L IMITATIONS OF P IECEWISE L INEARITY FOR E FFICIENT R OBUSTNESS C ERTIFICATION
Anonymous authors
Paper under double-blind review
A BSTRACT
Certiﬁed defenses against small-norm adversarial examples have received growing attention in recent years; though certiﬁed accuracies of state-of-the-art methods remain far below their non-robust counterparts, despite the fact that benchmark datasets have been shown to be well-separated at far larger radii than the literature generally attempts to certify.
In this work, we offer insights that identify potential factors in this performance gap.
Speciﬁcally, our analysis reveals that piecewise linearity imposes fundamental limitations on the tightness of leading certiﬁcation techniques.
These limitations are felt in practical terms as a greater need for capacity in models hoped to be certiﬁed efﬁciently.
Moreover, this is in addition to the capacity necessary to learn a robust boundary, studied in prior work.
However, we argue that addressing the limitations of piecewise linearity through scaling up model capacity may give rise to potential difﬁculties—particularly regarding robust generalization—therefore, we conclude by suggesting that developing smooth activation functions may be the way forward for advancing the performance of certiﬁed neural networks.
I NTRODUCTION
Since the discovery of adversarial examples (Szegedy et al., 2014), defenses against malicious input perturbations to deep learning systems have received notable attention.
While many early-proposed defenses—such as adversarial training (Madry et al., 2018)—are heuristic in nature, a growing body of work seeking provable defenses has arisen (Cohen et al., 2019;
Croce et al., 2019; Fromherz et al., 2021; Huang et al., 2021; Jordan et al., 2019; Lee et al., 2020; Leino & Fredrikson, 2021; Leino et al., 2021;
Li et al., 2019; Singla et al., 2022; Trockman & Kolter, 2021;
Wong et al., 2018; Zhang et al., 2018).
Generally, such defenses attempt to provide a certiﬁcate of local robustness (given formally in Deﬁnition 1), which guarantees a network’s prediction on a given point is stable under small perturbations (typically in Euclidean or sometimes (cid:96) ∞ space); this precludes the possibility of small-norm adversarial examples on certiﬁed points.
The success of a certiﬁed defense is typically measured empirically using veriﬁed robust accuracy (VRA), which reﬂects the fraction of points that are both (i) classiﬁed correctly and (ii) certiﬁed as locally robust.
Despite the fact that perfect robust classiﬁcation (i.e., 100% VRA) is known to be possible on standard datasets at the adversarial perturbation budgets used in the literature (Yang et al., 2020b), this possibility is far from realized in the current state of the art.
For example, on the benchmark dataset CIFAR-10, state-of-the-art methods offering deterministic guarantees of (cid:96) 2 robustness 1 have remained at approximately 60% VRA (Huang et al., 2021; Leino et al., 2021; Singla et al., 2022; Trockman & Kolter, 2021), while non-robust models handily eclipse 95% accuracy.
It is difﬁcult to precisely account for this discrepancy; though among other reasons, state-of-the-art methods typically use loose bounds to perform certiﬁcation—as exact certiﬁcation is (for general
ReLU networks) NP-complete (Katz et al., 2017; Sinha et al., 2018)—which conceivably leads to falsely ﬂagging truly robust points or to over-regularization of the learned model.
While conservative approximations may be necessary to perform efﬁcient certiﬁcation (and to facilitate efﬁcient robust training), it is certainly possible that they foil reasonable hopes for “optimality.”
In this work, we offer further insight into the shortcomings of modern certiﬁcation techniques by analyzing their limitations in the context of the architectural settings in which they are conventionally employed.
In particular, we ﬁnd that piecewise linearity —a practically ubiquitous property of neural networks considered in the certiﬁcation literature (e.g., standard ReLU and the more recently popularized “MinMax” (Anil et al., 2019) activations are both piecewise linear)—fundamentally limits the power of Lipschitz-based (cid:96) 2 local robustness certiﬁcation.
In effect, we argue, this means that extra capacity is needed simply for facilitating efﬁcient certiﬁcation —in addition to whatever capacity may be required for learning a robust boundary (e.g., as examined by Bubeck & Sellke (2021)).
On the other hand, perhaps surprisingly, we prove that free from the constraint of piecewise linearity, Lipschitz-based certiﬁcation is powerful enough to perform complete certiﬁcation on any decision boundary, provided the implementation of the function giving rise to the boundary is under the learner’s control (indeed, this is consistent with the fact that the highest performing certiﬁed defenses incorporate Lipschitz-based certiﬁcation into training).
These latter ﬁndings suggest that continued progress towards improving state-of-the-art VRA may be enabled through carefully chosen smooth activation functions, 2 which do not inherently limit the power of what are currently the most promising forms of efﬁcient local robustness certiﬁcation.
In summary, the primary contributions of this work are as follows: (1) we show that piecewise linearity imposes inherent limitations on the tightness of efﬁcient robustness certiﬁcation—our primary focus is Lipschitz-based certiﬁcation, but we discuss similar limitations of other methods in
Appendix B; (2) we prove that Lipschitz-based certiﬁcation is fundamentally powerful for tight robustness certiﬁcation, provided (i) the robust learning procedure has power over the implementation of the classiﬁer, and (ii) the hypothesis class is not limited to piecewise linear networks; and (3) we demonstrate that tight Lipschitz-based certiﬁcation may require signiﬁcant capacity overhead in piecewise-linear networks.
These ﬁndings offer a new perspective on the sticking points of modern certiﬁed training methods, and suggest possible paths forward.
We begin in Section 2 by introducing the limitations piecewise linearity imposes on robustness certiﬁcation, starting generally, and narrowing our focus speciﬁcally to Lipschitz-based certiﬁcation.
We then discuss the role that capacity plays in mitigating these limitations in Section 3, which concludes with a discussion of the implications of our ﬁndings, both retrospectively and prescriptively.
Finally, we discuss related work in Section 4, and offer our concluding remarks in Section 5.
L IMITATIONS OF P IECEWISE L INEARITY
The main insights in this work stem from the simple, yet crucial observation that the points lying at a ﬁxed Euclidean distance from a piecewise-linear decision boundary, in general, do not themselves comprise a piecewise-linear surface.
Therefore, in order for a certiﬁcation procedure to precisely recover the set of robust points—those which lie a distance of at least (cid:15) from the decision boundary—it must be capable of producing a boundary between robust and non-robust points that is not piecewise-linear, even on networks that are .
