Original: O N THE R OBUSTNESS OF R ANDOMIZED E NSEMBLES TO A DVERSARIAL P ERTURBATIONS
Revised: O N THE R OBUSTNESS OF R ANDOMIZED E NSEMBLES TO A DVERSARIAL P ERTURBATIONS

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Randomized ensemble classifiers (RECs), where one classifier is randomly selected during inference, have emerged as an attractive alternative to traditional ensembling methods for realizing adversarially robust classifiers with limited compute requirements.
Revised: Randomized ensemble classifiers (RECs), where one classifier is randomly selected during inference, have emerged as an attractive alternative to traditional ensembling methods for realizing adversarially robust classifiers with limited compute requirements.

Original: However, recent works have shown that existing methods for constructing RECs are more vulnerable than initially claimed, casting major doubts on their efficacy and prompting fundamental questions such as: “ When are
Revised: However, recent works have shown that existing methods for constructing RECs are more vulnerable than initially claimed, casting major doubts on their efficacy and prompting fundamental questions such as: “ When are

Original: RECs useful? ”
Revised: RECs useful? ”

Original: , “ What are their limits? ”, and “ How do we train them? ”.
Revised: , “ What are their limits? ”, and “ How do we train them? ”.

Original: In this work, we first demystify RECs as we derive fundamental results regarding their theoretical limits, necessary and sufficient conditions for them to be useful, and more.
Revised: In this work, we first demystify RECs as we derive fundamental results regarding their theoretical limits, necessary and sufficient conditions for them to be useful, and more.

Original: Leveraging this new understanding, we propose a new boosting algorithm (BARRE) for training robust RECs, and empirically demonstrate its effectiveness at defending against strong ℓ ∞ norm-bounded adversaries across various network architectures and datasets.
Revised: Leveraging this new understanding, we propose a new boosting algorithm (BARRE) for training robust RECs, and empirically demonstrate its effectiveness at defending against strong ℓ ∞ norm-bounded adversaries across various network architectures and datasets.

Original: Our code is submitted as part of the supplementary material, and will be publicly released on GitHub .
Revised: Our code is submitted as part of the supplementary material, and will be publicly released on GitHub .

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Defending deep networks against adversarial perturbations (Szegedy et al., 2013; Biggio et al., 2013;
Revised: Defending deep networks against adversarial perturbations (Szegedy et al., 2013; Biggio et al., 2013;

Original: Goodfellow et al., 2014) remains a difficult task.
Revised: Goodfellow et al., 2014) remains a difficult task.

Original: Several proposed defenses (Papernot et al., 2016;
Revised: Several proposed defenses (Papernot et al., 2016;

Original: Pang et al., 2019; Yang et al., 2019; Sen et al., 2019; Pinot et al., 2020) have been subsequently “broken” by stronger adversaries (Carlini & Wagner, 2017; Athalye et al., 2018; Tram`er et al., 2020;
Revised: Pang et al., 2019; Yang et al., 2019; Sen et al., 2019; Pinot et al., 2020) have been subsequently “broken” by stronger adversaries (Carlini & Wagner, 2017; Athalye et al., 2018; Tram`er et al., 2020;

Original: Dbouk & Shanbhag, 2022), whereas strong defenses (Cisse et al., 2017; Tram`er et al., 2018;
Revised: Dbouk & Shanbhag, 2022), whereas strong defenses (Cisse et al., 2017; Tram`er et al., 2018;

Original: Cohen et al., 2019), such as adversarial training (AT) (Goodfellow et al., 2014; Zhang et al., 2019; Madry et al., 2018), achieve unsatisfactory levels of robustness 1 .
Revised: Cohen et al., 2019), such as adversarial training (AT) (Goodfellow et al., 2014; Zhang et al., 2019; Madry et al., 2018), achieve unsatisfactory levels of robustness 1 .

Original: A popular belief in the adversarial community is that single model defenses, e.g., AT, lack the capacity to defend against all possible perturbations, and that constructing an ensemble of diverse, often smaller, models should be more cost-effective (Pang et al., 2019; Kariyappa & Qureshi, 2019;
Revised: A popular belief in the adversarial community is that single model defenses, e.g., AT, lack the capacity to defend against all possible perturbations, and that constructing an ensemble of diverse, often smaller, models should be more cost-effective (Pang et al., 2019; Kariyappa & Qureshi, 2019;

Original: Pinot et al., 2020;
Revised: Pinot et al., 2020;

Original: Yang et al., 2020b; 2021; Abernethy et al., 2021; Zhang et al., 2022).
Revised: Yang et al., 2020b; 2021; Abernethy et al., 2021; Zhang et al., 2022).

Original: Indeed, recent deterministic robust ensemble methods, such as MRBoost (Zhang et al., 2022), have been successful at achieving higher robustness compared to AT baselines using the same network architecture, at the expense of 4 × more compute (see Fig. 1).
Revised: Indeed, recent deterministic robust ensemble methods, such as MRBoost (Zhang et al., 2022), have been successful at achieving higher robustness compared to AT baselines using the same network architecture, at the expense of 4 × more compute (see Fig. 1).

Original: In fact, Fig 1 indicates that one can simply adversarially training larger deep nets that can match the robustness and compute requirements of
Revised: In fact, Fig 1 indicates that one can simply adversarially training larger deep nets that can match the robustness and compute requirements of

Original: MRBoost models, rendering state-of-the-art boosting techniques obsolete for designing classifiers that are both robust and efficient .
Revised: MRBoost models, rendering state-of-the-art boosting techniques obsolete for designing classifiers that are both robust and efficient .

Original: In contrast, randomized ensembles, where one classifier is randomly selected during inference, offer a unique way of ensembling that can operate with limited compute resources.
Revised: In contrast, randomized ensembles, where one classifier is randomly selected during inference, offer a unique way of ensembling that can operate with limited compute resources.

Original: However, the recent work of Dbouk & Shanbhag (2022) has cast major concerns regarding their efficacy, as they successfully compromised the state-of-the-art randomized defense of Pinot et al.
Revised: However, the recent work of Dbouk & Shanbhag (2022) has cast major concerns regarding their efficacy, as they successfully compromised the state-of-the-art randomized defense of Pinot et al.

Original: (2020) by large margins using their proposed ARC adversary.
Revised: (2020) by large margins using their proposed ARC adversary.

Original: Furthermore, there is an apparent lack of proper theory on the robustness of randomized ensembles, as fundamental questions such as: “when does randomization help?” or “how to find the optimal sampling probability?”
Revised: Furthermore, there is an apparent lack of proper theory on the robustness of randomized ensembles, as fundamental questions such as: “when does randomization help?” or “how to find the optimal sampling probability?”

Original: remain unanswered.
Revised: remain unanswered.

Original: Contributions .
Revised: Contributions .

Original: In this work, we first provide a theoretical framework for analyzing the adversarial robustness of randomized ensmeble classifiers (RECs).
Revised: In this work, we first provide a theoretical framework for analyzing the adversarial robustness of randomized ensmeble classifiers (RECs).

Original: Our theoretical results enable us to better
Revised: Our theoretical results enable us to better

Original: [Figure]
Revised: [Figure]

Original: understand randomized ensembles, revealing interesting and useful answers regarding their limits, necessary and sufficient conditions for them to be useful, and efficient methods for finding the optimal sampling probability.
Revised: understand randomized ensembles, revealing interesting and useful answers regarding their limits, necessary and sufficient conditions for them to be useful, and efficient methods for finding the optimal sampling probability.

Original: Next, guided by our threoretical results, we propose BARRE, a new boosting algorithm for training robust randomized ensemble classifiers achieving state-of-the-art robustness.
Revised: Next, guided by our threoretical results, we propose BARRE, a new boosting algorithm for training robust randomized ensemble classifiers achieving state-of-the-art robustness.

Original: We validate the effectiveness of BARRE via comprehensive experiments across multiple network architectures and datasets, thereby demonstrating that RECs can achieve similar robustness to AT and MRBoost, at a fraction of the computational cost (see Fig. 1).  
Revised: We validate the effectiveness of BARRE via comprehensive experiments across multiple network architectures and datasets, thereby demonstrating that RECs can achieve similar robustness to AT and MRBoost, at a fraction of the computational cost (see Fig. 1).  B ACKGROUND AND R ELATED W ORK Adversarial Robustness .

Revised: Deep neural networks are known to be vulnerable to adversarial perturbations (Szegedy et al., 2013; Biggio et al., 2013).

Revised: In an attempt to robustify deep nets, several defense methods have been proposed (Katz et al., 2017; Madry et al., 2018; Cisse et al., 2017; Zhang et al., 2019;

Original: P RELIMINARIES 2. P ROBLEM S ETUP
Revised: Yang et al., 2020b; Zhang et al., 2022; Tjeng et al., 2018; Xiao et al., 2018; Raghunathan et al., 2018; Yang et al., 2020a). While some heuristic-based empirical defenses have later been broken by better adversaries (Carlini & Wagner, 2017; Athalye et al., 2018; Tram ` er et al., 2020), strong defenses, such as adversarial training (AT) (Goodfellow et al., 2014; Madry et al., 2018; Zhang et al., 2019), remain unbroken but achieve unsatisfactory levels of robustness. Ensemble Defenses . Building on the massive success of classic ensemble methods in machine learning (Breiman, 1996; Freund & Schapire, 1997; Dietterich, 2000), robust ensemble methods (Kariyappa & Qureshi, 2019; Pang et al., 2019; Sen et al., 2019; Yang et al., 2020b; 2021; Abernethy et al., 2021; Zhang et al., 2022) have emerged as a natural solution to compensate for the unsatisfactory performance of existing single-model defenses, such as AT.

Revised: Earlier works (Kariyappa &

Revised: Qureshi, 2019; Pang et al., 2019; Sen et al., 2019) relied on heuristic-based techniques for inducing diversity within the ensembles, and have been subsequently shown to be weak (Tram`er et al., 2020;

Revised: Athalye et al., 2018).

Revised: Recent methods, such as RobBoost (Abernethy et al., 2021) and MRBoost (Zhang et al., 2022), formulate the design of robust ensembles from a margin boosting perspective, achieving state-of-the-art robustness for deterministic ensemble methods.

Revised: This achievement comes at a massive ( 4 − 5 × ) increase in compute requirements, as each inference requires executing all members of the ensemble, deeming them unsuitable for safety-critical edge applications (Guo et al., 2020; Sehwag et al., 2020; Dbouk & Shanbhag, 2021).

Revised: Randomized ensembles (Pinot et al., 2020), where one classifier is chosen randomly during inference, offer a more compute-efficient alternative.

Revised: However, their ability to defend against strong adversaries remains unclear (Dbouk & Shanbhag, 2022; Zhang et al., 2022).

Revised: In this work, we show that randomized ensemble classifiers can be effective at defending against adversarial perturbations, and propose a boosting algorithm for training such ensembles, thereby achieving high levels of robustness with limited compute requirements.

Revised: Randomized Defenses .

Revised: A randomized defense, where the defender adopts a random strategy for classification, is intuitive: if the defender does not know what is the exact policy used for a certain input, then one expects that the adversary will struggle on average to fool such a defense.

Revised: Theoretically, Bayesian Neural Nets (BNNs) (Neal, 2012) have been shown to be robust (in the large data limit) to gradient-based attacks (Carbone et al., 2020), whereas Pinot et al.

Revised: (2020) has shown that a randomized ensemble classifier (REC) with higher robustness exists for every deterministic classifier.

Revised: However, realizing strong and practical randomized defenses remains elusive as BNNs are too computationally prohibitive and existing methods (Xie et al., 2018; Dhillon et al., 2018;

Revised: Yang et al., 2019) often end up being compromised by adaptive attacks (Athalye et al., 2018; Tram`er et al., 2020).

Revised: Even BAT, the proposed method of Pinot et al.

Revised: (2020) for robust RECs, was recently broken by Zhang et al.

Revised: ; Dbouk & Shanbhag (2022).

Revised: In contrast, our work first demystifies randomized ensembles as we derive fundamental results regarding the limit of RECs, necessary and sufficient conditions for them to be useful, and efficient methods for finding the optimal sampling probability.

Revised: Empirically, our proposed boosting algorithm (BARRE) can successfully train robust

Revised: RECs, achieving state-of-the-art robustness for RECs.

Revised:  P RELIMINARIES & P ROBLEM S ETUP

Original: Notation .
Revised: Notation .

Original: Let F = { f 1 , ..., f M } be a collection of M arbitrary C -ary
Revised: Let F = { f 1 , ..., f M } be a collection of M arbitrary C -ary

Original: classifiers f
Revised: classifiers f

Original: i : R d → [ C ] .
Revised: i : R d → [ C ] .

Original: A soft classifier, denoted by ˜ f : R d → R C , can be used to construct a hard classifier f ( x ) =
Revised: A soft classifier, denoted by ˜ f : R d → R C , can be used to construct a hard classifier f ( x ) =

Original: arg max c ∈ [ C ] [ ˜ f ( x )] c , where [ v ] c
Revised: arg max c ∈ [ C ] [ ˜ f ( x )] c , where [ v ] c

Original: = v c .
Revised: = v c .

Original: We use the notation f ( ·| θ ) to represent parametric classifiers where f is a fixed mapping and θ ∈ Θ represents the learnable parameters.
Revised: We use the notation f ( ·| θ ) to represent parametric classifiers where f is a fixed mapping and θ ∈ Θ represents the learnable parameters.

Original: Let ∆ M = { v ∈ [0 , 1] M : (cid:80) v i = 1 } be the probability simplex of dimension M − 1 .
Revised: Let ∆ M = { v ∈ [0 , 1] M : (cid:80) v i = 1 } be the probability simplex of dimension M − 1 .

Original: Given a probability vector α ∈ ∆ M , we construct a randomized ensemble classifier (REC)
Revised: Given a probability vector α ∈ ∆ M , we construct a randomized ensemble classifier (REC)

Original: f α such that f α ( x ) =
Revised: f α such that f α ( x ) =

Original: f i ( x ) with probability α i .
Revised: f i ( x ) with probability α i .

Original: In contrast, traditional ensembling methods construct a deterministic ensemble classifier (DEC) using the soft classifiers as follows 2 : 
Revised: In contrast, traditional ensembling methods construct a deterministic ensemble classifier (DEC) using the soft classifiers as follows 2 : ¯ f ( x ) =

Original: [Equation]
Revised: arg max c ∈ [ C ] [ (cid:80) Mi

Original: Mi =1 ˜ f
Revised: =1 ˜ f

Original: i ( x )] c .
Revised: i ( x )] c .

Original: Denote z
Revised: Denote z

Original: =
Revised: =

Original: ( x , y ) ∈ R
Revised: ( x , y ) ∈ R

Original: d × [ C ] as a feature-label pair that follows some unknown distribution D .
Revised: d × [ C ] as a feature-label pair that follows some unknown distribution D .

Original: Let S ⊂ R d be a closed and bounded set representing the attacker’s perturbation set.
Revised: Let S ⊂ R d be a closed and bounded set representing the attacker’s perturbation set.

Original: A typical choice of S in the adversarial community is the ℓ p ball of radius ϵ : B p ( ϵ ) =
Revised: A typical choice of S in the adversarial community is the ℓ p ball of radius ϵ : B p ( ϵ ) =

Original: { δ ∈ R d : ∥ δ ∥ p ≤ ϵ } .
Revised: { δ ∈ R d : ∥ δ ∥ p ≤ ϵ } .

Original: For a classifier f i ∈ F and data-point z = ( x , y ) , define S i ( z )
Revised: For a classifier f i ∈ F and data-point z = ( x , y ) , define S i ( z )

Original: = { δ ∈ S :
Revised: = { δ ∈ S :

Original: f i ( x + δ ) ̸ = y } to be the set of valid adversarial perturbations to f i at z .
Revised: f i ( x + δ ) ̸ = y } to be the set of valid adversarial perturbations to f i at z .

Original: Definition 1.
Revised: Definition 1.

Original: For any (potentially random) classifier f , define the adversarial risk η :
Revised: For any (potentially random) classifier f , define the adversarial risk η :

Original: [Equation]
Revised: [Equation]

Original: The adversarial risk measures the robustness of f on average in the presence of an adversary (attacker) restricted to the set S .
Revised: The adversarial risk measures the robustness of f on average in the presence of an adversary (attacker) restricted to the set S .

Original: For the special case of S = { 0 } , the adversarial risk reduces to the standard risk of f :
Revised: For the special case of S = { 0 } , the adversarial risk reduces to the standard risk of f :

Original: [Equation]
Revised: [Equation]

Original: The more commonly reported robust accuracy of f , i.e., accuracy against adversarially perturbed inputs, can be directly computed from η ( f ) .
Revised: The more commonly reported robust accuracy of f , i.e., accuracy against adversarially perturbed inputs, can be directly computed from η ( f ) .

Original: The same can be said for the clean accuracy and η 0 ( f ) .
Revised: The same can be said for the clean accuracy and η 0 ( f ) .

Original: When working with an REC f α , the adversarial risk can be expressed as:
Revised: When working with an REC f α , the adversarial risk can be expressed as:

Original: [Equation]
Revised: [Equation]

Original: where we use the notation η ( α ) whenever the collection F is fixed.
Revised: where we use the notation η ( α ) whenever the collection F is fixed.

