.
Revised: the 4 β term comes from the fact that f y 0 /y {+
 [Equation]+} x ) is (4 β ) -smooth since it is the sum of difference of β -smooth function

Original: • (Necessary Condition)
Revised: • (Necessary Condition)

Original: From Lemma B.2, similarly, the necessary condition for M MME ( x ) =
Revised: From Lemma B.2, similarly, the necessary condition for M MME ( x ) =

Original: y 0 is simpliﬁed to: for any y 1 (cid:54)
Revised: y 0 is simpliﬁed to: for any y 1 (cid:54)

Original: =
Revised: =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: Again, from Taylor expansion, we have
Revised: Again, from Taylor expansion, we have

Original: [Equation]
Revised: [Equation]

Original: Plugging this into Equation (24) yields the necessary condition.
Revised: Plugging this into Equation (30) yields the necessary condition.

Original: In the above equation, the term + 12 · 4 βr 2 is bounded from Lagrange remainder.
Revised: In the above equation, the term + 12 · 4 βr 2 is bounded from Lagrange remainder.

Original: The 4 β term appears because of the same reason as before.
Revised: The 4 β term appears because of the same reason as before.

Original: Since we will compare the robustness of ensemble models and the single model, we show the corresponding conditions for single-model robustness.
Revised: Since we will compare the robustness of ensemble models and the single model, we show the corresponding conditions for single-model robustness.

Original: Proposition B.2 (Gradient and Conﬁdence Margin Conditions for Single-Model Robustness) .
Revised: Proposition B.3 (Gradient and Conﬁdence Margin Conditions for Single-Model Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Model F ( x 0 ) =
Revised: Model F ( x 0 ) =

Original: y 0 , and it is β -smooth.
Revised: y 0 , and it is β -smooth.

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: If for any y 1 ∈ [ C ] such that y 1 (cid:54) =
Revised: If for any y 1 ∈ [ C ] such that y 1 (cid:54) =

Original: y 
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: F is r -robust at point x 0 .
Revised: F is r -robust at point x 0 .

Original: • (Necessary Condition)
Revised: • (Necessary Condition)

Original: If F is r -robust at point x 0 , for any y 1 ∈ [ C ] such that y 1 (cid:54) =
Revised: If F is r -robust at point x 0 , for any y 1 ∈ [ C ] such that y 1 (cid:54) =

Original: y0 , [Equation]
Revised: y

Original: [Equation]
Revised: [Equation]

Original: Proof of Proposition B.2.
Revised: Proof of Proposition B.3.

Original: This proposition is apparent given the following inequality from Taylor expansion
Revised: This proposition is apparent given the following inequality from Taylor expansion

Original: [Equation]
Revised: [Equation]

Original: and the sufﬁcient and necessary robust condition in Fact B.1.
Revised: and the sufﬁcient and necessary robust condition in Fact B.

Revised: [Equation]

Original: B. P ROOF OF R OBUSTNESS C OMPARISON R ESULTS BETWEEN E NSEMBLE M ODELS AND S INGLE M ODELS
Revised: B. P ROOF OF R OBUSTNESS C OMPARISON R ESULTS BETWEEN E NSEMBLE M ODELS AND S INGLE M ODELS

Original: Corollary 1 (Comparison of Ensemble and Single-Model Robustness) .
Revised: Corollary 1 (Comparison of Ensemble and Single-Model Robustness) .

Original: Given an input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given an input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Suppose we have two β -smooth base models { F 1 , F 2 } , which are both r -robust at point x 0 .
Revised: Suppose we have two β -smooth base models { F 1 , F 2 } , which are both r -robust at point x 0 .

Original: For any ∆ ∈ [0 , 1) :
Revised: For any ∆ ∈ [0 , 1) :

Original: • (Weighted Ensemble) Deﬁne
Revised: • (Weighted Ensemble) Deﬁne

Original: Weighted Ensemble M WE with base models { F 1 , F 2 } .
Revised: Weighted Ensemble M WE with base models { F 1 , F 2 } .

Original: Suppose M WE ( x 0 ) =
Revised: Suppose M WE ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: If for any label y
Revised: If for any label y

Original: i (cid:54) =
Revised: i [Equation] =

Original: y 0 , the base models’ smoothness β ≤ ∆ · min[-{ f y 
-]
Revised: y 0 , the base models’ smoothness β ≤ ∆ [Equation] min[-{ f y 
-]

Original: /y
Revised: [Equation]

Original: i( x 0 ) , f y 0 /y
Revised: f [Equation] [Equation] [Equation]

Original: i( x 0 ) } / ( c 2 r 2 ) , and the gradient cosine similaritycos (cid:104)∇ x f y 0 /y
Revised: [Equation] [Equation] c 2 r 2 ) , and the gradient cosine similarity

Original: [-i( x 0 ) , ∇ x f y 
 /y-]
Revised: [-i( x 0 ) , ∇ x f y 
 /y-][Equation]

Original: i( x 0 ) (cid:105) ≤ cos θ , then the M WE with weights { w 1 , w 2 } is at least R -robust at point x 0 with
Revised: ≤ cos θ , then the M WE with weights { w 1 , w 2 } is at least R -robust at point x 0 with

Original: [Equation]
Revised: [Equation]

Original:  • (Max-Margin Ensemble) Deﬁne Max-Margin Ensemble M MME with the base models { F 1 , F 2 } .
Revised: where [Equation] [Equation] • (Max-Margin Ensemble) Deﬁne Max-Margin Ensemble M MME with the base models { F 1 , F 2 } .

Original: Suppose M MME ( x 0 ) =
Revised: Suppose M MME ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: If for any label y 1 (cid:54) =
Revised: If for any label y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 , the base models’ smoothness β ≤ ∆ · min { f y 0 /y 1( x 0 ) , f y 0 /y 2( x 0 ) } /{+
 [Equation]+}
Revised: y 0 , the base models’ smoothness β ≤ ∆ · min { f y 0 /y 1( x [Equation] , f y 0 /y {+
 [Equation]+}

Original:  ( c 2 r 2 ) , and the gradient cosine similarity cos
Revised: } / ( c 2 r 2 ) , and the gradient cosine similarity cos

Original: [Equation]
Revised: [Equation]

Original: f
Revised: x

Original: [Equation]
Revised: [Equation]

Revised: ( x 0 ) , ∇

Original: [Equation]
Revised: [Equation]

Revised: ( x 0 )

Original: [Equation]
Revised: [Equation]

Original: x 0 ) (cid:105) ≤ cos θ , then the M MME is at least R -robust at point xwith
Revised: ≤ cos θ , then the M MME is at least R -robust at point xwith

Original: [Equation]
Revised: [Equation]

Original:  where 
Revised: , where (15)

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Proof of Corollary 1.
Revised: Proof of Corollary 1.

Original: We ﬁrst prove the theorem for Weighted Ensemble.
Revised: We ﬁrst prove the theorem for Weighted Ensemble.

Original: For arbitrary y i (cid:54) =
Revised: For arbitrary y i (cid:54) =

Original: y 0 , we have
Revised: y 0 , we have

Original: [Equation]
Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Revised: [Table]

Revised: [Equation]

Original: [Table] 
Revised: [Table] [Equation] [Table] [Equation]

Revised: [Table]

Original: [Equation]
Revised: [Equation]

Original:  where ( i. ) follows from the necessary condition in Proposition B.2; ( ii. ) uses the condition on β ; and ( iii. ) replaces 2 w 1 w 2 f y[-
-]
Revised: [Table] [Equation] [Table] where ( i. ) follows from the necessary condition in Proposition B.3; ( ii. ) uses the condition on β ; and ( iii. ) replaces 2 w 1 w 2 f y[-
-]

Original: /y
Revised: /y

Original: i
Revised: i

Original: [Equation]
Revised: [Equation]

Revised: f

Original: [Equation]
Revised: [Equation]

Revised: /y

Revised: i( x

Revised: [Equation]

Original: 0 ) leveraging C WE .
Revised: ) leveraging C WE .

Original: Now, we deﬁne
Revised: Now, we deﬁne

Original: [Equation]
Revised: [Equation]

Original: All we need to do is to prove that M WE is robust within radius Kr .
Revised: All we need to do is to prove that M WE is robust within radius Kr .

Original: To do so, from Equation (4), we upper bound (cid:107) w 1 ∇ x f y 0 /y
Revised: To do so, from Equation (4), we upper bound (cid:107) w 1 ∇ x f y 0 /y

Original: i
Revised: i

Original: [Equation]
Revised: [Equation]

Revised: +

Original: [Equation]
Revised: [Equation]

Original: Notice that ∆ min { f y 0 /yi
Revised: Notice that ∆ min { f y 0 /y

Original: [Equation]

Original:  x [Equation] , f y 0 /yi
Revised: i( x 0 ) , f y 0 /y

Original: [Equation]

Original: [Equation] 2 from β [Equation] condition, so
Revised: i( x 0 ) } ≥ βc 2 r 2 from β ’s condition, so

Original: [Equation]
Revised: [Equation]

Original: From Equation (4), the theorem for Weighted Ensemble is proved.
Revised: From Equation (4), the theorem for Weighted Ensemble is proved.

Original: Now we prove the theorem for Max-Margin Ensemble.
Revised: Now we prove the theorem for Max-Margin Ensemble.