However, as we will see, Lipschitz-based certiﬁcation, for example, is in fact constrained to produce a piecewise-linear “certiﬁed frontier” on piecewise-linear networks, as the set of just-certiﬁable points essentially corresponds to a level curve in the output of the network being certiﬁed.
On the other hand, if the level curves of the function being certiﬁed correspond (up to some constant factor) to their distance from the decision boundary (and must therefore include smooth curves ),
Lipschitz-based certiﬁcation identiﬁes precisely the points that are truly (cid:15) -locally robust, provided a tight bound on the Lipschitz constant.
As we will make clear, this has important implications regarding the power of Lipschitz-based certiﬁcation in properly suited network architectures.
In the remainder of this section, we formalize this intuition and discuss some of its implications.
Section 2.1 introduces our main theorem regarding the limitations imposed by piecewise linearity, along with the necessary background and deﬁnitions.
Section 2.2 narrows the focus to Lipschitzbased certiﬁcation, showing that despite being powerful in general, it is fundamentally limited within the hypothesis class of piecewise linear networks.
Finally, Section 2.3 presents a thought experiment that provides basic intuition about the possible scale of the problems caused by these limitations.
2. F UNDAMENTAL L IMITATIONS TO C ERTIFICATION C OMPLETENESS
For our purposes, we will consider a neural network to be a function f : R n → R m mapping ndimensional inputs to logit values corresponding to m different classes.
From the network function f , we derive a neural classiﬁer, F : R n → R m , by letting F ( x ) = argmax i ∈
[ m ] f i ( x ) .
When it is clear from the context which we are referring to, we will use the term “neural network” for both the network function f and its corresponding classiﬁer F .
Note that two different neural network functions, f and f (cid:48) , may lead to the same predictions everywhere, i.e., ∀ x .
F ( x ) = F (cid:48) ( x ) .
When this happens, we say that f and f (cid:48) share the same decision boundary , where the decision boundary is simply the set of points where f i ( x ) =
f j ( x ) for some i (cid:54) =
j ∈ [ m ] .
In this work, we consider the problem of local robustness certiﬁcation.
As in prior work, we deﬁne local robustness as a property of a point x and classiﬁer F , parameterized by a perturbation budget , or robustness radius , (cid:15) , as in Deﬁnition 1.
Deﬁnition 1 ( (cid:15) -Local Robustness) .
A classiﬁer F : R n → [ m ] is (cid:15) -locally robust at point x ∈ R n , with respect to norm || · || , if
[Equation]
A certiﬁcation procedure , cert , is a function that takes a neural network, f , a point, x , and a perturbation budget, (cid:15) , and produces a label in { 0 , 1 } , where an output of 1 means that f is certiﬁed as (cid:15) -locally robust at x .
A valid certiﬁcation procedure must be sound , i.e., cert ( f, x, (cid:15) )
=
1 = ⇒ F is (cid:15) -locally robust at x ; however, it need not be complete , i.e., it may be the case that cert ( f, x, (cid:15) )
=
and yet F is in fact (cid:15) -locally robust at x .
For a given certiﬁcation procedure, let the certiﬁed regions of f , C cert ( f, (cid:15) )
= { x : cert ( f, x, (cid:15) ) } be the set of points that can be positively certiﬁed by cert .
Similarly, let the robust regions of f be given by the set R ( F, (cid:15) )
= { x : F is (cid:15) -locally robust at x } of (cid:15) -locally robust points (note that, in contrast to C cert , R does not depend on the implementation of f , only its classiﬁcation outputs, given by F ).
Soundness entails that ∀ f .
C cert ( f, (cid:15) ) ⊆
R ( F, (cid:15) ) , but clearly it is desirable for C cert ( f, (cid:15) ) to match R ( F, (cid:15) ) as tightly as possible; when this is achieved perfectly we can consider cert to be “complete.”
However, as C cert ( f, (cid:15) ) can depend on the underlying function, f , which has a surjective mapping to classiﬁers, F , derived from the same hypothesis class, we must be careful in deﬁning completeness precisely.
Let F be a hypothesis class —a family of functions of type R n → R m , e.g., that are captured by some neural network architecture.
We will also use the slight abuse of notation, F ∈ F , to denote any F : R n → [ m ] such that there exists a function f (cid:48) ∈ F which produces the same labels as F on all inputs, i.e., ∀ x .
F ( x ) = argmax i ∈
[ m ] f (cid:48) i ( x ) .
We say that a certiﬁcation procedure, cert , is complete on F if all possible decision boundaries achievable by functions in the hypothesis class have at least one implementation in F for which cert perfectly recovers the true robust regions.
This is stated formally in Deﬁnition 2.
Deﬁnition 2.
A certiﬁcation procedure, cert , is complete on hypothesis class, F , if for (cid:15) >∀ F ∈ F .
∃ f (cid:48) ∈ F .
(cid:16)
[Equation] [Equation]
Essentially, completeness over a hypothesis class entails a notion of compatibility between the certiﬁcation procedure and the hypothesis class; speciﬁcally, it means that for any decision boundary expressible by the hypothesis class, it is possible for a learning procedure to produce a model that implements the decision boundary in a way that makes the certiﬁcation procedure complete.
Deﬁnition 2 provides a key relaxation from a stricter notion of completeness that would require
C cert ( f, (cid:15) )
=
R ( F, (cid:15) ) for all f , as this would not be achievable by any polynomial certiﬁcation procedure 3 (Katz et al., 2017; Sinha et al., 2018).
By requiring tight certiﬁcation only modulo the decision boundary, we avoid this limitation, splitting the responsibility for completeness between the certiﬁcation procedure, the learning algorithm, and the hypothesis class.
Next, we will also ﬁnd it useful to deﬁne the certiﬁed frontier of F under cert (Deﬁnition 3); essentially, the set of points that are just barely certiﬁed, which lie at the frontier of the certiﬁed regions.
We will similarly deﬁne the robust frontier as the set of points that are just barely (cid:15) -locally robust, which lie at the frontier of the robust regions.
Deﬁnition 3 (Certiﬁed Frontier) .
The certiﬁed frontier of a neural network, F : R n → [ m ] , under certiﬁer, cert , at perturbation budget, (cid:15) , is the set of points
[Equation]
We now turn to the speciﬁcs of one of our main results, namely, that piecewise linearity is a limiting factor for tight certiﬁcation .
