C ERTIFIED R OBUSTNESS ON S TRUCTURAL G RAPH
M ATCHING
Anonymous authors
Paper under double-blind review
A BSTRACT
The vulnerability of graph matching (GM) to adversarial attacks has received increasing attention from emerging empirical studies, while the certified robustness of GM has not been explored.
Inspired by the technique of randomized smoothing, in this paper, for the first time to our best knowledge, the certified robustness on GM is defined and a new certification strategy is designed called Structure-based Certified Robustness of Graph Matching (SCR-GM).
Structural prior information of nodes is used to construct a joint smoothing distribution matrix with physical significance, which certifies a wider range than those obtained by previous iterative optimization methods.
Furthermore, we propose a certified space that can be used to derive a strictly certified radius and two extra radii for evaluation.
Experimental results on GM datasets reveal that our strategy achieves state-of-the-art ℓcertified accuracy and regions. Source code will be made publicly available.
I NTRODUCTION
As a well-known NP-hard problem in its general form (Yan et al., 2016) with wide applications e.g. in computer vision and pattern recognition, graph matching (GM) refers to establishing correspondences among two (Cho et al., 2010) or multiple graphs (Jiang et al., 2021).
Given two input graphs G 1 = { V 1 , E 1 } and G 2 = { V 2 , E 2 } with two sets of annotated nodes z 1 ∈ R n 1 × 2 and z 2 ∈ R n 2 ×(assumed in Euclidean space in this paper).
Here, V 1 ∈ R d v × n 1 and E 1 ∈ R d e × m 1 represent the feature matrix of n 1 nodes and m 1 edges (likewise for V 2 and E 2 ).
The similarities between nodes and edges are formulated into a global affinity matrix K ∈ R n 1 n 2 × n 1 n 2 , whose diagonal and off-diagonal elements store the node-to-node and edge to-edge affinities.
It aims to maximize the overall affinity score J of the matching nodes and the edges (Leordeanu & Hebert, 2005) in the form of quadratic assignment problem (QAP)
(Loiola et al., 2007):
[Equation]
where vec( X ) denotes the column-wise vector of the matching solution X ∈ { 0 , 1 } n 1 × n 2 which can be a partial permutation matrix when n 1 < n 2 .
One common approach is to relax X ’s raw binary constraint into a continuous one (between [0,1]), especially in the form of (partial) doubly-stochastic matrix S ∈ [0 , 1] n 1 × n 2 of which the sum of rows/columns is 1 (or zero for partial case).
The final X can be obtained by the Hungarian algorithm (Burkard & Dell’Amico, 2009):
X =
Hung ( S ) .
Eq.
1 can also directly incorporate deep nets to obtain the learned affinity matrix K by learning the raw attributes of the graphs e.g. CNNs for images from which the visual graphs are extracted, as well as learning the structure via graph neural networks (GNNs)
(Wang et al., 2019): K =
NN ( G 1 , G 2 ) .
Studies on robustness of machine learning models have attracted wide attention, while the robustness of combinatorial solvers is an emergning and unmatured topic (Geisler et al., 2021; Lu et al., 2021).
Under the deep GM paradigm, Ren et al.
(2022) reveal that the combinatorial GM algorithms can also be sensitive to (additive) noise perturbations not only in appearance but also for structure, similar to the node classification models (Dai et al., 2018; Sun et al., 2018), and an empirical defense algorithm via an appearance-aware regularizer is proposed.
So far, there still lacks principled certified defense to provide theoretical robustness guarantees for GM (let alone other combinatorial problems).
In fact, existing certified robustness mechanisms (including randomized smoothing) in the graph domain (Rong et al., 2019; Bojchevski et al., 2020; Z¨ugner & G¨unnemann, 2020; Jia et al., 2020) are confined to unconstrained node or graph-level classification/prediction within a single graph, which cannot be readily adopted for solving the cross-graph and combinatorial problems with structured output like the permutation matrix in GM.
Certifiable robustness studies solvers whose prediction at any point x is verifiably constant within some set around x (Wong & Kolter, 2018).
As a recent promising approach to achieve certified defense, randomized smoothing (RS) (Lecuyer et al., 2019; Cohen et al., 2019) provides a general robust guarantee applicable to large-scale neural networks against arbitrary attacks.
Given an input x and a base classifier, randomized smoothing constructs a ‘smoothed classifier’ which is certifiable within the region characterized by x and the smoothing distribution D .
RS has been used in certifying different models, e.g., image classification (Yang et al., 2020) and object detection in vision (Chiang et al., 2020).
As an initiative for applying RS to GM 1 , in this paper we mainly consider two major challenges to solve.
C1: varying-size of input graphs.
It is not suitable to certify graphs with different sizes by using an identical smoothing distribution.
C2: dependency of nodes in graph.
The graph structure as a whole carries important information for certification.
For the first challenge, we could refer to data-dependent certified robustness methods on image classification task.
Some data-dependent methods (Alfarra et al., 2022; Eiras et al., 2021; Hong & Hong, 2022; Labarbarie et al., 2022) are proposed recently to vary and optimize the smoothing distributions D for larger certification region.
Therefore, these methods can also be used to construct varying smoothing distributions for graphs with varying sizes.
For the second challenge, we expect smoothing distributions constructing correlations between nodes in a graph, which is lacking for current randomized smoothing.
Datadependent methods consider little on the heterogeneity and structure of inputs.
For example, Alfarra et al.
(2022) treat all pixels in one image equally, Eiras et al.
(2021) treat pixels differently but cannot reveal their correlation. Thus none of them can overcome the second challenge.
In this paper, we aim to solve certified robustness of GM, by analyzing the individual matching robustness of each node, instead of the whole variation of the output matching matrix X in Eq. 1.
In particular, we study the node classification task when converting the relaxed solution S into the final matching X (see Eq.
and the discussion therein), as such the RS-type certification phase can be naturally introduced during the classification stage.
Specifically, we propose the S tructure-based C ertified R obustness of G raph M atching (SCR-GM) which adopts joint Gaussian distribution instead of independent homogeneous distribution to construct the smoothing solvers.
As adversarial attacks tend to perturb the strongly correlated nodes at the same time, the additive noise sampled from joint distribution with structural information and physical meaning can reveal this correlation.
According to our theoretical analysis, we obtain the robustness guarantee on GM which describes a certified ℓ 2 -norm space ant its lower bound radius.
