I NTRIGUING P ROPERTIES OF I NPUT - DEPENDENT R ANDOMIZED S MOOTHING
Anonymous authors
Paper under double-blind review
A BSTRACT
Randomized smoothing is currently considered the state-of-the-art method to obtain certiﬁably robust classiﬁers.
Despite its remarkable performance, the method is associated with various serious problems such as “certiﬁed accuracy waterfalls”, certiﬁcation vs. accuracy trade-off, or even fairness issues.
Input-dependent smoothing approaches have been proposed with intention of overcoming these ﬂaws.
However, we demonstrate that these methods lack formal guarantees and so the resulting certiﬁcates are not justiﬁed.
We show that the input-dependent smoothing, in general, suffers from the curse of dimensionality, forcing the variance function to have low semi-elasticity.
On the other hand, we provide a theoretical and practical framework that enables the usage of input-dependent smoothing even in the presence of the curse of dimensionality, under strict restrictions.
We present one concrete design of the smoothing variance and test it on CIFAR10 and MNIST.
Our design solves some of the problems of classical smoothing and is formally underlined, yet further improvement of the design is still necessary.
I NTRODUCTION
Deep neural networks are one of the dominating recently used machine learning methods.
They achieve state-of-the-art performance in a variety of applications like computer vision, natural language processing, and many others.
The key property that makes neural networks so powerful is their expressivity (G ¨ uhring et al., 2020).
However, as a prize, they possess a weakness - a vulnerability against adversarial attacks (Szegedy et al., 2013; Biggio et al., 2013).
The adversarial attack on a sample x is a point x (cid:48) such that the distance d ( x (cid:48) , x ) is small, yet the model f ’s predictions on x and x (cid:48) differ.
Such examples are often easy to construct, for example by optimizing for a change in prediction f ( x ) (Biggio et al., 2013).
Even worse, these attacks are present even if the model’s prediction on x is unequivocal.
This property is highly undesirable because in several sensitive applications, misclassifying a sample just because it does not follow the natural distribution might lead to serious and harmful consequences.
A well-known example would be a sticker placed on a trafﬁc sign, which could possibly confuse the self-driving car and cause an accident (Eykholt et al., 2018).
To prevent this behaviour, the robustness of classiﬁers against adversarial examples has begun to be a strongly discussed topic.
Though many methods claim to provide robust classiﬁers, just some of them are certiﬁably robust, i.e. the robustness is mathematically guaranteed.
The certiﬁability turns out to be essential since more sophisticated attacks can break empirical defenses (Carlini & Wagner, 2017).
Currently, the dominating method to achieve the certiﬁable robustness is randomized smoothing (RS).
This clever idea to get rid of adversarial examples using randomization of input was introduced by Lecuyer et al.
and
Li et al.
and fully formalized and improved in Cohen et al.
Let f be a classiﬁer classifying inputs x ∈ R N as one of the classes C ∈ C .
Assume now a random deviation (cid:15) ∼ N (0 , σ 2 I ) .
The smoothed classiﬁer g , made of f , is deﬁned as: g ( x ) = arg max C P ( f ( x + (cid:15) ) =
C ) , for C ∈ C .
In other words, the smoothed classiﬁer classiﬁes a class that has the highest probability under the sampling of f ( x + (cid:15) ) .
Consequently, an adversarial attack x (cid:48) on f is less dangerous for g , because g does not look directly at x (cid:48) , but rather at its whole neighborhood, in a weighted manner.
This way, we can get rid of local artifacts that f possesses – thus the name “smoothing”.
It turns out, that g enjoys strong robustness properties against attacks bounded by a speciﬁcally computed l 2 -norm threshold, especially if f is trained under a Gaussian noise augmentation (Cohen et al., 2019).
Unfortunately, since the introduction of the RS, several serious problems were reported to be connected to the technique.
Cohen et al.
(2019) mention two of them.
First is the usage of lower conﬁdence bounds to estimate the leading class’s probability.
With a high probability, this leads to smaller reported certiﬁed radiuses in comparison with the true ones.
Moreover, it yields a theoretical threshold, which upper-bounds the maximal possible certiﬁed radius and causes the “certiﬁed accuracy waterfalls”, signiﬁcantly decreasing the certiﬁed accuracy.
This problem is particularly pronounced for small levels of the used smoothing variance σ 2 , which motivates to use larger variance.
Second, RS possesses a robustness vs. accuracy trade-off problem.
The bigger σ we use as the smoothing variance, the smaller clean accuracy will the smoothed classiﬁer have.
This motivates to use rather smaller levels of σ .
Third, as pointed out by Mohapatra et al.
(2020a), RS smoothens the decision boundary of f in such a way, that bounded or convex regions begin to shrink as σ increases, while the unbounded and anti-convex regions expand.
This, as the authors empirically demonstrate, creates a disbalance in class-wise accuracies of g and causes serious fairness issues.
Therefore, again, the smaller values of σ are more preferable.
See Appendix A for a detailed discussion.
Clearly, the usage of a global, constant σ is suboptimal.
For the samples close to the decision boundary, we want to use small σ , so that f and g have similar decision boundaries and the expressivity of f is not lost (where not necessary).
On the other hand, far from the decision boundary of f , where the probability of the dominant class is close to 1, we need bigger σ to avoid the severe under-certiﬁcation (see Appendix A).
Together, using a non-constant σ ( x ) rather than constant σ , a suitable smoothing variance could be used to achieve optimal robustness.
Yet there are some works introducing this concept (see Appendix C), most of them lack mathematical reasoning about the correctness of their method, which, as we show, turns out to be critical.
To support this argumentation, we present a toy example.
We train a network on a 2D dataset of a circular shape with the classes being two complementary sectors, where one is of a very small angle.
In Figure 1 we show the difference between constant and input-dependent σ .
Using non-constant σ ( x ) deﬁned in Equation 1, we obtain an improvement both in terms of the certiﬁed radiuses as well as clean accuracy.
For more details see Appendix A.
The main contributions of this work are fourfold.
First, we generalize the methodology of Cohen et al.
(2019)’s work for the case of input-dependent RS (IDRS), obtaining useful and important insights about how to use the Neyman-Pearson lemma in this, general, case.
Second and most importantly, we show that the IDRS suffers from the curse of dimensionality in the sense that the semi-elasticity coefﬁcient r of σ ( x ) (that is | log( σ ( x 0 ))
− log( σ ( x 1 ))
| ≤ r (cid:107) x 0 − x 1 (cid:107) ∀ x 0 , x 1 ∈ R N ) in a high-dimensional setting is restricted to be very small.
This means, that even if we wanted to vary the σ ( x ) signiﬁcantly with varying x , we can’t.
The maximal reasonable speed of change of σ ( x ) turns out to be almost too small to handle, especially in high dimensions.
Third, in contrast, we also study the conditions on σ ( x ) under which it is applicable in high-dimensional regime and prepare a theoretical framework necessary to build an efﬁcient certiﬁcation algorithm.
We are the ﬁrst to do so for σ ( x ) functions, which are not locally constant (as in Wang et al.
Finally, we provide a concrete design of the σ ( x ) function and test it extensively and compare it to the classical
RS on the CIFAR10 and MNIST datasets.
We discuss to what extent the method treats the issues mentioned above.
I NPUT - DEPENDENT RS AND THE CURSE OF DIMENSIONALITY
Let C be the set of classes, f : R N −→ C a classiﬁer (reffered to as the base classiﬁer), σ : R N −→ R a non-negative function and P ( C ) a set of distributions over C .
Then we call G f : R N −→ P ( C ) the smoothed class probability predictor , if G f ( x ) C =
P
( f ( x + (cid:15) )
= C ) , where (cid:15) ∼ N (0 , σ ( x ) 2 I ) and g f : R N −→ C is called smoothed classiﬁer if g f ( x ) =
arg max C G f ( x ) C , for C ∈ C .
We will omit the subscript f in g f often, since it is usually clear from the context, to which base classiﬁer the g corresponds.
Furthermore, let A :=
g ( x ) refer to the most likely class under the random variable f
( N ( x, σ 2 I )) , while B denote the second most likely class.
Deﬁne p
A =
G f ( x ) A and p B =
G f ( x ) B as the respective probabilities.
It is important to note that in practice, it is impossible to estimate p A and p B precisely.
Instead, p A is estimated as a lower conﬁdence bound of the relative occurence of class A in f ’s predictions given certain number of Monte-Carlo samples n and a conﬁdence level α and the estimate is denoted as p A .
We use the exact Clopper-Pearson interval for estimation of the lower conﬁdence bound.
Similarly for p B .
Since we deal just with l 2 certiﬁcates, (cid:107) x (cid:107) will denote the l 2 -norm of x .
First of all, we summarize the main steps in the derivation of certiﬁed radius using any method that relies on a use of Neyman-Pearson lemma.
For a potential adversary x (cid:48) specify the worst-case classiﬁer f ∗ , such that P ( f ∗ ( N ( x, σ 2 I ))
= A ) =
p A , while P ( f ∗ ( N ( x (cid:48) , σ 2 I ))
= B ) is maximized.
Express the probability G f ∗ ( x (cid:48) )
B as a function depending on x (cid:48) .
Determine the conditions on x (cid:48) (possibly related to (cid:107) x − x (cid:48) (cid:107) ) for which this probability is ≤ 0 .
From these condtions, derive the certiﬁed radius.
Cohen et al.
(2019) proceeded in this way to obtain a tight certiﬁed radius R =
σ 2 (Φ − 1 ( p A ) − Φ − 1 ( p B )) .
Unfortunately, their result is not directly applicable to the input-dependent case.
The constant σ simpliﬁes the derivation of f ∗ that turns out to be a linear classiﬁer.
This is not the case for non-constant σ ( x ) anymore.
Therefore, we need to generalize the methodology of Cohen et al.
We put p B = 1 − p A for simplicity (yet it is not necessary to assume this, see Appendix B.4).
Let x 0 be the point to certify, x 1 the potential adversary point, δ = x 1 − x
the noise and σ 0 = σ ( x 0 ) , σ 1 = σ ( x 1 ) the standard deviations used in x 0 and x 1 respectively.
Furthermore, let f i be a density and P i a probability measure corresponding to N ( x i , σ 2 i I ) , i ∈ { 0 , 1 } .
Lemma 1.
Out of all possible classiﬁers f such that G f ( x ) B ≤ p B = 1 − p A , the one, for which
G f ( x + δ ) B is maximized is the one, which predicts class B in a region determined by the likelihood ratio:
[Equation]
where r is ﬁxed, such that P 0 ( B )
= p B .
Note, that we use B to denote both the class and the region of that class.
We use this lemma to compute the decision boundary of the worst-case classiﬁer f ∗ .
Theorem 2.
If σ 0 > σ 1 , then B is a N -dimensional ball with the center at S > and radius R > :
[Equation]
>
[Equation]
If σ 0 < σ 1 , then B is the complement of a N -dimensional ball with the center at S < and radius R < :
S <
= x −
[Equation]
As we depict on Figure 2, both resulting balls are centered on the line connecting x 0 , x 1 .
Moreover, the centers of the balls are always further from x 0 , than x 1 is from x 0 (even in the case σ 0 < σ 1 ).
In both cases, it depends on p A (since r is ﬁxed such that P
( B ) = p B ) and the ball can, but might not cover x 0 and/or x 1 .
Note that if σ 0 = σ 1 , what can happen even in input-dependent regime, the worst-case classiﬁer is the half-space described by Cohen et al.
To compute the probability of a ball under a probability measure with an isotropic Gaussian density is far more challenging than to compute the probability of a half-space.
In fact, there is no closedform formula for such probability.
However, this probability is connected to the non-central chisquare distribution (NCCHSQ).
More precisely, the probability of an N -dimensional ball centered at z with radius r under N (0 , I ) can be expressed as a cumulative distribution fucntion (cdf) of
NCCHSQ with N degrees of freedom, non-centrality parameter (cid:107) z (cid:107) 2 and argument r 2 .
With this knowledge, we can express P 0 ( B ) and P 1 ( B ) in terms of the cdf of NCCHSQ as follows.
Theorem 3.
[Equation]
where the sign < or > is chosen according to the inequality between σ 0 and σ 1 .
Note, that both Theorem 2 and Theorem 3 work well also for δ = 0 .
In this case, we encounter a ball centered at x 0 = x 1 and all the cdf functions become cdf functions of central chi-squared.
We expressed probabilities of the worst-case class B ’s decision region using the cdf of NCCHCSQ.
Now, how do we do the certiﬁcation?
We start with the certiﬁcation just for two points, x 0 and x 1 .
We question, under which circumstances can x 1 be certiﬁed from the point of view of x 0 .
Having x 0 , p A and σ 0 > σ 1 , we can obtain such R , that P 0 ( B ) =
χ 2 N (cid:0) (cid:107) δ (cid:107) 2 σ 20 / ( σ 20 − σ 21 ) 2 , R 2 (cid:1) =
1 − p A
=
p B simply by putting it into the quantile function: R 2 =
χ 2 N, qf (cid:0) (cid:107) δ (cid:107) 2 σ 20 / ( σ 20 − σ 21 ) 2 , 1 − p A (cid:1) .
Then, we can substitute into P 1 ( B ) =
χ 2 N (cid:0) (cid:107) δ (cid:107) 2 σ 21 / ( σ 20 − σ 21 ) 2 , R 2 σ 20 /σ 21 (cid:1) .
This way, we obtain P 1 ( B ) and can judge, whether P 1 ( B ) < 1 / 2 or not.
Similar computation can be done if σ 0 < σ 1 .
Denote a := (cid:107) δ (cid:107) .
We can express the P 1 ( B ) more simply for σ 0 > σ 1 as
[Equation]
and for σ 0 < σ 1 as
[Equation]
With this in mind, if we have x 0 , x 1 , p A , σ 0 , σ 1 , then we can certify x 1 w.r.t x 0 simply by choosing the correct sign ( <, > ) and computing ξ < ( (cid:107) x 0 − x 1 (cid:107) ) or ξ > ( (cid:107) x 0 − x 1 (cid:107) ) , comparing them with 0 . 5 .
The sample plots of these ξ functions can be found in Appendix B.
Now, we are ready to discuss the curse of dimensionality.
The problem that arises is that having a high dimension N and σ 0 , σ 1 differing a lot from each other, ξ functions are already big at 0, even for considerably small p B .
For ﬁxed ratio σ 0 /σ 1 and probability p B , with increasing dimension, the ξ (0) increases and soon becomes bigger than 0.5.
This, together with monotonicity of ξ function yields that any x 1 cannot be certiﬁed w.r.t.
x 0 , if σ 0 , σ 1 are used.
The more dissimilar the σ 0 and σare, the smaller the dimension N needs to be for this situation to occur.
If we want to certify x 1 in a reasonable distance from x 0 , we need to use similar σ 0 , σ 1 .
This restricts the variability of σ ( x ) function.
We will formalize the curse of dimensionality in the following theorems.
More on why the curse of dimensionality is present is in Appendix B.2.
Theorem 4 (curse of dimensionality) .
Let x 0 , x 1 , p A , σ 0 , σ 1 , N be as usual.
Then, the following two implications hold:
If σ 0 > σ 1 and
[Equation]
then x 1 is not certiﬁed w.r.t.
x 0 .
If σ 0 < σ 1 and log
[Equation]
then x 1 is not certiﬁed w.r.t.
x 0 .