Of course, as alluded to earlier, some certiﬁcation procedures do achieve complete certiﬁcation on piecewise-linear networks—e.g., (Jordan et al., 2019; Tjeng et al., 2019)—however, such methods are invariably exponential.
Thus, we characterize the set of piecewise-linear limited (PLL) methods in Deﬁnition 4.
Intuitively, a certiﬁcation procedure is PLL if it is constrained to produce piecewise-linear certiﬁed frontiers on piecewise-linear models.
Deﬁnition 4 (Piecewise-linear Limited Certiﬁcation) .
A certiﬁcation procedure, cert , is piecewise-linear limited (PLL) if
[Equation]
-linear
Note that the robust frontier of a network F is, in general, not piecewise linear, even if F (and thus its decision boundary) is piecewise linear.
Thus, if the certiﬁed frontier of cert is piecewise linear, cert cannot be complete, i.e., C (cid:54) =
R .
Moreover, this means that any piecewise-linear limited certiﬁcation procedure cannot be complete on the hypothesis class of piecewise linear networks (Theorem 1).
The proof of Theorem 1 is given formally in Appendix A.1.
Theorem 1.
Any piecewise-linear limited certiﬁcation procedure is incomplete on the hypothesis class of piecewise linear networks.
The proof of Theorem 1 relies on the fact that a piecewise-linear function cannot be equal to a function exhibiting smooth curves.
However, it is known that neural networks, provided with enough capacity , can approximate any function with arbitrary precision (Hornik, 1991).
We address this point in Section 3, where we discuss the implications of Theorem 1 regarding the capacity requirements of tightly certiﬁable networks.
2. T HE P OWER AND L IMITATIONS OF L IPSCHITZ -B ASED C ERTIFICATION
We will now narrow our focus to consider the speciﬁc family of Lipschitz-based certiﬁcation methods.
Such methods perform certiﬁcation by using an upper bound, K , on the network’s Lipschitz constant; essentially, a point is certiﬁed if the margin by which the top-predicted class exceeds all other classes is greater than (cid:15)K .
In our work, we will set aside the details around how the Lipschitz is obtained, though this is also a source of potential looseness in the general approach.
That is, we will (optimistically) take for granted that a tight bound is obtained in our analysis.
Lipschitz-based certiﬁcation has proven effective in the literature, achieving state-of-the-art performance—when paired with an appropriate training routine—despite its simplicity (Leino et al., 2021; Trockman & Kolter, 2021).
Lipschitz-based certiﬁcation is advantageous in many ways; in addition to being easy to incorporate into a robust learning objective, it enables zero-cost certiﬁcation at run time, as the Lipschitz constant does not need to be recomputed after training.
On the other hand, it would seem that Lipschitz-based certiﬁcation is fundamentally underpowered—the “global” Lipschitz constant is a conservative estimate of the local Lipschitz constant, which in turn gives a conservative estimate of how much the net output can change within a given neighborhood.
If a primary sticking point for advancing certiﬁed accuracy is loose certiﬁcation, it is fair to ask how promising Lipschitz-based certiﬁcation will continue to be.
The philosophy behind incorporating Lipschitz-based certiﬁcation into training is essentially that the potential shortcomings of Lipschitz-based certiﬁcation can be addressed by learning a easily certiﬁable network function.
We show that this intuition is essentially correct.
Perhaps surprisingly, we show that Lipschitz-based certiﬁcation is sufﬁciently powerful to be complete on the hypothesis class of Lipschitz functions 4 However, we also show that Lipschitz-based certiﬁcation is PLL, meaning this potential cannot be achieved with a hypothesis class constrained by piecewise linearity.
2.2. L IPSCHITZ - BASED C ERTIFICATION IS P OWERFUL
We begin by showing that for any boundary achievable by a Lipschitz network function, when the learner is given control over the precise network function implementing the boundary, it is always possible to ﬁnd an implementation that can be tightly certiﬁed using Lipschitz-based certiﬁcation.
This is stated formally in Theorem 2.
Theorem 2 further entails that there exists a network function for any 2 (cid:15) -separated data that achieves perfect VRA under Lipschitz-based certiﬁcation.
The proof of Theorem 2 is given in Appendix A.2.
Theorem 2.
When the hypothesis class, F , is given as the set of Lipschitz functions, Lipschitz-based certiﬁcation is complete on F .
2.2. L IPSCHITZ - BASED C ERTIFICATION IS L IMITED BY P IECEWISE - LINEARITY
Despite the power of Lipschitz-based certiﬁcation for general functions, when restricted to the hypothesis class of piecewise linear networks, it becomes fundamentally limited.
That is, formally,
Lipschitz-based certiﬁcation is PLL (Proposition 3).
Proposition 3.
Lipschitz-based certiﬁcation is piecewise-linear limited.
Proposition 3 follows essentially because the certiﬁed frontier of Lipschitz-based certiﬁcation corresponds to a particular level curve of the network function, which is piecewise linear whenever the function is.
As a direct consequence of Proposition 3 and Theorem 1, we arrive at Corollary 4.
Corollary 4.
Lipschitz-based certiﬁcation is not complete on the hypothesis class of piece-wise linear networks.
Note that taken in the context of Theorem 2, Corollary 4 means that in a sense, the fundamental limitation of Lipschitz-based certiﬁcation is not intrinsic to its simplicity (e.g., because the local Lipschitz constant might be tighter than the global constant on some functions), but rather, it is related to the hypothesis class of networks being certiﬁed.
Put differently, piecewise linearity imposes real limitations on Lipschitz-based certiﬁcation that cannot be attributed to practical, but non-fundamental, issues, such as efﬁcient computation of Lipschitz bounds, etc.
2. T HE P ROBLEM WITH C ORNERS AND THE C URSE OF D IMENSIONALITY
The incongruence between the piecewise-linear certiﬁed frontier of Lipschitz-based methods, and the robust frontier of a piecewise-linear boundary, which features smooth curves, becomes relevant when the boundary comes to a “corner,” or relatively sharp inﬂection point.
At corners, the robust frontier curves at a ﬁxed radius around the corner, while the certiﬁed frontier, absent aid from additional capacity (see Section 3), runs parallel to the facets forming the corner, offset by a ﬁxed amount (see Figure 2 in Appendix D for an illustration).
The sharper the corner, the larger the difference will be between the corresponding robust and certiﬁed regions.
Additionally, we will see that this is also true the higher the dimension of the corner, i.e., the more independent half-spaces meet to create the corner.
