#  SPLITZ: Certifiable Robustness via Split Lipschitz Randomized Smoothing
††thanks: This work was supported by NSF grants CCF 2100013, CNS 2209951, CCF
1651492, CNS 2317192 and CNS 1822071. This wrok has been submitted to IEEE
Transactions on Information Forensics and Security

Meiyu Zhong Ravi Tandon  Department of Electrical and Computer Engineering
University of Arizona, Tucson, USA
E-mail: {meiyuzhong<EMAIL_ADDRESS>
###### Abstract

Certifiable robustness gives the guarantee that small perturbations around an
input to a classifier will not change the prediction. There are two approaches
to provide certifiable robustness to adversarial examples– a) explicitly
training classifiers with small Lipschitz constants, and b) Randomized
smoothing, which adds random noise to the input to create a smooth classifier.
We propose SPLITZ, a practical and novel approach which leverages the
synergistic benefits of both the above ideas into a single framework. Our main
idea is to split a classifier into two halves, constrain the Lipschitz
constant of the first half, and smooth the second half via randomization.
Motivation for SPLITZ comes from the observation that many standard deep
networks exhibit heterogeneity in Lipschitz constants across layers. SPLITZ
can exploit this heterogeneity while inheriting the scalability of randomized
smoothing. We present a principled approach to train SPLITZ and provide
theoretical analysis to derive certified robustness guarantees during
inference. We present a comprehensive comparison of robustness-accuracy
tradeoffs and show that SPLITZ consistently improves upon existing state-of-
the-art approaches on MNIST and CIFAR-10 datasets. For instance, with
$\ell_{2}$ norm perturbation budget of $\epsilon=1$, SPLITZ achieves 43.2%
top-1 test accuracy on CIFAR-10 dataset compared to state-of-art top-1 test
accuracy 39.8%.

###### Index Terms:

Certified defense, Randomized smoothing, Lipschitz constants, Adversarial
defense.

##  I Introduction

As deep learning becomes dominant in many important areas, ensuring robustness
during test time becomes increasingly important. Deep neural networks are
known to be vulnerable to adversarial attacks: small imperceptible
perturbations in the inputs leading to incorrect decisions [1, 2]. Although
many works have proposed heuristic defenses for training robust classifiers,
they are often shown to be inadequate against adaptive attacks [3, 4, 5].
Therefore, a growing literature on certifiable robustness has emerged [6, 7,
8]; where the classifier’s prediction must be provably robust around any input
within a perturbation budget.

There are two broad approaches to design classifiers which are certifiably
robust: a) design classifiers which are inherently stable (i.e., smaller
Lipschitz constants) [9, 10, 11]. There are a variety of methods to train
classifiers while keeping the Lipschitz constants bounded. The second approach
is b) randomized smoothing (RS) [7, 12, 8]; here, the idea is to smooth the
decision of a base classifier by adding noise at the input. The approach of RS
has been generalized in several directions: Salman et al. [13] and Carlini et
al. [14] combine denoising mechanisms with smoothed classifiers, Salman et al.
[15] combine adversarial training with smoothed classifiers, Zhai et al. [16]
propose a regularization which maximizes the approximate certified radius and
Horváth et al. [17] combine ensemble models with smoothed classifiers.

Ensuring certified robustness by constraining the Lipschitz constant usually
involves the estimation of the Lipschitz constant for an arbitrary neural
network. The main challenge is that accurate estimation of Lipschitz constants
becomes hard for larger networks, and upper bounds become loose leading to
vacuous bounds on certified radius. Recently, a variety of approaches have
emerged that focus on training while explicitly constraining the model’s
Lipschitz constant (outputs), for instance, LMT [18] and BCP [11]. These
methods control the Lischitz constant of the model by constraining the outputs
of each layer (or the outputs of the model); this has the dual benefit of
enhanced robustness of the model as well as better estimation of the overall
Lipschitz constant of the model. To further minimize the Lipschitz constant
during the certified robust training process and better estimate the local
Lipschitz constant of the model, recent work [19] focus on the constrained
training with respect to the local Lipschitz constant by utilizing the clipped
version of the activation functions.

Another line of works [20, 21] propose using models for which each individual
layer is $1$-Lipschitz. By enforcing orthogonal or near-orthogonal weight
matrices, these networks naturally limit their sensitivity to input
perturbations, contributing to a form of robustness that does not solely
depend on Lipschitz constant estimation. This approach can complement the
limitations of both Lipschitz constrained training and RS, particularly in
handling larger models where direct Lipschitz estimation becomes impractical.
Orthogonal constraints help maintain the global Lipschitz constant close to
$1$.

Lipschitz constrained training provides deterministic guarantees on certified
radius and is often challenging to accurately estimate the Lipschitz constant
of a large neural network. RS on the other hand offers scalability to
arbitrarily large networks and provide the closed-form certified robust
radius. These guarantees, however, are probabilistic in nature and the
smoothing procedure treats the entire classifier as a black box mechanism.

TABLE I: Comparison of certified test accuracy (%) on MNIST under $\ell_{2}$ norm perturbation. Each entry lists the certified accuracy using numbers taken from respective papers (RS results follow from previous benchmark papers [22, 12]). |  |  Certified Test Accuracy at $\epsilon~{}(\%)$
---|---|---
Method | Extra data | 1.50 | 1.75 | 2.00 | 2.25 | 2.50
RS [7] | ✗ | 67.3 | 46.2 | 32.5 | 19.7 | 10.9
MACER [16] | ✗ | 73.0 | 50.0 | 36.0 | 28.0 | -
Consistency [22] | ✗ | 82.2 | 70.5 | 45.5 | 37.2 | 28.0
SmoothMix [12] | ✗ | 81.8 | 70.7 | 44.9 | 37.1 | 29.3
DRT [23] | ✗ | 83.3 | 69.6 | 48.3 | 40.3 | 34.8
RS+OrthoNN [21] | ✗ | 70.1 | 49.7 | 33.2 | 21.0 | 10.5
SPLITZ | ✗ | 80.2 | 71.3 | 62.3 | 51.7 | 40.5
Figure 1: (a) Lipschitz constants of each affine layer in pretrained models:
VGG16 [24], ResNet18 [25], SqueezeNet [26]. (b) Local Lipschitz (upper) bound
for three random CIFAR-10 images on VGG16; (c) Percentage analysis of local
Lipschitz (upper) bound in CIFAR-10 test data (additional results are
presented in the Appendix A).

Overview of SPLITZ and Contributions. In this paper, we propose SPLITZ, which
combines and leverages the synergies offered by both local Lipschitz
constrained training and randomized smoothing. The general idea is to split a
classifier into two halves: the first half (usually a few layers) is
constrained to keep a smaller Lipschitz (upper) bound, and the latter half of
the network is smoothed via randomization. We propose the use of local
Lipschitz constant(s) of the first half of the network. This is because it can
capture the stability of the model with respect to each individual input. To
enhance certified robustness, we incorporated the local Lipschitz constant of
the network’s first half into the loss function as a regularization term. This
approach aims to maintain a comparatively small local Lipschitz constant
(typically less than 1) for the network’s first half, thereby improving the
certified robustness. To obtain the certified radius during inference, we
derive a closed-form expression for the certified radius based on the local
Lipschitz constant as well as the randomized smoothing parameters as shown in
Theorem 1; this result illustrates that enforcing a relatively small local
Lipschitz constant can help in improving the certified radius. To the best of
our knowledge, this is the first systematic framework to combine the ideas of
local Lipschitz constants with randomized smoothing.

Interestingly, this approach yields state-of-the-art results for several
datasets. For instance, Table I compares the certified test accuracy of SPLITZ
and existing state-of-art techniques for various values of $\epsilon$
(perturbation budget or certified radius) on the MNIST dataset. For $\epsilon$
($\ell_{2}$ norm perturbation size) even as large as $2.5$, where the state-
of-the-art accuracy is $34.8\%$, SPLITZ achieves certified accuracy of around
$40.5\%$. In Section IV, we present comprehensive set of results on MNIST and
CIFAR-10 datasets. In addition, we also provide a detailed ablation study, and
study the impact of various hyperparameters (such as the location of the
split, randomized smoothing parameters).

Intuition behind SPLITZ. The intuition behind SPLITZ comes from the following
key observations: a) Layer-wise Heterogeneity: many modern deep networks
exhibit heterogeneity in Lipschitz constants across layers. Fig 1(a) shows the
per-layer Lipschitz constants for three networks (VGG16, ResNet18 and
SqueezeNet). We observe that the values can vary widely across the layers, and
quite often, latter half of the network often shows larger Lipschitz
constants. b) Input (local) heterogeneity: We show the local Lipschitz (upper)
bounds for three randomly sampled images from CIFAR-10 when passed through the
first four layers of VGG16; note that the values of local Lipschitz bound can
vary across different inputs (images). The same behavior across the entire
CIFAR-10 test dataset is shown in Fig. 1(c). These observations motivate
SPLITZ as follows: smoothing the input directly may not be the optimal
approach as it does not account for this heterogeneity. Instead, by
introducing noise at an intermediate stage of the classifier, the model can
become more resilient to perturbations. This suggests the idea of splitting
the classifier. Simultaneously, the first half of the network should also be
“stable”, which motivates constraining the Lipschitz bound of first half of
the network.