Corollary 5 (one-sided simpler bound) .
Let x 0 , x 1 , p A , σ 0 , σ
[Equation]
N be as usual and assume now σ 0 > σ 1 .
Then, if
[Equation]
then x 1 is not certiﬁed w.r.t x 0 .
Note, that both Theorem 4 and Corrolary 5 can be adjusted to the case where we have a separate estimate p B and do not put p B =
1 − p A (see Appendix B.4).
We must emphasize, that the bounds obtained in Theorem 4 are very tight.
In other words, if the ratio σ 1 σ 0 is just slightly bigger than the minimal possible threshold determined in Theorem 4, ξ > (0) becomes smaller than 0 .
5 and similarly for ξ > (0) .
The reason for this is, that the only two estimates used in the proof of Theorem 4 are the estimates on the median, which are very tight and constant with respect to N and the Chernoff bound, which is generally considered to be tight too and improves for larger N .
The tightness is depicted on Figure 3, where we plot the minimal possible threshold σ 1 /σ 0 given by Theorem 4 and minimal threshold for which ξ > (0) < 0 .
5 as a function of N .
To get a better feeling about the concrete numbers, we provide a simple table, which shows the theoretical threshold values provided by Theorem 4.
If σ 1 /σ 0 is smaller than the threshold, we are not able to certify any pair of x 0 , x 1 using σ 0 , σ 1 .
[Table]
Results from Table 1 are very restrictive.
Assume we have a CIFAR10 sample with p
A = 0 .
For such a probability, constant σ = 0 . 5 is more than sufﬁcient to guarantee the certiﬁed radius of more than 1.
However, in the non-constant regime, to certify R ≥ 1 , we ﬁrst need to guarantee that no sample within the distance of 1 from x 0 uses σ 1 < 0 .
953 σ 0 .
To even strengthen this statement, note that one needs to guarantee σ 1 to be even much closer to σ 0 in practice. Why?
The results of Theorem 4 lower-bound the ξ functions at 0.
However, since ξ functions are strictly increasing (as shown in Appendix F), one usually needs σ 0 and σ 1 to be much closer to each other to guarantee ξ being smaller than 0 .
5 at a (cid:29) 0 .
This not only forces the σ ( x ) function to have really small semielasticity but also makes it problematic to deﬁne a stochastic σ ( x ) , since then the guarantees about its bounded semi-elasticity hold just probabilistically.
See Appendix B.2 for further discussions.
Even though the curse of dimensionality strikes hard against the IDRS, it is important to realize that it does not make it theoretically infeasible.
The reason for this is, that while the semi-elasticity constant of σ ( x ) is being forced to be smaller and smaller as N increases (approximately like 1 / √ N ), the average distance between two samples increases as √ N .
Therefore, even though we have to change the σ more slowly, we could potentially achieve the same percentual change of the σ in-between two samples, regardless of the dimension.
The problem is, however, that this maximal allowed percentual change is still quite small in practice and further numerical issues arise when using σ ( x ) which varies too slowly (see Section 3).
H OW TO USE INPUT - DEPENDENT SMOOTHING PROPERLY
As we discuss above, usage of IDRS is challenging.
How can we use σ ( x ) and obtain valid, mathematically justiﬁed certiﬁed radiuses?
Fix some design σ ( x ) .
If σ ( x ) is not trivial, to obtain a certiﬁed radius at x 0 , we need to go over all the possible adversaries x 1 in the neighborhood of x 0 , compute σ 1 and ξ <,> ( a ) .
Then, the certiﬁed radius is the inﬁmum over (cid:107) x 0 − x 1 (cid:107) for all uncertiﬁed x 1 points.
Of course, this is a priori infeasible.
Fortunately, the ξ functions possess a property that helps to simplify this procedure.
For convenience, we extend the notation of ξ functions such that ξ ( a, σ 1 ) additionally denotes the dependance on the σ 1 value.
Theorem 6.
Let x 0 , x 1 , p A , σ 0 be as usual and let (cid:107) x 0 − x 1 (cid:107) =
R .
Then, the following two statements hold:
Let σ 1 ≤ σ 0 .
Then, for all σ 2 : σ 1 ≤ σ 2 ≤ σ 0 , if ξ > ( R, σ 2 ) > 0 . 5 , then ξ > ( R, σ 1 ) > 0 .
Let σ 1 ≥ σ 0 .
Then, for all σ 2 : σ 1 ≥ σ 2 ≥ σ 0 , if ξ < ( R, σ 2 ) > 0 . 5 , then ξ < ( R, σ 1 ) > 0 . 5 .
Theorem 6 serves as a kind of monotonicity property.
The main gain is that now, for each distance
R from x 0 , we need to pick just two adversaries – the one with biggest σ 1 (if bigger than σ 0 ) and the one with the smallest σ 1 (if smaller than σ 0 ).
If we cannot certify some point x 1 at the distance
R from x 0 , then we will for sure not be able to certify at least one of the two adversaries with the most extreme σ 1 values.
This does, however, not sufﬁce for most of the reasonable σ ( x ) designs, since it might be still too hard to determine the two most extreme σ 1 ’s at some distance from x 0 .
Therefore, we need to assume that our σ ( x ) has a bounded semi-elasticity coefﬁcient r .
Then we have a guarantee that σ ( x 0 ) exp( − ra ) ≤ σ ( x 1 ) ≤ σ ( x 0 ) exp( ra ) .
Thus, we can assume the worst-case extreme σ 1 ’s for every distance a from x 0 .
Using this, we guarantee the following certiﬁed radius.
Theorem 7.
Let σ ( x ) be r -semi-elastic function and x 0 , p A , N, σ 0 as usual.
Then, the certiﬁed radius at x 0 guaranteed by our method is
CR ( x 0 ) = max { 0 , sup { R ≥ 0; ξ > ( R, σ 0 exp( − rR )) < 0 .
5 and ξ < ( R, σ 0 exp( rR )) < 0 . 5 }} .
Note that Theorem 7 can be adjusted to the case where we have a separate estimate p B and do not put p B =
1 − p A (see Appendix B.4).
Since the bigger the semi-elasticity constant of σ ( x ) is, the worse certiﬁcations we obtain, it is important to estimate the constant tightly.
Even with a good estimate of r , we still get smaller certiﬁed radiuses in comparison with using the σ ( x ) exactly, but that is a prize that is inevitable for the feasibility of the method.
The practical algorithm is then very easy - we just need to pick sufﬁciently dense space of possible radiuses and determine the smallest, for which either ξ > ( R, σ 0 exp( − rR )) or ξ <
( R, σ 0 exp( rR )) becomes bigger than a half.
The only non-trivial part is, how to evaluate the ξ functions.
For small values of R , the exp( − rR ) is very close to 1 and from the deﬁnition of ξ functions it is obvious that this results in extremely big inputs to the cdf and quantile function of NCCHSQ.
To avoid numerical problems, we employ a simple hack where we assume thresholds for σ 1 such that for
R small enough, these thresholds are used instead of σ 0 exp( ± rR )) .
Unfortunately, the numerical stability still disables the usage of this method on really high-dimensional datasets like ImageNet.
For more details on implementation, see Appendix D.
T HE DESIGN OF σ ( x ) AND EXPERIMENTS
The only missing ingredient to ﬁnally being able to use IDRS is the σ ( x ) function.
As we have seen, this function has to be r -semi-elastic for rather small r and ideally deterministic.
Yet it should at least roughly fulﬁll the requirements imposed by the motivation – it should possess big values for points far from the decision boundary of f and rather small for points close to it.
Adhering to these restrictions, we use the following function:
[Equation]
[Equation]
for σ b being a base standard deviation , r being the required semi-elasticity, { x i } di =1 the training set,
N k ( x ) the k nearest neighbors of x and m the normalization constant.
Intuitively, if a sample is far from all other samples, it will be far from the decision boundary, unless the network overﬁts to this sample.
On the other hand, the dense clusters of samples are more likely to be positioned near the decision boundary, since such clusters have a high leverage on the network’s weights, forcing the decision boundary to adapt well to the geometry of the cluster.
To use such a function, however, we ﬁrst prove that it is indeed r -semi-elastic.
Theorem 8.
The σ ( x ) deﬁned in equation 1 is r -semi-elastic.
We test our IDRS and our σ ( x ) functions extensively.
For both CIFAR10 (Krizhevsky, 2009) and MNIST (LeCun et al., 1999) datasets, we analyze series of different experimental setups, including experiments with an input-dependent train-time Gaussian data augmentation.
We present a direct comparison of our method with the constant σ method using evaluation strategy from Cohen et al.
(2019) (all other experiments, including ablation studies, and the discussion on the hyperparameter selection are presented in Appendix E).
Here, we compare Cohen et al.
(2019)’s
evaluations for σ = 0 .
50 with our evaluations, setting σ b = σ , r = 0 .
01 , k = 20 , m = 5 , 1 . 5 (for CIFAR10 and MNIST, respectively), applied on models trained with Gaussian data augmentation, using constant standard deviation roughly equal to the average test-time σ ( x ) or test-time σ .
For CIFAR10, these levels of train-time standard deviation are σ tr = 0 . 126 , 0 . 263 , 0 .
53 and for MNIST
σ tr = 0 . 124 , 0 .
In this way, the levels of σ ( x ) we use in the direct comparison are spread from the values roughly equal to Cohen et al.
(2019)’s constant σ to higher values.
The results are depicted in Figure 4.
From Figure 4 we see that we outperform the constant σ for small levels of σ , such as 0 .
12 or 0 . 25 .
On higher levels of σ , we are, in general, worse (see explanation in Appendix B.3).
The most visible improvement is in mitigation of the truncation of certiﬁed accuracy (certiﬁed accuracy waterfall).
To comment on the other two issues, we provide Tables 2 and 3 with the clean accuracies and classwise accuracy standard deviations.
These results are averages of 8 independent runs and in Table 2, the displayed error values are equal to empirical standard deviations.
From Tables 2 and 3, we draw two conclusions - ﬁrst, it is not easy to judge about the robustness vs. accuracy trade-off, because the differences in clean accuracies are not statistically signiﬁcant in [Table] [Table] any of the experiments (not even for CIFAR10 and σ = 0 .
25 , where the difference is at least pronounced).
However, the general trend in Table 2 indicates that the clean accuracies tend to slightly decrease with increasing rate.
Nevertheless, the differences are not large enough to compensate negatively the fact that we outperform constant σ in terms of the certiﬁed accuracies.
Second, the standard deviations of the class-wise accuracies, which serve as a good measure of the impact of the shrinking phenomenon and subsequent fairness, don’t signiﬁcantly change after applying the non-constant RS.
R ELATED WORK
Since the vulnerability of deep neural networks against adversarial attacks has been noticed by
Szegedy et al.
; Biggio et al.
(2013) a lot of effort has been put into making neural nets more robust.
There are two types of solutions – empirical and certiﬁed defenses.
While empirical defenses suggest heuristics to make models robust, certiﬁed approaches additionally provide a way to compute a mathematically valid robust radius.
One of the most effective empirical defenses, adversarial training (Goodfellow et al., 2014; Kurakin et al., 2016; Madry et al., 2017), is based on a very intuitive idea to use adversarial examples for training.
Unfortunately, together with adversarial training, other promising empirical defenses were subsequently broken by more sophisticated adversarial methods (for instance Carlini & Wagner (2017); Athalye & Carlini (2018); Athalye et al.
(2018), among many others).
Among many certiﬁed defenses (Tsuzuku et al., 2018; Anil et al., 2019; Hein & Andriushchenko, 2017; Wong & Kolter, 2018; Raghunathan et al., 2018; Mirman et al., 2018; Weng et al., 2018), one of the most successful yet is RS.
While Lecuyer et al.
(2019) introduced the method within the context of differential privacy, Li et al.
(2019) proceeded via the knowledge of R´enyi divergences.
Possibly the most prominent work on RS is that of Cohen et al.
Here, authors not only cleared RS from other contexts and promoted it to a self-standing topic, but also improved the theoretical results of the previous two papers, establishing tight certiﬁcation guarantees.
Later, a lot of authors further worked with RS.
The work of Yang et al.
(2020) generalizes the certiﬁcation provided by Cohen et al.
(2019), to certiﬁcations with respect to the general l p norms and provide the optimal smoothing distributions for each of the norms.
Other works point out different problems or weaknesses of RS like the curse of dimensionality (Kumar et al., 2020; Hayes, 2020; Wu et al., 2021), robustness vs. accuracy trade-off (Gao et al., 2020) or a shrinking phenomenon(Mohapatra et al., 2020a), which yields serious fairness issues (Mohapatra et al., 2020a).
The work of Mohapatra et al.
(2020b) improves RS further by introducing the ﬁrst-order information about g .
In this work, authors not only estimate g ( x ) , but also ∇ g ( x ) , making more restrictions on the possible base models f that might have created g .
Zhai et al.
(2020) and Salman et al.
(2019) improve the training procedure of f to yield better robustness guarantees of g .
Salman et al.
(2019) directly use adversarial training of the base classiﬁer f .
Finally, Zhai et al.
(2020) introduce socalled soft smoothing , which enables to compute gradients directly for g and construct a training method, which optimizes directly for the robustness of g via the gradient descent.
To address several issues connected to randomized smoothing, there have been already four works that introduce the usage of IDRS.
Wang et al.
(2021) divide R N into several regions
R i , i ∈ { 1 , . . .
, K } and optimize for σ i , i ∈ { 1 , . .
, K } locally, such that σ i is a most suitable choice for the region R i .
Yet this work partially solves some problems of randomized smoothing, it also possesses some practical and philosophical issues (see Appendix C).
Alfarra et al.
Eiras et al.
; Chen et al.
(2021), suggest to optimize for locally optimal σ i , for each sample x
i from the test set.
A similar strategy is proposed by these works in the training phase, with the intention of obtaining the base model f
that is most suitable for the construction of the smoothed classiﬁer g .
They demonstrate, that by using this input-dependent approach, one can overcome some of the main problems of randomized smoothing.
However, as we demonstrate in Appendix C, their methodology is not valid and therefore their results are not trustworthy.
Overall, there is no method that correctly generalizes the approach Cohen et al.
for the usage of not locally constant σ .
C ONCLUSIONS
We show in this work that input-dependent randomized smoothing suffers from the curse of dimensionality.
In the high-dimensional regime, the usage of input-dependent σ ( x ) is being put under strict constraints.
The σ ( x ) function is forced to have very small semi-elasticity.
This is in conﬂict with some recent works, which have used the input-dependent randomized smoothing without mathematical justiﬁcation and therefore claim invalid results.
It seems that input-dependent randomized smoothing has limited potential of improvement over the classical, constant- σ RS.
Moreover, due to numerical instability, the computation of certiﬁed radiuses on high-dimensional datasets like ImageNet remains to be an open challenge.
On the other hand, we prepare a ready-to-use mathematically underlined framework for the usage of the input-dependent RS and show, that it works well for small to medium-sized problems.
We also show via extensive experiments, that our concrete design of the σ ( x ) function reasonably treats the truncation issue connected to constant- σ RS and is partially capable of mitigating the robustness vs. accuracy one.
The most intriguing and promising direction for the future work lies in the development of new σ ( x ) functions, which are capable of even better treatment of the mentioned issues.