As a thought experiment, we will model a d -dimensional corner as the intersection of d orthogonal half-spaces.
Assuming the level curves near the corner run parallel to the half-spaces, h ∈ H , forming the corner, in the best case, the certiﬁed region is given by the union of half-spaces obtained by ﬂipping each h ∈ H and shifting it by (cid:15) .
Consider the hypercube of width (cid:15) just opposite the corner.
This hypercube lies entirely outside the robust region, meaning all points within it cannot be certiﬁed using Lipschitz-based certiﬁcation.
However, only the points intersecting the hypersphere of radius (cid:15) centered at the corner are truly non- (cid:15) -robust.
We can compute the ratio of the volume of the hypercube to the intersecting portion of the hypersphere, given by Equation 1:
[Equation]
As the dimension increases, this ratio tends to zero, meaning that in high dimensions, almost all points in this region opposite the corner are incorrectly uncertiﬁed .
Furthermore, the maximum distance from an uncertiﬁed point within this region to the boundary is equal to the diagonal of the hypercube, which is given by √ d · (cid:15) .
This means that even points that are signiﬁcantly more robust than required may yet be uncertiﬁed.
[Figure]
T HE R OLE OF C APACITY
The primary limitation of Lipschitz-based certiﬁcation in piecewise-linear networks derives from the fact that we cannot have smoothly curved level curves in such networks (or, more generally, that PLL certiﬁcation methods cannot have smoothly curved certiﬁed frontiers in such networks).
However, while this is true in the strictest sense, a function with smooth curves can be approximated with arbitrary precision, given sufﬁcient capacity.
In other words, increased network capacity may be one possible option to mitigate the fundamental limitations discussed throughout Section 2.
In this section, we investigate the capacity requirements necessary for tight PLL certiﬁcation in piecewiselinear networks.
While the precise meaning of “capacity” in a quantiﬁable sense is a bit nebulous, for our purposes, we will consider capacity in a piecewise-linear network to correspond to the number of piecewiselinear regions.
This grows with the number of internal neurons, though the relationship may vary depending on other aspects of the network architecture, e.g., the depth of the network.
Previous work has studied the capacity implications for learning a robust decision boundary, ﬁnding that separating points while controlling Lipschitzness may require additional capacity beyond what would be necessary to simply separate them (Bubeck & Sellke, 2021).
Besides the capacity required to represent the decision boundary in a robust network, our work asks instead about the capacity required to tightly certify a given boundary.
We ﬁnd that in a piecewise linear network, even if the boundary is optimal—in that all points in the distribution are indeed a distance of (cid:15) or more from it—the network may require additional capacity to be able to prove this using the Lipschitz constant.
Taking the data distribution aside, we consider the goal of certifying all points that are sufﬁciently far from the boundary.
As highlighted in Section 2.3, in places where the decision boundary forms high-dimensional “corners,” there may be relatively large volumes of points that are (cid:15) -far
from the boundary but cannot be certiﬁed as long as the level curves simply run parallel to the boundary.
In such cases, tight certiﬁcation requires extra capacity speciﬁcally to round out the level curves around the corners in the decision boundary.
We begin by demonstrating this concept via an illustrative example.
We conclude by discussing the implications of our results and suggest avenues for future work.
3. A N I LLUSTRATIVE E XAMPLE OF HOW C APACITY E NABLES T IGHT C ERTIFICATION
As an example of how Lipschitz-based certiﬁcation can require excess capacity beyond what is necessary to learn a robust boundary, we consider a synthetic 2-D dataset that can robustly separated by a simple piecewise linear boundary.
An illustration is provided in Figure 1a.
We begin with a decision boundary given by B = { ( x 1 , x 2 ) : max( x 1 , x 2 )
= 0 } ; this boundary separates points with negative x- and y-coordinates from points in the other three quadrants, and forms a 90 ◦ corner at the origin.
The data are then generated such that all the points with label 0 lie a distance of at least (cid:15) below and to the right of the boundary, and the points with label 1 lie a distance of at least (cid:15) above and to the right of the boundary.
Speciﬁcally, the 1-labeled points curve around the boundary such that there is a tight margin of exactly 2 (cid:15) about the boundary.
By construction, the function f ( x ) =
[0 , max( x 1 , x 2 )] produces logit values that yield the boundary
B , with respect to which all points in the dataset are (cid:15) -locally robust.
This function can be trivially implemented with minimal capacity by a simple MinMax network, f ( x ) = σ ( xW 1 ) W 2 , where σ is the MinMax activation function, and W 1 and W 2 are given by Equation 2.
[Equation]
Furthermore, the Lipschitz constant of f is 1; 5 this can even be tightly obtained by taking the layerwise product of the layer operator norms, as is typically done in practice.
Hence, the points that can be certiﬁed will be those for which | f 1 ( x ) − f 0 ( x ) | ≥ (cid:15) ; that is, the points outside the level curves max( x 1 , x 2 ) =
− (cid:15) and max( x 1 , x 2 ) = (cid:15) .
However, we see that this certiﬁed frontier fails to certify many points in the positive x-y quadrant, despite the fact that all the points are indeed robust with respect to the boundary of f .
This is depicted in Figure 1b.
In order to certify these points, we need the level curve corresponding to f 1 ( x ) − f 0 ( x ) =
(cid:15) to bend smoothly around the boundary, rather than forming the same 90 ◦ angle.
This requires more capacity.
To gain a sense of how this plays out in practice, we consider adding capacity via expanding the number of neurons in the hidden layer (which contained only two neurons in our minimal example).
In Figures 1d and 1e, we show the boundaries of two additional learned networks, g and h , withand 200 internal neurons, respectively.
We see that increasing the number of internal neurons by an order of magnitude yields a better set of level curves, but the network g still must compromise as the level curves are not smooth enough to tightly follow the contour of the data.
Finally, when we increase the number of internal neurons by two orders of magnitude , we at last obtain a function h that achieves nearly 100% VRA on our sample data.
This function, as desired, forms essentially smooth level curves that bend around the boundary corner with a radius of (cid:15) .
Interestingly, h learns a boundary that is somewhat different from the boundary originally used to derive the data; however, both boundaries can be thought of as “equivalent” in the sense that they produce the same margin, reﬂecting that the optimal boundary for this dataset is not unique.
Discussion.
In our example, we needed 100 times more neurons than were necessary to construct an optimal decision boundary in order to tightly certify the boundary with the Lipschitz constant.