Original: Similarly, for any arbitrary y 1 , y 2 such that y 1 (cid:54) =
Revised: Similarly, for any arbitrary y 1 , y 2 such that y 1 (cid:54) =

Original: y 0 , y 2 (cid:54) =
Revised: y 0 , y 2 (cid:54) =

Original: y 0 , we have
Revised: y 0 , we have

Original: [Equation]
Revised: [Equation]

Original: Now we deﬁne
Revised: Now we deﬁne

Original: [Equation]
Revised: [Equation]

Original: Again, from β ’s condition we have ∆ min { f y 0 /y 1( x 0 ) , f y 0 /y 2( x [Equation] ≥ βc 2 r 2{+
+} and {+(cid:107)∇ x f y 0 /y 
+}
Revised: Again, from β ’s condition we have ∆ min { f y 0 /y 1( x 0 ) , f y 0 /y 2( x 0 ) } ≥ βc 2 r {+
+} and {+(cid:107)∇ x f y 0 /y 
+}

Original: [Equation]
Revised: [Equation]

Original: From Equation (11), the ensemble is ( K (cid:48) r ) -robust at point x 0 , i.e., the theorem for Max-Margin
Revised: From Equation (12), the ensemble is ( K (cid:48) r ) -robust at point x 0 , i.e., the theorem for Max-Margin

Original: Ensemble is proved.
Revised: Ensemble is proved.

Original: B. P ROOFS OF M ODEL -S MOOTHNESS B OUNDS FOR R ANDOMIZED S MOOTHING
Revised: B. P ROOFS OF M ODEL -S MOOTHNESS B OUNDS FOR R ANDOMIZED S MOOTHING

Original: Theorem 2 (Model-Smoothness Upper Bound for EBS) .
Revised: Theorem 2 (Model-Smoothness Upper Bound for ¯ g εf ) .

Original: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable. Then the  smoothed conﬁdence function  g ε M is (2 /σ 2 ) -smooth.
Revised: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable, then the soft smoothed conﬁdence function ¯ g εf is (2 /σ 2 ) -smooth.

Original: Proof of Theorem 2.
Revised: Proof of Theorem 2.

Original: Recall that  g ε M ( x ) j
Revised: Recall that ¯ g εf ( x ) j

Original: = E ε ∼N (0 ,σ 2 I d ) I [ M ( x + ε )= j] , where I [ M ( x  )=
Revised: = E ε ∼N (0 ,σ 2 I d ) f ( x + ε ) j , where f ( x + ε )

Original: j] is a function from R d to { 0 , 1 } .
Revised: j is a function from R d to { 0 , 1 } .

Original: Therefore, to prove that g ε M is (2 /σ 2 ) -smooth, we only need to show that for any function f : R d → [0 , 1] , the function ˜ f : = f ∗ N (0 , σ 2 I d ) is (2 /σ 2 ) -smooth.
Revised: Therefore, to prove that g ε M is (2 /σ 2 ) -smooth, we only need to show that for any function f : R d → [0 , 1] , the function ¯ f := f ∗ N (0 , σ 2 I d ) is (2 /σ 2 ) -smooth.

Original: According to (Salman et al., 2019, Lemma 1), we have
Revised: According to (Salman et al., 2019, Lemma 1), we have

Original: [Equation]
Revised: [Equation]

Original: To show ˜ f is (2 /σ 2 ) -smooth
Revised: To show ¯ f is (2 /σ 2 ) -smooth

Original: , we only need to show that ∇ ˜ f is (2 /σ 2 ) -Lipschitz.
Revised: , we only need to show that ∇ ¯ f is (2 /σ 2 ) -Lipschitz.

Original: Let H ˜ f ( x ) be the
Revised: Let H ¯ f ( x ) be the

Original: Hessian matrix of ˜ f .
Revised: Hessian matrix of ¯ f .

Original: Thus, we only need to show that for any unit vector u , | u T H ˜ f ( x ) u | ≤ 2 /σ 2 .
Revised: Thus, we only need to show that for any unit vector u , | u T H ¯ f ( x ) u | ≤ 2 /σ 2 .

Original: By the isotropy of H ˜ f ( x ) , it is sufﬁcient to consider u
Revised: By the isotropy of H ¯ f ( x ) , it is sufﬁcient to consider u

Original: = (1 , 0 , 0 , . .
Revised: = (1 , 0 , 0 , . .

Original: . , 0) T , where u T H ˜ f ( x ) u =
Revised: . , 0) T , where u T H ¯ f ( x ) u =

Original: H ˜ f ( x ) 11 .
Revised: H ¯ f ( x ) 11 .

Original: Now we only need to bound the absolute value of H ˜ f ( x ) 11 :
Revised: Now we only need to bound the absolute value of H ¯ f ( x ) 11 :

Original: [Equation]
Revised: [Equation]

Original: Let Γ( · ) be the Gamma function
Revised: Let Γ( · ) be the Gamma function

Original: [Equation]
Revised: [Equation]

Original: we note that (cid:90) ∞
Revised: we note that (cid:90) ∞

Original: [Equation]
Revised: [Equation]

Original: and thus
Revised: and thus

Original: [Equation]
Revised: [Equation]

Original: which concludes the proof.
Revised: which concludes the proof.

Original: Remark.
Revised: Remark.

Original: The model-smoothness upper bound Theorem 2 is not limited to the ensemble model with
Revised: The model-smoothness upper bound Theorem 2 is not limited to the ensemble model with

Original: Ensemble-before-Smoothing strategy.
Revised: Ensemble-before-Smoothing strategy.

Original: Indeed, for arbitrary classiﬁcation models, since the conﬁdence score is in range [0 , 1] , the theorem still holds.
Revised: Indeed, for arbitrary classiﬁcation models, since the conﬁdence score is in range [0 , 1] , the theorem still holds.

Original: If the conﬁdence score is bounded in [ a, b ] , simple scaling yields the model-smoothness upper bound β
Revised: If the conﬁdence score is bounded in [ a, b ] , simple scaling yields the model-smoothness upper bound β

Original: = 2( b − a ) σ 2 .
Revised: = 2( b − a ) σ 2 .

Original: Proposition 1 (Model-Smoothness Lower Bound for EBS) .
Revised: Proposition B.4 (Model-Smoothness Lower Bound for ¯ g εf ) .

Original: There exists a smoothed conﬁdence function  g ε M that is β -smooth if and only if β ≥
Revised: There exists a smoothed conﬁdence function ¯ g εf that is β -smooth if and only if β ≥

Original: [Equation]
Revised: [Equation]

Original: Proof of Proposition 1.
Revised: Proof of Proposition B.4.

Original: We prove by construction.
Revised: We prove by construction.

Original: Consider the single dimensional input space R , and an ensemble M of several same base models that predicts label y 

Revised: Consider the single dimensional input space R , and a model f that has conﬁdence

Original: if and only if input x ≥ 0 .
Revised: if and only if input x ≥ 0 .

Original: As a result, 
Revised: As a result, g

Original: [Equation]
Revised: [Equation]

Original: + ∞ − xexp (cid:18) − t2 σ(cid:19) d t. Thus,
Revised: x

Original: [Equation]
Revised: [Equation]

Original: and (cid:12)(cid:12)(cid:12) d g ε
Revised: Thus,

Original: [Equation]
Revised: [Equation]

Original:  ( x )[Equation] d 2  x  (cid:12)(cid:12)(cid:12)
Revised: (cid:18) − x2 σ(cid:19) and (cid:12)(cid:12)(cid:12) d g εf ( x ) 2 yd 2 x (cid:12)(cid:12)(cid:12) = 1 √ 2 πσ 2 · (cid:12)(cid:12)(cid:12) x σ (cid:12)(cid:12)(cid:12)

Original: [Equation]
Revised: [Equation]

Original: By symmetry, we study the function h ( x ) = x exp( − x 2 / 2) for x ≥ 0 .
Revised: By symmetry, we study the function h ( x ) = x exp( − x 2 / 2) for x ≥ 0 .

Original: We have h (cid:48)
Revised: We have h (cid:48)

Original: ( x ) = (1 − x ) exp( − x 2 / 2) .
Revised: ( x ) = (1 − x ) exp( − x 2 / 2) .

Original: Thus, h ( x ) obtains its maximum at x 0 = 1 : h ( x 0 ) =
Revised: Thus, h ( x ) obtains its maximum at x 0 = 1 : h ( x 0 ) =

Original: exp( − 1 / 2 ) , which implies that
Revised: exp( − 1 / 2 ) , which implies that

Original: [Equation]
Revised: [Equation]

Original: which implies β ≥ 1 √ 2 πeσ 2 for this ensemble M per smoothness deﬁnition (Deﬁnition 4).
Revised: which implies β ≥ 1 √ 2 πeσ 2 for this ¯ g εf per smoothness deﬁnition (Deﬁnition 4).

Original: B. P ROOFS OF R OBUSTNESS C ONDITIONS FOR S MOOTHED E NSEMBLE M ODELS
Revised: B. P ROOFS OF R OBUSTNESS C ONDITIONS FOR S MOOTHED E NSEMBLE M ODELS

Original: Corollary 2 (Gradient and Conﬁdence Margin Conditions for Smoothed WE Robustness ( Second Way )) .
Revised: Corollary 2 (Gradient and Conﬁdence Margin Conditions for Smoothed WE Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.
Revised: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.