In addition, we propose another two radii to help evaluate the robustness more comprehensively.
We evaluate our strategy on Pascal VOC dataset (Everingham et al., 2010) with Berkeley annotations (Bourdev & Malik, 2009) and simulation dataset with random node sets.
Experimental results reveal that our strategy outperforms the previous works (Cohen et al., 2019; Alfarra et al., 2022; Eiras et al., 2021) on structural GM for ℓ 2 certified accuracy and regions.
Our contributions are as follows:
1) We propose a general framework for incorporating existing RS-based techniques for certifying graph matching solvers, as long as (which is often the case for both learning-based and classic solvers) it involves a post-binarization step that converts the relaxed matching S (by an arbitrary relaxed GM solver) to node matching. 2) Based our proposed framework, we present the first definition, to our best knowledge (see Eq. 5) of certified robustness for a graph matching solver.
We propose a certification method dubbed structure-based certified robustness of GM (SCR-GM) (see Sec. 4.3). It uses jointly distributed noise to model dependent node matching certification.
A certified space and lower bound radius are derived to guarantee robustness of graph matching.
Two radii are also devised for more complete evaluation of robustness, which complements potentially safe regions and largest feasible perturbations.
R ELATED WORK
We discuss works on certified robustness related to randomized smoothing and robustness of GM. Certified Robustness related to Randomized Smoothing Lecuyer et al.
(2019) propose randomized smoothing firstly as a certified adversarial defense, and use it to train the first certifiably robust classifier for ImageNet. However, its guarantees are loose, then Cohen et al. (2019) shows that adding Gaussian noise to classifiers enjoys a strict ℓ 2 certification radius, with follow-ups presenting new RS-type techniques, such as optimal perturbations at different norms, and certified robustness definitions for different tasks.
Alfarra et al.
(2022) show that the variance of the Gaussian distributions can be optimized at each input so as to maximize the certification region.
Meanwhile, Eiras et al.
(2021) extend isotropic smoothing distributions to generalized anisotropic counterparts.
Hong & Hong (2022) adopt the same anisotropic defination and further design a noise generator to efficiently fine-tune the distributions.
A recent work (Labarbarie et al., 2022) that relies on information geometry techniques manages to prove larger regions than previous methods.
However, all previous smoothing distributions D deprive the favorable prior knowledge which mainly refers to the node location and graph structure in GM.
Moreover, all of them at most certify a single image or graph but do not consider the combinatorial nature of the prediction as in GM.
Robustness of Graph Matching Approximate GM solvers have been developed over the decades from traditional learning-free methods (Emmert-Streib et al., 2016) to learning-based ones (Yan et al., 2020).
The seminal work (Zanfir & Sminchisescu, 2018) proposes a deep neural network based pipeline for visual GM, in which the visual appearance features are learned via CNN, with subsequent variants (Wang et al., 2019;
Rol ´ ınek et al., 2020), among which a major improvement is to explore the structural information using different techniques e.g. GNN, rather than only appearance features for node/edge attributes as done in (Zanfir & Sminchisescu, 2018).
Our work treats the GM solver as blackbox regardless it is learning-based or not, as long as it involves a continuous relaxation to obtain the intermediate double-stochastic matrix.
There is also an emerging line of research on adversarial attack and defense on (deep) GM.
The earlier work (Yu et al., 2019b) proposes a robust graph matching (RGM) model to improve the robustness against perturbations e.g. distortion, rotation, outliers and noise.
Zhang et al. (2020) devise an adversarial attack model for deep GM networks, which uses kernel density estimation to construct dense regions such that the neighboring nodes are indistinguishable.
Ren et al.
(2021) devise two specific topology attacks in GM: inter-graph dispersion and intra-graph combination attacks, and propose a resilient defense model.
Ren et al. (2022) design an attack perturbing input images and their hidden graphs together for deep (visual) GM, and further propose appearanceaware regularizers to enlarge the disparity among similar keypoints for defense.
However, the above defense methods are all heuristic and lacks robustness certification in face of other unseen attacks.
P RELIMINARIES ON R ANDOMIZED S MOOTHING
The original RS (Cohen et al., 2019) can transform an arbitrary base classifier f into a smoothed classifier g that is certifiably robust under ℓ 2 norm.
For any input x , the smoothed classifier g returns the most probable prediction of f for the random variable N ( x ; σ 2 I ) , which is defined by:
[Equation]
where ε ∼ N (cid:0) 0 , σ 2 I (cid:1) is isotropic Gaussian noise perturbing the input x .
Then the certified radius within which the output is unchanged for g ( x + δ )
=
c A that measures the certified robustness is:
[Equation]
where the most probable class c A is returned with probability p A and the ‘runner-up’ class is returned with probability p B .
p A and p B are lower bound and upper bound of p A and p B respectively, and Φ − 1 is the inverse of the standard Gaussian cumulative distribution function.
The smoothed classifier g is robust around x within the ℓ 2 radius in Eq.
To enhance the certification, Alfarra et al.
and Eiras et al.
(2021) propose isotropic and anisotropic distributions to maximize the certified region respectively.
However, none of them can explicitly encode the prior information of the inputs (e.g. the graph topology in GM) which means their distributions are randomly initialized.
Differently, we propose a correlation matrix to reveal the structural information in graphs, and in turn construct a joint Gaussian distribution to replace the single Gaussian distribution, which not only makes the initial distribution physically meaningful, but also eliminates the optimization process of finding the largest certified region.
M ETHODOLOGY
We first define the smoothed GM solver (be either neural network or traditional solver) and propose a robustness guarantee.
We then devise a new certification strategy SCR-GM using a physically meaningful joint smoothing distribution.
We also give two new radii to aid evaluating robustness.
4. P ROBLEM F ORMULATION
For pairwise GM with input (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) , we mainly focus on the effect of perturbing two sets of annotated nodes z 1 ∈ R n 1 × 2 and z 2 ∈ R n 2 × 2 .
For visual GM (Zanfir & Sminchisescu, 2018; Ren et al., 2022) as widely considered in literature, z 1 and z 2 are node coordinates obtained by human annotation or keypoint detectors.
During the certification for perturbing nodes, here we consider the node coordinates as the input while keep the node/edge attributes as unchanged.
The robustness guarantees of perturbing features are given in Appendix B.
As discussed in Sec. 3, randomized smoothing (RS) is a technique for constructing a smoothed function g from an arbitrary base function f .
