Reducing Certified Regression to Certified Classification for General Poisoning Attacks
Anonymous Author(s)
Anonymous Organization
Anonymous Location
Anonymous Email
Abstract —Adversarial training instances can severely distort a model’s behavior.
This work investigates certified regression defenses , which provide guaranteed limits on how much a regressor’s prediction may change under a training-set attack.
Our key insight is that certified regression reduces to (voting- based) certified classification when using median as a model’s primary decision function.
Coupling our reduction with ex- isting certified classifiers, we propose six new provably-robust regressors.
To the extent of our knowledge, this is the first work that certifies the robustness of individual regression predictions without any assumptions about the data distribution and model architecture.
We also show that the assumptions made by existing state-of-the-art certified classifiers are often overly pessimistic.
We introduce a tighter analysis of model robustness, which in many cases results in significantly improved certified guarantees.
Lastly, we empirically demonstrate our approaches’ effectiveness on both regression and classification data, where the accuracy of up to 50% of test predictions can be guaranteed under 1% training-set corruption and up to 30% of predictions under 4% corruption.
Our source code is available at https://github.com/AnonSaTML/certified regression.
I. I NTRODUCTION
In a training-set attack , an adversary inserts malicious instances into a model’s training set to manipulate one or more target predictions [1, 2, 3, 4, 5].
Kumar et al.
’s
[6] recent survey of large corporate and governmental organizations found that training-set attacks were their top ML security concern due to previous successful attacks [7].
Kumar et al.
specifically note that most defenses against these attacks lack “fundamental security rigor” and acknowledge that most adversarial ML defenses are like “crypto pre-Shannon” [8].
Kumar et al.
’s
concerns primarily arise because most defenses (including those for training-set attacks) are empirical [9, 10, 11, 12]; such defenses derive from insights into the underlying mechanisms of specific attacks and in turn provide strategies to mitigate the associated vulnerability.
The fatal weakness of empirical defenses is that they provide no guarantees of their effectiveness, and attacks can be adapted to bypass them – often with minimal effort [6, 13].
In contrast, certified defenses [14, 15, 16, 17] provide a quantifiable guarantee of a prediction’s robustness, albeit under specific assumptions.
There has been significant recent progress towards lifting the assumptions necessary to certify a classifier’s prediction.
Today, non-trivial guarantees of the pointwise robustness of individual classification predictions are possible without making assumptions about the underlying data distribution or model architecture.
Similar progress has not yet been made for regression.
Existing certified regressors generally make strong assumptions about the data distribution (e.g., linearity [18], sparsity [19]) that rarely hold in practice.
When those assumptions fail to hold, these methods’ “guarantees” are not guarantees at all.
Another common requirement of existing certified regressors is that the model architecture is linear [20], despite other architectures often performing far better [21, 22].
A problem Q is reducible to a different problem Q ′ if an efficient algorithm to solve Q ′ can also efficiently solve Q [23].
Our key insight is that certified regression is reducible to certified classification for backdoor and poisoning attacks.
Mapping certified regression to certified classification requires only minimal changes to the certified classifier’s architecture, with the robustness certification function identical.
Given reducibility, an important takeaway is that certified regression can be viewed as no harder than certified classification.
Coupling our reduction with existing certified classifiers [24, 25, 26], we propose six new certifiably-robust regressors.
To the extent of our knowledge, our methods are the first to provide pointwise regression robustness guarantees without both distributional and model assumptions.
Our primary contributions are enumerated below.
1) We formalize three paradigms based on median perturbation to map certified regression to certified classification.
All of our certified regressors apply one of these paradigms.
We propose two provably-robust instance-based regressors – one based on k -nearest neighbors and the other based on all training instances within a feature-space region.
We separately propose four ensemble-based certified regressors, where one pair of regressors trains submodels on disjoint data while the other pair allows submodels to be trained on overlapping data.
We significantly improve the certification performance of our ensemble-based regressors and existing certified classifiers via a tighter analysis of submodel prediction stability.
We demonstrate our methods’ effectiveness on both regression and classification datasets, where we certify significant fractions of the training set and even outperform state-ofthe-art certified classifiers on binary classification.
Note that all proofs are in the supplemental materials.
II. P RELIMINARIES
We begin with a summary of our notation followed by a formalization of our threat model and objective.
Notation
Let [ k ] denote the set of integers { 1 , . .
. , k } , and denote the corresponding power set 2 [ k ] .
1 [ q ] is the indicator function , which equals 1 if predicate q is true and 0 otherwise.
Let H ( k )
=
(cid:80) ki
=1 1 i denote the k -th harmonic number .
In this work, the term “set” refers to a multiset where multiple elements may have the same value.
Denote set A ’s median med A .
In cases where A ’s cardinality is even, the median is the midpoint between A ’s | A | 2 -th and ( | A | 2 + 1) -th largest values.
Finding the median requires only linear time, meaning median is asymptotically as fast as mean [27].
x ∈ X is an independent variable (e.g., feature vector ) of dimension d and y ∈ Y ⊆ R a response variable (e.g., target ).
Let Z :=
X × Y denote the instance space .
Training set S consists of n training examples.
For m ∈ N where m ≤ n , deterministic function h tr : Z → [ m ] partitions the instance space, and by consequence S .
Let S (1) , . . .
, S ( m ) be the m disjoint training set blocks defined by h tr where S = ⊔ mj =1 S ( j ) .
Model f : X → R is trained on full set S .
f may be a single decision function or the fusion of an ensemble of T submodels, where for simplicity T is chosen to be odd.
Let f t denote a submodel where t ∈ [ T ] .
Each f t has its own training data
D t ⊂ S .
Submodel training is deterministic , meaning training on fixed D always yields the same model.
We separately consider both partitioned ( ∀ t,t ′ D t ∩ D t ′ = ∅ ) and overlapping ( ∃ t,t ′ D t ∩ D t ′ ̸
= ∅ ) submodel training data.
Threat Model For arbitrary test instance ( x te , y te ) , the adversary’s objective is to alter the model so that the prediction error | f ( x te ) − y te | is as large as possible.
Our primary threat model considers an adversary that can insert arbitrary instances into training set S and arbitrarily delete instances from S .
The attacker has perfect knowledge of the learner and our method.
We make no assumptions about the underlying data distribution or adversarial training instances .
Our Objective Determine certified robustness R – a guarantee on the number of training instances that can be inserted into or deleted from training set S without the model prediction ever violating the requirement that ξ l ≤ f ( x te ) ≤ ξ u , where ξ l , ξ u ∈ R are user-specified and application dependent.
Note that robustness R is pointwise , meaning each prediction f ( x te ) is certified individually.
A. One-Sided vs. Two-Sided Certification Bounds
For simplicity, the remaining sections exclusively describe how to certify a one-sided upper bound , f ( x ) ≤ ξ , since all other bounds reduce to this base case.
For example, certifying a one-sided lower bound reduces to certifying an upper bound via negation as f ( x ) ≥ ξ ⇔ − f ( x ) ≤ − ξ .
Likewise, a two-sided bound is equivalent to the worst one-sided robustness as
[Equation]
B. Relating Regression and Binary Classification
Binary classification can be viewed as a simple form of regression where Y = {± 1 } .
The model’s decision function becomes sgn f ( x te ) where sgn a
= +1 if a > 0 and − 1 otherwise.
While our primary focus is regression, our methods also achieve state-of-the-art results for binary classification.
III. R ELATED W ORK
Techniques to mitigate (regression) models’ implicit fragility have been studied for over half a century.
Below we partition these methods into three categories with progressively stronger robustness guarantees.
Resilient Regression Early methods were rooted in robust statistics and focused on mitigating the effect of trainingset outliers.
For example, various trimmed loss functions (e.g., Huber [28], Tukey [29]) cap an outlier’s influence on a model [30, 31].
Methods like RANSAC [32] employ another common robustness strategy of detecting and removing training-set outliers [33, 34].
Adversarially-Robust Regression
The above methods primarily target random noise/outliers.
Adversarial training instances can be much more insidious since they are crafted to avoid detection by appearing uninfluential and may only affect a very small fraction of test predictions [2, 5].
These factors can combine to make adversarial training instances difficult for resilient methods to fully detect and correct [35].
Some existing adversarial regression defenses do provide pointwise robustness guarantees, albeit under strong assumptions about the underlying data distribution [36].
For example, some work assumes that the training set follows a linear data distribution with arbitrary white, Gaussian noise [18, 37].
Others assume the data distribution’s feature matrix is low rank [19].
Conditioning a guarantee on a specific data distribution is inherently precarious – in particular if the strong distributional assumption rarely holds and cannot be easily verified.
If the distributional assumption does not hold, any guarantee is no guarantee at all.
Note that there are adversarially-robust regression defenses that provide guarantees without making distributional assumptions [20, 36].
However, their robustness guarantees are themselves distributional.
For example, Jagielski et al.
[20] bound the clean training data’s mean error but provide no pointwise guarantees.
In other words, such methods do not provide insight into each prediction’s robustness.
A major strength of our approach to certified regression is that we provide pointwise guarantees without any assumptions .
Lastly, many existing adversarially-robust regressors consider exclusively linear models [18, 19, 20, 37].
However, state-of-the-art regressors increasingly leverage non-linear methods [21, 22, 38, 39].
In contrast, our ensemble-based certified regressors support any submodel architecture.
Certified Classification Recent work has proposed numerous classifiers provably robust to training-set attacks [15, 16, 17, 40, 41].
These state-of-the-art certified classifiers all rely on majority voting-based methods and derive their guarantees by (lower) bounding the number of training-set modifications needed for the label with the second-most votes to overtake the plurality label.
Jia et al.
’s
[24] certified k -nearest neighbor ( k NN) classifier is the simplest such method, where the set of “votes” is the training labels from the test instance’s neighborhood.
Due to space, we defer a detailed discussion and analysis of Jia et al.
[24]’s method to suppl.
Sec.
D.
Levine and Feizi [25] propose deep partition aggregation (DPA), a general, ensemble-based certified classifier.
Suppl.
Sec.
E describes DPA in detail, but briefly, DPA’s deterministic submodels are fully-independent since they are trained on disjoint data.
Given a test instance, each submodel predicts a label, and the overall prediction is the ensemble’s plurality label.
To turn these labels (i.e., votes) into a robustness guarantee, DPA needs to certify each submodel’s robustness.
However, DPA sidesteps this by always assuming worst-case submodel robustness, which we formalize below.
Def. 1.
Unit-Cost Assumption : Any modification to a submodel’s training set changes the submodel arbitrarily.
In practice, there are limits to how much a single training-set modification will alter a submodel and its predictions – in particular for models with strong inductive biases.
Therefore, the unit-cost assumption’s pessimism can cause methods like DPA to underestimate a prediction’s true robustness.
Nonetheless, this assumption greatly simplifies ensemble robustness certification by reducing the task to just submodel vote counting.
Most recently, Wang et al.
[26] modify DPA’s ensemble so that submodels can be trained on overlapping data, which (slightly) improves the ensemble’s certification bounds.
While voting-based methods work well for classification with nominal Y , these ideas have not yet been adapted to regression where Y is continuous.
This work fills in that gap by providing a reduction that adapts certified classifiers to certify regression.
We specifically detail the reduction for the certified classifiers proposed by Jia et al.
[24], Levine and Feizi [25], and Wang et al.
By building on these methods, we inherit their property of not needing to make assumptions about the data distribution or model architecture.