Original: Deﬁne soft smoothed conﬁdence ˜ g εi ( x ) :=
Revised: Deﬁne soft smoothed conﬁdence ¯ g εi ( x ) :=

Original: E ε f i ( x + ε ) for each base model F i ( 1 ≤ i ≤ N ).
Revised: E ε f i ( x + ε ) for each base model F i ( 1 ≤ i ≤ N ).

Original: The ˜ G ε M WE is a WE deﬁned over soft smoothed base models { ˜ g εi } Ni =1 with weights { w i } Ni =1 .
Revised: The ¯ G ε M WE is a WE deﬁned over soft smoothed base models { ¯ g εi } Ni =1 with weights { w i } Ni =1 .

Original: ˜
Revised: ¯

Original: G ε M WE ( x 0 ) =
Revised: G ε M WE ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: The ˜ G ε M WE is r -robust at point x 0 if for any y i (cid:54) = 
Revised: The ¯ G ε M WE is r -robust at point x 0 if for any y i (cid:54) = y 0 ,

Original: y
Revised: [Equation] N (cid:88)

Original: [Equation]
Revised: [Equation]

Original: • (Necessary Condition)
Revised: • (Necessary Condition)

Original: If ˜ G ε M WE is r -robust at point x 0 , for any y i (cid:54) = y 
Revised: If ¯ G ε M WE is r -robust at point x 0 , for any y i (cid:54) = y 0 ,

Original: [Equation]
Revised: [Equation]

Original: (cid:13)(cid:13) (cid:13) N (cid:88)

Original: [Equation]

Original: [Equation]

Original: Proof of Corollary 2.
Revised: Proof of Corollary 2.

Original: Since ˜ G ε M WE is a WE deﬁned over { ˜ g εi } Ni =1 , we apply Theorem 1 directly for ˜ G ε M WE .
Revised: Since ¯ G ε M WE is a WE deﬁned over { ¯ g εi } Ni =1 , we apply Theorem 1 directly for ¯ G ε M WE .

Original: Notice that each ˜ g εi has model-smoothness bound β
Revised: Notice that each ¯ g εi has model-smoothness bound β

Original: = 

Revised: =

Original: /σ 2 from Theorem 2 and the corollary statement follows.
Revised: /σ 2 from Theorem 2 and the corollary statement follows.

Original: Corollary 3 (Gradient and Conﬁdence Margin Condition for Smoothed MME Robustness ( Second Way )) .
Revised: Corollary 3 (Gradient and Conﬁdence Margin Condition for Smoothed MME Robustness) .

Original: Given input x 0 ∈ R d with ground-truth label y 0 ∈
Revised: Given input x 0 ∈ R d with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.
Revised: Let ε ∼ N (0 , σ 2 I d ) be a Gaussian random variable.

Original: Deﬁne soft smoothed conﬁdence ˜ g εi ( x ) :=
Revised: Deﬁne soft smoothed conﬁdence ¯ g εi ( x ) :=

Original: E ε f i ( x + ε ) for either base model For F 2 .
Revised: E ε f i ( x + ε ) for either base model F 1 or F 2 .

Original: The ˜ G ε M MME is a MME deﬁned over soft smoothed base models { ˜ g ε 1 , ˜ g ε 2 } .˜
Revised: The ¯ G ε M MME is a MME deﬁned over soft smoothed base models { ¯ g ε 1 , ¯ g ε 2 } .

Original:  G ε M MME ( x 0 ) =
Revised: ¯ G ε M MME ( x 0 ) =

Original: y 0 .
Revised: y 0 .

Original: • (Sufﬁcient Condition)
Revised: • (Sufﬁcient Condition)

Original: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]

Original: [Equation]
Revised: [Equation]

Original: then ˜ G ε M MME is r -robust at point x 0 .
Revised: then ¯ G ε M MME is r -robust at point x 0 .

Original: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||
Revised: • (Necessary Condition) Suppose for any x ∈ { x 0 + δ : ||

Original: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either G F i ( x ) =
Revised: δ || 2 ≤ r } , for any i ∈ { 1 , 2 } , either G F i ( x ) =

Original: y 0 or G (2) F i ( x ) =
Revised: y 0 or G (2) F i ( x ) =

Original: y 0 .
Revised: y 0 .

Original: If ˜ G ε M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =
Revised: If ¯ G ε M MME is r -robust at point x 0 , then for any y 1 , y 2 ∈ [ C ] such that y 1 (cid:54) =

Original: y 0 and y 2 (cid:54) =
Revised: y 0 and y 2 (cid:54) =

Original: y 0 ,
Revised: y 0 ,

Original: [Equation]
Revised: [Equation]

Original: y 1 ( x 0 ) + ∇ x (˜ g ε 2 ) y 0 /y 2 ( x 0 ) (cid:107) 2 ≤ 1 r ((˜ g ε 1 ) y 0 /y 1 ( x 0 )

Original: + (˜ g ε 2 ) y 0 /y 2 ( x 0 ))

Original: + 4 r σ 2 .

Original: Proof of Corollary 3.
Revised: Proof of Corollary 3.

Original: Since ˜ G ε M MME is constructed over conﬁdences ˜ g ε 1 and ˜ g ε 2 , we can directly apply Theorem 1.
Revised: Since ¯ G ε M MME is constructed over conﬁdences ¯ g ε 1 and ¯ g ε 2 , we can directly apply Theorem 1.

Original: Again, with the model-smoothness bound β = 2 /σ 2 we can easily derive the corollary statement.
Revised: Again, with the model-smoothness bound β = 2 /σ 2 we can easily derive the corollary statement.

Original: C A NALYSIS OF E NSEMBLE S MOOTHING S TRATEGIES
Revised: C A NALYSIS OF E NSEMBLE S MOOTHING S TRATEGIES

Original: In main text we mainly use the adapted randomized model smoothing strategy which is named
Revised: In main text we mainly use the adapted randomized model smoothing strategy which is named

Original: Ensemble-before-Smoothing (EBS).
Revised: Ensemble-before-Smoothing (EBS).

Original: We also consider Ensemble-after-Smoothing ( Ensemble-afterSmoothing ).
Revised: We also consider Ensemble-after-Smoothing ( Ensemble-afterSmoothing ).

Original: Through the following analysis, we will show Ensemble-before-Smoothing generally provides higher certiﬁed robust radius than Ensemble-after-Smoothing which justiﬁes our choice of the strategy.
Revised: Through the following analysis, we will show Ensemble-before-Smoothing generally provides higher certiﬁed robust radius than Ensemble-after-Smoothing which justiﬁes our choice of the strategy.

Original: Note that another advantage of Ensemble-before-Smoothing is the model-smoothness guarantee as shown in Theorem 2.

Original: The Ensemble-before-Smoothing strategy is deﬁned in Deﬁnition 5.
Revised: The Ensemble-before-Smoothing strategy is deﬁned in Deﬁnition 5.

Original: The Ensemble-after-Smoothing strategy is deﬁned as such.
Revised: The Ensemble-after-Smoothing strategy is deﬁned as such.

Original: Deﬁnition 6 ( Ensemble-after-Smoothing (EAS) ) .
Revised: Deﬁnition 6 ( Ensemble-after-Smoothing (EAS) ) .

Original: Let M be an ensemble model over base models { F i } Ni =1 .
Revised: Let M be an ensemble model over base models { F i } Ni =1 .

Original: Let ε be a random variable.
Revised: Let ε be a random variable.

Original: The EAS ensemble H ε M : R d (cid:55)→ [ C ] at input x 0 ∈ R d is deﬁned as: 
Revised: The EAS ensemble H ε M : R d (cid:55)→ [ C ] at input x 0 ∈ R d is deﬁned as: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Here, c is the index of the smoothed base model selected.
Revised: Here, c is the index of the smoothed base model selected.

Original: Remark.
Revised: Remark.

Original: In EBS, we ﬁrst construct a model ensemble M based on base models using WE or MME protocol, then apply randomized smoothing on top of the ensemble.
Revised: In EBS, we ﬁrst construct a model ensemble M based on base models using WE or MME protocol, then apply randomized smoothing on top of the ensemble.

Original: The resulting smoothed ensemble predicts the most frequent class of M when the input follows distribution x 0 + ε .
Revised: The resulting smoothed ensemble predicts the most frequent class of M when the input follows distribution x 0 + ε .

Original: In EAS, we use ε to construct smoothed classiﬁers for base models respectively.
Revised: In EAS, we use ε to construct smoothed classiﬁers for base models respectively.

Original: Then, for given input x 0 , the ensemble agrees on the base model which has the highest probability for its predicted class.
Revised: Then, for given input x 0 , the ensemble agrees on the base model which has the highest probability for its predicted class.

Original: C. C ERTIFIED R OBUSTNESS
Revised: C. C ERTIFIED R OBUSTNESS

Original: In this subsection, we characterize the certiﬁed robustness when using both strategies.
Revised: In this subsection, we characterize the certiﬁed robustness when using both strategies.

Original: C.1. Ensemble-before-Smoothing
Revised: C.1. Ensemble-before-Smoothing

Original: The following theorem gives an explicit method (ﬁrst compute g ε M ( x 0 ) G ε M ( x 0 ) via sampling then compute r ) to compute the certiﬁed robust radius r for EBS protocol.
Revised: The following theorem gives an explicit method (ﬁrst compute g ε M ( x 0 ) G ε M ( x 0 ) via sampling then compute r ) to compute the certiﬁed robust radius r for EBS protocol.