In this paper, we technically convert a whole matching problem into a set F regarding with binary classification based on the intermediate matrix S .
The set F can be expressed as: F = { f i |
f i : (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) → r j , i ∈ n 1 , j ∈ n 2 } , where f i represents that the i -th node in z 1 matches the j -th node in z 2 and r j represents the j -th node r j in z 2 .
Such a conversion allows us to certify the matching robustness for a single node, avoiding an imprecise certification for the entire matching matrix.
The smoothed network g i returns whichever node in zis most likely to match the node in z 1 when the input is perturbed by joint smoothing noise:
[Equation]
where ε ∼ N (0 , Σ ) , i ∈ n 1 , j ∈ n 2 . For convenience, we simplify f i (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) to f i ( z 1 ) and derive the results by perturbing zonly, as it is equivalent to robustness certification under joint perturbation to z 1 and z 2 . Furthermore, we propose a method which defines the smoothed function for certifying whole X as introduced in
Appendix. E. The distribution of noise ε is a joint Gaussian distribution matrix whose variance represents the correlation between nodes.
In addition, Σ is a hyperparameter for certified function which controls a robustness/accuracy trade-off and will be detailed in Sec. 4.3.
Note that for robustness certification, we only consider those nodes that can obtain a unique solution arg max in Eq. 4.
4. R OBUSTNESS G UARANTEE
Suppose that when the base function f i solves for the optimal matching of node i in z 1 , the most probable node r A in z 2 is returned with probability
p A = max s i ∈ S
i s i , where S i is the i -th row of S .
Similarly, the probability of ”runner-up” node r B in z 2 is denoted as p B , p B = max s i ∈ S i ,r B ̸
=
r A s i .
We adopt an ℓ 2 certified space to guarantee robustness of graph matching.
Theorem 1 ( ℓ 2 certified space) Let f i ( z 1 ) be node matching function, g i be defined as in Eq. 4, and ε ∼ N (0 , Σ ) .
If p A ∈ [0 , 1] and p B ∈ [0 , 1] satisfy:
[Equation]
then for g i ( z 1 + δ ) =
r A , we can get the certified ℓ 2 space for the addictive noise δ :
[Equation]
where B ⊤ B = Σ , and B ∈ R n 1 × n 1 is a full rank and real symmetric matrix based on the node correlation in node matrix z 1 , and p A and p B are the lower bound of p A and upper bound of p B .
The detail settings and properties of B and Σ are described and illustrated in Section 4.3.
The complete proof of Theorem 1 is presented in Appendix A. [Figure]
Lemma 1 (Eigenvalue Comparison) For a real symmetric matrix A ∈ R n × n , with λ max and λ min as its maximum and minimum of eigenvalues, then ∀ X ∈ R n , λ min X ⊤ X ≤ X ⊤ AX ≤ λ max X ⊤ X .
Based on Lemma 1 and the certified space in Eq.
we can further obtain a certified ℓ 2 norm radius: [Equation] [Equation]
[Equation]
(9) where λ max is the maximum eigenvalue of Σ − 1 .
We let the upper bound of δ ⊤ Σ − 1 δ satisfy the constraint of Eq.
6, therefore a lower bound on ∥
δ ∥ can be obtained as ∥ δ ∥ lower .
Eq.
6 is an exact constraint on the perturbation space which is a hyperellipsoid, while Eq. 9 describes minor axis of the hyperellipsoid.
Both of them are general expressions for arbitrary GM solvers and joint Gaussian smoothing distributions which will be shown in Sec. 4.3.
4. J OINT S MOOTHING D ISTRIBUTION
In contrast to isotropic (Alfarra et al., 2022) and anisotropic (Eiras et al., 2021) distributions, SCRGM reflects the structure of graph while achieving efficiency by avoiding gradient optimization.
We first construct the correlation matrix B based on the similarity between nodes in matrix z 1 .
B is a full rank and real symmetric matrix whose element b mn denotes the correlation between m -th and n -th node in z 1 . We define a similarity using Euclidean distance as follows:
[Equation]
where d mn is the Euclidean distance between the m -th and n -th nodes, and γ is the normalization coefficient which controls the degree of correlation.
We also uses other three similarity measures to construct B including cosine similarity, pearson similarity and dice similarity as in Appendix C.
Nodes in close proximity are more susceptible to perturbations with similar intensity, while perturbations added to nodes at larger distances are almost independent.
The diagonal elements in B indicate the intensity of perturbation at nodes, while the non-diagonal elements reveal the correlation between nodes.
Then by B ⊤ B = Σ , we can get the smoothing distribution Σ to sample the additive noise for the input.
Σ is a positive definite matrix, which determines the feasibility of radii derived in this work.
In contrast, the distribution in (Eiras et al., 2021) is a diagonal matrix with different diagonal elements, which cannot represent the correlation between nodes; and the distribution in (Alfarra et al., 2022) is a diagonal matrix with the same diagonal elements, which directly treats all nodes without difference.
In fact when inter-node correlations and the differences of noise intensity are neglected, Σ can degenerate into the above two distributions.
Therefore, Σ is a generalized setting that allows all distributions to be compared in the same framework.
For comparison, we need to keep Σ at the same order of magnitude as the previous three distributions (Cohen et al., 2019;
Eiras et al., 2021; Alfarra et al., 2022).
We take a similar strategy as that in (Eiras et al., 2021) to ensure that:
[Equation]
where λ xi is the eigenvalue of ( Σ x ) − 1 , Θ x is the distribution in (Eiras et al., 2021), θ xi is the diagonal element of Θ x and r = 12 (cid:0) Φ − 1 (cid:0)
p A (cid:1) − Φ − 1 ( p B ) (cid:1) .
Therefore, the four distributions mentioned above can be calculated and analyzed incrementally.
The visualization of the four distributions calculated from a same original σ (Cohen et al., 2019) are shown in Fig. 1(a).
Moreover, Σ x can trade-off the certified accuracy and radius, the eigenvalue λ xi is positively correlated with the certified accuracy and negatively correlated with the certified radius.
4. E VALUATING C ERTIFICATES
In Sec. 4.2, Eq. 6 reveals the certified space which is however difficult to quantify and compare.
Though Eq.
9 represents a certified and quantifiable form, it actually ignores a large portion of the certified space.
We therefore propose two more effective radii to help evaluate the robustness.
