SupplementaryMaterialfor CertifiedDefensetoImageTransformationsvia RandomizedSmoothing

Let x Rn, f: Rm Y be a classifier,ψβ: Rn Rm a composable transformation forβ N(0,Σ) with a symmetric, positive-definite covariance matrixΣ Rm m. For the construction of the set C, we iterate only over the index setP. The set P is constructed do include all points in G that could yield non empty intersectionsci0,j0, thus this is just to speed up the evaluation and equivalent otherwise to the algorithm described in the main part. MNISTFor MNIST we use a ResNet-18 (that takes a single color channel in the input layer), whichwetrainedwith σ = 0.3,PGDstepsize 0.2,batchsize 1024,andinitiallearningrate 0.01over 180 epochs, lowering the learning rate every 60 epochs. Fordata augmentation we used rotations in [ 30,30], [ 180,180] degrees and translations of 50% for each model respectively.