R EPRODUCIBILITY STATEMENT
Both our theoretical and practical results and experiments are reproducible.
In the theoretical part, we provide all the relevant proofs, insights and all the important reasoning.
We use public datasets for our experiments and our code contains just public, well-known libraries.
The code will be publicly available after the review process.
We do not use seeds for stochastic algorithms but the level of variance is not large enough to obtain qualitatively different results.
Upon request, we are willing to provide models trained by us to obtain exactly the same results.
A T HE ISSUES OF CONSTANT σ SMOOTHING A. T OY EXAMPLE
To better demonstrate our ideas we prepared a two-dimensional simple toy dataset.
This dataset can be seen in Figure 5.
The dataset is generated in polar coordinates having uniform angle and the distance distributed as a square root of suitable chi-square distribution.
The classes are positioned in a circle sectors, one in a sector with a very sharp angle.
The number of training samples isfor each class, number of test samples is 100 for each class (except demonstrative ﬁgures where we increased it to 300).
The model that was trained on this dataset was a simple fully connected three-layer neural network with ReLU activations and a maximal width of 20.
A. U NDERCERTIFICATION CAUSED BY THE USE OF LOWER CONFIDENCE BOUNDS
As we mention in Section one can not usually obtain exact values of p A and p B .
However, it is obvious, that for vast majority of evaluated samples, p A < p A and p B > p B .
Given the nature of our certiﬁed radius, it follows that R < R , where R denotes the certiﬁed radius coming from the certiﬁcation procedure with p A and p B , while R here stands for the certiﬁed radius corresponding to true values p A , p B .
It is, therefore, clear, that we face a certain level of under-certiﬁcation.
But how serious undercertiﬁcation it is?
Assume the case with a linear base classiﬁer.
Imagine, that we move the point x further and further away from the decision boundary.
Therefore, p A −→ 1 .
At some point, the probability will be so large, that with high probability, all n samplings in our evaluation of p A will be classiﬁed as A , obtaining ˆ
p A
= 1 - the empirical probability.
The lower conﬁdence bound p A is therefore bounded by having ˆ p A = 1 .
Thus, from some point, the certiﬁcation will yield the same p
A regardless of the true value of p A .
So in practice, we have an upper bound on the certiﬁed radius
R in the case of the linear boundary.
In Figure 7 (left), we see the truncation effect.
Using σ = 1 , from a distance of roughly 4, we can no longer achieve a better certiﬁed radius, despite its theoretical value equals the distance.
Similarly, if we ﬁx a distance of x from decision boundary and vary σ , for very small values of σ , the value of Φ − 1 ( p A ) will no longer increase, but the values of σ will pull R towards zero.
This behaviour is depicted in Figure 7 (right).
We can also look at it differently - what is the ratio between Φ − 1 ( p A ) and Φ − 1 ( p A ) for different values of p A ?
Since R =
σ Φ − 1 ( p A ) and R =
σ Φ − 1 ( p A ) , the ratio represents the “undercertiﬁcation rate”.
In Figure 6 we plot Φ − 1 ( p A )
Φ − 1 ( p A ) as a function of p A for two different ranges of values.
The situation is worst for very small and very big values of p A .
In the case of very big values, this can be explained due to extreme nature of Φ − 1 .
For small values of p A , it can be explained as a consequence of a fact, that even small difference between p A and p A will yield big ratio between Φ − 1 ( p A ) and Φ − 1 ( p A ) due to the fact, that these values are close to 0.
If we look at the left plot on Figure 8 we see, that the certiﬁed accuracy plots also possess the truncations.
Above some radius, no sample is certiﬁed anymore.
The problem is obviously more serious for small values of σ .
On the right plot of Figure 8, we see, that samples far from the decision boundary are obviously under-certiﬁed.
We can also see, that certiﬁed radiuses remain constant, even though in reality they would increase with increasing distance from the decision boundary.
All the observations so far motivate us to use rather large values of σ in order to avoid the truncation problem.
However, as we will see in the next sections, using a large σ carries a different, yet equally serious burden.
A. R OBUSTNESS VS . ACCURACY TRADE - OFF
As we demonstrate in the previous subsection, it is be useful to use large values of σ to prevent the under-certiﬁcation.
But does it come without a prize?
If we have a closer look at Figure 8 (right), we might notice, that the accuracy on the threshold 0 , i.e. “clean accuracy”, decreases as σ increases.
This effect has been noticed in the literature (Cohen et al., 2019; Gao et al., 2020; Mohapatra et al., 2020a) and is called robustness vs. accuracy tradeoff .
There are several reasons, why this problem occurs.
Generally, changing σ changes the decision boundary of g and we might assume, that due to the high complexity of the boundary of f , the decision boundary of g becomes smoother.
If σ is too large, however, the decision boundary will be so smooth, that it might lose some amount of the base classiﬁer’s expressivity.
Another reason for the accuracy drop is also the increase in the number of samples, for which the evaluation is abstained.
This is because using big values of σ makes more classes “within the reach of our distribution”, making the p A and p A small.
If p A < 0 .
and we do not estimate p B but set p B = 1 − p A , then we are not able to classify the sample as class A , yet we cannot classify it as a different class either, which forces us to abstain.
To demonstrate these results, we computed not only the clean accuracies of Cohen et al.
(2019) evaluations but also the abstention rates.
Results are depicted in the Table
From the table it is obvious that the abstention rate is possibly even bigger cause of accuracy drop than the “clean misclassiﬁcation”.
This problem can be partially solved if one estimated p B together [Table] with p A too.
In this way, using big σ yields generally small estimated class probabilities, but since p A ≥ p B , the problematic p B ≥ p
A occur just very rarely.
Another option is to increase the number of Monte-Carlo samplings for the classiﬁcation decision, what is almost for free.
Yet another reason for the decrease in the accuracy is the so-called shrinking phenomenon , which we will discuss in the next subsection.
In contrast with the truncation effect, the robustness vs. accuracy trade-off motivates the usage of smaller values of σ in order to prevent the accuracy loss, which is deﬁnitely a very serious issue.
A. S HRINKING PHENOMENON
How exactly does the decision boundary of g change, as we change the σ ?
For instance, if f is a linear classiﬁer, then the boundary does not change at all.
To answer this question, we employ the following experiment: For our toy base classiﬁer f on our toy dataset, we increase σ and plot the heatmap of f, g , together with its decision boundary.
This experiment is depicted on Figure 9.
As we see from the plots, increasing σ causes several effects.
First of all, the heatmap becomes more and more blurred, what proves, that stronger smoothing implies stronger smoothness.
Second, crucial, effect is that the bigger the σ , the smaller the decision boundary of a submissive class is.
The shrinkage becomes pronounced from σ = 1 .
Already for σ = 4 , there is hardly any decision boundary anymore.
Generally, as σ −→ ∞ , g will predict the class with the biggest volume in the input space (in the case of bounded input space, like in image domain, this is very well deﬁned).
For extreme values of sigma, the p A will practically just be the ratio between the volume of A and the actual volume of the input space (for bounded input spaces).
Following from these results, but also from basic intuition, it seems, that an undesired effect becomes present as σ increases - the bounded/convex regions become to shrink, like in Figure 9, while the unbounded/big/anti-convex regions expand.
This is called shrinking phenomenon .
Mohapatra et al.
(2020a) investigate this effect rather closely.
They deﬁne the shrinkage and vanishing of regions formally and prove rigorously, that if σ −→ ∞ , bounded regions, or semi-bounded regions (see
Mohapatra et al.
(2020a)) will eventually vanish.
We formulate the main result in this direction.
Theorem 9.
Let us have K the number of classes and the dimension N .
Assume, that we have some bounded decision region D for a speciﬁc class roughly centered around 0.
Further assume, that this is the only region where the class is classiﬁed.
Let R be a smallest radius such that D ⊂ B R (0) .
Then, this decision region will vanish at most for σ ≥ R √ K √ N .
Proof.
The idea of the proof is not very hard.
First, the authors prove, that the smoothed region will be a subset of the smoothed B R (0) .
Then, they upper-bound the vanishing threshold of such a ball in two steps.
First, they show, that if 0 is not classiﬁed as the class, then no other point will be (this is quite an intuitive geometrical statement.
The B R (0) has the biggest probability under N ( x, σ 2 I ) if x ≡ 0 ).
Second, they upper-bound the threshold for σ , under which B R (0) will have probability below 1 K (since they use slightly different setting as Cohen et al.
for the N ( x, σ 2 I ) .
Using some insights about incomplete gamma function, which is known to be also the cdf of central chisquare distribution, and some other integration tricks, they obtain the resulting bound.
Besides Theorem 9, authors also claim many other statements abound shrinking, including shrinking of semi-bounded regions.
Moreover, they also conduct experiments on CIFAR10 and ImageNet to support their theoretical ﬁndings.
They also point out serious fairness issue that comes out as a consequence of the shrinkage phenomenon.
For increasing levels of σ , they measure the class-wise clean accuracy of the smoothed classiﬁer.
If f is trained with gaussian data augmentation (what is known to be a good practice in randomized smoothing), using σ = 0 .
12 , the worst class cat has test accuracy of 67%, while the best class automobile attains the accuracy of 92%.
The ﬁgures, however, change drastically, if we use σ = 1 instead.
In this case, the worst predicted class cat has accuracy of poor 22%, while ship has reasonable accuracy 68%.
As authors claim, this is a consequence of the fact that samples of cat are situated more in bounded, convex regions, that suffer from shrinking, while samples of ship are mostly placed in expanded regions of anti-convex shape that will expand as the σ grows.
In addition, the authors also show, that the gaussian data augmentation or adversarial training will reduce the shrinking phenomenon just partially and for moderate and high values of σ , this effect will be present anyway.
We must emphasize, that this is a serious fairness issue, that has to be treated before randomized smoothing can be fully used in practice.
For instance, if we trained a neural network to classify humans into several categories, fairness of classiﬁcation is inevitable and the neural network cannot be used until this issue is solved.
Similarly as the robustness vs. accuracy tradeoff, this issue also motivates to use rather smaller values of σ .
We see, that it is not possible to address all three problems consistently because they disagree on whether to use smaller, or bigger values of σ .
B M ORE ON THEORY B. G ENERALIZATION OF RESULTS FROM L I ET AL . (2019)
In our main text, we mostly focus on the generalization of the methods from Cohen et al.
This is because these methods yield tight radiuses and because the application of Neyman-Pearson lemma is beautiful.
However, the methodology from Li et al.
(2019) can also be generalized for the input-dependent RS.
To be able to do it, we need some auxiliary statements about the R´enyi divergence.
Lemma 10.
The R´enyi divergence between two one-dimensional normal distributions is as follows:
[Equation]
provided, that σ 2 α :=
(1 − α ) σ 2 1 + ασ 2 0 ≥ 0 .
Proof.
See Van Erven & Harremos (2014).
Note, that this proposition induces some assumptions on how σ 0 , σ 1 , α should be related.
If σ 0 > σ 1 , then the required inequality holds for any 1 (cid:54) =
α > 0 .
If σ 0 < σ 1 , then α is restricted and we need to keep that in mind.
Lemma 11.
Assume, we have some one-dimensional distributions P 1 , P 1 , . .
. , P N and
Q 1 , Q 2 , . .
. , Q N deﬁned on common space for pairs with the same index.
Then, assuming product space with product σ -algebra, we have the following identity:
[Equation]
Proof.
See Van Erven & Harremos (2014).
Using these two propositions, we are now able to derive a formula for R´enyi divergence between two multivariate isotropic normal distributions:
Lemma 12.
[Equation]
Proof.
Imporant property that is needed here is, that isotropic gaussian distributions factorize to one-dimensinal independent marignals.
In other words:
[Equation]
and analogically for x 0 .
Therefore, using Lemma 11 we see:
[Equation]
Now, it sufﬁces to plug in the formula from Proposition 10 to obtain the required result:
[Equation]
Now it sufﬁces to sum up over i and the result follows.
To obtain the certiﬁed radius, we also need a result from Li et al.
(2019), which gives a guarantee that two measures on the set of classes will share the modus if the Rnyi divergence between them is small enough.
Lemma 13.
Let P =
( p 1 , p 2 , . . .
, p K ) and Q = ( q 1 , q 2 , . . .
, q K ) two discrete measures on C .
Let p A , p B correspond to two biggest probabilities in distribution P .
Let M 1 ( a, b ) = a + band
[Equation]
then the distributions P and Q agree on the class with maximal assigned probability.
Proof.
This lemma can be proved by directly computing the minimal
required D
α to be able to disagree on the maximal class probabilities via a constrained optimization problem (with variables p i , q i , i ∈ { 1 , . .
, K } ), solving KKT
Having explicit formula for the Rnyi divergence, we can mimic the methodology of Li et al.
(2019) to obtain the certiﬁed radius:
Theorem 14.
Given x 0 , p A , p B , σ 0 , N , the certiﬁed radius squared for all x 1 such that ﬁxed σ 1 is used is:
[Equation]
where S σ 0 ,σ 1 = R + , if σ 0 > σ 1 and S σ 0 ,σ 1 = (cid:16) 0 ,
[Equation]
Proof.
Let us ﬁx x 1 and assume, that α ∈ S σ 0 ,σ 1 .
Then, due to post-processing inequality for Renyi divergence, it follows that
[Equation]
Due to Lemma 13, it sufﬁces that the following inequality holds for some α ∈ S σ 0 ,σ 1 :
[Equation]
+ N log [Equation] (cid:18)
[Equation]
− log(
[Equation]
p
[Equation]
p
[Equation]
( p
[Equation]
p B )) .
This can be rewritten w.r.t.
(cid:107) x 0 − x 1 (cid:107) 2 : (cid:107)
[Equation]
(cid:107)
[Equation]
[Equation]
[Equation]
[Equation]
(cid:32)
N
[Equation]
(cid:18)
[Equation]
(cid:19) − N
[Equation]
[Equation]
p [Equation] )) (cid:33) . The resulting certiﬁed radius squared is now simply obtained by taking maximum over (cid:107) x 0 − x 1 (cid:107)s.t.
∃ α ∈ S σ 0 ,σ 1 such that the preceding inequality holds.
Note, that this theorem is formulated assuming, that except in x 0 , we use σ 1 everywhere.
It would require some further work to generalize this for general σ ( x ) functions, but to demonstrate the next point, it is not even necessary.
Looking at the expression, we can observe that
[Equation]
depends highly on N and even for a ratio of σ 0 σ 1 close to 1, we already obtain very strong negative values for high dimensions.
The expression log(1 − 2 M 1 ( p A , p B ) + 2 M 1 − α
( p A , p B )) is far less sensitive w.r.t p A and for large dimensions of N it is easily “beaten” by the ﬁrst expression.
Therefore, the higher the dimension N is, the bigger p A or the closer to 1 the σ 0 σ 1 has to be in order to obtain even valid certiﬁed radius (not to speak about big).
This points out that also the method of Li et al.
(2019) suffers from the curse of dimensionality, as we know it must have done.
This method is not useful for big N , because the conditions on p A , σ 0 , σ 1 are so extreme, that barely any inputs would yield a positive certiﬁed radius.
This fact is depicted in the Figure 10.
The key reason why this happens if done via R´enyi divergences is that while the divergence
D α ( N ( x 1 , σ 21 I ) ||N ( x 0 , σ 20 I )) grows independently of dimension as (cid:107) x 0 − x 1 (cid:107) grows, it drastically increases for big N even if x 1 = x 0 !
