Revised: Therefore, we can use the method discussed in Section A.3, i.e. use a single budget variable per node instead of using one per node and attribute.

Revised: Modelling our collective problem in this way, using Eq. 135 as our base certiﬁcates and rewriting the ﬁrst two sums using inner products results in the optimization problem

Revised: [Equation]

Revised: This optimization problem is identical to that of Schuchardt et al.

Revised: (2021) from Eqs.

Revised: (123) to (125).

Revised: The only difference is in how these problems would be mapped to a mixed-integer linear program.

Revised: We would directly model the indicator functions in the objective using a single linear constraint.

Revised: Schuchardt et al.

Revised: (2021) would use multiple linear constraints, each corresponding to one point in the adversarial budget space.

Revised: To summarize: For randomly smoothed models, masking out perturbations using a-priori knowledge about a model’s strict locality is equivalent to completely randomizing (here: ﬂipping bits with probability 50% ) parts of the input.

Revised: While Schuchardt et al.

Revised: (2021) only derived their certiﬁcate for binary data, it is conceivable that their approach could be applied to strictly local models for continuous data.

Revised: Considering our certiﬁcates for Gaussian (Proposition 1) and (Proposition 2) uniform smoothing, where the base certiﬁcate weights are 1 σ 2 and 1 λ , respectively, it should again be possible to perform the same masking operation as Schuchardt et al.

Revised: (2021) by using σ → ∞ and λ → ∞ .

Revised: Finally, it should be noted that the certiﬁcate by Schuchardt et al.

Revised: (2021) allows for additional constraints, e.g. on the adversarial budget per node or the number of nodes controlled by the adversary.

Revised: As all of them can be modelled using linear constraints on the budget variables (see Section C of their paper), they can be just as easily integrated into our mixed-integer linear programming certiﬁcate.

Original: D E XPERIMENTAL SETUP AND ADDITIONAL EXPERIMENTS
Revised: E E XPERIMENTAL SETUP AND ADDITIONAL EXPERIMENTS

Original: In the following, we ﬁrst explain the metrics we use for measuring the strength of certiﬁcates, and how they can be applied to the different types of randomized smoothing certiﬁcates used in our experiments.
Revised: In the following, we ﬁrst explain the metrics we use for measuring the strength of certiﬁcates, and how they can be applied to the different types of randomized smoothing certiﬁcates used in our experiments.

Original: We then discuss the experimental setup, as well hyperparameters and additional experimental results for our semantic segmentation Section D.2 and node classiﬁcation Section 8.
Revised: We then discuss the experimental setup, as well hyperparameters and additional experimental results for our semantic segmentation Section E.2 and node classiﬁcation Section 8.

Original: experiments.
Revised: experiments.

Original: D. M ETRICS
Revised: E. M ETRICS

Original: We use two metrics for measuring certiﬁcate strength: Certiﬁed accuracy (i.e. the percentage of correct and certiﬁably robust predictions) and certiﬁed ratio (i.e. the percentage of certiﬁably robust predictions, regardless of correctness).
Revised: We use two metrics for measuring certiﬁcate strength: Certiﬁed accuracy (i.e. the percentage of correct and certiﬁably robust predictions) and certiﬁed ratio (i.e. the percentage of certiﬁably robust predictions, regardless of correctness).

Original: We use Monte Carlo randomized smoothing (see Section C.
Revised: We use Monte Carlo randomized smoothing (see Section C.

Original: Therefore, we may have to abstain from making predictions.
Revised: Therefore, we may have to abstain from making predictions.

Original: Abstentions are counted as non-robust and incorrect.
Revised: Abstentions are counted as non-robust and incorrect.

Original: In the case of center smoothing, either all or none predictions abstain (this is inherent to the method.
Revised: In the case of center smoothing, either all or none predictions abstain (this is inherent to the method.

Original: In our experiments, center smoothing never abstained).
Revised: In our experiments, center smoothing never abstained).

Original: In the following, let Z = { d ∈ { 1 , . . .
Revised: In the following, let Z = { d ∈ { 1 , . . .

Original: , D out  | y n = ˆ y n } be the indices of correct predictions, given an input x .
Revised: , D out } | y n = ˆ y n } be the indices of correct predictions, given an input x .

Original: Na¨ıve collective certiﬁcate .
Revised: Na¨ıve collective certiﬁcate .

Original: The na ¨ ıve collective certiﬁcate certiﬁes each prediction independently.
Revised: The na¨ıve collective certiﬁcate certiﬁes each prediction independently.

Original: Like with our base certiﬁcates, let H ( n ) be the set of perturbed inputs y n is robust to.
Revised: Like with our base certiﬁcates, let H ( n ) be the set of perturbed inputs y n is robust to.

Original: Let B x be the collective perturbation model.
Revised: Let B x be the collective perturbation model.

Original: Then L = (cid:8) d ∈ { 1 , . . .
Revised: Then L = (cid:8) d ∈ { 1 , . . .

Original: , D out } | B x ⊆ H ( n ) (cid:9) is the set of all certiﬁably robust predictions.
Revised: , D out } | B x ⊆ H ( n ) (cid:9) is the set of all certiﬁably robust predictions.

