{"id":"8c07a3e8-769e-4989-9c27-e66034f30648","arxiv_id":"2501.10876","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A stable rank network with a known Lipschitz constant certifies robustness radii for persistence diagrams, and on ORBIT5K it keeps high robust accuracy where a standard PersLay model collapses.","lead":"The paper builds a classifier on topological summaries called persistence diagrams and makes its output stable by design, so it can certify how much the diagram can be perturbed before the prediction changes. On the ORBIT5K orbit dataset, this certified robustness stays high where a standard topological neural network fails even under tiny perturbations.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Section 3.1 states the certification inequality in the wrong direction; as written, the certificate is invalid and Table 1's certified numbers rest on an uncorrected statement.","rationale":"The reader's verdict is CONDITIONAL, and my analysis supports that conditionality rather than overturning it. The reader's weakest_assumption concerned the bijectivity of the learnable reparameterization F; that is a real gap for the learnable variant, but it does not affect the identity-F experiments. The more load-bearing issue is the direction of the robustness inequality in Section 3.1, which the reader also flagged in the strongest_claim. If the printed 'epsilon >= Mx/(2K)' were taken literally, the certificate would be invalid even for F=id, because Lipschitz-margin reasoning gives a lower bound on the radius, not robustness for all radii above the threshold. This is almost certainly a typo, since Table 1's numbers are consistent with the correct inequality, but the paper must correct the statement and clarify the certification computation. Because the underlying method is sound when the inequality is fixed, and the reported identity-F experiments appear to implement the correct certificate, I do not move the verdict from CONDITIONAL; I only emphasize that the sign error is the first thing to fix before acceptance.","tokens_in":11762,"tokens_out":4722,"duration_ms":56593,"concrete_test":"Independently re-derive the robustness bound from the definition: for a 1-Lipschitz f and a test point x with margin Mx, the certified radius is Mx/(2K). Concretely, with the identity-F SRN (K=1), take a test sample with margin Mx and evaluate the classifier at a persistence diagram at bottleneck distance Mx/2 + 10^-6. The printed inequality 'epsilon >= Mx/2' predicts robustness at that radius; the corrected bound predicts the classifier may change. If the prediction flips, the printed theorem is false. Also rerun the Table 1 certification computation comparing 'epsilon > margin/(2K)' versus 'epsilon <= margin/(2K)' and report whether the robust-accuracy columns change.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is the claim in Section 3.1 that 'g is epsilon-robust at x for all epsilon >= Mx/(2K)'. This is the reverse of the Tsuzuku-type bound. For a K-Lipschitz f, for any x' with d(x,x') <= epsilon, the margin at x' is at least Mx - 2K*epsilon, so the prediction is preserved when epsilon < Mx/(2K) (or <=, depending on convention). Thus g is robust on the ball of radius Mx/(2K), not for all larger radii. Taken literally, 'epsilon >= Mx/(2K)' claims robustness at arbitrarily large perturbations, which is impossible for a nonconstant classifier; the inequality must be 'epsilon <= Mx/(2K)' or 'epsilon < Mx/(2K)'. Since Table 1's SRN certified robust accuracies are computed as the percentage of test points whose robustness radius exceeds each epsilon threshold, the entire certification experiment depends on the correct inequality. As printed, the paper does not contain a valid certificate. A secondary gap is that the learnable F in Appendix C.4 is bounded and not surjective onto R>=0, so it does not satisfy the 'increasing bijection' definition in Appendix B; however, even the identity-F experiments in Table 1 require the corrected robustness inequality.