This reﬂects the effect, that if σ 0 (cid:54) = σ 1 , then the more dimensions we have, the more dissimilar are N ( x 1 , σ 21 I ) and N ( x 0 , σ 20 I )) .
We can think of it as a consequence of standard fact from statistics that the more data we have, the more conﬁdent statistics against the null hypothesis σ 0 = σ 1 will we get if the null hypothesis is false.
Since isotropic normal distributions can be actually treated as a sample of one-dimensional normal distributions, this is in accordance with our multivariate distributions setting.
B. T HE EXPLANATION OF THE CURSE OF DIMENSIONALITY
In the Section 2 we show that input-dependent RS suffers from the curse of dimenisonality.
Now we will elaborate a bit more on this phenomenon and try to explain why it occurs.
First, it is obvious from the Subsection B.1, that also the generalized method of Li et al.
(2019) suffers from the curse of dimensionality, because the R´enyi divergence between two isotropic Gaussians with different variances grows considerably with respect to dimension.
This suggests that the input-dependent RS might suffer from the curse of dimensionality in general.
To motivate this idea even further, we present this easy observation:
Theorem 15.
Denote R C to be a certiﬁed radius given for p A and σ 0 at x 0 assuming the constant σ 0 and following the certiﬁcation of Cohen et al.
Assume, that we do the certiﬁcation for each x 1 by assuming the worst case-classiﬁer as in Theorem 2.
Then, for any x 0 , any function σ ( x ) and any p A , the following inequality holds:
[Equation]
Proof.
Fix x 1 and σ 1 .
From Theorem 2 we know that the worst-case classiﬁer f ∗ deﬁnes a ball B such that P
( B ) = 1 − p A .
From this it obviously follows, that the linear classiﬁer f l and the linear space B l that assume constant σ 0 also for x 1 and is the worst-case for σ 0 such that P
( B l ) =
− p A is not worst-case for the case of using σ 1 instead.
Therefore, P 1 ( B l ) ≤ P 1 ( B ) .
Moreover, let P C 1 be a probability measure corresponding to N ( x 1 , σ 0 I ) , i.e. the probability measure assuming constant σ 0 .
It is easy to see that P C 1 ( B l ) > 0 .
5 ⇐⇒ P 1 ( B l ) > 0 .
5 because the probability of a linear half-space under isotropic normal distribution is bigger than half if
and only if the mean is contained in the half-space.
Assume, for contradiction that R > R C .
From that, it exists a particular x 1 such that P C 1 ( B l ) > 0 .
5 > P 1 ( B ) , because otherwise there would be no such point, which would cause R > R C .
However, P C 1 ( B l ) > 0 .
5 = ⇒ P 1 ( B l ) > 0 .
5 , thus P 1 ( B l ) >
P 1 ( B ) and that is contradiction.
This theorem shows, that we can never achieve a better certiﬁed radius at x 0 using σ 0 and having probability p A than that, which we would get by Cohen et al.
(2019)’s certiﬁcation.
Of course, this does not mean, that using non-constant σ is useless, since σ 0 can vary.
The question is, how much do we lose using non-constant σ .
To get a better intuition, we plot the functions ξ < and ξ > under different setups in Figure 11, together with P 1 ( B l ) from the proof of Theorem 15.
From the top row we can deduce that dimension N has a very signiﬁcant impact on the probabilities and therefore also on the certiﬁed radius.
We particularly point out the fact, that even ξ > (0) , ξ < (0) can have signiﬁcant margin w.r.t.
to the probability coming out of linear classiﬁer.
Already for N = 90 , we are not able to certify p
A = 0 .
99 for rather conservative value of σ 0 σ 1 .
From middle row we see, that decreasing σ 0 σ 1 can mitigate this effect strongly.
For instance, for σ 0 = 1 , σ 1 = 0 .
95 the difference between
P 1 ( B ) and P 1 ( B l ) is almost negotiated.
Bottom row compares ξ > ( a ) , ξ < ( a ) and the respective linear classiﬁer probabilities.
We can see, that the case σ 0 < σ 1 might cause stronger restrictions on our certiﬁcation (yet we deduce it just form the picture).
What is the reason for ξ > ( a ) , ξ < ( a ) being so big even at 0?
The problem is following: Assume σ 0 > σ 1 .
If x 0 = x 1 , the worst-case classiﬁer coming from Lemma 2 will be a ball B centered right at x 0 , such that P
( B ) = 1 − p A .
If we look at P 1 ( B ) , we see, that we have the same ball centered directly at the mean, but the variance of the distribution is smaller.
Using spherical symmetry of the isotropic gaussian distribution, this is equivalent to evaluating the probability of a bigger ball.
If we ﬁx σ 0 σ 1 and look at the ratio of probabilities P 1 ( B ) P 0 ( B ) with increasing N , the curse of dimensionality comes into the game.
For N = 2 , the ratio is not too big.
However, if N = 3072 , like in CIFAR10, this ratio is far bigger.
This can be intuitively seen from a property of chi-square distribution (which is present in the case x 0 = x 1 ), that while expectation is N , the standard deviation is “just” √ 2 N , i.e.
[Equation]
B. W HY DOES THE INPUT - DEPENDENT SMOOTHING WORK BETTER FOR SMALL σ VALUES ?
As can be observed in Section 4 and Appendix E, the bigger the σ b = σ we use, the harder it is to keep up to standards of constant smoothing.
An interesting question is, why is the usage of small σ b = σ helpful for the input-dependent smoothing?
Assume ﬁxed σ , say σ b = σ = 0 .
The theoretical bound on the certiﬁed radius given
Monte-Carlo samplings and 0.001 conﬁdence level using constant smoothing is about 0.48.
Having σ ( x ) ∼ 0 .
12 , we cannot expect much bigger certiﬁed radius.
Therefore, if we follow Theorem 7, the values of exp( − rR ) and exp( rR ) in the critical distance ∼ 0 .
5 will be much closer to 1, than the values of exp( − rR ) and exp( rR ) if we used σ b = σ = 0 .
50 instead, where the critical values of R could be much bigger than 0.5.
Therefore, the “gain” in P 1 ( B ) imposed by the curse of dimensionality, compared to P 1 ( B ) assuming constant σ will not be that severe yet.
This means, that the loss in certiﬁed radius caused by the curse of dimensionality will be much less pronounced on the “active” range of certiﬁed radiuses (those for which the constant smoothing still works), compared to using big σ b = σ .
To support this idea, we demonstrate it on Figure 12, where we depict the certiﬁed radius as a function of distance from decision boundary, assuming f to be a linear classiﬁer, using σ b = σ = 0 .
12 and σ b =
σ = 0 .
50 for comparison.
B. D OES THE CURSE OF DIMENSIONALITY APPLY IN MULTI - CLASS REGIME ?
In the main text, we presented a setup, where p B is set to be 1 − p A .
This is equivalent to pretending that we have just 2 classes.
By not estimating the proper value of p B we lose some amount of power and the resulting certiﬁed radius is smaller than it could have been, did we have the p B as well.
This is most pronounced for datasets with many classes.
The natural question, therefore, is, whether we could avoid the curse of dimensionality by properly estimating the p B together with p A .
The answer is no.
The problem is that the the theory in Section 2 already implicitly works with the estimate of p B in a form of 1 − p A .
The theory would work also with any other estimate of p B .
Assuming constant p B , instead of constant p A , as we did in Section 2, will, therefore, yield the same conclusions.
Moreover, there is neither theoretical, nor practical reason, why should p B decrease with increasing dimension.
This insight even applies to the question of the usage of input-dependent RS in practice.
The assumption p B = 1 − p
A is no more important in Section 3 than in Section 2.
Therefore, we can apply our method also for the p B obtained directly by Monte-Carlo sampling for the class B (or by any other estimation method).
C C ONCURRENT WORK
As we mention in Section 1, the idea to use input-dependent RS is not new.
It has popped out in years 2020 and 2021 in at least four works from three completely distinct groups of authors, even though none of these works has been successfully published yet.
We ﬁnd it necessary to comment on all of these works because of two orthogonal reasons.
First, it is a good practice to compare our work with the concurrent work to see what are pros and cons of these similar approaches and to what extend the approaches differ.
Second, we are convinced, that three of these four works claim results, which are not mathematically valid.
We ﬁnd this to be a particularly critical problem in a domain such as certiﬁable robustness, which is by deﬁnition based on rigorous, mathematical certiﬁcations.
C. T HE WORK OF W ANG ET AL . (2021)
This work, submitted for the ICLR conference 2021 is the only work that seems to be mathematically functional.
In this work, authors have two main contributions – ﬁrst, they propose a two-phase training, where in the second phase, for each sample x i , roughly the optimal σ i is being found and then this sample x i is being augmented with this σ i as an augmentation standard deviation.
Authors call this method pretrain to ﬁnetune .
Second, they provide a speciﬁc version of input-dependent
RS.
Essentially, they try to overcome the mathematical problems connected to the usage of nonconstant σ ( x ) by splitting the input space in so called robust regions
R i , where the constant σ i is guaranteed to be used.
All the certiﬁed balls are guaranteed to lie within just one of these robust regions, making sure that within one certiﬁed region, constant level of σ is used.
Authors test this method on CIFAR10 and MNIST and show, that the method can outperform existing state-of-the-art approaches, mainly on the more complex CIFAR10 dataset.
However, we make several points, which make the results of this work, as well as the proposed method less impressive:
• The computational complexity of both their train-time and test-time algorithms seems to be quite high.
• The ﬁnal smoothed classiﬁer depends on the order of the incoming samples.
As a consequence, it is not clear, whether the method works well for any permutation of the wouldbe tested samples.
This creates another adversarial attack possibility - to attack the ﬁnal smoothed classiﬁer by manipulating the test set so that the order of samples is inappropriate for the good functionality of the ﬁnal smoothed classiﬁer.
• Even more, the fact, that the smoothed classiﬁer depends on the order of the would-be tested samples makes it necessary, that the same smoothed classiﬁer is used all the time for some test session in a real-world applications.
For instance, a camera recognizing faces to approve an entry to a high-security building would need to keep the same model for its whole functional life, because restarting the model would enable attackers to create attacks on the predictions from the previous session.
This might lead to signiﬁcant restrictions on the practical usability of this method.
C. T HE WORKS OF A LFARRA ET AL . (2020) AND E IRAS ET AL . (2021)
In these works, similarly as in the work of Chen et al. (2021), authors suggest to optimize in each test point x for such a σ ( x ) , that maximizes the certiﬁed radius given by Zhai et al.
(2020), which is an extension of Cohen et al.
(2019)’s certiﬁed radius for soft smoothing.
The optimization for σ ( x ) differs but is similar in some respect (as will be discussed).
Besides, all three works further propose input-dependent training procedure, for which σ ( x ) - the standard deviation of gaussian data augmentation is also optimized.
Altogether, both authors claim strong improvements over all the previous impactful works like Cohen et al.
; Zhai et al.
Salman et al.
The only signiﬁcant difference between the works of Alfarra et al.
(2020) and Eiras et al.
(2021) (which have strong author intersections) is that in Eiras et al.
(2021), authors build upon Alfarra et al.
(2020)’s work and move from the isotropic smoothing to the smoothing with some speciﬁc anisotropic distributions.
As mentioned, authors ﬁrst deviate from the setup of Cohen et al.
and turn to the setup introduced by Zhai et al.
(2020), i.e. they use soft smoothed classiﬁer G deﬁned as
[Equation]
The key property of soft smoothed classiﬁers is that the Cohen et al.
(2019)’s result on certiﬁed radius holds for them too.
Theorem 16 (certiﬁed radius for soft smoothed classiﬁers) .
Let G be the soft smoothed probability predictor.
Let x be s.t.
[Equation]
Then, the smoothed classiﬁer g is robust at x with radius
[Equation]
where Φ − 1 denotes the quantile function of standard normal distribution.
Proof.
Is provided in Zhai et al.
Note, that it is, similarly as in the hard randomized smoothing version of this theorem, essential to provide lower and upper conﬁdence bounds for G ( x ) A and G ( x ) B , otherwise we cannot use this theorem with the required probability that the certiﬁed radius is valid.
Denote G ( x, σ ) to be the soft smoothed classiﬁer using σ in x .
Authors propose to use the following theoretical σ ( x ) function:
[Equation]
It is of course not possible to optimize for this particular function since it is not known.
It is also not feasible to run the Monte-Carlo sampling for each σ , because that is too costly and moreover due to stochasticity, it would lead to discontinuous function.
Treatment of this problem is probably the most pronounced difference between the works of Alfarra et al.
and
Chen et al.
Alfarra et al.
(2020) use the following easy observation: N (0 , σ 2 I ) ≡ σ N (0 , I ) .
Assume we have δ i , i ∈ { 1 , . .
, M } be i.i.d.
sample from N (0 , I ) .
Obviously, G ( x, σ ( x ))
A ∼ 1 M M (cid:80) i =1 F ( x + σδ i )
A , since this is just the empirical mean of the theoretical expectation.
Then, Expression 2 can be approximated as:
[Equation]
Here, M is the number of Monte-Carlo samplings used to approximate this function.
Note, that this function is a random realization of stochastic process in σ which is driven by the stochasticity in the sample δ i , i ∈ { 1 , . . .
, M } .
To ﬁnd the maximum of this function, authors furhter propose to use simple gradient ascent, which is possible due to the simple differentiable form of Expression 3.
This differentiability is one of the main motivations to switch from hard to soft randomized smoothing.
Now, we are able to state the exact optimization algorithm of Alfarra et al.
Note, that being done in this way, this algorithm can be viewed as a stochastic gradient ascent.
After obtaining σ ∗ ≡ σ ( x ) , authors further run the Monte-Carlo sampling to estimate the certiﬁed radius exactly as in Cohen et al.
(2019), but with σ ( x ) instead of some global σ .
Using this algorithm, authors achieve signiﬁcant improvement over the Cohen et al.
(2019)’s results, particularly getting rid of the ﬁrst problem mentioned in Appendix A, the truncation issue.
For the results, we refer to
Alfarra et al.
We will now give several comments on this algorithm and this method.
Algorithm function O PTIMIZE S IGMA ( F, x, β, σ 0 , M, K ): for k = 0 , . .
K do sample δ 1 , . . .
, δ M ∼ N (0 , I ) [Equation] return σ ∗ To begin with, in this optimization, authors do not adjust the estimated expectations and therefore don’t use lower conﬁdence bounds, but rather raw estimates.
This is not incorrect, since these estimates are not used directly for the estimation of certiﬁed radius, but it is inconsistent with the resulting estimation.
In other words, authors optimize for a slightly different function than they then use.
The difference is, however, not very big apart from extreme values of E A , where the difference might be really signiﬁcant.
To overcome slightly this inconsistence, authors further (without comment) use clamping of the ˆ
E A ( σ k ) and ˆ E B ( σ k ) on the interval [0 . 02 , 0 . 98] .
I.e. if ˆ E A ( σ k ) > 0 .
98 , it will be set to 0 .and
this is also taken into account in the computation of gradients.
This way, authors get rid of the inconvenient issue, that if G ( x ) A ∼ 1 , then ˆ E A ( σ k ) ∼ 1 for σ k ∼ 0 , what might cause very big value of Φ − 1 ( ˆ E A ( σ k )) , yielding strong inconsistency with what would be obtained, if lower conﬁdence bound was used instead.