Original: Let { e i } Mi =1 ⊂ { 0 , 1 } M be the standard basis vectors of R M , then we employ the notation η( f i ) = η ( f e i ) ≡ η ( e i ) =
Revised: Let { e i } Mi =1 ⊂ { 0 , 1 } M be the standard basis vectors of R M , then we employ the notation η

Original: η i .

Original: 2. B ACKGROUND AND R ELATED W ORK

Original: Adversarial Robustness .

Original: Deep neural networks are known to be vulnerable to adversarial perturbations (Szegedy et al., 2013; Biggio et al., 2013). In an attempt to robustify deep nets, several defense methods have been proposed (Katz et al., 2017; Madry et al., 2018; Cisse et al., 2017; Zhang et al., 2019; Yang et al., 2020b; Zhang et al., 2022; Tjeng et al., 2018; Xiao et al., 2018; Raghunathan et al., 2018; Yang et al., 2020a). While some heuristic-based empirical defenses have later been broken by better adversaries (Carlini & Wagner, 2017; Athalye et al., 2018; Tram`er et al., 2020), strong defenses, such as adversarial training (AT) (Goodfellow et al., 2014; Madry et al., 2018; Zhang et al., 2019), remain unbroken but achieve unsatisfactory levels of robustness.
Revised: ( f i ) =

Original: Ensemble Defenses .

Original: Building on the massive success of classic ensemble methods in machine learning (Breiman, 1996; Freund & Schapire, 1997; Dietterich, 2000), robust ensemble methods (Kariyappa & Qureshi, 2019; Pang et al., 2019; Sen et al., 2019; Yang et al., 2020b; 2021; Abernethy et al., 2021; Zhang et al., 2022) have emerged as a natural solution to compensate for the unsatisfactory performance of existing single-model defenses, such as AT. Earlier works (Kariyappa & Qureshi, 2019; Pang et al., 2019; Sen et al., 2019) relied on heuristic-based techniques for inducing diversity within the ensembles, and have been subsequently shown to be weak (Tram ` er et al., 2020; Athalye et al., 2018).
Revised: η ( f e i ) ≡

Original: Recent methods, such as RobBoost (Abernethy et al., 2021) and MRBoost (Zhang et al., 2022), formulate the design of robust ensembles from a margin boosting perspective, achieving state-of-the-art robustness for deterministic ensemble methods.

Original: This achievement comes at a massive ( 4 − 5 × ) increase in compute requirements, as each inference requires executing all members of the ensemble, deeming them unsuitable for safety-critical edge applications (Guo et al., 2020; Sehwag et al., 2020; Dbouk & Shanbhag, 2021). Randomized ensembles (Pinot et al., 2020), where one classifier is chosen randomly during inference, offer a more compute-efficient alternative. However, their ability to defend against strong adversaries remains unclear (Dbouk & Shanbhag, 2022; Zhang et al., 2022). In this work, we show that randomized ensemble classifiers can be effective at defending against adversarial perturbations, and propose a boosting algorithm for training such ensembles, thereby achieving high levels of robustness with limited compute requirements.
Revised: η ( e i ) =

Original: Randomized Defenses .

Original: A randomized defense, where the defender adopts a random strategy for classification, is intuitive: if the defender does not know what is the exact policy used for a certain input, then one expects that the adversary will struggle on average to fool such a defense.

Original: Theoretically, the work of Pinot et al.

Original: (2020) has shown that for any deterministic classifier, there exist a random mixture of classifiers that can achieve higher robustness, under a deterministic attacker.

Original: However, realizing strong randomized defenses remains elusive, as existing methods (Xie et al., 2018; Dhillon et al., 2018; Yang et al., 2019) often end up being compromised by adaptive attacks (Athalye et al., 2018; Tram`er et al., 2020). Even BAT, the proposed method of Pinot et al. (2020) for robust RECs, was recently broken by Zhang et al.
Revised: η i .

Original: ; Dbouk & Shanbhag (2022).

Original: In contrast, our work first demystifies randomized ensembles as we derive fundamental results regarding the limit of RECs, necessary and sufficient conditions for them to be useful, and efficient methods for finding the optimal sampling probability.

Original: Empirically, our proposed boosting algorithm (BARRE) can successfully train robust RECs, achieving state-of-the-art robustness for RECs.

Original:  T HE A DVERSARIAL R ISK OF A R ANDOMIZED E NSEMBLE C LASSIFIER
Revised:  T HE A DVERSARIAL R ISK OF A R ANDOMIZED E NSEMBLE C LASSIFIER

Original: In this section, we develop our main theoretical findings regarding the adversarial robustness of any randomized ensemble classifier.
Revised: In this section, we develop our main theoretical findings regarding the adversarial robustness of any randomized ensemble classifier.

Original: Detailed proofs of all statements and theorems can be found in
Revised: Detailed proofs of all statements and theorems can be found in

Original: Appendix A.
Revised: Appendix B.

Original: [Figure]
Revised: [Figure]

Original: 3. P ROPERTIES OF η
Revised: 4. P ROPERTIES OF η

Original: We start with the following statement:
Revised: We start with the following statement:

Original: Proposition 1.
Revised: Proposition 1.

Original: For any F = { f i } Mi =1 , perturbation set S ⊂ R d , and data distribution D , the adversarial risk η is a piece-wise linear convex function ∀ α ∈ ∆ M .
Revised: For any F = { f i } Mi =1 , perturbation set S ⊂ R d , and data distribution D , the adversarial risk η is a piece-wise linear convex function ∀ α ∈ ∆ M .

Original: Specifically, ∃ K ∈ N configurations
Revised: Specifically, ∃ K ∈ N configurations

Original: U k ⊆ { 0 , 1 } M ∀ k ∈
Revised: U k ⊆ { 0 , 1 } M ∀ k ∈

Original: [ K ] and p.m.f.
Revised: [ K ] and p.m.f.

Original: p ∈ ∆ K such that:
Revised: p ∈ ∆ K such that:

Original: [Equation]
Revised: [Equation]

Original: Before we explain the intuition behind Proposition 1, we first make the following observations:
Revised: Before we explain the intuition behind Proposition 1, we first make the following observations:

Original: Generality .
Revised: Generality .

Original: Proposition 1 makes no assumptions about the classifiers F , i.e., it applies even to the enigmatic deep nets.
Revised: Proposition 1 makes no assumptions about the classifiers F , i.e., it applies even to the enigmatic deep nets.

Original: While the majority of theoretical results in the literature have been restricted to ℓ p -bounded adversaries, Proposition 1 holds for any closed and bounded perturbation set S .
Revised: While the majority of theoretical results in the literature have been restricted to ℓ p -bounded adversaries, Proposition 1 holds for any closed and bounded perturbation set S .

Original: This is crucial, as real-world attacks are often not restricted to ℓ p balls around the input (Liu et al., 2018; Duan et al., 2020).
Revised: This is crucial, as real-world attacks are often not restricted to ℓ p balls around the input (Liu et al., 2018; Duan et al., 2020).

Original: This generality is further inherited by all of our results, as they build on
Revised: This generality is further inherited by all of our results, as they build on

Original: Proposition 1.
Revised: Proposition 1.

Original: Analytic Form .
Revised: Analytic Form .

Original: Proposition 1 allows us to re-write the adversarial risk in (3) using the analytic form in (4), which is much simpler to analyze and work with.
Revised: Proposition 1 allows us to re-write the adversarial risk in (3) using the analytic form in (4), which is much simpler to analyze and work with.

Original: In fact, the analytic form in (4) enables us to derive our main theoretical results in Sections 3.2 & 3.3, which include tight fundamental bounds on η .
Revised: In fact, the analytic form in (4) enables us to derive our main theoretical results in Sections 4.2 & 4.3, which include tight fundamental bounds on η .

Original: Optimal Sampling .
Revised: Optimal Sampling .

Original: The convexity of η implies that any local minimum α ∗ is also a global minimum.
Revised: The convexity of η implies that any local minimum α ∗ is also a global minimum.

Original: The probability simplex is a closed convex set, thus a global minimum, which need not be unique, is always achievable.
Revised: The probability simplex is a closed convex set, thus a global minimum, which need not be unique, is always achievable.

Original: Since η is piece-wise linear, then there always exists a finite set of candidate solutions for α ∗ .
Revised: Since η is piece-wise linear, then there always exists a finite set of candidate solutions for α ∗ .

Original: For M ≤ 3 , we efficiently enumerate all candidates in Section 3.2, eliminating the need for any sophisticated search method.
Revised: For M ≤ 3 , we efficiently enumerate all candidates in Section 4.2, eliminating the need for any sophisticated search method.

Original: For larger M however, enumeration becomes intractable.
Revised: For larger M however, enumeration becomes intractable.

Original: In Section 3.4, we construct an optimal algorithm for finding α ∗ by leveraging the classic sub-gradient method (Shor, 2012) for optimizing sub-differentiable functions.
Revised: In Section 4.4, we construct an optimal algorithm for finding α ∗ by leveraging the classic sub-gradient method (Shor, 2012) for optimizing sub-differentiable functions.

Original: Intuition .
Revised: Intuition .

Original: Consider a data-point z ∈ R d × [ C ] , then for any δ ∈ S and α ∈ ∆ M we have the per sample risk:
Revised: Consider a data-point z ∈ R d × [ C ] , then for any δ ∈ S and α ∈ ∆ M we have the per sample risk:

Original: [Equation]
Revised: [Equation]

Original: where u ∈ { 0 , 1 } M such that u i = 1 if and only if δ is adversarial to f i at z .
Revised: where u ∈ { 0 , 1 } M such that u i = 1 if and only if δ is adversarial to f i at z .

Original: Since u is independent of α , we thus obtain a many-to-one mapping from δ ∈ S to u ∈ { 0 , 1 } M .
Revised: Since u is independent of α , we thus obtain a many-to-one mapping from δ ∈ S to u ∈ { 0 , 1 } M .

Original: Therefore, for any α and z , we can always decompose the perturbation set S , i.e., S =
Revised: Therefore, for any α and z , we can always decompose the perturbation set S , i.e., S =

Original: G 1 ∪ ... ∪ G n , into n ≤ 2 M subsets, such that: ∀ δ ∈ G j : r ( z , δ , α ) =
Revised: G 1 ∪ ... ∪ G n , into n ≤ 2 M subsets, such that: ∀ δ ∈ G j : r ( z , δ , α ) =

Original: α ⊤ u j for some binary vector u j independent of α .
Revised: α ⊤ u j for some binary vector u j independent of α .

Original: Let
Revised: Let

Original: U = { u j } nj =1 be the collection of these vectors, then we can write:
Revised: U = { u j } nj =1 be the collection of these vectors, then we can write:

Original: [Equation]
Revised: [Equation]

Original: [Figure]
Revised: [Figure]

Original: The main idea behind the equivalence in (6) is that we can represent any configuration of classifiers, data-point and perturbation set using a unique set of binary vectors U .
Revised: The main idea behind the equivalence in (6) is that we can represent any configuration of classifiers, data-point and perturbation set using a unique set of binary vectors U .

Original: For example, Fig. 2 pictorially depicts this equivalence using a case of M = 3 classifiers in R 2 with S =
Revised: For example, Fig. 2 pictorially depicts this equivalence using a case of M = 3 classifiers in R 2 with S =

Original: B 2 ( ϵ ) .
Revised: B 2 ( ϵ ) .

Original: This equivalence is the key behind Proposition 1, since the point-wise max term in (6) is piece-wise linear and convex ∀ α ∈ ∆ M .
Revised: This equivalence is the key behind Proposition 1, since the point-wise max term in (6) is piece-wise linear and convex ∀ α ∈ ∆ M .

Original: Finally, Proposition 1 holds due to the pigeon-hole principle and the linearity of expectation.
Revised: Finally, Proposition 1 holds due to the pigeon-hole principle and the linearity of expectation.

Original: 3. S PECIAL C ASE OF T WO C LASSIFIERS
Revised: 4. S PECIAL C ASE OF T WO C LASSIFIERS

Original: With two classifiers only, we can leverage the analytic form of η in (4) and enumerate all possible classifiers/data-point configurations around S by enumerating all configurations U k ⊆ { 0 , 1 } 2 .
Revised: With two classifiers only, we can leverage the analytic form of η in (4) and enumerate all possible classifiers/data-point configurations around S by enumerating all configurations U k ⊆ { 0 , 1 } 2 .

Original: Specifically, Fig. 3 visualizes all K = 5 such unique configurations, which allows us to write ∀ α 
Revised: Specifically, Fig. 3 visualizes all K = 5 such unique configurations, which allows us to write ∀ α ∈ ∆ 2 :

Original: [Equation]
Revised: [Equation]

Original: where p ∈ ∆ 5 is the p.m.f.
Revised: where p ∈ ∆ 5 is the p.m.f.

Original: of “binning” any data-point z into any of the five configurations, under the data distribution z ∼ D .
Revised: of “binning” any data-point z into any of the five configurations, under the data distribution z ∼ D .

Original: Using (7), we obtain the following result:
Revised: Using (7), we obtain the following result:

Original: Theorem 1.
Revised: Theorem 1.

Original: For any two classifiers f 1 and f 2 with individual adversarial risks η 

Revised: For any two classifiers f 1 and f 2 with individual adversarial risks η

Original: and η 2 , respectively, subject to a perturbation set S ⊂ R d and data distribution D , if:
Revised: and η 2 , respectively, subject to a perturbation set S ⊂ R d and data distribution D , if:

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: then the optimal sampling probability α ∗ =
Revised: then the optimal sampling probability α ∗ =

Original: [ 1 / 2 1 / 2 ] ⊤ uniquely minimizes η ( α ) resulting in η ( α ∗ ) = 12 ( η 1 + η 2 − P { z ∈ R 1 } ) .
Revised: [ 1 / 2 1 / 2 ] ⊤ uniquely minimizes η ( α ) resulting in η ( α ∗ ) = 1 2 ( η 1 + η 2 − P { z ∈ R 1 } ) .

Original: Otherwise, α ∗ ∈ { e 1 , e 2 } minimizes η ( α ) , where e i s are the standard basis vectors of R 2 .
Revised: Otherwise, α ∗ ∈ { e 1 , e 2 } minimizes η ( α ) , where e i s are the standard basis vectors of R 2 .

Original: Theorem 1 provides us with a complete description of how randomized ensembles operate when
Revised: Theorem 1 provides us with a complete description of how randomized ensembles operate when

Original: M = 2 .
Revised: M = 2 .

Original: We discuss its implications below:
Revised: We discuss its implications below:

Original: Interpretation .
Revised: Interpretation .

Original: Theorem 1 states that randomization is guaranteed to help when the condition in (8) is satisfied, i.e., when the probability of data-points z ( P { z ∈ R 1 } ) for which it is possible to find adversarial perturbations that can fool f 1 or f 2 but not both (see configuration 1 in Fig. 3), is greater than the absolute difference ( | η 1 − η 2 | ) of the individual classifiers’ adversarial risks.
Revised: Theorem 1 states that randomization is guaranteed to help when the condition in (8) is satisfied, i.e., when the probability of data-points z ( P { z ∈ R 1 } ) for which it is possible to find adversarial perturbations that can fool f 1 or f 2 but not both (see configuration 1 in Fig. 3), is greater than the absolute difference ( | η 1 − η 2 | ) of the individual classifiers’ adversarial risks.

Original: Consequently, if the adversarial risks of the classifiers are heavily skewed, i.e., | η 1 − η 2 | is large, then randomization is less likely to help, since condition (8) becomes harder to satisfy.
Revised: Consequently, if the adversarial risks of the classifiers are heavily skewed, i.e., | η 1 − η 2 | is large, then randomization is less likely to help, since condition (8) becomes harder to satisfy.

Original: This, in fact, is the case for BAT defense
Revised: This, in fact, is the case for BAT defense

Original: (Pinot et al., 2020) since it generates two classifiers with η 1 < 1 and η 2 = 1 .
Revised: (Pinot et al., 2020) since it generates two classifiers with η 1 < 1 and η 2 = 1 .

Original: Theoremindicates that adversarial defenses should strive to achieve η 1 ≈ η 2 for randomization to be effective.
Revised: Theorem 1 indicates that adversarial defenses should strive to achieve η 1 ≈ η 2 for randomization to be effective.

Revised: In practice, it is very difficult to make P { z ∈ R 1 } very large compared to η 1 and ηdue to transferability of adversarial perturbations.

Original: Optimality Condition .
Revised: Optimality Condition .

Original: In fact, the condition in (8) is actually a necessary and sufficient condition for η ( α ∗ ) < min { η 1 , η 2 } .
Revised: In fact, the condition in (8) is actually a necessary and sufficient condition for η ( α ∗ ) < min { η 1 , η 2 } .

Original: That is, a randomized ensemble of f 1 and f 2 is guaranteed to achieve smaller adversarial risk than either f 1 of f 

Revised: That is, a randomized ensemble of f 1 and f 2 is guaranteed to achieve smaller adversarial risk than either f 1 of f

Original: if and only if (8) holds.
Revised: if and only if (8) holds.