Original: The certiﬁed ratio can be computed as | L | D out and the certiﬁed accuracy as | L ∩ Z | D out .
Revised: The certiﬁed ratio can be computed as | L | D out and the certiﬁed accuracy as | L ∩ Z | D out .

Original: Center smoothing Center smoothing does not determine which predictions are robust, but only how many are.
Revised: Center smoothing Center smoothing does not determine which predictions are robust, but only how many are.

Original: Let l be the number of certiﬁably robust predictions.
Revised: Let k be the number of certiﬁably robust predictions.

Original: The certiﬁed ratio can be easily computed as kD out .
Revised: The certiﬁed ratio can be easily computed as kD out .

Original: For the certiﬁed accuracy, we have to make the worst-case assumption that the adversary targets only correct predictions, i.e.  max(0 ,l − ( D out −| Z | ) D out
Revised: For the certiﬁed accuracy, we have to make the worst-case assumption that the non-robust predictions are correct predictions, i.e. compute max(0 ,k − ( D out −| Z | )) D out

Original: Collective certiﬁcate .
Revised: Collective certiﬁcate .

Original: Let l ( T ) be the optimal value of our collective certiﬁcate and set of targeted nodes T .
Revised: Let l ( T ) be the optimal value of our collective certiﬁcate and set of targeted nodes T .

Original: Then both the certiﬁed ratio and certiﬁed accuracy can be computed via l ( T ) D out with T = { 1 , . . .
Revised: Then both the certiﬁed ratio and certiﬁed accuracy can be computed via l ( T ) D out with T = { 1 , . . .

Original: , D out } and T =
Revised: , D out } and T =

Original: Z , respectively.
Revised: Z , respectively.

Original: D. S EMANTIC SEGMENTATION
Revised: E. S EMANTIC SEGMENTATION

Original: We ﬁrst list all parameters and details of our training and certiﬁcation procedures, before discussing additional experimental results in Section D.2.2.
Revised: We ﬁrst list all parameters and details of our training and certiﬁcation procedures, before discussing additional experimental results in Section E.2.3.

Original: D.2. E XPERIMENTAL SETUP AND HYPERPARAMETERS
Revised: E.2. E XPERIMENTAL SETUP AND HYPERPARAMETERS

Original: Model.
Revised: Model.

Original: As a base model for the semantic segmentation mask, we use a U-Net model (Ronneberger et al., 2015) with a ResNet-18 (He et al., 2016) backbone, as implemented by the Pytorch Segmentation Models library (version 0 . 13 ) (Yakubovskiy, 2020).
Revised: As the base model for the semantic segmentation task, we use a U-Net model (Ronneberger et al., 2015) with a ResNet-18 (He et al., 2016) backbone, as implemented by the Pytorch Segmentation Models library (version 0 . 13 ) (Yakubovskiy, 2020).

Original: We use the library’s default parameters.
Revised: We use the library’s default parameters.

Original: In particular, the inputs to the U-Net segmentation head are the features of the ResNet model after the ﬁrst convolutional layer and after each ResNet block (i.e. after every fourth of the subsequent layers).
Revised: In particular, the inputs to the U-Net segmentation head are the features of the ResNet model after the ﬁrst convolutional layer and after each ResNet block (i.e. after every fourth of the subsequent layers).

Original: The U-Net segmentation head uses (starting with the original resolution) 16 , 32 , 64 ,and 256 convolutional ﬁlters for processing the features at the different scales.
Revised: The U-Net segmentation head uses (starting with the original resolution) 16 , 32 , 64 ,and 256 convolutional ﬁlters for processing the features at the different scales.

Original: To avoid dimension mismatches in the segmentation head, all input images are zero-padded to a height and width that is the next multiple of 32 .
Revised: To avoid dimension mismatches in the segmentation head, all input images are zero-padded to a height and width that is the next multiple of 32 .

Original: Data and preprocessing.
Revised: Data and preprocessing.

Original: We evaluate our certiﬁcates on the Pascal-VOC 2012 segmentation validation set.
Revised: We evaluate our certiﬁcates on the Pascal-VOC 2012 segmentation validation set.

Original: We do not use the test set, because evaluating metrics like the certiﬁed accuracy requires access to the ground-truth labels.
Revised: We do not use the test set, because evaluating metrics like the certiﬁed accuracy requires access to the ground-truth labels.

Original: For training, we use the 10582 Pascal segmentation masks extracted from the SBD dataset (Hariharan et al., 2011) (referred to as ”Pascal trainaug” or ”Pascal augmented training set” in other papers).
Revised: For training, we use the 10582 Pascal segmentation masks extracted from the SBD dataset (Hariharan et al., 2011) (referred to as ”Pascal trainaug” or ”Pascal augmented training set” in other papers).

Original: SBD uses a different data split than the ofﬁcial PascalVOC 2012 segmentation dataset.
Revised: SBD uses a different data split than the ofﬁcial PascalVOC 2012 segmentation dataset.

Original: We avoid data leakage by removing all training images that appear in the validation set.
Revised: We avoid data leakage by removing all training images that appear in the validation set.