The paper is organized as follows: Section II introduces the objectives of the
paper, preliminaries, and definitions of randomized smoothing and Lipschitz
constant(s) used in the paper. Additionally, we review related works
concerning randomized smoothing and Lipschitz training. Section III discusses
the theoretical guarantees of SPLITZ and the corresponding training
mechanisms. Experiments and evaluation results are presented and discussed in
Section IV. Furthermore, additional experimental details on the Lipschitz
constant, theoretical results on the local Lipschitz bound, and supplementary
experimental results of the main findings are provided in the Appendices A, B,
and C, respectively. Our code is available at:
https://anonymous.4open.science/r/SPLITZ-3C66.

##  II Preliminaries on Certified Robustness

We consider a robust training problem for multi-class supervised
classification, where we are given a dataset of size $N$,
$\\{x_{i},y_{i}\\}_{i=1}^{N}$, where $x_{i}\in\mathbb{R}^{d}$ denotes the set
of features of the $i$th training sample, and
$y_{i}\in\mathcal{Y}:=\\{1,2,\dots,C\\}$ represents the corresponding true
label. We use $f$ to denote a classifier, which is a mapping $f$:
$\mathbb{R}^{d}\rightarrow\mathcal{Y}$ from input data space to output labels.
From the scope of this paper, our goal is to learn a classifier which
satisfies certified robustness, as defined next.

######  Definition 1.

(Certified Robustness) A (randomized) classifier $f$ satisfies
$(\epsilon,\alpha)$ certified robustness if for any input $x$, we have

$\mathbb{P}(f(x)=f(x^{\prime}))\geq 1-\alpha$, $\forall x^{\prime}$, such that
$x^{\prime}=x+\delta,\parallel\delta\parallel_{p}\leq\epsilon$

where the probability above is computed w.r.t. randomness of the classifier
$f$.

Intuitively, certified robustness requires that for any test input $x$, the
classifier’s decision remains locally invariant, i.e., for all $\forall
x^{\prime}$ around $x$, such that $\parallel
x^{\prime}-x\parallel_{p}\leq\epsilon$, $f(x)=f(x^{\prime})$ with a high
probability. Thus, $\epsilon$ is referred to as the certified radius, and
$(1-\alpha)$ measures the confidence. We mainly focus on $\ell_{2}$ norm
($p=2$) for the scope of this paper.

The literature on certified robustness has largely evolved around two distinct
techniques: Randomized Smoothing and Lipschitz constrained training for
Certifiably Robustness. We first briefly summarize and give an overview of
these two frameworks, before presenting our proposed approach of Split
Lipschitz Smoothing.

Randomized Smoothing (RS) [7] is a general procedure, which takes an arbitrary
classifier (base classifier) $f$, and converts it into a ”smooth” version
classifier (smooth classifier). Most importantly, the smooth classifier
preserves nice certified robustness property and provides easily computed
closed-form certified radius. Specifically, a general smooth classifier
$g_{RS}(\cdot)$ derived from $f$ is given as:

$\displaystyle
g_{RS}(x)=\underset{c~{}\in~{}\mathcal{Y}}{\text{argmax}}~{}\underset{\delta\sim\mathcal{N}(0,\sigma^{2}I)}{\mathbb{P}}(f(x+\delta)=c)$
(1)

Intuitively, for an input $x$, $g(x)$ will output the most probable class
predicted by the base classifier $f$ in the neighbourhood of $x$ with a high
confidence $1-\alpha$. In the paper [7], they prove that $g(x)$ is robust
against $\ell_{2}$ perturbation ball of radius
$\epsilon=\sigma\Phi^{-1}(\underline{p_{A}})$ around $x$, where $\sigma$ is
the standard deviation of the Gaussian noise, and $\underline{p_{A}}$ is the
lower bound of the probability that the most probable class predicted by the
classifier $f$ is $c_{A}$. RS is arguably the only certified defense which can
scale to large image classification datasets. Based on RS, a number of studies
have been undertaken in this field: RS was originally proposed to deal with
$\ell_{2}$ norm bounded perturbations; but was subsequently extended to other
norms using different smoothing distributions, including $\ell_{0}$ norm with
a discrete distribution [27], $\ell_{1}$ norm with a Laplace distribution
[28], and the $\ell_{\infty}$ norm with a generalized Gaussian distribution
[29]. Other generalizations include combining RS with adversarial training to
further improve certified robustness and generalization performance [15] or
denoising mechanisms (such as diffusion models) are often considered in
conjunction with RS [13, 14].

Achieving a large certified radius can be equivalently viewed as learning a
classifier with small Lipschitz constant. The Lipschitz constant is a
fundamental factor in numerous studies focused on training a certifiably
robust neural network, which can be defined as follows:

######  Definition 2.

(Global and Local Lipschitz Constant(s)) For a function $f$:
$\mathbb{R}^{d}\rightarrow\mathcal{Y}$, the Global, Local, and $\gamma$-Local
Lipschitz constants (at an input $x$) are respectively, defined as follows:

(Global Lipschitz constant)
$\displaystyle~{}~{}~{}~{}~{}~{}L_{f}=\underset{x,y\in\text{dom}(f);x\neq
y}{\sup}\frac{||f(y)-f(x)||_{p}}{||y-x||_{p}}$ (2) (Local Lipschitz constant)
$\displaystyle~{}~{}~{}~{}~{}~{}L_{f}(x)=\underset{y\in\text{dom}(f);y\neq
x}{\sup}\frac{||f(y)-f(x)||_{p}}{||y-x||_{p}}$ (3) ($\gamma$-Local Lipschitz
constant) $\displaystyle~{}~{}~{}~{}~{}~{}L^{(\gamma)}_{f}(x)=\underset{y\in
B(x,\gamma);y\neq x}{\sup}\frac{||f(y)-f(x)||_{p}}{||y-x||_{p}},$ (4)

where $B(x,\gamma)$ denotes the $\ell_{p}$-ball around $x$ of radius $\gamma$,
i.e., $B(x,\gamma)=\\{u:||u-x||_{p}\leq\gamma\\}$.

Informally, $L^{(\gamma)}_{f}(x)$ captures the stability of the function $f$
in the neighborhood of $x$, where the neighborhood is characterized by an
$\ell_{p}$-ball of radius $\gamma$.

Figure 2: Schematic of SPLITZ training framework. We first feed the input $x$
to the left half of the classifier denoted as $f_{L}$, where the local
Lipschitz constant of $f_{L}$ is constrained. Subsequently, we smooth the
right half of the classifier by introducing noise to the output of the left
half, expressed as: $f_{L}(x)+\delta$. Finally, the output of the right half
is $f_{R}(f_{L}(x)+\delta)$.

Lipschitz constrained training for Certifiably Robustness A reliable upper
bound for the local Lipschitz constant is essential for the robustness of a
classifier. However, computing the exact value of local Lipschitz constants
can be computationally challenging, prompting researchers to seek
approximations, in terms of upper bounds. Thus, a line of works focus on
deriving a tighter local Lipschitz bound e.g., [30, 31, 32]. Another line of
works utilize the local Lipschitz bound to obtain better robustness
guarantees, e.g., [33, 34]. Furthermore, there are several works which aim to
train a certified robust classifier as we briefly summarize next. One approach
is to estimate/upper bound the global Lipschitz constant of the classifier
(during each training epoch) and use it to ensure robustness. For instance,
[18, 11, 35] follow this general approach. The challenge is that the bounds on
global Lipschitz constants can be quite large, and do not necessarily
translate to improve certified robustness. An alternative approach is to use a
local Lipschitz bound (for each individual input $x$), as in [19] and then
explicitly minimize the Lipschitz bound during the training process. For
simplicity, we refer to the upper bound of the local Lipschitz constant as the
“local Lipschitz constant”.

##  III SPLITZ: Inference, Certification and Training

In this Section, we first describe the details of the proposed SPLITZ
classifier along with the motivation as well as key distinctions from prior
work. We then present new theoretical results on certified radius for SPLITZ.
Subsequently, we describe the training methodology for SPLITZ as well as
inference and computation of the certified radius. Suppose we are given a base
classifier $f:\mathbb{R}^{d}\rightarrow\mathcal{Y}$ which is a composition of
$K$ functions. Consider an arbitrary “split” of $f$ as
$f(\cdot)=f_{\text{R}}(f_{\text{L}}(\cdot))\triangleq f_{\text{R}}\circ
f_{\text{L}}$. As an example, if the classifier has $K=2$ hidden layers, i.e.,
$f(x)=f_{2}(f_{1}(x))$, then there are $K+1=3$ possible compositions/splits:

$\displaystyle a)f_{\text{R}}=I,f_{\text{L}}=f_{2}\circ f_{1},$ $\displaystyle
b)f_{\text{R}}=f_{2},f_{\text{L}}=f_{1},$ $\displaystyle
c)f_{\text{R}}=f_{2}\circ f_{1},f_{\text{L}}=I,$

where $I$ represents the identity function.