Original: This also implies that it is impossible to have a nontrivial 3 unique global minimizer other than α ∗ =
Revised: This also implies that it is impossible to have a nontrivial 3 unique global minimizer other than α ∗ =

Original: [ 1 / 2 1 / 2 ] ⊤ , which provides3 that is different than e 1 or e further theoretical justification for why the BAT defense in (Pinot et al., 2020) does not work, where α ∗ =
Revised: [ 1 / 2 1 / 2 ] ⊤ , which provides further theoretical justification for why the BAT defense in (Pinot et al., 2020) does not work, where α ∗ =

Original: 1] ⊤ was claimed to be a unique optimum (obtained via sweeping α ).
Revised: 1] ⊤ was claimed to be a unique optimum (obtained via sweeping α ).

Original: Simplified Search .
Revised: Simplified Search .

Original: Theorem 1 eliminates the need for sweeping α to find the optimal sampling probability α ∗ when working with M = 2 classifiers as done in (Pinot et al., 2020;
Revised: Theorem 1 eliminates the need for sweeping α to find the optimal sampling probability α ∗ when working with M = 2 classifiers as done in (Pinot et al., 2020;

Original: Dbouk &
Revised: Dbouk &

Original: Shanbhag, 2022).
Revised: Shanbhag, 2022).

Original: We only need to evaluate η (cid:16) [ 1 / 2 1 / 2 ] ⊤ (cid:17) and check if it is smaller than min { η 1 , η 2 } to choose our optimal sampling probability.
Revised: We only need to evaluate η (cid:16) [ 1 / 2 1 / 2 ] ⊤ (cid:17) and check if it is smaller than min { η 1 , η 2 } to choose our optimal sampling probability.

Original: A similar resultcan be obtained forthe case of M = 3 , which is deferred to Appendix B.1.
Revised: In Appendix C.1, we extend this result for M = 3 . Interestingly, Vorobeychik & Li (2014) derive a similar result for M = 2 for a different problem of an adversary attempting to reverse engineer the defender’s classifier via queries.

Original: Theoretical Limit .
Revised: Theoretical Limit .

Original: From Theorem 1, we can directly obtain a tight bound on the adversarial risk:
Revised: From Theorem 1, we can directly obtain a tight bound on the adversarial risk:

Original: Corollary 1.
Revised: Corollary 1.

Original: For any two classifiers f 1 and f 2 with individual adversarial risks η 

Revised: For any two classifiers f 1 and f 2 with individual adversarial risks η

Original: and η 2 , respectively, perturbation set S , and data distribution D :
Revised: and η 2 , respectively, perturbation set S , and data distribution D :

Original: [Equation]
Revised: [Equation]

Original: In other words, it is impossible for a REC with M = 2 classifiers to achieve a risk smaller than the
Revised: In other words, it is impossible for a REC with M = 2 classifiers to achieve a risk smaller than the

Original: RHS in (10).
Revised: RHS in (10).

Original: In the next section, we derive a more general version of this bound for arbitrary M .
Revised: In the next section, we derive a more general version of this bound for arbitrary M .

Original: 3. T IGHT F UNDAMENTAL B OUNDS
Revised: 4. T IGHT F UNDAMENTAL B OUNDS

Original: A fundamental question remains to be answered: given an ensemble F of M classifiers with adversarial risks η 1 , ..., η M , what is the tightest bound we can provide for the adversarial risk η ( α ) of a randomized ensemble constructed from F ?
Revised: A fundamental question remains to be answered: given an ensemble F of M classifiers with adversarial risks η 1 , ..., η M , what is the tightest bound we can provide for the adversarial risk η ( α ) of a randomized ensemble constructed from F ?

Original: The following theorem answers this question:
Revised: The following theorem answers this question:

Original: Theorem 2.
Revised: Theorem 2.

Original: For a perturbation set S , data distribution D , and collection of M classifiers F with individual adversarial risks η i ( i ∈ [ M ] ) such that 0 < η 1 ≤ ... ≤ η M ≤ 1 , we have ∀ α ∈ ∆ M :
Revised: For a perturbation set S , data distribution D , and collection of M classifiers F with individual adversarial risks η i ( i ∈ [ M ] ) such that 0 < η 1 ≤ ... ≤ η M ≤ 1 , we have ∀ α ∈ ∆ M :

Original: [Equation]
Revised: [Equation]

Original: Both bounds are tight in the sense that if all that is known about the setup F , D , and S is { η i } Mi =1 , then there exist no tighter bounds.
Revised: Both bounds are tight in the sense that if all that is known about the setup F , D , and S is { η i } Mi =1 , then there exist no tighter bounds.

Original: Furthermore, the upper bound is always met if α = e M , and the lower bound (if achievable) can be met if α = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ , where m = arg min k ∈
Revised: Furthermore, the upper bound is always met if α = e M , and the lower bound (if achievable) can be met if α = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ , where m = arg min k ∈

Original: [ M ] { η k k } .
Revised: [ M ] { η k k } .

Original: Upper bound :
Revised: Upper bound :

Original: The upper bound in (11) holds due to the convexity of η (Proposition 1) and the fact ∆ M = H (cid:0) { e i } Mi =1 (cid:1) , where H ( X ) is the convex hull of the set of points X .
Revised: The upper bound in (11) holds due to the convexity of η (Proposition 1) and the fact ∆ M = H (cid:0) { e i } Mi =1 (cid:1) , where H ( X ) is the convex hull of the set of points X .

Original: Implications of upper bound : Intuitively, we expect that a randomized ensemble cannot be worse than the worst performing member (in this case f M ).
Revised: Implications of upper bound : Intuitively, we expect that a randomized ensemble cannot be worse than the worst performing member (in this case f M ).

Original: A direct implication of this is that if all the members have similar robustness η i ≈ η j ∀
Revised: A direct implication of this is that if all the members have similar robustness η i ≈ η j ∀

Original: i, j , then randomized ensembling is guaranteed to either improve or achieve the same robustness.
Revised: i, j , then randomized ensembling is guaranteed to either improve or achieve the same robustness.

Original: In contrast, deterministic ensemble methods that average logits (Zhang et al., 2022; Abernethy et al., 2021; Kariyappa & Qureshi, 2019) do not even satisfy this upper bound (see Appendix B.2).
Revised: In contrast, deterministic ensemble methods that average logits (Zhang et al., 2022; Abernethy et al., 2021; Kariyappa & Qureshi, 2019) do not even satisfy this upper bound (see Appendix C.2).

Original: In other words, there are no worst-case performance guarantees with deterministic ensembling, even if all the classifiers are robust.
Revised: In other words, there are no worst-case performance guarantees with deterministic ensembling, even if all the classifiers are robust.

Original: Lower bound : The main idea behind the proof of the lower bound in (11) is to show that ∀ α ∈ ∆ M :η
Revised: Lower bound : The main idea behind the proof of the lower bound in (11) is to show that ∀ α ∈ ∆ M :

Original: [Equation]
Revised: [Equation]

Original: [Equation]

Original: where η 0 .
Revised: where η 0 .

Original: = 0 , m = arg min k ∈
Revised: = 0 , m = arg min k ∈

Original: [ M ] { η k / k } , and h can be interpreted as the adversarial risk of an REC constructed from an optimal set of classifiers F ′ with the same individual risks as F .
Revised: [ M ] { η k / k } , and h can be interpreted as the adversarial risk of an REC constructed from an optimal set of classifiers F ′ with the same individual risks as F .

Original: We make the following observations:
Revised: We make the following observations:

Original: Implications of lower bound :
Revised: Implications of lower bound :

Original: The lower bound in (11) provides us with a fundamental limit on the adversarial risk of RECs viz.
Revised: The lower bound in (11) provides us with a fundamental limit on the adversarial risk of RECs viz.

Original: , it is impossible for any REC constructed from M classifiers with  sorted risks { η i } Mi =1 to achieve an adversarial risk smaller than min k ∈
Revised: , it is impossible for any REC constructed from M classifiers with 3 that is different than e 1 or e sorted risks { η i } Mi =1 to achieve an adversarial risk smaller than min k ∈

Original: [ M ] { η k / k } = η m / m .
Revised: [ M ] { η k / k } = η m / m .

Original: This limit is not always achievable and generalizes the one in (10) which holds for M = 2 .
Revised: This limit is not always achievable and generalizes the one in (10) which holds for M = 2 .

Original: Theoremstates that if the limit is achievable then the corresponding optimal sampling probability α ∗ = [Equation] m ... [Equation]
Revised: Theoremstates that if the limit is achievable then the corresponding optimal sampling probability α ∗ = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ .

Original: [Equation]

Original: ⊤ .

Original: Note that this does not imply that the optimal sampling probability is always equiprobable sampling ∀F !
Revised: Note that this does not imply that the optimal sampling probability is always equiprobable sampling ∀F !

Original: Additionally, the lower bound in (11) provides guidelines for robustifying individual classifiers in order for randomized ensembling to enhance the overall adversarial risk.
Revised: Additionally, the lower bound in (11) provides guidelines for robustifying individual classifiers in order for randomized ensembling to enhance the overall adversarial risk.

Original: Given classifiers f 1 , ..., f m obtained via any sequential ensemble training algorithm, a good rule of thumb for the classifier obtained via the training iteration m + 1 is to have:
Revised: Given classifiers f 1 , ..., f m obtained via any sequential ensemble training algorithm, a good rule of thumb for the classifier obtained via the training iteration m + 1 is to have:

Original: [Equation]
Revised: [Equation]

Original: Note that only for m = 1 does (13) become a necessary condition: If η 2 > 2 η 1 , then f 1 will always achieve better risk than an REC of f 1 and f 2 .
Revised: Note that only for m = 1 does (13) become a necessary condition: If η 2 > 2 η 1 , then f 1 will always achieve better risk than an REC of f 1 and f 2 .

Original: If a training method generates classifiers f 1 , ..., f M with risks: η 1 < 1 and η i = 1 ∀ i ∈ { 2 , ..., M } , i.e., only the first classifier is somewhat robust and the remaining M − 1 classifiers are compromised (such as BAT), the lower bound in (11) reduces to: 
Revised: If a training method generates classifiers f 1 , ..., f M with risks: η 1 < 1 and η i = 1 ∀ i ∈ { 2 , ..., M } , i.e., only the first classifier is somewhat robust and the remaining M − 1 classifiers are compromised (such as BAT), the lower bound in (11) reduces to: [Equation]

Original: [Equation]
Revised: [Equation]

Original: implying the necessary condition M ≥ ⌈ η − 1 1 ⌉ for RECs constructed from F to achieve better risk than f 1 .
Revised: implying the necessary condition M ≥ ⌈ η − 1 1 ⌉ for RECs constructed from F to achieve better risk than f 1 .

Original: Note: the fact that this condition is violated by (Pinot et al., 2020) hints to the existence of strong attacks that can break it (Zhang et al., 2022; Dbouk & Shanbhag, 2022).
Revised: Note: the fact that this condition is violated by (Pinot et al., 2020) hints to the existence of strong attacks that can break it (Zhang et al., 2022; Dbouk & Shanbhag, 2022).

Original: 3. O PTIMAL S AMPLING
Revised: 4. O PTIMAL S AMPLING

Original: While Section 3.2 provides a simple and elegant solution for finding the optimal sampling probability for M ≤ 3 classifiers, the need for an efficient solution for the general case M > 3 remains.

Original: In this section, we leverage Proposition 1 and provide a theoretically optimal and efficient solution to compute the optimal sampling probability (OSP) algorithm
Revised: In this section, we leverage Proposition 1 to extend the results in Section 4.2 to provide a theoretically optimal and efficient solution for computing the optimal sampling probability (OSP) algorithm

Original: (Algorithm 1).
Revised: (Algorithm 1) for M > 3 .

Original: In practice, we do not know the true data distribution D .
Revised: In practice, we do not know the true data distribution D .

Original: Instead, we are provided a training set z 1 , ..., z n , assumed to be sampled i.i.d.
Revised: Instead, we are provided a training set z 1 , ..., z n , assumed to be sampled i.i.d.

Original: from D .
Revised: from D .

Original: Given the training set, and a fixed collection of classifiers F , we wish to find the optimal sampling probability:
Revised: Given the training set, and a fixed collection of classifiers F , we wish to find the optimal sampling probability:

Original: [Equation]
Revised: [Equation]

Original: Note that the empirical adversarial risk ˆ η is also piece-wise linear and convex in α , and hence all our theoretical results apply naturally.
Revised: Note that the empirical adversarial risk ˆ η is also piece-wise linear and convex in α , and hence all our theoretical results apply naturally.

Original: In order to numerically solve (15), we first require access to an adversarial attack oracle ( attack ) for RECs that solves ∀S , F , z , and α :
Revised: In order to numerically solve (15), we first require access to an adversarial attack oracle ( attack ) for RECs that solves ∀S , F , z , and α :

Original: [Equation]
Revised: [Equation]

Original: Using the oracle attack , Algorithm 1 updates its solution iteratively given the adversarial error-rate of each classifier over the training set.
Revised: Using the oracle attack , Algorithm 1 updates its solution iteratively given the adversarial error-rate of each classifier over the training set.

Original: The projection operator Π ∆ M in Line (15) of Algorithmis necessary to ensure that the solution remains a valid p.m.f.. Wang & Carreira-Perpin´an (2013) provide a simple and exact method for computing Π ∆ M .
Revised: The projection operator Π ∆ M in Line (15) of Algorithmensures that the solution is a valid p.m.f.. Wang & Carreira-Perpin´an (2013) provide a simple and exact method for computing Π ∆ M .

Original: Finally, we state the following result on the optimality of OSP:
Revised: Finally, we state the following result on the optimality of OSP:

Original: Theorem 3.
Revised: Theorem 3.

Original: The OSP algorithm output α T satisfies:
Revised: The OSP algorithm output α T satisfies:

Original: [Equation]
Revised: [Equation]

Original: for all initial conditions α (1) ∈ ∆ M , a > 0 , where α ∗ is a global minimum.
Revised: for all initial conditions α (1) ∈ ∆ M , a > 0 , where α ∗ is a global minimum.

Original: Theorem 3 follows from a direct application of the classic convergence result of the projected subgradient method for constrained convex minimization (Shor (2012)).
Revised: Theorem 3 follows from a direct application of the classic convergence result of the projected subgradient method for constrained convex minimization (Shor (2012)).

Original: The optimality of OSP relies on the existence of an attack oracle for (16) which may not always exist.
Revised: The optimality of OSP relies on the existence of an attack oracle for (16) which may not always exist.

Original: However, attack algorithms such as ARC (Dbouk & Shanbhag (2022)) were found to yield good results in the common setting of differentiable classifiers and ℓ p -restricted adversaries.
Revised: However, attack algorithms such as ARC (Dbouk & Shanbhag (2022)) were found to yield good results in the common setting of differentiable classifiers and ℓ p -restricted adversaries

Original: [Table]
Revised: [Table]

Revised: [Table]

Original: [Table]
Revised: [Table]

Original:  1 , F ← F ∪ { f ( ·| θ m ) } , α ← (cid:2) 1 m ... 1 m (cid:3) ⊤ 6: for e ∈ { 1 ,...,E } do 7: for mini-batch { z b } Bb do 8: compute ∀ b ∈
Revised: , α ) 3: initialize θ 0 ∈ Θ , F ← ∅ 4: for m ∈ { 1 ,...,M } do 5: θ m ← θ m − 1 , F ← F ∪ { f ( ·| θ m ) } , α ← (cid:2) 1 m ... 1 m (cid:3) ⊤ 6: for e ∈ { 1 ,...,E } do 7: for mini-batch { z b } Bb do 8: compute ∀ b ∈

Original: [ B ] : δ b ← attack ( F , S , α , z b ) 9: update θ m via SGD: θ m ← θ m − ρ B B (cid:88) b =1 ∇ θ m l (cid:16) ˜ f
Revised: [ B ] : δ b ← attack ( F , S , α , z b ) 9: update θ m via SGD: θ m ← θ m − ρ B B (cid:88) b =1 ∇ θ m l (cid:16) ˜ f

Original: ( x b + δ b | θ m ) ,y b (cid:17) 10: end for 11: / ∗ update α every E o epochs 12: if e mod E o = 

Revised: ( x b + δ b | θ m ) ,y b (cid:17) 10: end for 11: / ∗ update α every E o epochs 12: if e mod E o =

Original: then α ← OSP ( F , S , { z j } nj =1 ,T o ) 13: end for 14: end for 15: return F , α
Revised: then α ← OSP ( F , S , { z j } nj =1 ,T o ) 13: end for 14: end for 15: return F , α

Original:  A R OBUST B OOSTING A LGORITHM FOR R ANDOMIZED E NSEMBLES
Revised:  A R OBUST B OOSTING A LGORITHM FOR R ANDOMIZED E NSEMBLES

Original: Inspired by BAT (Pinot et al., 2020) and MRBoost (Zhang et al., 2022), we leverage our results in
Revised: Inspired by BAT (Pinot et al., 2020) and MRBoost (Zhang et al., 2022), we leverage our results in

Original: Section 3 and propose BARRE: a unified B oosting A lgorithm for R obust R andomized E nsembles described in Algorithm 2.
Revised: Section 4 and propose BARRE: a unified B oosting A lgorithm for R obust R andomized E nsembles described in Algorithm 2.