Original: We downscale both the training and the validation images and ground-truth masks to 50% of their original height and width, so that we can use larger batch sizes and thus use our compute time to more thoroughly evaluate a larger range of different smoothing distributions.
Revised: We downscale both the training and the validation images and ground-truth masks to 50% of their original height and width, so that we can use larger batch sizes and thus use our compute time to more thoroughly evaluate a larger range of different smoothing distributions.

Original: The segmentation masks are downscaled using nearest-neighbor interpolation, the images are downscaled using the INTER AREA operation implemented in OpenCV (Bradski, 2000).
Revised: The segmentation masks are downscaled using nearest-neighbor interpolation, the images are downscaled using the INTER AREA operation implemented in OpenCV (Bradski, 2000).

Original: Training and data augmentation.
Revised: Training and data augmentation.

Original: We initialize our model weights using the weights provided by the Pytorch Segmentation Models library, which were obtained by pre-training on ImageNet.
Revised: We initialize our model weights using the weights provided by the Pytorch Segmentation Models library, which were obtained by pre-training on ImageNet.

Original: We train our models for 256 epochs, using Dice loss with batch size 64 and Adam( lr = 0 .
Revised: We train our models for 256 epochs, using Dice loss with batch size 64 and Adam( lr = 0 .

Original: 001 , β 1 = 0 .
Revised: 001 , β 1 = 0 .

Original: 9 , β 2 = 0 .
Revised: 9 , β 2 = 0 .

Original: 999 , (cid:15) =
Revised: 999 , (cid:15) =

Original: 10 − 8 , weight decay = 0 .
Revised: 10 − 8 , weight decay = 0 .

Original: Every 8 epochs, we compute the mean IOU on the validation set.
Revised: Every 8 epochs, we compute the mean IOU on the validation set.

Original: After training, we use the model that achieved the highest validation mean IOU.
Revised: After training, we use the model that achieved the highest validation mean IOU.

Original: We apply the following train-time augmentations: Each image is randomly shifted by up to 10% of its height and width, scaled by a factor from [0 . 5 , 2 . 0] and rotated between − 10 and 10 degrees using the ShiftScaleRotate augmentation implemented by the Albumentations library (version 0 .
Revised: We apply the following train-time augmentations: Each image is randomly shifted by up to 10% of its height and width, scaled by a factor from [0 . 5 , 2 . 0] and rotated between − 10 and 10 degrees using the ShiftScaleRotate augmentation implemented by the Albumentations library (version 0 .

Original: (Buslaev et al., 2020).
Revised: (Buslaev et al., 2020).

Original: The images are than cropped to a ﬁxed size of 128 × 160 .
Revised: The images are than cropped to a ﬁxed size of 128 × 160 .

Original: Where necessary, the images are padded with zeros.
Revised: Where necessary, the images are padded with zeros.

Original: Padded parts of the segmentation mask are ignored during training.
Revised: Padded parts of the segmentation mask are ignored during training.

Original: After these operations, each input is randomly perturbed using a Gaussian distribution with a ﬁxed standard deviation σ ∈ { 0 , 0 . 01 , . . .
Revised: After these operations, each input is randomly perturbed using a Gaussian distribution with a ﬁxed standard deviation σ ∈ { 0 , 0 . 01 , . . .

Original: All samples are clipped to [0 , 1] to retain valid RGBimages.
Revised: All samples are clipped to [0 , 1] to retain valid RGBimages.

Original: Certiﬁcation.
Revised: Certiﬁcation.

Original: We evaluate all certiﬁcates on the ﬁrst 50 images from the validation set that – after downscaling – have a resolution of 166 × 250 .
Revised: We evaluate all certiﬁcates on the ﬁrst 50 images from the validation set that – after downscaling – have a resolution of 166 × 250 .

Original: For our experiments, we use Monte Carlo randomized smoothing (see discussion in Section C).
Revised: For our experiments, we use Monte Carlo randomized smoothing (see discussion in Section C).

Original: We use 12288 samples for making smoothed predictions and 153600 samples for certiﬁcation.
Revised: We use 12288 samples for making smoothed predictions and 153600 samples for certiﬁcation.

Original: We use the signiﬁcance parameter α to 0 .
Revised: We use the signiﬁcance parameter α to 0 .

Original: 01 , i.e. all certiﬁcates hold with probability 0 .
Revised: 01 , i.e. all certiﬁcates hold with probability 0 .

Original: For the center smoothing baseline, we use the default parameters suggested by the authors ( ∆ = 0 .
Revised: For the center smoothing baseline, we use the default parameters suggested by the authors ( ∆ = 0 .

Original: 05 , β = 2 , α 1 =
Revised: 05 , β = 2 , α 1 =

Original: α 2 ).
Revised: α 2 ).

Original: For the na ¨ ıve collective certiﬁcate baseline, we use Holm correction to account for the multiple comparisons problem, which yields strictly better results than Bonferroni correction.
Revised: For the na¨ıve collective certiﬁcate baseline, we use Holm correction to account for the multiple comparisons problem, which yields strictly better results than Bonferroni correction.

Original: For our localized smoothing certiﬁcates, we use Bonferroni correction.
Revised: For our localized smoothing certiﬁcates, we use Bonferroni correction.

