Corollary1statesthatf0 ismoreexpressivethan f when γ = 0, and thus the optimalf0 always outputs no higher loss, which, yet, is not true for arbitraryf0 (e.g.

Such message exchanging isparameter-free andselfadaptive, as it is dynamically controlled by the scaling factors that are determined by the training itself.

Since, by definition,ˆr(x0,) is the radius of the smallest ball with1/2+ probability mass of f(x0 +P)overall possible centers inRk and ˆRisthe radius of the smallest such ball centered at ˆf(x),wemusthaveˆr(x0,) ˆR. Consider the smallest ballB(z0,ˆr(x, 1)) that encloses at least1/2 + 1 probability mass of f(x+P). We sample then points in batches and compute the distanced(ci,zj) for each pair of candidate centerci andpointzj inabatch. Also, with high probability, at least half of then samples will lie in this ball too. Ignoring the probability that none of then0 points lie inside the ball, we can derive the following versionoftheorem3: Theorem1.

The study of provable adversarial robustness has mostly been limited to classification tasks and models with one-dimensional real-valued outputs.

Theorem 6.Suppose Assumptions 4, 5, 6, hold.