The fundamental challenge of our reduction is making a continuous output space behave like a robust, nominal label space.
We describe the solution to this challenge next.
IV. W ARM -U P : P ERTURBING A S ET ’ S M EDIAN
Traditional center statistics such as mean have a breakdown point of 0, i.e., altering a single value in a set can shift the mean arbitrarily.
In contrast, median has maximum robustness, i.e., a breakdown of 50%.
A high breakdown point entails that a statistic is stable and resistant to change.
We formalize changes to median below.
Def. 2.
Median Perturbation : The task of altering a set’s contents so that its median exceeds some specified ξ ∈ R .
Throughout this work, determining pointwise robustness R simplifies to quantifying the number of changes that can be made to a set without perturbing its median.
To better foster intuitions, we first formalize robustness R w.r.t.
simply perturbing a multiset’s median and unrelated to any model.
Later sections apply these ideas to link certified regression and certified classification.
Formally, let V be a multiset of cardinality T := |V| .
Denote the subset of elements in V that are at most ξ as
V l := { ν t ∈ V : ν t ≤ ξ } and denote its complement V u :=
V \ V l .
Below we define three different paradigms that constrain how V is modified.
Figure 1 visualizes our first two unweighted paradigms.
Note that Fig.
1’s values are repeatedly used throughout this paper, including in Fig.
2 for our third median perturbation paradigm and later in Figs.
4 and 5.
In all cases below, consider when med V ≤ ξ since the degenerate case of med V > ξ is by definition non-robust.
A. Unweighted Swap Paradigm
Here, set V has fixed, odd-valued 3 cardinality T .
All modifications to V take the form of “swaps” where a single value in V is replaced with any real number.
Fig.
1b visualizes the unweighted swap paradigm on a simple set V = { 2 , . .
. , 6 } of
T = 5 values.
Lemma 3 tightly bounds the number of arbitrary swaps R that can be made to V without perturbing its median.
Lemma 3.
For ξ ∈ R , real multiset V where med V ≤ ξ with
T := |V| odd, and V l := { ν t ∈ V : ν t ≤ ξ } , let (cid:101)
V be a multiset formed from V where elements have been arbitrarily replaced.
If the number of elements replaced in (cid:101) V does not exceed
[Equation]
it is guaranteed that med (cid:101) V ≤ ξ .
Proof sketch.
For a set of odd cardinality T , the median is always the set’s (cid:6) T 2 (cid:7) -th largest value.
For V ’s median to be at most ξ , at least (cid:6) T 2 (cid:7) items in V cannot exceed ξ .
Each swap reduces the number of elements not exceeding ξ by at most one.
If there are |V l | elements less than or equal to ξ in V and there must be at least (cid:6) T 2 (cid:7) such elements to avoid perturbing the median, then at most |V l
| − (cid:6) T 2 (cid:7) swaps can be performed.
B. Insertion/Deletion Paradigm
For the second paradigm, V is no longer fixed cardinality (it may expand or contract), and T may be even or odd.
Each modification of V takes the form of either a single deletion or insertion but not both.
Figs. 1c and 1d visualize median perturbation under insertions and deletions resp.
with certified robustness R following Lem. 4.
Suppl.
Sec.
B proves that worst-case insertions and deletions perturb a set’s median in exactly the same way and thus are interchangeable.
That is why Figs.
1c and 1d have identical certified robustness ( R = 2 ).
∞ ∞ V :
Initial Median ξ
[Figure]
∞
[Figure]
∞
[Figure]
∞ ∞
[Figure] [Figure]
would
Lemma 4.
For ξ ∈ R and real multiset V where med V ≤ ξ , define T := |V| and V l := { ν t ∈ V : ν t ≤ ξ } .
Let (cid:101) V be any multiset formed from V where elements have been arbitrarily deleted and/or inserted.
Then, if the total number of inserted and deleted elements in (cid:101) V does not exceed
[Equation]
it is guaranteed that med (cid:101) V ≤ ξ .
Eq.
(2)’s bound may be non-tight by 1.
We did this for consistency with other ideas.
See suppl.
Sec.
G-A for details.
Comparing Eqs.
the insertion/deletion paradigm’s robustness R is about twice that of the unweighted swap paradigm.
Intuitively, this is because one swap entails two separate operations – both an insertion and a deletion.
C. Weighted Swap Paradigm
The two median-perturbation paradigms above assume that each modification to V has equivalent cost.
Consider a generalized swap paradigm where each value ν t ∈ V has an associated weight/cost r t ∈ N .
We seek to tightly bound the budget an attacker could spend with it remaining guaranteed that f ( x te ) ≤ ξ ; we still denote this budget R .
Given V l as above, R l := { r t : ν t ∈ V l } contains V l ’s corresponding weights/costs.
Define ∆ : =
|V l | − (cid:6) T 2 (cid:7) , and let multiset R ∆ be the ∆ smallest values in R l (i.e., |R ∆ | = ∆ ).
Directly applying Lem.
3, an obvious but non-optimal bound is
[Equation]
∞ ∞
[Figure]
[Figure] [Figure]
that is impossible to perturb the median and any additional weight would be sufficient to swap out =
Recall Fig.
1a where V = { 2 , . .
. , 6 } and ξ = 5 . 4 .
Consider its weighted extension where for simplicity and w.l.o.g.
R = { 3 , . . .
, 7 } , i.e., ∀ t r t = ν t + 1 .
Eq.
(4) certifies robustness
R = 3 for this example.
However, Fig.
2b shows R = 6 since the budget of the second (i.e., (∆ + 1) -th) largest value in R l can be partially used.
Lemma 5 formalizes this insight into a tight bound for median perturbation under weighted swaps.
Lemma 5.
For ξ ∈ R and real multiset V where med V ≤ ξ , let R be V ’s corresponding integral weight multiset where
T := |V| = |R| is fixed and odd.
Define R l := { r t ∈ R : ν t ≤ ξ } , and let (cid:101) R l be the smallest ( |V| − (cid:6) T 2 (cid:7) + 1) values in R l .
Then the cost to perturb V ’s median exceeds
[Equation]
V. R EDUCING R EGRESSION TO V OTING -B ASED B INARY C LASSIFICATION
We now show how methods used to certify binary classification can be adapted to certify regression.
During inference, all voting-based certified methods (both classifiers and regressors) follow the same basic procedure.
First, the model generates a multiset of votes, which for binary classification we denote V ± 1 .
Certified classifiers only differ in how V ± 1 is constructed and in the consequences that construction has on certifying R .
For example, V ± 1 could be a k NN neighborhood or the submodel predictions in an ensemble.
Nonetheless, for binary classification, V ± 1 contains at most two unique values ( +1 and − 1 ), meaning V ± 1 ’s majority label is also its median.
In other words, f ( x te ) = med V ± 1 .
To certify robustness R , existing methods rely on a function we term the robustness certifier .
The function’s inputs are votes V ± 1 and optionally weights/costs R .
Implicitly, the certifier knows how the votes were generated and how changes to training set S could affect V ± 1 .
Generally, a simple
[Figure]
Inputs
Outputs
Regressor regres sion binarizes V
V which is used by the robustness certifier (optionally with weights R ) to determine R .
procedure to construct V ± 1 entails a simple certifier, and complex construction implies a complex certifier.
Fundamentally, for voting-based, binary classification, robustness certification always reduces to the same core idea.
If f ( x te )
= med V ± 1 , then for the runner-up label to overtake the majority label, V ± 1 ’s median must be perturbed.
Therefore, certifying voting-based, binary classification is simply certifying median perturbation .
To generalize a voting-based, certified classifier to certify regression, two primary modifications are required; we visualize our regression to classification reduction in Fig.
First, the model is modified from generating binary votes V ± 1 to generating real-valued ones denoted V .
The changes necessary to make this switch are specific to the underlying certified classifier.
In some cases, no change is required [24]; for others, ensemble submodel classifiers are simply replaced with submodel regressors [25, 26].
The second modification is more subtle.
If V is real-valued, a robustness certifier expecting binary votes cannot be directly applied.
That is where ξ ∈ R fits in; it partitions V into two subsets: V l containing all “votes” at most ξ and V u containing all “votes” exceeding ξ .
We can think of these subsets as two different classes where if f ( x te ) ≤ ξ , V l is the majority class and V u runner-up.
For any prediction f ( x te ) := med V , the robustness certifier’s output R equals the number of trainingset modifications that can be made without ever perturbing med V beyond ξ .
Lemma 6 formalizes the connection between real-valued and binarized robustness.
This symmetry in robustness derives from both tasks’ (implicit) shared reliance on median.
Lemma 6.
For ξ ′ ∈ R and real multiset V ′ where med V ′ ≤ ξ ′ , let V ± 1 := { sgn ( ν t − ξ ′ ) :
ν t ∈ V ′ } .
Let R be the corresponding integral weight multiset of V ′ where |V ′ |
=
|R| .
Then, under the (un)weighted swap and insertion/deletion paradigms, both
V = V ′ with ξ = ξ ′ and V = V ± 1 with ξ = 0 have equivalent robustness R .
By binarizing V , Lem.
6 enables us to directly reuse robustness certifiers from binary classification to certify regression .
Our reduction to certified classification entails two primary benefits.
First, it allows us to repurpose for regression the diverse set of voting-based, certified classifiers that already exist [24, 25, 26].
Moreover, as new voting-based, certified classifiers are proposed in the future, these yet undiscovered methods can also be reformulated as certified regressors.
As mentioned above, the procedure to construct the set of votes and to certify robustness is unique to each classifier.
The next three sections describe how to certify regression using progressively more complex models, with each method based on a reduction to an existing voting-based certified classifier.
VI. C ERTIFIED I NSTANCE -B ASED R EGRESSION
For the first method, recall from Sec.
III that Jia et al.
[24] propose a state-of-the-art certified classifier based on k NN.
Nearest-neighbor methods are a specific type of instancebased learner (IBL), where predictions are made using memorized training instances [42].
IBLs generally rely on the intuition that instances close together in feature space ( X ) have similar target values ( Y ).
Specifically, IBLs search for stored training instances most similar to x te and derive the model prediction from these retrieved neighbors .
We partition IBLs into two subcategories:
• Fixed-population neighborhood methods specify the exact number of “neighbors” when making a prediction.
• Region-based neighborhood methods define a neighborhood as all training instances in a specific feature-space region.
These
two
subcategories calculate certified robustness differently
and are discussed separately below.
All IBLs considered here use the same decision rule.
Formally, given x te ∈ X and real multiset neighborhood N ( x te ) returned by the IBL, the model’s prediction is the neighborhood’s median, i.e., f ( x te ) :
= med N ( x te ) .
Recall that our goal is to certify that if at most R arbitrary insertions or deletions are made to S , it is guaranteed that f ( x te ) ≤ ξ .
A. Fixed-Population Neighborhood
As the name indicates, fixed-population neighborhood IBLs make predictions using a fixed number of training instances, i.e., ∀ x te T
= |N
( x te ) | .
k -nearest neighbors is perhaps the bestknown fixed-population method.
Traditionally, k NN returns the neighborhood’s mean value.
For clarity, we will refer to the version of k NN that uses the neighborhood’s median value as k -Nearest Neighbors Median , or simply k NN-m.
Our threat model allows the adversary to insert arbitrary training instances and/or delete any existing instances.
Fig.
4b visualizes an example attack on a k NN-m regressor.