Original: This method is used for computing the certiﬁed robust radius in our paper.
Revised: This method is used for computing the certiﬁed robust radius in our paper.

Original: All other baselines appeared in our paper also use this method.
Revised: All other baselines appeared in our paper also use this method.

Original: Proposition C.1 (Certiﬁed Robustness for Ensemble-before-Smoothing ) .
Revised: Proposition C.1 (Certiﬁed Robustness for Ensemble-before-Smoothing ) .

Original: Let G ε M be an ensemble constructed by EBS strategy.
Revised: Let G ε M be an ensemble constructed by EBS strategy.

Original: The random variable ε ∼ N (0 , σ 2 I d ) .
Revised: The random variable ε ∼ N (0 , σ 2 I d ) .

Original: Then the ensemble G ε M is r -robust at point x 0 where
Revised: Then the ensemble G ε M is r -robust at point x 0 where

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: Here, g ε M ( x 0 ) j = Pr (cid:15) ( M ( x [Equation] + ε ) = j ) .
Revised: Here, g ε M ( x 0 ) j = Pr (cid:15) ( M ( x 0 + ε ) = j ) .

Original: The proposition is a direct application of Lemma A.1.
Revised: The proposition is a direct application of Lemma A.1.

Original: C.1. Ensemble-after-Smoothing
Revised: C.1. Ensemble-after-Smoothing

Original: The following theorem gives an explicit method to compute the certiﬁed robust radius r for EAS protocol.
Revised: The following theorem gives an explicit method to compute the certiﬁed robust radius r for EAS protocol.

Original: Theorem 5 (Certiﬁed robustness for Ensemble-after-Smoothing ) .
Revised: Theorem 5 (Certiﬁed robustness for Ensemble-after-Smoothing ) .

Original: Let H ε M be an ensemble constructed by EAS strategy over base models { F i } Ni =1 .
Revised: Let H ε M be an ensemble constructed by EAS strategy over base models { F i } Ni =1 .

Original: The random variable (cid:15) ∼ N (0 , σ 2 I d ) .
Revised: The random variable (cid:15) ∼ N (0 , σ 2 I d ) .

Original: Let y 

Revised: Let y

Original: = H ε M ( x 0 ) .
Revised: = H ε M ( x 0 ) .

Original: For each i ∈ [ N ] , deﬁne
Revised: For each i ∈ [ N ] , deﬁne

Original: [Equation]
Revised: [Equation]

Original: Then the ensemble H ε M is r -robust at point x 0 where
Revised: Then the ensemble H ε M is r -robust at point x 0 where

Original: [Equation]
Revised: [Equation]

Original: Remark.
Revised: Remark.

Original: The theorem appears to be a bit counter-intuitive — picking the best smoothed model in terms of certiﬁed robustness cannot give strong certiﬁed robustness for the ensemble.
Revised: The theorem appears to be a bit counter-intuitive — picking the best smoothed model in terms of certiﬁed robustness cannot give strong certiﬁed robustness for the ensemble.

Original: As long as the base models have different certiﬁed robust radius (i.e., r i ’s are different), the r , certiﬁed robust radius for the ensemble, is strictly inferior to that of the best base model (i.e., max r i ).
Revised: As long as the base models have different certiﬁed robust radius (i.e., r i ’s are different), the r , certiﬁed robust radius for the ensemble, is strictly inferior to that of the best base model (i.e., max r i ).

Original: Furthermore, if there exists a base model with wrong prediction (i.e., r i ≤ 0 ), the certiﬁed robust radius r is strictly smaller than half of the best base model.
Revised: Furthermore, if there exists a base model with wrong prediction (i.e., r i ≤ 0 ), the certiﬁed robust radius r is strictly smaller than half of the best base model.

Original: Proof of Theorem 5.
Revised: Proof of Theorem 5.

Original: Without loss of generality, we assume r 1 > r 2 > · · · > r N .
Revised: Without loss of generality, we assume r 1 > r 2 > · · · > r N .

Original: Let the perturbation added to x 0 has L 2 length δ .
Revised: Let the perturbation added to x 0 has L 2 length δ .

Original: When δ ≤ r N , since picking any model always gives the right prediction, the ensemble is robust.
Revised: When δ ≤ r N , since picking any model always gives the right prediction, the ensemble is robust.

Original: When r N < δ ≤ r 1 + r N, the highest robust radius with wrong prediction is δ − r N , and we can still guarantee that model F 1 has robust radius at least r 1 − δ from the smoothness of function x (cid:55)→ g εF 1 ( x ) G εF 1 ( x 0 ) (Salman et al., 2019).
Revised: When r N < δ ≤ r 1 + r N, the highest robust radius with wrong prediction is δ − r N , and we can still guarantee that model F 1 has robust radius at least r 1 − δ from the smoothness of function x (cid:55)→ g εF 1 ( x ) G εF 1 ( x 0 ) (Salman et al., 2019).

Original: Since r 1 − δ ≥ r 1 − r N≥ δ − r N , the ensemble will agree on F 1 or other base model with correct prediction and still gives the right prediction.
Revised: Since r 1 − δ ≥ r 1 − r N≥ δ − r N , the ensemble will agree on F 1 or other base model with correct prediction and still gives the right prediction.

Original: When δ > r 1 + r N, suppose f N is a linear model and only predicts two labels (which achieves the tight robust radius bound according to Cohen et al.
Revised: When δ > r 1 + r N, suppose f N is a linear model and only predicts two labels (which achieves the tight robust radius bound according to Cohen et al.

Original: , then f N can have robust radius δ − r N for the wrong prediction.
Revised: , then f N can have robust radius δ − r N for the wrong prediction.

Original: At the same time, for any other model F i which is linear and predicts correctly, the robust radius is at most r i − δ .
Revised: At the same time, for any other model F i which is linear and predicts correctly, the robust radius is at most r i − δ .

Original: Since r i − δ <
Revised: Since r i − δ <

Original: r 1 − δ <
Revised: r 1 − δ <

Original: r 1 − r N< δ − r N , the ensemble can probably give wrong prediction.
Revised: r 1 − r N< δ − r N , the ensemble can probably give wrong prediction.

Original: In summary, as we have shown, the certiﬁed robust radius can be at most r .
Revised: In summary, as we have shown, the certiﬁed robust radius can be at most r .

Original: For any radius δ > r , there exist base models which lead the ensemble H ε M ( x 0 + δ e ) to predict the label other than y 0 .
Revised: For any radius δ > r , there exist base models which lead the ensemble H ε M ( x 0 + δ e ) to predict the label other than y 0 .

Original: C. C OMPARISON OF T WO S TRATEGIES
Revised: C. C OMPARISON OF T WO S TRATEGIES

Original: In this subsection, we compare the two ensemble strategies when the ensembles are constructed from two base models.
Revised: In this subsection, we compare the two ensemble strategies when the ensembles are constructed from two base models.

Original: Corollary 4 (Smoothing Strategy Comparison) .
Revised: Corollary 4 (Smoothing Strategy Comparison) .

Original: Given M MME , a Max-Margin Ensemble constructed from base models { f a , f b } .
Revised: Given M MME , a Max-Margin Ensemble constructed from base models { f a , f b } .

Original: Let ε ∼ N (0 , σ 2 I d ) .
Revised: Let ε ∼ N (0 , σ 2 I d ) .

Original: Let G ε M MME be the EBS ensemble, and H ε M MME be the EAS ensemble.
Revised: Let G ε M MME be the EBS ensemble, and H ε M MME be the EAS ensemble.

Original: Suppose at point x 0 with ground-truth label y 0 , G εF a ( x 0 ) =
Revised: Suppose at point x 0 with ground-truth label y 0 , G εF a ( x 0 ) =

Original: G εF b ( x 0 ) =
Revised: G εF b ( x 0 ) =

Original: y 0 , g εF a ( x 0 ) > 0 . 5 , g εF b ( x 0 ) > 0 . 5 .
Revised: y 0 , g εF a ( x 0 ) > 0 . 5 , g εF b ( x 0 ) > 0 . 5 .

Original: Let δ be their probability difference for class y 0 , i.e, δ :=
Revised: Let δ be their probability difference for class y 0 , i.e, δ :=

Original: | g εF a ( x 0 ) y 

Revised: | g εF a ( x 0 ) y

Original: − g εF b ( x 0 )
Revised: − g εF b ( x 0 )

Original: y 

Revised: y

Original: | ,.
Revised: | ,.

Original: Let p min be the smaller probability for class y 0 between them, i.e., p min :
Revised: Let p min be the smaller probability for class y 0 between them, i.e., p min :

Original: =
Revised: =

Original: min { g εF a ( x 0 ) y 0 , g εF b ( x 0 ) y 0 } .
Revised: min { g εF a ( x 0 ) y 0 , g εF b ( x 0 ) y 0 } .

