Pith. sign in

REVIEW 5 major objections 5 minor 47 references

One probability now bounds any model's perturbation robustness

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Tower robustness measures a model's expected accuracy over random perturbations within an Lp ball and comes with computable lower and upper bounds based on exact binomial tests.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Tower robustness is smoothed accuracy with a binomial-test wrapper; the upper bound rests on an unreliable type II error guarantee and the lower bound has an algebraic slip. the 5 major comments →

arxiv 2508.19183 v1 pith:RY7YKZSR submitted 2025-08-26 cs.LG

Get Global Guarantees: On the Probabilistic Nature of Perturbation Robustness

Wenchuan Mu , Kwan Hui Lim This is my paper
classification cs.LG MSC 62F0368T07
keywords tower robustnessprobabilistic robustnessadversarial robustnessexact binomial testhypothesis testingrobustness certificationTower Lawdeep neural networks
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes Tower robustness, defined as the probability that a model's prediction is correct on a randomly perturbed input inside an epsilon ball, and argues this single scalar is the natural global measure of perturbation robustness. It shows how to estimate a computable lower bound and a computable upper bound on this quantity from a finite test set, using an exact binomial test on each input-label pair and then eliminating the two helper parameters kappa and alpha with the Tower Law, total probability, and Markov's inequality. If the argument is right, a model's pre-deployment robustness can be reported as one certified number, different models can be compared even when evaluated under different settings, and deterministic and probabilistic verification results can be combined without losing the guarantee.

Core claim

The paper claims that perturbation robustness is a single probabilistic quantity: Tower robustness, P(h(x')=y | ||x'-x||_p ≤ epsilon), the chance a model is correct on a random input drawn from the epsilon-neighborhood of a random natural input. Deterministic certifiable robust accuracy is an unbiased estimator of its lower bound. Using an exact binomial test per point plus the Tower Law, total probability, and Markov's inequality, the paper gets global bounds independent of helper parameters kappa and alpha: lower ((1-kappa)P(cPRA)-alpha)/(1+alpha), upper kappa P(cPRA)/(1-alpha)-kappa+1; cPRA means the per-point event that misprediction probability is certified below kappa. These bounds are

What carries the argument

Tower robustness (Definition 3.1) is the central object: P(h(x')=y | ||x'-x||_p ≤ epsilon). The proof chain uses the Tower Law E[E[b|a]]=E[b] to express it as an expectation of per-neighborhood correctness; the law of total probability to remove the significance level alpha; and Markov's inequality, with a known upper bound on per-neighborhood misprediction, to remove the tolerance kappa. Per test point, an exact binomial test with both left- and right-tailed rejection decides whether the neighborhood's misprediction probability is at most kappa. Inequalities (26) and (27), which bound the two directions of test error by alpha, carry the global guarantee.

Load-bearing premise

The entire guarantee rests on the claim that a single per-point test, on a fixed number of sampled neighbors, keeps both kinds of mistakes below the chosen small rate alpha; the paper states this as a fact but does not prove it.

