Pith. sign in

REVIEW 4 major objections 5 minor 30 references

Inference Privacy: Properties and Mechanisms

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Inference Privacy gives users a tunable privacy radius when querying public models.

desk verdict A radius-bounded inference-privacy framework that is essentially metric DP with a tunable ball; the mechanisms are correct given a certified Lipschitz bound, but the novelty is modest and the proofs need cleanup. read the letter →

arxiv 2411.18746 v1 pith:A7UNG3EE submitted 2024-11-27 cs.CR cs.ITcs.LGmath.IT

Fengwei Tian , Ravi Tandon This is my paper · ORCID
classification cs.CRcs.ITcs.LGmath.IT
keywords inferenceprivacylocaldifferentialmetricLipschitzconstantoutputperturbationinpututilitytradeoffpost-processingcomposition
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper aims to move privacy protection from the training phase to the inference phase: a user querying a public model should be able to control how easily the model's output can be traced back to their input. To that end it defines Inference Privacy (IP), in which a randomized mechanism is $\{(\epsilon,\delta),\alpha\}$-private if all inputs within distance $\alpha$ under a chosen metric have outputs that are $(\epsilon,\delta)$-indistinguishable. The radius $\alpha$ is user-tunable, so users can choose how wide a neighborhood of their data must be protected. The paper shows that IP generalizes local differential privacy, satisfies post-processing and composition properties, and can be realized by adding noise to the model output (calibrated by the model's global Lipschitz constant) or to the input (calibrated by $\alpha$ alone). Experiments on CIFAR-10 and CIFAR-100 demonstrate the resulting utility-privacy tradeoff.

What carries the argument

The object that carries the argument is the $\{(\epsilon,\delta),\alpha\}$-IP condition itself, which makes the privacy radius $\alpha$ a first-class parameter alongside $(\epsilon,\delta)$. In the output-perturbation mechanisms the noise scale is set by $\alpha\mu_C$, where $\mu_C$ is an upper bound on the model's global Lipschitz constant; this converts a bound on input distance into a bound on output movement, so the usual Laplace and Gaussian density-ratio computations apply. In the input-perturbation mechanism the noise scale depends on $\alpha$ alone, because the identity map has Lipschitz constant 1 and the post-processing property extends the guarantee to any downstream model $C$. The chaining property rests on the geometric fact that Euclidean $p$-space is geodesic: intermediate points $u_1,\ldots,u_{h-1}$ along the segment from $x_a$ to $x_b$, each at distance $\alpha$ from its neighbor, let the proof compose $h=\lceil\beta/\alpha\rceil$ pairwise privacy losses.

What would settle it

Choose a model and its claimed Lipschitz bound $\mu_C$; by optimization or random search, look for two inputs $x_a,x_b$ with $\|x_a-x_b\|_p\le\alpha$ such that $\|C(x_a)-C(x_b)\|_p>\mu_C\alpha$. If such a pair exists, the density ratio of the corresponding Lap-Output or Gauss-Output mechanism at the stated noise scale exceeds $e^\epsilon$ for some output region, so one can exhibit a measurable set $S$ where the IP inequality $\Pr[M(x_a)\in S]\le e^\epsilon\Pr[M(x_b)\in S]+\delta$ is violated. Finding one such pair would refute the mechanism's claimed privacy calibration for that model.

Watch

Extended reading notes

Core claim

The central claim is that inference-stage privacy can be defined locally around a user's input and enforced by standard noise mechanisms. Within a metric space $(\mathcal{X},d)$, a mechanism $M$ satisfies $\{(\epsilon,\delta),\alpha\}$ Inference Privacy if for every measurable $S$ and every pair $x_a,x_b$ with $d(x_a,x_b)\le\alpha$, we have $\Pr[M(x_a)\in S]\le e^\epsilon\Pr[M(x_b)\in S]+\delta$. Because taking $\alpha=\infty$ recovers local differential privacy, IP is a strict generalization and gives users a dial that LDP lacks. The paper proves that IP is closed under data-independent post-processing, that basic and parallel composition add privacy budgets while taking the minimum radius, and that a chaining property extends a guarantee from radius $\alpha$ to any larger $\beta$ by inserting intermediate points on a geodesic line segment. Constructively, it gives a Laplace output mechanism with scale $\mu_C\alpha/\epsilon$, a Gaussian output mechanism with variance $2\ln(1.25/\delta)(\alpha\mu_C)^2/\epsilon^2$, and a Gaussian input mechanism with variance $2\ln(1.25/\delta)\alpha^2/\epsilon^2$, where $\mu_C$ is the model's global Lipschitz constant.