Original: We denote p to the probability of choosing the correct class when the base models disagree with each other; denote p ab to the probability of both base models agreeing on the correct class: p :=
Revised: We denote p to the probability of choosing the correct class when the base models disagree with each other; denote p ab to the probability of both base models agreeing on the correct class: p :=

Original: Pr ε ( M MME ( x 0 + ε ) =
Revised: Pr ε ( M MME ( x 0 + ε ) =

Original: y 

Revised: y

Original: | F a ( x 0 + ε ) (cid:54) =
Revised: | F a ( x 0 + ε ) (cid:54) =

Original: F b ( x 0 + ε ) and ( F a ( x 0 + ε ) =
Revised: F b ( x 0 + ε ) and ( F a ( x 0 + ε ) =

Original: y 0 or F b ( x 0 + ε ) =
Revised: y 0 or F b ( x 0 + ε ) =

Original: y 0 ))
Revised: y 0 ))

Original: , p ab :=
Revised: , p ab :=

Original: Pr ε ( F a ( x 0 + ε ) =
Revised: Pr ε ( F a ( x 0 + ε ) =

Original: F b ( x 0 + ε ) = y 0 ) .
Revised: F b ( x 0 + ε ) = y 0 ) .

Original: We have:
Revised: We have:

Original: If p > 1 / 2 + (2 + 4( p min − p ab ) /δ ) − 1 , r G > r H . 2.
Revised: If p > 1 / 2 + (2 + 4( p min − p ab ) /δ ) − 1 , r G > r H . 2.

Original: If p ≤ 1 / 2 , r H ≥ r G .
Revised: If p ≤ 1 / 2 , r H ≥ r G .

Original: Here, r G is the certiﬁed robust radius of G ε M MME computed from Equation (32) ; and r H is the certiﬁed robust radius of H ε M MME computed from Equation (33) .
Revised: Here, r G is the certiﬁed robust radius of G ε M MME computed from Equation (38) ; and r H is the certiﬁed robust radius of H ε M MME computed from Equation (39) .

Original: Remark.
Revised: Remark.

Original: Since p is the probability where the ensemble chooses the correct prediction between two base model predictions, with Max-Margin Ensemble, we think p > 1 / 2 with non-trivial margin.
Revised: Since p is the probability where the ensemble chooses the correct prediction between two base model predictions, with Max-Margin Ensemble, we think p > 1 / 2 with non-trivial margin.

Original: The quantity p min − p ab and δ both measure the base model’s diversity in terms of predicted label distribution, and generally they should be close.
Revised: The quantity p min − p ab and δ both measure the base model’s diversity in terms of predicted label distribution, and generally they should be close.

Original: As a result, 1 / 2 + (2 + 4( p min − p ab ) /δ ) − 1 ≈ 1 / 2 + 1 / 6 = 2 / 3 , and case (1) should be much more likely to happen than case (2).
Revised: As a result, 1 / 2 + (2 + 4( p min − p ab ) /δ ) − 1 ≈ 1 / 2 + 1 / 6 = 2 / 3 , and case (1) should be much more likely to happen than case (2).

Original: Therefore, EBS usually yields higher robustness guarantee .
Revised: Therefore, EBS usually yields higher robustness guarantee .

Original: We remark that the similar tendency also holds with multiple base models.
Revised: We remark that the similar tendency also holds with multiple base models.

Original: Proof of Corollary 4.
Revised: Proof of Corollary 4.

Original: For convenience, deﬁne p a :=
Revised: For convenience, deﬁne p a :=

Original: g εF a ( x 0 ) y 0 , p b := g εF b ( x 0 ) y 0 , where p a = p b + δ and p min = p b .
Revised: g εF a ( x 0 ) y 0 , p b := g εF b ( x 0 ) y 0 , where p a = p b + δ and p min = p b .

Original: From Proposition C.1 and Theorem 5, we have
Revised: From Proposition C.1 and Theorem 5, we have

Original: [Equation]
Revised: [Equation]

Original: Notice that Pr (cid:15) ( M MME ( x 0 + (cid:15)) =
Revised: Notice that Pr (cid:15) ( M MME ( x 0 + (cid:15)

Original: y 0 ) = 
Revised: [Equation] = y

Original:  p ab + p ( p a + pb − 2 p ab ) , we can rewrite r G as
Revised: [Equation] = p ab + p ( p a [Equation] p

Original: [Equation]
Revised: [Equation]

Original: =
Revised: p

Original: [Equation]
Revised: [Equation]

Original: p ab )) .
Revised: ) , we can rewrite r G as [Equation]

Original: When p > 1 / 2 + (2 + 4( p min − p ab ) /δ )
Revised: When p > 1 / 2 + ( 2 + 4( p min − p ab ) /δ )

Original: − 1 , since 
Revised: − 1 , since p >

Revised: [Equation]

Revised: p

Original: [Equation]
Revised: [Equation]

Original: we have p ab + p
Revised: we have p ab + p

Original: ( p a + p b − 2 p ab ) > p a .
Revised: ( p a + p b − 2 p ab ) > p a .

Original: Therefore, r G > σ Φ − 1 ( p a ) .
Revised: Therefore, r G > σ Φ − 1 ( p a ) .

Original: Whereas, r H ≤ σ/ 2 · 2Φ − 1 ( p a ) =
Revised: Whereas, r H ≤ σ/ 2 · 2Φ − 1 ( p a ) =

Original: σ Φ − 1 ( p a ) .
Revised: σ Φ − 1 ( p a ) .

Original: So r G > r H .
Revised: So r G > r H .

Original: When p ≤ 1 / 2 ,p
Revised: When p ≤ 1 / 2 ,

Original: [Equation]

Original: + p ( p

Original: [Equation]

Original: p

Original: [Equation]
Revised: [Equation]

Original:  ≤ p ab + 1 / [Equation] ( p a + p [Equation]
Revised: Therefore, r G ≤ σ Φ − 1 (( p a + p b ) / 2) .

Original: −

Original: [Equation]

Original: p ab )

Original: = ( p a + p b ) / 2 . Therefore, r G ≤ σ Φ − 1 (( p a + p b ) / 2) . Notice that Φ − 1 is convex in [1 / 2 , + ∞ ) , so Φ − 1 ( p a ) + Φ − 1 ( p b ) ≥ 2Φ − 1 (( p a + p b ) / 2) , i.e., r H ≥ r G .
Revised: Notice that Φ − 1 is convex in [1 / 2 , + ∞ ) , so Φ − 1 ( p a ) + Φ − 1 ( p b ) ≥ 2Φ − 1 (( p a + p b ) / 2) , i.e., r H ≥ r G .

Original: D R OBUSTNESS FOR S MOOTHED ML E NSEMBLE : S TATISTICAL R OBUSTNESS P ERSPECTIVE
Revised: D R OBUSTNESS FOR S MOOTHED ML E NSEMBLE : S TATISTICAL R OBUSTNESS P ERSPECTIVE

Original: In this appendix, we study the robustness of ensemble models from the statistical robustness perspective.
Revised: In this appendix, we study the robustness of ensemble models from the statistical robustness perspective.

Original: This perspective is motivated from Lemma A.1, where the certiﬁed robust radius of a model smoothed with Gaussian distribution ε ∼ N (0 , σ 2 I d ) is directly proportional to the probability of the original (unsmoothed) model predicting the correct class under such noise.
Revised: This perspective is motivated from Lemma A.1, where the certiﬁed robust radius of a model smoothed with Gaussian distribution ε ∼ N (0 , σ 2 I d ) is directly proportional to the probability of the original (unsmoothed) model predicting the correct class under such noise.

Original: We ﬁrst deﬁne the notation of statistical robustness in Appendix D.1; then we show and prove the certiﬁed robustness guarantees of WE, MME, and single models respectively in Appendix D.2; next we use these results to compare these ensembles under both general assumptions (Appendix D.3) and more speciﬁc uniform distribution assumptions (Appendix D.4) where several ﬁndings are also discussed; ﬁnally, we conduct extensive numerical experiments to verify all these ﬁndings in
Revised: We ﬁrst deﬁne the notation of statistical robustness in Appendix D.1; then we show and prove the certiﬁed robustness guarantees of WE, MME, and single models respectively in Appendix D.2; next we use these results to compare these ensembles under both general assumptions (Appendix D.3) and more speciﬁc uniform distribution assumptions (Appendix D.4) where several ﬁndings are also discussed; ﬁnally, we conduct extensive numerical experiments to verify all these ﬁndings in

Original: Appendix D.5.
Revised: Appendix D.5.

Original: D. D EFINITIONS OF S TATISTICAL R OBUSTNESS
Revised: D. D EFINITIONS OF S TATISTICAL R OBUSTNESS

Original: Deﬁnition 7 ( ( ε, p ) -Statistical Robust) .
Revised: Deﬁnition 7 ( ( ε, p ) -Statistical Robust) .

Original: Given a random variable ε and model F : R d (cid:55)→ [ C ] , at point x 0 with ground truth label y 0 , we call F is ( ε, p ) -statistical robust if Pr ε ( F ( x 0 + ε ) =
Revised: Given a random variable ε and model F : R d (cid:55)→ [ C ] , at point x 0 with ground truth label y 0 , we call F is ( ε, p ) -statistical robust if Pr ε ( F ( x 0 + ε ) =

Original: y 0 ) ≥ p .
Revised: y 0 ) ≥ p .

Original: Remark.
Revised: Remark.