What would settle it

Simulate the per-point test: for many points whose true misprediction probability is exactly kappa, or slightly above or below it, draw the prescribed number of perturbation samples and count how often the left-tailed and right-tailed tests make each error. If either empirical error rate exceeds alpha, inequalities (26) and (27) fail and the global bounds are not guaranteed. A second check is to enumerate all neighbors exactly for a small model and compare the true Tower robustness against the paper's lower bound; any violation of inequality (40) would refute the method as stated.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Model robustness can be reported as a single certified scalar instead of an attack-dependent accuracy, so rankings no longer depend on which adversarial attack was used.
  • Two models evaluated with different kappa and alpha values can be compared fairly through the same lower- and upper-bound formulas.
  • Deterministic certified robustness and probabilistic robustness can be combined in one framework, with deterministic verification covering some cases and probabilistic testing covering the rest.
  • Tightening kappa or alpha raises the reported lower bound without invalidating it, removing the incentive to inflate robustness scores by choosing loose helper parameters.
  • The upper bound, while not a safety certificate, can expose when a model's actual robustness may be far worse than its lower bound suggests.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The decomposition suggests a direct generalization: replace the uniform (p, epsilon)-ball with any perturbation distribution, and the same Tower-Law structure will express expected correctness under that distribution as an expectation of per-point conditional correct probabilities, potentially certifying robustness to rotations, brightness, or other semantic perturbations.
  • A testable extension is to partition the input space and report a Tower robustness bound per class or per region; the Tower Law should make the global bound a weighted average of local bounds, giving practitioners a localization of where robustness fails.
  • Because the bounds use only the model's predicted labels, the same certificate should apply to black-box decision rules such as ensembles or non-differentiable pipelines, a generality the paper does not spell out.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper introduces 'Tower robustness', defined as the probability that a model predicts correctly on an input randomly drawn from the neighborhood of a random data point, i.e., P(h(x')=y | ||x'-x||_p <= epsilon). It argues that this quantity unifies existing deterministic and probabilistic robustness metrics via the Tower Law, and derives computable lower and upper bounds on it. The derivation proceeds by per-input exact binomial hypothesis tests of whether the local misprediction probability is at most kappa, then uses the law of total probability and Markov's inequality to eliminate the helper parameters kappa and alpha. Experiments on MNIST and CIFAR-10 report lower and upper bounds for six trained models. The central technical problem is in Section 4.1: the paper asserts simultaneous type I and type II error guarantees for a fixed-size exact binomial test (inequalities (26)-(27)), but the type II bound is not proved and is generally false for a composite alternative near the boundary. This invalidates the upper-bound claims in Lemma 4.1 and Theorem 4.2. Additional algebra errors appear in Lemma 4.1 and Theorem 4.3, and the claim that kappa and alpha are 'eliminated' is not supported.

Significance. If the lower-bound part can be repaired, the paper makes a useful conceptual contribution: it gives a clean probabilistic definition of robustness that is directly estimable, and the lower-bound construction could provide a practical certificate for model robustness. The attempt to unify deterministic and probabilistic robustness metrics and to remove the arbitrariness of kappa and alpha is worthwhile. The paper does not ship machine-checked proofs, and the current proofs contain load-bearing errors; the upper-bound claims are unsupported, and the final bounds are point estimates without finite-sample confidence statements. The lower-bound idea is potentially salvageable and worth another round, but the manuscript in its present form cannot be accepted.