Since k is fixed, inserting a new instance ( ) into the neighborhood causes one neighborhood instance to be ejected; in other words, insertions are simply instance swaps.
As a worst-case, we assume that the ejected element equals at most threshold ξ , meaning each insertion always maximally increases the neighborhood’s median.
Under this simplifying assumption, adversarial insertions are always at least as harmful as deletions for fixed-population neighborhood IBLs.
Neighborhood size k is a user-specified hyperparameter so let k be odd-valued.
Therefore, these fixed-population neighborhood IBL regressors satisfy all of the criteria of
[Figure] [Figure]
4 ∞
[Figure] [Figure]
∞ ∞
[Figure]
median perturbation under the unweighted swap paradigm where T = k .
Theorem 7 then follows directly from Lemma 3.
Theorem 7.
Let f be an instance-based regressor trained on set S .
Given ξ ∈ R and x te ∈ X , let real multiset N ( x te ) be x te ’s neighborhood under f with fixed, odd-valued cardinality T :
= |N ( x te ) | .
Define V l := { y ∈ N ( x te ) :
y ≤ ξ } .
Given f ( x te ) :
= med N ( x te ) ≤ ξ , then if model f is trained on a modified S where the total number of inserted and deleted training instances does not exceed
[Equation]
it is guaranteed that f ( x te ) ≤ ξ .
We denote k NN -m certified regression as k NN-CR.
Due to space, we defer to suppl.
Sec.
D the proof that when under binary classification, k NN-CR and Jia et al.’s
[24] k NN classifier yield identical robustness guarantees.
B. Region-Based Neighborhood
Neighborhood membership does not need to be tied to the number of neighbors.
Rather, a neighborhood can be defined by specific criteria, with all stored training instances satisfying those criteria included in the neighborhood.
For instance, radius nearest neighbors ( r NN) defines x te ’s neighborhood as all training instances within a given distance of x te [43].
Alternatively, fully-random decision trees recursively partition the feature space into disjoint regions, and a neighborhood is defined as all instances within the same feature region [44].
Fig.
4c visualizes an attack on an r NN-median learner, where the adversary inserts malicious instances ( ) to perturb the median prediction.
Unlike fixed-population neighborhoods, the inserted instances do not cause any existing training instances to be ejected.
Rather, inserting and deleting training instances are distinct operations.
It is easy to see that region-based IBLs with median as the decision operator follow Sec.
IV-B’s insertion/deletion paradigm.
Theorem 8 then follows directly from Lemma 4.
Theorem 8.
Let f be an instance-based regressor trained on S that partitions X into disjoint regions.
Given x te ∈ X , let real multiset N ( x te ) be x te ’s neighborhood under f where
T :=
|N ( x te ) | .
For ξ ∈ R , define V l := { y ∈ N ( x te ) :
y ≤ ξ } .
If model f is trained on a modified S where the total number of inserted and deleted training instances does not exceed
R =
|V l | − T − 1 , (
[Equation]
) it is guaranteed that f ( x te ) ≤ ξ .
Jia et al.
propose an r NN-based certified classifier, with the robustness certifier identical to their k NN method.
By using our insertion/deletion paradigm for the robustness certifier instead of Jia et al.’s approach, Eq.
(7)’s R roughly doubles.
C. Computational Complexity
Eqs.
(6) and (7) require determining V l ’s cardinality, which has complexity O ( T ) .
However, constructing neighborhood N ( x te ) can require scanning the entire training set and has complexity O ( n ) .
Therefore, certifying each IBL regression prediction’s robustness is in O ( n ) – the same as Jia et al.’s
certified k NN and r NN classifiers.
VII. C ERTIFIED R EGRESSION FOR G ENERAL M ODELS
Instance-based learners lend themselves to robustness certification.
However, there are many applications where IBLs perform poorly.
This section explores reducing certified regression to a second certified classifier, which will now allow us to use whichever model architecture has the best performance.
Recall that Levine and Feizi’s [25] certified classifier, DPA, uses an ensemble trained on partitioned training data.
In this section, we first reduce certified regression to certified classification using DPA.
We then improve the certification performance of DPA and by extension our certified regressor by using tighter, weighted analysis.
All certified regression ensembles we consider have T submodels denoted f 1 , . . .
, f T , and the ensemble decision function uses median, i.e., f ( x te ) :
= med { f 1 ( x te ) , . .
, f T ( x te ) } .
Since ensemble size T is always a user-specified hyperparameter, select odd T .
For arbitrary x te ∈ X , let
V :=
{ f t ( x te ) : t ∈ [ T ] } .
Our goal remains to determine R – a pointwise guarantee on the total number of training-set modifications where it remains guaranteed that f ( x te ) ≤ ξ .
A. Partitioned Certified Regression
Here, the T submodel regressors are fully-independent , meaning their training sets are disjoint, and each submodel prediction provides no direct insight into any other submodel’s behavior.
This simple framework makes no assumptions about the submodel architecture ; the submodels may be non-parametric or parametric, deep or shallow, etc.
The only requirement is that each submodel returns a deterministic prediction given its training set and feature vector x te .
Levine and Feizi enforce disjoint submodel training sets by using deterministic function h tr to partition training set S into T disjoint blocks, S (1) , . . .
, S ( T ) .
Formally, for all t ∈ [ T ] , submodel f t ’s training set is D t = S ( t ) .
Since each training instance is assigned to exactly one submodel, any training-set modification can only affect one submodel.
Under the unit-cost assumption (Def. 1), each trainingset modification changes the corresponding submodel’s prediction from f t ( x te ) to ∞ in the worst case.
Thus, perturbing a partitioned ensemble’s median prediction follows Sec.
IV-A’s unweighted swap paradigm where, as explained above, each perturbed submodel entails one training-set modification .
Via reduction to DPA, Theorem 9 directly applies Lemmato certify unit-cost, partitioned regression’s robustness under arbitrary training-set insertions and deletions.
Theorem 9.
For x te ∈ X , ξ ∈ R , and deterministic function h tr that partitions set S into disjoint blocks S (1) , . . .
, S ( T ) , let f be an ensemble of T submodels where T is odd, and each deterministic submodel f t is trained on block S ( t ) .
Define V l :=
{ f t ( x te ) :
f t ( x te ) ≤ ξ } .
Given f ( x te ) :
= med { f 1 ( x te ) , . .
, f T ( x te ) } ≤ ξ , if model f is trained on a modified S where the total number of inserted and deleted training instances does not exceed
[Equation]
it is guaranteed that f ( x te ) ≤ ξ .
We denote this disjoint ensemble regressor as partitioned certified regression (PCR).
Suppl.
Sec.
E proves that when regression is used for binary classification, PCR and DPA yield identical robustness guarantees ( R ).
B. Weighted Partitioned Certified Regression
Levine and Feizi only consider the maximally pessimistic unit-cost assumption.
For a feature vector x te , it may take multiple training set insertions/deletions to corrupt a submodel’s prediction.
For example, Theorems 7 and 8 prove that IBL predictions are robust to multiple training-set modifications.
Fixing the regressor’s overall architecture, one obvious way to improve certified robustness R is to improve the robustness certifier.
Below, we introduce tighter analysis of each PCR submodel’s pointwise robustness so as to move beyond unit cost.
Let r t ∈
N
denote the minimum number of insertions/deletions required to change 4 the submodel enough where f t ( x te ) > ξ .
By definition, if f t ( x te ) > ξ without any training-set modifications, r t = 0 .
When ∃ t r t > 1 , better certified guarantees are possible through a weighted framework.
Theorem 10 directly applies Lemma 5’s weighted swap paradigm to adapt PCR (and DPA) to weighted perturbation costs.
We denote this extension weighted partitioned certified regression (W-PCR).
Theorem 10.
For x te ∈ X , ξ ∈ R , and function h tr that partitions set S into disjoint blocks S (1) , . . .
, S ( T ) , let f be an ensemble of T submodels where T is odd.
Each deterministic submodel f t is trained on block S ( t ) and requires at least r t ∈ Z + modifications to S ( t ) for f t ( x te ) > ξ .
For
R :=
{ r t : f t ( x te ) ≤ ξ } , let (cid:101)
R l be R ’s smallest |R| − (cid:6) T 2 (cid:7) +values.
Given
[Equation]
if model f is trained on a modified S where the total number of inserted and deleted training instances does not exceed
[Equation]
(9) it is guaranteed that f ( x te ) ≤ ξ .
It can be easily shown that W-PCR always yields certified robustness at least as good as PCR.
Although proposed in the context of regression, our weighted formulation also notably improves certified classification as shown in Sec.
X-B.
C. Computational Complexity
Both PCR and W-PCR require training O ( T ) models.
As established by Lemmas 3 and 5, the computational complexity of PCR and W-PCR (resp.) to certify each ensemble prediction is O ( T ) [27] – the same complexity as DPA.
VIII. C ERTIFIED R EGRESSION U SING O VERLAPPING T RAINING D ATA
This section reduces certified regression to a third certified classifier, specifically Wang et al.
’s
[26] reformulation of DPA where the submodels are trained on overlapping data.
This makes the submodels interdependent, meaning one training-set modification may alter multiple submodel predictions.
Fig.visualizes an ensemble trained on overlapping training sets.
Again, T is the number of submodels.
6 Function h tr : Z → [ m ] still partitions the instance space into m disjoint blocks, where m ≥ T .
Following Wang et al., a second deterministic function h f : [ m ] → 2 [ T ] maps each training-set block to one or more submodel training sets.
Formally, submodel f t ’s training set is D t := (cid:70) t ∈
h f ( j ) S ( j ) .
Let d ( j ) :=
| h f ( j ) | denote S ( j ) ’s spread degree , i.e., the number of models that use S ( j ) during training.
Denote the maximum spread degree as d max := max { d (1) , . . .
, d ( m ) } .
The ensemble’s decision function is still the median submodel prediction.
Below, we first consider certified regression on overlapping data under the unit-cost assumption.
We then improve overlapping regression by leveraging our weighted reformulation.
A. Overlapping Certified Regression
Irrespective of whether the submodels are trained on disjoint or overlapping data, under the unit-cost assumption, at least |V l | −
[Equation]
T 2 (cid:7) submodel predictions must exceed ξ to perturb the ensemble’s median.
Observe that each submodel training set D t ⊂ S is composed of one or more dataset blocks.
Perturbing any block in D t is sufficient to perturb the submodel’s prediction, with an optimal attacker minimizing the number of training-set (block) modifications .
S ( 6 )
S ( 5 )
S ( 7 )
S ( 1 )
S ( 5 )
S ( 4 )
S ( 6 )
S ( 3 )
S ( 4 )
S ( 2 )
SubmodelTrainingSets
S ( 7 )
S ( 6 )
S ( 5 )
S ( 4 )
S ( 3 )
S ( 2 )
S ( 1 )
Training set S partitioned by h tr
Block Mapping by h f fffff
T = 5 Submodels
SubmodelPredictions
Threshold ξ
InitialMedian
The
If the goal were to perturb all T submodels, then for arbitrary block mapping function h f , determining the minimum number of blocks that need to be modified reduces to minimum set cover , which is NP-hard [46].
Specifically, the set to cover is T l := { t : f t ( x te ) ≤ ξ } , i.e., the submodels predicting at most ξ , and the collection of subsets is
S :=
(cid:8) { j : t ∈
h f ( j ) } : f t ( x te ) ≤ ξ (cid:9) , which contains the dataset blocks each relevant submodel is trained on.