Load-bearing premise

The output-perturbation mechanisms are only as valid as the certified upper bound on the model's global Lipschitz constant: if the true Lipschitz constant is underestimated, the claimed $\{(\epsilon,\delta),\alpha\}$ guarantee does not follow, and if it is overestimated, the noise destroys utility.

Editorial extensions

If this is right

  • A user sending a query to a public classifier or chatbot can obtain a numerical privacy guarantee over a chosen neighborhood of their input, without any change to the model's training procedure.
  • For models with small certified Lipschitz constants, output perturbation dominates input perturbation in accuracy at the same privacy level, giving architects a concrete reason to build 1-Lipschitz networks.
  • The chaining property lets one noisy release be analyzed at multiple radii, so a service can publish a single mechanism and let users select the guarantee appropriate to how sensitive their data is.
  • The composition theorems make IP compositional in multi-step inference pipelines: privacy losses add across steps and the effective neighborhood shrinks to the smallest radius among the steps.
  • Because Gaussian input noise is calibrated only by $\alpha/\epsilon$, any model, regardless of architecture, can be protected with the same input-perturbation mechanism.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Applied at the embedding level of a language model, with a semantic metric in place of $\ell_p$ distance, IP could become a formal defense against prompt-reconstruction and model-inversion attacks on chatbots; the paper names language models as future work but does not test them.
  • Swapping global Lipschitz bounds for local Lipschitz bounds, as the authors suggest in their discussion, would likely cut the required noise on standard networks and could make output perturbation practical where it currently is not.
  • The fact that Gauss-Input accuracy depends only on the ratio $\alpha/\epsilon$ suggests a simple service design: advertise equivalent $(\alpha,\epsilon)$ pairs and let users trade neighborhood size against indistinguishability at constant utility.
  • Because the chaining bound mirrors group differential privacy, tighter group-privacy composition results could probably be imported to reduce the exponential $\delta$ growth in IP's radius extension.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces Inference Privacy (IP), a definition that requires a randomized mechanism's output distributions to be close for any two inputs within a metric ball of radius α, yielding {(ε,δ),α}-IP as a generalization of local differential privacy. It proves basic properties (post-processing, sequential and parallel composition, chaining), and proposes three mechanisms: Laplace output perturbation, Gaussian output perturbation, and Gaussian input perturbation, with noise calibrated to the model's global Lipschitz constant (for output perturbation) or to α alone (for input perturbation). Experiments on CIFAR-10 and CIFAR-100 compare utility trade-offs for ResNet-18 and SLL networks. The central definitions and main privacy statements are plausible and follow standard differential-privacy sensitivity arguments, but several proof details and the treatment of the Lipschitz bound need correction.

Significance. If the stated guarantees hold in the intended form, the paper offers a clean and broadly applicable framework for inference-time privacy with a tunable radius α, and it explicitly connects to Lipschitz-bounded networks. The main theorems are derived from first-principles sensitivity bounds rather than fitted parameters, which is a strength. The paper also honestly admits limitations (Remark 9, and the difficulty of applying Gauss-Output to ResNet-18 in Section V). However, the practical validity of the output-perturbation guarantees depends on certified Lipschitz bounds, and the write-up contains several proof errors that currently prevent the rigor claimed in the paper. The utility curves are direct consequences of the noise formulas, so the empirical section is illustrative rather than a validation of the privacy guarantee itself.