major comments (5)
  1. [§4.1, inequalities (26)-(27)] The assertion that a fixed-size exact binomial test satisfies P(¬a2|a1)<α and P(a2|¬a1)<α simultaneously is not proved and is in general false. For H1:p≤κ, as p approaches κ from below, the power of any level-α test converges to α, so the type II error P(¬a2|a1) tends to 1−α, which is not <α for α<1/2. Formula (25) is an asymptotic/approximate sample-size formula involving the unknown p̂, not a uniform guarantee over the composite alternative. Because the upper bound in Theorem 4.2 (Eq. (33)) and the upper bound in Lemma 4.1 use both error-rate bounds, these upper-bound claims are unsupported as written.
  2. [§4.2, Lemma 4.1, Eq. (30)] Equation (30) is algebraically incorrect. Solving (29) for P(a1) gives denominator P(a2|a1)−P(a2|¬a1) = 1−P(¬a2|a1)−P(a2|¬a1), not 1−P(¬a2|a1)+P(a2|¬a1). The displayed derivation therefore does not establish (28). Even after correcting the algebra, the upper bound in (28) requires the unproved type II bound (26); only the lower bound is available from type I control alone. Please rewrite the proof and state explicitly which inequalities are needed for each bound.
  3. [§4.2.2, Theorem 4.3, Eq. (44)] In the proof, substituting the lower bound P(q≤κ) > (P(cPRA)−α)/(1+α) into (43) yields ((1−κ)(P(cPRA)−α))/(1+α), not ((1−κ)P(cPRA)−α)/(1+α) as written in (44). The displayed bound (40) is numerically weaker and happens to be valid, but only if one adds an extra inequality; the proof as written is incorrect. Please correct the substitution or make the weakening step explicit.
  4. [§4.2.2, after Eq. (40)] The claim that κ and α have been 'eliminated' is not correct: both parameters appear explicitly in (40) and (33), and cPRA is itself defined using κ and α. The further claim that one may freely choose different (κ,α) for different models and still compare lower bounds is not justified; reducing κ or α changes the event cPRA and the value of P(cPRA) in a model-dependent way, and no monotonicity theorem is proved. This affects the paper's central 'fair comparison' and 'global guarantee' narrative.
  5. [§5, Figure 2] The reported lower/upper bounds are computed from an empirical estimate of P(cPRA) (the sample mean over the test set), but the paper does not provide confidence intervals or finite-sample concentration bounds for this estimate. Since a 'pre-deployment guarantee' must hold with respect to the true cPRA probability, the plotted values are point estimates rather than guaranteed bounds. Please state the sampling procedure, perturbation sample sizes, and how estimation uncertainty is accounted for.
minor comments (5)
  1. [§4.1, Eq. (22)] The p-value formula is notated inconsistently: 'P(k > k)' is written but the displayed sum is P(K ≤ k). Please correct the tail direction and notation.
  2. [§4.1, after Eq. (25)] Formula (25) uses z_α, but for α<1/2, z_α is negative; as written the numerator can be negative and the formula is ambiguous. Please define the quantiles and the intended error rates.
  3. [§3.2, Definition 3.1] The notation P_{||x'-x||_p≤ε}(h(x')=y) is not formally defined. Please specify the underlying random experiment: x,y drawn from D, then x' drawn uniformly from the ε-neighborhood of x.
  4. [§4.1, 'Both left- and right-tailed tests'] The decision rule for combining the two one-sided tests for a single input-label pair is not specified. Please state exactly when a2, ¬a2, or neither is declared.
  5. [§5] No details are given on the number of perturbations sampled per input, the significance level used in the experiments, or the computation of cPRA from the test set. Figure 2 has no error bars. The abstract's 'extensive comparative evaluation' is overstated given the absence of baseline comparisons.

Circularity Check

0 steps flagged

No circularity: Tower robustness bounds follow from direct definitions and inequalities; no fitted parameter is relabeled as a prediction and no load-bearing self-citation is used.

full rationale

The derivation chain is self-contained. Tower robustness is defined directly in Definition 3.1 as E[1_{h(x')=y} | ||x'-x||_p<=eps], and Theorem 3.3 is just an application of the Tower Law. The global bounds in Lemma 4.1, Theorem 4.2, and Theorem 4.3 are algebraic consequences of the law of total probability and Markov's inequality; they do not assume the Tower robustness value they intend to bound. The binomial-test error-rate claims (26)-(27) are statistical assertions about test power, not circular redefinitions: even if the type II error bound is not achievable at a fixed sample size (a correctness/soundness risk), the derivations would be valid conditional on those bounds. Similarly, the statement that kappa and alpha are 'eliminated' is an overclaim, since expressions (33) and (40) still contain them and cPRA is parameterized by them; however, this is a comparability/consistency issue rather than a circular reduction, because the bounds remain valid for any kappa and alpha. The only self-citation ([24]) appears in a future-work sentence and carries no load in the derivation. Overall, no part of the claimed prediction reduces by construction to its inputs.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The central claim rests on standard probability inequalities plus two domain-specific choices: an unstated perturbation distribution and an unproved simultaneous control of both hypothesis test error rates. No new physical entities are introduced.