However, recall that for median perturbation under unweighted swaps, we only need to perturb (i.e., cover)
|V l | − (cid:6) T 2 (cid:7) submodels – not all of them.
Therefore, rather than mapping to set cover, our problem reduces to the related problem of partial set cover , where only a constant fraction of the instances (i.e., submodels) need to be covered.
For arbitrary block mapping function h f , Lemma 11 below establishes that finding the optimal R here is NP-hard [47, 48].
Lemma 11.
Finding optimal certified robustness R for overlapping certified regression is NP-hard.
Although our problem is NP-hard, it is polynomial-time approximable.
Specifically, the approximation uses the famous greedy set-cover algorithm where in each iteration, the subset (training block S ( j ) ) covering the most remaining elements (submodels) is selected [47, 49].
Let G denote the bound found by this greedy method, and define ∆ :=
|V l | − (cid:6) T 2 (cid:7) .
Then for the non-naive case where ∆ ≥ 2 ,
[Equation]
where H ( d max ) is the d max -th harmonic number.
This bound follows directly from partial set cover approximation factor analysis [46, Thm. 4; 47, Thm. 3].
7 Slav ´ ık [46] shows that the difference between this approximation factor’s overall lower and upper bound is only roughly 1.1, meaning this general approximation is quite good overall.
However, in most cases, the performance advantage of overlapping versus disjoint unit-cost regressors is small enough that the greedy optimality gap wipes out all gains.
Instead, we rely on Fig.
6’s integer linear program (ILP) to bound R in the overlapping case.
This ILP is directly adapted from standard partial set-cover, where for unit costs ∀ t r t = 1 .
While the ILP is still NP-hard in the worst case, modern LP solvers often find a (near) optimal solution in reasonable time (e.g., a few seconds)
In cases where finding true robustness R is computationally expensive, these solvers generally return guaranteed bounds on R that are (much) better than the greedy approximation [53].
9 We refer to this unit-cost, ILPbased approach as overlapping certified regression (OCR).
B. Weighted Overlapping Certified Regression
Recall that Sec.
VII-B improves certified regressor PCR by reformulating DPA so as not to be restricted by the unit-cost assumption.
Here, we follow the same approach of improving certified regressor OCR by generalizing Wang et al.’s
[26] certified classifier to non-unit costs.
As with W-PCR earlier, r t > 1 entails that submodel f t ’s training set must be modified at least r t times for f t ( x te ) > ξ .
This prevents weighted overlapping regression from applying partial set cover since each submodel f t now has a coverage requirement.
Instead, partial set multicover (PSMC) min R = m (cid:88)
j = ω ( j ) − σ (12a) s .
t .
T l = { t : f t ( x te ) ≤ ξ } , (12b) r max = max { r t : t ∈ [ T ] } (12c) σ = 1 [ r max > 1] (12d) (cid:88) t ∈T l δ t ≥ |V l | − (cid:24) T 2 (cid:25) + σ, (Median perturb.) (12e) r t δ t ≤ (cid:88)
S ( j ) ⊆D t ω ( j ) , t ∈ T l (12f)
δ t ∈ { 0 , 1 } , t ∈ T l (12g) ω
( j ) ∈ { 0 , . . .
, r max } , j ∈ [ m ] (12h) ω ( j ) contains made generalizes partial set cover to support coverage requirements r t ≥
and we adapt PSMC to weighted, overlapping regression.
Note that PSMC, and by extension our task, is provably hard as formalized below.
Corollary 12.
Finding the optimal certified robustness R for weighted overlapping certified regression is NP-hard.
PSMC is far less studied than (partial) set cover.
PSMC is polynomial-time approximable – albeit with worse known bounds than partial set cover.
Ran et al.
[45] provide the bestknown PSMC bounds; their method is much more complicated than greedy partial set cover and relies on a reduction to another NP-hard problem, minimum densest subcollection.
Let
G be the solution generated by Ran et al.
’s
algorithm, then
[Equation]
Like with unweighted overlapping regression, Eq.
(11)’s approximation factor is large enough that it usually wipes out the performance gains derived from weighted costs.
Instead, we use Fig.
6’s ILP to bound R in accordance with Lem.
In the ILP, σ = 1 in the weighted case and 0 otherwise.
Hence, at least ( |V l | − (cid:6) T 2 (cid:7) + 1) submodels must be covered (i.e., perturbed) in the weighted case.
Following Eq.
(5), sum (cid:80) mj
=1 ω ( j ) is decremented by one in the ILP.
We refer to this overlapping ILP-based approach as weighted overlapping certified regression (W-OCR).
C. Computational Cost
See suppl.
Sec.
I-E for an empirical evaluation and extended discussion of the OCR & W-OCR ILP execution time.
The preceding sections describe the benefits of having more robust ensemble components (i.e., r t > 1 ) but do not address how to find r t .
Apart from IBLs and ensembles, the two methods we focus on in this work, we know of no general method for computing insertion/deletion robustness efficiently.
We attribute this scarcity to the task’s difficulty.
Nonetheless, we believe this work shows that certification beyond unit cost merits future study.
Here we explore certifying beyond unit cost from two perspectives.
First, we explore the obvious idea of combining IBLs with ensembles and explain why that performs poorly.
Next, we propose a simple, general approach to certify any (sub)model beyond unit cost, albeit with a (slightly) more restricted threat model.
A. Combining Instance-Based Learners & Ensembles
The points raised below apply to both fixed-population and region-based IBLs.
We exclusively discuss k NN-CR here with the extension to other certified IBLs straightforward.
In practice, function h tr partitions instance space
Z uniformly at random (u.a.r.) into m approximately equal-sized regions.
For simplicity and w.l.o.g., consider an ensemble of k NN-CR submodels trained on disjoint subsets where T = m .
Let k ′ and R denote the neighborhood size and certified robustness (resp.)
of a k NN-CR model trained on i.i.d.
training set S .
If S is partitioned u.a.r. to train T k NN-CR submodels each with k ≈ k ′ T , then each submodel’s expected robustness is roughly RT .
In the best case for the defender ( ∀ t f t ( x te ) ≤ ξ ), an adversary only needs to perturb at most (cid:6) T 2 (cid:7) submodels.
Combining the above with Theorem 10 for W-PCR, this k NN-CR ensemble’s expected certified robustness is approximately
[Equation]
As n, T → ∞ , then by Eq.
(13), a k NN-CR ensemble’s expected robustness decreases by 50% versus the single k NN - CR model baseline .
Intuitively, for ensembles, an adversary only needs to directly attack about half of the submodels and by extension half of the training data.
In contrast, when there is only a single k NN-CR model trained on all of S , the adversary must attack the whole training set.
B. Certifying Non-Unit Costs by Construction
Since IBLs are a poor candidate to marry with ensembles, we need an alternative approach to certify a model’s robustness beyond r = 1 .
Given the dearth of existing methods (known to us), we fill in the gap and propose a simple, general-purpose method to certify robustness against arbitrary deletions .
To be clear, this is a (slightly) restricted version of the full threat model considered so far, which allows arbitrary insertions and deletions.
Nonetheless, this restricted threat model still has broad applicability.
For example, an adversary may only be able to insert poisoned instances into a training set but not delete clean ones [2, 3, 5, 12, 19].
Motivated by Cook and Weisberg’s [55] classic case deletion diagnostics , we use a constructive proof to certify a
(sub)model’s pointwise robustness under instance deletions.
Consider training ( n + 1) deterministic models – one model using full set S
= { ( x i ,y i ) } ni =1 and another n models on each of the leave-one-out subsets S \ ( x i ,y i ) for all i ∈ [ n ] .
If all ( n + 1) trained models make the same prediction (e.g., a value not exceeding ξ for some x te ), then by construction, the model trained on all of S has, at minimum, r = 2 for arbitrary deletions.
Lemma 13 generalizes the above for an arbitrary number of deletions r < n .
Lemma 13.
For x te ∈ X , training set S where 2 S is its power set, r ∈ [ |S| − 1] , and ξ ∈ R , denote a deterministic model trained on subset S ⊆ S as f S .
Given ∀ S ′ ∈ 2 S | S ′ | < r = ⇒ f
S\ S ′ ( x te ) ≤ ξ , then for any (cid:101) S ⊂ S , if f (cid:101) S ( x te ) > ξ then at least r instances from S were deleted in (cid:101) S .
A strength of Lemma 13 is its flexibility; it can be adapted to any model class, including both classifiers and regressors.
Its clear limitation is its computational complexity.
Computational Complexity : Certifying r > 1 requires training
O ( n ( r − 1) ) models; this is a one-time, amortized cost.
Consider separately the cost to certify each prediction.
During inference, the O ( n ( r − 1) ) models are checked.
While this may be problematic in some cases, it should be contextualized.
Recall that Sec.
VI explores IBLs like k NN, which have inference complexity O ( n ) .
Therefore, our method to certify r = 2 has the same time complexity during inference as k NN.
C. More Submodels vs. Weighted Costs
Increasing submodel count T and using weighted costs are partially conflicting approaches to increase R .
A natural question is which of the two approaches yields better certified robustness.
Above, we explain why increasing T is a poor strategy for IBLs.
For ensembles, increasing T generally means that each submodel is trained on fewer data.
As an intuition, consider when ∀ t r t = 2 .
For a unit-cost ensemble to certify equivalent R , submodel count T must about double, and each submodel is trained on 50% fewer data, which can significantly degrade submodel performance.
In contrast, weighted costs with r = 2 reduces submodel trainingset sizes by 1 (Lem. 13).
By training weighted submodels on much more data, weighted submodels can outperform submodels from ensembles with larger T .
This improved submodel performance can in turn improve certified robustness.
X. E VALUATION
This section evaluates our five primary certified regressors: k NN-m certified regression ( k NN-CR), 10 partitioned certified regressors PCR & W-PCR as well as overlapping certified regressors OCR & W-OCR.
Additional experimental results are in the supplement, including full k NN-CR certification plots (I-B), alternate ξ value analysis (I-C), model training times (I-D), ILP execution time (I-D), etc.
To the extent of our knowledge, we propose the first pointwise certified regression methods that make no assumptions about the test distribution or model architecture.
Without a clear baseline, we compare our five methods against each other.
As a reference on the clean-data performance, we report each dataset’s “uncertified” (non-robust) accuracy.
A. Experimental Setup
Due to space, most evaluation setup details (e.g., hyperparameters) are deferred to suppl.
Sec.
H with a brief summary below.
For each experiment in this section, at least ten trials were performed.
To improve readability, we only report the mean values below with variances in suppl.
Sec.
I-A.
Dataset Configuration Each (sub)model is trained on 1 q -th of the training data, where q ∈ Z > 0 .
For k NN-CR, always q = 1 .
For our four ensemble-based methods (W-)PCR and (W-)OCR, q can significantly affect the ensemble’s accuracy and best-case certified robustness ( R ).
As such, for each dataset, we report results with three different q values.
For all ensembles, function h tr partitions training set S u.a.r.
For our partitioned regressors (W-)PCR, S is split into q blocks, with T = q .
For our overlapping regressors (W-)OCR, we followed Wang et al.’s
[26] overlapping certified classifier evaluation.
Specifically, S is partitioned into qd blocks u.a.r.
All blocks have fixed spread degree d > 1 (see
Tab. I), and h f assigns blocks to submodels at random.