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes the Stable Rank Network (SRN), which composes a stable-rank vectorization of persistence diagrams with a Lipschitz MLP, and claims that the known Lipschitz constant of the composition can be used to certify adversarial robustness in the space of persistence diagrams under Wasserstein/Bottleneck metrics. The method is evaluated on ORBIT5K, where SRN reports a certified robust accuracy of 79.6% at epsilon=10^-5 and 51.3% at epsilon=1, compared with a reimplemented PersLay baseline whose robust accuracy under attack drops to about 25% at the same radii. The main theoretical ingredients are the stability inequality for stable ranks (Eq. 3), a Lipschitz bound for reparameterizations F (Proposition 1), and a margin-based certificate following Tsuzuku et al. (2018).","tokens_in":12070,"tokens_out":7122,"duration_ms":74027,"significance":"The idea of importing certified robustness into persistence-diagram classification is timely, and the use of stable ranks gives the pipeline a parameter-free 1-Lipschitz constant when F=id. The comparison between a certified lower bound (SRN) and an attack-based upper bound (PersLay) is a sensible experimental design. However, the paper's central certificate contains a reversed inequality, and the learnable reparameterization used in Appendix C.4 does not satisfy the bijectivity assumption under which the stability result is stated. These issues are load-bearing, so the contribution is only conditionally established.","major_comments":[{"comment":"The statement that g is epsilon-robust at x for all epsilon >= Mx/(2K) is the reverse of the standard Lipschitz-margin bound. For a K-Lipschitz f, every x' with d(x,x') <= epsilon has f_c(x') >= f_c(x) - K*epsilon and f_i(x') <= f_i(x) + K*epsilon for i != c, so the margin at x' is at least Mx - 2*K*epsilon; the prediction is preserved when epsilon <= Mx/(2K) (strictly, epsilon < Mx/(2K), depending on tie conventions). As written, the certificate claims robustness for arbitrarily large radii, which is impossible for a nonconstant classifier. Table 1's certified robust accuracies depend on this inequality, so the numerical certification results are unsupported until the inequality is corrected and the numbers are recomputed with the correct direction.","section":"Section 3.1"},{"comment":"Appendix B defines a reparameterization F as an increasing bijection R>=0 -> R>=0, and Equation (3) and Corollary 2 are stated for such F. The learnable F in Appendix C.4, F(t) = integral_0^t f dlambda with f a Gaussian mixture, is strictly increasing but bounded (its supremum is the integral of f over R>=0), hence it is not surjective onto R>=0 and is not an increasing bijection. The paper therefore does not provide a stability or Lipschitz guarantee for the learnable-F variant. Since Section 3.1's certificate is formulated for the SRN architecture generally, the authors must either prove the stability inequality for bounded increasing F or explicitly restrict the certified claim to bijective F, with the learnable F presented only as a heuristic. The identity-F case used in Table 1 is covered, but only after the inequality in Major Comment 1 is fixed.","section":"Appendix B and Appendix C.4"}],"minor_comments":[{"comment":"The third contribution bullet says the method 'provides certified robustness for the SRN architecture'; given Major Comments 1 and 2, this should be qualified to the identity-F variant and with the corrected inequality.","section":"Section 1"},{"comment":"The displayed inequality in Eq. (3) has no factor K and is followed by Proposition 1, which introduces K; this is mathematically correct, but the presentation would be clearer if the final K-Lipschitz statement were displayed as a numbered corollary so that readers do not mistake Eq. (3) for the sharp constant.","section":"Appendix B, Eq. (3)"},{"comment":"The certified numbers should state whether the margin condition is evaluated with strict or non-strict inequality at the boundary epsilon = Mx/(2K), since tie-breaking at the decision boundary can affect the reported percentages.","section":"Table 1"}],"recommendation":"major_revision","confidential_remarks":"The reversed inequality is likely a typo, but it is central and must be fixed. The authors should also address the gap between the bijective F assumption and the Gaussian-mixture F in Appendix C.4; if the learnable F is not certified, the paper should say so explicitly. The experimental protocol is sensible, but the workshop format leaves little room for hyperparameter details; a journal version should include them. The self-citation for Eq. (3) is appropriate and does not by itself raise concerns."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: the SRN idea is sound and worth knowing about, but the paper as written has a sign error in its central certificate, and the learnable reparameterization isn't covered by the stated stability theorem. Fix those and this is a clean little contribution; don't cite the current version for the certificate.