free parameters (3)
  • kappa (tolerance threshold) = not fitted, user-chosen
    Tolerance for per-input misprediction probability; appears in the final bounds (33) and (40), so it is a free parameter despite the elimination claim.
  • alpha (significance level) = not fitted, user-chosen
    Significance level of the exact binomial tests; appears in the final bounds and controls the width of the guarantees.
  • perturbation sampling distribution = not specified
    The robustness value depends on how x' is sampled within the Lp ball; the paper never specifies the distribution (e.g., uniform over the ball), which is a chosen modeling degree of freedom.
axioms (4)
  • domain assumption The conditional probability distribution of x' given ||x'-x||<=epsilon is well-defined and the event {h(x')=y} is measurable.
    Definition 3.1 and the Tower Law derivation depend on this measure-theoretic setup, but the paper never specifies the distribution of perturbations within the neighborhood.
  • domain assumption x' = x + t with t independent of x and y, so the smoothed distribution is a convolution.
    Used in equations (16)-(18) to reinterpret Tower robustness; this independence assumption is not guaranteed for adversarial perturbations.
  • ad hoc to paper The exact binomial test, run as both left- and right-tailed tests, satisfies P(a2|not a1) < alpha and P(not a2|a1) < alpha simultaneously.
    Asserted via inequalities (26)-(27) without proof; the type II error bound is not generally controlled by a fixed-size level-alpha test.
  • standard math Markov's inequality and the Tower Law apply to the event functions as used.
    Theorem 3.3 and Theorems 4.2-4.3 invoke these standard results.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of Get Global Guarantees: On the Probabilistic Nature of Perturbation Robustness." pith.science (2026). https://pith.science/paper/RY7YKZSR

@misc{pith2026250819183,
  author       = {Pith},
  title        = {Pith review of: Get Global Guarantees: On the Probabilistic Nature of Perturbation Robustness},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RY7YKZSR}},
  note         = {Machine review of arXiv:2508.19183}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

In safety-critical deep learning applications, robustness measures the ability of neural models that handle imperceptible perturbations in input data, which may lead to potential safety hazards. Existing pre-deployment robustness assessment methods typically suffer from significant trade-offs between computational cost and measurement precision, limiting their practical utility. To address these limitations, this paper conducts a comprehensive comparative analysis of existing robustness definitions and associated assessment methodologies. We propose tower robustness to evaluate robustness, which is a novel, practical metric based on hypothesis testing to quantitatively evaluate probabilistic robustness, enabling more rigorous and efficient pre-deployment assessments. Our extensive comparative evaluation illustrates the advantages and applicability of our proposed approach, thereby advancing the systematic understanding and enhancement of model robustness in safety-critical deep learning applications.

Figures

Figures reproduced from arXiv: 2508.19183 by Kwan Hui Lim, Wenchuan Mu.

Figure 1
Figure 1. Figure 1: Comparison of space coverage: (a) Adversarial at [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Tower robustness guarantees. Each solid line shows the lower bound, and the dashed line shows the upper bound. [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 37 canonical work pages · 1 internal anchor

  1. [1]

    Alan Agresti and Brent A. Coull. 1998. Approximate is Better than "Ex- act" for Interval Estimation of Binomial Proportions. The American Statis- tician 52, 2 (1998), 119–126. https://doi.org/10.1080/00031305.1998.10480550 arXiv:https://doi.org/10.1080/00031305.1998.10480550

    Pith/arXiv arXiv 1998

  2. [2]

    Abdulrahman Al-Abassi, Hadis Karimipour, Ali Dehghantanha, and Reza M. Parizi. 2020. An Ensemble Deep Learning-Based Cyber-Attack Detection in Industrial Control System. IEEE Access 8 (2020), 83965–83973. https://doi.org/10. 1109/ACCESS.2020.2992249

    work page arXiv 2020

  3. [3]

    Guy Amir, Haoze Wu, Clark Barrett, and Guy Katz. 2021. An SMT-based ap- proach for verifying binarized neural networks. In Tools and Algorithms for the Construction and Analysis of Systems: 27th International Conference, TACAS 2021, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2021, Luxembourg City, Luxembourg, ...