Hence, each overlapping ensemble necessarily has T = qd submodels.
Submodel Architectures To demonstrate their generality, our ensemble methods use two different submodel architectures, namely ridge regression and XGBoost [21] gradient-boosted forests.
Model determinism is enforced via a fixed random seed.
Below, we report whichever submodel architecture performed the best on a held-out validation set.
Evaluation Metric
For each test instance ( x te ,y te ) , our goal is to determine the largest pointwise certified robustness R that guarantees ξ l ≤ f ( x te ) ≤ ξ u .
Throughout this evaluation, ξ l := y te − ξ and ξ u :=
y te + ξ .
These bounds are w.r.t.
each test example’s true target value y te , not predicted value f ( x te ) .
Therefore, a large certified robustness R means that the prediction is both accurate and stable .
Here, error threshold ξ may be a specific fraction (e.g., 15%) of each instance’s target value y te or a fixed value for the entire dataset (see Table I).
In practice, the appropriate ξ value is application specific.
Our evaluation metric is certified accuracy , which is the fraction of instances with robustness R ≥ ψ for ψ ∈ N .
In each trial, we calculated the certified robustness ( R ) for at least 100 random test instances and report the mean certified accuracy across all trials.
See suppl.
Sec.
I-A for the certified accuracy variance.
Note that existing certified classifiers were previously evaluated using certified accuracy [24, 25, 26] with ξ = 0 , i.e., the predicted label must match true label y te .
Datasets Our certified regressors are evaluated on six datasets: five regression and one binary classification.
Like previous
[Table]
Error thresholds that are a percentage of each instance’s true target value are denoted X
% · y .
Alternate ξ values are evaluated in suppl.
Sec.
I-C.
[Table]
work [39], the datasets are preprocessed where all categorical features are transformed into one-hot encodings.
Table I summarizes each dataset’s key attributes, including its size, error threshold ( ξ ), ensemble submodel architecture, etc.
A brief description of each dataset is below.
Ames [56] and Austin [57] estimate home prices in two
American cities.
Diamonds [58] predicts a diamond’s price based on attributes such as cut, color, carat, etc.
Weather [59] estimates ground temperature (in degrees Celsius) using date, time, and longitude/latitude information.
For computational efficiency, Weather’s size was downsampled by 10 × u.a.r.
Life [60] estimates life expectancy (in years) using epidemiological and other national statistics.
Spambase [61] is a binary classification dataset where emails are labeled as either spam or ham.
Spambase’s positive training prior is 39%.
Certifying r >
For our two weighted methods, W-PCR and
W-OCR, our evaluation attempts to certify each submodel’s robustness against deletions up to r = 2 .
B. Analyzing the Certified Accuracy
Figure 7 visualizes our methods’ mean certified accuracy for the six datasets.
Due to space, the corresponding numerical values, including variance, appear in Sec.
I-A. Below, we briefly summarize the experiments’ primary takeaways.
Takeaway #1 : Both our ensemble and IBL regressors certify non-trivial fractions of the training set.
For the Ames and
Life datasets, W-OCR certifies 50% of test predictions up to 1% training-set corruption.
Similarly, k NN-CR certifies 30% of predictions on Ames up to 4% corruption.
These certified guarantees are without explicit assumptions about the data distribution or, in the case of ensembles, the submodel’s architecture.
For other datasets, we certify predictions up to hundreds or thousands of training-set modifications.
Takeaway #2 : Ensemble regressors have better peak performance.
Across all six datasets, the ensemble-based methods all had better peak certified accuracy than k NN-CR.
The performance gap was as large as 3.5 × and is not primarily due to feature dimension as k NN-CR performed worst on
Diamonds, which has the smallest dimension by far.
Takeaway #3 : W - OCR achieves the largest certified robustness ( R ) amongst the ensemble methods.
This is observed using each dataset’s largest q value.
For all six datasets, there is a (significant) gap between W-OCR ( ) and our secondbest ensemble method, W-PCR ( ).
Takeaway #4 : k NN - CR achieves the largest certified robustness.
Although k NN-CR certifies (far) fewer instances than the ensembles, for instances that it can certify, its maximum robustness R is generally far larger than that of W-OCR.
For example with Weather, k NN-CR’s maximum R is 5 × larger than W-OCR’s.
Suppl.
Sec.
I-B best visualizes this trend in its plots of k NN-CR’s full certified accuracy.
Takeaway #5 : W - OCR achieves state-of-the-art certified accuracy for binary classification.
While regression is this work’s primary focus, recall that binary classification can be solved by a regressor.
For binary classification, k NN-CR’s R is identical to Jia et al.’s
[24] k NN classifier; PCR certifies equivalent robustness as DPA, and OCR very closely approximates Wang et al.
’s
[26] overlapping method.
Observe that
W-OCR outperforms the unweighted ensembles and k NN-CR on Spambase’s [61] two largest q values.
Note that Spambase’s maximum q value cannot be increased further without severely degrading submodel performance.
This provides empirical evidence for Sec.
IX-C’s claim that a weighted strategy can outperform increasing submodel count T .
Takeaway #6 : q can significantly affect certified accuracy.
Previous certified classifier evaluations [24, 25, 26] underexplore q ’s role.
Those works primarily evaluate vision datasets where the training data is supplemented by (1) using a pre-trained model to extract much better features [24, 41] or (2) using vision data augmentation [25, 26].
For the tabular datasets evaluated here, such options are not as available.
Without such augmentation, increasing q can significantly degrade an ensemble’s peak certified accuracy.
As an example, the ensembles’ peak certified accuracy can decline by up to 28% between training a model on all of S versus a dataset’s maximum q value (compare to uncertified accuracy in
Fig. 7).
Therefore, when thinking about certified classifiers and regressors, always consider the potential benefits of external (clean) data augmentation.
For instance, in our experiments,
XGBoost certified ensembles’ accuracy improved by multiple percent when using mixup data augmentation [62].
XI. C ONCLUSIONS
This paper describes a novel reduction from certified regression to certified classification based on median perturbation.
Applying this reduction, we propose six new certified regressors that require no assumptions about the data distribution or model architecture.
As improved voting-based, certified classifiers are proposed in the future, our reduction can be applied to those methods too.
This enables certified regression to keep pace with the rapid advances in certified classification.
Lastly, our empirical results show that improved certified guarantees are possible when the unit-cost assumption is replaced by our tighter weighted analysis.
These certification gains apply to both classification and regression, but
Sec.
IX-B’s approach is computationally expensive.
We advocate for better methods that efficiently certify beyond r = 1 .
Uncertified ( q = 1 )
PCR (ours)
OCR (ours)
W-PCR (ours)
W-OCR (ours) k NN-CR (ours)
[Figure]
Robustness ( R )
[Figure]
A m e s
H o u s i n g
C e r ti fi e d A cc .
[Figure]
Certified Robustness ( R ), q =
A u s t i n
H o u s i n g
C e r ti fi e d A cc .
[Figure]
[Figure] [Figure]
D i a m o nd s
C e r ti fi e d A cc .
[Figure]
Robustness ( R )
[Figure]
W e a t
h
er
C e r ti fi e d A cc .
[Figure] [Figure]
L i f e
C e r ti fi e d A cc .
[Figure]
b a s e
C e r ti fi e d A cc
[Figure]
[Figure]
[Figure]
ericpierce/austinhousingprices
[Online]
Available: https://archive.ics.uci.edu/ml/ datasets/spambase
Reducing Certified Regression to Certified Classification for General Poisoning Attacks
Supplemental Materials
Table of Contents
Appendix A: Nomenclature Reference
A
Appendix B: Worst-Case Insertions and Deletions are Interchangeable: Proof
A
Appendix C: Proofs for the Main Paper
A
Appendix D: Reducing k NN-CR to Jia et al.’s
Certified k NN Classifier
A
Appendix E: Reducing PCR to DPA
A
Appendix F: Relating OCR to Wang et al.
’s
Overlapping Certified Classifier
A
Appendix G: On the Tightness of Certified Regression
A
G-A
Region-Based Neighborhood IBL . .
A
G-B
Weighted Overlapping Certified Regression . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A
Appendix H
: Evaluation
Setup
A
H-A
Dataset Configuration . .
A
H-B
Dataset Target Value Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A
H-C
Hyperparameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A
Appendix I: Additional Experiments
A
I-A
Detailed Experimental Results . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
A
I-B k NN-CR Full Certified Accuracy Plots . .
A
[Table]
A
[Table]
A
[Table]
A
[Table]
Effect
[Table]
Median
[Table]
A
[Table] [Table]
Indicator function where 1 [ q ] = 1 if q is true and 0 otherwise
[Table]
th harmonic number where H ( k ) =
(cid:80)
[Table]
Feature vector
[Table]
Feature domain where ∀ x x ∈ X and X
⊆ R d
[Table]
Target range
[Table]
∀
[Table]
Instance space where Z :=
X
× Y
[Table]
te
[Table]
Arbitrary test instance
[Table]
Training set where S ⊆
Z
[Table]
Training-set size where n := |S|
[Table]
Number of training
[Table]
set blocks
[Table]
Training-set partitioning function where h tr : Z → [ m ]
[Table]
Training-set block index where j ∈ [ m ]
S ( j
[Table]
j -th training-set block where S ( j ) := { z ∈ S : h tr ( z ) =
j } and ∀ j ′ ̸ =
j S ( j ) ∩ S ( j ′ )
= ∅ f
Robust regressor – either an ensemble or instance-based learner – where f : X → Y f ( x te )
Regressor f ’s prediction for test feature vector x te
[Table]
One-sided upper bound for robustness certification where f ( x te ) ≤ ξ ξ l
Two-sided lower bound for robustness certification where ξ l ≤ f ( x te ) ≤ ξ u ξ u
Two-sided upper bound for robustness certification where ξ l ≤ f ( x te ) ≤ ξ u k NN
Vanilla k -nearest neighbors
[Table]
neighbors with median as the decision function
[Table]
Nearest-neighbors neighborhood (multi)set for test feature vector x te
[Table]
Ensemble submodel count where by definition T is selected to be odd-valued
[Table]
Submodel index where t ∈ [ T ]
[Table]
Number of training set modifications required to violate invariant ξ l ≤ f t ( x te ) ≤ ξ u .
Note that r t is one larger than f t ’s certified robustness
[Table]
Maximum submodel modification requirement where r max :=
max t r t
[Table]
Overlapping training-set block assignment function where h f : [ m ] → 2 [ T ]
D t
Submodel f t ’s training set where for overlapping regression D t =
(cid:83) j ∈ [ m ]
[Table]
∈ h f ( j ) S ( j )
[Table]
Inverse of the fraction of the training set used to train each submodel, where ∀ t q = n |D t | d (
[Table]
Spread degree of training-set block S ( j ) where d ( j ) :=
| h f ( S ( j ) )
|
[Table]
max
Maximum spread degree where d max := max j d ( j )
[Table]
Set of ensemble submodels predicting f t ( x te ) ≤ ξ where T l ⊆
[ T ]
[Table]
e
[Table]
g
[Table]
NN
[Table]
submodel predictions
[Table]
T
[Table]
|V
[Table]
Lower thresholded real-valued multiset where V l := { ν t ∈ V : ν t ≤ ξ }
[Table]
Upper thresholded real-valued multiset where V u := { ν t ∈ V : ν t > ξ }
[Table]
Binarized multiset where V ± 1 :=
{ sgn ( ν t ) :
ν t ∈ V}
[Table]
Adversarially perturbed
[Table]
[Table] [Table]
t
[Table]
t
[Table]
[ T
[Table]
Lemma 14.