Original: Given a dataset { z j } nj =1 and an REC attack algorithm attack , BARRE iteratively trains a set of parametric classifiers f ( ·| θ 1 ) , ..., f ( ·| θ M ) such that the adversarial risk of the corresponding REC is minimized.
Revised: Given a dataset { z j } nj =1 and an REC attack algorithm attack , BARRE iteratively trains a set of parametric classifiers f ( ·| θ 1 ) , ..., f ( ·| θ M ) such that the adversarial risk of the corresponding REC is minimized.

Original: The first iteration of BARRE reduces to standard AT (Madry et al., 2018).
Revised: The first iteration of BARRE reduces to standard AT (Madry et al., 2018).

Original: Doing so typically guarantees that the first classifier achieves the lowest adversarial risk and η ( α ∗ ) ≤ η 1 . That is, thefinal REC cannot be worse than single model AT.
Revised: Doing so typically guarantees that the first classifier achieves the lowest adversarial risk and η ( α ∗ ) ≤ η 1 , i.e., Theorem 3 ensures the REC is no worse than single model AT.

Original: At the start of eachnew iteration m ≥ 2 , BARRE will initialize a new classifier f ( ·| θ m ) with θ m = θ m − 1 .
Revised: In each iteration m ≥ 2 , BARRE initializes the m -th classifier f ( ·| θ m ) with θ m = θ m − 1 .

Original: The training procedure alternates between updating the parameters θ m via SGD using adversarial samples of the current REC and solving for the optimal sampling probability α ∗ ∈
Revised: The training procedure alternates between updating the parameters θ m via SGD using adversarial samples of the current REC and solving for the optimal sampling probability α ∗ ∈

Original: ∆ m via OSP.
Revised: ∆ m via OSP.

Original: Including f ( ·| θ m ) in the attack (Line (8)) is crucial, as it ensures that the robustness of f ( ·| θ m ) is not completely compromised, thereby improving the bounds in Theorem 2.
Revised: Including f ( ·| θ m ) in the attack (Line (8)) is crucial, as it ensures that the robustness of f ( ·| θ m ) is not completely compromised, thereby improving the bounds in Theorem 2.

Original: Note that for iterations m ≤ 3 , we replace the OSP procedure in Line (12) with a simplified search over a finite set of candidate solutions (see Section 3.2 and Appendix B.1).
Revised: Note that for iterations m ≤ 3 , we replace the OSP procedure in Line (12) with a simplified search over a finite set of candidate solutions (see Section 4.2 and Appendix C.1).

Original: 4. E XPERIMENTAL R ESULTS
Revised: 5. E XPERIMENTAL R ESULTS

Original: In this section, weconduct several experiments to validate the effectiveness of BARRE at constructing robust randomized ensemble classifiers.
Revised: In this section, we validate the effectiveness of BARRE in constructing robust RECs.

Original: Setup .
Revised: Setup .

Original: Per standard practice, we focus on defending against ℓ ∞ norm-bounded adversaries.
Revised: Per standard practice, we focus on defending against ℓ ∞ norm-bounded adversaries.

Original: We report results for three network architectures with different complexities:
Revised: We report results for three network architectures with different complexities:

Original: ResNet-20 (He et al., 2016),
Revised: ResNet-20 (He et al., 2016),

Original: MobileNetV1 (Howard et al., 2017), and ResNet-18, across CIFAR-10 and CIFAR-100 datasets (Krizhevsky et al., 2009).
Revised: MobileNetV1 (Howard et al., 2017), and ResNet-18, across CIFAR-10 and CIFAR-100 datasets (Krizhevsky et al., 2009).

Revised: Computational complexity is measured via the number of floating-point operations (FLOPs) required per inference.

Original: To ensure a fair comparison across different baselines, we use the same hyper-parameter settings detailed in Appendix C.1.
Revised: To ensure a fair comparison across different baselines, we use the same hyper-parameter settings detailed in Appendix D.1.

Original: Attack Algorithm .
Revised: Attack Algorithm .

Original: For all our robust evaluations, we will adopt the state-of-the-art ARC algorithm (Dbouk & Shanbhag, 2022) which can be used for both RECs and single models.
Revised: For all our robust evaluations, we will adopt the state-of-the-art ARC algorithm (Dbouk & Shanbhag, 2022) which can be used for both RECs and single models.

Original: Specifically, we shall use a slightly modified version that achieves better results in the equiprobable sampling setting (see Appendix C.3).
Revised: Specifically, we shall use a slightly modified version that achieves better results in the equiprobable sampling setting (see Appendix D.3).

Original: For training with BARRE, wefind that using ARC (Line (8)) leads to severe overfitting, and instead adopt adaptive PGD (Zhang et al., 2022) for better generalization performance (see Appendix C.4).
Revised: For training with BARRE, we adopt adaptive PGD (Zhang et al., 2022) for better generalization performance (see Appendix D.4).

Original: Benefit of Randomization .
Revised: Benefit of Randomization .

Original: Table 1 demonstrates that BARRE can successfully construct RECs that achieve competitive robustness (within ∼ 0 .
Revised: Table 1 demonstrates that BARRE can successfully construct RECs that achieve competitive robustness (within ∼ 0 .

Original: compared to MRBoost-trained deterministicensembles, across three different network architectures on CIFAR-10. The benefit of randomization
Revised: compared to MRBoost-trained deterministic

Original: [Table]
Revised: [Table]

Original: [Table]
Revised: ensembles, across three different network architectures on CIFAR-10.

Original:  can be seen for M ≥ 2 , as we obtain massive 2 − 4 × savings in compute requirements.
Revised: The benefit of randomization can be seen for M ≥ 2 , as we obtain massive 2 − 4 × savings in compute requirements.

Original: Note that both methods have the same 4 memory footprint.
Revised: Note that both methods have the same 4 memory footprint.

Original: These observations are further corroborated by
Revised: These observations are further corroborated by

Original: CIFAR-100 experiments in Appendix C.5.
Revised: CIFAR-100 experiments in Appendix D.5.

Revised: [Table]

Original: BARRE vs. Other Methods .
Revised: BARRE vs. Other Methods .

Original: Due to the lack of dedicated randomized ensemble defenses, we establish baselines by constructing RECs from both MRBoost and independently adversarially trained (IAT) models.
Revised: Due to the lack of dedicated randomized ensemble defenses, we establish baselines by constructing RECs from both MRBoost and independently adversarially trained (IAT) models.

Original: We use OSP (Algorithm 1) to find the optimal sampling probability for each REC.
Revised: We use OSP (Algorithm 1) to find the optimal sampling probability for each REC.

Original: All RECs share the same first classifier f 1 , which is adversarially trained.
Revised: All RECs share the same first classifier f 1 , which is adversarially trained.

Original: Doing so ensures a fair comparison, and guarantees all the methods cannot be worse than AT.
Revised: Doing so ensures a fair comparison [Table] and guarantees all the methods cannot be worse than AT.

Original: Table 2reports both the natural and robust accuracies of all RECs across both CIFAR-10 and CIFAR-100 datasets, and provides strong evidence that BARRE outperforms both IAT and MRBoost when it comes to robust RECs.
Revised: Table 2 provides strong evidence that BARRE outperforms both IAT and MRBoost for both CIFAR-10 and CIFAR-100 datasets.

Original: Interestingly, we find that MRBoost ensembles can be quite ill-suited for RECs.
Revised: Interestingly, we find that MRBoost ensembles can be quite ill-suited for RECs.

Original: This can be seen for
Revised: This can be seen for

Original: MobileNetV1, where the optimal sampling probability obtained was α ∗ =
Revised: MobileNetV1, where the optimal sampling probability obtained was α ∗ =

Original: 25 0] ⊤ , i.e., the REC completely disregards the last classifier.
Revised: 25 0] ⊤ , i.e., the REC completely disregards the last classifier.

Original: In contrast, BARRE-trained RECs utilize all members of the ensemble.
Revised: In contrast, BARRE-trained RECs utilize all members of the ensemble.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: We have demonstrated both theoretically and empirically that robust randomized ensemble classifiers (RECs) are realizable.
Revised: We have demonstrated both theoretically and empirically that robust randomized ensemble classifiers (RECs) are realizable.

Original: Theoretically, we derive the robustness limits of RECs, necessary and sufficient conditions for them to be useful, and efficient methods for finding the optimal sampling probability.
Revised: Theoretically, we derive the robustness limits of RECs, necessary and sufficient conditions for them to be useful, and efficient methods for finding the optimal sampling probability.

Original: Empirically, we propose BARRE, a new boosting algorithm for constructing robust
Revised: Empirically, we propose BARRE, a new boosting algorithm for constructing robust

Original: RECs and demonstrate its effectiveness at defending against strong ℓ ∞ norm-bounded adversaries.
Revised: RECs and demonstrate its effectiveness at defending against strong ℓ ∞ norm-bounded adversaries.

Original: A O MITTED P ROOFS AND D ERIVATIONS A. P ROOF OF P ROPOSITION
Revised: A T HEORETICAL R ATIONALE FOR BARRE

Revised: In this section, we expand on Section 5.1 and provide a more detailed rationale behind the steps in BARRE. Given a dataset { z j } nj =1 and an REC attack algorithm attack , BARRE iteratively trains a set of parametric classifiers f ( ·| θ 1 ) , ..., f ( ·| θ M ) in a boosting fashion.

Revised: Note that the optimality of OSP (Theorem 3) implies that a BARRE-trained REC is guaranteed to achieve better or the same performance than the BEST performing member of the ensemble.

Revised: This explains the choice of boosting for BARRE, since the first iteration reduces to standard AT, the most effective method to date for generating robust classifiers.

Revised: Thus, BARRE trained RECs are guaranteed to perform better than AT.

Revised: In each iteration m ≥ 2 , BARRE initializes the m -th classifier f ( ·| θ m ) with θ m = θ m − 1 .

Revised: The training procedure alternates between updating the parameters θ m via SGD using adversarial samples of the current REC and solving for the optimal sampling probability α ∗ ∈

Revised: ∆ m via OSP.

Revised: Including f ( ·| θ m ) in the attack (Line (8)) is crucial, as it ensures that the robustness of f ( ·| θ m ) is not completely compromised, thereby improving the bounds in Theorem 2.

Revised: Furthermore, the rationale behind the sequence of steps in BARRE can be better understood using

Revised: Theorem 1 (for the case of M = 2 ).

Revised: Theorem 1 states that the optimal REC adversarial risk would be η ( α ∗ )

Revised: = 12 ( η 1 + η 2 − P

Revised: z ∈ R 1 } )

Revised: (assuming (8) is met), therefore it is equally important to minimize both η ’s and maximize P { z ∈ R 1 } .

Revised: BARRE does so by initially adversarially training a robust classifier f 1 (minimizing η 1 ), then training f 2 (initialized from f 1 to minimizes η 2 ) on the adversarial examples of the REC of f 1 and f 2 .

Revised: Doing so increases P { z ∈ R 1 } while maintaining η 2 as low as possible.

Revised: B O MITTED P ROOFS AND D ERIVATIONS B. P ROOF OF P ROPOSITION

Original: We provide the proof of Proposition 1 (restated below):
Revised: We provide the proof of Proposition 1 (restated below):

Original: Proposition (Restated) .
Revised: Proposition (Restated) .

Original: For any F = { f i } Mi =1 , perturbation set S ⊂ R d , and data distribution
Revised: For any F = { f i } Mi =1 , perturbation set S ⊂ R d , and data distribution

Original: D , the adversarial risk η is a piece-wise linear convex function ∀ α ∈ ∆ M .
Revised: D , the adversarial risk η is a piece-wise linear convex function ∀ α ∈ ∆ M .

Original: Specifically, ∃ K ∈ N configurations U k ⊆ { 0 , 1 } M ∀ k ∈
Revised: Specifically, ∃ K ∈ N configurations U k ⊆ { 0 , 1 } M ∀ k ∈

Original: [ K ] and p.m.f.
Revised: [ K ] and p.m.f.

Original: p ∈ ∆ K such that:
Revised: p ∈ ∆ K such that:

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: Consider having one data-point z ∈ R d × [ C ] , then for any δ ∈ S and α ∈ ∆ M we have:
Revised: Consider having one data-point z ∈ R d × [ C ] , then for any δ ∈ S and α ∈ ∆ M we have:

Original: [Equation]
Revised: [Equation]

Original: where u ∈ { 0 , 1 } M such that u i = 1 if and only if δ is adversarial to f i at z .
Revised: where u ∈ { 0 , 1 } M such that u i = 1 if and only if δ is adversarial to f i at z .

Original: Since u is independent of α , we thus obtain a many-to-one mapping from δ ∈ S to u ∈ { 0 , 1 } M .
Revised: Since u is independent of α , we thus obtain a many-to-one mapping from δ ∈ S to u ∈ { 0 , 1 } M .

Original: Therefore, for any α and z , we can always decompose the perturbation set S , i.e., S =
Revised: Therefore, for any α and z , we can always decompose the perturbation set S , i.e., S =

Original: G 1 ∪ ... ∪ G n , into n ≤ 2 M subsets, such that: ∀ δ ∈ G j : r ( z , δ , α ) =
Revised: G 1 ∪ ... ∪ G n , into n ≤ 2 M subsets, such that: ∀ δ ∈ G j : r ( z , δ , α ) =

Original: α ⊤ u j for some binary vector u j independent of α .
Revised: α ⊤ u j for some binary vector u j independent of α .

Original: Let
Revised: Let

Original: U = { u j } nj =1 be the collection of these vectors, then we can write:
Revised: U = { u j } nj =1 be the collection of these vectors, then we can write:

Original: [Equation]
Revised: [Equation]

Original: The vectors { u j } nj =1 define a unique classifier and data-point configuration that is independent of the sampling probability.
Revised: The vectors { u j } nj =1 define a unique classifier and data-point configuration that is independent of the sampling probability.

Original: The function max δ r is thus convex and piece-wise linear in α .
Revised: The function max δ r is thus convex and piece-wise linear in α .

Original: Partitioning the data-point space R ⊆
Revised: Partitioning the data-point space R ⊆

Original: R d × [ C ] into K subsets R = R 1 ∪ ... ∪ R K such that all the data-points z ∈ R k share the same set “configuration” U k , we obtain:
Revised: R d × [ C ] into K subsets R = R 1 ∪ ... ∪ R K such that all the data-points z ∈ R k share the same set “configuration” U k , we obtain:

Original: [Equation]
Revised: [Equation]

Original: where the total size of the partition K is finite (exponential in the size M ) and
Revised: where the total size of the partition K is finite (exponential in the size M ) and

Original: p ∈ ∆ K such that p k = P { z ∈ R k } .
Revised: p ∈ ∆ K such that p k = P { z ∈ R k } .

Original: Finally, η is convex and piece-wise linear in α since the summation of convex and piece-wise linear functions is also convex and piece-wise linear.
Revised: Finally, η is convex and piece-wise linear in α since the summation of convex and piece-wise linear functions is also convex and piece-wise linear.

Original: A. P ROOF OF T HEOREM
Revised: B. P ROOF OF T HEOREM

Original: First, we state and prove this useful lemma:
Revised: First, we state and prove this useful lemma:

Original: Lemma 1.
Revised: Lemma 1.

Original: Let h : R → R be a convex piece-wise linear, hence sub-differentiable, function of the form:
Revised: Let h : R → R be a convex piece-wise linear, hence sub-differentiable, function of the form:

Original: [Equation]
Revised: [Equation]

Original: such that a 1 < a 2 .
Revised: such that a 1 < a 2 .

Original: We wish to minimize h over x ∈ [ c, d ] where c ≤ y ≤ d , and y is the intersection point b 2 − b 1 a 1 − a 2 .
Revised: We wish to minimize h over x ∈ [ c, d ] where c ≤ y ≤ d , and y is the intersection point b 2 − b 1 a 1 − a 2 .

Original: Then, the optimal value x ∗ that minimizes h ( x ) in (22) , is given by
Revised: Then, the optimal value x ∗ that minimizes h ( x ) in (22) , is given by

Original: [Equation]
Revised: [Equation]

Original: Note: only in the first case is the solution unique.
Revised: Note: only in the first case is the solution unique.

Original: Proof.
Revised: Proof.

Original: From constrained convex optimization (Boyd et al.
Revised: From constrained convex optimization (Boyd et al.

Original: ; Shor (2012)), we know that x ∗ is the minimizer of h over [ c, d ] if there exists a sub-gradient g ∈ ∂h ( x ∗ ) such that:
Revised: ; Shor (2012)), we know that x ∗ is the minimizer of h over [ c, d ] if there exists a sub-gradient g ∈ ∂h ( x ∗ ) such that:

Original: [Equation]
Revised: [Equation]

Original: For x ̸ = y , h is differentiable with ∇ h = a 3 + a 1 (if x < y ) or ∇ h = a 3 + a 2 (if x > y ), and for x = y
Revised: For x ̸ = y , h is differentiable with ∇ h = a 3 + a 1 (if x < y ) or ∇ h = a 3 + a 2 (if x > y ), and for x = y

Original: the sub-differential is given by ∂h ( y )
Revised: the sub-differential is given by ∂h ( y )

Original: = { a
Revised: = { a

Original: [Equation]
Revised: [Equation]

Original: + βa
Revised: + βa

Original: [Equation]
Revised: [Equation]

Original: + (
Revised: + (

Original: [Equation]
Revised: [Equation]

Original: : β ∈ [0 , 1] } .
Revised: : β ∈ [0 , 1] } .