######  Definition 3.

(SPLITZ Classifier) Let $f$ be a base classifier:
$\mathbb{R}^{d}\rightarrow\mathcal{Y}$. Consider an arbitrary split of $f$ as
$f(\cdot)=f_{\text{R}}(f_{\text{L}}(\cdot))$. We define the SPLITZ classifier
$g_{\textit{SPLITZ}}(\cdot)$ as follows:

$\displaystyle
g_{\textit{SPLITZ}}(x)=\underset{c~{}\in~{}\mathcal{Y}}{argmax}~{}\underset{\delta\sim\mathcal{N}(0,\sigma^{2}I)}{\mathbb{P}}(f_{\text{R}}(f_{\text{L}}(x)+\delta)=c)$
(5)

The SPLITZ smoothing classifier is illustrated in Fig 2. The basic idea of
SPLITZ is two fold: smooth the right half of the network using randomized
smoothing and constrain the Lipschitz constant of the left half. Specifically,
to robustly classify an input $x$, we add noise to the output of the left half
(equivalently, input to the right half) of the network, i.e.,
$f_{\text{L}}(x)$ and then follow the same strategy as randomized smoothing
thereafter. While RS takes care of smoothing the right half, we would still
like the left half to be as stable as possible. Thus in addition to smoothing,
we need to ensure that the Lipschitz constant of the left half $f_{\text{L}}$
of the network is also kept small. We next present our main theoretical
result, which allows us to compute the certified radius for SPLITZ.

######  Theorem 1.

Let us denote $L_{f_{\text{L}}}^{(\gamma)}(x)$ as the $\gamma$-local Lipschitz
constant of the function $f_{\text{L}}$ at $x$ in a ball of size $\gamma$, and
$R_{f_{\text{R}}}(f_{\text{L}}(x))$ as the certified radius of the function
$f_{\text{R}}$ at the input $f_{\text{L}}(x)$, with probability at least
$(1-\alpha)$. Then, for any input $x$, with probability $1-\alpha$,
$g_{\textit{SPLITZ}}(x)$ has a certified radius of at least,

$\displaystyle R_{g_{\textit{SPLITZ}}}(x)=\underset{\gamma\geq
0}{\max}~{}~{}\min\left\\{\frac{R_{f_{\text{R}}}(f_{\text{L}}(x))}{L_{f_{\text{L}}}^{(\gamma)}(x)},\gamma\right\\}$
(6)

Figure 3: Comparison of certified radius with $\ell_{2}$ norm perturbation
w.r.t RS [7] and SPLITZ (ours), when varying levels of Gaussian noise
$\sigma\in\\{0.25,0.5,1.0\\}$ on the CIFAR-10 dataset. We can observe that
SPLITZ consistently outperforms RS [7] under different noise levels. For
instance, when Radius = 1.0, SPLITZ achieves $43.2\%$ certified test accuracy
while the best certified test accuracy of RS under different noise levels is
$22.0\%$. We refer the reader to Table II for a comprehensive comparison of
SPLITZ with several other approaches on CIFAR-10 dataset.

Given an input $x$, in order to compute the certified radius for SPLITZ
classifier, we need $L_{f_{\text{L}}}^{(\gamma)}(x)$, i.e., the $\gamma$-local
Lipschitz constant (discussed in the next Section) and the certified radius of
right half of the classifier, i.e., $R_{f_{\text{R}}}(f_{\text{L}}(x))$. For
Gaussian noise perturbation in the second half,
$R_{f_{\text{R}}}(f_{\text{L}}(x))$ is exactly the randomized smoothing
$\ell_{2}$ radius [7], given as
$R_{f_{\text{R}}}(f_{\text{L}}(x))=\frac{\sigma}{2}(\Phi^{-1}(\underline{p_{A}})-\Phi^{-1}(\overline{p_{B}}))$,
where $\underline{p_{A}}$ is the lower bound of the probability that the most
probable class $c_{A}$ is returned, $\underline{p_{B}}$ is upper bound of the
probability that the “runner-up” class $c_{B}$ is returned.

######  Remark 1.

Optimization over $\gamma$ We note from Theorem 1 that finding the optimal
choice of $\gamma$ is crucial. One way is to apply the efficient binary search
during the certify process to find the optimal value of $\gamma$.
Specifically, we set the initial value of $\gamma$ and compute the
corresponding local Lipschitz constant $L_{f_{L}}^{(\gamma)}(x)$ at input $x$.
By comparing the value between $\gamma$ and
${R_{f_{R}}(f_{L}(x))}/{L_{f_{L}}^{(\gamma)}(x)}$, we divide the search space
into two halves at each iteration to narrow down the search space until
$\gamma^{*}={R_{f_{R}}(f_{L}(x))}/{L_{f_{L}}^{(\gamma^{*})}(x)}$. Another way
is to do a one-step search. Specifically, we first approximate the local
Lipschitz constant $\tilde{L}_{f_{L}}^{(\gamma)}(x)$ at $x$ by averaging local
Lipschitz constants of inference data given the inference $\gamma$. We then
set $\gamma^{\prime}={R_{f_{R}}(f_{L}(x))}/{\tilde{L}_{f_{L}}^{(\gamma)}(x)}$
and re-calculate the local Lipschitz constant
$\tilde{L}_{f_{L}}^{(\gamma^{\prime})}(x)$ according to $\gamma^{\prime}$.
Finally, we compute the approximate optimal
$\gamma^{*}={R_{f_{R}}(f_{L}(x))}/{\tilde{L}_{f_{L}}^{(\gamma^{\prime})}(x)}$.
Overall, we show the certification process in detail in Algorithm 1.

######  Remark 2.

Split Optimization In Theorem 1, we presented our result for an arbitrary
split of the classifier. In principle, we can also optimize over how we split
the classifier. If the base classifier is a composition of $K$ functions and
the left part of the classifier $f_{L^{(s)}}$ contains $s$ layers and $f_{R}$
contains $(K-s)$ layers, then we can find the optimal split $s^{*}$ by varying
$s$ from $0,1,2,\ldots,K$. We can observe that selecting $s=0$ corresponds to
conventional randomized smoothing whereas $s=K$ corresponds to label
smoothing. In our experiments (see Section IV), we find that it is sufficient
to split after a few layers (e.g., split the classifier after the
$s=1^{\text{st}}$ layer, $f_{\text{L}}=f_{1}$) and this alone suffices to
outperform the state-of-art methods [15, 7, 22, 12] on the CIFAR-10 dataset,
where we show the comparison of certified radius (RS vs SPLITZ) in Fig 3.
Similar behavior can also be observed on other image datasets such as the
MNIST dataset. We further discuss the impact of different splitting strategies
in Section IV.

######  Remark 3.

Compatibility of SPLITZ with other defenses In addition, we claim that the
SPLITZ mechanism is also compatible with other RS based certified robust
techniques, such as adversarial smoothing [15], mixsmoothing [12] or denoising
diffusion models [14]. As an example, [14] propose a denosing mechanism using
a diffusion model, which achieves the state-of-the-art. Our SPLITZ classifier
contains two parts, left part is constrained by a small local Lipschitz
constant while right part is smoothed by noise, which is same as a randomized
smoothing based mechanism. Thus, our model can easily add a diffusion
denoising model after the noise layer (after $f_{L}(x)+\delta$) and then feed
the denoised samples into the $f_{R}$. Similarly, for adversarial smoothing or
mixsmoothing, SPLITZ is adaptable to feed either adversarial examples
($f_{L}(x^{\prime})+\delta$) or mixup samples ($f_{L}(\tilde{x})+\delta$)
respectively to the right half of the classifier $f_{R}$. On the other hand,
SPLITZ is also compatible to other Lipschitz constrained based mechanisms
(e.g., orthogonal neural network based mechanism [21, 20]). For instance, we
can incorporate an orthogonal constraint regularization into the loss function
to enforce orthogonality within the convolution layer throughout the training
process. The outcomes of integrating the orthogonal convolution neural network
with SPLITZ are meticulously detailed in the Section IV.

We next present our proof of Theorem 1 as follows.

###### Proof.

Let us consider an input $x$ to SPLITZ classifier $g_{\textit{SPLITZ}}(\cdot)$
and define the following function

$\displaystyle\tilde{g}(u)\triangleq\underset{c\in\mathcal{Y}}{argmax}~{}\mathbb{P}_{\delta}(f_{R}(u+\delta)=c).$
(7)

We first note from Definition 3 that $g_{\textit{SPLITZ}}(x)$ can be written
as $g_{\textit{SPLITZ}}(x)=\tilde{g}(f_{L}(x))$, where the function
$\tilde{g}$ is the smoothed version of $f_{R}$.