Original: For our localized smoothing distribution, we partition the input image into a regular grid of size 4 × 6 and deﬁne minimum standard deviation σ min and maximum standard deviation σ max .
Revised: For our localized smoothing distribution, we partition the input image into a regular grid of size 4 × 6 and deﬁne minimum standard deviation σ min and maximum standard deviation σ max .

Original: Let J ( k,l ) be the set of all pixel coordinates in grid cell ( k, l ) .
Revised: Let J ( k,l ) be the set of all pixel coordinates in grid cell ( k, l ) .

Original: To smooth outputs in grid cell ( i, j ) , we use a smoothing distribution N ( 0 , diag( σ ) with, ∀ k ∈ { 1 , . .
Revised: To smooth outputs in grid cell ( i, j ) , we use a smoothing distribution N ( 0 , diag( σ ) with, ∀ k ∈ { 1 , . .

Original: , 4 } , l ∈ { 1 , . . .
Revised: , 4 } , l ∈ { 1 , . . .

Original: , 6 } , d ∈ J ( k,l ) , [Equation] i.e. we linearly interpolate between σ min and σ max based on the l ∞ distance of grid cells ( i, j ) and ( k, l ) .
Revised: , 6 } , d ∈ J ( k,l ) , σ d = σ min + ( σ max − σ min ) · max ( | i − k | , | l − j | ), (139) i.e. we linearly interpolate between σ min and σ max based on the l ∞ distance of grid cells ( i, j ) and ( k, l ) .

Original: All results are reported for the relaxed linear programming formulation of our collective certiﬁcate (see Section A.4)
Revised: All results are reported for the relaxed linear programming formulation of our collective certiﬁcate (see Section A.4).

Original: For each grid cell, we use 124 = 14 · 6 of the samples, which corresponds to 512 samples for prediction and 6400 samples for certiﬁcation.
Revised: For each grid cell, we use 124 = 14 · 6 of the samples, which corresponds to 512 samples for prediction and 6400 samples for certiﬁcation.

Revised: The collective linear program is solved using MOSEK (version 9.2.46) (MOSEK ApS, 2019) through the CVXPY interface (version 1.1.13) (Diamond & Boyd, 2016).

Revised: E.2. H ARDWARE

Revised: All experiments on image segmentation were performed using a Xeon E5-2630 v4 CPU @

Revised: 2.20GHz, an NVIDA GTX 1080TI GPU and 128 GB of RAM.

Original: D.2. A DDITIONAL EXPERIMENTAL EVALUATION
Revised: E.2. C OMPLETE EXPERIMENTAL EVALUATION

Original: As explained in Section 8.1, the objective of our experiments on semantic segmentation is to verify our claim that localized smoothing allows for a better accuracy-robustness trade-off than randomized smoothing with i.i.d.
Revised: As explained in Section 8.1, the objective of our experiments on semantic segmentation is to verify our claim that localized smoothing allows for a better accuracy-robustness trade-off than randomized smoothing with i.i.d.

Original: distributions, i.e. it allows us to retain a higher prediction quality and simultaneously provide stronger collective robustness guarantees.
Revised: distributions, i.e. it allows us to retain a higher prediction quality and simultaneously provide stronger collective robustness guarantees.

Original: The ﬁrst step of our evaluation procedure is to evaluate the na¨ıve and the center smoothing baselines for Gaussian standard deviations σ ∈ { 0 . 1 , 0 . 2 , 0 . 3 , 0 . 4 , 0 . 5 } and – for each σ – ﬁnd a combination of localized smoothing parameters σ min , σ out that result in equal or higher accuracy and stronger certiﬁcates, as measured by certiﬁed accuracy and certiﬁed ratio.
Revised: The ﬁrst step of our evaluation procedure is to evaluate the na ¨ ıve and the center smoothing baselines for Gaussian standard deviations σ ∈ { 0 . 1 , 0 . 2 , 0 . 3 , 0 . 4 , 0 . 5 } and – for each σ – ﬁnd a combination of localized smoothing parameters σ min , σ out that result in equal or higher accuracy and stronger certiﬁcates, as measured by certiﬁed accuracy and certiﬁed ratio.

Original: Figs.
Revised: Figs.

Original: 5 to 8 show the certiﬁed accuracy and certiﬁed ratio curve for all 10 pairs of baseline and locally smoothed models ( 5 per baseline).
Revised: 5 to 8 show the certiﬁed accuracy and certiﬁed ratio curve for all 10 pairs of baseline and locally smoothed models ( 5 per baseline).

Original: The  certiﬁed ratioAUC and certiﬁed ratio AUC for all smoothed models are summarized in Tables 1 and 2.
Revised: The AUC of the certiﬁed ratio and certiﬁed ratio curves for all smoothed models are summarized in Tables 1 and 2.

Original: Safe for center smoothing with σ = 0 .
Revised: Safe for center smoothing with σ = 0 .

Original: 2 , which has a slightly higher certiﬁed ratio, we can outperform all baselines.
Revised: 2 , which has a slightly higher certiﬁed ratio but lower accuracy, we can outperform all baselines.

Original: The second step is to ﬁx the found localized smoothing parameters and perform a ﬁne-grained search over σ ∈ [0 , 1] .
Revised: The second step is to ﬁx the found localized smoothing parameters and perform a ﬁne-grained search over σ ∈ [0 , 1] .