\n\nWhat's actually new: composing stable-rank vectorizations with 1-Lipschitz L∞-dist networks to get a certified Lipschitz constant for a persistence-diagram classifier, then applying the standard margin bound. That's a natural but useful combination, and Table 1's comparison against a reimplemented PersLay is the right kind of evidence. The stable-rank chain is solid when F=id: rp,id is 1-Lipschitz with respect to Wp, the MLP is 1-Lipschitz in L∞, so the composition is 1-Lipschitz and the Tsuzuku bound applies. The authors also correctly describe their certified numbers as lower bounds and the attack-based PersLay numbers as upper bounds, which is the honest framing.\n\nSoft spots, in order of severity. First, Section 3.1 states 'g is ε-robust for all ε ≥ Mx/2K'. That is the wrong direction; the Tsuzuku-type bound certifies ε ≤ Mx/2K. As printed, the certificate is invalid—it would claim robustness at arbitrarily large radii, which a non-constant classifier cannot have. Table 1's numbers depend on the corrected inequality, so this has to be fixed before the results can be trusted. I assume it's a typo, but it's load-bearing.\n\nSecond, Appendix B insists F is an increasing bijection of R≥0, but the learnable F in C.4 is an integral of a Gaussian mixture, which is bounded and so not surjective. The stability inequality quoted from prior work may or may not need surjectivity; as written, the learnable variant isn't covered. Table 1 uses F=id, so the main experiments are unaffected, but the method section overclaims.\n\nThird, the reproducibility is thin: no code, no hyperparameters for the attack (λ, PGD steps, number of added points), no details on the stable-rank vector dimension or padding. For a workshop abstract that's tolerable; for a full paper it wouldn't be.\n\nVerdict: the central argument holds up for F=id once the inequality direction is corrected. The paper deserves refereeing—the idea is timely for TDA+robustness—but the current version shouldn't be accepted without the typo fixed and the bijectivity gap addressed.","headline":"Sound idea, F=id experiments likely right, but central certificate has a sign error and learnable F overclaims; fix before citing.","tokens_in":12643,"tokens_out":3950,"would_cite":false,"duration_ms":36643,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["55N31","68T07"],"pacs":[],"model":"deepseek-v4-flash","headline":"A classifier built from stable ranks of persistence diagrams certifies per-sample robustness radii in one forward pass.","keywords":["persistent homology","persistence diagrams","stable ranks","Lipschitz neural networks","certified robustness","adversarial robustness","topological data analysis","ORBIT5K"],"falsifier":"Compute $\\|r_{p,F}(D)-r_{p,F}(D')\\|_\\infty$ and $K\\,W_p(D,D')$ for many pairs of H1 diagrams using the trained Gaussian-mixture $F$; a single pair violating the stable-rank Lipschitz inequality would show the certified radius $M_x/(2K)$ is not guaranteed for that variant. For the identity-$F$ version, run a Wasserstein-space Carlini-Wagner attack and check whether any adversarial example appears at distance below $M_x/(2K)$; finding one would refute the certificate.","tokens_in":11574,"feed_emoji":"🛡️","tokens_out":9351,"duration_ms":85718,"temperature":0.7,"pith_summary":"The paper introduces an architecture, the Stable Rank Network, that turns persistence diagrams into learned vector representations while keeping a known Lipschitz constant. If the claim holds, any classifier built this way carries a per-sample robustness certificate: from one forward pass and the prediction margin, a user knows the largest perturbation radius within which the prediction cannot change. This matters because standard ways of feeding persistence diagrams into neural networks lose the stability guarantees of topological data analysis, and exact robustness verification is generally intractable. On the ORBIT5K benchmark the method reports certified robust accuracy that stays high where a standard PersLay baseline degrades under adversarial perturbation.","feed_headline":"Stable ranks certify robustness from one forward pass","feed_subtitle":"On ORBIT5K, certified robust accuracy stays at 79.6% and 51.3% at radius 1, while a standard baseline collapses.","key_machinery":"The central object is the Stable Rank Network (SRN). Its first stage maps a persistence diagram $D$ to a vector $r_{p,F}(D)$ of cumulative norms of sorted lifetimes $\\ell_F(a,b)=F(b)-F(a)$, where $F$ reparameterizes the filtration scale; by the stable-rank stability inequality this map is $K$-Lipschitz from the $p$-Wasserstein distance on diagrams to the $\\ell^\\infty$ metric, with $K=1$ when $F=\\mathrm{id}$. The second stage is an MLP built from $\\ell^\\infty$-distance neurons, each 1-Lipschitz, so the full composition $f$ is $K$-Lipschitz. The Tsuzuku margin argument then turns the per-sample prediction margin $M_x$ into the certified radius $M_x/(2K)$.","core_discovery":"The paper's central claim is that composing a