While it is difﬁcult to extrapolate from this toy example to a “real world” scenario, our results suggest that smoothing the level curves may require signiﬁcant overhead beyond the capacity necessary to produce a truly robust boundary.
Another aspect of this experiment worth noting is that when the network had insufﬁcient capacity to learn an optimally robust, tightly certiﬁed boundary (e.g., in Figures 1c and 1d), the resulting model tended to compromise by making the corner less sharp (compared to the desired 90 ◦ angle).
Geometrically, when the boundary has an inﬂection with a wider angle, the difference between the certiﬁable frontier and the frontier of robust points is less pronounced (consider for example, what happens then the inﬂection approaches 180 ◦ ).
In effect, this means that while under-parameterization of piecewise-linear models may be a problem for robust model performance in practice, this limitation may be (at least in part) manifested as an under-ﬁt model as opposed to one with many robust but non-certiﬁable points.
This is reﬂected in the empirical results for certiﬁably trained models in the literature, which typically have lower “clean accuracies” than their standard-trained counterparts.
However, we note that these models also exhibit a discrepancy between their certiﬁed accuracy and their vulnerability to actual attacks, leaving the possibility that they may also fail to certify some truly robust points.
3. P OTENTIAL D RAWBACKS OF THE C APACITY E SCAPE H ATCH
As we have seen, by adding capacity, we can help overcome the limitations of piecewise linearity by enabling the network to approximate smooth curves around corners in the decision boundary.
For universal tight certiﬁcation, this needs to be done in the neighborhood of all corners on the decision boundary.
To the extent that each corner requires independent capacity, hopes for the scalability of such an approach seem slim; albeit, VRA only requires tight certiﬁcation on the data manifold, meaning that extra capacity should only be needed in places where the decision boundary has sharp inﬂections near in-distribution points.
However, this, too, presents an interesting problem.
Namely, the network only has incentive to allocate capacity to round the level curves in the places that are necessary to certify its training set ; i.e., where inﬂections in the decision boundary encroach on training points.
Meanwhile, if similar inﬂections exist near test points not seen during training, the learned network may fail to certify them—even if the boundary is general, and even if it is also robust.
In other words, we are faced with not only the challenge of learning a generally robust boundary, but additionally of learning a generally certiﬁable function.
Indeed, generalization of VRA is empirically observed to be worse than the corresponding “clean accuracy” would indicate—a principle that has been noted in prior work due to its privacy implications (Yeom et al., 2020).
A Proposed Way Forward.
Another possibility for addressing the fact that Lipschitz-based certiﬁcation is PLL is to expand the hypothesis class to enable smooth curves in the decision surface.
Ultimately, our analysis shows that Lipschitz-based certiﬁcation is most effective when the level curves of the network function accurately reﬂect the (cid:96) 2 distance to the boundary, which requires the possibility of smooth curves.
This goal may be best achieved by purpose-built activations, as piecewise linearity stems from the choice in activation function.
State-of-the-art Lipschitz-based certiﬁable training methods have enjoyed increased success in recent years through leveraging MinMax activations (Anil et al., 2019)—or a variant thereof proposed by Singla et al.
(2022)—which are piecewise linear.
MinMax has a distinct advantage over the more common ReLU activation, due to its gradient-norm-preserving (GNP) property, which Anil et al.
demonstrate is key for tight, efﬁcient Lipschitz bounds.
While the need for gradient norm preservation remains clear, we posit that some form of smoothness is an additional desirable property, as it would free the hypothesis class from piecewise linearity.
We believe the task of designing suitable smooth activation functions for PLL-certiﬁed networks is a promising avenue for future work.
R ELATED W ORK
Power and Limitations of Lipschitz-based Certiﬁcation.
Several of the early efforts around robustness certiﬁcation focused on post hoc certiﬁcation of networks trained outside of the control of the certiﬁer.
This is a fundamentally hard problem, shown to be NP-complete by Katz et al.
(2017) and Sinha et al.
While this fundamentally limits the tractability of complete post hoc certiﬁcation, the limitation is of lesser concern for modern approaches that incorporate certiﬁcation into the training objective, thus encouraging learning models that better facilitate efﬁcient certiﬁcation.
The speciﬁc limitations of Lipschitz-based certiﬁcation have also been of great interest in the prior literature.
Most of these results particularly consider the practical problem of bounding a neural network’s Lipschitz constant.
For example, Huster et al.
(2018) note that the common method of using the product of the layer-wise operator norm cannot tightly bound the Lipschitz constant of even basic functions in ReLU networks.
Anil et al.
(2019) study this point further demonstrating a trade-off between expressive power and efﬁcient Lipschitz bound computation in networks with non-gradient-norm-preserving activation functions.
This limitation is handled by using network architectures with gradient-norm-preserving activation function such as MinMax, and orthonormal linear operators (though the latter need not necessarily be strictly enforced as it is a learnable objective).
Anil et al.
conjecture that such networks are universal 1-Lipschitz function approximators , suggesting that learning any Lipschitz function in such a way that the Lipschitz constant can be bounded tightly and efﬁciently is possible.
By contrast, our work points to previously unstudied limitations that are separate from the Lipschitz constant bounding problem, and are indeed not mitigated through the use of MinMax activations, which are piecewise linear.
However, we propose that the limitations brought forth in our work may similarly be addressed via novel activation functions.
On the ﬂip side, previous work has also touched on the power of Lipschitz-based certiﬁcation.
(Leino et al., 2021) showed that certiﬁcation with the global Lipschitz constant can be as powerful as with the local Lipschitz constant when the model is under the learner’s control.
We extend this result in a number of key ways.
First, we prove a stronger result that can be stated for all points, rather than for a ﬁnite set of points certiﬁed via the local Lipschitz constant.
Second, we explicitly consider the hypothesis class, demonstrating that smoothness is a necessary condition to achieve this result.
Capacity Requirements for Robust Neural Networks.
Understanding the role of capacity in deep neural networks has been a topic of interest in general, particularly due to the demonstrated effectiveness of highly over-parameterized models (Arora et al., 2018; Bubeck & Sellke, 2021; Du et al., 2019; Garg et al., 2022; Zhang et al., 2017).
Recent work has also investigated this subject in the particular context of robust models.
Bubeck & Sellke (2021) showed that under mild regularity assumptions, learning a highly accurate model with small Lipschitz constant requires signiﬁcantly more parameters than would be required with no constraint on the Lipschitz constant—where the capacity overhead, in terms of the number of parameters, scales with the dimension.