Original: Note that based on Lemma A.1, when ε ∼ N (0 , σ 2 I d ) , if F is ( ε, p ) -statistical robust at point x 0 , the smoothed model G εF over F is ( σ Φ − 1 ( p ))
Revised: Note that based on Lemma A.1, when ε ∼ N (0 , σ 2 I d ) , if F is ( ε, p ) -statistical robust at point x 0 , the smoothed model G εF over F is ( σ Φ − 1 ( p ))

Original: -robust at point x 0 .
Revised: -robust at point x 0 .

Original: The following three deﬁnitions are used in the theorem statements in the following subsections.
Revised: The following three deﬁnitions are used in the theorem statements in the following subsections.

Original: They can be viewed as the “conﬁdence margins” under noised inputs x 0 + ε for single model and ensemble respectively.
Revised: They can be viewed as the “conﬁdence margins” under noised inputs x 0 + ε for single model and ensemble respectively.

Original: Deﬁnition 8 ( ( ε, λ, p ) -Single Conﬁdent) .
Revised: Deﬁnition 8 ( ( ε, λ, p ) -Single Conﬁdent) .

Original: Given a classiﬁcation model F .
Revised: Given a classiﬁcation model F .

Original: If at point x 0 with groundtruth label y 0 and the random variable ε , we have
Revised: If at point x 0 with groundtruth label y 0 and the random variable ε , we have

Original: [Equation]
Revised: [Equation]

Original: − p, we call F ( ε, λ, p ) -single conﬁdent at point x 0 .
Revised: we call F ( ε, λ, p ) -single conﬁdent at point x 0 .

Original: Deﬁnition 9 ( ( ε, λ, p ) -WE Conﬁdent) .
Revised: Deﬁnition 9 ( ( ε, λ, p ) -WE Conﬁdent) .

Original: Let M WE be a weighted ensemble deﬁned over base models { F i } N i =1 with weights { w i } N i =1 .
Revised: Let M WE be a weighted ensemble deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .

Original: If at point x 0 with ground-truth y 0 and random variable ε , we have
Revised: If at point x 0 with ground-truth y 0 and random variable ε , we have

Original: [Equation]
Revised: [Equation]

Original: we call weighted ensemble M WE ( ε, λ, p )
Revised: we call weighted ensemble M WE ( ε, λ, p )

Original: -WE conﬁdent at point x 0 .
Revised: -WE conﬁdent at point x 0 .

Original: Deﬁnition 10 ( ( ε, λ, p ) -MME Conﬁdent) .
Revised: Deﬁnition 10 ( ( ε, λ, p ) -MME Conﬁdent) .

Original: Let M MME be a max-margin ensemble over { F i } Ni =1 .
Revised: Let M MME be a max-margin ensemble over { F i } Ni =1 .

Original: If at point x 0 with ground-truth y 0 and random variable ε , we have
Revised: If at point x 0 with ground-truth y 0 and random variable ε , we have

Original: [Equation]
Revised: [Equation]

Original: we call max-margin ensemble M MME ( ε, λ, p ) -MME conﬁdent at point x 0 .
Revised: we call max-margin ensemble M MME ( ε, λ, p ) -MME conﬁdent at point x 0 .

Original: Note that the conﬁdence of every single model lies in the probability simplex, and λ reﬂects the conﬁdence portion that a wrong prediction class can take beyond the true class ( 1 − f i ( x 0 + ε ) ).
Revised: Note that the conﬁdence of every single model lies in the probability simplex, and λ reﬂects the conﬁdence portion that a wrong prediction class can take beyond the true class ( 1 − f i ( x 0 + ε ) ).

Original: To reduce ambiguity, we usualy use λ 1 in WE Conﬁdent, λ 2 in MME Conﬁdent, and λ 3 in Single
Revised: To reduce ambiguity, we usualy use λ 1 in WE Conﬁdent, λ 2 in MME Conﬁdent, and λ 3 in Single

Original: Conﬁdent.
Revised: Conﬁdent.

Original: Note that given λ 1 is the weighted average and λ 2 the maximum over λ ’s of all base models, under the same p , λ 1 /λ 2 ≤ 1 .
Revised: Note that given λ 1 is the weighted average and λ 2 the maximum over λ ’s of all base models, under the same p , λ 1 /λ 2 ≤ 1 .

Original: Furthermore, under the same p , λ 1 /λ 2 reﬂects the adversarial transferability (Papernot et al., 2016a) among base models : If the transferability is high, the conﬁdence scores of base models are similar ( λ ’s are similar), and thus λ 1 is large resulting in large λ 1 /λ 2 .
Revised: Furthermore, under the same p , λ 1 /λ 2 reﬂects the adversarial transferability (Papernot et al., 2016a) among base models : If the transferability is high, the conﬁdence scores of base models are similar ( λ ’s are similar), and thus λ 1 is large resulting in large λ 1 /λ 2 .

Original: On the other hand, when the transferability is low, the conﬁdence scores are diverse ( λ ’s are diverse), and thus λ 1 is small resulting in small λ 1 /λ 2 .
Revised: On the other hand, when the transferability is low, the conﬁdence scores are diverse ( λ ’s are diverse), and thus λ 1 is small resulting in small λ 1 /λ 2 .

Original: The following lemma is frequently used in our following proofs:
Revised: The following lemma is frequently used in our following proofs:

Original: Lemma D.1.
Revised: Lemma D.1.

Original: Suppose the random variable X satisﬁes E X > 0 , Var( X ) < ∞ and for any x ∈ R + ,
Revised: Suppose the random variable X satisﬁes E X > 0 , Var( X ) < ∞ and for any x ∈ R + ,

Original: Pr( X ≥ E X + x ) =
Revised: Pr( X ≥ E X + x ) =

Original: Pr( X ≤ E X − x ) , then
Revised: Pr( X ≤ E X − x ) , then

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma D.1.
Revised: Proof of Lemma D.1.

Original: Apply Chebyshev’s inequality on random variable X and notice that X is symmetric, then we can easily observe this lemma.
Revised: Apply Chebyshev’s inequality on random variable X and notice that X is symmetric, then we can easily observe this lemma.

Original: Now we are ready to present the certiﬁed robustness for different ensemble models.
Revised: Now we are ready to present the certiﬁed robustness for different ensemble models.

Original: D. S TATISTICAL C ERTIFIED R OBUSTNESS G UARANTEES
Revised: S TATISTICAL C ERTIFIED R OBUSTNESS G UARANTEES

Original: The main results in this subsection are Theorem 6 and Theorem 7.
Revised: The main results in this subsection are Theorem 6 and Theorem 7.

Original: D.2. C ERTIFIED R OBUSTNESS FOR S INGLE M ODEL
Revised: D.2. C ERTIFIED R OBUSTNESS FOR S INGLE M ODEL

Original: As the start point, we ﬁrst show a direct proposition stating the certiﬁed robustness guarantee of the single model.
Revised: As the start point, we ﬁrst show a direct proposition stating the certiﬁed robustness guarantee of the single model.

Original: Proposition D.1 (Certiﬁed Robustness for Single Model) .
Revised: Proposition D.1 (Certiﬁed Robustness for Single Model) .

Original: Let ε be a random variable.
Revised: Let ε be a random variable.

Original: Let F be a classiﬁcation model, which is ( ε, λ 3 , p ) -single conﬁdent.
Revised: Let F be a classiﬁcation model, which is ( ε, λ 3 , p ) -single conﬁdent.

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth y 0 ∈
Revised: d be the input with ground-truth y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Suppose f ( x 0 + ε ) y 0 follows symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 3 ) − 1 .
Revised: Suppose f ( x 0 + ε ) y 0 follows symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 3 ) − 1 .

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: Proof of Proposition D.1.
Revised: Proof of Proposition D.1.

Original: We consider the distribution of quantity Y :
Revised: We consider the distribution of quantity Y :

Original: = f ( x 0 + ε )
Revised: = f ( x 0 + ε )

Original: y 

Revised: y

Original: − λ 3 (1 − f ( x 0 + ε ) y 0 ) .
Revised: − λ 3 (1 − f ( x 0 + ε ) y 0 ) .

Original: Since the model F is ( ε, λ 3 , p ) -single conﬁdent, with probability 1 − p , Y ≤ f ( x 0 + ε ) y 0 − max y j ∈
Revised: Since the model F is ( ε, λ 3 , p ) -single conﬁdent, with probability 1 − p , Y ≤ f ( x 0 + ε ) y 0 − max y j ∈

Original: [ C ]: y j (cid:54) =
Revised: [ C ]: y j (cid:54) =

Original: y 

Revised: y

Original: f ( x 0 + ε ) y j .
Revised: f ( x 0 + ε ) y j .

Original: We note that since
Revised: We note that since

Original: [Equation]
Revised: E Y = (1 + λ 3 ) µ − λ 3 , Var( Y ) =

Original:  from Lemma D.1,
Revised: (1 + λ 3 ) 2 s 2 , from Lemma D.1,

Original: [Equation]
Revised: [Equation]

Original: Thus,
Revised: Thus,

Revised: Pr

Original: [Equation]
Revised: [Equation]

Original: D.2. C ERTIFIED R OBUSTNESS FOR E NSEMBLES
Revised: D.2. C ERTIFIED R OBUSTNESS FOR E NSEMBLES

Original: Now we are ready to prove the certiﬁed robustness of the Weighted Ensemble and Max-Margin
Revised: Now we are ready to prove the certiﬁed robustness of the Weighted Ensemble and Max-Margin

Original: Ensemble (Theorems 6 and 7).
Revised: Ensemble (Theorems 6 and 7).