However, the clamping causes even stronger inconsistence in the end.
Note, that if G ( x ) A ∼ 1 , then the true value of E A ( σ k ) would be really close to 1 , yielding high values of Φ − 1 ( E A ( σ k )) .
This value would be far better approximated by the lower conﬁdence bound than with the clamping, since the lower conﬁdence bound of 1 for M = 100000 and α = 0 .
001 is more than 0 . 9999 , while the clamped value is just 0 . 98 .
This makes small values of σ highly disadvantageous, since σ 2 −→ 0 as σ −→ 0 , yet Φ − 1 ( ˆ E A ( σ k )) is being stuck on Φ − 1 (0 . 98) .
In other words, this way authors artiﬁcially force the resulting σ ( x ) to be big enough, s.t.
E ( σ ( x ))
A ≤ 0 .
This assumption is not commented in the article and might result in intransparent behaviour.
Second of all, authors use M = 1 for their experiments.
This can be interpreted as using batch size 1 in classical SGD.
We suppose that this small batch size is suboptimal since it yields an insanely high variance of the gradient.
Third of all, during the search for σ ( x ) , it is not taken into account, whether the prediction is correct or not.
This is, of course, a scientiﬁcally correct approach, since we cannot look at the label of the test sample before the very ﬁnal evaluation.
However, it is also problematic, since the function in
Expression 2 might attain its optimum in such a σ ( x ) , which leads to misclassiﬁcation.
This could have been avoided if constant σ was used instead.
To further illustrate this issue, assume F ( x ) =
1 ( B 1 (0)) , i.e. F ( x ) predicts class 1 if and only if (cid:107) x (cid:107) ≤ 1 , otherwise predicts class 0.
Assume we are certifying x ≡ 0 and assume that σ 0 in
Algorithm 1 is initialized such that class 0 is already dominating.
Then, we will have positive gradient ∇ σ k R ( σ k ) in all steps, because F ( σδ i ) is obviously non-increasing, so the number of points classiﬁed as class 1 for ﬁxed sample δ i , i ∈ 1 , . . .
, M is decreasing, yielding ˆ E A ( σ k ) nondecreasing in σ k , while σ k 2 strictly increasing in σ k .
This way, the σ k will diverge to ∞ for k −→ ∞ .
However, point x ≡ 0 is classiﬁed as class 1, yielding misclassiﬁcation which is, moreover, assigned very high certiﬁed radius.
This issue is actually even more general - the function in Expression 2 does in most cases (assuming inﬁnite region R N ) not possess global maximum, because usually
[Equation]
This can be seen, for instance, easily for the F ( x ) = 1 ( B 1 (0)) , but it is the case for any hard classiﬁer, for which one region becomes to have dominating area as the radius around some x 0 goes to inﬁnity.
This is because, if some region becomes to be dominating (for instance if all other regions are bounded), then σ 2 grows, while Φ − 1 ( G ( x, σ ( x ))
A ) − Φ − 1 ( G ( x, σ ( x ))
B ) either grows too, or stagnates, making the whole function strictly increasing with sufﬁciently high slope.
This issue also throws the hyperparameter K under closer inspection.
What is the effect of this hyperparameter on the performance of the algorithm?
From the previous paragraph, it seems, that this parameter serves not only as the “ scaled number of epochs”, but also as some stability parameter, which, however, does not have theoretical, but rather practical justiﬁcation.
Another issue is, that the function in Expression 2 might be non-convex and might possess many different local minima, from which not all (or rather just a few) are actually reasonable.
Therefore, the Algorithm 1 is very sensitive to initialization σ 0 .
However, probably the biggest issue of all is connected to the impossibility result showed in Section 2, which shows, that the Algorithm 1 actually yields invalid certiﬁed radiuses.
Why it is so?
First of all, we must justify, that our impossibility result is applicable also for the soft randomized smoothing.
This is because classiﬁers of type F ( x ) C = 1 ( x ∈ R C ) for R C being decision region for class C are among applicable classiﬁers
s.t. G ( x, σ ) A = E A .
With such classiﬁers, however, there is no difference between soft and hard smoothing and moreover E A ≡ p A from our setup.
This way we can construct the worst-case classiﬁers F ∗ exactly as in our setup and therefore the same worstcase classiﬁers and subsequent adversarial examples are applicable here as well.
In other words, for ﬁxed value of soft smoothed G ( x, σ ) A = E A we can denote p
A = E A
and ﬁnd the worst-case hard classiﬁer F deﬁned as indicator of the worst-case ball, which will yield E B ≡ P 1 ( B ) from
Theorem 3 in some queried point x 1 .
As we have seen in previous paragraphs, the resulting σ ( x ) yielded in Algorithm 1 is very instable and stochastic - it depends heavily on F, σ 0 , K, β, M and of course δ i , i ∈ { 1 , . .
, M } for each iteration of the for cycle.
Now, for instance for CIFAR10 and p A = 0 .
99 , we have the minimal possible ratio σ 0 σ 1 equal to more than 0 .
It is hard to believe, that such instable, highly stochastic and non-regularized (except for K, β ) method will yield σ ( x ) sufﬁciently slowly varying such that within the certiﬁed radius around x 0 , there will be no x 1 for which σ 1 deviates more than by this strict threshold from σ 0 .
This is even more pronounced on ImageNet, where the minimal possible ratio σ 1 σ 0 is above 0.99 for any p A or E A .
Even without the help of curse of dimensionality, we can construct a counterexample for which the algorithm will not yield valid certiﬁed radius.
Assume again F ( x ) =
( B 1 (0)) and assume modest dimension N = 2 .
Assume we try to certify point x 0 ≡ [50 , 0] .
Then, the theoretical σ -dependent function from Equation 2 is depicted on Figure 13.
We can see, that the resulting σ ( x 0 ) will be as big as our regularizers K and β in Algorithm 1 will allow.
Therefore, if we run the algorithm for K high-enough, surely the resulting certiﬁed radius will be far bigger than 50.
However, if we certify the point x 0 ≡ [0 , 0] and we start with σ 0 = 0 .
25 , for instance, then the σ -dependent certiﬁed radius in Expression 2 will be decreasing in this σ 0 , yielding σ ( x 0 ) < 0 .
25 , which will result in classiﬁcation of class 1.
This point [0 , 0] lies within the “certiﬁed” range of [50 , 0] , yet it is not classiﬁed the same, because, obviously, [50 , 0] is classiﬁed as class 0.
This is therefore a counterexample to the validity of Alfarra et al.
(2020)’s certiﬁcation method and their results.
Note that even though our counterexample is a bit “extreme” and one could argue that in practice such a situation would not occur, we must emphasize, that this counterexample is constructed even without the help of the curse of dimensionality.
In practice, it fully sufﬁces, that for x 0 and some certiﬁed radius R in x 0 , there exists x 1 within the range of this certiﬁed radius, s.t.
σ 1 is quite dissimilar to σ 0 .
If such situation occurs, then R surely is not a valid certiﬁed radius.
[-R ( √ l k + s k σ 0 ) = √ l k + s k σ 
-]
C. T HE WORK OF C HEN ET AL . (2021)
The methodology of Chen et al.
(2021) is rather similar to that of Alfarra et al.
The biggest difference consists in the optimization of Expression 2.
Instead of stochastic gradient descent, they use more sophisticated version of grid search - so called multiple-start fast gradient sign search .
Simply speaking, this method ﬁrst generates a set of pairs ( σ 0 , s )
i , i ∈ { 1 , . . .
, K } and then for each of the i runs, it runs a j -while cycle, where in each step j , it increases σ 2 j = σ 20 + js to σ 2 j +
=
σ 20 + ( j + 1) s and checks, whether the σ -dependent empirical certiﬁed radius in Expression 3 increases or not.
If yes, they continue until j is above some threshold
T , if not, they break and report σ i as the σ j from the inner step where while cycle was broken.
After obtaining σ i for i ∈ { 1 , . . .
, K } , they choose σ ( x ) to be the one, that maximizes Expression 3.
More concretely, their multiple-start fast gradient sign search algorithm looks as follows:
It is not entirely clear from the text of Chen et al.
(2021), how exactly are l k , s k sampled, but it is written there, that the interval for l is [1 , 16] and for s it is ( − 1 , 1) .
Moreover, the authors don’t provide the code and from the text, it seems, that they don’t use lower conﬁdence bounds during the evaluation of certiﬁed radiuses, what we consider to be a serious mistake (if really the case).
However, we add some comments to this method regardless of the lower conﬁdence bounds.
Generally, this method possesses most of the disadvantages mentioned in Section C.2.
They use the same function for optimization, the Expression 2 and its empirical version 3.
This means, that the method suffers from having several local optima, having no global optimum in general (and in most cases with limit inﬁnity).
Similarly like before, here is also no control over the correctness of the prediction, i.e. many or all local optima might lead to misclassiﬁcation.
On the other hand, in this paper authors use M = 500 (the effective batch size), which is deﬁnitely more reasonable than M = 1 as in Alfarra et al.
Furthermore, they use multiple initializations, making the optimization more robust and improving the chances to obtain global, or at least very good local minimum.
However, the main problem, the curse of dimensionality yielding invalid results is even more pronounced here.
Unlike the “continuous approach” in Alfarra et al.
(2020), here authors for each xsample just some discrete grid (more complex, since there are more initializations) of possible values of σ ( x ) .
For instance, if s = 1 , then the smallest possible ratio between two consecutive l ’s in the Algorithm 2 is √ 15 / 4 ∼ 0 . 97 , making it impossible to certify some x 1 w.r.t.
x 0 if for both s = 1 and l 0 (cid:54) = l 1 on ImageNet and also for a lot of samples on CIFAR10.
Of course, the fact that s is randomly sampled from ( − 1 , 1) makes this counter-argumentation more difﬁcult, but it is, again, highly unlikely that this highly stochastic method without control over σ ( x ) would yield function Algorithm ) function O PTIMIZE S IGMA ( F, x, σ 0 , M, K, T ): generate ( l k , s k ) , k ∈ { 1 , . . , K } for k = 1 , . .
K do sample δ 1 , . . .
, δ M ∼ N (0 , l k σ 20 I ) φ ( √ l k σ 0 )
= 1 M M (cid:80) i =1 F ( x + δ i ) ˆ E A ( √ l k σ 0 ) = max C φ ( √ l k σ 0 ) C
R ( √ l k σ 0 ) = √ l k σ 0 Φ − 1 ( ˆ E A ( √ l k σ 0 )) m k
= R ( √ l k σ 0 ) while l k ∈ [1 , T ] do sample δ 1 , . .
, δ M ∼ N (0 , ( l k + s k ) σ 20 I ) φ ( √ l k + s k σ 0 )
= 1 M M (cid:80) i =
1 F ( x + δ i )
ˆ E A ( √ l k + s k σ 0 )
=
max C φ ( √ l k + s k σ 0 )
C
{+R ( √ l k + s k σ 0 ) = √ l k + s k σ 
+}
Φ − 1 ( ˆ E A ( √ l k + s k σ 0 ))
if R ( √ l k + s k σ 0 ) ≥ R ( √ l k σ 0 ) then l k ← l k + s k m k
= R ( √ l k + s k σ 0 ) else break σ ( x ) = max k ∈{ 1 ,...,K } m k return σ ( x ) with sufﬁciently small semi-elasticity.
Therefore also the impressive results of Chen et al.
(2021) are, unfortunately, scientiﬁcally invalid.
D I MPLEMENTATION DETAILS
Even though our algorithm is rather easy, there are some perks that should be discussed before one can safely use it in practice.
First, we show the actual Algorithm
Note that the function ComputeCertifiedRadius is a bit more complicated than depicted in
Algorithm 3.
We don’t use a simple for-loop, but rather quite an efﬁcient search method.
Theoretically speaking, this algorithm works perfectly.
However, in practice, it is a bit problematic.
The issue is, that since we use σ 11 and σ 12 , which are extremely close to σ 0 for small tested radiuses R , the NCCHSQ functions will get extremely high inputs, making the results numerically instable.
To prevent this, we use a simple trick.
Since the more extreme σ 1 will we assume in evaluation at particular distance R , the worse for us, we can prevent numerical issues simply by putting σ t < σ 0 and σ T > σ 0 to be maximal and minimal used σ ’s in our evaluation, i.e. the true σ used will be min { σ t , σ 0 exp( − rR ) } and max { σ T , σ 0 exp( rR ) } .
This way, we avoid numerical issues, because we can put σ t , σ T to be s.t.
[Equation]
is not too big and in the same time maintainting the correct certiﬁcation thanks to the Lemma 6.
The problems of this workarounds are ﬁrst that it decreases the certiﬁcation power, since it assumes σ 1 ’s that are even worse than the theoretically guaranteed worst-case possibilities and second, more importantly, that it requires some engineering to design the σ t , σ T designs.
It is submoptimal to put one constant value for these thresholds, because the numerical problems occur at different ratio thresholds of σ 1 /σ 0 for different class probabilities p A and the dimension N .
This requires to design a speciﬁc σ t ( p A ) and σ T ( p A ) functions for each dimension N which we want to apply.
For instance, we use σ t ( p A ) = 0 .
9993 + 0 .
001 log 10 ( p B ) , and σ T ( p A )
= 1 /σ t ( p A ) for CIFAR10, while for MNIST we use σ t ( p A )
= 0 .
9988 + 0 .
001 log 10 ( p B ) , and σ T ( p A )
= 1 /σ t ( p A ) .
To design such functions, one needs to plot plot real probability of a ball with fixed variances as fcn of dist function, which computes the ξ functions, for particular N and several values of p A and look, whether
# evaluate g at xfunction PREDICT( f, σ 0 , x 0 , n, α ): counts ←− SampleUnderNoise( f, x 0 , n, σ 0 ) ˆ c A , ˆ c B ←− two top indices in counts n A , n B ←− counts ( c A ) , counts (ˆ c B ) if BinomPValue ( n A , n A + n B , 0 . 5) ≤ α then return ˆ c
A else return ABSTAIN # certify the robustness of g around xfunction CERTIFY
( f, σ 0 , x 0 , n 0 , n, α ): counts0 ←− SampleUnderNoise( f, x 0 , n 0 , σ 0 ) ˆ c A ←− top index in counts counts ←− SampleUnderNoise( f, x 0 , n, σ 0 ) p A ←− LowerConfBound ( counts [ˆ c A ] , n, 1 − α ) if p A > 1 /then return prediction ˆ c A and radius
ComputeCertiﬁedRadius( σ 0 , r, N, p A , num steps) else return ABSTAIN function C OMPUTE C ERTIFIED R ADIUS ( σ 0 , r, N, p A , num steps) radiuses ←− linspace(num space) for R in radiuses do
[Equation]
xi lower ← ξ < ( R, σ 12 ) if max { xi bigger , xi lower } > 0 .
5 then BREAK return R plot real probability of a ball with fixed variances as fcn of dist , which computes the ξ functions.
The coding is [ σ 0 , σ 1 , N, p A ] .
it computes correctly.
As an example, we provide such a plots for well and ill working setups on
Figure 14.
Another performance trick is to not evaluate ξ for each R i , where R i is i -th grid point of evaluation, but rather evaluate sequentially R i 2 , i.e. just every i 2 -th point, until we reach value > 0 .