While a controlled Lipschitz constant is central to successful Lipschitz-based certiﬁcation, our work (e.g., our example in Section 3.1), shows that a Lipschitz interpolation between points of opposite class is not sufﬁcient for certiﬁcation.
As our analysis is focused on certiﬁcation rather than Lipschitz interpolation, we complement the work of Bubeck & Sellke, showing that even further capacity may be required to appropriately bend the function’s level curves to facilitate Lipschitz-based certiﬁcation.
In addition to the information-theoretic capacity requirements, large numbers of parameters in deep networks may be necessary to facilitate efﬁcient learning (Arora et al., 2018; Du et al., 2019).
Recently, Garg et al.
(2022) showed that robust learning in particular may require even greater overparameterization than standard learning.
Results such as these are complimentary to work such as ours, which focus on minimal parameterizations.
Randomized Smoothing.
Our work has focused on deterministic certiﬁcation.
By contrast, randomized smoothing (Cohen et al., 2019; Lecuyer et al., 2018) has become a popular method that instead provides a statistical guarantee of robustness.
Randomized smoothing (RS) essentially modiﬁes the original function by predicting the expected label under Gaussian 6 noise.
These predictions are empirically determined through sampling, with the statistical certiﬁcate depending on the unanimity of the sample labels.
While RS provides a weaker robustness guarantee, it solidly outperforms deterministic methods in terms of certiﬁed accuracy.
Interestingly, it seems clear that RS is not PLL, since it naturally smooths piecewise linear networks, leading to a smooth boundary and certiﬁed frontier—this may be one of the keys to its success.
This observation gives further support to the notion that state-of-the-art deterministic methods may be held back by piecewise linearity, and may beneﬁt from smooth activation functions.
C ONCLUSIONS AND F UTURE D IRECTIONS
Incorporating Lipschitz-based certiﬁcation into robust training procedures has proven to be the most effective way to achieve high deterministic (cid:96) 2 veriﬁed-robust accuracy yet considered in the literature.
Due to our Theorem 2, there is reason to believe Lipschitz-based certiﬁcation has the power to remain as promising as current results suggest.
However, we also showed that restricted to the hypothesis class of piecewise-linear networks, as has been the standard regime, Lipschitz-based certiﬁcation becomes fundamentally limited.
For piecewise-linear networks, this means that tight
Lipschitz-based certiﬁcation may require signiﬁcantly more parameters, which, even if tractable, can complicate certiﬁably robust generalization (e.g., see Section 3.2).
On the other hand, rather than viewing this as a fundamental drawback for Lipschitz-based certiﬁcation, we propose that purpose-built activations—with the correct smoothness and gradient-norm-preserving properties— is a promising avenue for future work to free the most promising form of efﬁcient deterministic certiﬁcation from the limitations of piecewise linearity.
A P ROOFS A. P ROOF OF T HEOREM
Theorem Statement.
Any piecewise-linear limited certiﬁcation procedure is incomplete on the hypothesis class of piecewise linear networks.
Proof.
It sufﬁces to show that there exists a boundary achievable by a piecewise-linear network for which no PLL certiﬁcation method can tightly certify.
We proceed by producing a piecewise linear boundary that induces a smooth robust frontier.
This is sufﬁcient to prove our theorem, as ∆
[Equation]
Consider the 2-D boundary given by max( x, y )
= 0 .
Clearly, this boundary exists within the class of piecewise linear functions as the function f
( x, y ) =
max( x, y ) is piecewise linear.
Now consider the points in the positive x-y quadrant.
The points in this quadrant that are at distance (cid:15) from the boundary are given by (cid:112) x
2 + y 2 = (cid:15) , which is not piecewise linear.
By deﬁnition, any certiﬁcation method that is PLL must have a certiﬁed frontier that is piecewise linear.
Thus, the certiﬁed frontier of such any such method cannot be equal to (cid:112) x
2 + y 2 = (cid:15) in this quadrant.
A. P ROOF OF T HEOREM
Theorem Statement.
When the hypothesis class, F , is given as the set of Lipschitz functions,
Lipschitz-based certiﬁcation is complete on F .
Proof.
Let F be the set of Lipschitz functions.
Consider the decision boundary of any function f ∈ F .
Deﬁne f (cid:48) as follows: let d ( x ) be the minimum distance of x from the decision boundary and let f (cid:48)
( x ) =
d ( x ) · 1 F ( x ) , where 1 F ( x ) is the one-hot encoding of F ( x ) .
First, observe that f (cid:48)
j − f (cid:48)
i is 1-Lipschitz for all i (cid:54) =
j .
To see this consider the following.
The
Lipschitz constant is given by
[Equation]
Consider points x and x (cid:48) , and let us assume that || x − x (cid:48)
||
= δ .
We would like to bound the quantity given by (4), the numerator in (3), by δ .
[Equation]
There are a few cases to consider.
First if F ( x ) and F ( x (cid:48) ) are both different from i and j , then (4) is 0 ≤ δ .
Since (4) is symmetric in both i and j , and x and x (cid:48) , without loss of generality, we will assume F ( x ) =
j .
This leaves two cases: when F ( x (cid:48) )
=
j , and when F ( x (cid:48) ) (cid:54) =
j (in the latter case we will not be concerned with whether or not F ( x (cid:48) )
= i ).
In the ﬁrst case we have
[Equation]
without loss of generality
[Equation]
Let a be the nearest point on the boundary to x (cid:48) , such that which d ( x (cid:48) )
=
|| x (cid:48) − a || .
Thus,
[Equation]
as a is on the boundary
[Equation] [Equation]
by the triangle inequality
[Equation] [Equation]
as desired
[Equation]
In the second case, x and x (cid:48) are given different labels and we have
[Equation] [Equation]
as f (cid:48)
i ( x (cid:48) ) is at most d ( x (cid:48) )
(achieved when F ( x (cid:48) )
= i )
[Equation]
Since x and x (cid:48) are given different labels, there must be at least one part of decision boundary that bisects the line segment connecting x and x (cid:48) ; let a be this intersection point.
Additionally, since a is on the boundary, we must have that d ( x ) ≤ || x − a || and d ( x (cid:48) )
≤ || x (cid:48) − a || .
Thus, as desired, d ( x ) + d ( x (cid:48) ) ≤ || x − a || + |
[Equation]
x (cid:48)
[Equation]
=
[Equation]
This allows us to conclude that f (cid:48)
j − f (cid:48)
i is 1-Lipschitz for all i (cid:54) =
j , as claimed.