We are given that the smooth version $\tilde{g}$ has a certified radius of
$R_{\tilde{g}}(u)\triangleq R_{f_{\text{R}}}(u)$ with probability at least
$1-\alpha$. This is equivalent to the statement that for all $u^{\prime}$ such
that $||u-u^{\prime}||_{p}\leq R_{f_{\text{R}}}(u)$, we have:

$\displaystyle\tilde{g}(u)=\tilde{g}(u^{\prime}).$ (8)

We are also given $L_{f_{\text{L}}}^{(\gamma)}(x)$, the $\gamma$-local
Lipschitz constant of the function $f_{\text{L}}$ at $x$ in a ball of size
$\gamma$. This implies that for all $||x-x^{\prime}||_{p}\leq\gamma$,

$\displaystyle||f_{L}(x)-f_{L}(x^{\prime})||_{p}\leq
L_{f_{L}}^{(\gamma)}(x)||x-x^{\prime}||_{p}$ (9)

Now, setting $u=f_{\text{L}}(x)$ and $u^{\prime}=f_{\text{L}}(x^{\prime})$, we
obtain

$\displaystyle||u-u^{\prime}||_{p}=||f_{L}(x)-f_{L}(x^{\prime})||_{p}\leq
L_{f_{L}}^{(\gamma)}(x)||x-x^{\prime}||_{p}.$ (10)

Now observe that ensuring $g_{SPLITZ}(x)=g_{SPLITZ}(x^{\prime})$ is equivalent
to ensuring $\tilde{g}(f_{L}(x))=\tilde{g}(f_{L}(x^{\prime}))$, which in turn
is equivalent to $\tilde{g}(u)=\tilde{g}(u^{\prime})$. Thus, if we ensure that

$\displaystyle L_{f_{L}}^{(\gamma)}(x)||x-x^{\prime}||_{p}\leq
R_{f_{\text{R}}}(f_{\text{L}}(x))$
$\displaystyle\leftrightarrow||x-x^{\prime}||_{p}\leq\frac{R_{f_{R}}(f_{L}(x))}{L_{f_{L}}^{(\gamma)}(x)}$
(11)

then we have:

$\displaystyle g_{SPLITZ}(x)=g_{SPLITZ}(x^{\prime}).$ (12)

However, we also note that:

$\displaystyle||x-x^{\prime}||_{p}\leq\gamma,$ (13)

therefore the certified radius is given by:

$\displaystyle\min\left\\{\frac{R_{f_{R}}(f_{L}(x))}{L_{f_{L}}^{(\gamma)}(x)},\gamma\right\\}.$
(14)

We finally note that the choice of $\gamma$ (size of the ball) was arbitrary,
and we can pick the optimum choice that yields the largest radius. This leads
to the final expression for certified radius for SPLITZ:

$\displaystyle R_{g_{\textit{SPLITZ}}}(x)=\underset{\gamma\geq
0}{\max}~{}~{}\min\left\\{\frac{R_{f_{\text{R}}}(f_{\text{L}}(x))}{L_{f_{\text{L}}}^{(\gamma)}(x)},\gamma\right\\}$
(15)

and completes the proof of the Theorem. ∎

We show the inference and certification process of SPLITZ in Algorithm 1.

Training Methodology for SPLITZ In this Section, we present the details on
training the SPLITZ classifier. The key to ensuring the certified robustness
of the SPLITZ classifier is to keep the local Lipschitz constant of the left
half of the classifier $f_{L}$ small while smoothing the right half of the
classifier $f_{R}$. Let us denote $w_{L}$, $w_{R}$ as the training parameters
of $f_{L}$ and $f_{R}$, respectively. We propose the following training loss
function:

$\displaystyle\underset{w_{L},w_{R}}{\text{min}}~{}\frac{1-\lambda}{N}\sum_{i=1}^{N}\mathbb{E}_{\delta}[\text{Loss}(f_{R}^{w_{R}}(f_{L}^{w_{L}}(x_{i})+\delta),y_{i})]$
$\displaystyle+\frac{\lambda}{N}\sum_{i=1}^{N}\text{max}(\theta,L_{f_{L}^{w_{L}}}^{(\gamma)}(x_{i})),$
(16)

where $\lambda\in[0,1]$ is a hyperparameter controlling the tradeoff between
the accuracy and robustness, $\theta$ is a learnable parameter to optimize the
local Lipschitz constant, and $\text{Loss}(\cdot)$ is the loss function (e.g.,
cross entropy loss). Following the literature on randomized smoothing, we
replace the expectation operators with their empirical estimates, and our loss
function becomes:

$\displaystyle\underset{w_{L},w_{R}}{\text{min}}~{}\underbrace{\frac{1-\lambda}{N}\sum_{i=1}^{N}\left(\frac{1}{Q}\sum_{q=1}^{Q}\text{Loss}(f_{R}^{w_{R}}(f_{L}^{w_{L}}(x_{i})+\delta_{q}),y_{i})\right)}_{\text{"Smoothing"
loss for}f_{R}}$
$\displaystyle+\underbrace{\frac{\lambda}{N}\sum_{i=1}^{N}\text{max}(\theta,L_{f_{L}^{w_{L}}}^{(\gamma)}(x_{i}))}_{\text{Lipschitz
regularization for}f_{L}}.$ (17)

As illustrated in Eq III, we first input the image $x_{i}$ to the left part of
the classifier $f_{L}(x_{i})$ and then add noise $\delta_{q}$, which forms the
noisy samples $f_{L}(x_{i})+\delta_{q}$. We then feed noisy samples to the
right part of the classifier $f_{R}(f_{L}(x_{i})+\delta_{q})$ and obtain the
corresponding prediction. Given the true label $y_{i}$, the loss (e.g., cross
entropy) w.r.t $x_{i}$ can be computed. At the same time, the local Lipschitz
constant of the left part of the classifier needs to be minimized. To this
end, we propose a regularization term to the loss function, which controls the
local Lipschitz constant of $f_{L}$. In addition, we do not want the value of
the local Lipschitz constant to become too small during the training process,
which may lead to a poor accuracy. Therefore, we set a learnable Lipschitz
constant threshold $\theta$ for local Lipschitz constant of $f_{L}$, and use
$\text{max}(\theta,L_{f_{L}}^{(\gamma)}(x_{i}))$ as the regularization term.

Algorithm 1 SPLITZ Inference & Certification

Input: Test input $x$, classifier $f^{*}_{L},f^{*}_{R}$, noise level $\sigma$,
hyperparameter $\gamma$, confidence parameter $\alpha$, number of noise
samples to predict top class $n_{0}$, number of noise samples to estimate the
lower bound of the probability of the top class $n_{1}$.

Output: The certified radius $R_{g_{\textit{SPLITZ}}}(x)$ and corresponding
prediction of the given input $x$.

1: Run the SPLITZ classifier $n_{0}$ times:
$\\{f^{*}_{R}(f^{*}_{L}(x)+\delta_{i})\\}_{i=1}^{n_{0}}$ using $n_{0}$
independent noise realizations.

2: Compute $\text{count}_{n_{0}}(i)=\text{\\# of times class $i$ is the top
class}$. SPLITZ inference/prediction:
$c_{A}=\arg\max_{i}\text{count}_{n_{0}}(i)$

3: Approximate the lower confidence bound $\underline{p_{A}}$ of the
probability of the top class $c_{A}$ from $n_{1}$ independent runs of the
SPLITZ classifier with confidence $1-\alpha$.

4: if $\underline{p_{A}}>0.5$ then

5: Compute the certified radius of $f^{*}_{R}$:
$R_{f^{*}_{R}}(f^{*}_{L}(x))\leftarrow\sigma\Phi^{-1}(\underline{p_{A}})$

6: Optimize $\gamma^{*}$ (discussed in Remark $1$) and calculate the
corresponding local Lipschitz bound on $f^{*}_{L}$. (Eq. 18).

7: Compute the overall certified radius $R_{g_{\textit{SPLITZ}}}(x)$ at $x$
(as shown in Theorem 1):
$R_{g_{\textit{SPLITZ}}}(x)\leftarrow\min\left\\{R_{f^{*}_{\text{R}}}(f^{*}_{\text{L}}(x))/L_{f^{*}_{\text{L}}}^{(\gamma^{*})}(x),\gamma^{*}\right\\}$

8: Return prediction $c_{A}$ and certified radius $R_{g_{\textit{SPLITZ}}}(x)$

9: else

10: Return abstain

11: end if

Computing the Local Lipschitz bound: We note that both SPLITZ training as well
as inference/certification require the computation of the local Lipschitz
constant of the left half of the network, i.e., $f_{L}$. The simplest approach
would be to use a bound on the global Lipschitz constant of $f_{L}$. For
example, if $f_{L}$ is composed of $s$ layers, with each layer being a
combination of an affine operation followed by ReLU nonlinearity, then the
following simple bound could be used:

$\displaystyle
L^{(\gamma)}_{f_{L}}(x)\leq||W_{s}||_{2}\times||W_{s-1}||_{2}\dots||W_{1}||_{2},$

where $W_{s}$ is the weight matrix of layer $s$ and $||W_{s}||_{2}$ denotes
the corresponding spectral norm. However, this bound, while easy to compute
turns out to be quite loose. More importantly, it does not depend on the
specific input $x$ as well as the parameter $\gamma$. Fortunately, bounding
the local Lipschitz constant of a classifier is an important and a well
studied problem. There are plenty of mechanisms to estimate the local
Lipschitz bound of $f_{L}$. In principle, our SPLITZ classifier is compatible
with these local Lipschitz bound estimation algorithms. From the scope of this
paper, we use the local Lischitz constant constrained methodology proposed in
[19] which leads to much tighter bounds on the local Lipschitz constant and
maintain the specificity on the input $x$. Specifically, we apply the clipped
version of activation layers (e.g. ReLU) to constrain each affine layer’s
output and obtain the corresponding upper bound (UB) and the lower bound (LB)
for each affine layer, where the classifier is given an input $x$ around a
$\gamma$ ball. We use an indicator function $I^{v}$ to represent index of the
rows or columns in the weight matrices of each affine layer, which within the
range from LB to UB. By multiplying each affine layer’s weight matrix and each
clipped activation layer’ indicator matrix, the tighter local Lipschtz
constant can be obtained. Assume $f_{L}$ network contains $s$-affine-layer
neural network and each affine layer is followed by a clipped version of the
activation layer, (upper bound of) the local Lipschitz constant $L$ of $f_{L}$
around the input $x$ is:

$\displaystyle L_{f_{L}}^{(\gamma)}(x)\leq$ $\displaystyle\parallel
W_{s}I^{v}_{s-1}\parallel_{2}\times\parallel
I^{v}_{s-1}W_{s-1}I^{v}_{s-2}\parallel_{2}\dots\parallel
I^{v}_{1}W_{1}\parallel_{2},$ (18)

where $W_{s}$ is the weight matrix of layer $s$.

