PaperlayerView exact revision on arXiv

Source-linked AI summary

The Geometry of Randomized Smoothing on Feasible Sets

Syed Izhan Khilji, Alireza Furutanpey, Schahram Dustdar

arXiv:2609.39497v1cs.LGstat.ML

TL;DR

Filtering reports label probabilities among retained proposals, but the ordinary smoothing comparison controls fixed Gaussian event masses rather than those center-dependent conditional ratios. The paper characterizes when conditioning preserves Gaussian comparisons and certifies the unchanged filtered predictor using joint retained-label masses or covariance-controlled divergence bounds. At radius 0.2, conditional R´enyi certifies 892 images versus 725 for joint-mass; fresh independent samples verified opposite population conditional labels in twelve endpoint pairs.

  • Problem

    Filtering reports label probabilities among retained proposals, but the ordinary smoothing comparison controls fixed Gaussian event masses rather than those center-dependent conditional ratios.

    Source: §1 · p. 1

  • Method

    The paper characterizes when conditioning preserves Gaussian comparisons and certifies the unchanged filtered predictor using joint retained-label masses or covariance-controlled divergence bounds.

    Source: §1 · pp. 1–2

  • Results

    At radius 0.2, conditional R´enyi certifies 892 images versus 725 for joint-mass; fresh independent samples verified opposite population conditional labels in twelve endpoint pairs.

    Source: §5 · pp. 7, 9

  • Takeaways & Limitations

    Convex retention preserves the full Gaussian comparison, while general filters need geometric control or joint retained-label events for sound certification without changing the predictor.

    Source: §1 · p. 1, §7 · p. 9

    The AuditVotes 12/128 result concerns a selected cohort, not dataset prevalence, and the learned-model studies use one checkpoint and noise scale.

    Source: §7 · p. 9

Abstract

from arXiv · show

Randomized smoothing certifies the probability of a fixed output event as the center of Gaussian noise moves. Feasibility or confidence filtering reports label probabilities only among retained proposals, producing a ratio. Its numerator is a fixed Gaussian event mass, while its denominator is the probability of retention and can change with the center. Substituting this ratio into the ordinary smoothing formula can therefore certify a ball that contains a decision boundary. We separate the problem into a geometric question and a certification question. Geometry determines when conditioning preserves Gaussian comparisons. Convex retained sets preserve the full comparison, while general sets require geometric control of the retained law as the center moves. Without such control, conditional probabilities imply no positive universal radius. Joint retention-and-label probabilities always yield a valid certificate for the same filtered predictor. A uniform covariance bound transfers divergence certificates to the retained law and can yield larger radii even when the Gaussian event comparison fails. Both methods admit finite-sample bounds. For a learned image classifier with a training-selected nonconvex filter, conditional R\'enyi bounds certify more images than joint-mass bounds without additional model evaluations. A released confidence filter exhibits verified label changes inside radii obtained by conditional substitution. An application of adaptive Gaussian composition covers causal finite-horizon executions with history-dependent center shifts under a pathwise energy bound.

1 INTRODUCTION

Filtering turns fixed Gaussian event masses into center-dependent conditional ratios, so an ordinary smoothing radius can contain a label change. The paper characterizes when conditioning preserves Gaussian comparisons and gives joint-mass and covariance-based certification alternatives.

1 INTRODUCTION

  • A 0.9 vote among retained proposals can represent only 0.09 Gaussian mass for the retained-and-labeled event, which ordinary smoothing controls.The standard proof controls event mass, not the fraction among retained proposals.Source: §1 · p. 1
  • Because retention probability changes with the center, conditional label probabilities can change inside a radius obtained by substituting them into the ordinary formula.Dividing label masses by the same denominator preserves their order at one center, not their comparison across centers.Source: §1 · p. 1
  • Convex retained sets preserve the full Gaussian event comparison; for general sets, retained-law geometry controls whether comparisons survive conditioning.The paper relates log-retention curvature to KL and Rényi divergence and identifies conditional covariance as a local quantity.Source: §1 · p. 1
  • Joint retained-label masses give a sound certificate for the unchanged predictor, while a uniform covariance bound can transfer divergence certificates to conditional probabilities.The covariance approach can yield a larger radius without requiring the full Gaussian event comparison; conditional probabilities alone give no positive universal radius without such control.Source: §1 · pp. 1–2
  • The paper tests failure and recovery with a training-selected nonconvex image filter and an AuditVotes case study, and develops finite-sample procedures for certification.Its stated contributions also include a causal finite-horizon extension for history-dependent center shifts under a common execution.Source: §1 · p. 2