5 and then to search just the interval [( i − 1) 2 , i 2 ] , where i is the ﬁrst iteration for which ξ > ( R i 2 , σ 1 ) ≥ 0 .
E M ORE TO EXPERIEMNTS AND ABLATIONS
Before we present our further results, we must emphasize that our certiﬁcation procedure is barely any slower than that of Cohen et al.
More speciﬁcally, given 100000 iterations of montecarlo sampling, certiﬁcation of one sample using Cohen et al.
’s algorithm on CIFAR10 takes ∼ 15 seconds on our machine, while certiﬁcation of a sample using our Algorithm 3 takes 15 −seconds depending on the σ b , r setup.
If at least one of σ b and r is not small, then our method runs practically instantly.
If both parameters are small, then one evaluation can take up to 5 seconds depending on the exact value of parameters and on the p A .
Note, that this part of the certiﬁcation is dimension-independent and therefore can run in the same time also on much higher-dimensional problems.
Besides the actual certiﬁcation, we have to compute σ ( x ) for each of the test examples.
This part of the algorithm is being executed before the actual certiﬁcation and usually takes around 1 minute on our machine and on CIFAR10.
All in all, even in the really worst-case scenario, our method runs at most 1 / 3 -times longer than the old method on CIFAR10.
On MNIST, the ratio between our run and the original run is higher, since MNIST is smaller-dimensional problem.
However, since our part of evaluation is practically independent of the setup (except the values of σ b and r , which, however, can yield just some upperbounded amount of slow-down), our algorithm does not bring any added asymptotic time complexity.
E. H OW TO CHOOSE THE HYPERPARAMETERS ?
Our design of σ ( x ) function deﬁned in Equation 1 uses several hyperparameters.
These are: r for the rate, m for the scaling, σ b for the base sigma and k for the k -nearest neighbors.
How do we choose these hyperparameters?
The m parameter depends on our goals.
We can set it so that σ ( x ) achieves lowest values at σ b by setting it so that it is roughly equal to the minimal distance from k nearest neighbors across, for instance, training samples. Other possibility is to set it so that it is roughly equal to the average distance from k nearest neighbors, to ensure that the average σ ( x ) will roughly correspond to the σ b . The k parameter needs to be set with two objectives in mind. Firstly, it would be unwise to set it too small, because then the distance from k nearest neighbors would be too noisy.
On the other hand, we don’t want it too high, because then it will not be changing fast enough with changing the position of x . The suitable value can be obtained by looking at histograms of average distances from k nearest neighbors and choosing the k for which the histogram is enough scattered, but it is not too small. The r parameter needs to be chosen so that we can have some signiﬁcant advantage over constant smoothing, but it cannot be too big, because otherwise the curse of dimensionality would apply. The value can be decided either by trial and error, or by plotting the certiﬁed radius given linear classiﬁer, or from Theorem 4, setting the rate low-enough so that within the expected certiﬁed radius range, the ratio σ 1 σ 0 can’t move anywhere near the theoretical thresholds implied by Theorem 4.
The σ b is the base σ and should be used according to the level of smoothing variance we want to use.
More discussion on this can be found in Cohen et al.
E. C OMPARISON WITH C OHEN ET AL . (2019) METHODOLOGY ON CIFAR10 DATASETS
Here, we compare Cohen et al.
(2019)’s
evaluations for σ = 0 .
50 with our evaluations directly on models trained by Cohen et al.
, setting σ b = σ , r = 0 .
005 , 0 . 01 and 0 .
015 for σ b
= σ = 0 .
12 , k = 20 and m = 5 .
In this way, the levels of σ ( x ) used in direct comparison will rise from the values roughly equal to Cohen et al.
(2019)’s constant σ to higher values.
The results are depicted in Figure 15.
Note, that this evaluation is being done on the models trained directly by Cohen et al.
and therefore the variance of Gaussian data augmentation is not entirely consistent with the optimal variance that should be used for non-constant σ , which should be either the same, σ ( x ) or constant, but in average equal to σ ( x ) .
The results are similar as in the Section 4.
Note, that for σ b = [Table] [Table] [Table]
, the curse of dimensionality becomes most pronounced, explained in Appendix Further
[Table] we provide the Tables 5, 6, where the clean accuracies and -wise standard deviations are displayed.
The results are, again, similar as in the section 4.
E. C OMPARISON WITH C OHEN ET AL . (2019) METHODOLOGY ON MNIST DATASETS
Here, we present similar comparison as in Subsection E.2, but on MNIST and with models trained by us.
Again, the setup is similar as in the Section 4.
We compare σ = σ b = 0 .
50 with test-time rates r = 0 .
05 and train-time level of σ again equal to σ = σ b .
It is important to note, that we use different normalization constant m in the MNIST case.
In CIFAR10, we set m = 5 , in MNIST, the suitable m is 1 .
This way we assure, that the smallest σ ( x ) values in the test set will roughly equal the σ b = σ .
The certiﬁed accuracy plots are depicted on Figure 16.
We also add the clean accuracy table and class-wise clean accuracies standard deviation table (7, 8).
be discussed later be ignored now
[Table]
All the results are, again, very similar to those presented in Section 4, even though the gain in certiﬁed accuracies is marginally worse, since our evaluations run on models trained with in average smaller train-time data-augmentation standard deviation σ b = σ .
E. I NVESTIGATION OF THE EFFECT OF TRAINING WITH INPUT - DEPENDENT GAUSSIAN AUGMENATATION
It has been shown by many works, that apart from a good test-time certiﬁcation method, also the appropriate training plays a very important role in the ﬁnal robustness of our smoothed classiﬁer g .
Already Cohen et al.
(2019) realize this and propose to train with gaussian data augmentation with constant σ .
They experiment with different levels of σ during training and conclude that training with the same level of σ that will be later used in the test time is usually the most suitable option.
The question of best-possible training to boost the certiﬁed robustness didn’t stay without the interest of different researchers.
Both Zhai et al.
(2020) and Salman et al.
(2019) try to improve the way of training and propose two different, yet interesting and effective training methods.
While
Zhai et al.
(2020) manage to incorporate the adversarial robustness into the training loss function, therefore training directly for the robustness, Salman et al.
(2019) propose to use adversarial training to achieve more robust classiﬁers.
Both Alfarra et al.
and
Chen et al.
(2021) already propose to use training with input-dependent σ as the variance of gaussian data augmentation.
Both of them proceed similarly as during test time - to obtain training σ ( x ) , they optimize for such, that would maximize the certiﬁed accuracy of training samples.
In this section, we propose and test our own training method.
We propose to use again gaussian data augmentation with input-dependent σ ( x ) , but we suggest to use the simple σ ( x ) deﬁned in
Equation 1.
In other words, we suggest using the same σ ( x ) during training as during testing (up to parametrization, which might differ).
Note, that, unlike the certiﬁcation, the training procedure does not require any mathematical analysis nor certiﬁcation.
It is totally up to us how we train the base classiﬁer f and the way of training does not inﬂuence the validity of subsequent certiﬁcation guarantees during test time.
However, it is good to have a reasonable training procedure, because otherwise, we would achieve a satisfactory model neither in terms of clean accuracy nor in terms of adversarial robustness. [Table]
[Table] In the subsequent analysis, we evaluate and compare our certiﬁcation procedures on models trained with different training parametrizations.
For this particular section, we run the comparison only on the CIFAR10 dataset.
For each test-time σ b , r , we evaluate our method with these parameters on base models f trained with the same σ b , but different level of training rate trr .
The training rate trr plays exactly the same role as the evaluation rate r but is used exclusively during training.
Note, that this makes our σ ( x ) different during training and testing since it is parametrized with different rates.
On the Figure 17 we plot evaluations on CIFAR10 of our method for rate 0 .
01 , all levels of σ b = 0 .
50 and each of these test-time setups is evaluated on 4 different levels of train-time rate trr = 0 . 0 , 0 . 01 , 0 . 04 , 0 . 1 .
From the results, we judge, that our training procedure works satisfactorily well.
It can generally outperform the constant σ training, yet the standard accuracy vs. robustness trade-off is present in some cases.
If we train with small train-time rate, the improvement of the certiﬁed accuracies is not pronounced (the case for σ b = σ = 0 .
50 is slightly misleading, since such a conﬁguration is just a result of the variance of clean accuracy w.r.t different traning runs) enough, but we also don’t lose almost any clean accuracy.
Increasing the rate to trr = 0 .
04 results in much more pronounced improvements in high certiﬁed accuracies, yet also comes at a prize of clean accuracy drop, especially for large σ levels.
Even bigger training rate, such as trr = 0 .
1 seems to be too big and does not bring almost any improvement over the rate trr = 0 .
04 , yet loses a large amount of clean accuracy.
These results suggest, that the input-dependent training with a carefully chosen training rate for σ ( x ) can lead to signiﬁcant improvements in certiﬁable robustness.
However, it is important to note, that the optimal trr seems to be dependent on the σ b , therefore for each value of σ b , some effort has to be invested to ﬁnd the optimal hyperparameters.
Besides, we were also interested, whether using an input-dependent σ ( x ) during training inﬂuences the class-wise accuracy balance.
In Table 9 we report the standard deviations of class-wise accuracies.
We can observe, that unlike the pure input-dependent evaluation, the input-dependent training is partially capable of mitigating the effects of the shrinking.
For instance, the trr = 0 . 04 for σ b = 0 .
12 provides obvious improvement in establishing class-wise balance.
Similarly successful are trainings with trr = 0 .
for σ b = 0 .
12 and both trr = 0 .
04 for σ b = 0 .
Also for σ = 0 .
50 the mitigation is present for small-enough training rates.
However, we must emphasize, that if we use too big training rate, the disbalance between class accuracies will be re-established and in some cases even magniﬁed.
Therefore, we must be careful to choose the appropriate training rate for the σ b , r .
E. W HY DO WE NOT COMPARE WITH THE CURRENT STATE - OF - THE - ART ?
Brieﬂy speaking – we could, but we don’t consider it necessary.
Since we claim just one type of improvement over the Cohen et al.
(2019)’s model (experiment-wise) and don’t claim new state-ofthe-art training method, we didn’t ﬁnd it necessary to measure our strengths with methods of Salman et al.
(2019) and Zhai et al.
It is obvious that we would outperform these methods in the question of certiﬁed accuracy waterfalls anyway, since these methods focus on the training phase.
Since we do not outperform Cohen et al.
neither in terms of the clean accuracies nor in terms of class-wise accuracies, it is not our belief that we would outperform the two modern methods in these metrics.
Moreover, we ﬁnd the comparison with Cohen et al.
(2019) most structured, since we extend the theory built by them.
E. A BLATIONS
Even though our results so far might look impressive, we can’t claim that it is fully due to our particular method until we exclude the possibility, that some different effects play an essential role in the improvement over Cohen et al.
(2019)’s work.
To investigate, whether our particular method dominates the contribution to the performance boost, we conduct several ablation studies - ﬁrst, we study the variance of our evaluations and trainings, second, we study the effect of input-dependent test-time randomized smoothing, and third, we study the effect of input-dependent train-time data augmentation.
E.6. V ARIANCE OF THE EVALUATION
To ﬁnd out, whether there is a signiﬁcant variance in the evaluation of certiﬁed radiuses, we conduct a simple experiment - we train a single model on CIFAR10 and evaluate our method on this model for the very same setup of parameters multiple times.
This way, the only present stochasticity is in the Monte-Carlo sampling, which inﬂuences the evaluation of certiﬁed radiuses.
We pick the parameters as follows:
σ b = 0 . 50 , r = 0 .
01 , trr = 0 . 0 , since the σ b = 0 .
50 turns out to have biggest variance in the training.
The results are depicted in Figure 18.
From the results, it is obvious that the variance in the evaluation phase is absolutely negotiable.
Therefore, there is no need to run the same evaluation setup more times. [Table] [Table]
E.6. V ARIANCE OF THE TRAINING
To estimate the variance of the training [Table] we train several models for one speciﬁc training setup and evaluate them with the same evaluation setup (knowing, that there is no variance in the evaluation phase, this is equivalent to measuring directly the training variance).
We pick our classical non-constant σ ( x ) for the evaluation, but we train with constant variance data augmentation.
The concrete parameters we work with are: σ b ∈ { 0 .
50 } , r = 0 .
01 , trr = 0 .
and we runtrainings for each of these parameter conﬁgurations.
Then we run full certiﬁcation to not only see the variance in clean accuracy, but also the variance in the certiﬁed radiuses.
The results are depicted in Figure 19.
From the ﬁgures we see, that the variance of the training is strongly σ b -dependent.
Most volatile clean accuracy is present for the case σ b = 0 .
However, fortunately, the biggest variability is present for the clean accuracy and the curves seem to be less scattered in the areas of high certiﬁed radiuses.
The concrete standard deviations of clean accuracies are in Table 10.
The standard deviations of clean accuracies for MNIST dataset and the same parameters are in Table 11.
Since the differences in accuracies of different methods are very subtle, it is hard to obtain statistically trustworthy results.
For instance, given, that the standard deviation 0 .
4% is the true standard deviation of the σ b = 0 .
25 runs, we would need 16 runs to decrease it to a standard deviation of 0 .
1% , which might be considered to be precise-enough.
To do the same in the case of σ b = 0 .
50 on
CIFAR10, we would roughly need 400 runs to decrease the standard deviation below 0 .
Therefore, the results we provide in the subsequent subsections, being the average of “just” 8 runs, have to be taken just modulo variance in the results, which might still be considerable.
E.6. E FFECT OF INPUT - DEPENDENT EVALUATION
In this ablation study, we compare the certiﬁcation method for particular σ b , r = 0 .
01 , trr =
.with the constant- σ certiﬁcation method with Cσ b , r = 0 . 0 , trr = 0 .
0 , where C is an appropriate constant.
The motivation behind such an experiment is, that our σ ( x ) is generally bigger than σ b , but originally, we compare this method to constant σ = σ b evaluation.
Therefore, in average, samples in our method enjoy bigger values of σ ( x ) .
Natural question is, whether we cannot obtain the same performance boost using just the constant σ method with Cσ b > σ b set to such value, which roughly corresponds to the average of σ ( x i ) for x i , i ∈ { 1 , . . .
, T } being the test set.
The problem of using bigger Cσ b is, that we encounter performance drop and more severe case of shrinking, but we need to check, to what extent is the performance drop present in the input-dependent σ ( x ) method.
Comparing the performance drops of larger constant Cσ b and input-dependent σ ( x ) , which is in average larger (but in average the same as the Cσ b ), we will be able to answer, to what degree is the usage of input-dependent σ ( x ) really justiﬁed.
If we remind ourselves, that
[Equation]
then we see, that the constant C we are searching for is the average (or rather median) value of
[Equation]
Fortunately, empirically, the mean and median of the above expression are roughly equal for both
CIFAR10 and MNIST, so we are not forced to choose between them.
For r = 0 .
01 , m = 5 , we choose the rounded value of C = exp(0 . 05) on CIFAR10.
For r = 0 .
01 , m = 1 .
5 as in
MNIST, the constant is set to C = 1 . 035 .
In the end, the values of Cσ used in this experiment are
Cσ = 0 .
53 for CIFAR10 and Cσ = 0 .
517 for MNIST.