For real multiset V of cardinality T > 1 , if an arbitrarily-large value is inserted into V or the smallest value in
V is deleted, the median of the resulting sets is equivalent.
Proof.
For simplicity and w.l.o.g., assume V is ordered where ν 1 ≤ · · · ≤ ν T .
Let α ∈ [1 , T ] denote the median’s index.
If T is odd, α = (cid:6) T 2 (cid:7) ; otherwise, when T is even, α = T 2 + 12 , i.e., the midpoint between the T 2 -th and ( T 2 + 1) -th largest values in V .
Consider first an arbitrarily-large insertion when T odd.
Each insertion increases the set’s cardinality by 1.
When V ’s cardinality is odd, then the cardinality of this new set after the first insertion is even.
Therefore, this new set’s median has index
[Equation]
Median’s index for new set of even size T +
[Equation] [Equation]
[Equation]
Since T ≥ α ′ and the inserted element is larger than all values in V , the value corresponding to index ( (cid:6) T 2 (cid:7) − 12 ) is equivalent for both original set V and the new set after the insertion.
Next, consider the deletion case for odd T .
Similar to above, the cardinality of the modified set after one deletion is even; therefore, this modified set’s median has index
[Equation]
Median’s index for new set of even size T
[Equation]
[Equation] [Equation]
This new set’s cardinality is one smaller than the original set with the smallest element removed.
Hence, the value corresponding to index ( (cid:6) T 2 (cid:7) − 12 ) in this shrunken set equals the value at index ( (cid:6) T 2 (cid:7) + 12 ) in original set V .
Since indices α ′ and α ′′ correspond to the same value in V , the resulting sets’ medians are equivalent.
The primary takeaway from Lemma 14 is that under the insertion/deletion paradigm, worst-case insertions and deletions are interchangeable.
Note that for our purposes, there is an edge case where worst-case insertions and deletions exhibit divergent behavior.
Specifically, after T deletions (i.e., all elements in V are removed), the median of an empty set is not generally defined.
In contrast, the median after T arbitrarily-large insertions is itself arbitrarily large.
For consistency, we define the empty set’s median as ∞ to match the insertion case.
Proof of Lemma
Proof.
Let V l be all elements in V that do not exceed ξ .
Under the swap paradigm, the optimal strategy to maximally increase a set’s median is to iteratively replace the set’s smallest value with ∞ .
Apply this optimal strategy to V .
After one swap, the resulting set contains |V l | − 1 elements that are less than or equal to ξ .
After two swaps, there are |V l | − 2 such elements with each subsequent swap’s effects proceeding inductively.
Once the modified set contains exactly (cid:6) T 2 (cid:7) elements less than or equal to ξ , no additional swaps are possible without causing the resulting set’s median to exceed ξ .
Therefore, by induction, the maximum number of swaps that can be performed on V and it remains guaranteed that the resulting set’s median does not exceed ξ is
[Equation]
Proof of Lemma
Proof.
For simplicity and w.l.o.g., assume V is ordered where ν 1 ≤ · · · ≤ ν T .
An attacker’s optimal insertion strategy is to insert arbitrarily-large values into V while the optimal deletion strategy is to always delete V ’s smallest value.
Lemma 14 proves that these worst-case operations perturb the median identically so we only consider insertions below.
Let α denote the median’s index.
If T is odd, α = (cid:6) T 2 (cid:7) ; otherwise, when T is even, α = T 2 + 12 , i.e., the midpoint between the T 2 -th and ( T 2 + 1) -th largest values in V .
Each insertion increases the set’s size by 1.
When V ’s size is odd, then the size of this new set after the first insertion is even.
Therefore, this new set’s median has index
[Equation]
Median’s index for new even size T +
[Equation]
[Equation] [Equation]
[Equation]
The analysis is essentially identical when T is even and is excluded for brevity.
Note that each insertion always increases the median’s index α by 12 .
As long as α ≤ |V l | , it is guaranteed that med V ≤ ξ .
Since each insertion changes α by 1 2 , then 2( |V l | − α ) arbitrary insertions can be made in V with it remaining guaranteed that the modified set’s median does not exceed ξ .
Regardless of whether T is odd or even, 12 it holds that
[Equation] [Equation]
Proof.
The first portion of this proof follows the same argument as the proof of Lemma 3, with one primary difference.
There, the optimal strategy to perturb V ’s median swapped out the smallest values in V first.
For the weighted version, the optimal (greedy) strategy swaps out whichever value in V l ⊆ V has the smallest weight.
To perturb V ’s median above ξ , it is sufficient to swap any |V l | − (cid:6) T 2 (cid:7) values in V l with an arbitrarily large replacement.
For simplicity and without loss of generality, let ˜ r 1 , . . .
˜
r |V l | be the weights of the elements in V l arranged in ascending order.
Define ∆ :=
|V l | − (cid:6) T 2 (cid:7) .
Applying Lemma 3, up to ∆ values in V can be replaced without perturbing the median.
This entails a minimum cost of
[Equation]
Denote the (∆ + 1) -th largest weight in R l as ˜ r ∆+1 .
Observe that adding ˜ r
[Equation]
1 − 1 to Eq.
(25) is insufficient to swap out any remaining elements in V l since all elements with weight less than ˜ r ∆+1 are already replaced and all remaining elements have weight at least ˜ r ∆+1 .
Therefore, the certified robustness is
[Equation]
Moreover, increasing Eq.
(29) by one would allow for the (∆ + 1) -th largest value in V to be swapped, which would in turn perturb the set’s median above ξ .
Therefore, Eq.
(29)’s bound is tight.
Proof of Lemma
Proof.
The median perturbation paradigms formalized in Lemmas 3, 4, and 5 calculate their certified robustness using three values, namely: T , |V l | , and (cid:6) T 2 (cid:7) .
If these three values are equivalent for V and V ± 1 , then their associated certified robustness ( R ) must also be equal.
Since |V| =
|V ± 1 | , they have equivalent T and (cid:6) T 2 (cid:7) .
By definition, the binarization of V to V ± 1 does not change the value of |V l | either.
Therefore, for all three median perturbation paradigms, binary multiset V ± 1 and real multiset V have equivalent certified robustness R .
Proof of Theorem
Proof.
For fixed-population IBLs, certifying that f ( x te ) ≤ ξ simplifies to median perturbation under Sec.
IV-A’s unweighted swap paradigm since all necessary criteria are met,
namely that
1) f ’s decision function is a median operation over a set of values, i
e., f ( x te ) :
= med N ( x te ) .
2) Neighborhood N ( x te ) has fixed cardinality T , and T is odd.
A worst-case modification to training set S causes an element in N ( x te ) to be replaced with a different one.
Lemma 3, therefore,
provides
a (
lower) bound on the number of training-set modifications that can be made without the resulting model violating the requirement that f ( x te ) ≤ ξ .
That is why certified robustness R in Eqs.
(6) and (2) (Thm. 7 & Lem.
3, resp.) are equivalent.
Proof of Theorem
Proof.
This proof follows a very similar structure as Theorem 7’s proof above.
The primary distinction is that a different median perturbation paradigm from Sec.
IV is needed here.
For region-based IBLs, certifying that f ( x te ) ≤ ξ simplifies to median perturbation under Sec.
IV-B’s insertion/deletion paradigm since the three necessary criteria are met:
1) f ’s decision function is a median operation over a set of values, i.e., f ( x te ) :
= med N ( x te ) .
2) Neighborhood cardinality T is not fixed but can increase and/or decrease.
Each modification of N ( x te ) takes the form of either an insertion or deletion, i.e., not swaps.
Therefore, Lemma 4 bounds the total number of training-set insertions/deletions that can be performed without violating the requirement that f ( x te ) ≤ ξ .
That is why R ’s definition in Eq.
(7) is identical to Eq.
Proof of Theorem
Proof.
Certifying here that f ( x te ) ≤ ξ simplifies to median perturbation under the unweighted swap paradigm since all necessary criteria are satisfied, specifically that
1) f ’s decision function is a median operation over a set of fixed, deterministic values, i.e., f ( x te ) :
= med { f 1 ( x te ) , . .
, f T ( x te ) } . 2)
Since the submodels are trained on disjoint data/feature regions, a change to one submodel (i.e., value f t ( x te ) ) has no effect on any other submodel (value).
Each submodel perturbation causes an existing value in the set to be replaced by a new value.
4) T is fixed and odd-valued.
The cost to change any submodel (i.e., value) is one, i.e., ∀ t r t = 1 .
Lemma 3 provides a (lower) bound on the number of training-set modifications that can be performed without violating the requirement that f ( x te ) ≤ ξ .
Certified robustness R in Eq.
(8) is then identical to Lemma 3’s Eq.
Proof of Theorem
Proof.
Here, we extend the argument in Theorem 9’s proof to the weighted case.
Four of the five criteria in Thm.
9’s proof still hold, specifically that
1) f ’s decision function is a median over a set of values.
Each submodel is independent and deterministic.
3) Modifications to the set of values take the form of swaps.
4) T is fixed and odd-valued.
The only difference is that the perturbations are weighted where each value f t ( x te ) now has an associated cost r t ≥ 0 .
Therefore,
Sec.
IV-C’s weighted swap paradigm applies.
Certified robustness R in Eq.
(9) follows directly from and is identical to R in
Lemma 5’s Eq.
Proof of Lemma
Proof.
To prove a problem is NP-hard, it suffices to show that there exists a polynomial time reduction from a known NP-hard problem to it.
As explained in Sec.
VIII-A, partial set cover is NP-hard [46, 47].
Below we map partial set cover to overlapping certified regression.
Let U :=
[ T ′ ] be a ground set of T ′ elements, and let Q :=
{Q 1 , . . .
, Q m } be a collection of sets where each Q j ⊆ U and (cid:91)
Q∈ Q
Q = U .
The goal is to find the subcover F ⊆ Q of minimum cardinality s.t.
[Equation]
Q∈F
[Equation]
(cid:12)(cid:12)(cid:12)(cid:12)
[Equation]
where ∆ ∈ [ T ′ ] .
It is straightforward to map the above to overlapping certified regression.
Let the ensemble have (2 T ′ + 1) submodels.
Function h tr partitions the training set into m blocks with the blocks denoted S (1) , . . .
, S ( m ) .
Define the block mapping function as:
[Equation]
Intuitively, each of the first T ′ submodels is trained on one of the subsets in Q , while the remaining models are not trained on any data.
Let all submodels be constant a function.
Define the submodel function as
[Equation]
For any finite ξ , |V l | = ∆ + (cid:6) T 2 (cid:7) .
Applying Theorem 9, the number of submodels overlapping certified regression perturbs is |V l | − (cid:6) T 2 (cid:7) =
∆ .
Overlapping certified regression’s robustness R is the solution to the original partial set cover problem because
1) Only models with index t ≤ T ′ will be perturbed since all other submodels have no training data.
The training set of each of these T ′ submodels maps directly to a subset in Q . 3)
Overlapping certified regression seeks to find the minimum number of dataset blocks that must be modified to perturb the median prediction.
In this formulation, the number of blocks to be modified is ∆ – same as in the original partial-set cover problem.
If overlapping certified regression were solvable in polynomial-time, then partial set cover would also be solvable in polynomial time.