Eq.is the certification for the worst case of the input, Eq. 13 is the certification for all cases and Eq.reveals the maximum potential for immunity to perturbations.
Combining the three radii allows a complete evaluation of the robustness for solvers.
By Lemma 1 and Eq.
7 we define a maximum radius of the certified space:
[Equation]
where λ min is the minimum eigenvalue of Σ − 1 , and δ ⊤ Σ − 1 δ ≥ λ min δ ⊤ δ .
∥
δ ∥ max denotes the ℓ 2 -norm maximum value for all possible perturbations.
Inspired by (Eiras et al., 2021), we can also measure the certified space in terms of ellipsoidal volume.
By using the formula for the volume of the ellipsoid: V ( R ) =
r n √ π n / Γ( n/ 2 + 1) (cid:81) ni =1 ξ i (Kendall, 2004) where ξ i is the i -th radius of the ellipsoid, we can get a proxy radius ∥ δ ∥ volume as:
[Equation]
where r = 12 (cid:0)
Φ − 1 (cid:0) p A (cid:1) − Φ − 1 ( p B ) (cid:1) and λ i is the eigenvalue of Σ − 1 .
When all λ i are the same, the certification result will be the same as the traditional method (Cohen et al., 2019).
As described in section 4.2, the certified space is a hyperellipsoid geometrically, ∥ δ ∥ lower represents the minor axis, ∥ δ ∥ max represents the major axis,
∥
δ ∥ volumn is a proxy radius of a hypersphere with the same volume as the hyperellipsoid.
The whole certification process is shown in Algorithm
. E XPERIMENTS
We evaluate our strategy in three aspects: i) For deep graph matching, we compare three radii in
Eq. 9, Eq.
12 and Eq. 13 obtained by different certified methods on four GM networks; ii)
For nonlearning GM methods, we perform synthetic experiments on the widely-used solver RRWM (Cho et al., 2010); iii) We reveal the impact of Σ on the certification results by ablation study.
5. E VALUATION S ETTINGS
Following the GM literature (Wang et al., 2021), we mainly evaluate our method on Pascal VOC dataset (Everingham et al., 2010) with Berkeley annotations (Bourdev & Malik, 2009).
All the experiments are conducted on CPU (Intel(R) Core(TM) i7-7820X CPU @ 3.60GHz) and GPU lower , ∥ δ i ∥ max and ∥ δ i ∥ volume described in Sec. 4.4, append ∆ .
14: end if 15: end for 16: return M , ∆ (GTX 2080 Ti GPU).
We validate the certified robustness on four representative deep GM models: GMN (Zanfir & Sminchisescu, 2018), PCA-GM (Wang et al., 2019),
CIE-H (Yu et al., 2019a), NGMv2 (Wang et al., 2021) and also a non-deep method RRWM (Cho et al., 2010).
In this work, data processing and parameter settings are the same as the original papers unless otherwise specified.
The compared methods include RS (Cohen et al., 2019), DDRS (Alfarra et al., 2022) and ANCER (Eiras et al., 2021).
Since the anisotropic method in (Hong & Hong, 2022) is the same as in (Eiras et al., 2021) and (Hong & Hong, 2022) does not provide any code, we choose to compare with (Eiras et al., 2021).
We follow the procedure as much similar as possible to that in (Cohen et al., 2019). In (Cohen et al., 2019), the certified accuracy (CA) is defined as:
CA ( R ) = E x,y [ 1 ( ∥ δ ∥ ≥ R ) 1 ( g ( x ) = y )] . In our method, g represents the smoothed function defined in Eq.
4, x denotes the input node in test set, and y is its ground truth matching node. ∥ δ ∥ denotes the certified radius calculated by Eq.
9, Eq.
12, Eq. 13, R is the scale of x-axis, 1 is an indicator function.
To quantify the improvement, we use Average Certified Radius (ACR) in (Zhai et al., 2020): E x,y [ ∥ δ ∥ 1 { g ( x ) = y } ] . We use ℓ lower, ℓ max2 and ℓ Σ2 to express ∥ δ ∥ lower , ∥ δ ∥ max and ∥
δ ∥ volume in the experiments.
5. E XPERIMENTS ON D EEP G RAPH MATCHING
We first set the initial σ of RS to σ ∈ { 1 , 5 , 10 , 15 , 20 } , and calculate the smoothing distribution of σ ∗ x in DDRS and Θ x in ANCER, where iteration number in DDRS and ANCER is equal to 100.
Then we set normalization coefficient γ = 5 and compute the joint distribution matrix Σ of SCRGM.
Fig. 1(b) shows the certified radius ∥ δ ∥ lower and ACR on a sample of our method and baselines which indicates that the overall certified robustness of our methods is superior to the baselines.
Then we evaluate our strategy on four deep GM methods, the relationship of top-1 certified accuracy and three radii ( ℓ lower, ℓ max2 and ℓ Σ2 ) are plotted in Fig. 2, which only shows the case of σ = 5 .
When the radius on x -axis is the same, the higher the certified accuracy on y -axis, the better the certified robustness.
The certified accuracy of our method is slightly lower sometimes than baselines when ∥ δ ∥ lower is small. However, when ∥ δ ∥ lower is large, the accuracy of baseline decreases significantly or even fails completely while our method maintains a more respectable accuracy. When evaluating using ∥ δ ∥ max and ∥ δ ∥ volume , the advantages of our method are more obvious. [Figure]
We calculate the ACR ∥ δ ∥ lower of four different RS-type methods ( σ = 5) and four GM methods as shown in Tab. 1, which indicates that our method shows a better certified robustness performance over the whole dataset. To show the impact of certified robustness on the accuracy of the solvers we [Figure]
use Tab. 2 to show the standard accuracy and certified accuracy of different certified radius ∥ δ ∥ using NGMv2 algorithm on Pascal VOC dataset.
More results are detailed in Appendix D.1.
For non-learning GM, we certify the effectiveness of SCR-GM using simulation experiments on classic non-learning solver RRWM.
First we randomly generate two sets of node matrices and calculate their affinity matrix K using Gaussian kernel affinity function.
Then we obtain the robustness results by perturbing node locations and edge features respectively using RS and SCR-GM smoothing distributions.
We set σ = 0 .
5 and σ = 0 .
004 respectively in Fig. 3(a) and 3(b).