Algorithm 2 SPLITZ Training

Input: Training set $D_{train}=\\{x_{i},y_{i}\\}_{i=1}^{N_{train}}$; noise
level $\sigma$, training steps $T$, Lipschitz threshold $\theta$, training
hyperparameter $\gamma$.

Output: $f_{L}^{*}$, $f_{R}^{*}$.

1: for $t=0,\dots,T-1$ do

2: Compute local Lipschitz constant of $f_{L}$:
$L_{f_{L}}^{\gamma}(x)\leftarrow Cal\\_Lip~{}(f_{L},x,\gamma)$.

3: Sample noise $\delta$ and add it to outputs of $f_{L}$ to obtain noise
samples: $f_{L}(x)+\delta$

4: Feed the noise samples to $f_{R}$ network to get the corresponding
predictions: $f_{R}(f_{L}(x)+\delta)$

5: Set the local Lipschitz threshold $\theta$ and minimize the loss function
in Eq. III.

6: end for

Function $Cal\\_Lip$ ($f_{L},x,\gamma$)

1: Compute the $UB_{k}$ and $LB_{k}$ for each layer $k$ in $f_{L}(x)$ given
the perturbation $\gamma$ around input $x$

2: Compute the indicator matrix $I^{v}_{k}$ for each layer $k$

3: Compute the local Lipschitz constant $L_{f_{L}}^{(\gamma)}(x)$ (Eq. 18)

Return $L_{f_{L}}^{(\gamma)}(x)$

Summary of SPLITZ Training Methodology Overall, our training procedure is
presented in Algorithm 2. During the process of computing local Lipschitz
constant of $f_{L}$, for each iteration, we feed the input to the classifier
$f_{L}$ and calculate the LB and UB of outputs of each affine layer in $f_{L}$
given the input $x$ within a $\gamma$ ball. We then can calculate the
indicator matrix $I^{v}$ and compute the spectral norm of the reduced weight
matrix $\parallel I^{v}_{s}W_{s}I^{v}_{s}\parallel$ for each layer $s$ in
$f_{L}$ using power iteration. By multiplying the reduced weight matrix of
each affine layer in $f_{L}$, we are able to arrive at the local Lipschitz
constant of $f_{L}$. Secondly, we smooth the right half of the neural network
$f_{R}$ by sampling from Gaussian noise with zero mean and adding it to the
output of $f_{L}$. Then we feed the noisy samples $f_{L}(x)+\delta$ to $f_{R}$
and obtain the corresponding loss. Next, we minimize the overall loss and
backward the parameters to optimize the overall network $f$. Finally, we
certify the base classifier $f$ to obtain the Lipschitz smoothing classifier
$g_{\textit{SPLITZ}}$ as shown in Algorithm 1.

##  IV Experiments and Evaluation Results

In this section, we evaluate the SPLITZ classifier on two datasets, MNIST[36]
and CIFAR-10 [37], where we demonstrate that our proposed approach
consistently surpasses other state-of-the-art methods. For all datasets, we
report the approximate certified test accuracy and certified radius of
smoothed classifiers over test datasets (full test datasets in MNIST and
CIFAR-10 datasets). Same as previous works, we vary the noise level
$\sigma\in\\{0.25,0.5,1.0\\}$ for the smoothed models on CIFAR-10 dataset
($\sigma\in\\{0.25,0.5,0.75,1.0\\}$ for MNIST dataset) and certified the same
noise level $\sigma$ during the inference time. To ensure a fair comparison
with previous studies, we provide the highest reported results from each paper
for the corresponding above levels of noise magnitudes. To improve certified
robustness, we utilize the tighter local Lipschitz bound introduced in [19].
For two datasets, we use the same model as previous works [7, 14, 12, 22]
(LeNet for MNIST, ResNet110 for CIFAR-10). More experimental details are
described in Appendix C.

Evaluation metric Our evaluation metric to measure the certified robustness of
the smooth classifier is based on the standard metric proposed in [7]: the
approximate certified test accuracy, which can be estimated by the fraction of
the test dataset which CERTIFY classifies are correctly classified and at the
same time corresponding radius are larger than radius $\epsilon$ without
abstaining. Another alternative metric is to measure the average certified
radius (ACR) considered by [16]. We show that SPLITZ consistently outperforms
other mechanisms w.r.t ACR. For all experiments, we applied the $\ell_{2}$
norm input perturbation.

TABLE II: Comparison of the approximate certified test accuracy (%) on CIFAR-10 under $\ell_{2}$ norm perturbation. Extra data indicates whether their models incorporate other datasets in their models. Each entry lists the certified accuracy using numbers taken from respective papers. We set our values bold face when the value outperforms the best among the comparison methods.  |  |  Certified accuracy at $\epsilon~{}(\%)$
---|---|---
Method | Extra data | 0.25 | 0.5 | 0.75 | 1.0
PixelDP [8] | ✗ | 22.0 | 2.0 | 0.0 | 0.0
RS [7] | ✗ | 61.0 | 43.0 | 32.0 | 22.0
SmoothAdv [15] | ✗ | 67.4 | 57.6 | 47.8 | 38.3
SmoothAdv [15] | ✓ | 74.9 | 63.4 | 51.9 | 39.6
MACER [16] | ✗ | 71.0 | 59.0 | 46.0 | 38.0
Consistency [22] | ✗ | 68.8 | 58.1 | 48.5 | 37.8
SmoothMix [12] | ✗ | 67.9 | 57.9 | 47.7 | 37.2
Boosting [17] | ✗ | 70.6 | 60.4 | 52.4 | 38.8
DRT [23] | ✗ | 70.4 | 60.2 | 50.5 | 39.8
ACES [38] | ✗ | 69.0 | 57.2 | 47.0 | 37.8
DDS [14] | ✓ | 76.7 | 63.0 | 45.3 | 32.1
DDS (finetuning) [14] | ✓ | 79.3 | 65.5 | 48.7 | 35.5
RS + OrthoNN [21] | ✗ | 63.3 | 45.9 | 28.9 | 19.2
SPLITZ | ✗ | 71.3 | 63.2 | 53.4 | 43.2

SPLITZ Methodology For all datasets, we split the classifier after
$1^{\text{st}}$ affine layer where the left half of the classifier contains
one convolution layer followed by the clipped ReLU layer (See Appendix B). The
rest of the classifier is the same as original models (LeNet for MNIST,
ResNet110 for CIFAR-10).

Dataset Configuration For both the MNIST and CIFAR-10 dataset(s), we draw
$n_{0}=10^{2},~{}n_{1}=10^{5}$ noise samples to certify the smoothing model
following [7, 14, 12]. We set the Lipschitz threshold (see Sec III) as
$\theta=0.5$. For local Lipschitz constrained training, we set tradeoff
parameter $\lambda$ (see Sec III) evenly decrease from $0.8-0.4$, $0.7-0.5$
respectively. We use one Nvidia P100 GPU to train the SPLITZ model with batch
size $512,256$ respectively. We apply Adam Optimizer for two datasets (MNIST,
CIFAR-10). For the MNIST dataset, we conduct training for 150 epochs and
utilize an early-stop strategy to search for the optimal classifier over an
additional 150 epochs. We set the initial learning rate as 0.001. The learning
rate is decayed (multiplied by 0.1) by 0.1 at every 50 epochs (50th, 100th…).
For the CIFAR-10 dataset, we train 200 epochs using the ResNet110 and use the
early-stop strategy to search for the optimal classifier over an additional
200 epochs. Furthermore, we set the initial learning rate as 0.001 and final
learning rate as $10^{-6}$. The learning rate starts to evenly decay at each
epoch from the half of the training epochs. We report our more experimental
details in Appendix C.

Baseline mechanisms We compare our method with various existing techniques
proposed for robust training of smoothed classifiers, as listed below: (a)
PixelDP [8]: cerified robust training with differential privacy mechanism; (b)
RS [7]: standard randomized smoothing with the classifier trained with
Gaussian augmentation; (c) SmoothAdv [15]: adversarial training combined with
randomized smoothing; (d) MACER [16]: a regularization approach which
maximizes the approximate certified radius; (e) Consistency [22]: a KL-
divergence based regularization that minimizes the variance of smoothed
classifiers $f(x+\delta)$ across $\delta$; (f) SmoothMix [12]: training on
convex combinations of samples and corresponding adversarial on smoothed
classifier; (g) Boosting [17]: a soft-ensemble scheme on smooth training; (h)
DRT [23]: a lightweight regularized training on robust ensemble ML models; (i)
ACES [38]: a selection-mechanism combined with a smoothed classifier; (j) DDS
[14]: a denoised diffusion mechanism combined with a smoothed classifier; (k)
RS [7] \+ OrthoNN [21]: an orthogonal convolutional layer followed by a
randomized smoothing model.

###  IV-A Main Results

Results on MNIST As showed in Table I, we can observe that SPLITZ outperforms
other state-of-art approaches in almost every value of $\epsilon$.
Impressively, we find that the SPLITZ classifier has a significant improvement
when the value of $\epsilon$ is large. For instance, when $\epsilon=2.50$,
SPLITZ classifier achieves 40.5% compared to state-of-art top-1 test accuracy
34.8% certified test accuracy on the MNIST dataset. Moreover, when we increase
$\epsilon$ from 1.50 to 2.50, RS drops from 67.3% to 10.9% decreasing 56.4%
test accuracy. SPLITZ, however, maintains higher certified test accuracy from
80.2% to 40.5% maintaining relatively higher test accuracy.