Original: This is to ensure that our previous results were not caused by a particularly poor choice of baseline parameters.
Revised: This is to ensure that our previous results were not caused by a particularly poor choice of baseline parameters.

Original: Table 5 summarizes the results.
Revised: Table 5 summarizes the results.

Original: It shows that there is no σ in our search space for which the baselines outperform the locally smoothed model w.r.t.
Revised: It shows that there is no σ in our search space for which the baselines outperform the locally smoothed model w.r.t.

Original: our metrics of certiﬁcate strength.
Revised: our metrics of certiﬁcate strength.

Original: Figure Fig.
Revised: Figure Fig.

Original: 4 demonstrates why there is no σ that outperforms our baselines, using the certiﬁed ratio of the na¨ıve collective certiﬁcate baseline as an example.
Revised: 4 demonstrates why there is no σ that outperforms our baselines, using the certiﬁed ratio of the na¨ıve collective certiﬁcate baseline as an example.

Original: The certiﬁcate strength, as measured by the certiﬁed ratio AUC, increases with σ .
Revised: The certiﬁcate strength, as measured by the certiﬁed ratio’s AUC, increases with σ .

Original: But the model’s accuracy decreases with σ .
Revised: But the model’s accuracy decreases with σ .

Original: Therefore, strengthening the certiﬁcate requires sacriﬁcing some accuracy.
Revised: Therefore, strengthening the certiﬁcate requires sacriﬁcing some accuracy.

Original: But the locally smoothed models were already as accurate or more accurate than the baselines, which makes it impossible for the baselines to simultaneously attain a higher accuracy and stronger certiﬁcates.
Revised: But the locally smoothed models were already as accurate or more accurate than the baselines, which makes it impossible for the baselines to simultaneously attain a higher accuracy and stronger certiﬁcates.

Original: To summarize: Localized smoothing appears to indeed offer a better trade-off between certiﬁed accuracy and robustness.
Revised: To summarize: Localized smoothing appears to indeed offer a better trade-off between certiﬁed accuracy and robustness.

Original: In  8.1, we mentioned the potential concern raised by comparing base classiﬁers with different trained weights.
Revised: In Section 8.1, we mentioned that we compare base classiﬁers with different trained weights.

Original: For i.i.d.
Revised: For i.i.d.

Original: smoothing with σ , we loaded models trained with σ train =
Revised: smoothing with σ , we loaded models trained with σ train =

Original: σ .
Revised: σ .

Original: For localized smoothing, we loaded models trained with σ train =
Revised: For localized smoothing, we loaded models trained with σ train =

Original: σ min .
Revised: σ min .

Original: To show that this is not the reason why we outperform the baselines, we compare the same i.i.d.
Revised: To show that this is not the reason why we outperform the baselines, we compare the same i.i.d.

Original: and localized smoothing distributions as before, but use σ train
Revised: and localized smoothing distributions as before, but use σ train

Original: =
Revised: =

Original: σ min for all models.
Revised: σ min for all models.

Original: The results are summarized in Appendix D.2. and Table 4.
Revised: The results are summarized in Appendix E.2.3 and Table 4.

Original: Overall, there is only a single instance in which the baselines are better than the localized smoothing certiﬁcate in any of our metrics:
Revised: Overall, there is only a single instance in which the baselines are better than the localized smoothing certiﬁcate in any of our metrics:

Original: For σ = 0 .
Revised: For σ = 0 .

Original: 3 , the na¨ıve baseline attains an accuracy of 79 .
Revised: 3 , the na¨ıve baseline attains an accuracy of 79 .

Original: 5% that is 0 .
Revised: 5% that is 0 .

Original: 4 p .
Revised: 4 p .

Original: p .
Revised: p .

Original: higher than that of the locally smoothed model.
Revised: higher than that of the locally smoothed model.

Original: Its certiﬁed accuracyAUC and certiﬁed ratio AUC of 0 . 492 and 0 . 5615 , respectively, are however much smaller than the 0 . 5869 and 0 .
Revised: The AUC of its certiﬁed accuracy and certiﬁed ratio curves – 0 . 492 and 0 . 5615 , respectively – are however much smaller than the 0 . 5869 and 0 .

Original: 6579 guaranteed by localized smoothing.
Revised: 6579 guaranteed by localized smoothing.

Original: So, even with this different choice of weights, localized smoothing appears to guarantee a better trade-off between accuracy and provable robustness.
Revised: So, even with this different choice of weights, localized smoothing appears to guarantee a better trade-off between accuracy and provable robustness.

Original: [Figure]
Revised: On average, each collective linear program only took 0 . 68 s to solve. This computational overhead is small compared to amount of time needed to obtain the randomized smoothing certiﬁcates through Monte Carlo sampling, an average 460 s per image.

Original: [Table]
Revised: [Figure]

Original: [Table]
Revised: ﬁ e d r a ti o AU C [Figure]

Original: [Table] [Table] 
Revised: [Table] [Table] [Table]

Original:  for σ ∈ { 0 . 1 , 0 . 2 , 0 . 3 , 0 . 4 , 0 . 5 } and different σ min and σ max .
Revised: baseline and localized smoothing for σ ∈ { 0 . 1 , 0 . 2 , 0 . 3 , 0 . 4 , 0 . 5 } and different σ min and σ max .