Our method has similar performance corresponding to the same ∥ δ ∥ lower as the baseline. Moreover, it performs better on the other two cases which indicates that the guarantee space certified by our method is wider and its overall robustness is better. We only compare the results using RS and SCR-GM in this experiment, because DDRS and ANCER require the gradient optimization of networks, and they are not applicable to non-learning GM solvers.
5. T HE E FFECT OF J OINT S MOOTHING D ISTRIBUTION
First, we simplify B by retaining only the higher correlation values in the matrix according to the correlation radio p and setting other values to 0.
The radio is set to p ∈ { 0 % , 20 % , 40 % , 60 % , 80 % , 100 % } where 100 % represents SCR-GM retaining all the correlation coefficients and 0 % represents ANCER without correlation coefficients.
Results in Fig. 4(a) demonstrate the effectiveness of the Σ which can be used to get a better certified robustness properties.
Then, we verify the impact of initial σ for Σ and the results are plotted in Fig. 4(b).
Hyperparameter σ determines the scale of Σ which controls a trade-off between certified robustness and accuracy.
C ONCLUSION AND O UTLOOK
We have proposed a definition of certified robustness on structural graph matching and design a method SCR-GM that utilizes the correlation between nodes to construct a joint smooth distribution.
We obtain ℓ 2 norm certified space and radius for certification.
For evaluation, we propose two additional radii by eigenvalue properties.
Experiments on deep GM networks and classic solvers show that our method achieves a state-of-art robustness guarantee. Potential impact & limitations.
The currently technique is confined with the graph in Euclidean space (and specifically 2D graphs for experiments), a more general formulation is QAP where the perturb may be directly added on the affinity matrix K .
A significant direction is enabling robustness certification on the combinatorial solvers whereby GM is one of such cases.
We hope this work can inspire subsequent research in this promising area where theoretical results are welcomed given the recent intensive empirical studies (Bengio et al., 2021; Yan et al., 2020).
A P ROOFS OF T HEOREM
Here we provide the complete proof for Theorem 1.
We first prove the following Lemma 2 which is inspired by the Neyman-Pearson for Gaussians lemma derived in (Cohen et al., 2019) and introduce
Lemma 3 which makes random vector independent after linear transformation.
Lemma 2 (Neyman-Pearson for Joint Gaussian Noise) Let X ∼
N ( x, Σ) and Y ∼
N ( x + δ, Σ) .
Let h : R d → { 0 , 1 } be any deterministic or random function.
Then:
If S = (cid:8) k ∈ R d : δ T Σ − 1 k ≤ β (cid:9) for some β and P ( h ( X ) = 1) ≥ P ( X ∈ S ) , then P ( h ( Y ) = 1) ≥ P ( Y ∈ S ) . If S = (cid:8) k ∈ R d : δ T Σ − 1 k ≥ β (cid:9) for some β and P ( h ( X ) = 1) ≤ P ( X ∈ S ) , then P ( h ( Y ) = 1) ≤ P ( Y ∈ S ) .
Proof.
This lemma is the special case of Neyman-Pearson when X and Y are joint Gaussian noises with means x and x + δ .
It suffices to simply show that for any β , there is some t > 0 for which:
[Equation] [Equation]
For ease of representation, we use S ∈ R d × d (with element s ij ) instead of Σ − 1 .
The likelihood ratio for this choice of X and Y turns out to be:
[Equation]
where b is a constant, specifically b = − δ T Σ − 1 x − 1 2 δ T Σ − 1 δ .
Therefore given any β , we may take t = exp( β + b ) and get this correlation:
[Equation]
Lemma 3 (Joint Gaussian Distribution)
If there is a random vector X ∼ N ( µ, Σ) , where µ ∈ R n is the mean vector.
A positive semi-definite real symmetric matrix Σ ∈ S n × n ++ is the covariance matrix of X .
There is a full rank matrix B ∈ R n × n , which makes X =
BZ + µ , Z ∼ N ( 0 , I ) and
B ⊤ B = Σ .
Then we can prove Theorem 1, recall:
Theorem 1.
Let f i ( z 1 ) be node matching function, g i be defined as in Eq. 4, and ε ∼ N (0 , Σ ) .
If p A ∈ [0 , 1] and p B ∈ [0 , 1] satisfy:
[Equation]
[Equation] Then for g i ( z 1 + δ ) =
r A , we can get the certified ℓ 2 space for the addictive noise δ :
[Equation] [Equation]
where B ⊤ B = Σ , B ∈ R n 1 × n 1 is a full rank and real symmetric matrix based on the physical relationships in node matrix z 1 , and p A and p B are the lower bound of p A and the upper bound of p B , respectively.
To show that g i ( z 1 + δ ) =
r A , it follows from the definition of g i that we need to show that
[Equation]
In the derivation, r B is actually not just “runner-up” node, but any node that is different from r A .
We define the random variables:
[Equation]
We know that:
[Equation]
Our goal is to show that
[Equation]
According to lemma 2, we can define the half-spaces:
[Equation]
Claim 1 shows that P ( X ∈ A ) =
p A , therefore we can get P ( f i ( X ) =
r A ) ≥ P ( X ∈ A ) .
Hence we may apply Lemma 2 with h ( z ) :
=
[ f i ( z ) =
r A ] to conclude:
[Equation]
Similarly, we obtain P ( f i ( X ) =
r B ) ≤ P ( X ∈ B ) .
Hence we may apply Lemma 2 with h ( z ) :
=
[ f i ( z ) =
r B ] to conclude:
[Equation]
Combining Eq.
20 and 21, we can get the conditions of Eq.
[Equation]
According to Claim 3 and Claim 4, we can get P ( Y ∈ A ) and P ( Y ∈ B ) as:
[Equation]
Finally, we obtain that P ( Y ∈ A ) > P ( Y ∈ B ) if and only if:
[Equation]
Because B is a real symmetric matrix ( B T = B ), we can finally get:
[Equation]
which recovers the theorem statement.
A. L INEAR TRANSFORMATION AND DERIVATION
We obtain four equations based on linear transformation:
Claim 1.
P ( X ∈ A ) =
p
A
Proof.
Recall that A = (cid:8) k : δ T Σ − 1 ( k − z 1 ) ≤ ∥ δ T Σ − 1 B ∥
Φ − 1 (cid:0) p A (cid:1)(cid:9) and X ∼ N ( z 1 , Σ) , according to lemma 3, we can get:
[Equation]
Claim 2.