To obtain a fair comparison, though, we evaluate the input-dependent σ ( x ) evaluation strategy on models trained with constant Cσ b standard deviation of gaussian augmentation.
This is because this level of σ is equal to the mean value of the σ ( x ) and we believe, that such a training data augmentation standard deviation is more consistent with our σ ( x ) function.
We provide the plots of single-run evaluations of certiﬁed accuracies for CIFAR10 in Figure 20 and for MNIST in Figure 21.
The models on which we evaluate differ because for the increased constant σ evaluations we needed to also use an increased level of the training data augmentation variance.
From the ﬁgures, it is obvious, that our method is not able to outperform the constant σ method using the same mean σ in terms of certiﬁed accuracy, not even for our strongest σ b = 0 .
This fact might not be in general bad news, if we demonstrated, that our method suffers from less pronounced accuracy drop or less pronounced disbalance in class-wise accuracies.
To ﬁnd out, we measure average accuracies of the evaluation strategies from 8 runs for each, as well as average class-wise accuracy standard deviations from 8 runs.
The results are provided in Tables 12 and 13 for CIFAR and Tables 14 and 15 for MNIST. [Table] [Table] [Table]
[Table]
As for CIFAR10, except for σ = σ b = 0 .
25 , the differences in accuracies between different evaluation strategies are so small, that we cannot consider them to be statistically signiﬁcant.
Even though the difference for σ = σ b = 0 .
25 is high, it is still not possible to draw some deﬁnite conclusions, especially for the difference between the input-dependent σ ( x ) and the increased constant Cσ b evaluations.
[-r = 0 . 
-]
[-r = 0 . 
-]
[-r = 0 . 
-]
[-r = 0 . 
-]
In general, it is not easy to judge, whether our method possesses some advantage (or disadvantage) over the increased Cσ b method in terms of clean accuracy.
Similar conclusions can be drawn in the context of the shrinking phenomenon.
Here, the differences are also very small, but unlike in the comparison with Cohen et al.
(2019) models, where we evaluate our input-dependent σ ( x ) method on classiﬁers trained with inconsistent data-augmentation variance, here we observe the general trend, that our method is able to outperform the increased constant Cσ b evaluation.
This is good news and it conﬁrms our suspicion, that the bad results from Subsection E.2 could come from the train-test σ inconsistency.
The results on MNIST suggest similar conclusions for the accuracy vs. robustness tradeoff.
Similarly, the σ = σ b = 0 .
50 are not telling much, and for σ = σ b = 0 .
25 , the differences are still rather small (yet the standard deviation of the results should be ∼ 0 . 0001 , so it is rather on the edge).
The conclusions for the shrinking phenomenon are a bit more pesimistic than in the case of
CIFAR10.
Here we don’t see any improvement over the constant σ , not even the one with increased σ level.
E.6. E FFECT OF INPUT - DEPENDENT TRAINING
In this last ablation study, we compare our input-dependent data augmentation for particular σ b , r and particular training rate trr with the constant Cσ b data augmentation, where the training rate trr is set to 0.
The strategy for choosing the constant C is exactly the same as in the ﬁrst experiment.
Particularly, we evaluate our method with r = 0 .
01 and σ b = 0 .
50 , trained with the same level of σ b and training rate trr = 0 .
01 with the evaluations using r = 0 .
01 and σ b = 0 .
50 during test time, while during train time using training rate trr = 0 . 0 , but using the constant σ = 0 .
53 for CIFAR10 and σ = 0 .
517 for MNIST.
This way, we compensate for the “increased levels of σ ( x ) ” with respect to σ b .
We present our comparisons in the Figure 22 for CIFAR10 and 23 for MNIST, providing the evaluations with r = 0 .
01 , σ b = 0 .
50 and the same σ b and trr = 0 .
during train time as a reference.
The certiﬁed accuracy results for the CIFAR10 and the MNIST differ a bit.
For CIFAR10 training with rate r = 0 .
01 is does not overperform the constant Cσ b training.
For σ b = 0 .
12 , the constant
Cσ b training clearly outperforms the input-dependent training.
For σ b = 0 .
25 , these two training strategies seem to have almost identical performances.
For σ b = 0 .
50 , the input-dependent σ ( x )
[Table]
[Table] [Table] [Table] strategy outperforms the constant σ ones, but now we know, that it is purely due to the variance in the training.
On the other hand on MNIST, we either have very similar performance or even slightly outperform the constant σ training.
Looking at the accuracy and standard deviation Tables 16, 17, 18 and 19, we can deduce the following.
In terms of clean accuracy, the input-dependent training strategy performs worst in most of the cases, even though the differences in performance might not be statistically signiﬁcant.
We see, that we would need far more evaluations to see some clear pattern.
However, these results are deﬁnitely not good news for the use of input-dependent σ ( x ) during training.
In terms of the class-wise accuracy standard deviation, we again see countering results for CIFAR and MNIST datasets.
For CIFAR10 the input-dependent σ ( x ) clearly outperforms the smaller constant σ b training method, particularly for σ b = 0 .
However, the constant Cσ b method seem to outperform even the input-dependent σ ( x ) .
For MNIST, the smaller constant σ b outperforms both other methods, while they are rather similar.
Together with ﬁndings from previous sections, these results suggest, that usage of this particular design of input-dependent σ ( x ) might not be worthy until a more precise evaluation is conducted.
However, the combination of input-dependent test-time evaluation with constant, yet increased traintime augmentation is possibly the strongest combination that can be achieved using input-dependent sigma at all (especially for CIFAR10).
F P ROOFS
Lemma 17 (Neyman-Pearson) .
Let X, Y be random vectors in R N with densities x, y .
Let h : R N −→ { 0 , 1 } be a random or deterministic function.
Then, the following two implications hold:
If S = (cid:110) z ∈ R N : y ( z ) x ( z ) ≤ t (cid:111) for some t > 0 and P ( h ( X ) = 1) ≥ P ( X ∈ S ) , then P ( h ( Y ) = 1) ≥ P ( Y ∈ S ) .
If S = (cid:110) z ∈ R N : y ( z ) x ( z ) ≥ t (cid:111) for some t > 0 and P ( h ( X ) = 1) ≤ P ( X ∈ S ) , then P ( h ( Y ) = 1) ≤ P ( Y ∈ S ) .
Proof.
See Cohen et al.
Lemma 1: Out of all possible classiﬁers f such that G f ( x ) B ≤ p B = 1 − p A , the one, for which
G f ( x + δ ) B is maximized is the one, which predicts class B in a region determined by the likelihood ratio:
[Equation]
where r is ﬁxed, such that P 0 ( B )
= p B .
Note, that we use B to denote both the class and the region of that class.
Proof.
Let f be arbitrary classiﬁer.
To invoke the Neyman-Pearson Lemma 17, deﬁne h ≡ f (with the only difference, that h goes to { 0 , 1 } instead of { A, B } ).
Moreover, let S ≡ B and
X ∼ N ( x, σ 20 I ) , Y ∼ N ( x + δ, σ 21 I ) .
Let also f ∗ classify S as B .
Then obviously, P ( X ∈ S )
=
P 0 ( B ) = p B .
Since G f ( x ) B ≤ p B , we have P ( h ( X ) = 1) ≤ p B .
Using directly the second part of
Neyman-Pearson Lemma 17, this will yield P ( Y ∈ S ) ≥ P ( h ( Y ) = 1) .
Rewritten in the words of our setup, G f ∗ ( x + δ ) ≥ G f ( x + δ ) .
Theorem 2: If σ 0 > σ 1 , then B is a N -dimensional ball with the center at S > and radius R > :
[Equation]
If σ 0 < σ 1 , then B is the complement of a N -dimensional ball with the center at S < and radius R < :
[Equation]
Proof.
From spherical symmetry of isotropic multivariate normal distribution, it follows, that without loss of generality we can take δ ≡ ( a, 0 , . . . , 0) .
With little abuse of notation, let a refer to ( a, 0 , . .
. , 0) as well as (cid:107) ( a, 0 , . . . , 0) (cid:107) .
With this, the B is a set of all x , for which:
[Equation]
≤ r (2 π ) N/ 2 σ N 1 exp (cid:32) −2 σ(cid:34) ( x 1 − a ) 2 +
N (cid:88) i =
x 2 i (cid:35)(cid:33) ⇐⇒ 2 σ(cid:32) ( x 1 − a ) 2 +
N (cid:88) i =
x 2 i (cid:33) −2 σ
N (cid:88) i = x 2 i ≤ N log (cid:18) σσ(cid:19)
+ log( r )
⇐⇒ ( σ 20 − σ 21 )
N (cid:88) i = x 2 i + ( σ 20 − σ 21 ) x 21 − 2 σ 20 x 1 a + σ 20 a 2 ≤ 2 Nσ 20 σ 21 log (cid:18) σσ(cid:19) + 2 σ 20 σ 21 log( r )
Now assume σ 0 > σ 1 and continue:
[Equation]
Such inequality deﬁnes exactly the ball from the statement of the theorem.
On the other hand, if σ 0 < σ 1 :
[Equation]
This is exactly the complement of a ball from the second part of the statement of the theorem.
Theorem 3:
[Equation]
where the sign < or > is choosed according to the inequality between σ 0 and σ [Equation]
Proof.
Assume ﬁrst σ 0 > σ 1 .
Let us shift the coordinates, such that x + σ 20 σ 20 − σ 21 δ ←− 0 .
Now, the x will have coordinates − σ 20 σ 20 − σ 21 δ .
Assume X ∼ N ( − σ 20 σ 20 − σ 21 δ, σ 20 I ) .
To obtain
P
[Equation]
we could almost use NCCHSQ
[Equation]
but we don’t have correct scaling of variance of X .
However, for any regular square matrix Q , it follows that P ( X ∈ B ) =
P ( QX ∈ QB ) , where QB is interpreted as set projection.
Therefore, if we choose Q ≡ 1 σ 0 I , we will get
[Equation]
Now, since X/σ 0 ∼ N ( − σ 0 σ 20 − σ 21 δ, I ) , we can use the deﬁnition of NCCHSQ to obtain the ﬁnal:
P
[Equation]
B
[Equation]
To obtain P 1 ( B ) , we will do similar calculation, yet we need to compute the offset:
[Equation]
Thus, after shifting coordinates in the same way, our alternative X will be distributed like
X ∼ N ( − σ 21 σ 20 − σ 22 a, σ 1 I ) .
Now, the same idea as before will yield the required formula.
In the case of σ 0 < σ 1 , we do practically the same thing, yet now, we have to keep in mind, that B will not be a ball, but its complement, therefore we will obtain “ 1 − ” in the formulas.
Lemma 18.
Functions ξ > ( a ) , ξ < ( a ) are continuous on the whole R + .
Particularly, they are continuous at 0.
Proof.
Assume for simplicity σ 0 > σ 1 and ﬁx x 0 , whose position is irrelevant and ﬁx x 1 such that (cid:107) x 0 − x 1 (cid:107) =
a m , where a m is the point, where we prove the continuity.
Note, that χ 2 N ( λ, x ) can be interpreted (as we have seen) as a probability of an offset ball with radius √ x and offset √ λ .
Assume we have a sequence { a i } ∞ i =1 , a i −→ a m .
Deﬁne x i to be a point lying on the line deﬁned by x 0 , xs.t.
(cid:107) x 0 − x i (cid:107) =
a i .
deﬁne B a i to be the worst-case ball corresponding to a i , x i .
Now, without loss of generality, we can assume, that all B ’s are open.
We have already seen from Lemma 2, that centers of B i converge to the center of B m .
Deﬁne X i = 1 ( B i ) , X m = 1 ( B m ) .
First we need to prove, that r i , radiuses of the balls converge.
Assume for contradiction, that r i do not converge.
Without loss of gererality, let r s =
lim sup i −→ ∞ r i > r m .
If r s = ∞ , it is trivial to see, that P
( B i ) (cid:54) =
p B for some i for which r i is too big.
If r s < ∞ , consider { a i k } ∞ k =0 to be the subsequence for which r s is monotonically attained.
Deﬁne B s the ball with center x 1 and radius r s and X s = 1 ( B s ) .
Then, X i k a.s.
−→ X s for k −→ ∞ and from dominated convergence theorem, P
( B i k ) −→ P
( B s ) .
However, P 0 ( B s ) > P 0 ( B m ) =
p B , what is contradiction, since obviously P
( B i k ) (cid:54) =
p B for some k .
Since σ 1 is ﬁxed, the P 1 i , probability measures corresponding to N ( x i , σ 1 I ) are actually the same probability measure up to a shift.
Therefore, P 1 i ( B i ) can be treated as P 2 ( ¯ B i ) , where P 2 is simply measure corresponding to N (0 , σ 1 I ) and ¯ B i is simply B i shifted accordingly s.t.
P 1 i ( B i ) =
P 2 ( ¯ B i ) (and assume, without loss of generality, that for each i , they are shifted such that their centers lie on a ﬁxed line).
Now, since we know, that “position” of both the centers of the balls and the x 1 is continuous w.r.t a , as can be seen from Lemma 2 (and the radiuses are still r i and converge), we see, that even 1 ( ¯ B i ) −→ 1 ( ¯ B m ) almost surely.
Now, we can simply use dominated convergence theorem using P 2 to obtain P 2 ( ¯ B i ) −→ P 2 ( ¯ B m ) and thus P 1 i ( B i ) −→ P 1 m ( B m ) , what we wanted to prove.
Note that the proof for the case σ 0 < σ 1 is fully analogous, yet instead of class B probabilities, we work with class A probabilities to still work with balls and not with less convenient complements.
Lemma 19.
If λ 1 > λ 2 , then χ 2 N ( λ 21 , x 2 ) ≤ χ 2 N ( λ 22 , x 2 ) .
Proof.
Let us ﬁx N (0 , I ) and respective measure P and respective density f .
From symmetry, the
NCCHCSQ deﬁned as distribution of (cid:107) X (cid:107) 2 for an offset normal distribution can be as well deﬁned as (cid:107) X − s (cid:107) 2 under centralized normal distribution.
Deﬁne B 1 a ball with center at ( λ 1 , 0 , . .
. , 0) and radius x and B 2 a ball with center at ( λ 2 , 0 , . .
. , 0) and radius x .
Denote C ( B ) as the center of a ball B .
From deﬁnition of NCCHSQ it now follows, that P ( B i ) =
χ 2 N ( λ 2 i , x 2 ) , i ∈ { 1 , 2 } .
Therefore, it sufﬁces to show P ( B 1 ) ≤ P ( B 2 ) .
Deﬁne D 1 =
B 1 \ B 2 and D 2 = B 2 \ B 1 .
Then we know:
[Equation]
f
[Equation]
z ) [Equation] Thus,
[Equation]
Let S
=
C
( B 1 )
+ C ( B 2 ).
Deﬁne a central symmetry M with center S .
Let z 1 ∈ D 1 .
Then z 1 can be decomposed as z 1 = C ( B 1 ) + d, (cid:107) d (cid:107) ≤ x .
Then, z 2 :=
M ( z 1 ) =
C ( B 2 ) − d from symmetry.
This way, we see, that D 1 =
M ( D 2 ) and D
= M ( D 1 ) under a bijection M which does not distort the geometry and distances of the euclidean space.