2 FILTERED GAUSSIAN SMOOTHING

Filtered Gaussian smoothing conditions proposals on a fixed retention rule and reports label probabilities among retained proposals. This makes the reported probabilities ratios, unlike the fixed-event masses used by ordinary Gaussian comparisons.

2 FILTERED GAUSSIAN SMOOTHING

  • The setup fixes the Gaussian noise scale, affine proposal space, measurable retention and task rules, and finite label set.The retention rule defines the retained set K, and each label event is its intersection with the task's label region.Source: §2 · p. 2
  • At each center, the conditional label probability is the joint retained-label mass divided by the retention probability.The retention probability is assumed positive; equal-covariance Gaussian measures are mutually absolutely continuous, so positivity at one center implies positivity at every finite center.Source: §2 · p. 2
  • The common denominator preserves label ordering at one center but changes across centers, so the Gaussian event comparison applies to joint masses rather than conditional ratios.A substituted conditional radius can therefore be invalid if the smoothed decision changes within it.Source: §2 · pp. 2–3
  • A perturbation changes only the center under the single-step setup; observation-space certification additionally needs a verified bound on the learned center map.A support or filter that changes with the observation requires separate analysis.Source: §2 · p. 3

3 OCCUPANCY CONTROLS CONDITIONAL GAUSSIAN GEOMETRY

The paper separates divergence control of the retained Gaussian law from preservation of all Gaussian event comparisons. Convexity guarantees the latter, while nonconvex examples show why a substituted conditional radius can fail.

3 OCCUPANCY CONTROLS CONDITIONAL GAUSSIAN GEOMETRY

  • Concavity of log retention probability characterizes the ordinary Gaussian KL rate and the corresponding finite-order Rényi rates for every ordered pair of centers.The paper also expresses conditioned KL as ordinary Gaussian KL plus the first-order Taylor remainder of log occupancy.Source: §3 · p. 3
  • Convex retained sets preserve the full Gaussian event comparison, making the substituted conditional radius sound for fixed convex retention.The result also holds when nominal conditional label probabilities are replaced by familywise-valid bounds.Source: §3 · p. 3
  • For general retained sets, the full event comparison has an exact one-dimensional test using projected retained-law distributions.The likelihood ratio is ordered by the projection, reducing measurable events to nested halfspaces.Source: §3 · pp. 3–4
  • If conditional covariance stays below Λσ^2 along the segment between centers, conditioned KL is at most Λ times the squared displacement over 2σ^2.A local ratio above one disproves the ordinary Gaussian KL rate, but certifying a decision radius still requires a located label change or covariance control throughout the candidate ball.Source: §3 · p. 4
  • At displacement 0.11, the confidence-filter label has changed despite a substituted radius of 0.190855; the joint-mass radius is the exact 0.1 boundary distance.The conditional decision boundary in the example is at zero.Source: §3 · p. 4
  • For a connected nonconvex L-shaped support, the conditioned label changes strictly inside the substituted conditional radius.The witness uses a binary rule defined by a retained event and certified Gaussian probability bounds.Source: §3 · p. 4
  • Convexity is sufficient but not necessary for log-occupancy concavity, while simple fixed nonconvex supports need not satisfy the substituted-radius or Gaussian-divergence conditions.The confidence filter and connected L-shape provide examples of nonconvex supports lacking those properties.Source: §3 · p. 5

4 CERTIFYING THE UNCHANGED FILTERED CLASSIFIER

The paper certifies the unchanged filtered classifier either from joint retained-label masses or, under covariance control, from conditional probabilities. These routes address the lack of a universal radius from conditional probabilities alone.