Original: If a 3 ∈ ( − a 2 , − a 1 ) , then ∃ β ∈ [0 , 1] such that a 3 + βa 1 + (1 − β ) a 2 = 0 , and thus 0 ∈ ∂h
Revised: If a 3 ∈ ( − a 2 , − a 1 ) , then ∃ β ∈ [0 , 1] such that a 3 + βa 1 + (1 − β ) a 2 = 0 , and thus 0 ∈ ∂h

Original: ( y ) , which is a sufficient condition for global minimization, thus x ∗ =
Revised: ( y ) , which is a sufficient condition for global minimization, thus x ∗ =

Original: y .
Revised: y .

Original: Furthermore, x ∗ =
Revised: Furthermore, x ∗ =

Original: y is unique, since ∀ x ̸
Revised: y is unique, since ∀ x ̸

Original: = y , we will have ∇ h = a 1 + a 3 < 0 (if x < y ) or ∇ h = a 2 + a 3 > 0 (if x > y ) which in both cases implies ∀ z ̸
Revised: = y , we will have ∇ h = a 1 + a 3 < 0 (if x < y ) or ∇ h = a 2 + a 3 > 0 (if x > y ) which in both cases implies ∀ z ̸

Original: = y ∃ x ∈ [ c, d ] such that ∇ h ( z )( x − z ) < 0 .
Revised: = y ∃ x ∈ [ c, d ] such that ∇ h ( z )( x − z ) < 0 .

Original: If a 3 / ∈ ( − a 2 , − a 1 ) , then either a 3 ≥ − a 1 or a 3 ≤ − a 2 .
Revised: If a 3 / ∈ ( − a 2 , − a 1 ) , then either a 3 ≥ − a 1 or a 3 ≤ − a 2 .

Original: If a 3 ≥ − a 1 , then a 1 + a 3 = ∇ h ( c ) ≥ 0 , which implies that: ( a 1 + a 3 )( x − c ) ≥ 0 ∀ x ∈ [ c, d ] , hence x ∗ = c .
Revised: If a 3 ≥ − a 1 , then a 1 + a 3 = ∇ h ( c ) ≥ 0 , which implies that: ( a 1 + a 3 )( x − c ) ≥ 0 ∀ x ∈ [ c, d ] , hence x ∗ = c .

Original: Otherwise if a 3 ≤ − a 2 , then a 2 + a 3 = ∇ h ( d ) ≤ 0 , which implies that: ( a 2 + a 3 )( x − d ) ≥ 0 ∀ x ∈ [ c, d ] , hence x ∗ = d .
Revised: Otherwise if a 3 ≤ − a 2 , then a 2 + a 3 = ∇ h ( d ) ≤ 0 , which implies that: ( a 2 + a 3 )( x − d ) ≥ 0 ∀ x ∈ [ c, d ] , hence x ∗ = d .

Original: We now provide the proof of Theorem 1 (restated below):
Revised: We now provide the proof of Theorem 1 (restated below):

Original: Theorem (Restated) .
Revised: Theorem (Restated) .

Original: For any two classifiers f 1 and f 2 with individual adversarial risks η 

Revised: For any two classifiers f 1 and f 2 with individual adversarial risks η

Original: and η 2 , respectively, subject to a perturbation set S ⊂ R d and data distribution D , if:
Revised: and η 2 , respectively, subject to a perturbation set S ⊂ R d and data distribution D , if:

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: then the optimum sampling probability α ∗ =
Revised: then the optimum sampling probability α ∗ =

Original: ( 1 / 2 , 1 / 2 ) ⊤ uniquely minimizes η ( α ) resulting in η ( α ∗ )
Revised: ( 1 / 2 , 1 / 2 ) ⊤ uniquely minimizes η ( α ) resulting in η ( α ∗ )

Original: = 12 ( η 1 + η 2 − P
Revised: = 12 ( η 1 + η 2 − P

Original: z ∈ R 1 } ) .
Revised: z ∈ R 1 } ) .

Original: Otherwise, α ∗ ∈ { e 1 , e 2 } minimizes η ( α ) , where e i s are the standard basis vectors of R 2 .
Revised: Otherwise, α ∗ ∈ { e 1 , e 2 } minimizes η ( α ) , where e i s are the standard basis vectors of R 2 .

Original: Proof.
Revised: Proof.

Original: We know that, for M = 2 , the adversarial risk η can be re-written ∀ α ∈ ∆ 2 :
Revised: We know that, for M = 2 , the adversarial risk η can be re-written ∀ α ∈ ∆ 2 :

Original: [Equation]
Revised: [Equation]

Original: (26) where p k = P { z ∈ R k } , and the regions {R k } Kk =1 partition the input space R d × [ C ] as follows:
Revised: (26) where p k = P { z ∈ R k } , and the regions {R k } Kk =1 partition the input space R d × [ C ] as follows:

Original: [Equation]
Revised: [Equation]

Original: Using α 1 = 1 − α 

Revised: Using α 1 = 1 − α

Original: = α , we have ∀ α ∈ [0 , 1] :
Revised: = α , we have ∀ α ∈ [0 , 1] :

Original: [Equation]
Revised: [Equation]

Original: where we wish to find α ∗ ∈ [0 , 1] that minimizes h ( α ) .
Revised: where we wish to find α ∗ ∈ [0 , 1] that minimizes h ( α ) .

Original: Applying Lemma 1 with:
Revised: Applying Lemma 1 with:

Original: [Equation]
Revised: [Equation]

Original: and utilizing η 1 = η ( e 1 )
Revised: and utilizing η 1 = η ( e 1 )

Original: =
Revised: =

Original: p 1 + p 2 + p 3 and η 2 = η ( e 2 )
Revised: p 1 + p 2 + p 3 and η 2 = η ( e 2 )

Original: = p 1 + p 2 + p 4 , yields the main result.
Revised: = p 1 + p 2 + p 4 , yields the main result.

Original: A. P ROOF OF C OROLLARY
Revised: B. P ROOF OF C OROLLARY

Original: We provide the proof of Corollary 1 (restated below):
Revised: We provide the proof of Corollary 1 (restated below):

Original: Corollary.
Revised: Corollary.

Original: For any two classifiers f 1 and f 2 with individual adversarial risks η 

Revised: For any two classifiers f 1 and f 2 with individual adversarial risks η

Original: and η 2 , respectively, perturbation set S , and data distribution D :
Revised: and η 2 , respectively, perturbation set S , and data distribution D :

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: From Theorem 1, we have that:
Revised: From Theorem 1, we have that:

Original: [Equation]
Revised: [Equation]

Original: Using the tight upper bound on P { z ∈ R 1 } ≤ min { η 1 , η 2 } , we obtain the main result.
Revised: Using the tight upper bound on P { z ∈ R 1 } ≤ min { η 1 , η 2 } , we obtain the main result.

Original: A. P ROOF OF T HEOREMA.4. U SEFUL L EMMAS
Revised: B. P ROOF OF T HEOREMB.4. U SEFUL L EMMAS

Original: We first state and prove a few useful lemmas that are vital for proving Theorem 2.
Revised: We first state and prove a few useful lemmas that are vital for proving Theorem 2.

Original: While some lemmas are trivial and have been proven elsewhere, we nonetheless state their proofs for completeness.
Revised: While some lemmas are trivial and have been proven elsewhere, we nonetheless state their proofs for completeness.

Original: Lemma 2.
Revised: Lemma 2.

Original: Let h : R n → R be a convex function, and H ( X ) ⊂
Revised: Let h : R n → R be a convex function, and H ( X ) ⊂

Original: R n be the convex hull of X = { x 1 , ..., x d } where { x i } di =1 ∈ R n , then there exists x m ∈ X such that:
Revised: R n be the convex hull of X = { x 1 , ..., x d } where { x i } di =1 ∈ R n , then there exists x m ∈ X such that:

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: Let u be any arbitrary vector in H ( X ) , that is ∃ α ∈ ∆ d :
Revised: Let u be any arbitrary vector in H ( X ) , that is ∃ α ∈ ∆ d :

Original: [Equation]
Revised: [Equation]

Original: Let m ∈
Revised: Let m ∈

Original: [ d ] such that h ( x m ) ≥ h ( x i ) ∀ i ∈ [ d ] .
Revised: [ d ] such that h ( x m ) ≥ h ( x i ) ∀ i ∈ [ d ] .

Original: From the convexity of h , we upper bound h ( u ) as follows:
Revised: From the convexity of h , we upper bound h ( u ) as follows:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Thus, (32) holds for any u ∈ H ( X ) .
Revised: Thus, (32) holds for any u ∈ H ( X ) .

Original: Lemma 3 (Redistribution Lemma) .
Revised: Lemma 3 (Redistribution Lemma) .

Original: ∀ p, q such that 0 ≤ p ≤ q ≤ 1 , ∀ α ∈ ∆ M , and ∀I , J ⊆
Revised: ∀ p, q such that 0 ≤ p ≤ q ≤ 1 , ∀ α ∈ ∆ M , and ∀I , J ⊆

Original: [ M ] such that I / ∈ J / ∈
Revised: [ M ] such that I / ∈ J / ∈

Original: I we have:
Revised: I we have:

Original: [Equation]
Revised: [Equation]

Original: Proof.
Revised: Proof.

Original: [Equation]
Revised: [Equation]

Original: where (a) holds because the maximum over
Revised: where (a) holds because the maximum over

Original: I ∪ J is either α i ∗ or α j ∗ , and (b) holds since the smallest of the two maximizers cannot be smaller than the maximizer of the smaller set
Revised: I ∪ J is either α i ∗ or α j ∗ , and (b) holds since the smallest of the two maximizers cannot be smaller than the maximizer of the smaller set

Original: I ∩ J .
Revised: I ∩ J .

Original: Lemma 4.
Revised: Lemma 4.

Original: Let { f i } Mi =1 be an arbitrary collection of C -ary classifiers with individual adversarial risks η i such that 0 < η 1 ≤ ... ≤ η M ≤ 1 .
Revised: Let { f i } Mi =1 be an arbitrary collection of C -ary classifiers with individual adversarial risks η i such that 0 < η 1 ≤ ... ≤ η M ≤ 1 .

Original: For any data distribution D and perturbation set S we have ∀ α ∈ ∆ M :
Revised: For any data distribution D and perturbation set S we have ∀ α ∈ ∆ M :

Original: [Equation]
Revised: [Equation]

Original: where η 0 .
Revised: where η 0 .

Original: = 0 .
Revised: = 0 .

Original: Proof.
Revised: Proof.

Original: From Proposition 1 we know that ∃ K ∈ N , p ∈ ∆ K , and U k ⊆ { 0 , 1 } M ∀ k ∈
Revised: From Proposition 1 we know that ∃ K ∈ N , p ∈ ∆ K , and U k ⊆ { 0 , 1 } M ∀ k ∈

Original: [ K ] such that:
Revised: [ K ] such that:

Original: [Equation]
Revised: [Equation]

Original: Let L k ⊆
Revised: Let L k ⊆

Original: [ M ] represent the set of classifier indices
Revised: [ M ] represent the set of classifier indices

Original: i 1 , ..., i n that are active in the configuration U k , that is: m ∈
Revised: i 1 , ..., i n that are active in the configuration U k , that is: m ∈

Original: L k ⇐⇒ ∃ v ∈ U k such that v m =(39)
Revised: L k ⇐⇒ ∃ v ∈ U k such that v m =(39)

Original: We then lower bound η as follows:
Revised: We then lower bound η as follows:

Original: [Equation]
Revised: [Equation]

Original: The bound trivially holds, since the sum of positive numbers is always larger than any summand.
Revised: The bound trivially holds, since the sum of positive numbers is always larger than any summand.

Original: It is noteworthy to point out that the RHS quantity η ′ ( α ) can be interpreted as the adversarial risk of an auxiliary set of classifiers F ′ with same individual risks { η i } such that for any z ∈ R d × [ C ] , the classifiers have no common adversarial perturbations, i.e.:
Revised: It is noteworthy to point out that the RHS quantity η ′ ( α ) can be interpreted as the adversarial risk of an auxiliary set of classifiers F ′ with same individual risks { η i } such that for any z ∈ R d × [ C ] , the classifiers have no common adversarial perturbations, i.e.:

Original: [Equation]
Revised: [Equation]

Original: and:
Revised: and:

Original: [Equation]
Revised: [Equation]

Original: Assume that the conditions of Lemma 3 are met by two terms in η ′ , i.e., ∃ k 1 ,
Revised: Assume that the conditions of Lemma 3 are met by two terms in η ′ , i.e., ∃ k 1 ,

Original: k 2 ∈ [ K ] such that
Revised: k 2 ∈ [ K ] such that

Original: L k 1 / ∈ L k 2 / ∈
Revised: L k 1 / ∈ L k 2 / ∈

Original: L k 1 and p k 1 ≤ p k 2 , then we can apply the bound in Lemma 3 and obtain:
Revised: L k 1 and p k 1 ≤ p k 2 , then we can apply the bound in Lemma 3 and obtain:

Original: [Equation]
Revised: [Equation]

Original: where η ′′ ( α ) is the modified ensemble adversarial risk.
Revised: where η ′′ ( α ) is the modified ensemble adversarial risk.

Original: The application of Lemma 3 can be understood as a way to “re-distribute” the classifiers’ adversarial vulnerabilities while preserving the adversarial risk identities ∀ i ∈
Revised: The application of Lemma 3 can be understood as a way to “re-distribute” the classifiers’ adversarial vulnerabilities while preserving the adversarial risk identities ∀ i ∈

Original: [ M ] :
Revised: [ M ] :

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: The main idea of this proof is to keep applying Lemma 3 to the modified ensemble adversarial risks (if possible) to obtain a better lower bound.
Revised: The main idea of this proof is to keep applying Lemma 3 to the modified ensemble adversarial risks (if possible) to obtain a better lower bound.

Original: The process stops when the conditions are no longer met, and we obtain an adversarial risk h ( α ) :
Revised: The process stops when the conditions are no longer met, and we obtain an adversarial risk h ( α ) :

Original: [Equation]
Revised: [Equation]

Original: Without loss of generality, we will assume that {J k } are distinct and q k ̸ = 0 .
Revised: Without loss of generality, we will assume that {J k } are distinct and q k ̸ = 0 .

Original: Furthermore, since the conditions of Lemma 3 cannot be met by any two sets in {J k } , we must have (up to a re-ordering of the indices):
Revised: Furthermore, since the conditions of Lemma 3 cannot be met by any two sets in {J k } , we must have (up to a re-ordering of the indices):

Original: [Equation]
Revised: [Equation]

Original: We now make the following observations:
Revised: We now make the following observations:

Original: Due to (46), we have that L ≤ M and for all i ∈
Revised: Due to (46), we have that L ≤ M and for all i ∈

Original: [ M ] , ∃ m i ∈
Revised: [ M ] , ∃ m i ∈

Original: [ L ] such that:
Revised: [ L ] such that:

Original: [Equation]
Revised: [Equation]

Original: Since { η i } are sorted, we get that
Revised: Since { η i } are sorted, we get that

Original: m i +

Revised: m i +

Original: = m i
Revised: = m i

Original: + 1 if η i < η
Revised: + 1 if η i < η

Original: i +

Revised: i +

Original: or m i +

Revised: or m i +

Original: = m i otherwise 3.
Revised: = m i otherwise 3.

Original: J 1 =
Revised: J 1 =

Original: [ M ] since η 1 ̸ =4.
Revised: [ M ] since η 1 ̸ =4.

Original: For any two consecutive sets J k and J k +1 , we can always find n ≥ 1 indices from [ M ] such that J k
Revised: For any two consecutive sets J k and J k +1 , we can always find n ≥ 1 indices from [ M ] such that J k

Original: =
Revised: =

Original: J k +1 ∪ { i 1 , ..., i n } .
Revised: J k +1 ∪ { i 1 , ..., i n } .

Original: The indices i 1 , ..., i n are consecutive, share the same m i (i.e., η i l is the same for all l ∈ [ n ] ), and also satisfy:
Revised: The indices i 1 , ..., i n are consecutive, share the same m i (i.e., η i l is the same for all l ∈ [ n ] ), and also satisfy:

Original: [Equation]
Revised: [Equation]

Original: We first prove the lemma for the special case of distinct risks, i.e. η i < η i +1 ∀ i .
Revised: We first prove the lemma for the special case of distinct risks, i.e. η i < η i +1 ∀ i .

Original: Special Case .
Revised: Special Case .

Original: The risks are distinct, then we must have L = M , with every two consecutive sets
Revised: The risks are distinct, then we must have L = M , with every two consecutive sets

Original: J k and J k +1 differing by one index.
Revised: J k and J k +1 differing by one index.

Original: Therefore we have J k =
Revised: Therefore we have J k =

Original: J k +1 ∪ { k } and J M +1 = ∅ .
Revised: J k +1 ∪ { k } and J M +1 = ∅ .