    work page 2021

  4. [4]

    Clark Barrett and Cesare Tinelli. 2018. Satisfiability modulo theories. Springer

    work page 2018

  5. [5]

    Nicholas Carlini and David Wagner. 2017. Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods. Association for Computing Machinery, New York, NY, USA, 3–14. https://doi.org/10.1145/3128572.3140444

    arXiv 2017

  6. [6]

    Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. A simple framework for contrastive learning of visual representations. In Interna- tional conference on machine learning . PmLR, 1597–1607

    work page 2020

  7. [7]

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. 2019. Certified Adversarial Ro- bustness via Randomized Smoothing. In Proceedings of the 36th International Con- ference on Machine Learning (Proceedings of Machine Learning Research, Vol. 97) , Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.). PMLR, PMLR, 1310–1320. https://proceedings.mlr.press/v97/cohen19c.html

    work page 2019

  8. [8]

    Jiankang Deng, Jia Guo, Niannan Xue, and Stefanos Zafeiriou. 2019. ArcFace: Additive Angular Margin Loss for Deep Face Recognition. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) . 4685–4694. https: //doi.org/10.1109/CVPR.2019.00482

    arXiv 2019

  9. [9]

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xi- aohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. 2021. An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale. In9th Interna- tional Conference on Learning Representations, IC...

    2021

  10. [10]

    Luciano Floridi and Massimo Chiriatti. 2020. GPT-3: Its Nature, Scope, Limits, and Consequences. Minds and Machines 30, 4 (01 Dec 2020), 681–694. https: //doi.org/10.1007/s11023-020-09548-1

    work page doi:10.1007/s11023-020-09548-1 2020

  11. [11]

    Rui Fu, Zuo Zhang, and Li Li. 2016. Using LSTM and GRU neural network methods for traffic flow prediction. In 2016 31st Youth Academic Annual Conference of Chinese Association of Automation (YAC). 324–328. https://doi.org/10.1109/YAC. 2016.7804912

    work page arXiv 2016

  12. [12]

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. 2016. Deep Residual Learning for Image Recognition. InProceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR)

    2016

  13. [13]

    Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song

  14. [14]

    Dill, Kyle Julian, and Mykel J

    Guy Katz, Clark Barrett, David L. Dill, Kyle Julian, and Mykel J. Kochenderfer

    work page

  15. [15]

    Guy Katz, Derek A Huang, Duligur Ibeling, Kyle Julian, Christopher Lazarus, Rachel Lim, Parth Shah, Shantanu Thakoor, Haoze Wu, Aleksandar Zeljić, et al

    work page

  16. [16]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial examples in the physical world. In 5th International Conference on Learning Representa- tions, ICLR 2017, Toulon, France, April 24-26, 2017, Workshop Track Proceedings . OpenReview.net. https://openreview.net/forum?id=HJGU3Rodl

    work page 2017

  17. [17]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. 2017. Adversarial Machine Learning at Scale. In 5th International Conference on Learning Representations, ICLR 2017, Toulon, France, April 24-26, 2017, Conference Track Proceedings . Open- Review.net. https://openreview.net/forum?id=BJm4T4Kgx

    work page 2017

  18. [18]

    Yann LeCun, Corinna Cortes, and Chris Burges. 1998. http://yann.lecun.com/ exdb/mnist/

    work page 1998

  19. [19]

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. 2019. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 656–672

    work page 2019

  20. [20]

    Sungyoon Lee, Jaewook Lee, and Saerom Park. 2020. Lipschitz-certifiable training with a tight outer bound. Advances in Neural Information Processing Systems 33 (2020), 16891–16902

    work page 2020

  21. [21]