4 CERTIFYING THE UNCHANGED FILTERED CLASSIFIER

  • Joint retained-label masses certify the unchanged filtered predictor using lower and upper bounds on the selected and competing event masses.Algorithm 1 combines explicit competitor bounds and the selected-or-rejected mass bound in one familywise confidence event, using the same model evaluations.Source: §4 · pp. 5, 7
  • Conditional probabilities and noise scale alone give no positive universal radius over arbitrary fixed filters, and joint masses alone cannot determine a uniformly larger binary radius.The paper gives constructions with conditional top probability p for which the decision boundary is less than any prescribed ε away.Source: §4 · pp. 5–6
  • A covariance bound throughout a ball transfers Rényi divergence bounds to the retained law and yields a conditional decision radius.For orders above one, the covariance premise must extend to the tilted center, which explains the spatial requirement R/α; covariance at the nominal center alone is insufficient.Source: §4 · p. 6
  • 0.04067 < 0.09470 < 0.1 < 0.11888: on a globally covariance-controlled nonconvex band filter, joint-mass, forward-KL, and conditional radii remain below the 0.1 boundary except the conditional radius.The values are rmass, rcov, the exact boundary distance, and rcond, respectively.Source: §4 · p. 6
  • A fixed classifier, projection, or randomized repair uses the ordinary event certificate; convex conditioning, log-concave occupancy, covariance control, and joint masses require their respective conditions.The paper distinguishes divergence-rate control from the full event comparison and gives a finite-horizon counterpart for predictable Gaussian blocks under one causal program.Source: §4 · p. 7

5 EXPERIMENTS

Experiments compare certificates under a globally covariance-controlled learned filter with joint-mass bounds, then test conditional substitution on a separate released confidence filter. The studies also evaluate a finite-horizon cost-avoidance certificate and verify conditional-label changes inside substituted radii.

Global covariance certificate on a learned model

  • A global covariance proof holds for the training-selected nonconvex filter on all 2,000 CIFAR-10.2 images, with abstentions retained in each denominator.The filter is α ≤ |⟨u, z⟩ + b| ≤ β with 0 < α < β = σ = 0.25; its conditional R´enyi analysis is a reanalysis of saved counts.Source: §5 · p. 7
  • At radius 0.2, conditional R´enyi certifies 892 images versus 725 for joint-mass bounds; at radius 0.5, it certifies 381 where joint mass certifies none.Unfiltered smoothing remains stronger at both radii, and the R´enyi reanalysis uses the same saved counts without additional model evaluations.Source: §5 · p. 7

Released-model evaluation and fixed-cohort attack

  • The released-model evaluation uses a ResNet-110 checkpoint, σ = 0.25, and a confidence filter retaining proposals whose largest softmax probability exceeds 0.9.The datasets are all 10,000 CIFAR-10 test images and 2,021 CIFAR-10.1 v4 images; each image uses independent selection and estimation batches.Source: §5 · pp. 7–8
  • At radius 0.5, Algorithm 1 certifies 32.02% of CIFAR-10 and 17.52% of CIFAR-10.1 images, below unfiltered smoothing at 39.17% and 23.95%.Conditional substitution reports 60.07% and 44.14%, respectively; mean retention is 49.34% and 35.11%.Source: §5 · p. 8
  • 12 of 128 fixed-cohort endpoint pairs have verified opposite conditional labels at displacements below familywise lower bounds on their substituted radii.Nine cases occur among the 80 correctly classified images with positive conditional-substitution radii; the reported yield is for the declared attack and finite cohort.Source: Figure 2 · p. 8, §5 · p. 9

Sequential extension

  • For SafetyPointGoal2, the lower confidence bound on cost avoidance exceeds 0.5 for every tested center-shift sequence with cumulative Euclidean shift budget B ≤ 0.02.The certificate concerns avoiding positive native cost until goal or timeout, not task completion, observation robustness, or forward invariance.Source: §5 · p. 9

6 RELATED WORK

The related work spans fixed-event and rejection-aware smoothing, constrained-input and altered-noise methods, and certificates for adaptive trajectories. This paper retains joint-event foundations while studying probabilities conditioned on acceptance and specializes adaptive Gaussian composition to causal feasibility programs.