Results on CIFAR10 As shown in Table II and Fig 3, our method outperforms the
state-of-art approaches for every value of $\epsilon$ on CIFAR-10 dataset.
Interestingly, we find that the SPLITZ training has a significant improvement
when the value of $\epsilon$ is large. For instance, when $\epsilon=1.0$, the
model achieves 43.2% top-1 test accuracy on CIFAR-10 dataset compared to
state-of-art top-1 test accuracy 39.8%. One hypothesis is that minimizing the
Lipscitz bound of $f_{L}$ ($L_{f_{L}}\leq 1$) is able to boost the certified
radius of the model. Intuitively, more samples are correctly classified while
corresponding radius are larger than given $\epsilon$. In addition, we can
observe the similar trend as MNIST dataset. SPLITZ maintains higher certified
test accuracy when we increase $\epsilon$ from 0.25 to 1.00 compared to other
state-of-art mechanisms.

TABLE III: Comparison of average certified radius (ACR) across two different
datasets (MNIST, CIFAR-10). We can observe that for two datasets, SPLITZ
consistently achieves better results compared to other state-of-art
mechanisms. * is reported by [22, 12]

$\sigma$ | Methods | MNIST | CIFAR-10
---|---|---|---
0.25 | $\text{RS}^{*}$ | 0.911 | 0.424
$\text{SmoothAdv}^{*}$ | 0.932 | 0.544
MACER | 0.918 | 0.556
Consistency | 0.928 | 0.552
SmoothMix | 0.933 | 0.548
SPLITZ | 1.752 | 0.680
0.50 | $\text{RS}^{*}$ | 1.553 | 0.525
$\text{SmoothAdv}^{*}$ | 1.687 | 0.684
MACER | 1.583 | 0.726
Consistency | 1.697 | 0.726
SmoothMix | 1.694 | 0.737
SPLITZ | 2.059 | 0.924
1.00 | $\text{RS}^{*}$ | 1.620 | 0.542
SmoothAdv | 1.779 | 0.660
MACER | 1.520 | 0.792
Consistency | 1.819 | 0.816
SmoothMix | 1.823 | 0.773
SPLITZ | 2.104 | 0.979

Results on Average Certified Radius (ACR) We investigate the performance of
SPLITZ using average certified radius (ACR), where we measure the correct
samples’ average certified radius over the test datasets (MNIST, CIFAR-10). As
shown in Table III, we provide the comprehensive comparison results of average
certified radius (ACR) compared to other certified robust techniques. Our
SPLITZ consistently outperforms others. For instance, when
$\sigma=0.25~{}(0.50)$, the ACR of SPLITZ is 1.752 (2.059) respectively, where
the state-of-the-art is 1.697 (0.933) respectively. In addition, we can
observe the same trends in CIFAR-10 dataset, where SPLITZ consistently
outperforms the state-of-the-art when $\sigma=0.25,0.50$ and $1.00$.

TABLE IV: SPLITZ training time and certifying time across two datasets (MNIST
using LeNet, CIFAR-10 using ResNet 110 ).

Training
---
Datasets | Architecture | # of GPUs | Training per epoch (s) | Certifying per image (s)
MNIST | LeNet | 1 | 15.1 | 1.0
CIFAR-10 | ResNet110 | 1 | 59.5 | 50.7

TABLE V: Comparison of certified test accuracy of SPLITZ with Gaussian noise
$\sigma=0.75$ for varying the splitting layer on MNIST dataset with LeNet.

| Certified Test Accuracy at $\epsilon~{}(\%)$ |
---|---|---
Location of Splitting | 0.50 | 0.75 | 1.00 | 1.25 | 1.50 | 1.75 | 2.00 | 2.25 | 2.50
$1^{\text{st}}$ affine layer | 94.1 | 92.0 | 88.8 | 84.7 | 79.0 | 71.3 | 62.3 | 51.7 | 40.5
$2^{\text{nd}}$ affine layer | 89.7 | 86.2 | 81.0 | 75.0 | 68.0 | 59.9 | 51.0 | 41.4 | 31.8
$3^{\text{rd}}$ affine layer | 84.4 | 80.4 | 75.6 | 69.9 | 63.6 | 56.9 | 49.4 | 40.3 | 29.3

###  IV-B Training and certifying time

Our SPLITZ model needs to vary the value of $\gamma$ (the size of the ball
around input $x$) during the training epoch. Thus, we may need relatively more
time to obtain the optimal model. To solve this, we apply the early stop
mechanism to obtain the better optimized model during the training process. At
the same time, we decay our learning rates during the training process. We use
one Nvidia P100 GPU to train our SPLITZ model and report our training time
(certifying time) for each one epoch (one image) in the Table IV.

###  IV-C Ablation Study

We also conduct an ablation study to explore the effects of hyperparameters in
our proposed method on CIFAR-10 and MNIST datasets. We will explain the impact
of the splitting location, the effect of global (local) Lipschitz bound,
comparison of the orthogonal neural network (OrthoNN) and SPLITZ, effect of
input perturbation $\gamma$ and effect of learnable Lipschitz threshold
parameter $\theta$.

Figure 4: (a) Comparison of certified test accuracy of SPLITZ when varying
$\sigma$ on the MNIST dataset, (b) Comparison of certified test accuracy of
SPLITZ with Global vs Local Lipschitz bound ($\gamma$) on the MNIST dataset.

Impact of splitting location As mentioned in Section III, our SPLITZ
classifier can be optimized over different split ways, where we conduct the
experiments and show our results in Table V. For example, when $\epsilon=2$,
splitting after the $1^{st}$, or $2^{nd}$, or $3^{rd}$ layer result in
certified accuracy of $62.3$%, $51.0$% and $49.4$% respectively. These results
indicate that splitting the neural network early achieves better performance.
Intuitively, splitting the neural network early helps the model minimize the
local Lipschitz bound, which improves the certified robustness leading to a
higher certified test accuracy given the same $\epsilon$. As the splitting
becomes ”deeper”, estimating the local Lipshitz constant also becomes harder,
which implies that a looser bound leads to smaller certified radius.

Effect of global (local) Lipschitz constant of the first half of the
classifier As shown in Fig 4 (a), we investigate the effect of (upper bound
of) the Lipschitz constant of left half of the classifier on certified test
accuracy. Interestingly, we can observe that tighter Lipschitz bound gives
better certified accuracy given the same radius. Furthermore, using a bound on
the local Lipschitz constant to compute the certified accuracy is always
better than using the global Lipschitz constant. This is also clearly evident
from the result of Theorem 1.

Comparison of the orthogonal neural network (OrthoNN) and the SPLITZ In the
baseline RS+OrthoNN model, during the training process, we enforce the first
convolution layer of the classifier’s left half to act as an orthogonal
convolution neural network. This is achieved by incorporating an orthogonal
constraint regularization into the loss function. For the SPLITZ model, we
impose a constraint on the local Lipschitz constant of the classifier’s left
half. The comparison between RS+orthoNN and SPLITZ is illustrated in Table I
with respect to the MNIST dataset and in Table II with respect to the CIFAR-10
dataset. Our observations indicate that enforcing an orthogonal convolution
layer on the classifier’s left half has a comparatively lesser impact than
training with a local Lipschitz constraint.

TABLE VI: Comparison of certified test accuracy of SPLITZ with Gaussian noise
$\sigma=0.75$ for varying $Lip_{\theta}$ (the threshold of the local Lipschitz
bound around input $x$) on MNIST dataset.

| Certified Test Accuracy at $\epsilon~{}(\%)$
---|---
$Lip_{\theta}$ | 0.50 | 0.75 | 1.00 | 1.25 | 1.50 | 1.75 | 2.00 | 2.25 | 2.50
0.3 | 94.1 | 91.6 | 88.4 | 84.2 | 78.2 | 70.3 | 60.9 | 50.6 | 39.4
0.5 | 94.1 | 92.0 | 88.8 | 84.7 | 79.0 | 71.3 | 62.3 | 51.7 | 40.5
0.7 | 94.7 | 92.6 | 89.4 | 85.1 | 79.5 | 71.5 | 61.7 | 50.7 | 38.8

TABLE VII: Comparison of certified test accuracy of SPLITZ with Gaussian noise
$\sigma=0.75$ for varying $\gamma$ (the size of the ball around input $x$) on
MNIST dataset.

| Certified Test Accuracy at $\epsilon~{}(\%)$
---|---
$\gamma$ | 0.50 | 0.75 | 1.00 | 1.25 | 1.50 | 1.75 | 2.00 | 2.25 | 2.50
0.1 | 94.7 | 92.5 | 89.6 | 85.4 | 80.2 | 73.2 | 64.0 | 54.1 | 42.7
1 | 94.1 | 92.0 | 88.8 | 84.7 | 79.0 | 71.3 | 62.3 | 51.7 | 40.5
2 | 94.3 | 92.1 | 88.6 | 84.2 | 78.3 | 70.4 | 60.5 | 49.6 | 38.0

Effect of $\theta$ (Lipschitz threshold) As shown in Fig 4(b) and Table VI, we
analyze the effect of the training threshold $\theta$ (See Eq III). For
smaller values of $\epsilon$, SPLITZ with higher Lipschitz constant achieves
better performances on accuracy. Conversely, SPLITZ with a smaller Lipschitz
constant can boost certified radius, which obtains a relative higher certified
test accuracy when $\epsilon$ is larger. These observations suggest a trade-
off between the Lipschitz constant and certified accuracy. Thus, identifying
the optimal Lipschitz threshold is essential for achieving a balances between
robustness and utility. This ablation study further validates that the essence
of our SPLITZ classifier lies in maintaining a relatively optimized Lipschitz
constant for the left half of the classifier.