P ( X ∈ B ) =
p B
Proof.
Recall that B = (cid:8) k : δ T Σ − 1 ( k − z 1 ) ≥ ∥
δ T Σ − 1 B ∥ Φ − 1 (1 − p B ) (cid:9) and X ∼ N ( z 1 , Σ) , according to lemma 3, we can get:
[Equation]
Claim 3.
P
[Equation]
Y ∈ A )
[Equation]
Proof.
Recall that A = (cid:8) k : δ T Σ − 1 ( k − z 1 ) ≤ ∥ δ T Σ − 1 B ∥
Φ − 1 (cid:0) p A (cid:1)(cid:9) and Y ∼ N ( z 1 + δ, Σ) , according to lemma 3, we can get:
[Equation]
Claim 4.
[Equation]
Proof.
Recall that B =
[Equation]
1 ( k − z 1 ) ≥ ∥ δ T Σ − 1 B ∥ Φ − 1 (1 − p B ) (cid:9) and Y ∼
N ( z 1 + δ, Σ) , according to lemma 3, we can get:
[Equation]
B R OBUSTNESS GUARANTEE WHEN PERTURBING FEATURES
For GM with input (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) for matching prediction X , we now focus on the effect of perturbing node features.
Recall that the set F can be expressed as: F
= { f i | f i : (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) → r j , i ∈ n 1 , j ∈ n 2 } where G 1 = { V 1 , E 1 } and G 2 =
{ V 2 , E 2 } , f i represents that the i -th node in z 1 matches the j -th node in z 2 , r j is the j -th node in z 2 .
Now we define a new smoothed network g i that returns whichever node in z 2 is most likely to match the node in z 1 when perturbing node features V 1 ∈ R d v × n 1 by joint smoothing distribution noise:
[Equation]
For notational convenience, we simplify f i (cid:0) V 1 + ε, E 1 , V 2 , E 2 , z 1 , z 2 (cid:1) to f i ( V 1 ) .
Suppose that when the base function f i solves for the optimal matching of node i in z 1 , the most probable node r A is returned with probability p A = max s i ∈ S
i s i , where S i is the i -th row of S .
The probability of ”runner-up” node r B is denoted as p B , p B = max s i ∈ S i ,r B ̸
= r A s i .
Similarly, we obtain an ℓ 2 certified space to guarantee robustness of graph matching when perturbing features as follows.
Theorem 2 ( ℓ 2 certified space when perturbing features) Let f i ( V 1 ) be node matching function, g i be defined as in Eq.
24, and ε ∼ N (0 , Σ ) .
If p A ∈ [0 , 1] and p B ∈ [0 , 1] satisfy:
[Equation]
then for g i ( V 1 + δ ) =
r A , we can get the certified ℓ 2 space for the addictive noise δ :
[Equation] [Equation]
where p A and p B are the lower bound of p A and the upper bound of p B respectively.
We set
B ⊤ B = Σ where B ∈ R (
d v × n 1 ) × ( d v × n 1 ) is a diagonal matrix.
Different from the correlation matrix in Eq.
10, B is a diagonal matrix similar as (Eiras et al., 2021).
However, B is obtained by structure-based prior knowledge rather than the optimization process in (Eiras et al., 2021).
We divide the node feature V 1 into n 1 parts and add independent identically distributed noise of the same intensity (denoted by b m , m ∈ n 1 ) to each part.
The noise intensity of m -th part b m is defined as b m =
d m d σ where d is the whole distance between nodes in z 1 , d m is the distance between the m -th node and other nodes, the original σ is the same as described in (Cohen et al., 2019).
This setting indicates that outlier points are more resistant to perturbation.
Finally we can derive the same radius forms as Eq. 9, 12 and 13.
C E XPERIMENTAL S ETUP
In this work, we evaluate our strategy on deep graph matching networks and a classic non-learning solver.
The procedures to obtain the baseline networks and the evaluation methods are detailed as follows.
C. B ASELINE OF C ERTIFICATION METHODS
In terms of certification, the baselines we considered are RS (Cohen et al., 2019), DDRS (Alfarra et al., 2022) and ANCER (Eiras et al., 2021).
We adapt the off-the-shelf DDRS and ANCER to obtain the data-dependent distribution σ ∗ x and anisotropic distribution Θ x for graph matching.
We add noise to graphs and use p A = max s i ∈ S
i s i and p B =
max s i ∈ S i ,r B ̸
=
r A s i to calculate the gap value Φ − 1 ( p A ) − Φ − 1 ( p B ) ( S i is the i -th row of S ).
The optimization equations and parameters remain the same as the original algorithms.
Then we use SCR-GM to get our joint distribution Σ .
Finally, we use the Monte Carlo algorithms in (Cohen et al., 2019) to sample noises according to different distributions and output three radii derived in Sec. 4.2 and 4.4.
The sample number n and n 0 are set to 1000 and 100 due to the efficiency of graph matching networks, and other parameters are the same as the original network settings (Cohen et al., 2019).
C. E VALUATION ON D EEP G RAPH M ATCHING
For deep graph matching, we mainly evaluate our method on Pascal VOC dataset (Everingham et al., 2010) with Berkeley annotations (Bourdev & Malik, 2009).
We follow the protocol of (Wang et al., 2021) and filter out poorly annotated images.
In the experiment, we use 100 inputs (containing approximately 650 nodes) of 20 categories to certify the matching robustness.
We check our strategy on four representative deep graph matching methods: GMN (Zanfir & Sminchisescu, 2018), PCA-GM (Wang et al., 2019),
CIE-H (Yu et al., 2019a) and NGMv2 (Wang et al., 2021), while use the checkpoints of these GM models collected by ThinkMatch ( https: //github.com/Thinklab-SJTU/ThinkMatch ).
We directly evaluate the certified robustness of these networks without fine-tune training.
C. E VALUATION ON NON - LEARNING METHOD
For non-learning method, we mainly evaluate our method on simulation data which contains randomly generated node pairs.
In the experiment, we use 100 inputs (each contains 5-10 nodes randomly) and evaluate the strategy on classic solver RRWM (Cho et al., 2010).
For evaluation, we extract node features and calculate the affinity matrix K using Gaussian kernel affinity function.
Then we perturb node locations and features separately and obtain the certified robustness results. C. S IMILARITY MEASURES
In addition to Eq. 10, we also uses other three similarity measures to construct B including cosine similarity, pearson similarity and dice similarity as follows.