6 RELATED WORK

  • Rejection-aware smoothing treats rejection as an output, while this work retains that joint-event foundation and studies probabilities conditioned on acceptance.The cited smoothing literature also includes fixed-output Gaussian smoothing and likelihood-ratio methods for broader noise laws.Source: §6 · p. 9
  • Projection and known-domain methods do not divide by a center-dependent acceptance probability; input-dependent smoothing changes the noise law, whereas Double Sampling keeps its primary law fixed.These approaches frame distinct alternatives to conditioning on retained proposals.Source: §6 · p. 9
  • The trajectory result specializes fully adaptive Gaussian composition to correlated proposal blocks and a common causal feasibility program.Prior work cited includes policy smoothing and adaptive randomized smoothing for trajectories and multi-step computation.Source: §6 · p. 9

7 LIMITATIONS AND CONCLUSION

The conclusion limits the guarantees to unchanged retention and task rules, and distinguishes the scope of the learned-model studies and trajectory certificate. The appendices characterize occupancy geometry globally and locally through divergence comparisons and conditional covariance.

7 LIMITATIONS AND CONCLUSION

  • The single-step guarantees require unchanged retention and task rules, and observation perturbations require a verified map to Gaussian centers.The learned-model experiments use one checkpoint and noise scale; the CIFAR-10.2 and AuditVotes findings concern one selected filter and a selected cohort, respectively.Source: §7 · p. 9
  • The conclusion separates certificates that preserve the predictor: convex retention preserves the ordinary event comparison, while general retention needs geometric control or joint retained-label events.The resulting certificates leave the predictor unchanged.Source: §7 · p. 9

A OCCUPANCY IDENTITIES AND GLOBAL CHARACTERIZATION

  • The global occupancy argument uses smoothness of log retention probability and characterizes concavity through Gaussian-comparator KL and finite-order R´enyi bounds.The proof derives the divergence bounds from concavity and establishes the converse characterization.Source: A OCCUPANCY IDENTITIES AND GLOBAL… · pp. 13–14

B INTEGRATED AND LOCAL COVARIANCE IDENTITIES

  • Locally, a conditional-covariance eigenvalue above σ² makes the corresponding divergence strictly exceed its Gaussian comparator for sufficiently small nonzero center shifts.The maximum directional quotient is λmax(Ca)/σ².Source: B INTEGRATED AND LOCAL COVARIANCE… · p. 15

C JOINT-MASS PROOFS AND GEOMETRY-CONTROLLED RADII

The section establishes joint-mass and geometry-controlled radii for the unchanged filtered predictor. It also shows that conditional-only substitution can fail, while covariance bounds can transfer divergence guarantees to the retained law.

C JOINT-MASS PROOFS AND GEOMETRY-CONTROLLED RADII

  • The binary joint-mass radius is sharp: two disjoint label events tie at the population radius given by Theorem 7.The two joint masses determine the first equality of the competing labels.Source: C JOINT-MASS PROOFS AND… · p. 15
  • Conditional probabilities alone can keep a fixed value p while the decision boundary approaches arbitrarily close to the nominal center.The symmetric-tail construction makes dT → 0 while retaining the same conditional probability p.Source: C JOINT-MASS PROOFS AND… · p. 15
  • Joint retained-label masses support a valid radius: data processing rules out a tie when αΛ∥d∥²/(2σ²) < Cα(pA, pB).Taking the supremum over competitors gives a union of concentric open balls.Source: C JOINT-MASS PROOFS AND… · p. 16
  • Reverse-KL order-one radii are never smaller than forward-KL radii under the same covariance premise, and reverse cost has no corresponding ceiling as (p, q) approaches (1, 0).The forward cost is at most log 2.Source: C JOINT-MASS PROOFS AND… · p. 16
  • Under a uniform covariance bound, the covariance KL upper bound stays below the categorical tie cost, ruling out competitor ties within the resulting radius.A local covariance certificate requires the complete segment to the comparison center to remain in the stated ball.Source: C JOINT-MASS PROOFS AND… · pp. 16–17
  • Finite-sample joint-mass bounds use independent selection and estimation batches or simultaneous bounds, while covariance certificates need a simultaneous guarantee over the full center ball.A sample covariance at the anchor alone does not supply that guarantee.Source: C JOINT-MASS PROOFS AND… · p. 17

D OUTWARD-RATIONAL CERTIFICATE FOR THE COMPACT WITNESS

Outward rational interval propagation certifies the compact connected nonconvex witness’s probability bounds and a label change inside the substituted radius. The enclosures also establish excess conditional KL and total variation over their Gaussian comparators.