    Jianlin Li, Jiangchao Liu, Pengfei Yang, Liqian Chen, Xiaowei Huang, and Li- jun Zhang. 2019. Analyzing deep neural networks with symbolic propagation: Towards higher precision and faster verification. In Static Analysis: 26th Interna- tional Symposium, SAS 2019, Porto, Portugal, October 8–11, 2019, Proceedings 26 . Springer, 296–319

    work page 2019

  22. [22]

    Linyi Li, Tao Xie, and Bo Li. 2023. SoK: Certified Robustness for Deep Neural Networks. In 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, 22-26 May 2023 . IEEE. https://arxiv.org/abs/2009.04131

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  23. [23]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. Towards Deep Learning Models Resistant to Adversarial Attacks. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net. https://openreview.net/forum?id=...

    work page 2018

  24. [24]

    Wenchuan Mu and Kwan Hui Lim. 2025. Bayesian Privacy Guarantee for User History in Sequential Recommendation Using Randomised Response. In Pro- ceedings of the 34th ACM International Conference on Information and Knowledge Management (CIKM’25)

    work page 2025

  25. [25]

    Mark Niklas Müller, Franziska Eckert, Marc Fischer, and Martin T. Vechev. 2022. Certified Training: Small Boxes are All You Need. CoRR abs/2210.04871 (2022). https://doi.org/10.48550/arXiv.2210.04871 arXiv:2210.04871

    Pith/arXiv arXiv doi:10.48550/arxiv.2210.04871 2022

  26. [26]

    Stuart J Pocock. 1977. Group sequential methods in the design and analysis of clinical trials. Biometrika 64, 2 (1977), 191–199

    work page 1977

  27. [27]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning . PmLR, 8748–8763

    2021

  28. [28]

    Matthew Ragoza, Joshua Hochuli, Elisa Idrobo, Jocelyn Sunseri, and David Ryan Koes. 2017. Protein-Ligand Scoring with Convolutional Neural Networks.Journal of Chemical Information and Modeling 57, 4 (2017), 942–957. https://doi.org/ 10.1021/acs.jcim.6b00740 arXiv:https://doi.org/10.1021/acs.jcim.6b00740 PMID: 28368587

    doi:10.1021/acs.jcim.6b00740 2017

  29. [29]

    Pappas, and Hamed Hassani

    Alexander Robey, Luiz Chamon, George J. Pappas, and Hamed Hassani. 2022. Probabilistically Robust Learning: Balancing Average and Worst-case Perfor- mance. In Proceedings of the 39th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 162) , Kamalika Chaudhuri, Ste- fanie Jegelka, Le Song, Csaba Szepesvari, Gang Ni...

    work page 2022

  30. [30]

    Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Se- bastien Bubeck, and Greg Yang. 2019. Provably robust deep learning via adver- sarially trained smoothed classifiers. Advances in Neural Information Processing Systems 32 (2019)

    work page 2019

  31. [31]

    Zhouxing Shi, Yihan Wang, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsieh

    work page

  32. [32]

    Gagandeep Singh, Rupanshu Ganvir, Markus Püschel, and Martin Vechev. 2019. Beyond the single neuron convex barrier for neural network certification. Ad- vances in Neural Information Processing Systems 32 (2019)

    work page 2019

  33. [33]

    Vladimir Vapnik. 1999. The nature of statistical learning theory . Springer science & business media

    work page 1999

  34. [34]

    Aladin Virmaux and Kevin Scaman. 2018. Lipschitz regularity of deep neural networks: analysis and efficient estimation. In Advances in Neural Information Processing Systems, S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa- Bianchi, and R. Garnett (Eds.), Vol. 31. Curran Associates, Inc. https://proceedings. neurips.cc/paper/2018/file/d54e99a6c03...

    work page 2018

  35. [35]

    In Advances in Neural Information Processing Systems , M

    Fast Certified Robust Training with Short Warmup. In Advances in Neural Information Processing Systems , M. Ranzato, A. Beygelzimer, Y. Dauphin, P.S. Liang, and J. Wortman Vaughan (Eds.), Vol. 34. Curran As- sociates, Inc., 18335–18349. https://proceedings.neurips.cc/paper/2021/file/ 988f9153ac4fd966ea302dd9ab9bae15-Paper.pdf

    work page 2021

  36. [36]