For two points in the Euclidean space R n : A = ( a 1 , a 2 , · · · , a n ) and B = ( b 1 , b 2 , · · · , b n ) , cosine similarity is defined as follows:
[Equation]
Pearson similarity is defined as follows:
[Equation] ∈ [ − 1 , 1] , (28) where ¯ A = (cid:80) ni =1 a i /n, ¯ B = (cid:80) ni =1 b i /n .
[Table]
[Table]
Dice similarity is defined as follows:
Dice
[Equation] (29) where A and B can not be zero point at the same time. D E XPERIMENTAL R ESULTS D. C ERTIFICATION R ESULTS OF D EEP G RAPH M ATCHING D.1. P ERTURBING NODE LOCATION For perturbing node location, we report certified accuracy at ℓ lower, ℓ max2 and ℓ Σ2 radii, for each certified method RS (Cohen et al., 2019), DDRS (Alfarra et al., 2022), ANCER (Eiras et al., 2021) and SCR-GM, each network GMN (Zanfir & Sminchisescu, 2018), PCA-GM (Wang et al., 2019),
CIE-H (Yu et al., 2019a) and NGMv2 (Wang et al., 2021), each original σ ( σ = 1 , 5 , 10 , 15 and 20 ).
Figures 5, 6, 7 and 8 show certified results on different graph matching networks, respectively.
In addition, we certify the effect of the normalization parameter γ , and Fig.
12 shows the results on NGMv2 (Wang et al., 2021) algorithm and σ is set to 5.
Tab. 3 shows the impact of different choices for constructing B on the certified robustness.
B constructed by Euclidean distance and Dice similarity perform better on the certified robustness.
The advantage of B constructed by Euclidean distance is more obvious when the radius is larger.
D.1. P ERTURBING FEATURES
For perturbing node features, we only compare our strategy with RS (Cohen et al., 2019) due to the excessive inefficiency of DDRS (Alfarra et al., 2022) and ANCER (Eiras et al., 2021).
We set original σ as σ = 0 .
5 , 1 , 1 . 5 and 2 , other settings are the same as Appendix D.1.1.
Fig.shows certified results on different graph matching networks when perturbing node features.
D. C ERTIFICATION R ESULTS OF NON - LEARNING METHODS
In this section, we report certified accuracy at ℓ lower, ℓ max2 and ℓ Σ2 radii, for certified method (Cohen et al., 2019) and SCR-GM on RRWM (Cho et al., 2010).
We set original σ as σ = 0 .
4 and 0 .when perturbing node locations, while we set σ = 0 .
001 , 0 . 004 and 0 .
006 when perturbing features.
Fig. 13 and 14 show certified results on the classic solver. [Table] [Figure]
[Figure]
E C ERTIFIED ROBUSTNESS OF THE SOLUTION X ’ S STRUCTURE
In Sec. 4, we focus on the certified robustness of node matching results in the graph rather than the whole graph matching result.
Our work treats the GM solver as blackbox to get the relaxed matching
S , then uses a post-binarization step to to modify the output format X and get the node matching function set F .
Then we certify the robustness of F .
However, we can also certify the robustness of the full matrix X which is able to utilize more graph structure information, as well as fully consider the constrains in Eq. 1.
E. D EFINITION
Consider a graph matching problem from input space to partial permutation matrices X .
As discussed above, randomized smoothing (RS) is a technique for constructing a smoothed function g from an arbitrary base function f .
When queried at the input (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) , the smoothed function g returns whichever matrix X the base function f is most likely to return when z 1 is perturbed by noise:
[Equation]
where ε ∼ N (0 , Σ ) .
The distribution of additive noise ε is a joint Gaussian distribution matrix whose variance Σ represents the correlations between nodes.
In addition, Σ is a hyperparameter for certified function which controls the robustness/accuracy trade-off.
E. R OBUSTNESS G UARANTEE FOR X
We define a robustness guarantee with confidence c ∈ [0 , 1] , which ensures that the similarity between the output matrix calculated by g and its ground truth matrix X g is not less than a confidence c .
Suppose that when the base function f solves (cid:0) G 1 , G 2 , z 1 + ε, z 2 (cid:1) , its output matrices whose similarity to X g is not less than c are returned with probability p :
[Equation]
(cid:40)
[Equation]
Our main result is that smoothed function g is robust within a ℓ 2 certified space, which also holds if we replace p with a lower bound p .
Theorem 3 ( ℓ 2 certified space for X ) Let f be a matching function, g be defined as in Eq. 30, and ε ∼ N (0 , Σ ) .
Suppose X A ∈ X ′ and p ∈ ( 12 , 1] satisfy:
[Equation]
Then we can get the certified ℓ 2 space for the addictive noise δ :
[Equation]
which guarantees g (cid:0) G 1 , G 2 ,
z 1 + δ, z 2 (cid:1)
∈ X ′ .
In Eq. 6, B ⊤ B = Σ and B ∈ R n 1 × n 1 is a full rank and real symmetric matrix based on the node correlation in node matrix z 1 .
The detail settings and properties of B and Σ are the same as in Section 4.3.
Based on Lemma 1 and the certified space in Eq.
33, we can further obtain a certified ℓ 2 norm radius:
[Equation]
34) where λ max is the maximum eigenvalue of Σ − 1 .
We can define a maximum radius of the certified space:
[Equation]
where λ min is the minimum eigenvalue of Σ − 1 .
The proxy radius ∥ δ ∥ volume is as follows:
[Equation]
The whole robustness certification process is shown in Algorithm 2.
In fact, we cannot get the real X g and X during certification stage, so we use Monte Carlo sampling to estimate it.
We first sample f (cid:0) G 1 , G 2 , z 1 + ε, z 2 (cid:1) with n 0 times and add all permutation matrices to get X s , then we use
Sinkhorn and Hungarian algorithm to approximate X g .
During certification, if the approximated ˆ X g is not the same as the ground truth matrix X g , we consider that the certification for this sample has failed.
Then we sample f (cid:0) G 1 , G 2 , z 1 + ε, z 2 (cid:1) with n times and put all possible matrices into set ˆ X to approximate X .
When n is large, ˆ X and X are relatively close.
E. EXPERIMENTS
We evaluate our methods on deep graph matching networks and non-learning solvers.