Effect of $\gamma$ (size of radius around input $x$) According to above
results, constraining the local Lipschitz constant achieves better
performance. To further explore the benefit of local Lipschitz constrained
training, it is necessary to explore the indicator matrix $I^{v}$ in Eq 18,
which depends on the size of the ball around the input (i.e., the
hyperparameter $\gamma$). In Table VII, we show how varying training $\gamma$
impacts the certified test accuracy for different values of $\epsilon$. We
observe that smaller values of training $\gamma$ lead to higher certified
accuracy for all values of $\epsilon$.

##  V Discussion and conclusion

In this paper, we presented SPLITZ, a novel and practical certified defense
mechanism, where we constrained the local Lipschitz bound of the left half of
the classifier and smoothed the right half of the classifier with noise. This
is because the local Lipschitz constant can capture information specific to
each individual input, and the relative stability of the model around that
input. To the best of our knowledge, this is the first systematic framework to
combine the ideas of local Lipschitz constants with randomized smoothing.
Furthermore, we provide a closed-form expression for the certified radius
based on the local Lipschitz constant of the left half of the classifier and
the randomized smoothing based radius of the right half of the classifier. We
show that maintaining a relatively small local Lipschitz constant of the left
half of the classifier helps to improve the certified robustness (radius). We
showed results on several benchmark datasets and obtained significant
improvements over state-of-art methods for MNIST, CIFAR-10 datasets. For
instance, on the CIFAR-10 dataset, SPLITZ can achieve $43.2\%$ certified test
accuracy compared to state-of-art certified test accuracy $39.8\%$ with
$\ell_{2}$ norm perturbation budget of $\epsilon=1$. We reported similar
results for the MNIST dataset. We believe that combining the core idea of
SPLITZ with other recent techniques, such as denoising diffusion models and
adversarial training can be a fruitful next step to further improve certified
robustness.

Figure 5: Lipschitz Constants of each affine layer in pretrained models:(a)
4C3F model (there are 4 convolution layers and 3 fully- connected layers in
the neural network. ) [19] , (b) Alexnet model [39], (c) ResNet34 model [25].
We can observe the similar trends that right half of the model usually contain
a larger Lipschitz constant, while the left half of the model preserves a
relatively smaller Lipschitz constant. Figure 6: (a) Local Lipschitz bound for
three random CIFAR-10 images on Alexnet, (b) Percentage analysis of local
Lipschitz bound in CIFAR-10 test data.

##  Appendix A Additional Results on Lipschitz bounds

In this Section, we provide additional Lipschitz constants results in the
prevalent neural networks in Fig 5. We can observe the similar trends as
previous that the right half of the neural network is more unstable than the
right half of the neural network. As shown in Fig 6 (a), we notice
considerable variation in the values of local Lipschitz constants across
different input images, a trend that is consistent throughout the entire
CIFAR-10 test dataset as depicted in Fig 6 (b). These findings lead us to
reconsider the efficacy of directly smoothing the input. Such an approach
doesn’t cater to the observed heterogeneity. Alternatively, injecting noise at
an intermediary step within the classifier can make the model more robust to
disturbances.

##  Appendix B Lipschitz Constrained Training

From the scope of this paper, we utilize the local Lipschitz contrained
training for the left half of the classifier introduced in [19]. We focus on
$l_{2}$ norm denoted as $\parallel\cdot\parallel$. Now we consider a neural
network $f$ containing $L$ affine layers (parameterized by $w$) each followed
by a clipped version ReLU$\theta$, which is defined as follows:

$\displaystyle ReLU\theta(x)=\begin{cases}0,&\text{if}~{}~{}x\leq 0\\\
x,&\text{if}~{}~{}0<x<\theta\\\ \theta,&\text{if}~{}~{}x\geq\theta\\\
\end{cases}$ (19)

The neural network maps input $x$ to output $f(x)$ using the following
architecture:

$\displaystyle z_{1}=x;z_{l}(x)=ReLU\theta(W_{l}x),z_{L+1}=W_{L}z_{L}$ (20)

We define the perturbation around the input $x$ as:

$\displaystyle
x^{\prime}=x+\epsilon,\parallel\epsilon\parallel\leq\delta,\delta\geq 0$ (21)

By adding perturbation around input $x$ within a $\delta$ ball,
$z(x^{\prime})$ can be bounded element-wise as $LB\leq z(x^{\prime})\leq UB$,
where $LB$ and $UB$ can obtain by bound propagation methods [9, 11]. We then
define the diagonal matrix $I^{v}$ to represent the entries where
ReLU$\theta$’s outputs are $varying$:

$\displaystyle
I^{v}(i,i)=\begin{cases}1,&\text{if}~{}~{}UB_{i}>0~{}~{}and~{}~{}LB_{i}<\theta\\\
0,&\text{otherwise}\\\ \end{cases}$ (22)

Next, the output of the ReLU$\theta$ $D^{v}$ can be defined as follows:

$\displaystyle
D^{v}(i,i)=\begin{cases}\mathbbm{1}(\text{ReLU}\theta(z_{l}^{i})>0),&\text{if}~{}~{}I^{v}(i,i)=1\\\
0,&\text{otherwise}\\\ \end{cases}$ (23)

where $\mathbbm{1}$ denote the indicator function. Then the local Lipschitz
bound at input $x$ is:

$\displaystyle L_{local}(x,f)\leq\parallel W_{L}I^{v}_{L-1}\parallel\parallel
I^{v}_{L-1}W_{L-1}I^{v}_{L-2}\parallel\dots\parallel I^{v}_{1}W_{1}\parallel$
(24)

As stated in [19], it straight forward to prove $\parallel
I^{v}_{L-1}W_{L-1}I^{v}_{L-2}\parallel\leq\parallel W_{L-1}\parallel$ using
the property of eigenvalues. We briefly prove it following from [19].

###### Proof.

Let $W^{\prime}=[W~{}I]^{T}$, The singular value of $W^{\prime}$ is defined as
the square roots of the eigenvalues of $W^{\prime T}~{}W^{\prime}$. We know
the following

$\displaystyle{W^{\prime}}^{T}W^{\prime}=W^{T}W+I^{T}I\geq W^{T}W.$ (25)

Therefore, we get the following result:

$\displaystyle\parallel W^{\prime}\parallel\geq\parallel W\parallel$ (26)

We complete the proof. ∎

Next, we will give a toy example to further illustrate the idea of local
Lipschitz bound.

A toy example Here we provide a similar toy example as mentioned in [19].
Consider a $2$-layer neural network with ReLU$\theta$ activation layer:

$\displaystyle
x\rightarrow\text{Linear1}(W^{1})\rightarrow\text{ReLU}\theta\rightarrow\text{Linear2}(W^{2})\rightarrow
y$ (27)

where $x\in\mathcal{R}^{3}$ and $y\in\mathcal{R}$ and $W^{l}$ denotes the
weight matrix for layer $l$. Moreover the threshold $\theta=1$.

Given the input [1,-1,0] with $\ell_{2}$ perturbation 0.1. Assume the weight
matrices are:

$\displaystyle W^{1}=\begin{bmatrix}2&0&0\\\ 0&2&0\\\
0&0&1\end{bmatrix},W^{2}=[1,1,1]$ (28)

Thus, we have the following:

$\displaystyle\text{Input}~{}[1,-1,0]\rightarrow$ (29)
$\displaystyle\begin{bmatrix}[0.9&1.1]\\\ [-1.1&-0.9]\\\
[-0.1&0.1]\end{bmatrix}\times\begin{bmatrix}2&0&0\\\ 0&2&0\\\
0&0&1\end{bmatrix}\rightarrow\begin{bmatrix}[1.8&2.2]\\\ [-2.2&-1.8]\\\
[-0.1&0.1]\end{bmatrix}$

According to the above upper bound (UB) and lower bound (LB), we obtain the
$I_{V}$ function as follows:

$\displaystyle I_{V}^{1}=\begin{bmatrix}0&0&0\\\ 0&0&0\\\ 0&0&1\end{bmatrix}$
(30)

Overall, we have the local Lipschitz bound as follows:

$\displaystyle L_{local}(x,f)\leq\parallel W^{2}I_{V}^{1}\parallel\parallel
I_{V}^{1}W^{1}\parallel=1$ (31)

For the global Lipschitz bound, we have the following:

$\displaystyle L_{global}\leq\parallel W^{2}\parallel\parallel
W^{1}\parallel=4$ (32)

Overall, we can find that the local Lipschiz bound is much tighter than the
global Lipschitz bound.

##  Appendix C Additional Experimental Details

In this section, we provide additional results for the two datasets, e.g.,
MNIST, CIFAR-10 dataset. We first provide the details of two datasets. Next,
we illustrate the baselines used in our paper. Note that we report the numbers
(certified test accuracy, average certified radius) from respective papers.