major comments (4)
  1. [Section IV, Eq. (8), Definitions 3–4, Theorem 2] The output-perturbation guarantees require μ_C to be a certified upper bound on the true global Lipschitz constant, because Eq. (52) uses α μ_C ≥ ||C(xa) – C(xb)||_2. The paper defines μ_C in Eq. (8) as a supremum, then says that 'upper bounds' will be used and that the upper bound will also be denoted μ_C, but it never states how such a bound is certified for the SLL models in Section V. If μ_C is underestimated or is not certified, Theorem 2 and Definition 4 do not provide the claimed {(ε,δ),α}-IP. Please make the certification requirement explicit in the mechanism definitions and report the certified μ_C values used in the experiments; the SLL networks from [21,26] presumably have certified 1-Lipschitz properties, but this is not stated.
  2. [Appendix F, Eq. (54), and Appendix G, Eq. (71)] The Gaussian tail bound is misstated. The text claims δ/2 > (σ/(√(2π) z)) e^{-z²/(2σ²)} ≥ Pr[Z > z] with Z a standard normal variate. The correct standard tail bound is Pr[Z > z] ≤ (1/(√(2π) z)) e^{-z²/2} for z > 0; σ does not appear in the exponent once Z is standardized. The same error is copied into Appendix G. The mechanism calibration σ ≥ sqrt(2 ln(1.25/δ)) α μ_C / ε may still be correct, but the proof must be rewritten with the proper tail inequality and the relevant substitutions.
  3. [Appendix C, Eqs. (21)–(24)] The proof of parallel composition treats each chunk distance ||xa_i – xb_i||_p as though it were equal to the privacy radius α_i, writing d(xa,xb) = (Σ α_i^p)^{1/p} ≥ α_i and then using this to assert B(xi,min α_i) ⊆ B(xi,α_i). This is not justified: α_i is a mechanism parameter, not the actual distance between the two inputs in that chunk. The proposition is still true via the simpler observation that ||xa_i – xb_i||_p ≤ ||xa – xb||_p ≤ min_j α_j ≤ α_i, but the argument as written is erroneous and should be replaced.
  4. [Appendix E, Eqs. (35)–(38)] The Laplace mechanism proof is written for point masses, using expressions such as Pr[MLo(xa) = y] and Pr[Z1 = z] and then evaluating densities. The mechanism is continuous, so the proof should be phrased in terms of densities and integrals over measurable sets. The underlying sensitivity bound is standard and can be made correct, but the current presentation is not a valid proof as written.
minor comments (5)
  1. [Before Theorem 1] There is a typo: 'Poof of this result is presented in Appendix E' should read 'Proof of this result is presented in Appendix E.'
  2. [Proposition 3 statement] The word 'spited' should be 'split,' and the notation in the proposition statements '{(Pm i=1 ϵi, Pm i=1 δi, min αi} IP' is missing matching braces for the privacy tuple.
  3. [Section V, discussion of Figure 6] The text says 'As presented in Table 6,' but the referenced object is a figure; this should be 'As presented in Figure 6.'
  4. [Definitions 4 and 5] The noise variable Z2 is reused for both output perturbation in Definition 4 and input perturbation in Definition 5, while Appendix G switches notation to Z3; this is confusing and should be made consistent.
  5. [Appendix F, Eq. (54)] Equation (54) is missing a closing parenthesis in the exponent and the displayed inequality is dimensionally inconsistent; the equation should be corrected along with the tail-bound rewrite described in the major comment.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: IP guarantees are derived from Lipschitz sensitivity bounds; remaining issues are assumption/verification gaps, not circular reductions.

full rationale

The derivation chain is self-contained. Definitions 1 and 2 fix the IP guarantee, and Propositions 1-4 are direct measure-theoretic or metric consequences of that definition (post-processing, composition, chaining). Theorems 1-3 are standard Laplace/Gaussian mechanism sensitivity arguments: each proof bounds the privacy-loss ratio by exp(epsilon * ||C(xa)-C(xb)||_p / (alpha mu_C)) and then uses the Lipschitz inequality alpha mu_C >= ||C(xa)-C(xb)||_p (Eqs. 40, 52, 69) to conclude the guarantee. No fitted parameter is renamed as a prediction, and no equation is assumed to prove itself. The output-perturbation guarantee is conditional on mu_C being a true (or certified upper) Lipschitz constant, which the paper states is computationally infeasible to compute exactly (Eq. 8 and Section IV) and does not certify in the experiments; this is a correctness/verification gap, not circularity. The only self-citation, reference [27] in Section VI(c), appears in a future-work suggestion about hybrid 1-Lipschitz models and is not load-bearing for any of the paper's central claims. The paper therefore shows no circular reduction by construction.