The evaluation settings are the same as in Sec. 5.1.
E.3. E XPERIMENTS ON D EEP G RAPH MATCHING
We focus on certifying the robustness of node locality and compare ℓ lower, ℓ max2 , ℓ Σ2 certification using four certified methods on four deep GM algorithms.
We first set the initial σ of RS to σ ∈ { 1 , 5 , 10 , 15 , 20 } , the confidence c = 0 .
9 and calculate the smoothing distribution of σ ∗ x in DDRS and Θ x in ANCER, where iteration number in DDRS and ANCER is equal to 100.
Then we set normalization coefficient γ = 5 and compute the joint distribution matrix Σ of SCR-GM.
Then we evaluate our strategy on four deep GM methods, the relationship of top-1 certified accuracy and three radii ( ℓ lower, ℓ max2 and ℓ Σ2 ) is plotted in Fig.
When the radius on x -axis is the same, the higher the certified accuracy on y -axis, the better the certified robustness.
Our method outperforms the baseline on NGMv2 algorithm, which means that the certified accuracy is higher when the radii ( ℓ lower, ℓ max2 and ℓ Σ2 ) is the same.
On CIE-H and PCA-GM algorithms, the certified accuracy of our method is slightly lower sometimes than baselines when ℓ lowerradius is small.
However, when ℓ lowerradius is large, the accuracy of baselines decrease significantly or even fail completely while our method maintains a more respectable accuracy.
When evaluating using ℓ max2 and ℓ Σ2 radii, the certified results of our method are similar as the baselines.
On GMN algorithm, our certification results are a bit worse than ANCER.
In short, the certified robustness advantage of our method is more obvious on the algorithm with better matching accuracy itself.
E.3. E XPERIMENTS ON N ON -L EARNING GM M ETHODS
For non-learning GM, we certify the effectiveness of SCR-GM using simulation experiments on classic non-learning solver RRWM.
First we randomly generate two sets of node matrices and calculate their affinity matrix K using Gaussian kernel affinity function.
Then we obtain the robustness results by perturbing node locations and edge features respectively using RS and SCR-GM smoothing distributions.
We set σ = 0 .
1 and σ = 0 .
0001 respectively in Fig.
11(a) and 11(b).
Our method has similar performance of the certified accuracy corresponding to the same ∥ δ ∥ lower with the baseline.
However, our method performs better on ∥ δ ∥ volume and ∥ δ ∥ max which indicates that the guarantee space certified by our method is wider and its overall robustness is better.
We only compare the results using RS and SCR-GM in this experiment, because DDRS and ANCER require the gradient optimization of networks, and they are not applicable to non-learning GM solvers.
[Figure]
E. P ROOF
To show that g (cid:0) G 1 , G 2 , z 1 + δ, z 2 (cid:1)
∈ X ′
[Equation]
it follows from the definition of g that we need to show that:
[Equation]
We define two random variables:
[Equation]
We know that:
[Equation]
Our goal is to show that
[Equation]
According to lemma
[Equation]
we can define the half-spaces:
[Equation]
Claim 1 shows that P ( I ∈ A ) =
p , therefore we can get P ( f ( I ) =
X A , X A ∈ X ′ ) ≥ P ( I ∈ A ) .
Hence we may apply Lemma 2 to conclude:
[Equation]
Similarly, we obtain P ( f ( I ) =
X B , X B / ∈ X ′ ) ≤ P ( I ∈ B ) .
Hence we may apply Lemma 2 to conclude:
[Equation]
[Equation]
Combining Eq. 39 and 40, we can get the conditions of Eq.
[Equation]
[Equation]
According to Claim 3 and Claim 4, we can get P ( O ∈ A ) and P ( O ∈ B ) as:
[Equation]
Finally, we obtain that P ( O ∈ A ) > P ( O ∈ B ) if and only if:
[Equation]
Since B is a real symmetric matrix ( B T = B ), we can finally get:
[Equation]
p ) (cid:1) , which recovers the theorem statement.
E.4. L INEAR TRANSFORMATION AND DERIVATION
We obtain four equations based on linear transformation: Claim 1.
P ( I ∈ A ) = p
Proof.
Recall that A = (cid:8) k : δ T Σ − 1 ( k − (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) )
≤ ∥ δ T Σ − 1 B ∥ Φ − 1 (cid:0) p (cid:1)(cid:9) , according to lemma 3, we can get:
[Equation]
p
[Equation]
=
p.
Claim 2.
P ( I ∈ B ) = 1 − p
Proof.
Recall that B = (cid:8) k : δ T Σ − 1 ( k − (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) ) ≥
∥ δ T Σ − 1 B ∥
Φ − 1 (cid:0) p (cid:1)(cid:9) , according to lemma 3, we can get:
[Equation]
=
[Equation]
Claim 3.
P ( O ∈ A ) =
Φ
[Equation]
B ∥
[Equation]
Proof.
Recall that A = (cid:8) k : δ T Σ − 1 ( k − (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) )
≤ ∥ δ T Σ − 1 B ∥ Φ − 1 (cid:0) p (cid:1)(cid:9) and O ∼ (cid:0) G 1 , G 2 , N (cid:0)
z 1 + δ, Σ (cid:1) , z 2 (cid:1) , according to lemma 3, we can get:
[Equation]
Claim 4.
P ( O ∈ B ) =
Φ (cid:16) − Φ − 1 (cid:0) p (cid:1) + δ T Σ − 1 δ ∥
[Equation]
T Σ − 1 B ∥ (cid:17)
Proof.
Recall that B = (cid:8) k : δ T Σ − 1 ( k − (cid:0) G 1 , G 2 , z 1 , z 2 (cid:1) ) ≥
∥ δ T Σ − 1 B ∥
Φ − 1 (cid:0) p (cid:1)(cid:9) and O ∼ (cid:0) G 1 , G 2 , N (cid:0) z 1 + δ, Σ (cid:1) , z 2 (cid:1) , according to lemma 3, we can get:
[Equation]
[Equation]
Σ − 1 B ∥ (cid:19) =
P (cid:18) N
[Equation]
[Equation]
1 (cid:0) p (cid:1) + δ T Σ − 1 δ ∥ δ T Σ − 1 B ∥ (cid:19) =
Φ (cid:18) − Φ − 1 (cid:0) p (cid:1) + δ T Σ − 1 δ ∥
δ T Σ − 1 B ∥ (cid:19)