Original: Unlike in Table 1, we also load the model trained with σ min for the baselines.
Revised: Unlike in Table 1, we also load the model trained with σ min for the baselines.

Original: Safe for σ = 0 .
Revised: Safe for σ = 0 .

Original: 3 , where the baseline has a higher accuracy but much weaker certiﬁcates, localized smoothing again offers a higher accuracy and stronger certiﬁcates.Center smoothing
Revised: 3 , where the baseline has a higher accuracy but much weaker certiﬁcates, localized smoothing again offers a higher accuracy and stronger certiﬁcates.

Original: [Table]
Revised: [Table]

Original: [Table][Table]
Revised: [Table]

Original: [Table]
Revised: [Table]

Original: C e r ti ﬁ e d r a ti o
Revised: C e r ti ﬁ e d r a ti o

Original: Na¨ıve

Original: [Table]
Revised: [Table]

Original: C e r ti ﬁ e d r a ti o Na¨ıve Localizedsmoothing
Revised: LPlocalized

Original: [Table]
Revised: [Table]

Original: Na¨ıve
Revised: C e r ti ﬁ e d r a ti o

Original: [Table]
Revised: [Table]

Original: C e r ti ﬁ e d r a ti o
Revised: C e r ti ﬁ e d r a ti o

Original: Na¨ıve Localizedsmoothing
Revised: LPlocalized Na¨ıvelocalized

Original: [Table] [Figure]
Revised: Na¨ıve i.i.d. [Figure]

Original: [Table]
Revised: [Table]

Original: C e
Revised: C e

Original: [Table]
Revised: [Table]

Original: ti ﬁ e d acc
Revised: ti ﬁ e d acc

Original: [Table]
Revised: [Table]

Original:  ac y
Revised: r ac y

Original: [Table]
Revised: [Table]

Original: C
Revised: C

Original: [Table]
Revised: [Table]

Original:  ﬁ
Revised: ti ﬁ

Original: [Table]
Revised: [Table]

Original: d accu
Revised: d acc

Original: [Table]
Revised: [Table]

Revised: r

Revised: [Table]

Original: ac y
Revised: [Figure] LPlocalized Na¨ıvelocalized Na¨ıve i.i.d.

Original: [Table] [Figure] 
Revised: [Figure] [Table]

Revised: C e r ti ﬁ e d r a ti o

Original: [Table]
Revised: [Table]

Original: C e r ti ﬁ e d r a ti o
Revised: C e r ti ﬁ e d r a ti o

Revised: [Table]

Original: Centersmoothing
Revised: C [Table] ti ﬁ [Table]

Original: Localizedsmoothing
Revised: d r a ti o LPlocalized

Original: [Table]
Revised: [Figure]

Original: Centersmoothing
Revised: Centersmoothing

Original: Localizedsmoothing [Table] 
Revised: [Figure] [Table] ti ﬁ

Original: C e r ti ﬁ e d r a ti o

Original: Centersmoothing

Original: Localizedsmoothing

Original: [Table]
Revised: [Table]

Original: Centersmoothing

Original: Localizedsmoothing

Original: [Table]
Revised: [Figure]

Original: C e r ti ﬁ e d r a ti o Centersmoothing Localizedsmoothing [Table]
Revised: LPlocalized

Original: [Figure]

Original: [Table]

Original: Centersmoothing

Original: Localizedsmoothing

Original: [Table]

Original: Centersmoothing

Original: Localizedsmoothing [Table] Centersmoothing Localizedsmoothing
Revised: Na¨ıvelocalized

Original: [Table]

Original: Centersmoothing
Revised: Centersmoothing

Original: [Table]

Original: acc

Original: [Table]

Original: ac

Original: [Table]

Original: Centersmoothing

Original: Localizedsmoothing (

Original: [Figure]
Revised: [Figure]

Original: D. N ODE CLASSIFICATION
Revised: E. N ODE CLASSIFICATION

Original: We ﬁrst discuss the experimental setup and the necessary parameters for our training and certiﬁcation procedure before we show additional experimental results in Section D.3.2.
Revised: We ﬁrst discuss the experimental setup and the necessary parameters for our training and certiﬁcation procedure before we show additional experimental results in Section E.3.3.

Original: D.
Revised: E.

Original: . E XPERIMENTAL S ETUP AND H YPERPARAMETERS
Revised: . E XPERIMENTAL S ETUP AND H YPERPARAMETERS

Original: Metric
Revised: Metric

Original: In the node classiﬁcation setting we are generally only concerned with certiﬁed accuracy.
Revised: In the node classiﬁcation setting we are generally only concerned with certiﬁed accuracy.

Original: To calculate this accuracy, we only consider nodes that are correctly classiﬁed, where the method does not abstain, and is certiﬁably robust for the given perturbation.
Revised: To calculate this accuracy, we only consider nodes that are correctly classiﬁed, where the method does not abstain, and is certiﬁably robust for the given perturbation.