However, partial set cover is NP-hard, meaning overlapping certified regression must also be NP-hard.
Proof of Corollary
Proof.
From Lemma 11 above, (unweighted) overlapping certified regression is NP-hard.
The unweighted case trivially maps to the weighted one where ∀ t r t = 1 .
Therefore, weighted OCR must be at least as hard as the unweighted case meaning
W-OCR is also NP-hard.
Proof of LemmaProof
By
construction
Given a deterministic training algorithm, a model’s prediction can be certified against the deletion of any subset S ⊂ S by training a model on just dataset S \ S and verifying the prediction does not violate the associated invariant , i.e., f S\ S ( x te ) ≤ ξ .
Consider training a separate model on each subset of S of size at least n − r + 1 .
If all of those models also satisfy the invariant, then by construction, r − 1 deletions or fewer are insufficient to violate the invariant.
If r − 1 deletions are not enough, then at least r deletions are required.
Lemma 13’s proof above only applies if model prediction and training is deterministic, i.e., repeating training and then the prediction always yields the same predicted value.
Otherwise, proof by construction would require verifying all random seeds for each subset of S .
R EDUCING k NN-CR TO J IA ET AL .’
S C ERTIFIED k NN C LASSIFIER
Sec.
III mentions that Jia et al.
[24] propose a certified classifier by leveraging the implicit robustness of nearest neighbor methods.
In their paper, Jia et al.
examine both pointwise certification 13 of test instances individually as well as joint certification of multiple test instances collectively.
Here, we exclusively consider Jia et al.
’s pointwise contributions.
This section explores in detail how our certified robust regressor, k NN-CR, reduces to Jia et al.’s
certified k NN classifier.
For classification, label space Y is nominal and consists of |Y| classes.
Given test instance x te ∈ X , a k NN classifier returns neighborhood N ( x te ) , which is a multiset whose underlying set is Y .
Let c and c ′ be the labels with the largest and secondlargest multiplicity in N ( x te ) .
In other words, c and c ′ are the first and second most popular labels in x te ’s neighborhood.
Denote the multiplicity of labels c and c ′ as T c and T c ′ , respectively.
Jia et al.
[24, Thm. 1] specify their certified k NN classifier’s robustness bound as
[Equation]
32) where indicator function 1 [ c > c ′ ] breaks ties by choosing whichever label is assigned the larger number.
Lemma 15 below establishes that for binary classification, Jia et al.
’s method and k NN-CR certify equivalent robustness guarantees ( R ).
This symmetry between Jia et al.
’s method and k NN-CR extends beyond classification to regression as well.
Recall that Lemma 6 establishes symmetry between certified robustness in a real-valued domain and robustness in a binarized domain.
Applying that insight here, Jia et al.
’s
certified k NN (binary) classifier is extended from the binary domain to certify the robustness of k NN-CR’s real-valued regression predictions.
Observe that this interplay is the fundamental concept underpinning any reduction.
Put simply, Jia et al.’s
certification algorithm serves as, in essence, a “subroutine” within Fig.
3’s certified regressor framework.
Lemma 15.
For x te ∈ X and f a k -nearest neighbor classifier, let N ( x te ) be x te ’s neighborhood under f with T :
= |N ( x te ) | odd.
For binary classification, Jia et al.
[24] and k NN - CR certify equivalent robustness.
Proof.
For binary classification with odd neighborhood cardinality T , there cannot be ties between labels.
Moreover, T c − T c ′ is always odd by the pigeonhole principle.
Applying these two observations, Eq.
(32) simplifies to
[Equation]
Under binary classification, T c + T c ′ =
T meaning
[Equation]
In the case of binary classification, V l represents all models that predict majority label c .
Therefore, |V l | = T c meaning
Eq.
(38) is equivalent to Eq.
A
E R EDUCING PCR TO DPA
As detailed in Sec.
III, Levine and Feizi [25]’s deep partition aggregation (DPA) defense relies on an ensemble of T fullyindependent, deterministic submodels, 14 each of which is trained on disjoint data.
Like our certified regressors, DPA certifies the pointwise robustness of an individual model prediction, f ( x te ) .
In the classification case, label space Y is nominal and consists of |Y| classes.
Given x te ∈ X , each submodel assigns x te some label, i.e., f t ( x te ) ∈ Y .
Denote the ensemble’s plurality label for x te as c ∈ Y , and denote the number of submodels that predict c for x te as T c ∈ [ T ] .
Let c ′
∈
Y \ { c } denote any label other than the ensemble’s plurality prediction, and let T c ′ ∈ { 0 , . . .
, (cid:6) T 2 (cid:7) } denote the number of submodels that predict c ′ for x te .
Levine and Feizi [25, Thm. 1] specify DPA’s certified robustness bound as
[Equation]
where 1 [ c ′ < c ] breaks ties by predicting whichever label has the lower assigned number.
Lemma 16 below establishes that DPA and PCR certify equivalent robustness guarantees for binary classification with an odd number of submodels.
This symmetry between DPA and PCR extends beyond classification to regression as well.
Recall that Lemma 6 establishes symmetry between certified robustness in a real-valued domain and robustness in a binarized domain.
Applying that insight, it is clear then that DPA is certifying the robustness of our certified regressor PCR, albeit using
V ’s surrogate V ± 1 := { sgn ( ν t − ξ ) : ν t ∈ V} .
This is the fundamental idea behind reductions.
Here, DPA’s certification algorithm serves as a type of “subroutine” within the certified regressor framework (Fig. 3).
Lemma 16.
Let f be an ensemble of T fully-independent, deterministic submodels where each submodel is trained on disjoint data with T odd.
For binary classification, DPA and PCR certify equivalent robustness.
Proof.
This proof is very similar to that of Lem.
Nonetheless, we repeat the full details to make each proof standalone.
Let x te ∈
X
be any feature vector.
Given ensemble f , x te ’s non-majority label c ′ is unique so Eq.
(39) simplifies to
[Equation]
Similarly for odd T , ties are not possible making the indicator function unnecessary and able to be ignored depending how c and c ′ are chosen to be defined.
This simplifies Eq.
(40) to
[Equation]
Eq.
(41) can be rewritten as
[Equation]
In the case of binary classification, V l represents all models that predict majority label c .
Therefore, |V l | = T c meaning
Eq.
(45) is equivalent to Eq.
R ELATING OCR TO W ANG ET AL .’ S O VERLAPPING C ERTIFIED C LASSIFIER
As discussed in Sec.
III, Wang et al.
[26] propose an overlapping certified classifier they name deterministic finite aggregation (DFA).
Note the acronym similarity between DFA and Levine and Feizi’s [25] deep partition aggregation (DPA).
As a basic intuition on DFA, recall that d max is the maximum spread degree of any dataset block over the T overlapping submodels.
As detailed in Sec.
VIII, when certifying robustness for both classification and regression, (partially) covering set
[ T ] is not the goal.
Rather, the goal is to partially cover set
[Equation]
i.e., those subset of models that predict at most ξ .
Over this restricted subset, the maximum block spread degree may be less than d max .
As a very simplified explanation, Wang et al.
use this insight to provide worst-case deterministic bounds on the robustness of an overlapping classification prediction.
Our discussion of overlapping regression in Sec.
VIII does not directly apply Wang et al.
’s robustness certifier for multiple reasons, including
1) Wang et al.
do not explain that determining optimal R under their formulation is NP-hard.
We believe this is an important insight.
Wang et al.
do not analyze the optimality gap of their approach.
Both our ILP approach and partial set cover approximation give optimality bounds.
What is more, our ILP-based approach can actually prove optimality gives r 1 , . .
, r T .
In contrast, when Wang et al.
’s solution is optimal, no indication of that fact is readily given.
Wang et al.
only consider the unit-cost assumption, meaning their formulation does not natively support weighted robustness analysis.
To ensure a fair and direct comparison between OCR and W-OCR, we use an ILP for both methods.
One clear limitation of our choice to use an ILP for overlapping robustness certification is the added computational cost.
However, in our implementation, solving a single ILP uses very few resources, e.g., just a single core in a multicore CPU.
Moreover, we enforce tractable computation times by specifying an ILP time limit.
While these two factors combined are not a panacea, they do assuage (some) computational concerns.
This section explores two cases where our certified robustness bounds may not be tight.
A. Region-Based Neighborhood IBL
Recall that our insertion/deletion paradigm specifies the certified robustness as
[Equation]
Consider the case where |V l | < T .
After R worst-case insertions into set V , the median is max V l +
[Equation]
V
[Equation]
It is possible that ξ can still exceed this value, meaning one more worst-case insertion/deletion is possible.
In other words, Eq.
(3)’s bound would be non-tight by at most one.
To make the insertion/deletion paradigm’s certified robustness bound tight, redefine Lemma 4’s certified robustness as,
[Equation]
where (cid:101) V u := V u ∪ {∞} .
Since Theorem 8 derives its bounds directly from Lemma 4, our certified robustness bound for region-based neighborhood
IBLs can also be non-tight by one.
We deliberately simplify our formulation to exclude this case to ensure consistency with the other presented ideas.
B. Weighted Overlapping Certified Regression
A weighted ensemble never has a worse true certified robustness than its unit-cost equivalent.
However, there are cases where
W-OCR’s bound is one lower than OCR’s bound, i.e., Fig.
6’s ILP bound is not tight.
This occurs, when for optimal R , it is possible to perturb |V l | − (cid:6) T 2 (cid:7) + 1 submodels (i.e., one more than the required |V l | − (cid:6) T 2 (cid:7) submodels).
In such cases, Eq.
(5)’s decrementing by one causes the bound to be one less than the ideal value.
It is possible to formulate a more complicated
ILP to account for this corner case.
However, we deliberately keep the formulation simple, knowing R may be marginally non-tight.
Sec.
X’s evaluation shows this niche case occurs only rarely in practice – almost exclusively when T is small.
This section details the evaluation setup used in Section X’s experiments, including implementation details, dataset configuration, and hyperparameter settings.
Our source code can be downloaded from https://github.com/AnonSaTML/certified regression.
All experiments were implemented and tested in Python 3.7.1.
Experiments were performed using one core of a fourteen-core Intel E5-2690v
CPU and 12GB of RAM.
Ridge regression models were trained using Scikit-Learn [63], while the decision forests used the
XGBoost library [21].
The overlapping regressor ILPs (Fig. 6) were optimized using Gurobi [52] with a time limit of 1200s.
Our implementation loads the gurobipy Gurobi python package by default.
Gurobi is a commercial product and requires a license to solve most non-trivial linear programs.
Gurobi offers free, unlimited licenses for academic use, including both for an individual system and for a cloud/HPC environment.
A. Dataset Configuration
Our source code automatically downloads all necessary datasets.
Regarding dataset preprocessing, categorical features were transformed into one-hot-encoded features in line with previous work [39].
Standardizing features by dataset mean/variance breaks submodel independence and so was not performed.
Minimal manual feature engineering was performed to improve the housing datasets’ results, e.g., adding a home’s age, total square feet, total number of bathrooms, etc.; this feature engineering was done based on existing features in the dataset (e.g., total square feet equals the sum of the first and second-floor square footage).
None of the engineered features affect submodel independence.
Most of the six datasets in Sec.
X-A do not have a dedicated test set.
In such cases, the data was split 90%/10% at random between training and test.
When training k NN-CR models, each feature dimension was normalized to the range [0 , 1] .