Original: Furthermore, we will get η i − η i − 1 =
Revised: Furthermore, we will get η i − η i − 1 =

Original: q
Revised: q

Original: i ∀ i ∈
Revised: i ∀ i ∈

Original: [ M ] with η 0 = 0 .
Revised: [ M ] with η 0 = 0 .

Original: Thus we can write:
Revised: Thus we can write:

Original: [Equation]
Revised: [Equation]

Original: General Case .
Revised: General Case .

Original: For the general case we will have L ≤ M distinct risks η i 1 < ... <
Revised: For the general case we will have L ≤ M distinct risks η i 1 < ... <

Original: η i L and M − L repeated risks, where i 1 = 1 .
Revised: η i L and M − L repeated risks, where i 1 = 1 .

Original: Thus we have q k =
Revised: Thus we have q k =

Original: η
Revised: η

Original: i k − η i k − 1 ∀ k ∈
Revised: i k − η i k − 1 ∀ k ∈

Original: [ L ] , and η i 

Revised: [ L ] , and η i

Original: =
Revised: =

Original: η 0 = 0 by definition.
Revised: η 0 = 0 by definition.

Original: Using observations 3 and 4, we have that J k
Revised: Using observations 3 and 4, we have that J k

Original: = { u k , ..., M } for some index u k ∈ [ M ] , with u 1 = 1 .
Revised: = { u k , ..., M } for some index u k ∈ [ M ] , with u 1 = 1 .

Original: Thus we have u k +

Revised: Thus we have u k +

Original: −
Revised: −

Original: u k − 1 ≥ 0 to be the number of of consecutive repeated risks equal to η i k .
Revised: u k − 1 ≥ 0 to be the number of of consecutive repeated risks equal to η i k .

Original: Let {J ′ k } be the M − L index sets missing from { i ∈ [ M ] : { i, ..., M }} , then we have:
Revised: Let {J ′ k } be the M − L index sets missing from { i ∈ [ M ] : { i, ..., M }} , then we have:

Original: [Equation]
Revised: [Equation]

Original: where (a) holds due to the fact η i − η i − 1 = 0 for all the merged M − L terms.
Revised: where (a) holds due to the fact η i − η i − 1 = 0 for all the merged M − L terms.

Original: Lemma 5.
Revised: Lemma 5.

Original: Given a sequence { γ i } Mi =0 such that 0 = γ 0 < γ 1 ≤ ... ≤ γ M ≤ 1 , the vector α ∗ = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ ∈ ∆ M is a solution to the following minimization problem:
Revised: Given a sequence { γ i } Mi =0 such that 0 = γ 0 < γ 1 ≤ ... ≤ γ M ≤ 1 , the vector α ∗ = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ ∈ ∆ M is a solution to the following minimization problem:

Original: [Equation]
Revised: [Equation]

Original: where γ m m ≤ γ
Revised: where γ m m ≤ γ

Original: i
Revised: i

Original: i , ∀ i ∈
Revised: i , ∀ i ∈

Original: [ M ] .
Revised: [ M ] .

Original: Proof.
Revised: Proof.

Original: We know that h is a piece-wise linear convex function over a closed and convex set, which implies the existence of a global minimizer.
Revised: We know that h is a piece-wise linear convex function over a closed and convex set, which implies the existence of a global minimizer.

Original: Define the mapping g : ∆ M → [0 , 1] M such that ∀ i ∈
Revised: Define the mapping g : ∆ M → [0 , 1] M such that ∀ i ∈

Original: [ M ] :
Revised: [ M ] :

Original: [Equation]
Revised: [Equation]

Original: We can re-write the function h via a simple re-arrangement to obtain:
Revised: We can re-write the function h via a simple re-arrangement to obtain:

Original: [Equation]
Revised: [Equation]

Original: Define the decomposition over the probability simplex: ∆ M = ∆ 1 M ∪ ∆ 2 M ∪ ... ∪ ∆ M !
Revised: Define the decomposition over the probability simplex: ∆ M = ∆ 1 M ∪ ∆ 2 M ∪ ... ∪ ∆ M !

Original: M , where ∀ n ∈ [ M !] , ∃ i 1 , i 2 , ..., i M such that ∀ α ∈ ∆ nM we have:
Revised: M , where ∀ n ∈ [ M !] , ∃ i 1 , i 2 , ..., i M such that ∀ α ∈ ∆ nM we have:

Original: [Equation]
Revised: [Equation]

Original: In other words, ∆ nM is the set of all probability vectors that share the same sorting indices.
Revised: In other words, ∆ nM is the set of all probability vectors that share the same sorting indices.

Original: Since we have M ! ways to arrange M numbers, the size of the decomposition will be M ! .
Revised: Since we have M ! ways to arrange M numbers, the size of the decomposition will be M ! .

Original: We now make the following observations:
Revised: We now make the following observations:

Original: ∀ n , ∆ nM is a convex set.
Revised: ∀ n , ∆ nM is a convex set.

Original: quick proof : Let α , β ∈ ∆ nM , then ∃ i 1 , i 2 , ..., i M such that α i 1 ≥ ... ≥ α i M and β i 1 ≥ ...
Revised: quick proof : Let α , β ∈ ∆ nM , then ∃ i 1 , i 2 , ..., i M such that α i 1 ≥ ... ≥ α i M and β i 1 ≥ ...

Original: ≥ β i M .
Revised: ≥ β i M .

Original: ∀ λ ∈ [0 , 1] we have q = λ
Revised: ∀ λ ∈ [0 , 1] we have q = λ

Original: α + (1 − λ ) β ∈ ∆ M , since (cid:80) q i = (cid:80) λα
Revised: α + (1 − λ ) β ∈ ∆ M , since (cid:80) q i = (cid:80) λα

Original: i + (1 − λ ) β i = 1 and q i ≥ 0 .
Revised: i + (1 − λ ) β i = 1 and q i ≥ 0 .

Original: We also have ∀ l ∈
Revised: We also have ∀ l ∈

Original: [ M − 1]
Revised: [ M − 1]

Original: [Equation]
Revised: [Equation]

Original: ∀ n , ∃P n = { p n 1 , ..., p nM } ⊂ ∆ nM such that ∆ nM =
Revised: ∀ n , ∃P n = { p n 1 , ..., p nM } ⊂ ∆ nM such that ∆ nM =

Original: H ( P n ) , where H ( X ) is the convex hull of the set of points X .
Revised: H ( P n ) , where H ( X ) is the convex hull of the set of points X .

Original: quick proof : Let i 1 , ..., i M be the sorted indices associated with an arbitrary subset ∆ nM .
Revised: quick proof : Let i 1 , ..., i M be the sorted indices associated with an arbitrary subset ∆ nM .

Original: Construct the M probability vectors as follows: ∀ k ∈
Revised: Construct the M probability vectors as follows: ∀ k ∈

Original: [ M ] p nk,j = 1 k if j ∈ { i 1 , ..., i k } else p nk,j = 0 .
Revised: [ M ] p nk,j = 1 k if j ∈ { i 1 , ..., i k } else p nk,j = 0 .

Original: It is easy to verify that p nk ∈ ∆ nM , since (cid:80) j p nk,j = k/k = 1 , and p nk,i 1 ≥ ... ≥ p nk,i M .
Revised: It is easy to verify that p nk ∈ ∆ nM , since (cid:80) j p nk,j = k/k = 1 , and p nk,i 1 ≥ ... ≥ p nk,i M .

Original: Since ∆ nM is convex (Claim 1), we thus have that H ( P n ) ⊆
Revised: Since ∆ nM is convex (Claim 1), we thus have that H ( P n ) ⊆

Original: ∆ nM .
Revised: ∆ nM .

Original: What is left is to show that ∆ nM ⊆
Revised: What is left is to show that ∆ nM ⊆

Original: H ( P n ) , which can be established if we show that ∀ α ∈ ∆ nM , ∃ λ ∈ ∆ M such that α = (cid:80) k
Revised: H ( P n ) , which can be established if we show that ∀ α ∈ ∆ nM , ∃ λ ∈ ∆ M such that α = (cid:80) k

Original: λ k p
Revised: λ k p

Original: nk .
Revised: nk .

Original: We shall prove it by construction, specifically define:
Revised: We shall prove it by construction, specifically define:

Original: [Equation]
Revised: [Equation]

Original: This induces a valid convex coefficient vector λ , since (cid:80) k λ
Revised: This induces a valid convex coefficient vector λ , since (cid:80) k λ

Original: [Equation]
Revised: [Equation]

Original: = (cid:80)
Revised: = (cid:80)

Original: [Equation]
Revised: [Equation]

Original: It is also easy to verify that α i l
Revised: It is also easy to verify that α i l

Original: = (cid:80) k
Revised: = (cid:80) k

Original: λ k p
Revised: λ k p

Original: nk,i l for all indices i l ∈ [ M ] , since:
Revised: nk,i l for all indices i l ∈ [ M ] , since:

Original: [Equation]
Revised: [Equation]

Original: by construction of λ and P n .
Revised: by construction of λ and P n .

Original: ∀ n , the function
Revised: ∀ n , the function

Original: g
Revised: g

Original: is
Revised: is

Original: linear over α ∈ ∆ nM .
Revised: linear over α ∈ ∆ nM .

Original: quick proof : Define the maximum index s ( α , i ) =
Revised: quick proof : Define the maximum index s ( α , i ) =

Original: arg max j ∈{ i,...,M } { α j } .
Revised: arg max j ∈{ i,...,M } { α j } .

Original: By definition, α ∈ ∆ nM implies that s ( i ) =
Revised: By definition, α ∈ ∆ nM implies that s ( i ) =

Original: s ( α , i ) is independent of α .
Revised: s ( α , i ) is independent of α .

Original: Therefore ∀ i ∈
Revised: Therefore ∀ i ∈

Original: [ M ] we have g
Revised: [ M ] we have g

Original: i
Revised: i

Original: ( α ) =
Revised: ( α ) =

Original: α s ( i ) − α s ( i +1) with the slight abuse of notation α M +1 = 0 .
Revised: α s ( i ) − α s ( i +1) with the slight abuse of notation α M +1 = 0 .

Original: Therefore ∃ G n ∈ {− 1 , 0 , 1 } M × M such that g ( α ) =
Revised: Therefore ∃ G n ∈ {− 1 , 0 , 1 } M × M such that g ( α ) =

Original: G n α for all α ∈ ∆ nM .
Revised: G n α for all α ∈ ∆ nM .

Original: Combining observations 1,2&3, we can re-write the original optimization problem as follows:
Revised: Combining observations 1,2&3, we can re-write the original optimization problem as follows:

Original: [Equation]
Revised: [Equation]

Original: where (a) holds because the minimum of a linear function over the convex hull of a set of points X is obtained at one of the points in X .
Revised: where (a) holds because the minimum of a linear function over the convex hull of a set of points X is obtained at one of the points in X .

Original: Thus, to solve the original optimization problem, we only need to evaluate M !
Revised: Thus, to solve the original optimization problem, we only need to evaluate M !

Original: linear functions with
Revised: linear functions with

Original: M vectors each, and pick the one that achieves the smallest value.
Revised: M vectors each, and pick the one that achieves the smallest value.

Original: Finally, we will now show that the search space can be significantly reduced from M !
Revised: Finally, we will now show that the search space can be significantly reduced from M !

Original: ×
Revised: ×

Original: M to M possible solutions.
Revised: M to M possible solutions.

Original: Let ∆ nM be an arbitrary subset of ∆ M whose associated sorted indices are i n 1 , i n 2 , ..., i nM , and P n = { p nk } k are the associated extreme points.
Revised: Let ∆ nM be an arbitrary subset of ∆ M whose associated sorted indices are i n 1 , i n 2 , ..., i nM , and P n = { p nk } k are the associated extreme points.

Original: We first note that, ∀ k ∈
Revised: We first note that, ∀ k ∈

Original: [ M ] , g ( p nk ) = (cid:2) 0 ... 

Revised: [ M ] , g ( p nk ) = (cid:2) 0 ...

Original: 1 k 0 ... 0 (cid:3) ⊤ with j nk = max { i n 1 , ..., i nk } is the non-zero index.
Revised: 1 k 0 ... 0 (cid:3) ⊤ with j nk = max { i n 1 , ..., i nk } is the non-zero index.

Original: Therefore, we have that ∀ n, k :
Revised: Therefore, we have that ∀ n, k :

Original: [Equation]
Revised: [Equation]

Original: Equation (59) reveals that, amongst all vectors p nk with fixed k , the smallest error is always achieved by the subset n whose associated j nk index is the smallest, since the robust errors are always assumed to be sorted.
Revised: Equation (59) reveals that, amongst all vectors p nk with fixed k , the smallest error is always achieved by the subset n whose associated j nk index is the smallest, since the robust errors are always assumed to be sorted.

Original: Furthermore, the smallest value that j nk can achieve is k , since it is the largest index amongst k arbitrary indices from [ M ] .
Revised: Furthermore, the smallest value that j nk can achieve is k , since it is the largest index amongst k arbitrary indices from [ M ] .

Original: Therefore, let ∆ mM be the subset whose sorting indices are i k
Revised: Therefore, let ∆ mM be the subset whose sorting indices are i k

Original: = k , i.e. α ∈ ∆ mM implies α 1 ≥ ... ≥ α M .
Revised: = k , i.e. α ∈ ∆ mM implies α 1 ≥ ... ≥ α M .

Original: For this subset, we will always have j mk = max { 1 , ..., k } = k which implies that ∀ n ∈ [ M !] and ∀ k ∈ [ M ] :
Revised: For this subset, we will always have j mk = max { 1 , ..., k } = k which implies that ∀ n ∈ [ M !] and ∀ k ∈ [ M ] :

Original: [Equation]
Revised: [Equation]

Original: (60) where p mk = (cid:2) 1 k ... 1 k 0 ... 0 (cid:3) ⊤ .
Revised: (60) where p mk = (cid:2) 1 k ... 1 k 0 ... 0 (cid:3) ⊤ .

Original: Combining (58)&(60) we obtain:
Revised: Combining (58)&(60) we obtain:

Original: [Equation]
Revised: [Equation]

Original: =
Revised: =

Original: [Equation]
Revised: [Equation]

Original: 61) which can be achieved using α ∗ = (cid:2) 1 k ∗ ... 1 k ∗ 0 ... 0 (cid:3) ⊤ .
Revised: 61) which can be achieved using α ∗ = (cid:2) 1 k ∗ ... 1 k ∗ 0 ... 0 (cid:3) ⊤ .

Original: A.4. M AIN P ROOF
Revised: B.4. M AIN P ROOF

Original: We now restate and prove Theorem 2:
Revised: We now restate and prove Theorem 2:

Original: Theorem (Restated) .
Revised: Theorem (Restated) .

Original: For a perturbation set S , data distribution D , and collection of M classifiers
Revised: For a perturbation set S , data distribution D , and collection of M classifiers

Original: F with individual adversarial risks
Revised: F with individual adversarial risks

Original: η i ( i ∈ [ M ] ) such that 0 < η 1 ≤ ... ≤ η M ≤ 1 , we have ∀ α ∈ ∆ M :
Revised: η i ( i ∈ [ M ] ) such that 0 < η 1 ≤ ... ≤ η M ≤ 1 , we have ∀ α ∈ ∆ M :

Original: [Equation]
Revised: [Equation]

Original: Both bounds are tight in the sense that if all that is known about the setup F , D , and S is { η i } Mi =1 , then there exist no tighter bounds.
Revised: Both bounds are tight in the sense that if all that is known about the setup F , D , and S is { η i } Mi =1 , then there exist no tighter bounds.

Original: Furthermore, the upper bound is always met if α = e M , and the lower bound (if achievable) can be met if α = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ , where m = arg min k ∈
Revised: Furthermore, the upper bound is always met if α = e M , and the lower bound (if achievable) can be met if α = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ , where m = arg min k ∈

Original: [ M ] { η k k } .
Revised: [ M ] { η k k } .

Original: Proof.
Revised: Proof.

Original: We first prove the upper bound and then the lower bound.
Revised: We first prove the upper bound and then the lower bound.

Original: Upper bound :
Revised: Upper bound :

Original: From Proposition 1, we have that η is convex in α ∈ ∆ M .
Revised: From Proposition 1, we have that η is convex in α ∈ ∆ M .

Original: Using ∆ M =
Revised: Using ∆ M =

Original: H ( { e 1 , ..., e M } ) and applying Lemma 2, we get ∀ α ∈ ∆ M :
Revised: H ( { e 1 , ..., e M } ) and applying Lemma 2, we get ∀ α ∈ ∆ M :

Original: [Equation]
Revised: [Equation]

Original: This establishes the upper bound in (62).
Revised: This establishes the upper bound in (62).

Original: The bound is tight, since η ( e M ) =
Revised: The bound is tight, since η ( e M ) =

Original: η M is achievable.
Revised: η M is achievable.

Original: Lower bound : From Lemmas 4&5, we establish ∀ α ∈ ∆ M , the following result:
Revised: Lower bound : From Lemmas 4&5, we establish ∀ α ∈ ∆ M , the following result:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: where m = arg min k ∈ [ M ] { η k k } and α ∗ = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ .
Revised: where m = arg min k ∈ [ M ] { η k k } and α ∗ = (cid:2) 1 m ... 1 m 0 ... 0 (cid:3) ⊤ .