Assumptions & free parameters 1 free parameters · 3 assumptions · 0 invented entities

The paper contributes no invented entities. Its central mechanisms depend on the model's Lipschitz constant and on the geodesic structure of Euclidean p-space; both are external inputs, not free parameters fitted to data. The privacy parameters epsilon, delta, and alpha are user-chosen requirements, not fitted constants.

free parameters (1)
  • Global Lipschitz constant upper bound mu_C = not fitted; assumed known or upper-bounded per model
    Noise scales for Lap-Output and Gauss-Output are proportional to mu_C (Definitions 3 and 4, Equation 8). The guarantee is only valid if mu_C is a true upper bound; the text notes exact estimation is infeasible.
assumptions (3)
  • domain assumption The model C has a finite global Lipschitz constant mu_C under the chosen norm, and a valid upper bound is available to the mechanism designer.
    Invoked in Equation 8 and Definitions 3 and 4; if the bound is invalid, Theorems 1 and 2 do not establish IP.
  • standard math The input space (R^n, ||.||_p) is geodesic, so the segment between any two inputs lies in the space and supports the chaining construction.
    Proposition 4 proof in Appendix D constructs intermediate points u_i on the linear segment; the paper cites Busemann for geodesic spaces.
  • domain assumption The chosen metric d captures the notion of input similarity that matters for the adversarial reconstruction threat.
    Definitions 1 and 2 only bound outputs for pairs with d(xa,xb) <= alpha; Remark 2 discusses metric choice, but the guarantee inherits all limitations of that choice.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Inference Privacy: Properties and Mechanisms." pith.science (2026). https://pith.science/paper/A7UNG3EE

@misc{pith2026241118746,
  author       = {Pith},
  title        = {Pith review of: Inference Privacy: Properties and Mechanisms},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/A7UNG3EE}},
  note         = {Machine review of arXiv:2411.18746}
}
read the original abstract

Ensuring privacy during inference stage is crucial to prevent malicious third parties from reconstructing users' private inputs from outputs of public models. Despite a large body of literature on privacy preserving learning (which ensures privacy of training data), there is no existing systematic framework to ensure the privacy of users' data during inference. Motivated by this problem, we introduce the notion of Inference Privacy (IP), which can allow a user to interact with a model (for instance, a classifier, or an AI-assisted chat-bot) while providing a rigorous privacy guarantee for the users' data at inference. We establish fundamental properties of the IP privacy notion and also contrast it with the notion of Local Differential Privacy (LDP). We then present two types of mechanisms for achieving IP: namely, input perturbations and output perturbations which are customizable by the users and can allow them to navigate the trade-off between utility and privacy. We also demonstrate the usefulness of our framework via experiments and highlight the resulting trade-offs between utility and privacy during inference.

Figures

Figures reproduced from arXiv: 2411.18746 by the authors.

Figure 1
Figure 1. Illustration of Inference Privacy (IP): A mechanism satisfies IP if for any two inputs xa and xb, such that ||xa − xb||p ≤ α, their corresponding outputs M(xa) and M(xb) have similar probability distributions. The radius α measures the extent of similarity, and the privacy leakage is measured by parameters (ϵ, δ). (See definition 2.) eliminating sensitive data [14]. II. INFERENCE PRIVACY We consider an arbitrary pre… view at source ↗
Figure 2
Figure 2. The workflow of output perturbation methods: User [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 4
Figure 4. Experimental results on CIFAR-10 classification: nat [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figures from the paper (3 more)
Figure 5
Figure 5. Figure 5: Experimental results on CIFAR-10 classification: natu [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Comparison of the natural accuracy of on CIFAR10 dataset and CIFAR100 dataset under different IP constraints, where [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: An illustration of 2 points xa, xb in an Euclidean p￾space with distance β > α Illustrated as [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

30 extracted references · 18 canonical work pages

  1. [1]

    A survey of privacy attacks in machine learning,

    M. Rigaki and S. Garcia, “A survey of privacy attacks in machine learning,” ACM Computing Surveys , vol. 56, no. 4, pp. 1–34, 2023

    work page 2023

  2. [2]

    The algorithmic foundations of differential privacy,

    C. Dwork, A. Roth et al. , “The algorithmic foundations of differential privacy,” Foundations and Trends® in Theoretical Computer Science , vol. 9, no. 3–4, pp. 211–407, 2014

    2014

  3. [3]

    Deep learning with differential privacy,

    M. Abadi, A. Chu, I. Goodfellow, H. B. McMahan, I. Mironov, K. Talwar, and L. Zhang, “Deep learning with differential privacy,” in Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, 2016, pp. 308–318

    2016

  4. [4]