###  C-A Training details

For all value of $\sigma$, we keep the value of training $\sigma$ and testing
$\sigma$ to be the same. We apply the noise samples $n_{0}=100$ to predict the
most probably class $c_{A}$ and denote $\alpha=0.001$ as the confidence during
the certifying process. Furthermore, we use $n_{1}=100,000$ to calculate the
lower bound of the probability $p_{A}$ for the MNIST, CIFAR-10 respectively.
Moreover, to maintain a relatively small local Lipschitz constant of left half
of the SPLITZ classifier, we set the threshold of clipped ReLU (see Sec B) as
1 for all datasets. For estimating the local Lipschitz constant of the left
half of the classifier, the power iteration is 5, 2 during the training for
MNIST, CIFAR-10 respectively following from [19].

###  C-B Details of datasets

MNIST [36] dataset contains handwritten digits usually used for image
classification problems. The dataset is comprised of a total of 70,000 images,
with 60,000 images in the training set and 10,000 in the test set. The dataset
has 10 classes and is in grayscale format. We pre-process the MNIST dataset
using normalization. We incorporate the Lipschitz constant of the
normalization layer when calculating the local Lipschitz constant of the left
half of the classifier.

CIFAR-10 [37] dataset consists of 60,000 RGB images distributed across 10
categories: airplane, automobile, bird, cat, deer, dog, frog, horse, ship, and
truck. Each category is represented by 6,000 images. The dataset is divided
into a training set with 50,000 images and a test set containing 10,000
images. We employ the conventional data augmentation techniques of random
horizontal flipping and random translation by up to 4 pixels, consistent with
methods used in other baseline studies [14, 7, 12]. Additionally, we normalize
each image on a pixel-by-pixel basis. We incorporate the Lipschitz constant of
the normalization layer when calculating the local Lipschitz constant of the
left half of the classifier.

## References

  * [1] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in International Conference on Learning Representations, 2014.
  * [2] B. Biggio, I. Corona, D. Maiorca, B. Nelson, N. Šrndić, P. Laskov, G. Giacinto, and F. Roli, “Evasion attacks against machine learning at test time,” in Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2013, Prague, Czech Republic, September 23-27, 2013, Proceedings, Part III 13, pp. 387–402, Springer, 2013.
  * [3] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014.
  * [4] N. Carlini and D. Wagner, “Adversarial examples are not easily detected: Bypassing ten detection methods,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security, pp. 3–14, 2017.
  * [5] J. Uesato, B. O’donoghue, P. Kohli, and A. Oord, “Adversarial risk and the dangers of evaluating against weak attacks,” in International Conference on Machine Learning, pp. 5025–5034, PMLR, 2018.
  * [6] E. Wong and Z. Kolter, “Provable defenses against adversarial examples via the convex outer adversarial polytope,” in International Conference on Machine Learning, pp. 5286–5295, PMLR, 2018.
  * [7] J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in International Conference on Machine Learning, pp. 1310–1320, PMLR, 2019.
  * [8] M. Lecuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana, “Certified robustness to adversarial examples with differential privacy,” in 2019 IEEE Symposium on Security and Privacy (SP), pp. 656–672, IEEE, 2019.
  * [9] S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. Mann, and P. Kohli, “On the effectiveness of interval bound propagation for training verifiably robust models,” arXiv preprint arXiv:1810.12715, 2018.
  * [10] M. Mirman, T. Gehr, and M. Vechev, “Differentiable abstract interpretation for provably robust neural networks,” in International Conference on Machine Learning, pp. 3578–3586, PMLR, 2018.
  * [11] S. Lee, J. Lee, and S. Park, “Lipschitz-certifiable training with a tight outer bound,” Advances in Neural Information Processing Systems, vol. 33, pp. 16891–16902, 2020.
  * [12] J. Jeong, S. Park, M. Kim, H.-C. Lee, D.-G. Kim, and J. Shin, “Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness,” Advances in Neural Information Processing Systems, vol. 34, pp. 30153–30168, 2021.
  * [13] H. Salman, M. Sun, G. Yang, A. Kapoor, and J. Z. Kolter, “Denoised smoothing: A provable defense for pretrained classifiers,” Advances in Neural Information Processing Systems, vol. 33, pp. 21945–21957, 2020.
  * [14] N. Carlini, F. Tramer, K. D. Dvijotham, L. Rice, M. Sun, and J. Z. Kolter, “(certified!!) adversarial robustness for free!,” in The Eleventh International Conference on Learning Representations, 2023.
  * [15] H. Salman, J. Li, I. Razenshteyn, P. Zhang, H. Zhang, S. Bubeck, and G. Yang, “Provably robust deep learning via adversarially trained smoothed classifiers,” Advances in Neural Information Processing Systems, vol. 32, 2019.
  * [16] R. Zhai, C. Dan, D. He, H. Zhang, B. Gong, P. Ravikumar, C.-J. Hsieh, and L. Wang, “Macer: Attack-free and scalable robust training via maximizing certified radius,” in International Conference on Learning Representations, 2020.
  * [17] M. Z. Horváth, M. N. Müller, M. Fischer, and M. Vechev, “Boosting randomized smoothing with variance reduced classifiers,” arXiv preprint arXiv:2106.06946, 2021.
  * [18] Y. Tsuzuku, I. Sato, and M. Sugiyama, “Lipschitz-margin training: Scalable certification of perturbation invariance for deep neural networks,” Advances in Neural Information Processing Systems, vol. 31, 2018.
  * [19] Y. Huang, H. Zhang, Y. Shi, J. Z. Kolter, and A. Anandkumar, “Training certifiably robust neural networks with efficient local lipschitz bounds,” Advances in Neural Information Processing Systems, vol. 34, pp. 22745–22757, 2021.
  * [20] X. Xu, L. Li, and B. Li, “Lot: Layer-wise orthogonal training on improving l2 certified robustness,” Advances in Neural Information Processing Systems, vol. 35, pp. 18904–18915, 2022.
  * [21] J. Wang, Y. Chen, R. Chakraborty, and S. X. Yu, “Orthogonal convolutional neural networks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11505–11515, 2020.
  * [22] J. Jeong and J. Shin, “Consistency regularization for certified robustness of smoothed classifiers,” Advances in Neural Information Processing Systems, vol. 33, pp. 10558–10570, 2020.
  * [23] Z. Yang, L. Li, X. Xu, B. Kailkhura, T. Xie, and B. Li, “On the certified robustness for ensemble models and beyond,” arXiv preprint arXiv:2107.10873, 2021.
  * [24] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in International Conference on Learning Representations, 2015.
  * [25] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp. 770–778, 2016.
  * [26] F. N. Iandola, S. Han, M. W. Moskewicz, K. Ashraf, W. J. Dally, and K. Keutzer, “Squeezenet: Alexnet-level accuracy with 50x fewer parameters and¡ 0.5 mb model size,” arXiv preprint arXiv:1602.07360, 2016.
  * [27] G.-H. Lee, Y. Yuan, S. Chang, and T. Jaakkola, “Tight certificates of adversarial robustness for randomly smoothed classifiers,” Advances in Neural Information Processing Systems, vol. 32, 2019.
  * [28] J. Teng, G.-H. Lee, and Y. Yuan, “$l_{1}$ adversarial robustness certificates: a randomized smoothing approach,” 2020.
  * [29] D. Zhang*, M. Ye*, C. Gong*, Z. Zhu, and Q. Liu, “Filling the soap bubbles: Efficient black-box adversarial certification with non-gaussian smoothing,” 2020.
  * [30] H. Zhang, P. Zhang, and C.-J. Hsieh, “Recurjac: An efficient recursive algorithm for bounding jacobian matrix of neural networks and its applications,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 33, pp. 5757–5764, 2019.
  * [31] M. Fazlyab, A. Robey, H. Hassani, M. Morari, and G. Pappas, “Efficient and accurate estimation of lipschitz constants for deep neural networks,” Advances in Neural Information Processing Systems, vol. 32, 2019.
  * [32] M. Jordan and A. G. Dimakis, “Exactly computing the local lipschitz constant of relu networks,” Advances in Neural Information Processing Systems, vol. 33, pp. 7344–7353, 2020.
  * [33] M. Hein and M. Andriushchenko, “Formal guarantees on the robustness of a classifier against adversarial manipulation,” Advances in Neural Information Processing Systems, vol. 30, 2017.
  * [34] L. Weng, H. Zhang, H. Chen, Z. Song, C.-J. Hsieh, L. Daniel, D. Boning, and I. Dhillon, “Towards fast computation of certified robustness for relu networks,” in International Conference on Machine Learning, pp. 5276–5285, PMLR, 2018.
  * [35] K. Leino, Z. Wang, and M. Fredrikson, “Globally-robust neural networks,” in International Conference on Machine Learning, pp. 6212–6222, PMLR, 2021.
  * [36] Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner, “Gradient-based learning applied to document recognition,” Proceedings of the IEEE, vol. 86, no. 11, pp. 2278–2324, 1998.
  * [37] A. Krizhevsky, G. Hinton, et al., “Learning multiple layers of features from tiny images,” 2009.
  * [38] M. Z. Horváth, M. N. Müller, M. Fischer, and M. Vechev, “Robust and accurate–compositional architectures for randomized smoothing,” arXiv preprint arXiv:2204.00487, 2022.
  * [39] A. Krizhevsky, I. Sutskever, and G. E. Hinton, “Imagenet classification with deep convolutional neural networks,” Advances in Neural Information Processing Systems, vol. 25, 2012.