Original: This establishes the lower bound in (62).
Revised: This establishes the lower bound in (62).

Original: The bound is tight, since for fixed 0 <
Revised: The bound is tight, since for fixed 0 <

Original: η 1 ≤ ... ≤ η M ≤ 1 , we can construct F , S , and D such that η ( α )
Revised: η 1 ≤ ... ≤ η M ≤ 1 , we can construct F , S , and D such that η ( α )

Original: =
Revised: =

Original: h ( α ) and ∀ i ∈
Revised: h ( α ) and ∀ i ∈

Original: [ M ] : η ( e i )
Revised: [ M ] : η ( e i )

Original: =
Revised: =

Original: h ( e i ) =
Revised: h ( e i ) =

Original: η i , as shown next.
Revised: η i , as shown next.

Original: Let S ⊂ R d be any closed and bounded set containing at least M distinct vectors { δ j } Mj =1 ⊆
Revised: Let S ⊂ R d be any closed and bounded set containing at least M distinct vectors { δ j } Mj =1 ⊆

Original: S .
Revised: S .

Original: Let D be any valid distribution over R = R d ×
Revised: Let D be any valid distribution over R = R d ×

Original: [ C ] such that ∀ i ∈
Revised: [ C ] such that ∀ i ∈

Original: [ M ] : P { z ∈ T i } =
Revised: [ M ] : P { z ∈ T i } =

Original: η i , P { z ∈ T M +1 } = 1 , and ∅ = T 

Revised: η i , P { z ∈ T M +1 } = 1 , and ∅ = T

Original: ⊂ T 1 ⊆ T 2 ⊆ ... ⊆
Revised: ⊂ T 1 ⊆ T 2 ⊆ ... ⊆

Original: T M ⊆ T M +1 ⊂ R .
Revised: T M ⊆ T M +1 ⊂ R .

Original: Finally, we construct classifiers
Revised: Finally, we construct classifiers

Original: f i ( ∀ i ∈ [ M ] ) to satisfy the following assignment ∀ z ∈ T M +1 :
Revised: f i ( ∀ i ∈ [ M ] ) to satisfy the following assignment ∀ z ∈ T M +1 :

Original: [Equation]
Revised: [Equation]

Original: i.e., the i -th classifier decision f i ( x + δ ) is incorrect only if δ =
Revised: i.e., the i -th classifier decision f i ( x + δ ) is incorrect only if δ =

Original: δ i and z ∈ T i .
Revised: δ i and z ∈ T i .

Original: Given the above construction, we establish
Revised: Given the above construction, we establish

Original: [Equation]
Revised: [Equation]

Original: where: (a) holds because P { z ∈ T M +1 }
Revised: where: (a) holds because P { z ∈ T M +1 }

Original: = 1 ; (b) holds because we can partition T M +1 into M +sets: T 1 ∪ ( T 2 \ T 1 ) ∪ . . .
Revised: = 1 ; (b) holds because we can partition T M +1 into M +sets: T 1 ∪ ( T 2 \ T 1 ) ∪ . . .

Original: ∪ ( T M +1 \ T M ) , and because the max term is 0 ∀ z ∈ T M +1 \ T M ; (c) holds by construction of F and S , and (d) holds since η i
Revised: ∪ ( T M +1 \ T M ) , and because the max term is 0 ∀ z ∈ T M +1 \ T M ; (c) holds by construction of F and S , and (d) holds since η i

Original: = P { z ∈ T i } and T i ⊆
Revised: = P { z ∈ T i } and T i ⊆

Original: T i +1 .
Revised: T i +1 .

Original: A. P ROOF OF T HEOREM
Revised: B. P ROOF OF T HEOREM

Original: First, we state the classic result on the convergence of the projected sub-gradient method for convex minimization (Shor (2012)):
Revised: First, we state the classic result on the convergence of the projected sub-gradient method for convex minimization (Shor (2012)):

Original: Lemma 6 (Projected Sub-gradient Method) .
Revised: Lemma 6 (Projected Sub-gradient Method) .

Original: Let h : R d → R be a a convex and sub-differentiable function.
Revised: Let h : R d → R be a a convex and sub-differentiable function.

Original: Let C
Revised: Let C

Original: ⊂ R
Revised: ⊂ R

Original: d be a convex set.
Revised: d be a convex set.

Original: For iterations t = 1 , .., T , define the projected sub-gradient method:
Revised: For iterations t = 1 , .., T , define the projected sub-gradient method:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: (68) where a t = a / t for some positive a > 0 , x (1) ∈ C is an arbitrary initial guess, h (1) best = h ( x (1) ) , and g ( t ) ∈
Revised: (68) where a t = a / t for some positive a > 0 , x (1) ∈ C is an arbitrary initial guess, h (1) best = h ( x (1) ) , and g ( t ) ∈

Original: ∂h
Revised: ∂h

Original: ( x ( t ) ) is a sub-gradient of h at x ( t ) .
Revised: ( x ( t ) ) is a sub-gradient of h at x ( t ) .

Original: Let t best designate the best iteration index thus far.
Revised: Let t best designate the best iteration index thus far.

Original: Then, if h has norm-bounded sub-gradients: ∥ g ∥ 2 ≤ G for all g ∈ ∂h ( x ) and x ∈ C , we have:
Revised: Then, if h has norm-bounded sub-gradients: ∥ g ∥ 2 ≤ G for all g ∈ ∂h ( x ) and x ∈ C , we have:

Original: [Equation]
Revised: [Equation]

Original: where:
Revised: where:

Original: [Equation]
Revised: [Equation]

Original: We then prove Theorem 3 (restated below) via a direct application of Lemma 6:
Revised: We then prove Theorem 3 (restated below) via a direct application of Lemma 6:

Original: Theorem (Restated) .
Revised: Theorem (Restated) .

Original: The OSP algorithm output α T satisfies:
Revised: The OSP algorithm output α T satisfies:

Original: [Equation]
Revised: [Equation]

Original: for any initial condition α (1) ∈ ∆ M , a > 0 , where α ∗ is a global minimum.
Revised: for any initial condition α (1) ∈ ∆ M , a > 0 , where α ∗ is a global minimum.

Original: Proof.
Revised: Proof.

Original: The ensemble empirical adversarial risk ˆ η is convex and sub-differentiable (Proposition 1), being minimized over a convex set ∆ M .
Revised: The ensemble empirical adversarial risk ˆ η is convex and sub-differentiable (Proposition 1), being minimized over a convex set ∆ M .

Original: At each iteration t in OSP, the vector g obtained at line (12) is norm-bounded with G = √ M , the vector g is also a sub-gradient of ˆ η at α ( t ) , therefore Lemmaapplies.
Revised: At each iteration t in OSP, the vector g obtained at line (12) is norm-bounded with G = √ M , the vector g is also a sub-gradient of ˆ η at α ( t ) , therefore Lemmaapplies.

Original: B A DDITIONAL T HEORETICAL R ESULTS B. S PECIAL C ASE OF T HREE C LASSIFIERS
Revised: C A DDITIONAL T HEORETICAL R ESULTS C. S PECIAL C ASE OF T HREE C LASSIFIERS

Original: In this section, we derive a simplified search strategy for finding the optimal sampling probability for the special case of M = 3 , akin to Section 3.2.
Revised: In this section, we derive a simplified search strategy for finding the optimal sampling probability for the special case of M = 3 , akin to Section 4.2.

Original: Similar to (7), we can enumerate all possible classifiers/data-point configurations around S , which allows us to write ∀ α ∈ ∆ 3 :
Revised: Similar to (7), we can enumerate all possible classifiers/data-point configurations around S , which allows us to write ∀ α ∈ ∆ 3 :

Original: [Equation]
Revised: [Equation]

Original: where p ∈ ∆ 12 .
Revised: where p ∈ ∆ 12 .

Original: Using (72), we obtain the following result:
Revised: Using (72), we obtain the following result:

Original: Theorem 4.
Revised: Theorem 4.

Original: Define A ⊂ ∆ 3 to be the set of the following vectors:
Revised: Define A ⊂ ∆ 3 to be the set of the following vectors:

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: (cid:35)
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: (cid:34)
Revised: (cid:35)

Original: [Equation]
Revised: [Equation]

Original:  1  / 4 1 /(cid:35)
Revised: (cid:34) 1 /1 / 4 1 /(cid:35)

Original: [Equation]
Revised: [Equation]

Original: (cid:34) 1 /1 / 3 1 /(cid:35)(cid:41)
Revised: (cid:34) 1 /1 / 3 1 /(cid:35)(cid:41)

Original: [Equation]
Revised: [Equation]

Original: Then for any three classifiers f 1 , f 2 , and f 3 , perturbation set S ⊂ R d , and data distribution D , we have:
Revised: Then for any three classifiers f 1 , f 2 , and f 3 , perturbation set S ⊂ R d , and data distribution D , we have:

Original: [Equation]
Revised: [Equation]

Original: The set A is optimal, in the sense that there exist no smaller set A ′ such that (74) holds.
Revised: The set A is optimal, in the sense that there exist no smaller set A ′ such that (74) holds.

Original: Theorem 4 simplifies the search for the optimal sampling probability significantly, as it is sufficient to evaluate η at exactly 10 different candidate solutions, captured by A , and pick the best performing one.
Revised: Theorem 4 simplifies the search for the optimal sampling probability significantly, as it is sufficient to evaluate η at exactly 10 different candidate solutions, captured by A , and pick the best performing one.

Original: Theorem 4 also guarantees that the search procedure is efficient, since every candidate solution in A needs to be evaluated.
Revised: Theorem 4 also guarantees that the search procedure is efficient, since every candidate solution in A needs to be evaluated.

Original: Proof.
Revised: Proof.

Original: We shall use the same technique used in the proof of Lemma 5.
Revised: We shall use the same technique used in the proof of Lemma 5.

Original: We can decompose ∆ 3 into 6 such subsets ∆ 13 , ..., ∆ 63 , such that each subset contains vectors that share the same sorting indices.
Revised: We can decompose ∆ 3 into 6 such subsets ∆ 13 , ..., ∆ 63 , such that each subset contains vectors that share the same sorting indices.

Original: These subsets are convex, and they can be represented as the convex hull of three vectors.
Revised: These subsets are convex, and they can be represented as the convex hull of three vectors.

Original: Due to the symmetry of the problem, we shall focus on one subset ∆ 13 =
Revised: Due to the symmetry of the problem, we shall focus on one subset ∆ 13 =

Original: H (cid:16)(cid:110) (1 , 0 , 0) ⊤ , ( 1 / 2 , 1 / 2 , 0) ⊤ , ( 1 / 3 , 1 / 3 , 1 / 3 ) ⊤ (cid:111)(cid:17) where ∀ α ∈ ∆ 13 , we have: α 1 ≥ α 2 ≥ α 3 .
Revised: H (cid:16)(cid:110) (1 , 0 , 0) ⊤ , ( 1 / 2 , 1 / 2 , 0) ⊤ , ( 1 / 3 , 1 / 3 , 1 / 3 ) ⊤ (cid:111)(cid:17) where ∀ α ∈ ∆ 13 , we have: α 1 ≥ α 2 ≥ α 3 .

Original: Notice that for any α ∈ ∆ 13 , all the terms in (72) become linear in α , except for the term max { α 2 + α 3 , α 1 } .
Revised: Notice that for any α ∈ ∆ 13 , all the terms in (72) become linear in α , except for the term max { α 2 + α 3 , α 1 } .

Original: Therefore, we can further decompose ∆ 13 into two convex subsets ∆ 1 , 1 3 and ∆ 1 , 2 3 , such that:
Revised: Therefore, we can further decompose ∆ 13 into two convex subsets ∆ 1 , 1 3 and ∆ 1 , 2 3 , such that:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: and η is linear over both subsets (but not their union).
Revised: and η is linear over both subsets (but not their union).

Original: Claim : we have:
Revised: Claim : we have:

Original: [Equation]
Revised: [Equation]

Original: [Equation]
Revised: [Equation]

Original: Since both ∆ 1 , 1 3 and ∆ 1 , 2 3 are convex
Revised: Since both ∆ 1 , 1 3 and ∆ 1 , 2 3 are convex

Original: [Equation]
Revised: [Equation]

Original: it is enough to show that:
Revised: it is enough to show that:

Original: [Equation]
Revised: [Equation]

Original: for (76) to hold.
Revised: for (76) to hold.

Original: For all α ∈ ∆ 1 , 1 3 , define:
Revised: For all α ∈ ∆ 1 , 1 3 , define:

Original: [Equation]
Revised: [Equation]

Revised: [Equation]

Original: Then we always have:
Revised: Then we always have:

Original: [Equation]
Revised: [Equation]

Original: where it is easy to verify that
Revised: where it is easy to verify that

Original: λ
Revised: λ

Original: 1 + λ 2 + λ 3 = 1 .
Revised: 1 + λ 2 + λ 3 = 1 .

Original: The same can be shown for any α ∈ ∆ 1 , 2 3 , using the following:
Revised: The same can be shown for any α ∈ ∆ 1 , 2 3 , using the following:

Original: [Equation]
Revised: [Equation]

Original: which establishes the claim in (76).
Revised: which establishes the claim in (76).

Original: Using (76) and the linearity of η on each subset
Revised: Using (76) and the linearity of η on each subset

Original: [Equation]
Revised: [Equation]

Original: we can write:
Revised: we can write:

Original: [Equation]
Revised: [Equation]

Original: Finally, repeating this procedure for the remainder 5 sets ∆ 23 , ..., ∆ 63 establishes (74).
Revised: Finally, repeating this procedure for the remainder 5 sets ∆ 23 , ..., ∆ 63 establishes (74).

Original: To show that the set A is minimal, we provide 10 constructions of η using the p vector in (72)
Revised: To show that the set A is minimal, we provide 10 constructions of η using the p vector in (72)

Original: such that the i th vector
Revised: such that the i th vector

Original: α ∈
Revised: α ∈

Original: A is a unique (amongst A ) global optimum of η characterized by the i th p vector (listed below):
Revised: A is a unique (amongst A ) global optimum of η characterized by the i th p vector (listed below):

Original: [Equation]
Revised: [Equation]

Original: B. W ORST C ASE P ERFORMANCE OF D ETERMINISTIC E NSEMBLES
Revised: C.

Revised: W ORST C ASE P ERFORMANCE OF D ETERMINISTIC E NSEMBLES

Original: In Section 3.3, we showed via Theorem 2 that the adversarial risk of any randomized ensemble classifier is upper bounded by the worst performing classifier in the ensemble F .
Revised: In Section 4.3, we showed via Theorem 2 that the adversarial risk of any randomized ensemble classifier is upper bounded by the worst performing classifier in the ensemble F .

Original: In this section, we will show that the same cannot be said regarding deterministic ensemble classifiers.
Revised: In this section, we will show that the same cannot be said regarding deterministic ensemble classifiers.

Original: That is, there exist an ensemble F , data distribution D , and perturbation set S such that: 
Revised: That is, there exist an ensemble F , data distribution D , and perturbation set S such that: [Equation]

Original: [Equation]
Revised: [Equation]

Original: where ¯ f is the deterministic ensemble classifier constructed via the rule:
Revised: where ¯ f is the deterministic ensemble classifier constructed via the rule:

Original: [Equation]
Revised: [Equation]

Original: Consider the following setup:
Revised: Consider the following setup:

Original: two binary classifiers in R
Revised: two binary classifiers in R

Original: [Equation]
Revised: [Equation]

Original: which can be obtained from the “soft” classifiers:
Revised: which can be obtained from the “soft” classifiers:

Original: [Equation]
Revised: [Equation]

Original: using f i ( x ) =
Revised: using f i ( x ) =

Original: arg max c ∈{ 1 , 2 } [ ˜ f i ( x )] c , where w 1 =
Revised: arg max c ∈{ 1 , 2 } [ ˜ f i ( x )] c , where w 1 =

Original: [1 1] ⊤ and w 2 =
Revised: [1 1] ⊤ and w 2 =

Original: [1 − 1] ⊤ .
Revised: [1 − 1] ⊤ .

Original: a Ber ( p ) data distribution D over two data-points in R 2 ×
Revised: a Ber ( p ) data distribution D over two data-points in R 2 ×

Original: [Equation]
Revised: [Equation]

Original: the ℓ 2 norm-bounded perturbation set S
Revised: the ℓ 2 norm-bounded perturbation set S

Original: = { δ : ∥ δ ∥ ≤ ϵ } for some 0 < ϵ <
Revised: = { δ : ∥ δ ∥ ≤ ϵ } for some 0 < ϵ <

Original: [Equation]
Revised: [Equation]

Original: √
Revised: √

Original: [Equation]
Revised: [Equation]

Original: We first note that for binary linear classifiers and ℓ 2 -norm bounded adversaries, we have that:
Revised: We first note that for binary linear classifiers and ℓ 2 -norm bounded adversaries, we have that:

Original: • the shortest distance between a point x and the decision boundary of linear classifier f with weight w and bias b is:
Revised: • the shortest distance between a point x and the decision boundary of linear classifier f with weight w and bias b is:

Original: [Equation]
Revised: [Equation]

Original: • if f ( x ) ̸
Revised: • if f ( x ) ̸

Original: = y , then the optimal adversarial perturbation is given by:
Revised: = y , then the optimal adversarial perturbation is given by:

Original: [Equation]
Revised: [Equation]

Original: We can now evaluate the adversarial risks of each classifier:
Revised: We can now evaluate the adversarial risks of each classifier:

Original: [Equation]
Revised: [Equation]

Original: where we use ϵ < 1 / √ 2 .
Revised: where we use ϵ < 1 / √ 2 .