The points that are certiﬁed by Lipschitz-based certiﬁcation are those for which (14) holds, where j = F ( x ) and K ji is the Lipschitz constant of f (cid:48)
j − f (cid:48)
i .
[Equation]
Notice that when i (cid:54) =
F ( x ) , f (cid:48)
i ( x ) = 0 .
Thus (14) can be simpliﬁed to f
[Equation]
j ( x ) =
d ( x ) ≥ (cid:15) , noting also that K ji = 1 ∀
i, j .
Therefore, the points that can be certiﬁed via Lipschitz-based certiﬁcation are those for which d ( x ) ≥ (cid:15) , which are precisely the points that are locally robust.
A. P ROOF OF P ROPOSITION
Theorem Statement.
Lipschitz-based certiﬁcation is piecewise-linear limited.
Proof.
Assume the function, f , being certiﬁed is piecewise linear.
Without loss of generality, consider inputs x for which the network predicts class j .
The margin by which class j surpasses all other classes is given by m ( x ) =
min i { f j ( x ) − f i ( x ) } .
Note that m is piecewise linear as f is piecewise linear.
Let K be the Lipschitz constant of m .
The largest radius that can be certiﬁed at x is then m / K .
Thus, the certiﬁed frontier is given by m / K = (cid:15) ; this corresponds to the level curve of m corresponding to m = (cid:15) · K .
Since m is piecewise linear, this level curve is piecewise linear.
Thus, the certiﬁed frontier is piecewise linear, and
Lipschitz-based certiﬁcation
is PLL.
B L IMITATIONS OF O THER C ERTIFICATION M ETHODS B. L IMITATIONS OF L OCAL -L IPSCHITZ - BASED C ERTIFICATION
State-of-the-art deterministic (cid:96) 2 certiﬁed performance is currently achieved using Lipschitz-based certiﬁcation, which outperforms other types of certiﬁed training methods (Leino et al., 2021; Trockman & Kolter, 2021) such as those based on convex relaxations—e.g., (Wong et al., 2018)—or maximizing linear regions—e.g., (Croce et al., 2019; Xiao et al., 2019).
Unsurprisingly, however, methods that use the local Lipschitz constant for certiﬁcation can achieve similarly high VRA (Huang et al., 2021), though this comes at the cost of signiﬁcantly slower certiﬁcation.
The local Lipschitz constant at a point x is given by K (cid:15) ( x ) in Deﬁnition 5, which essentially corresponds to the maximum slope of the function within an (cid:15) neighborhood of x .
Deﬁnition 5.
The local Lipschitz constant is given by
[Equation]
Local-Lipschitz-based certiﬁcation , similar to Lipschitz-based certiﬁcation (Section 2.2), certiﬁes points, x , when the margin by which the top-predicted class, F ( x ) , exceeds all other classes is greater than (cid:15) · K (cid:15) ( x ) .
While the local Lipschitz constant is always a lower bound for the global Lipschitz constant—and therefore local-Lipschitz-based certiﬁcation can possibly be tighter—
local-Lipschitz-based certiﬁcation is nonetheless equally limited.
We will consider a generous setting in which the bound used for certiﬁcation is exact, i.e., where the certiﬁcation procedure has oracle access to K (cid:15) ( x ) .
Because K (cid:15) ( x ) is not piecewise linear, localLipschitz-based certiﬁcation is not strictly piecewise-linear limited (PLL) in this setting.
It is worth noting, however, that methods for approximating the local Lipschitz constant may not leverage this smoothness in practice.
Regardless, we show that local-Lipschitz-based certiﬁcation is incomplete on piecewise-linear networks (Theorem 5).
This result is related to the fact that when the learner is given control over the implementation of the boundary, (global) Lipschitz-based certiﬁcation can match the power of local-Lipschitz-based certiﬁcation; this result has been proven in a slightly weaker formulation by Leino et al.
We provide an alternative theorem statement and proof here that better aligns with the insights in this work.
Theorem 5.
Local-Lipschitz-based certiﬁcation is not complete on the hypothesis class of piecewise-linear networks.
Proof.
It sufﬁces to show that there exists a boundary achievable by a piecewise-linear network for which no corresponding piecewise-linear implementation can be tightly certiﬁed by local-Lipschitzbased certiﬁcation.
Recall that by Corollary 4 there exists such a boundary for (global) Lipschitzbased certiﬁcation.
We will consider one of the same such boundaries.
For a particular value of (cid:15) , consider the points ∆ ( R ( F, (cid:15) )) , which are at distance exactly (cid:15) from the boundary.
There are two cases to consider: either (1) the local Lipschitz constant is always the same everywhere, i.e., ∀ (cid:15) > 0 , ∀ x 1 , x 2 ∈ ∆ ( R ( F, (cid:15) )) , K (cid:15) ( x 1 ) =
K (cid:15) ( x 2 ) , or (2) there is some variation in the local Lipschitz constant, such that ∃ (cid:15) > 0 , x 1 , x 2 ∈ ∆ ( R ( F, (cid:15) )) where K (cid:15) ( x 1 ) (cid:54)
=
K (cid:15) ( x 2 ) .
In the ﬁrst case, we see that K (cid:15) ( x ) =
K (the global Lipschitz constant), meaning that localLipschitz-based certiﬁcation will certify the exact same points as (global) Lipschitz-based certiﬁcation.
Thus, by Corollary 4, there must be a point which is robust at radius (cid:15) but not certiﬁable.
In the second case, without loss of generality, assume K (cid:15) ( x 1 )
> K (cid:15) ( x 2 ) .
Because f is piecewise linear, it is comprised of a ﬁnite number of linear functions, which in turn have a ﬁnite number of distinct slopes (gradient norms).
Thus, if K (cid:15) ( x 1 ) > K (cid:15) ( x 2 ) , K (cid:15) ( x 1 ) − K (cid:15) ( x 2 ) =
δ where δ belongs to some ﬁnite set of strictly positive values.
Furthermore, without loss of generality, x 1 and x 2 can be chosen to be arbitrarily close together, i.e., they lie arbitrarily near a point where the local Lipschitz constant changes.
We will therefore consider x 1 and x 2 that are chosen such according to Equation 15.
[Equation]
[Equation]
Let m 2 be the margin by which the top-predicted class, F ( x 2 ) , exceeds all other classes.