Therefore, it sufﬁces to show:
[Equation]
f ( M ( z )) , M ( z ) ∈ D 1 . From the monotonicity of f ( y ) w.r.t (cid:107) y (cid:107) it actually sufﬁces to show (cid:107) z (cid:107) ≤ (cid:107) M ( z ) (cid:107) ∀ z ∈ D 2 .
Fix some z ∈ D 2 .
By the fact that M is central symmetry and z −→ M ( z ) , it is obvious, that z = S + p ,
M ( z ) =
S − p , where p is some vector.
Now, using law of cosine, we can write:
[Equation]
where α is angle between S and − p .
On the other hand:
[Equation]
It is obvious from these equations, that
[Equation]
Here, the crucial observation is, that D 1 and D 2 are separated by a hyperplane perpendicular to S (vector), such that S (point) is in this hyperplane.
From this it follows:
[Equation]
Now, since z = S + p and z ∈ D 2 , this implies (cid:107) S (cid:107) 2 ≥ z T S
= (cid:107) S (cid:107)
+ p T S and thus p T S ≤ 0 .
Lemma 20.
Functions ξ > ( a ) , ξ < ( a ) are non-decreasing in a .
Proof.
First assume σ 0 > σ 1 and analyse ξ > ( a ) .
From Lemma 18, we can without loss of generality assume, that a > 0 , since ξ > (0) is simply the limit for a −→ 0 and cannot change the monotonicity status.
Now, ﬁx a > 0 and deﬁne x 0 , x 1 s.t.
(cid:107) x 0 − x 1 (cid:107) = a .
Denote B a to be the worst-case ball corresponding to x 0 , x 1 and P 1 as usual.
Choose (cid:15) <
σ 21 σ 20 − σ 21 a , which is the distance between x 1 and
C ( B a ) , as can be seen from Lemma 2.
Now, assume x 2 lies on line deﬁned by x 0 , x 1 with (cid:107) x 0 − x 2 (cid:107) =
a + (cid:15) .
Let B a + (cid:15) be the corresponding worst-case ball and P 2 as usual.
First observe, that P 2 ( B a ) ≥ P 1 ( B a ) , since (cid:107) x 1 − C ( B a ) (cid:107) > (cid:107) x 2 − C ( B a ) (cid:107) .
Here we use χ 2 N ( λ 1 , x ) ≤ χ 2 N ( λ 2 , x ) if λ 1 > λ 2 , what is proved in Lemma 19.
Second, note, that since B a + (cid:15) is the worst-case ball for x 2 , it follows P 2 ( B a + (cid:15) ) ≥ P 2 ( B a ) .
Thus, P 1 ( B a ) ≤ P 2 ( B a + (cid:15) ) , but that is exactly ξ > ( a ) ≤ ξ > ( a + (cid:15) ) .
To prove ξ > ( a ) ≤ ξ > ( a + (cid:15) ) also for (cid:15) > σ 21 σ 20 − σ 21 a , it sufﬁces to consider ﬁnite sequence of points a i starting at a and ending at a + (cid:15) that are “close enough to each other” such that the respective (cid:15) i that
[Table]
Now, assume σ 0 < σ 1 and analysie ξ < ( a ) .
The proof is similar, but we have to be a bit careful about some details.
Again, ﬁx a > 0 , deﬁne x 0 , x 1 accordingly and all other objects as before, except now, let us denote A a = B C a and A a + (cid:15) =
B C a to be the class A balls which are complements to the anti-balls B .
Again, P 2 ( A a ) ≤ P 1 ( A a ) , since (cid:107) x 1 − C ( A a ) (cid:107) <
(cid:107) x 2 − C
( A a ) (cid:107) .
We again used the monotonicity from Lemma 19.
Moreover, P 2 ( A a + (cid:15) ) ≤ P 2 ( A a ) , since B a + (cid:15) is the worst-case set for x 2 .
Therefore, P 1 ( A a ) ≥ P 2 ( A a + (cid:15) ) , but after reverting to B ’s, it follows ξ > ( a ) ≤ ξ > ( a + (cid:15) ) .
Here, we don’t even need to care about (cid:107) (cid:15) (cid:107) , since the centers of A ’s are on the opposite half-lines from x 0 than x 1 and x 2 .
To prove the main theorem, we need a simple bound on a median of central chi-squared distribution, shown in Robert (1990) in a more general way.
Lemma 21.
For all c ≥ 0 ,
[Equation]
Proof.
See Robert (1990).
Theorem 4 (the curse of dimensionality): Let x 0 , x 1 , p A , σ 0 , σ 1 , N be as usual.
Then, the following two implications hold:
If σ 0 > σ 1 and
[Equation]
then x 1 is not certiﬁed w.r.t.
x 0 .
If σ 0 < σ 1 and
[Equation]
then x 1 is not certiﬁed w.r.t.
x 0 .
Proof.
We will ﬁrst prove ﬁrst statement, thus let us assume σ 0 > σ 1 .
Then P 1 ( B ) = ξ > ( (cid:107) x 0 − x 1 (cid:107) ) .
From monotonicity of ξ showed in Lemma 20, we know ξ > ( (cid:107) x 0 − x 1 (cid:107) ) ≥ ξ > (0) .
We will show ξ > (0) > 0 .
We have, using deﬁnition of ξ > plugging in a = 0 :
[Equation]
Note, that here, we work with central chi-square cdf and quantile function.
In order to show ξ > (0) > 0 .
5 , it sufﬁces to show
[Equation]
because it is well-known, that median of central chi-square distribution is smaller than mean, which is N , i.e. from strict monotonicity of cdf, we will get χ 2 N ( N ) > 0 .
To show the above inequality, we will use Chernoff bound on chi-squared, which states the following:
If 0 < z < 1 , then χ 2 N ( zN ) ≤ ( z exp(1 − z )) N/ 2 .
Putting z ≡ σ 21 σ 20 , using chernoff bound we get:
[Equation]
The last inequality is required to hold.
If it holds, then necessarily χ 2 N,qf (1 − p A ) >
σ 21 σ 20 N and thus σ 20 σ 21 χ 2 N,qf (1 − p A ) > N. Manipulating the required inequality, we will get exactly
[Equation]
what is the assumption of 1.
Similarly we will also prove the statement 2.
Assume σ 0 > σ 1 .
Like in part 1, we will just prove ξ < (0) > 0 .
5 by using chernoff bound.
This time, however, we have:
[Equation]
i.e. we need to prove
[Equation]
The second part of Chernoff bound states: If 1 < z , then χ 2 N ( zN ) ≥ 1 − ( z exp [Equation] 1 − z )) N/ 2 .
Let us choose z ≡ σ 21 σ 20 N − 1 N .
Then Chernoff bound yields:
[Equation]
If this holds, then
[Equation]
Now, using Lemma 21 for the easy case of central chi-squared, we see: χ 2 N ( N − 1) < 0 .
5 and thus
[Equation]
what we wanted to prove.
Corollary 5 (one-sided simpler bound): Let x 0 , x 1 , p A , σ 0 , σ 1 , N be as usual and assume now σ 0 > σ 1 .
Then, if
[Equation]
then x 1 is not certiﬁed w.r.t x 0 .
Proof.
We will simply prove
[Equation]
Assume expression log(1 − y )
+ y ; 1 > y > 0 .
From Taylor series, it is apparent, that log(1 − y )
+ y < − y 2 2 .
Therefore, if − y 2 2 < 2log(1 − p A ) N , then also log(1 − y )
+ y <
2log(1 − p A ) N .
Solving for y in the ﬁrst inequality, we get sufﬁcient condition y > 2 (cid:113)
− log(1 − p A ) N .
Plugging 1 − σ 21 σ 20 into y we get:
[Equation]
which is very easily manipulated to the inequality from theorem statement.
Theorem 6: Let x 0 , x 1 , p A , σ 0 be as usual and let (cid:107) x 0 − x 1 (cid:107) =
R .
Then, the following two statements hold:
Let σ 1 ≤ σ 0 .
Then, for all σ 2 : σ 1 ≤ σ 2 ≤ σ 0 , if ξ > ( R, σ 2 ) > 0 . 5 , then ξ > ( R, σ 1 ) > 0 .
Let σ 1 ≥ σ 0 .
Then, for all σ 2 : σ 1 ≥ σ 2 ≥ σ 0 , if ξ < ( R, σ 2 ) > 0 . 5 , then ξ > ( R, σ 1 ) > 0 .
Proof.
We will ﬁrst prove the ﬁrst statement.
Denote, as usual in the proofs B i the worst-case ball for σ i , P i the probability associated to N ( x 1 , σ 2 i I ) .
Since ξ > ( R, σ 2 ) > 0 .
5 and since it is essentially P 2 ( B 2 ) , we see, that the probability of a ball under normal distribution is bigger than half.
This is obviously possible just if x 1 ∈ B 2 .
From the fact, that B 1 is the worst-case ball for σ 1 we see ξ > ( R, σ 1 )
=
P 1 ( B 1 ) ≥ P 1 ( B 2 ) .
It sufﬁces to show P 1 ( B 2 ) ≥ P 2 ( B 2 ) .
This follows, since σ 1 ≤ σ 2 and x 1 ∈ B 2 .
We know, that we can rescale the space such that
[Equation]
using the fact that σ just scales the normal distribution.
The set σ 2 σ 1 ( B 2 − x 1 ) + x 1 is just an image of B 2 via homothety with center x 1 and rate σ 2 σ 1 .
So it sufﬁces to prove
[Equation]
However, obviously σ 2 σ 1 ( B 2 − x 1 ) + x 1 ⊃ B 2 from convexity of a ball.
If, namely, x 1 + z ∈ B 2 , then from convexity also x 1 + σ 1 σ 2 z ∈ B 2 and this maps back to x 1 + z , thus x 1 + z is in an image.
Applying monotonicity of P , we obtain the result.
Now we will prove the second statement and as usual, let A 1 , A 2 , P 1 , P 2 be as usual ( A is now the ball connected to class A ).
As always, P 1 ( A 1 ) ≤ P 1 ( A 2 ) , so it sufﬁces to show P 2 ( A 2 ) < 0 .
5 =
⇒ P 1 ( A 2 ) < 0 .
Now, we need to distinguish two cases.
If x 1 ∈ A 2 , the proof is completely analogical to the ﬁrst part, but now reasoning on A ’s rather than B ’s. In this case, we will even get stronger P 1 (
A 2 ) ≤ P 2 ( A 2 ) just like in the ﬁrst part.
If x 1 (cid:54)∈ A 2 , then it is easy to see, that indeed P 2 ( A 2 ) < 0 .
5 , yet it is also obvious to see that P 1 ( A 2 ) < 0 .
This ﬁnishes the proof of the lemma.
Theorem 7: Let σ ( x ) be r -semi-elastic function and x 0 , p A , N, σ 0 as usual.
Then, the certiﬁed radius at x 0 guaranteed by our method is
[Equation]
[Equation]
Proof.
This follows easily from Theorem
Lemma 22.
Let us have f ( x ) =
M (cid:80) i =
1 f i ( x ) 1 ( x ∈ R i ) , where { R i } Mi =1 is ﬁnite set of regions that divide the R N and { f i } Mi =1 , f i : R i −→ R is ﬁnite set of 1-Lipschitz continuous (1-LC) functions.
Moreover assume, that f ( x ) is continuous.
Then, f ( x ) is 1-LC.
Proof.
We do not assume any nice behaviour from our decision regions, what can make the situation quite ugly.
For instance, regions might not be measurable.
However, it will not be a problem for us.
Fix x 1 , x 2 .
Consider line segment S
= x 1 + α ( x 2 − x 1 ) , α ∈ [0 , 1] .
Let us instead of points in S work with numbers in [0 , 1] via the α encoding.
Consider the following coloring C of [0 , 1] : Each point a ∈ [0 , 1] will be assigned one of M colors according to which region the x 1 + a ( x 2 − x 1 ) belongs.
Deﬁne d 1 ≡ 0 and d 2 = sup { z ∈ [0 , 1] , C ( z ) =
C ( d 1 ) } .
Thus, d 2 is the supremum of all numbers colored the same color as 0 .
Then,
[Equation]
Why?
Let { z j } ∞ j =1 be a non-decreasing sequence
s.t. C ( z j ) =
C (0) and z j −→ d 2 .
Since f is continuous, obviously f ( x 1 + d 2 ( x 2 − x 1 )) =
lim j −→ ∞ f
( x 1 + z j
( x 2 − x 1 )) .
Now, since norm and absolute value are both continuous functions and since from 1-LC of f C (0) on R C (0) we have ∀ j ∈ N :
[Equation]
we also necessarily have
[Equation]
If d 2 = 1 , we ﬁnish the construction.
If not, distinguish two cases.
First assume C ( d 2 ) =
C ( d 1 ) .
In this case, take some color C s.t.
∃{ z j } ∞ j =1 : z j +1 ≤ z j ∀ j ∈ N and z j −→ d 2 and z j > d 2 ∀ j ∈ N , and ﬁx one such { z j } ∞ j =1 .
Obviously, C (cid:54) =
C (0) , since d 2 is upper-bound on points of color
C (0) .
Then, deﬁne d 3 = sup { z ∈ [0 , 1] , C ( z ) =
C } and also deﬁne { z j } ∞ j =1 :
z j +1 ≥ z j ∀ j ∈
N and z j −→ d 3 .
From continuity of f , we again have f ( x 1 + d 2 ( x 2 − x 1 )) =
lim j −→ ∞ f
( x 1 + z j
( x 2 − x 1 )) and similarly f ( x 1 + d 3 ( x 2 − x 1 )) =
lim j −→ ∞ f
( x 1 + z j
( x 2 − x 1 )) .
Again from continuity of absolute value and norm and 1-LC of all the partial functions we have:
[Equation]
and |
[Equation]
( x
[Equation]
Now assume C ( d 2 ) (cid:54) =
C ( d 1 ) .
Then, we can take as C directly C ( d 2 ) and do the same as in the last paragraph (note, that this case could have implicitly come up in the previous construction too, but we would need to not take C = C (0) and we ﬁnd this case distinction to be more elegant).
If d 3 = 1 , we ﬁnish the construction.
If not, we continue in exactly the same manner as before.
Since the number of colors M is ﬁnite, we will run out of colors in ﬁnite number of steps and thus, eventually there will be l ≤ M s.t.
d l = 1 .
The ﬁnal 1-LC is now trivially obtained as follows:
[Equation]
Theorem 8: The σ ( x ) deﬁned in Equation 1 is r -semi-elastic.
Proof.
Our aim is to prove, that
[Equation]
is r lipschitz continuous.
Obviously, this does not depend neither on log( σ b ) , nor on − rm , so we will focus just on rk (cid:80)
[Equation]
Obviously, this function is r lipschitz continuous if and only if
[Equation]
Let us ﬁx y ∈ R N .
We will ﬁrst prove (cid:107) x − y (cid:107) is 1-LC.
Let us ﬁx x 1 , x 2 .
From triangle inequality we have
[Equation]
what is exactly what we wanted to prove.
Now ﬁx y 1 , y 2 , . . .
, y k and x 1 , x 2 .
Then (cid:12)(cid:12)(cid:12)(cid:12)
[Equation]
[Table]
Finally note, that using the k nearest neighbors out of ﬁnite training dataset will divide R N in a ﬁnite number of regions, where each region is deﬁned by the set of k nearest neighbors for x in that region.
Note, that the average distance from k nearest neighbors is obviously continuous.
Then, using Lemma 22, the claim follows.