Original: Due to symmetry, we also get η 2 = p .
Revised: Due to symmetry, we also get η 2 = p .

Original: The average ensemble classifier ¯ f constructed from f 1 and f 2 is defined via the rule:
Revised: The average ensemble classifier ¯ f constructed from f 1 and f 2 is defined via the rule:

Original: [Equation]
Revised: [Equation]

Original: whose adversarial risk can be computed as follows:
Revised: whose adversarial risk can be computed as follows:

Original: [Equation]
Revised: [Equation]

Original: which is strictly greater than max { p, 1 − p } ∀ p ∈ (0 , 1) .
Revised: which is strictly greater than max { p, 1 − p } ∀ p ∈ (0 , 1) .

Original: Therefore, we have constructed an example where deterministic ensembling is always worse than using any of the individual classifiers, which proves that deterministic ensemble classifiers do not satisfy the upper bound.
Revised: Therefore, we have constructed an example where deterministic ensembling is always worse than using any of the individual classifiers, which proves that deterministic ensemble classifiers do not satisfy the upper bound.

Original: C A DDITIONAL E XPERIMENTS AND C OMPARISONS C. E XPERIMENTAL S ETUP
Revised: D A DDITIONAL E XPERIMENTS AND C OMPARISONS D. E XPERIMENTAL S ETUP

Original: In this section, we describe the complete experimental setup used for all our experiments.
Revised: In this section, we describe the complete experimental setup used for all our experiments.

Original: Training .
Revised: Training .

Original: All models are trained for 100 epochs via SGD with a batch size of 256 and 0 .
Revised: All models are trained for 100 epochs via SGD with a batch size of 256 and 0 .

Original: 1 initial learning rate, decayed by 0 .
Revised: 1 initial learning rate, decayed by 0 .

Original: 1 first at the 50 th epoch and twice at the 75 th epoch.
Revised: 1 first at the 50 th epoch and twice at the 75 th epoch.

Original: We employ the recently proposed margin-maximizing cross-entropy (MCE) loss from Zhang et al.
Revised: We employ the recently proposed margin-maximizing cross-entropy (MCE) loss from Zhang et al.

Original: with 0 .momentum and a weight decay factor of 5 × 10 − 4 .
Revised: with 0 .momentum and a weight decay factor of 5 × 10 − 4 .

Original: We use 10 attack iterations during training with ϵ = 8 / 255 and a step size β = 2 / 255 .
Revised: We use 10 attack iterations during training with ϵ = 8 / 255 and a step size β = 2 / 255 .

Original: For IAT, each classifier is indepdenelty trained from a different random initialization, using a standard PGD adversary.
Revised: For IAT, each classifier is indepdenelty trained from a different random initialization, using a standard PGD adversary.

Original: For MRBoost, we use their public implementation from GitHub to reproduce all their results.
Revised: For MRBoost, we use their public implementation from GitHub to reproduce all their results.

Original: For BARRE, we use an adaptive PGD (APGD) adversary (discussed in detail in Section C.4) as our training attack algorithm.
Revised: For BARRE, we use an adaptive PGD (APGD) adversary (discussed in detail in Section D.4) as our training attack algorithm.

Original: We apply
Revised: We apply

Original: OSP for T o = 10 iterations every E o = 10 epochs.
Revised: OSP for T o = 10 iterations every E o = 10 epochs.

Original: To avoid catastrophic overfitting (Rice et al., 2020), we always save the best performing checkpoint during training.
Revised: To avoid catastrophic overfitting (Rice et al., 2020), we always save the best performing checkpoint during training.

Original: Since all the ensemble methods considered reduce to adversarial training for the first iteration, we use a shared adversarially trained first classifier.
Revised: Since all the ensemble methods considered reduce to adversarial training for the first iteration, we use a shared adversarially trained first classifier.

Original: Doing so ensures a fair comparison between different ensemble methods.
Revised: Doing so ensures a fair comparison between different ensemble methods.

Original: For both CIFAR-10, and CIFAR-100 datasets, we adopt standard data augmentation (random crops and flips).
Revised: For both CIFAR-10, and CIFAR-100 datasets, we adopt standard data augmentation (random crops and flips).

Original: Per standard practice, we apply input normalization as part of the model, so that the adversary operates on physical images x ∈ [0 , 1] d .
Revised: Per standard practice, we apply input normalization as part of the model, so that the adversary operates on physical images x ∈ [0 , 1] d .

Original: Evaluation .
Revised: Evaluation .

Original: For all our robust evaluations, we will adopt the state-of-the-art ARC algorithm (Dbouk & Shanbhag, 2022) which can be used for both RECs and single models.
Revised: For all our robust evaluations, we will adopt the state-of-the-art ARC algorithm (Dbouk & Shanbhag, 2022) which can be used for both RECs and single models.

Original: Specifically, we useiterations of ARC, with an attack strength ϵ = 8 / 255 and approximation parameter G = 2 .
Revised: Specifically, we useiterations of ARC, with an attack strength ϵ = 8 / 255 and approximation parameter G = 2 .

Original: Following the recommendations of Dbouk & Shanbhag (2022), we use a step size of 2 / 255 when evaluating single models ( M = 1 ) and a step size of 8 / 255 when evaluating RECs ( M ≥ 2 ).
Revised: Following the recommendations of Dbouk & Shanbhag (2022), we use a step size of 2 / 255 when evaluating single models ( M = 1 ) and a step size of 8 / 255 when evaluating RECs ( M ≥ 2 ).

Original: C. I NDIVIDUAL MODEL ROBUSTNESS
Revised: D. I NDIVIDUAL MODEL ROBUSTNESS

Original: In Tables 3&4, we provide the clean and robust accuracies of all the individual classifiers constructed via the different ensemble methods on CIFAR-10 and CIFAR-100, respectively.
Revised: In Tables 3&4, we provide the clean and robust accuracies of all the individual classifiers constructed via the different ensemble methods on CIFAR-10 and CIFAR-100, respectively.

Original: Robust accuracy is measured using ARC.
Revised: Robust accuracy is measured using ARC.

Original: As expected, only ensembles produced via IAT consist of classifiers achieving near-identical robust and natural accuracies.
Revised: As expected, only ensembles produced via IAT consist of classifiers achieving near-identical robust and natural accuracies.

Original: In contrast, ensembles produced via MRBosst or BARRE witness a degradation in individual classifier robust accuracy as the ensemble size grows.
Revised: In contrast, ensembles produced via MRBosst or BARRE witness a degradation in individual classifier robust accuracy as the ensemble size grows.

Original: However, since MRBoost was not initially designed for randomized ensemble classifiers, this degradation in robust accuracy can be rather severe as seen for MobileNetV1 in both Tables 3&4.
Revised: However, since MRBoost was not initially designed for randomized ensemble classifiers, this degradation in robust accuracy can be rather severe as seen for MobileNetV1 in both Tables 3&4.

Original: This explains why, for such ensembles, the optimal sampling probability obtained for the constructed REC completely disregards the last classifier as highlighted in Section 4.1.
Revised: This explains why, for such ensembles, the optimal sampling probability obtained for the constructed REC completely disregards the last classifier as highlighted in Section 5.1.

Original: [Table]
Revised: [Table]

Original: −
Revised: −

Original: [Table]
Revised: [Table]

Original:  A TTACKS FOR R ANDOMIZED E NSEMBLES
Revised: D. A TTACKS FOR R ANDOMIZED E NSEMBLES

Original: Given a data-point z
Revised: Given a data-point z

Original: =
Revised: =

Original: ( x
Revised: ( x

Original: [Table]
Revised: [Table]

Original: y ) and a potentially random classifier f
Revised: y ) and a potentially random classifier f

Original: [Table]
Revised: [Table]

Original: the goal of an adversary is to find an adversarial perturbation that maximizes the single-point expected adversarial risk:
Revised: the goal of an adversary is to find an adversarial perturbation that maximizes the single-point expected adversarial risk:

Original: [Equation]
Revised: [Equation]

Original: where we adopt the ℓ p norm-bounded adversary for the remainder of this section.
Revised: where we adopt the ℓ p norm-bounded adversary for the remainder of this section.

Original: Projected gradient descent (PGD) (Madry et al., 2018) is perhaps the most popular attack algorithm for solving (93) for the case of differentiable deterministic classifiers.
Revised: Projected gradient descent (PGD) (Madry et al., 2018) is perhaps the most popular attack algorithm for solving (93) for the case of differentiable deterministic classifiers.

Original: Specifically, given a surrogate loss function l , such as the cross-entropy loss, PGD finds an adversarial δ iteratively via the following:
Revised: Specifically, given a surrogate loss function l , such as the cross-entropy loss, PGD finds an adversarial δ iteratively via the following:

Original: [Equation]
Revised: [Equation]

Original: 94) where µ p is the ℓ p steepest direction projection operator, and Π pϵ is the projection operator on the ℓ p ball of radius ϵ .
Revised: 94) where µ p is the ℓ p steepest direction projection operator, and Π pϵ is the projection operator on the ℓ p ball of radius ϵ .

Original: In order to adapt PGD for evaluating randomized ensemble classifiers, Pinot et al.
Revised: In order to adapt PGD for evaluating randomized ensemble classifiers, Pinot et al.

Original: (2020) first proposed adaptive PGD (APGD-L) using the expectation-over-transformation (EOT) method (Athalye
Revised: (2020) first proposed adaptive PGD (APGD-L) using the expectation-over-transformation (EOT) method (Athalye

Original: [Table]
Revised: [Table]

Original: MRBoost 54 .54 .53 .51 .
Revised: MRBoost 54 .54 .53 .51 .

Original: BARRE 54 .54 .53 .52 .
Revised: BARRE 54 .54 .53 .52 .

Original: [Figure]
Revised: [Figure]

Original: et al., 2018), which uses (94) with the expected loss function as follows:
Revised: et al., 2018), which uses (94) with the expected loss function as follows:

Original: [Equation]
Revised: [Equation]

Original: Note that the discrete nature of randomized ensembles allows for an exact computation of the expectation in (95).
Revised: Note that the discrete nature of randomized ensembles allows for an exact computation of the expectation in (95).

Original: Recently, Zhang et al.
Revised: Recently, Zhang et al.

Original: (2022) proposed a stronger version of adaptive PGD, where the expectation is taken at the softmax level (APGD-S).
Revised: (2022) proposed a stronger version of adaptive PGD, where the expectation is taken at the softmax level (APGD-S).

Original: Using APGD-S, Zhang et al.
Revised: Using APGD-S, Zhang et al.

Original: (2022) were able to compromise the BAT defense.
Revised: (2022) were able to compromise the BAT defense.

Original: Independently, Dbouk & Shanbhag (2022) studied the effectiveness of EOTbased adaptive attacks for evaluating the robustness of RECs, and concluded that such methods are fundamentally ill-suited for the task.
Revised: Independently, Dbouk & Shanbhag (2022) studied the effectiveness of EOTbased adaptive attacks for evaluating the robustness of RECs, and concluded that such methods are fundamentally ill-suited for the task.

Original: Instead, they proposed the ARC attack (Algorithm 2 of (Dbouk & Shanbhag, 2022)), which relied on iteratively updating the perturbation based on estimating the direction towards the decision boundary of each classifier and using an adaptive step size method.
Revised: Instead, they proposed the ARC attack (Algorithm 2 of (Dbouk & Shanbhag, 2022)), which relied on iteratively updating the perturbation based on estimating the direction towards the decision boundary of each classifier and using an adaptive step size method.

Original: In this section, we propose a small modification to ARC (ARC-R) that proves to be quite more effective in the equiprobable setting.
Revised: In this section, we propose a small modification to ARC (ARC-R) that proves to be quite more effective in the equiprobable setting.

Original: Specifically, instead of looping over the classifiers in a deterministic fashion based on the order of the sampling probability vector, we propose using a randomized order loop.
Revised: Specifically, instead of looping over the classifiers in a deterministic fashion based on the order of the sampling probability vector, we propose using a randomized order loop.

Original: This ensures that ARC is never biased towards certain classifiers.
Revised: This ensures that ARC is never biased towards certain classifiers.

Original: In fact, Table 5 demonstrates that ARC-R is better than APGD-L (Pinot et al., 2020), APGD-S Zhang et al.
Revised: In fact, Table 5 demonstrates that ARC-R is better than APGD-L (Pinot et al., 2020), APGD-S Zhang et al.

Original: (2022), and
Revised: (2022), and

Original: ARC (Dbouk & Shanbhag, 2022) at evaluating the robustness of RECs on CIFAR-10, constructed with equiprobable sampling across various network architectures and ensemble training methods.
Revised: ARC (Dbouk & Shanbhag, 2022) at evaluating the robustness of RECs on CIFAR-10, constructed with equiprobable sampling across various network architectures and ensemble training methods.

Original: Hence, we shall adopt this version of ARC for all our experiments.
Revised: Hence, we shall adopt this version of ARC for all our experiments.

Original: C. ARC VS . A DAPTIVE PGD FOR BARRE
Revised: D. ARC VS . A DAPTIVE PGD FOR BARRE

Original: As highlighted in Section 4.1, we find that ARC, despite being the strongest adversary, leads to poor performance when adopted as the training attack in BARRE.
Revised: As highlighted in Section 5.1, we find that ARC, despite being the strongest adversary, leads to poor performance when adopted as the training attack in BARRE.

Original: In this section, we investigate this phenomenon, as we study the performance of BARRE using two different attacks during training,
Revised: In this section, we investigate this phenomenon, as we study the performance of BARRE using two different attacks during training,

Original: APGD (Zhang et al., 2022) and ARC (Dbouk & Shanbhag, 2022).
Revised: APGD (Zhang et al., 2022) and ARC (Dbouk & Shanbhag, 2022).

Original: Specifically, we train two RECs on CIFAR-10 using the ResNet-20 architecture.
Revised: Specifically, we train two RECs on CIFAR-10 using the ResNet-20 architecture.

Original: Both RECs share the same first classifier f 1 , which is adversarially trained using standard PGD.
Revised: Both RECs share the same first classifier f 1 , which is adversarially trained using standard PGD.

Original: The second classifier f 2 is trained via either APGD or
Revised: The second classifier f 2 is trained via either APGD or

Original: ARC.
Revised: ARC.

Original: Figure 4 plots the evolution of both robust and clean accuracies of the two RECs across thetraining epochs of f 2 , measured on the test set.
Revised: Figure 4 plots the evolution of both robust and clean accuracies of the two RECs across thetraining epochs of f 2 , measured on the test set.

Original: Note that in both RECs, the robust accuracy is evaluated via the stronger ARC adversary.
Revised: Note that in both RECs, the robust accuracy is evaluated via the stronger ARC adversary.

Original: When evaluated on clean images, we find that BARRE with
Revised: When evaluated on clean images, we find that BARRE with

Original: ARC leads to significantly more accurate RECs when compared to BARRE with APGD.
Revised: ARC leads to significantly more accurate RECs when compared to BARRE with APGD.

Original: However, this comes at the expense of robust accuracy, as the REC obtained via BARRE with ARC is much more vulnerable than the APGD counterpart.
Revised: However, this comes at the expense of robust accuracy, as the REC obtained via BARRE with ARC is much more vulnerable than the APGD counterpart.

Original: We hypothesize that the adversarial samples generated via ARC during training do not generalize well to the test set.
Revised: We hypothesize that the adversarial samples generated via ARC during training do not generalize well to the test set.

Original: This explains why we observe that
Revised: This explains why we observe that

Original: the
Revised: the

Original: REC obtained via BARRE with ARC achieves much higher robust accuracies on the training set.
Revised: REC obtained via BARRE with ARC achieves much higher robust accuracies on the training set.

Original: Thus, for better generalization performance, we shall adopt adaptive PGD during training in all our experiments.
Revised: Thus, for better generalization performance [Table] we shall adopt adaptive PGD during training in all our experiments.

Original: C. A DDITIONAL R ESULTS
Revised: D. A DDITIONAL R ESULTS

Original: In this section
Revised: In this section

Original: [Table]
Revised: [Table]

Original: we complete the CIFAR-10 results reported in Table 1 for showcasing the benefit of randomization.
Revised: we complete the CIFAR-10 results reported in Table 1 for showcasing the benefit of randomization.

Original: Specifically, Table 6 provides further evidence that BARRE can train RECs of competitive robustness compared to MRBoost-trained deterministic ensembles, while requiring significantly less compute.
Revised: Specifically, Table 6 provides further evidence that BARRE can train RECs of competitive robustness compared to MRBoost-trained deterministic ensembles, while requiring significantly less compute.

Original: [Table]
Revised: [Table]