The maximum radius that can be certiﬁed at x 2 is thus m 2 / K (cid:15) ( x 2 ) .
Note that as certiﬁcation is sound, we have
[Equation]
Now consider the maximum radius that can be certiﬁed at x 1 .
Let m 1 be the margin by which the top-predicted class, F ( x 1 ) , exceeds all other classes.
The maximum radius that can be certiﬁed at x 1 is thus m 1 / K (cid:15) ( x 1 )
[Equation]
by assumption
[Equation] [Equation]
by deﬁnition of the Lipschitz constant
[Equation]
our choice of
[Equation]
Thus, we see that x 1 cannot be certiﬁed with radius (cid:15) , despite that its distance from the boundary is exactly (cid:15) .
B. O THER P IECEWISE - LINEAR L IMITED M ETHODS
Our work focuses primarily on Lipschitz-based certiﬁcation, which we demonstrate is fundamentally limited on the hypothesis class of piecewise linear networks.
However, this limitation is not due speciﬁcally to the use of the Lipschitz constant per se; instead, we attribute it more generally to the fact that Lipschitz-based certiﬁcation always produces a piecewise-linear certiﬁed frontier on piecewise-linear networks, a property we refer to as PLL (Deﬁnition 4).
In this section we brieﬂy discuss how this property may apply to other ﬂavors of certiﬁcation techniques that have been proposed in the literature.
Convex Relaxations and Dual Networks.
One classic approach for certiﬁcation is through convex relaxation.
A survey of such methods is given by Salman et al.
(2019), who point out the limitations (regarding tight certiﬁcation) of convex relaxations (though the authors do not consider our setting where the learner may control the implementation of the boundary, but rather focus on post hoc certiﬁcation).
Though many approaches in this family have been proposed, we will consider two baseline methods that capture a primal and dual formulation of convex relaxations: Fast-Lin (Weng et al., 2018), and an approach proposed by Wong & Kolter (2018), often referred to as “KW.”
Fast-Lin directly derives upper and lower bounds on the output of a ReLU network in order to determine if an adversarial example might exist.
This is done by iteratively computing upper and lower bounds for the neurons in each layer and using them to replace the ReLU activations with linear upper and lower bounds.
This computation resembles a piecewise-linear network, suggesting that Fast-Lin is PLL.
The KW approach formulates the adversary as an LP that optimizes over the convex outer approximation of the set of top-level activations reachable through a norm-bounded perturbation.
Crucially, for the sake of tractability, the LP can be bounded by the feasible set of the dual,
which Wong &
Kolter show can be expressed as a dual network , which resembles a backwards pass in the network being certiﬁed.
For ReLU networks, the activations in the dual network are replaced with their upper convex envelopes (a linear function) over the bounded set [ (cid:96), u ] , where (cid:96) and u represent lower and upper bounds on the pre-ReLU neural activations.
The upper and lower bounds can be iteratively computed in a similar way to in Fast-Lip; thus, in its simplest form, 7 the dual network inherits the piecewise linearity of the original ReLU network being certiﬁed, suggesting the resulting certiﬁed frontier is piecewise linear, and certiﬁcation is PLL.
Hyperplane Projections.
As exact certiﬁcation is NP-complete, the literature has often turned to training procedures that help simple, approximate certiﬁcation enjoy greater success.
In piecewise linear networks, the input can be partitioned into a polyhedral complex where each convex region corresponds to a single activation pattern , over which the network is linear (Croce et al., 2019;
Fromherz et al., 2021; Jordan et al., 2019).
Motivated by this view of ReLU networks, one family of robust training approaches attempts to expand the linear regions of the network to simplify the combinatorial analysis of the possible ReLU activation patterns (Croce et al., 2019; Xiao et al., 2019).
Croce et al.
proposed a simple certiﬁcation technique for networks trained with their “Maximum
Margin Regularization” (MMR), where a point, x , is certiﬁed only if (1) the entire (cid:15) -ball around x is contained in a single convex activation region, and (2) the linear function corresponding to the region does not have a boundary within (cid:15) from x .
This approach is clearly PLL, as the certiﬁed regions can be obtained by shrinking each activation region (possibly split in two if a linear decision boundary crosses it) by (cid:15) .
Since the original regions are convex polytopes, so too are the certiﬁed regions, thus the certiﬁed frontier is piecewise-linear.
In contrast to our ﬁndings for Lipschitz-based certiﬁcation, it is worth noting that the limitations of this approach go beyond PLL, as completeness of the MMR approach is in direct conﬂict with non-linearity; and moreover, the approach is designed speciﬁcally for piecewise-linear networks.
C D ETAILS ON E XPERIMENTS
The experiments presented in Figure 1 in Section 3 were performed using the gloro Python library, which implements the GloRo Net method of Leino et al.
(2021) for training certiﬁably robust [Equation] 𝐾 models by incorporating Lipschitz-based certiﬁcation into training.
All networks in the experiments consisted of a 1-hidden layer dense network with MinMax Anil et al.
(2019) activations; three speciﬁc architectures were used, with 2, 20, and 200 hidden units, respectively.
Models were trained for 64 epochs, with a batch size of 128.
We chose hyperparameters inspired by those used by Leino et al.
(see the original paper for details on the meaning of the various hyperparameters); namely, we used GloRo-TRADES loss with λ = 1 . 2 , we scaled (cid:15) logarithmically to its ultimate value of 0 .
5 by the half-way point of training, and we linearly decreased the learning rate from 10 − 3 to 0 half-way through training.
D A N I LLUSTRATIVE E XAMPLE OF THE C ORNER P ROBLEM
For illustrative purposes a diagram is provided in Figure 2 that serves as a visual explanation of the “corner problem” described in Section 2.3.
The boundary of a neural network, shown by the bold black line, forms a sharp corner.
The complement to the robust region, i.e., the set of points that are not robust, is shown in gray.
A simple implementation of this boundary has level curves that make similar sharp corners; the level curve corresponding to the certiﬁed frontier is shown by the dotted line, and the certiﬁed region is colored in blue.
The region opposite the corner in the boundary is highlighted.
We see that in this region, there is a set of points, shown in orange, that are not certiﬁed, despite the fact that they are robust, being at distance greater than (cid:15) from the boundary.
In this two-dimensional example, these falsely ﬂagged points make up a relatively small fraction of the uncertiﬁed points opposite the corner (represented as the union of the orange points and the highlighted gray points in the diagram); however, in high dimensions, virtually all uncertiﬁed points in this region