    Deep learning with label differential privacy,

    B. Ghazi, N. Golowich, R. Kumar, P. Manurangsi, and C. Zhang, “Deep learning with label differential privacy,” Advances in neural information processing systems, vol. 34, pp. 27 131–27 145, 2021

    work page 2021

  5. [5]

    Survey: Leakage and privacy at inference time,

    M. Jegorova, C. Kaul, C. Mayor, A. Q. O’Neil, A. Weir, R. Murray- Smith, and S. A. Tsaftaris, “Survey: Leakage and privacy at inference time,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022

    work page 2022

  6. [6]

    Managing your private and public data: Bringing down inference attacks against your privacy,

    S. Salamatian, A. Zhang, F. du Pin Calmon, S. Bhamidipati, N. Fawaz, B. Kveton, P. Oliveira, and N. Taft, “Managing your private and public data: Bringing down inference attacks against your privacy,” IEEE Journal of Selected Topics in Signal Processing, vol. 9, no. 7, pp. 1240– 1255, 2015

    work page 2015

  7. [7]

    Vicious Classifiers: Assessing Inference-time Data Reconstruction Risk in Edge Computing

    M. Malekzadeh and D. Gunduz, “Vicious classifiers: Data reconstruction attack at inference time,” arXiv preprint arXiv:2212.04223 , 2022

    work page Pith review arXiv 2022

  8. [8]

    Local privacy and statistical minimax rates,

    J. C. Duchi, M. I. Jordan, and M. J. Wainwright, “Local privacy and statistical minimax rates,” in 2013 IEEE 54th annual symposium on foundations of computer science . IEEE, 2013, pp. 429–438

    2013

Show all 30 references
  1. [9]

    What can we learn privately?

    S. P. Kasiviswanathan, H. K. Lee, K. Nissim, S. Raskhodnikova, and A. Smith, “What can we learn privately?” SIAM Journal on Computing, vol. 40, no. 3, pp. 793–826, 2011

    2011

  2. [10]

    Privacy-preserving machine learning through data obfuscation,

    T. Zhang, Z. He, and R. B. Lee, “Privacy-preserving machine learning through data obfuscation,” arXiv preprint arXiv:1807.01860 , 2018

    2018 arXiv

  3. [11]

    Data sanitization for privacy preservation on social network,

    P. Tambe and D. V ora, “Data sanitization for privacy preservation on social network,” in 2016 International Conference on Automatic Control and Dynamic Optimization Techniques (ICACDOT) . IEEE, 2016, pp. 972–976

    2016

  4. [12]

    Cer- tified data removal from machine learning models,

    C. Guo, T. Goldstein, A. Hannun, and L. Van Der Maaten, “Cer- tified data removal from machine learning models,” arXiv preprint arXiv:1911.03030, 2019

    1911 arXiv

  5. [13]

    Distillation as a defense to adversarial perturbations against deep neural networks,

    N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami, “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE symposium on security and privacy (SP) . IEEE, 2016, pp. 582–597

    2016

  6. [14]

    Eternal sunshine of the spotless net: Selective forgetting in deep networks,

    A. Golatkar, A. Achille, and S. Soatto, “Eternal sunshine of the spotless net: Selective forgetting in deep networks,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2020, pp. 9304–9312. Fig. 6: Comparison of the natural accuracy of on C...

    2020

  7. [15]

    Word2vec,

    K. W. Church, “Word2vec,” Natural Language Engineering , vol. 23, no. 1, pp. 155–162, 2017

    2017

  8. [16]

    A normalized levenshtein distance metric,

    L. Yujian and L. Bo, “A normalized levenshtein distance metric,” IEEE transactions on pattern analysis and machine intelligence, vol. 29, no. 6, pp. 1091–1095, 2007

    2007

  9. [17]

    Local differential privacy on metric spaces: optimizing the trade-off with utility,

    M. Alvim, K. Chatzikokolakis, C. Palamidessi, and A. Pazii, “Local differential privacy on metric spaces: optimizing the trade-off with utility,” in 2018 IEEE 31st Computer Security Foundations Symposium (CSF). IEEE, 2018, pp. 262–267

    2018

  10. [18]

    Metric differential privacy at the user-level,

    J. Imola, A. R. Chowdhury, and K. Chaudhuri, “Metric differential privacy at the user-level,” arXiv preprint arXiv:2405.02665 , 2024

    2024 arXiv

  11. [19]