Without feature normalization, k NN-CR generally prioritizes whichever feature has the largest magnitude.
This transformation implicitly restricts arbitrary insertions to the feature range in the original dataset.
Such normalization is implicitly done in certified classifier evaluation on image datasets where each pixel has a consistent, fixed range.
B. Dataset Target Value Statistics
Table III summarizes the test set’s target ( y ) value distribution statistics for Sec.
X’s five regression datasets.
Recall from Table I that the Ames, Austin, and Diamonds datasets set error threshold ξ as a fixed percentage of y te .
This choice was made because these three datasets exhibit significant y variance.
For example, for Diamonds, the largest y value ($18.8k) is about two orders of magnitude larger than the smallest y value ($339).
Using a fixed ξ value on these three datasets would have made certifying instances with small y unrealistically easy while making certification of instances with large y unreasonably difficult.
Making the error threshold a fraction of y te allows the certification difficulty to be more consistent across the range of y values.
Datasets Weather and Life used fixed ξ values of 3 degrees (Celsius) and 3 years respectively.
Both of these threshold values are less than one-third of each dataset’s y standard deviation.
Supplemental Section I-C evaluates the performance of our certified regressors on additional ξ values – both larger and smaller than the ξ values used in Sec.
X.
C. Hyperparameters
Following Jia et al.
’s
[24] certified k NN classifier evaluation, k NN-CR’s neighborhood size, k , was set to the (larger) odd integer nearest to n 2 .
We use the Minkowski distance as the neighborhood’s distance metric.
[Table]
For our ensemble regressors, hyperparameters were tuned using Bayesian optimization as implemented in the scikit-optimize library [64].
The partitioned and overlapping certified regressors (unweighted and weighted) used the same settings.
Ridge Regression Hyperparameters For three datasets – Diamonds [58], Weather [59], and Spambase [61] – our four ensemble regressors used ridge regression as the submodel architecture.
For each dataset and q value, we tuned three ridge regression hyperparameters.
Below, we list those hyperparameters along with the set of values considered.
• Weight Decay ( λ ): L 2 regularization strength.
We considered values between 10 − 8 and 10 4 .
• Error Tolerance ( ε ): Minimum validation error that defines when a model is considered converged.
The tested values were { 10 − 8 , 10 − 7 , . . .
, 10 − 3 } .
• Maximum Number of Iterations (# Itr.):
Defines the maximum number of optimizer iterations.
If the error tolerance is achieved before the iteration count is met, the model is treated as converged, and optimization stops.
The tested values were { 10 2 , 10 3 , . . .
Table IV lists the final hyperparameters for each experimental setup that used ridge regression as the submodel architecture.
XGBoost Hyperparameters
For three datasets – Ames Housing [56], Austin Housing [57], and Life [60] – our four ensemble regressors and q value, we tuned seven hyperparameters.
Below, we list those hyperparameters along with the set of values considered
• Number of Trees ( τ ): Number of trees in the ensemble.
The tested values were { 50 , 100 , 250 , 500 , 1000 } .
• Maximum Tree Depth
( h ): Maximum depth of each tree in the ensemble.
The tested values were { 1 , . . .
• Evaluation Metric ( L ):
Applied to the validation set and is the metric being minimized.
The tested values were root mean squared error (RMSE) and mean absolute error (MAE).
• Weight Decay ( λ ): L 2 regularization strength.
We considered values between 10 − 3 and 10 5 .
• Minimum Split Loss ( γ ): Minimum reduction in loss required to split a node instead of making it a leaf.
The values considered were { 0 . 005 , 0 . 01 , 0 . 05 , 0 . 1 , 0 . 3 , 0 . 5 , 1 } .
• Learning Rate ( η ): Larger value makes the boosting more conservative.
The tested values were { 0 . 01 , 0 . 1 , 0 . 3 , 1 } .
to
[Table] [Table]
MAE 1 E + 1 E −0.
RMSE 1 E −5 E −1.
MAE 1 E + 1 E −1.
MAE 1 E −1 E −1.
Life
RMSE 1 E + 1 E −0.
RMSE
E + 5 E −0.
MAE 1 E + 1 E −1.
RMSE
E + 5 E −0.
Limited space prevents us from including all experimental results in the main paper.
We provide additional results below.
A. Detailed Experimental Results
1) Baseline Accuracy: Table VI shows the baseline accuracy when a model is trained on all of training set S (i.e., q = 1 ).
For each dataset, the model architecture (either ridge regression or XGBoost) aligns with those used for Sec.
X’s ensembles.
See Table I.
[Table]
2) Numerical Results: Fig.
7 visualizes our certified regressors’ certified robustness on six datasets – five regression and one binary classification.
This section provides the certified accuracy in numerical form, including the associated variance.
[Table]
[Table] [Table]
74.9 ± 5.
15.7 ± 3.
56.0 ± 4.
56.3 ± 5.
56.0 ± 4.
62.8 ± 6.
14.8 ± 3.
24.7 ± 4.
25.3 ± 4.
29.5 ± 4.
42.3 ± 6.
12.3 ± 3.
0.0 ± 0. 0.0 ± 0.
16.9 ± 4.
17.9 ± 5.
10.7 ± 2.
0.0 ± 0. 0.0 ± 0.
4.2 ± 1.
3.3 ± 3.
9.6 ± 3.
[Table] [Table]
[Table]
B. k NN - CR Full Certified Accuracy Plots
To improve readability
[Figure]
Fig.
7 does not show k NN-CR’s full certified accuracy trend.
Instead, Fig. 8 below plots k NN-CR’s full mean certified accuracy against that of W-OCR (using each dataset’s maximum q value) for each of Sec.
X’s six datasets.
Fig. 8 also visualizes the variance of each method by showing one standard deviation of the certified accuracy as a shaded region around the mean line.
In summary, while W-OCR certifies more instances (i
[Figure]
e., has larger peak certified accuracy), its maximum certified robustness R is (significantly) smaller than that of k NN-CR
[Figure]
[Table]
C. Alternative ξ Evaluation
For each dataset in Sec.
X, we evaluate a single threshold value ξ .
This section explores how ξ affects our certified regressors’ performance on four regression datasets.
17 Specifically, Fig.
9 considers our two best-performing methods, W-OCR and k NN-CR.
Like in Sec X, k NN-CR uses q = 1 .
For W-OCR, we report results for each dataset’s two largest q values.
Note that in Table I, Ames and Diamonds use the same (default) threshold ξ = 15% · y while both Life and Weather use (default) value ξ = 3 .
In Fig.
9 below, each dataset pair considers the same alternate ξ values.
ξ ’s exact effect varies across datasets, but generally, certified accuracy increases roughly linearly with ξ until the accuracy saturates.
ξ = 5% · y ξ = 10% · y ξ = 15% · y (Default) ξ = 20% · y ξ = 25% · y
[Figure]
A m e s
H o u s i n g
C e r ti fi e d A cc .
[Figure]
D i a m o n d s
C e r ti fi e d A c c .
[Figure]
ξ =ξ =ξ = 3 (Default) ξ =ξ =ξ =ξ =
[Figure]
W e a t
h
er
C e r ti fi e d A cc .
[Figure]
L i f e
C e r ti fi e d A cc .
[Figure]
D. Model Training Times
This section summarizes the time needed to train our primary certified regressors.
All experiments were performed using a single core of a fourteen-core Intel E5-2690v4 CPU with 12GB of 2400MHz DDR4 RAM.
As is standard for k NN models, k NN-CR’s training time is essentially zero since “training” simply entails instance memorization, which is nearly instantaneous.
Table XIV details the training times of our two partitioned regressors: PCR which follows the unit-cost assumption (i.e., ∀ t r t = 1 ) and its weighted extension W-PCR.
The training times are broken down into the time required to train a single submodel as well as the average time to train the whole ensemble.
As expected, W-PCR takes much longer to train than PCR since the former requires training O ( n + T ) models (for r max = 2 ) while the latter requires only O ( T ) models.
As q increases, each submodel is trained on fewer data.
It might be assumed that submodel training time is inversely related to q .
However, Table XIV shows that this is not necessarily the case since different hyperparameter settings can drastically affect how long a model takes to train, even after accounting for q .
Note also that all ensemble submodels can be trained fully in parallel.
Hence, by simply parallelizing submodel training,
PCR’s total training time can be sped up by a factor of about T while W-PCR’s total training time can be sped up by about a factor of ( n + T ) .
Moreover, while training an ensemble (partitioned or overlapping) is often more computationally expensive than training just one model on the whole training set, this additional training time is amortized across all test predictions that need to be certified.
Lastly, recall from Sec.
X-A’s evaluation that our overlapping certified ensembles, OCR and W-OCR, have T = qd submodels, where d is the training-set block spread degree.
Therefore, the time to train OCR and W-OCR ensembles is about d times larger than that of PCR and W-PCR, respectively.
See Table I for each dataset’s d value.
[Table]
Recall from Sec.
VIII that our two overlapping certified regressors, OCR and W-OCR, use an integer linear program to bound certified robustness R .
Under OCR’s unit-cost structure where ∀ t r t ≤ 1 , Fig. 6 is actually a binary integer program since ∀ j ω ( j ) ∈ { 0 , 1 } .
In contrast, with W-OCR’s weighted costs, Fig. 6 is a true integer linear program.
While both OCR and W-OCR have the same asymptotic complexity, we observed that LP solvers generally solve programs with only binary variables faster than integral ones.
Sec.
X’s evaluation implemented Fig.
6’s LP in Gurobi [52].
All experiments were performed on a single core of a fourteencore Intel E5-2690v4 CPU with 12GB of RAM.
Fig.
10 shows the ILP execution time distribution of OCR and W-OCR for three datasets from Sec.
X. For each dataset, we report the ILP’s execution time for the two largest q values.
Each histogram visualizes at least 1600 trials per method.
In summary, ILP execution time is bimodal with run times clustered around 0 seconds and 1200 seconds (i.e., the ILP’s time limit).
OCR’s ILP is generally faster on average than W-OCR (observe that OCR times out less frequently, if at all).
Note also that the ILP’s execution time distribution does not change significantly across each dataset’s two q values.
[Figure] [Figure]
F. Effect of Median as the Model Decision Function
This section evaluates how the choice of decision function affects the accuracy of standard (i.e., non-robust) regression.
All experiments above exclusively used median as the decision function.
Below, we compare median’s performance to the more traditional decision function, mean.
To be clear, this section’s experiments exclusively consider non-robust model predictions.
This mini ablation study simply examines the decision function’s effect on baseline (uncertified) prediction accuracy.
Table XV compares the performance of mean and median on Sec.
X’s five regression datasets.
These experiments used the same threshold ( ξ ) values as Sec.
X (see Tab. I).
Tab.
XV includes results for two different model architectures: k NN-based regression and a regression ensemble that follows PCR’s base architecture.
For each dataset, the ensemble regressor is evaluated on the same three q values used in Sec.
X.
In summary, median and mean decision functions have comparable performance.
Median had better average accuracy than mean on 11 of 20 evaluation setups.
Median and mean had equivalent average performance on four setups.
Mean outperformed median on the remaining five setups.
k NN regression was the method most affected by the choice of decision function.
In particular for the Weather and Life datasets, mean outperformed median by 8.6 and 2.3 percentage points, respectively.
Only one other evaluation setup (Austin with q = 701 ) saw a similarly large performance difference (3.8pp).
[Table]