*sensitivity* of the model.

Typically, models with larger classification margins are less sensitive to input perturbations [@Sokolic2017; @Jakubovitz2018; @Cohen2019; @Liu2018; @Li2018]. Such margins are the distance in data-space between a point ${{\boldsymbol{\mathbf{}}}}{x}$ and a classifier’s decision boundary. Larger margins mean that a classifier associates a larger region centered on a point ${{\boldsymbol{\mathbf{}}}}{x}$ to the same class. Intuitively this means that noise added to ${{\boldsymbol{\mathbf{}}}}{x}$ is still likely to fall within this region, leaving the classifier prediction unchanged.

Tikhonov Regularisation
-----------------------

Tikhonov regularisation involves adding some regulariser to the loss function, which encodes a notion of ‘smoothness’ of a function $f$ [@Bishop1995]. As such, by design, regularisers of this form have been shown to have beneficial regularisation properties when used in the training objective of neural networks by smoothing the loss landscape [@Girosi1990; @Burger2003]. If we have a loss of the form $\tilde{\mathcal{L}}_{\mathrm{SGD}}(\mathcal{B}; {{\boldsymbol{\mathbf{}}}}{\theta})$, the Tikhonov regularised loss becomes: $$\tilde{\mathcal{L}}_{\mathrm{SGD}}(\mathcal{B}; {{\boldsymbol{\mathbf{}}}}{\theta}) + \lambda\|f_{\theta}\|^2_{\mathcal{H}}$$ where $f_{\theta}$ is the function with parameters $\theta$ which we are learning and $\|\cdot\|_{\mathcal{H}}$ is the norm in the function space $\mathcal{H}$ and $\lambda$ is a (multidimensional) penalty which penalises elements of $\|f_{\theta}\|^2_{\mathcal{H}}$ unequally, or is data-dependent [@Tikhonov1977; @Bishop1995].

The Explicit Effect of Gaussian Noise Injections
================================================

We 