Original: In the following text, we ﬁrst deﬁne statistical margins for both WE and MME, and point out their connections to the notion of ( ε, p ) -Statistical
Revised: In the following text, we ﬁrst deﬁne statistical margins for both WE and MME, and point out their connections to the notion of ( ε, p ) -Statistical

Original: Robust.
Revised: Robust.

Original: Then, we reason about the expectation, variance, and tail bounds of the statistical margins.
Revised: Then, we reason about the expectation, variance, and tail bounds of the statistical margins.

Original: Finally, we derive the certiﬁed robustness from the statistical margins.
Revised: Finally, we derive the certiﬁed robustness from the statistical margins.

Original: Deﬁnition D.1 ( ˆ X 1 ; Statistical Margin for WE M WE ) .
Revised: Deﬁnition D.1 ( ˆ X 1 ; Statistical Margin for WE M WE ) .

Original: Let M WE be Weighted Ensemble deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .
Revised: Let M WE be Weighted Ensemble deﬁned over base models { F i } Ni =1 with weights { w i } Ni =1 .

Original: Suppose M WE is ( ε, λ 1 , p ) -WE-conﬁdent.
Revised: Suppose M WE is ( ε, λ 1 , p ) -WE-conﬁdent.

Original: We deﬁne random variable ˆ X 1 which is depended by random variable ε :
Revised: We deﬁne random variable ˆ X 1 which is depended by random variable ε :

Original: [Equation]
Revised: [Equation]

Original: Deﬁnition D.2 ( ˆ X 2 ; Statistical Margin for MME M MME ) .
Revised: Deﬁnition D.2 ( ˆ X 2 ; Statistical Margin for MME M MME ) .

Original: Let M MME be Max-Margin Ensemble deﬁned over base models { F i } Ni =1 .
Revised: Let M MME be Max-Margin Ensemble deﬁned over base models { F i } N i =1 .

Original: Suppose M MME is ( ε, λ 2 , p ) -MME-conﬁdent.
Revised: Suppose M MME is ( ε, λ 2 , p ) -MME-conﬁdent.

Original: We deﬁne random variable ˆ X 2 which is depended by random variable ε :
Revised: We deﬁne random variable ˆ X 2 which is depended by random variable ε :

Original: [Equation]
Revised: [Equation]

Original: We have the following observation:
Revised: We have the following observation:

Original: Lemma D.2.
Revised: Lemma D.2.

Original: For Weighted Ensemble,
Revised: For Weighted Ensemble,

Original: [Equation]
Revised: [Equation]

Original: For Max-Margin Ensemble,
Revised: For Max-Margin Ensemble,

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma D.2.
Revised: Proof of Lemma D.2.

Original: (1) For Weighted Ensemble, we deﬁne the random variable X 1 :
Revised: (1) For Weighted Ensemble, we deﬁne the random variable X 1 :

Original: [Equation]
Revised: [Equation]

Original: Since M WE is ( ε, λ 1 , p ) -WE-conﬁdent, from Deﬁnition 9, with probability 1 − p , we haveX 1 ( ε ) ≥ N (cid:88) [Equation]
Revised: Since M WE is ( ε, λ 1 , p ) -WE-conﬁdent, from Deﬁnition 9, with probability 1 − p , we have

Original: [Equation]

Original: + ε )

Original: [Equation]

Original: [Equation]

Original: = (

Original: [Equation]

Original: λ 2 )

Original: N (cid:88)

Original: j

Original: [Equation]
Revised: [Equation]

Original: = ˆ X 1 ( ε ) .

Original: Therefore,
Revised: Therefore,

Original: [Equation]
Revised: [Equation]

Original: (2) For Max-Margin Ensemble, we deﬁne the random variable X 2 :[Equation]
Revised: (2) For Max-Margin Ensemble, we deﬁne the random variable X 2 :

Original: Similarly

Original: [Equation]
Revised: [Equation]

Original:  since M MME is ( ε, λ 2 , p ) -MME-conﬁdent, from Deﬁnition [Equation] with probability 1 − p [Equation]
Revised: Similarly, since M MME is ( ε, λ 2 , p ) -MME-conﬁdent, from Deﬁnition 10, with probability 1 − p , we have

Original: we have

Original: [Equation]
Revised: [Equation]

Original: Moreover, from Lemma B. [Equation] we know
Revised: Moreover, from Lemma B.1, we know

Original: [Equation]
Revised: [Equation]

Original: As the result, to quantify the statistical robustness of two types of ensembles, we can analyze the distribution of statistical margins ˆ X 1 and ˆ X 2 .
Revised: As the result, to quantify the statistical robustness of two types of ensembles, we can analyze the distribution of statistical margins ˆ X 1 and ˆ X 2 .

Original: Lemma D.3 (Expectation and variance of ˆ X 1 and ˆ X 2 ) .
Revised: Lemma D.3 (Expectation and variance of ˆ X 1 and ˆ X 2 ) .

Original: Let ˆ X 1 and ˆ X 2 be deﬁned by Deﬁnition D. and Deﬁnition D.2 respectively.
Revised: Let ˆ X 1 and ˆ X 2 be deﬁned by Deﬁnition D. and Deﬁnition D.2 respectively.

Original: Assume { f i ( x 0 + ε ) y 0 }
Revised: Assume { f i ( x 0 + ε ) y 0 }

Original: Ni =1 are i.i.d.
Revised: Ni =1 are i.i.d.

Original: and follow symmetric distribution with mean µ and variance s 2 .
Revised: and follow symmetric distribution with mean µ and variance s 2 .

Original: Deﬁne s 2 f =
Revised: Deﬁne s 2 f =

Original: Var(min i ∈
Revised: Var(min i ∈

Original: [ N ] f i ( x 0 + ε ) y 0 ) .
Revised: [ N ] f i ( x 0 + ε ) y 0 ) .

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma D.3.
Revised: Proof of Lemma D.3.

Original: [Equation]
Revised: [Equation]

Original: According to the symmetric distribution property of { f i ( x 0 + ε ) y 0 } Ni =1 , we have
Revised: According to the symmetric distribution property of { f i ( x 0 + ε ) y 0 } Ni =1 , we have

Original: [Equation]
Revised: [Equation]

Original: Also, due the symmetry, we have
Revised: Also, due the symmetry, we have

Original: [Equation]
Revised: [Equation]

Original: As a result,
Revised: As a result,

Original: [Equation]
Revised: [Equation]

Original: From Lemma D.3, now with Lemma D.1, we are ready to derive the statistical robustness lower bound for WE and MME.
Revised: From Lemma D.3, now with Lemma D.1, we are ready to derive the statistical robustness lower bound for WE and MME.

Original: Theorem 6 (Certiﬁed Robustness for WE) .
Revised: Theorem 6 (Certiﬁed Robustness for WE) .

Original: Let ε be a random variable supported on R d .
Revised: Let ε be a random variable supported on R d .

Original: Let M WE be a Weighted Ensemble deﬁned over { F i } Ni =1 with weights { w i } Ni =1 .
Revised: Let M WE be a Weighted Ensemble deﬁned over { F i } Ni =1 with weights { w i } Ni =1 .

Original: The M WE is ( ε, λ 1 , p ) -WE conﬁdent.
Revised: The M WE is ( ε, λ 1 , p ) -WE conﬁdent.

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth label y 0 ∈
Revised: d be the input with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Assume { f i ( x 0 + ε ) y 0 }
Revised: Assume { f i ( x 0 + ε ) y 0 }

Original: Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
Revised: Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.

Original: and follow symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 1 ) − 1 .
Revised: and follow symmetric distribution with mean µ and variance s 2 , where µ > (1 + λ − 1 1 ) − 1 .

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: Theorem 7 (Certiﬁed Robustness for MME) .
Revised: Theorem 7 (Certiﬁed Robustness for MME) .

Original: Let ε be a random variable.
Revised: Let ε be a random variable.

Original: Let M MME be a MaxMargin Ensemble deﬁned over { F i } Ni =1 .
Revised: Let M MME be a MaxMargin Ensemble deﬁned over { F i } Ni =1 .

Original: The M MME is ( ε, λ 2 , p ) -MME conﬁdent.
Revised: The M MME is ( ε, λ 2 , p ) -MME conﬁdent.

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth label y 0 ∈
Revised: d be the input with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Assume { f i ( x 0 + ε ) y 0 }
Revised: Assume { f i ( x 0 + ε ) y 0 }

Original: Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.
Revised: Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d.

Original: and follow symmetric distribution with mean µ where µ > (1 + λ − 1 2 ) − 1 .
Revised: and follow symmetric distribution with mean µ where µ > (1 + λ − 1 2 ) − 1 .

Original: Deﬁne s [Equation]
Revised: Deﬁne s 2 f =

Original: = Var(min i ∈
Revised: Var(min i ∈

Original: [ N ] f i

Original: [Equation]

Original:  x [Equation] + ε ) y 0 ) .
Revised: [ N ] f i ( x 0 + ε ) y 0 ) .

Original: We have
Revised: We have

Original: [Equation]
Revised: [Equation]

Original: Proof of Theorems 6 and 7.
Revised: Proof of Theorems 6 and 7.

Original: Combining Lemmas D.1 to D.3, we get the theorem.
Revised: Combining Lemmas D.1 to D.3, we get the theorem.

