% \documentclass{uai2024} % for initial submission
\documentclass[accepted]{uai2024} % after acceptance, for a revised version; 
% also before submission to see how the non-anonymous paper would look like 
                        
%% There is a class option to choose the math font
% \documentclass[mathfont=ptmx]{uai2024} % ptmx math instead of Computer
                                         % Modern (has noticeable issues)
% \documentclass[mathfont=newtx]{uai2024} % newtx fonts (improves upon
                                          % ptmx; less tested, no support)
% NOTE: Only keep *one* line above as appropriate, as it will be replaced
%       automatically for papers to be published. Do not make any other
%       change above this note for an accepted version.

%% Choose your variant of English; be consistent
\usepackage[american]{babel}
% \usepackage[british]{babel}

%% Some suggested packages, as needed:
\usepackage{natbib} % has a nice set of citation styles and commands
\let\cite\citep
\bibliographystyle{plainnat}
\renewcommand{\bibsection}{\subsubsection*{References}}
\usepackage{mathtools} % amsmath with fixes and additions
% \usepackage{siunitx} % for proper typesetting of numbers and units
\usepackage{booktabs} % commands to create good-looking tables
\usepackage{tikz} % nice language for creating drawings and diagrams

\usepackage{graphicx}
\usepackage{caption}
\usepackage{subcaption}
\usepackage{float}
\usepackage{multirow}
\usepackage{multicol}
\usepackage{sidecap}

\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{makecell}
\usepackage{apptools}

\newcommand{\probust}{\texorpdfstring{$p^\mathrm{robust}_{\sigma}$}{probust}}
\newcommand{\pmc}{\texorpdfstring{$p^\mathrm{mc}_{\sigma}$}{pmc}}
\newcommand{\ptaylor}{\texorpdfstring{$p^\mathrm{taylor}_{\sigma}$}{ptaylor}}
\newcommand{\ptaylormvs}{\texorpdfstring{$p^\mathrm{taylor\_mvs}_{\sigma}$}{ptaylormvs}}
\newcommand{\pmmse}{\texorpdfstring{$p^\mathrm{mmse}_{\sigma}$}{pmmse}}
\newcommand{\pmmsemvs}{\texorpdfstring{$p^\mathrm{mmse\_mvs}_{\sigma}$}{pmmsemvs}}
\newcommand{\psoftmax}{\texorpdfstring{$p^\mathrm{softmax}_{T}$}{psoftmax}}
\newcommand{\probustwsigma}[1]{\texorpdfstring{$p^\mathrm{robust}_{\sigma= {#1}}$}{probust}}
\newcommand{\pmmsewsigma}[1]{\texorpdfstring{$p^\mathrm{mmse}_{\sigma = {#1}}$}{pmmse}}


%% Provided macros
% \smaller: Because the class footnote size is essentially LaTeX's \small,
%           redefining \footnotesize, we provide the original \footnotesize
%           using this macro.
%           (Use only sparingly, e.g., in drawings, as it is quite small.)

%% Self-defined macros
\newcommand{\swap}[3][-]{#3#1#2} % just an example

\title{Characterizing Data Point Vulnerability via Average-Case Robustness}
% \title{Efficient Estimation of Average-Case Robustness for Multi-Class Classification}


% The standard author block has changed for UAI 2024 to provide
% more space for long author lists and allow for complex affiliations
%
% All author information is authomatically removed by the class for the
% anonymous submission version of your paper, so you can already add your
% information below.
%
% Add authors

\author{\hspace{2em}Tessa Han*}
\author{\hspace{3em}Suraj Srinivas*}
\author{Himabindu Lakkaraju}

% Add affiliations after the authors
\affil[]{Harvard University }

%\affil[2]{%
%    Harvard University}
%\affil[3]{%
%    Harvard University}
    
% \affil[2]{%
%     Second Affiliation\\
%     Address\\
%     …
% }
% \affil[3]{%
%     Another Affiliation\\
%     Address\\
%     …
%   }

\renewcommand{\thefootnote}{\fnsymbol{footnote}}
  
  \begin{document}
\maketitle
\footnotetext{*Equal contribution}

\begin{abstract}
Studying the robustness of machine learning models is important to ensure consistent model behaviour across real-world settings. To this end, adversarial robustness is a standard framework, which views robustness of predictions through a binary lens: either a worst-case adversarial misclassification exists in the local region around an input, or it does not. However, this binary perspective does not account for the degrees of vulnerability, as data points with a larger number of misclassified examples in their neighborhoods are more vulnerable. In this work, we consider a complementary framework for robustness, called average-case robustness, which measures the fraction of points in a local region that provides consistent predictions. However, computing this quantity is hard, as standard Monte Carlo approaches are inefficient especially for high-dimensional inputs. In this work, we propose the first analytical estimators for average-case robustness for multi-class classifiers. We show empirically that our estimators are accurate and efficient for standard deep learning models and demonstrate their usefulness for identifying vulnerable data points, as well as quantifying robustness bias of models. Overall, our tools provide a complementary view to robustness, improving our ability to characterize model behaviour. 
\end{abstract}

\input{1-intro}
\input{2-related-work}
\input{3-method}
\input{4-experiments}
\input{5-conclusion}

%\bibliographystyle{unsrtnat}
\bibliography{references.bib}

\appendix
\onecolumn
\input{6-appendix}

\end{document}