D OUTWARD-RATIONAL CERTIFICATE FOR THE COMPACT WITNESS

  • Rational interval arithmetic encloses primitive evaluations and propagates bounds through rectangle masses, normalization, logarithms, and event differences.Every divisor interval has a strictly positive lower endpoint, and the verifier records remainders and checks the strict inequalities.Source: D OUTWARD-RATIONAL CERTIFICATE FOR THE… · pp. 17–18
  • 0.527476587–0.527476588 for Qa(E) versus 0.498885133–0.498885134 for Qb(E) certifies opposite strict labels and a change inside the substituted radius.Figure 3 depicts the connected L-shaped support, tested displacement, conditional boundary, and substituted radius.Source: D OUTWARD-RATIONAL CERTIFICATE FOR THE… · p. 18, Figure 3 · p. 19
  • DKL(Qa∥Qb) exceeds its Gaussian KL comparator 1/450 by more than 0.0002013, while dTV(Qa, Qb) exceeds its Gaussian TV comparator by more than 0.0020501.The certified enclosures give DKL(Qa∥Qb) [0.002423524, 0.002423525] and dTV(Qa, Qb) [0.028641422, 0.028641423].Source: D OUTWARD-RATIONAL CERTIFICATE FOR THE… · p. 18

E A COVARIANCE-CONTROLLED NONCONVEX FAMILY

The section gives nonconvex retained sets with uniform covariance control, allowing divergence-based certificates even when Gaussian event comparison fails. In the two-band witness, the covariance-based radius exceeds twice the joint-mass radius, while the substituted conditional radius crosses the decision boundary.

E A COVARIANCE-CONTROLLED NONCONVEX FAMILY

  • For K = L0 × S with diam(S) ≤ 2σ, conditioning preserves the unrestricted Gaussian factor on L0 and gives Cov(Qc) ⪯ σ²IL even when S is disconnected.This covariance guarantee does not assert the Gaussian event comparison.Source: E A COVARIANCE-CONTROLLED NONCONVEX… · p. 19
  • A filter retaining a scalar projection within [−β, β], with β ≤ σ, has Cov(Xc | R(Xc) = 1) ⪯ σ²I for every center, including when its direction and offset are fixed after separate-data learning.The result extends to an orthonormal set of retained coordinates with coordinatewise bounds βj ≤ σ.Source: E A COVARIANCE-CONTROLLED NONCONVEX… · p. 19
  • For the two-band set, the retained second coordinate lies in [−1, 1], giving a global covariance bound λmax(Cov(Qc)) ≤ 1 despite K having infinite diameter.Proposition 9 applies globally with R = ∞ and Λ = 1, although the diameter-based formulas are unavailable.Source: E A COVARIANCE-CONTROLLED NONCONVEX… · p. 20
  • At δ = 0.1, rcov is 0.09470767664273030523–0.09470767664273030524 versus rmass at 0.04067994841241465132–0.04067994841241465133; the substituted conditional radius crosses the boundary.The forward-KL radius remains close to the exact boundary and is more than twice the joint-mass radius at the certified point.Source: E A COVARIANCE-CONTROLLED NONCONVEX… · p. 20, Figure 4 · p. 20

F ALTERNATIVE FEASIBLE KERNELS

Alternative feasible kernels preserve Gaussian comparisons through common post-processing or fixed mixtures, while anchored comparisons handle center-dependent mixture weights. The section also extends comparisons to causal finite-horizon executions under a pathwise energy bound and specifies their certification conditions.

