Tower Robustness in Deep Learning

• Tower Robustness is a probabilistic metric that quantifies the likelihood of a classifier remaining correct under uniformly sampled Lp-bounded perturbations.
• The method employs one-sample binomial hypothesis tests at each data point to compute statistically grounded lower and upper bounds on robustness.
• Empirical evaluations on datasets like MNIST and CIFAR-10 demonstrate practical trade-offs between sample complexity and certified robustness in safety-critical deployments.

Searching arXiv for the cited papers and nearby context. Tower Robustness is a probabilistic robustness metric for classification models under bounded input perturbations. Introduced by Mu and Lim, it evaluates the probability that a randomly perturbed test pair remains correctly classified when the perturbation is drawn uniformly from an $L^p$ ball of radius $\epsilon$ around the input (Mu et al., 26 Aug 2025). In contrast to purely attack-based scores and in contrast to deterministic certified accuracy as a partial guarantee, the metric is formulated as a global scalar over the data distribution and is paired with a hypothesis-testing procedure that yields computable lower and upper bounds with statistical confidence. The same phrase, however, appears in other research areas with different meanings, including rigid-body assembly stability, tower forcing in set theory, and lunar tensegrity design; these usages are terminologically related only at the level of the word “tower,” not as a shared formalism (Nadeau et al., 2024).

1. Definition and probabilistic semantics

Under the notation conventions of Mu and Lim, $\mathbb{X},\mathbb{Y}$ denote the input and label spaces, $h:\mathbb{X}\to\mathbb{Y}$ is a classifier, $g(x,w,y)$ its softmax scores, and $\|\cdot\|_p$ is the usual $L^p$ norm on inputs (Mu et al., 26 Aug 2025). Let $(\mathbf{x},\mathbf{y})\sim D$ be drawn from the data distribution, and fix a radius $\epsilon\ge 0$ under the $L^p$ norm. Definition 3.1 gives the $\epsilon$0–Tower Robustness of model $\epsilon$1 as

$\epsilon$2

or equivalently

$\epsilon$3

The randomness is explicitly two-stage. First, one samples $\epsilon$4. Second, one samples a neighbour $\epsilon$5 uniformly in the $\epsilon$6 ball of radius $\epsilon$7 around $\epsilon$8. The resulting scalar therefore captures the probability that a randomly perturbed test pair remains correctly classified. The paper presents this not as a pointwise worst-case property, but as expected conditional accuracy over random neighbourhoods.

The probabilistic interpretation is formalized through the law of total expectation. Defining the Bernoulli indicator

$\epsilon$9

Theorem 3.1 yields

$\mathbb{X},\mathbb{Y}$0

This establishes Tower Robustness as the expectation of local conditional correctness across the data distribution rather than as a deterministic all-points certificate.

2. Hypothesis-testing construction

The operational core of Tower Robustness is a local hypothesis test performed at each test example (Mu et al., 26 Aug 2025). For a fixed pair $\mathbb{X},\mathbb{Y}$1, the paper considers the conditional local misclassification probability

$\mathbb{X},\mathbb{Y}$2

and reduces its estimation to a one-sample binomial test.

The null and alternative hypotheses are stated as

$\mathbb{X},\mathbb{Y}$3

where $\mathbb{X},\mathbb{Y}$4 is the true local misclassification rate within the perturbation ball and $\mathbb{X},\mathbb{Y}$5 is a user-specified tolerance. One samples $\mathbb{X},\mathbb{Y}$6 neighbours, observes $\mathbb{X},\mathbb{Y}$7 misclassifications, and computes the exact binomial p-value

$\mathbb{X},\mathbb{Y}$8

If $\mathbb{X},\mathbb{Y}$9, one rejects $h:\mathbb{X}\to\mathbb{Y}$0 at significance level $h:\mathbb{X}\to\mathbb{Y}$1 and concludes that the local misclassification rate is $h:\mathbb{X}\to\mathbb{Y}$2 with confidence $h:\mathbb{X}\to\mathbb{Y}$3.

This construction is central to the paper’s framing of robustness as a probabilistic quantity. A common misunderstanding is to treat such a test as equivalent to adversarial search or deterministic verification. Mu and Lim instead place it between those regimes: it is stricter than heuristic attack-failure estimates because it is certificate-bearing, but it does not assert universal correctness throughout the perturbation ball. The method therefore targets pre-deployment robustness assessment under a probabilistic semantics rather than exact worst-case verification.