Original: Model We test two different models: 2 -layer APPNP (Klicpera et al., 2019) and 6 -layer GCN (Kipf & Welling, 2017).
Revised: Model We test two different models: 2 -layer APPNP (Klicpera et al., 2019) and 6 -layer GCN (Kipf & Welling, 2017).

Original: For both models we use a hidden size of 64 and dropout with a probability of 0 . 5 .
Revised: For both models we use a hidden size of 64 and dropout with a probability of 0 . 5 .

Original: Furthermore, for the propagation step of APPNP we use 10 for the number of interactions and 0 .as value for α .
Revised: Furthermore, for the propagation step of APPNP we use 10 for the number of interactions and 0 .as value for α .

Original: Data and preprocessing.
Revised: Data and preprocessing.

Original: We evaluate our approach on the Cora-ML node classiﬁcation dataset.
Revised: We evaluate our approach on the Cora-ML node classiﬁcation dataset.

Original: We perform standard preprocessing, i.e., remove self-loops, make the graph undirected and select the largest connected component.
Revised: We perform standard preprocessing, i.e., remove self-loops, make the graph undirected and select the largest connected component.

Original: For the localized smoothing approach we perform Metis clustering (Karypis & Kumar, 1998) to partition the graph into 5 clusters.
Revised: For the localized smoothing approach we perform Metis clustering (Karypis & Kumar, 1998) to partition the graph into 5 clusters.

Original: We create an afﬁnity ranking by counting the number of edges which are connecting cluster i and j .
Revised: We create an afﬁnity ranking by counting the number of edges which are connecting cluster i and j .

Original: This ranking is used to select the noise parameter for smoothing the attributes of cluster j while classifying a node of cluster i .
Revised: This ranking is used to select the noise parameter for smoothing the attributes of cluster j while classifying a node of cluster i .

Original: Training and data augmentation All models are trained with a learning rate of 0 .
Revised: Training and data augmentation All models are trained with a learning rate of 0 .

Original: 001 and weight decay of 0 .
Revised: 001 and weight decay of 0 .

Original: The models we use for sparse smoothing are trained with the noise distribution that is also reported for certiﬁcation.
Revised: The models we use for sparse smoothing are trained with the noise distribution that is also reported for certiﬁcation.

Original: The localized smoothing models are trained on the their minimal noise level, i.e., not with localized noise but with only θ +min and θ − min .
Revised: The localized smoothing models are trained on the their minimal noise level, i.e., not with localized noise but with only θ +min and θ − min .

Original: Certiﬁcation In the node classiﬁcation setting the noise parameter space is large.
Revised: Certiﬁcation In the node classiﬁcation setting the noise parameter space is large.

Original: Instead of only one noise parameter as used in the image segmentation scenario, we can vary ﬂip probabilities for addition and deletion.
Revised: Instead of only one noise parameter as used in the image segmentation scenario, we can vary ﬂip probabilities for addition and deletion.

Original: Apart from that we need lower and upper values for each of those.
Revised: Apart from that we need lower and upper values for each of those.

Original: Therefore, we just selected the minimum parameters and focused on optimising the baseline around these noise levels as described in Section 8.2.
Revised: Therefore, we just selected the minimum parameters and focused on optimising the baseline around these noise levels as described in Section 8.2.

Original: The speciﬁc noise parameters and baseline search space regions can be seen in the captions of the respective ﬁgures.
Revised: The speciﬁc noise parameters and baseline search space regions can be seen in the captions of the respective ﬁgures.

Revised: The collective linear program is solved using MOSEK (version 9.2.46) (MOSEK ApS, 2019) through the CVXPY interface (version 1.1.13) (Diamond & Boyd, 2016).

Revised: E.3. H ARDWARE

Revised: All experiments on image segmentation were performed using an AMD EPYC 7543 CPU @ 2.80GHz, an NVIDA A100 GPU and 32 GB of RAM.

Original: D.3. A DDITIONAL E XPERIMENTAL E VALUATION
Revised: E.3. A DDITIONAL E XPERIMENTAL E VALUATION

Original: In Fig.
Revised: In Fig.

Original: 9, we can see a comparison of our localized smoothing approach to sparse smoothing for a
Revised: 9, we can see a comparison of our localized smoothing approach to sparse smoothing for a

Original: GCN model with 6-layers.
Revised: GCN model with 6-layers.

Original: The noise levels are in the samemagnitude as the ones shown in Fig.
Revised: Here, the smoothing distribution is the same as the one used in Fig.of Section 8.2.

Original: In Fig.
Revised: In Fig.

Original: 10, we can see a comparison for another APPNP model but with smaller minimal noise levels.
Revised: 10, we can see a comparison for an APPNP model but with smaller minimal noise levels.

Original: We can see that in all experiments for deletion, the localized smoothing approach outperforms the baselines.
Revised: We can see that in all experiments for deletion, the localized smoothing approach outperforms the baselines.

Original: In the deletion setting we increase theaverage certiﬁed accuracy  AUCof all three experiments from  12 .
Revised: In the deletion setting we increase the certiﬁed accuracy curve’s AUC from an average 12 .

Original: 28by 54% to 18 . 
Revised: 28 to 18 . 93 (i.e. by 54% ).