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu

    work page

  37. [37]

    Andrew Wen, Mohamed Y Elwazir, Sungrim Moon, and Jungwei Fan. 2020. Adapting and evaluating a deep learning language model for clinical why- question answering. JAMIA Open 3, 1 (02 2020), 16–20. https://doi.org/ 10.1093/jamiaopen/ooz072 arXiv:https://academic.oup.com/jamiaopen/article- pdf/3/1/16/33419137/ooz072.pdf

    work page doi:10.1093/jamiaopen/ooz072 2020

  38. [38]

    Tsui-Wei Weng, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, Dong Su, Yupeng Gao, Cho-Jui Hsieh, and Luca Daniel. 2018. Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approach. In 6th International Conference on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 - May 3, 2018, Conference Track Proceedings . OpenReview.net. ...

    work page 2018

  39. [39]

    A. Wald. 1945. Sequential Tests of Statistical Hypotheses. The Annals of Mathe- matical Statistics 16, 2 (1945), 117 – 186. https://doi.org/10.1214/aoms/1177731118

    arXiv 1945

  40. [40]

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. 2019. Theoretically Principled Trade-off between Robustness and Accuracy. In Proceedings of the 36th International Conference on Machine Learning (Proceedings of Machine Learning Research, Vol. 97), Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.). PMLR, 7472–748...

    work page 2019

  41. [41]

    In International Conference on Learning Representations

    Improving adversarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations . Get Global Guarantees: On the Probabilistic Nature of Perturbation Robustness CIKM ’25, November 10–14, 2025, Seoul, Republic of Korea

    work page 2025

  42. [42]

    Fieldsend

    Tianle Zhang, Wenjie Ruan, and Jonathan E. Fieldsend. 2023. PRoA: A Proba- bilistic Robustness Assessment Against Functional Perturbations. In Machine Learning and Knowledge Discovery in Databases , Massih-Reza Amini, Stéphane Canu, Asja Fischer, Tias Guns, Petra Kralj Novak, and Grigorios Tsoumakas (Eds.). Springer Nature Switzerland, Cham, 154–170

    work page 2023

  43. [44]

    Xiaodong Yang, Taylor T Johnson, Hoang-Dung Tran, Tomoya Yamaguchi, Bardh Hoxha, and Danil V Prokhorov. 2021. Reachability analysis of deep ReLU neural networks using facet-vertex incidence.. In HSCC, Vol. 21. 19–21

    work page 2021

  44. [46]

    Jingqing Zhang, Yao Zhao, Mohammad Saleh, and Peter J. Liu. 2020. PEGASUS: Pre-training with Extracted Gap-sentences for Abstractive Summarization. In Proceedings of the 37th International Conference on Machine Learning, ICML 2020, 13-18 July 2020, Virtual Event (Proceedings of Machine Learning Research, Vol. 119) . PMLR, 11328–11339. http://proceedings.m...

    work page 2020

  45. [2017]

    In Computer Aided Verification, Rupak Majumdar and Viktor Kunčak (Eds.)

    Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networks. In Computer Aided Verification, Rupak Majumdar and Viktor Kunčak (Eds.). Springer International Publishing, Cham, 97–117

    work page

  46. [2019]

    In Computer Aided Verification: 31st International Conference, CA V 2019, New York City, NY, USA, July 15-18, 2019, Proceedings, Part I 31

    The marabou framework for verification and analysis of deep neural networks. In Computer Aided Verification: 31st International Conference, CA V 2019, New York City, NY, USA, July 15-18, 2019, Proceedings, Part I 31. Springer, 443–452

    work page 2019

  47. [2021]

    In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Natural adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition . 15262–15271

    work page

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.