3. Estimation procedure and global certificates

The full computation wraps the per-example test into an empirical estimator over a test set (Mu et al., 26 Aug 2025). The procedure is as follows.

For each test sample $h:\mathbb{X}\to\mathbb{Y}$4, draw $h:\mathbb{X}\to\mathbb{Y}$5 i.i.d. perturbations $h:\mathbb{X}\to\mathbb{Y}$6 uniformly from the $h:\mathbb{X}\to\mathbb{Y}$7 ball of radius $h:\mathbb{X}\to\mathbb{Y}$8 around zero, form perturbed inputs $h:\mathbb{X}\to\mathbb{Y}$9, and record binary outcomes

$g(x,w,y)$0

Let $g(x,w,y)$1 and compute the exact binomial p-value under $g(x,w,y)$2. If $g(x,w,y)$3, mark

$g(x,w,y)$4

otherwise set

$g(x,w,y)$5

Over all $g(x,w,y)$6 test cases, compute the empirical robust-accuracy statistic

$g(x,w,y)$7

The paper then substitutes this statistic into global bounds derived from Lemma 4.1 and Markov’s Inequality. The resulting lower and upper bounds are

$g(x,w,y)$8

and

$g(x,w,y)$9

These form a two-sided certificate around the true value of Tower Robustness.

The construction is global in a precise sense. Denoting by $\|\cdot\|_p$0 the event that the local null hypothesis has been rejected for $\|\cdot\|_p$1, Lemma 4.1 gives

$\|\cdot\|_p$2

Theorems 4.3 and 4.4 then convert this event-level statement into bounds on the Tower Robustness itself. With confidence at least $\|\cdot\|_p$3, the true Tower Robustness lies in $\|\cdot\|_p$4.

4. Theoretical position among robustness notions

The paper organizes Tower Robustness as a bridge between local probabilistic tests and global robustness guarantees (Mu et al., 26 Aug 2025). Theorem 3.1 identifies the metric with expected conditional accuracy over perturbation neighbourhoods. The corollary in Section 3.2 states that deterministic certified accuracy $\|\cdot\|_p$5 lower-bounds Tower Robustness. This formally places deterministic certification inside the broader probabilistic framework rather than outside it.

The distinction from attack-based evaluation is equally explicit. Attack-failure-rate metrics have no statistical certificate and may be upper bounds on robustness but not tight. Deterministic certification covers only a small fraction of inputs at high dimensions. Approximate probabilistic methods such as Agresti–Coull intervals can over- or under-estimate, whereas the exact binomial test used here remains conservative and sound even for small samples or extreme rates.

A second common misunderstanding is to read Tower Robustness as a statement about individual samples rather than a data-distribution-level quantity. The formal definition is distributional: the metric is an expectation over $\|\cdot\|_p$6 and over random perturbations conditioned on $\|\cdot\|_p$7. This suggests that its principal use is not to replace pointwise verification, but to quantify global perturbation-robust correctness under explicit statistical risk.

The parameters $\|\cdot\|_p$8 and $\|\cdot\|_p$9 govern the trade-off between certificate strength and sample complexity. The paper states that by choosing small $L^p$0 one can tighten the certificate at the cost of more samples per example. It also recommends choosing $L^p$1 equal to the maximum acceptable misclassification proportion and $L^p$2 equal to the tolerable statistical risk.

5. Empirical behavior, computational profile, and practical use

The reported empirical evaluation covers MNIST and CIFAR-10, each with 10 k test examples (Mu et al., 26 Aug 2025). The perturbation neighbourhoods are $L^p$3 for MNIST and $L^p$4 for CIFAR-10. Six models are evaluated: an ERM baseline, PGD-adversarial-training (Madry et al.), TRADES, MART, a CVaR-trained probabilistically robust model, and Small-Box certified training. The default helper parameters are $L^p$5, with a fixed sample budget $L^p$6 per test example such as $L^p$7 or a budget chosen by sequential sampling formulas.