F ALTERNATIVE FEASIBLE KERNELS

  • A center-independent randomized repair applied through the same measurable map at both centers preserves Gaussian event and total-variation comparisons and finite-order Gaussian divergence bounds.Exact evaluation of the convex-partition alternative can require component occupancies and, for positive temperatures, a certified diameter; these may be intractable for neural confidence regions.Source: F ALTERNATIVE FEASIBLE KERNELS · pp. 20–21

G FIXED-WEIGHT AND ANCHORED COMPARISONS

  • Fixed-weight mixtures over convex components retain Gaussian event comparisons and divergence bounds, while anchored comparisons provide a valid radius for a top label and runner-up.The component weights are center-independent; the anchored construction uses a fixed anchor and a corrected bound.Source: F ALTERNATIVE FEASIBLE KERNELS · p. 21

H FIXED RANDOMIZED REPAIR IS A COMMON CHANNEL

  • A fixed common randomized channel preserves the comparisons, including deterministic repair and component-indexed repair, but does not cover changes to the state, feasible set, or channel across centers.State-specific channels are allowed when compared centers belong to the same fixed state fibre.Source: H FIXED RANDOMIZED REPAIR IS A COMMON… · p. 23

I ADAPTIVE FEASIBLE-TRAJECTORY COMPARISON

  • For finite-horizon causal executions, predictable history-dependent shifts under the pathwise energy condition yield event and divergence comparisons for public traces, even with history-dependent feasible sets.The finite-sample procedure uses a nominal lower confidence bound and requires the energy condition at every reachable history; it does not establish feasible-action nonemptiness or forward invariance.Source: I ADAPTIVE FEASIBLE-TRAJECTORY… · pp. 24–26

I.1 LEARNED-CONTROLLER EVALUATION

The learned-controller evaluation certifies an event probability above 0.5 at B = 0.02 for all six arms. The certified successes are mostly timeouts, and the result does not certify task completion or forward invariance.

I.1 LEARNED-CONTROLLER EVALUATION

  • The three PPO-Lagrangian controllers were trained for 10 million environment steps each and evaluated with a deterministic clipped-controller fallback when no proposal passed verification.Evaluation used SafetyPointGoal2-v0 in Safety-Gymnasium 1.0.0.Source: §I.1 · p. 26
  • The certified event is no positive native cost until the first goal or 500 executed steps, so a timeout without cost counts as success.Reaching the goal stops the event, which makes no claim about later states.Source: §I.1 · p. 26
  • All six arms certify event probability above 0.5 at B = 0.02 with familywise error at most 0.001, using 59–107 nominal trajectories per arm reaching the goal before cost.Most certified successes are therefore timeouts.Source: §I.1 · p. 27
  • The result does not certify task completion, observation perturbations, changes to the verifier or dynamics, or forward invariance.The verifier is a fixed observation-only heuristic, not a native-cost oracle.Source: §I.1 · pp. 26–27

J RELATION OF THE FORMAL RESULTS TO PRIOR WORK

Table 2 distinguishes earlier results used in the formal steps from results established here. The section highlights limits of conditional votes and covariance-based transfer to conditional laws.

J RELATION OF THE FORMAL RESULTS TO PRIOR WORK

  • Table 2 maps earlier statements used in formal steps to results established here, including explicit competitor bounds and their combination with rejection-complement bounds.Its columns distinguish the earlier result from the contribution established in this paper.Source: Table 2 · p. 27, J RELATION OF THE FORMAL RESULTS TO… · pp. 27–28
  • Theorem 7 and Algorithm 1 build on joint selected-label and selected-or-rejection masses, while the cited joint-event certificate does not certify from conditional votes alone.The cited prior construction retains rejection as an output.Source: J RELATION OF THE FORMAL RESULTS TO… · p. 28
  • Proposition 9 gives a support-free impossibility result for conditional-only radii alongside sharpness results for joint-mass radii and categorical Rényi reversal bounds.The listed tools also include data processing, Popoviciu’s inequality, and likelihood-ratio oscillation.Source: J RELATION OF THE FORMAL RESULTS TO… · p. 28
  • A uniform covariance bound transfers divergence certificates to conditional laws, with an R/α restriction when the bound holds only inside a radius-R ball.The result concerns certification under a covariance condition rather than preservation of the full Gaussian event comparison.Source: J RELATION OF THE FORMAL RESULTS TO… · p. 28
  • For correlated proposal blocks, the stated causal construction uses one common selector, verifier, fallback, dynamics, and stopping program.The passage specifies an exact Mahalanobis cost for the correlated blocks.Source: J RELATION OF THE FORMAL RESULTS TO… · p. 28