Original: In the addition scenario the average decreases from 6 .
Revised: In the addition scenario the AUC, averaged over all experiments, decreases from 6 .

Original: 85% by 11 . 25% to 6 .
Revised: 85 to 6 . 08 (i.e. by 11 . 25% ).

Original: This is mainly due to the results of the experiment that can be seen in Fig.
Revised: This is mainly due to the results of the experiment that can be seen in Fig.

Original: In the baseline evaluation process both noise parameters for sparse smoothing are signiﬁcantly larger than our min-values.
Revised: In the baseline evaluation process both noise parameters for sparse smoothing are signiﬁcantly larger than our min-values.

Original: This shows that our values may be too small in this scenario.
Revised: This shows that our values may be too small in this scenario.

Original: Fig.
Revised: Fig.

Original: 11 compares the variance certiﬁcate to the sparse smoothing certiﬁcate of Bojchevski et al.
Revised: 11 compares the variance certiﬁcate to the sparse smoothing certiﬁcate of Bojchevski et al.

Original: That is, we use only one cluster and the same noise levels and models for our approach and the baseline, i.e., θ + = 0 .
Revised: That is, we use only one cluster and the same noise levels and models for our approach and the baseline, i.e., θ + = 0 .

Original: 01 and θ − = 0 .
Revised: 01 and θ − = 0 .

Original: We observe thatin for both models the variance certiﬁcate yields better results for deletion.
Revised: We observe that for both models the variance certiﬁcate yields better results for deletion.

Original: However, in the addition setting, it is outperformed by the baseline.
Revised: However, in the addition setting, it is outperformed by the baseline.

Original: If we look at Proposition 6, we can see that we multiply the adversarial budget for addition with γ + and the one for deletion with γ − .
Revised: If we look at Theorem 2, we can see that we multiply the adversarial budget for addition with γ + [Figure] C e r ti ﬁ e d acc u r ac y LP localized

Revised: Na¨ıve localized

Original: As γ + has θ + in the denominator the small noise level for addition results in larger values for γ + .
Revised: Na¨ıve i.i.d. [Figure] [Figure] C e r ti ﬁ e d acc u r ac y

Revised: LP localized

Revised: Na¨ıve localized

Revised: Na¨ıve i.i.d.

Revised: In the deletion scenario we outperform the baseline with an AUC of 21 .

Revised: 76 non-collective).

Revised: For addition the sparse smoothing performs slightly better than our certiﬁcate with AUC of 9 .

Revised: ( 6 . 39 non-collective).

Revised: However, the our approach performs signiﬁcantly better in small perturbation regions and also in clean accuracy (0 perturbation).

Original: For these parameters we have γ + = 2 .and
Revised: [Figure] i.i.d. Number of adversarial deletions 0 .0 .0 .0 .0 .1 . C e r ti ﬁ e d acc u r ac y

Original: γ − = 0 . 491 which shows why the certiﬁcate is less robust to adversarial additions.
Revised: LP localized Na¨ıve localized

Original: This is consistent with  the other experiments where our results are on par or worse than the baseline for additions but we outperform it for deletions.
Revised: Na¨ıve i.i.d. and the one for deletion with γ − . As γ + has θ + in the denominator the small noise level for addition results in larger values for γ + . For these parameters we have γ + = 2 .

Original: [Figure]
Revised: 795 and γ − = 0 .

Original:  adversarial [Figure] C e r ti ﬁ e d acc u r ac y
Revised: 491 which shows why the certiﬁcate is less robust to adversarial additions.

Original: Sparse smoothing Localized smoothing Number of adversarial deletions 0 .0 .0 .0 .0 .1 . C e r ti ﬁ e d acc u r ac y
Revised: This is consistent with the other experiments where our results are on par or worse than the baseline for additions but we outperform it for deletions.

Original: [Figure]

Original: [Figure]

Original: adversarial

Original: [Figure]

Original: ti

Original: [Figure]

Original: e

Original: [Figure]

Original: We localized smoothing min θ min θ +max 08 , θ max 95 ) with sparse smoothing with ( θ + = 0 . 0085 , θ − = 0 . for addition and ( θ + = 0 .
Revised: On average, each collective linear program only took 10 .

Original: 007 , θ − = 0 .

Original: 755 ) for deletion. These conﬁgurations yield the largest AUC of 5 . 62 for addition and 14 . 29 for deletion compared to all combinations θ + ∈ { 0 . 01 } and θ − ∈ [0 . 1 , . . . In the deletion scenario we outperform the baseline with an AUC of 18 .
Revised: 9 s to solve.

Original: 76 ( 14 .non-collective). However, the sparse smoothing performs better for addition than our certiﬁcate which only yields a AUC of 3 . 39 ( 2 . 54 non-collective). We observe that the optimal parameters for addition are both signiﬁcantly larger than our minimal ones.
Revised: The reason that the linear programs for graphs required more time than those for image, even though they involve fewer constraints and variables, is that a different, not as well-vectorized implementation was used.

Original: [Figure]
Revised: [Figure]

Original: C e r ti ﬁ e d acc u r ac y
Revised: C e r ti ﬁ e d acc u r ac y

Original: [Figure] [Figure]
Revised: [Figure] [Figure]