The quantitative results isolate several patterns. On CIFAR-10, CVaR attains the highest lower bound $L^p$8, while PGD training achieves $L^p$9. On MNIST, all robustly trained models—PGD, TRADES, MART, and CVaR—exceed $(\mathbf{x},\mathbf{y})\sim D$0 lower bound; ERM is low, and Small-Box, although tuned for deterministic certification, remains low in the probabilistic sense. As $(\mathbf{x},\mathbf{y})\sim D$1 is tightened from $(\mathbf{x},\mathbf{y})\sim D$2 down to $(\mathbf{x},\mathbf{y})\sim D$3 with $(\mathbf{x},\mathbf{y})\sim D$4 fixed, lower bounds increase by up to $(\mathbf{x},\mathbf{y})\sim D$5–$(\mathbf{x},\mathbf{y})\sim D$6 points; tightening $(\mathbf{x},\mathbf{y})\sim D$7 yields smaller gains.

The computational cost is reported as roughly linear in $(\mathbf{x},\mathbf{y})\sim D$8 forward evaluations, with $(\mathbf{x},\mathbf{y})\sim D$9 and $\epsilon\ge 0$0 on the order of $\epsilon\ge 0$1–$\epsilon\ge 0$2 per test. The paper characterizes this as orders-of-magnitude faster than complete deterministic verification on large networks, while yielding more rigorous statistical guarantees than heuristic attack-based metrics. Practical recommendations include using sequential sampling formulas (Eqn 4.2) to adaptively pick $\epsilon\ge 0$3 per example and combining the procedure with any available deterministic certificate so that points already certified robust can skip sampling.

The stated deployment setting is safety-critical systems requiring pre-deployment guarantees on failure probabilities under worst-case-bounded perturbations. Within that setting, Tower Robustness is presented as a global-average correctness guarantee over perturbed inputs together with rigorously quantified error bars. The limitations are also explicit: uniformly sampling in high-dimensional perturbation balls may miss “thin” adversarial manifolds; the current theory assumes i.i.d. neighbourhood sampling; and extensions to importance-sampling, adaptive local tests, distribution shift, more complex transformation models, and privacy-preserving sampling remain open directions.

6. Other meanings of “tower robustness” and related terminology

The phrase “tower robustness” is not unique to probabilistic deep learning. In other literatures, “tower” and “robustness” appear together in substantially different technical senses.

Area	Object of study	Core formalism
Probabilistic model robustness	Classifier under bounded perturbations	Exact binomial tests and bounds on Tower Robustness
Frictional assembly stability	Tower-like rigid-body assembly	CIG, baseline QP, max-flow slip test, toppling margins
Set theory and forcing	Tower of ideals	Presaturated vs precipitous towers under reflection axioms
Structural design	Deployable tensegrity lunar tower	Non-linear optimization with yielding, buckling, and stiffness constraints

In rigid-body mechanics, the relevant quantity is static robustness for assemblies in frictional contact, not the probabilistic metric of Mu and Lim. The method of “Robustness Assessment of Assemblies in Frictional Contact” builds a Contact Interface Graph, solves a baseline QP, computes slip margins via a force-flow network, computes toppling margins by subgraph enumeration and torque ratios, and returns

$\epsilon\ge 0$4

for a load point $\epsilon\ge 0$5 and direction $\epsilon\ge 0$6 (Nadeau et al., 2024). The Lego-block tower case study reports a five-cube tower with $\epsilon\ge 0$7, $\epsilon\ge 0$8, and overall $\epsilon\ge 0$9 under the specified top-corner lateral load.

In set theory, Cox–Viale study tower forcing rather than geometric or probabilistic robustness. Their results concern towers of ideals with critical point $L^p$0, the distinction between precipitousness and presaturation, and incompatibilities between presaturated towers concentrating on $L^p$1 or $L^p$2 and principles such as RP, SRP, and TP$L^p$3 (Cox et al., 2011). The term “robustness” in that discussion refers to the persistence or failure of structural properties of towers under forcing and reflection assumptions, not to perturbation tolerance.

In structural mechanics, Chen et al. analyze a deployable tensegrity lunar tower via a non-linear optimization problem whose design variables include force-densities, a complexity parameter $L^p$4, and a minimum prestress level $L^p$5 (Chen et al., 2020). Robustness is secured at three levels: local yielding or buckling, global buckling through the positive-definiteness condition

$L^p$6

and gravity coupling through equilibrium with self-weight. The 2 km case study with a 6 000 kg payload reports an optimal design at complexity $L^p$7 with $L^p$8 and $L^p$9.

These usages indicate that “Tower Robustness” in contemporary arXiv-indexed research is primarily a term of art in probabilistic robustness for deep learning, while adjacent appearances of the phrase in assembly analysis, set theory, and structural design are domain-specific and formally unrelated.