K.1 RELEASED-MODEL RECERTIFICATION

  • The released-model audit finds that the manuscript substitutes conditional-probability bounds into a Gaussian radius although its halfspace comparison applies to joint retention-and-label indicators.The audit concerns the Gaussian image extension, not the separate graph certificate.Source: §K.1 · p. 28
  • The seeded full-test evaluation follows the released image path, including noise before normalization, no clipping, and strict confidence-threshold retention.It uses 100 proposals per image for selection and 10,000 for estimation, with seeded streams and retained and unfiltered counts.Source: §K.1 · pp. 28–29
  • Table 3 reports additional full-test results; selected-label accuracy is 0.7603 after filtering versus 0.7867 without filtering, with mean retained fraction 0.493386.The evaluation uses conventional SciPy quantiles and does not claim adversarial floating-point soundness.Source: §K.1 · p. 29, Table 3 · p. 29

K.2 CIFAR-10.1 EVALUATION

The appendix evaluates conditional, joint-mass, and geometry-controlled certificates across attacks, synthetic geometries, and a learned image model. It reports verified boundary crossings under conditional substitution and improved conditional-divergence certificate counts under a global covariance bound.

K.3 FIXED-COHORT CIFAR-10.1 ATTACK

  • All twelve screened fixed-cohort candidates have verified opposite endpoint labels below fresh lower bounds on their substituted radii; nine occur among 80 correctly classified images with positive released radii.The primary fixed-cohort yield is 12/128, for the declared attack and finite cohort.Source: §K.3 · p. 30, Table 5 · p. 30

K.4 OUTPUT-SELECTED BOUNDARY CONFIRMATION

  • Four population substitution violations are verified with familywise error at most 0.001, but the output-selected candidates establish existence rather than prevalence.The confirmation requires opposite endpoint winners and shifts below fresh lower bounds on the corresponding population substituted radii.Source: §K.4 · p. 31, Table 6 · p. 31

K.5 CONFIDENCE-THRESHOLD SELECTION

  • The threshold-selection study chooses threshold zero on development data and confirms the same candidate ordering on untouched indices.Its objective averages explicit-joint certified accuracy over radii 0.25, 0.5, and 0.75; it addresses the released checkpoint only.Source: §K.5 · p. 31, Table 7 · p. 31

K.6 POPULATION FEASIBLE-ACTION REANALYSIS

  • At all 448 reference states, the substituted conditional radius crosses the located boundary, while the positive joint-mass radius crosses none.The joint radius divided by boundary distance has median 0.7708 and maximum 0.8628.Source: §K.6 · p. 32

K.7 GEOMETRIC BREADTH

  • In the product-box study, ten covariance-direction KL ratios from five base geometries exceed one, with a maximum of 1.0448; no independent-direction ratio exceeds one.Every fixed-anchor control in Panel B stays below one.Source: Figure 5 · p. 32

K.8 HELD-OUT COVARIANCE REPLICATION

  • Fourteen held-out geometries exceed the Gaussian KL rate in the anchor top-covariance direction, versus none in the independently seeded direction.The 128 base geometries, not 1,024 factor rows, are the independent analysis units; the study is a targeted replication, not a prevalence estimate.Source: §K.8 · pp. 32–33, Figure 6 · p. 33

K.10 CONDITIONAL DIVERGENCE REANALYSIS

  • At radius 0.2, R´enyi certifies 167 correct images that joint mass does not, with none in reverse; for 877 labels, its lower radius exceeds the joint upper radius by at least 0.01.The reanalysis uses the original bounds and counts these as comparisons between certificate formulas, not true robust radii.Source: §K.10 · p. 34, Table 9 · p. 35
Loading 2609.39497v1…