Original: Remark.
Revised: Remark.

Original: Theorems 6 and 7 provide two statistical robustness lower bounds for both types of ensembles, which is shown to be able to translate to certiﬁed robustness.
Revised: Theorems 6 and 7 provide two statistical robustness lower bounds for both types of ensembles, which is shown to be able to translate to certiﬁed robustness.

Original: For the Weighted Ensemble, noticing that ˆ X 1 is the weighted sum of several independent variables, we can further apply McDiarmid’s Inequality to get another bound
Revised: For the Weighted Ensemble, noticing that ˆ X 1 is the weighted sum of several independent variables, we can further apply McDiarmid’s Inequality to get another bound

Original: [Equation]
Revised: [Equation]

Original: which is tighter than Equation (38) when (cid:107) w (cid:107) 2 1 / (cid:107) w (cid:107) 2 2 is large.
Revised: which is tighter than Equation (44) when (cid:107) w (cid:107) 21 / (cid:107) w (cid:107) 22 is large.

Original: For average weighted ensemble, (cid:107) w (cid:107) 21 / (cid:107) w (cid:107) 2 2 = N .
Revised: For average weighted ensemble, (cid:107) w (cid:107) 21 / (cid:107) w (cid:107) 22 = N .

Original: Thus, when N is large, this bound is tighter.
Revised: Thus, when N is large, this bound is tighter.

Original: Both theorems are applicable under the i.i.d.
Revised: Both theorems are applicable under the i.i.d.

Original: assumption of conﬁdence scores.
Revised: assumption of conﬁdence scores.

Original: The another assumption µ > max {

Original: [Equation] 1 + λ − 1 1 ) − 1 , [Equation] 1 + λ − 1 2 ) − 1 } insures that both ensembles have higher probability of predicting the true class rather than other classes, i.e., the ensembles have non-trivial clean accuracy.
Revised: The another assumption µ > max { (1 + λ − 1 1 ) − 1 , (1 + λ − 1 2 ) − 1 } insures that both ensembles have higher probability of predicting the true class rather than other classes, i.e., the ensembles have non-trivial clean accuracy.

Original: D. C OMPARISON OF C ERTIFIED R OBUSTNESS
Revised: D. C OMPARISON OF C ERTIFIED R OBUSTNESS

Original: We ﬁrst show and prove an important lemma.
Revised: We ﬁrst show and prove an important lemma.

Original: Then, based on the lemma and Theorems 6 and 7, we derive the comparison corollary.
Revised: Then, based on the lemma and Theorems 6 and 7, we derive the comparison corollary.

Original: Lemma D.4.
Revised: Lemma D.4.

Original: For µ, λ 1 , λ 2 , C > 0 , when max { λ 1 / (1 + λ 1 ) , λ 2 / (1 + λ 2 ) } < µ ≤ 1 , and C < 1 , we have
Revised: For µ, λ 1 , λ 2 , C > 0 , when max { λ 1 / (1 + λ 1 ) , λ 2 / (1 + λ 2 ) } < µ ≤ 1 , and C < 1 , we have

Original: [Equation]
Revised: [Equation]

Original: Proof of Lemma D.4.
Revised: Proof of Lemma D.4.

Original: [Equation]
Revised: [Equation]

Original: Now we can show and prove the comparison corollary
Revised: Now we can show and prove the comparison corollary.

Original: [Equation]

Original: Corollary 5 (Comparison of Certiﬁed Robustness) .
Revised: Corollary 5 (Comparison of Certiﬁed Robustness) .

Original: Let ε be a random variable supported on R d .
Revised: Let ε be a random variable supported on R d .

Original: Over base models { F i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted
Revised: Over base models { F i } Ni =1 , let M MME be Max-Margin Ensemble, and M WE the Weighted

Original: Ensemble with weights { w i } Ni =1 .
Revised: Ensemble with weights { w i } Ni =1 .

Original: Let x 0 ∈ R
Revised: Let x 0 ∈ R

Original: d be the input with ground-truth label y 0 ∈
Revised: d be the input with ground-truth label y 0 ∈

Original: [ C ] .
Revised: [ C ] .

Original: Assume { f i ( x 0 + ε ) y 0 }
Revised: Assume { f i ( x 0 + ε ) y 0 }

Original: Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d, and follow symmetric distribution with mean µ and variance s 2 , where µ > max { (1 + λ[Equation] − [Equation]
Revised: Ni =1 , the conﬁdence scores across base models for label y 0 , are i.i.d, and follow symmetric distribution with mean µ and variance s 2 , where µ > max { (1 + λ − 1 1 ) − 1 , (1 + λ − 1 2 ) − 1 } .

Original: −

Original: [Equation] − [Equation] Deﬁne s  f =Var
Revised: Deﬁne s 2 f =

Original: (min i ∈[ N f i ( x
Revised: Var(min i ∈

Original:  + ε ) y  ) and assume s f < s .
Revised: [ N ] f i ( x 0 + ε ) y 0 ) and assume s f < s .

Original: When
Revised: When

Original: [Equation]
Revised: [Equation]

Original: for any weights { w i } Ni =1 , M WE has higher certiﬁed robustness than M MME .
Revised: for any weights { w i } Ni =1 , M WE has higher certiﬁed robustness than M MME .

Original: When
Revised: When

Original: [Equation]
Revised: [Equation]

Original: for any weights { w i } Ni =1 , M MME has higher certiﬁed robustness than M WE .
Revised: for any weights { w i } Ni =1 , M MME has higher certiﬁed robustness than M WE .

Original: Here, the certiﬁed robustness is given by Theorems 6 and 7.
Revised: Here, the certiﬁed robustness is given by Theorems 6 and 7.

Original: Proof of Corollary 5.
Revised: Proof of Corollary 5.

Original: According to Lemma D.4, we have
Revised: According to Lemma D.4, we have

Original: [Equation]
Revised: [Equation]

Original: According to Theorems 6 and 7, we know the RHS in Equation (38) is larger than the RHS in
Revised: According to Theorems 6 and 7, we know the RHS in Equation (44) is larger than the RHS in

Original: Equation (39), i.e., M WE has higher certiﬁed robustnesss than M MME .
Revised: Equation (45), i.e., M WE has higher certiﬁed robustnesss than M MME .

Original: According to Lemma D.4, we have
Revised: According to Lemma D.4, we have

Original: [Equation]
Revised: [Equation]

Original: According to Theorems 6 and 7, we know the RHS in Equation (39) is larger than the RHS in
Revised: According to Theorems 6 and 7, we know the RHS in Equation (45) is larger than the RHS in

Original: Equation (38), i.e., M MME has higher certiﬁed robustnesss than M WE .
Revised: Equation (44), i.e., M MME has higher certiﬁed robustnesss than M WE .

Original: Remark.
Revised: Remark.

Original: Given that λ 1 /λ 2 reﬂects the adversarial transferability among base models Appendix D.1, the corollary implies that, MME is more robust when the transferability is high; WE is more robust when the transferability is low.
Revised: Given that λ 1 /λ 2 reﬂects the adversarial transferability among base models Appendix D.1, the corollary implies that, MME is more robust when the transferability is high; WE is more robust when the transferability is low.

Original: (2) As we can observe in the proof, there is a gap between Equation (41) and Equation (42) — when λ 1 /λ 2 lies in between RHS of Equation (41) and RHS of Equation (42), it is undetermined which ensemble protocol has higher robustness.
Revised: (2) As we can observe in the proof, there is a gap between Equation (47) and Equation (48) — when λ 1 /λ 2 lies in between RHS of Equation (47) and RHS of Equation (48), it is undetermined which ensemble protocol has higher robustness.

Original: Indeed, this uncertainty is caused by the adjustable weights { w i } Ni =1 of the Weighted Ensemble.
Revised: Indeed, this uncertainty is caused by the adjustable weights { w i } N i =1 of the Weighted Ensemble.

Original: If we only consider the average ensemble, then this gap is closed:
Revised: If we only consider the average ensemble, then this gap is closed:

Original: [Equation]
Revised: [Equation]

Original: (3) Note that we assume that s f < s , where s 2 is the variance of single variable and s 2 f is the variance of minimum of N i.i.d.
Revised: (3) Note that we assume that s f < s , where s 2 is the variance of single variable and s 2 f is the variance of minimum of N i.i.d.

Original: variables.
Revised: variables.

Original: For common symmetry distributions, along with the increase of N , s f shrinks in the order of O (1 /N B ) where B ∈ (0 , 2] .
Revised: For common symmetry distributions, along with the increase of N , s f shrinks in the order of O (1 /N B ) where B ∈ (0 , 2] .

Original: Thus, as long as N is large, the assumption s f < s will always hold.
Revised: Thus, as long as N is large, the assumption s f < s will always hold.

Original: An exception is that when these random variables follow the exponential distribution, where s f does not shrink along with the increase of N .
Revised: An exception is that when these random variables follow the exponential distribution, where s f does not shrink along with the increase of N .

Original: However, since these random variables are conﬁdence scores which are in [0 , 1] , they cannot obey exponential distribution.
Revised: However, since these random variables are conﬁdence scores which are in [0 , 1] , they cannot obey exponential distribution.

Original: D. A C ONCRETE C ASE : U NIFORM D ISTRIBUTION
Revised: D. A C ONCRETE C ASE : U NIFORM D ISTRIBUTION