    Lipschitz regularity of deep neural networks: analysis and efficient estimation,

    A. Virmaux and K. Scaman, “Lipschitz regularity of deep neural networks: analysis and efficient estimation,” Advances in Neural Infor- mation Processing Systems , vol. 31, 2018

    2018

  12. [20]

    Efficient and accurate estimation of lipschitz constants for deep neural networks,

    M. Fazlyab, A. Robey, H. Hassani, M. Morari, and G. Pappas, “Efficient and accurate estimation of lipschitz constants for deep neural networks,” Advances in neural information processing systems , vol. 32, 2019

    2019

  13. [21]

    A unified algebraic perspective on lipschitz neural networks,

    A. Araujo, A. Havens, B. Delattre, A. Allauzen, and B. Hu, “A unified algebraic perspective on lipschitz neural networks,” arXiv preprint arXiv:2303.03169, 2023

    2023 arXiv

  14. [22]

    Orthogonalizing convolutional layers with the cayley transform,

    A. Trockman and J. Z. Kolter, “Orthogonalizing convolutional layers with the cayley transform,” arXiv preprint arXiv:2104.07167 , 2021

    2021 arXiv

  15. [23]

    Lot: Layer-wise orthogonal training on improving l2 certified robustness,

    X. Xu, L. Li, and B. Li, “Lot: Layer-wise orthogonal training on improving l2 certified robustness,” Advances in Neural Information Processing Systems, vol. 35, pp. 18 904–18 915, 2022

    2022

  16. [24]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, G. Hinton et al. , “Learning multiple layers of features from tiny images,” 2009

    2009

  17. [25]

    Pytorch image models,

    R. Wightman, “Pytorch image models,” https://github.com/rwightman/ pytorch-image-models, 2019

    2019

  18. [26]

    Direct parameterization of lipschitz- bounded deep networks,

    R. Wang and I. Manchester, “Direct parameterization of lipschitz- bounded deep networks,” in International Conference on Machine Learning. PMLR, 2023, pp. 36 093–36 110

    2023

  19. [27]

    Splitz: Certifiable robustness via split lips- chitz randomized smoothing,

    M. Zhong and R. Tandon, “Splitz: Certifiable robustness via split lips- chitz randomized smoothing,” arXiv preprint arXiv:2407.02811 , 2024

    2024 arXiv

  20. [28]

    Busemann, The geometry of geodesics

    H. Busemann, The geometry of geodesics . Courier Corporation, 2012. APPENDIX A. Proof of Proposition 1 In this section, we prove the post processing property of IP mechanisms. For arbitrary functions M : Rn → Rk and F : Rk → Rk′ , if M satisfies {(ϵ, δ), α} IP, we need to show...

    2012

  21. [29]

    (47) Notice that: Z Z2∈S′ 2 fz(Z2)dz = Z Z2|ln fz (Z2 ) fz (Z2 −(C(xb )−C(xa )) >ϵ fu(Z2)dz

    (46) Then: I1 = Z Z2∈S′ 1 fz(Z2)dz + Z Z2∈S′ 2 fz(Z2)dz ≤ eϵ Z Z2∈S′ 1 fz(Z2 − (C(xa) − C(xb)))dz + Z Z2∈S′ 2 fu(Z2)dz. (47) Notice that: Z Z2∈S′ 2 fz(Z2)dz = Z Z2|ln fz (Z2 ) fz (Z2 −(C(xb )−C(xa )) >ϵ fu(Z2)dz. (48) We then look at the interested ratio: ln fz(Z2) fz(Z2 − (C(...

  22. [30]

    (64) Notice that: Z Z3∈S′ 2 fz(Z3)dz = Z Z3|ln fz (Z3 ) fz (Z3 −(xb −xa )) >ϵ fz(Z3)dz

    (63) Then: I1 = Z Z3∈S′ 1 fz(Z3)dz + Z Z3∈S′ 2 fz(Z3)dz ≤ eϵ Z Z3∈S′ 1 fz(Z3 − (xa − xb))dz + Z Z3∈S′ 2 fz(Z3)dz. (64) Notice that: Z Z3∈S′ 2 fz(Z3)dz = Z Z3|ln fz (Z3 ) fz (Z3 −(xb −xa )) >ϵ fz(Z3)dz. (65) We look at the interested ratio: ln fz(Z3) fz(Z3 − (xb − xa)) = ln exp...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.