stable-rank vectorization of persistence diagrams with a 1-Lipschitz neural network yields a classifier whose robustness radius is known: for a test sample $x$, if $f$ is the $K$-Lipschitz logit map, then the classifier $g=\\arg\\max\\circ f$ is certified $\\epsilon$-robust for radii up to the margin-based bound $M_x/(2K)$, where $M_x$ is the difference between the correct logit and the second-largest logit. Because $K$ is controlled by design (with $F=\\mathrm{id}$ the stable-rank map is 1-Lipschitz and the MLP layers are 1-Lipschitz), the radius is computable from a single forward pass. On ORBIT5K H1 persistence diagrams, SRN reaches 79.6% accuracy and the certified robust accuracy stays at 79.6% for $\\epsilon=10^{-5}$ and 51.3% for $\\epsilon=1$, while a reimplemented PersLay under adversarial attack drops to 27.4% and 24.8%.","pith_inferences":["The stated certificate assumes $F$ is an increasing bijection of $\\mathbb{R}_{\\geq 0}$; the bounded Gaussian-mixture $F$ introduced in Appendix C.4 is not a bijection, so the proven guarantee currently covers the identity-$F$ experiments, not the learnable-$F$ variant.","A testable next step is to verify the stability inequality numerically for the learned $F$ and, if it fails, constrain $F$ to a family of increasing bijections so the certificate extends to the learned case.","The paper certifies robustness with respect to Wasserstein distance between persistence diagrams; for end users perturbing point clouds, the radius would need to be divided by the Lipschitz constant of the alpha-complex and homology map, which the paper does not compute."],"forward_implications":["With the identity reparameterization, every correctly classified ORBIT5K test sample is certified robust at radius $10^{-5}$, and over half at radius $1$, using only a forward pass.","The SRN certified accuracies are lower bounds on true robust accuracy, whereas the PersLay adversarial-attack numbers are upper bounds; the certified values remaining higher strengthens the comparison.","Because the architecture controls $K$ explicitly, the same margin argument applies unchanged to any persistence-diagram input with a Wasserstein or Bottleneck metric.","Composing the network with a PH pipeline whose data-to-diagram map is Lipschitz yields a point-cloud-level robustness guarantee with the radius scaled by that pipeline's Lipschitz constant."],"supporting_citations":[{"why":"Supplies the margin-based Lipschitz certification radius $M_x/(2K)$ that Section 3.1 applies to the SRN classifier.","marker":"Tsuzuku et al. (2018)"},{"why":"Defines stable ranks and the stability result quoted as inequality (3).","marker":"Scolamiero et al. (2017)"},{"why":"Provides the computation of stable ranks and the $\\ell^\\infty$-distance identity connecting stable ranks to Wasserstein distance.","marker":"Agerberg et al. (2023)"},{"why":"Introduces the parametrized families of reparameterizations $F$ from which SRN builds its learnable filtration scale.","marker":"Chachólski and Riihimaki (2020)"},{"why":"Gives the 1-Lipschitz $\\ell^\\infty$-distance neurons used in the MLP stage of SRN.","marker":"Zhang et al. (2021)"},{"why":"Establishes the persistence-diagram stability that motivates using persistent homology as a Lipschitz representation.","marker":"Cohen-Steiner et al. (2005)"},{"why":"Supplies Wasserstein stability results for persistence diagrams used as background for the robustness setting.","marker":"Skraba and Turner (2020)"},{"why":"Defines PersLay, the baseline whose robustness degrades in the comparison, and the ORBIT5K benchmark setup.","marker":"Carrière et al. (2020)"},{"why":"Is the adversarial attack adapted to Wasserstein space in Section 3.2 and used to test the PersLay baseline.","marker":"Carlini and Wagner (2017)"}],"fun_headline_variants":["Robustness radius computed in one forward pass","Topological features certify adversarial robustness","Stable ranks guarantee robustness without attacks","1-Lipschitz neural nets: certified robustness","Persistence diagrams unlock certified adversarial safety"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The certificate rests on knowing the exact Lipschitz constant of the whole feature map and on the stable-rank reparameterization being an increasing bijection of the nonnegative reals; the reported learnable variant uses a bounded Gaussian-mixture function, so the proven guarantee applies cleanly only to the identity-$F$ version used in the experiments.","fun_headline_variants_meta":{"raw":{"variants":["Robustness radius computed in one forward pass","Topological features certify adversarial robustness","Stable ranks guarantee robustness without attacks","1-Lipschitz neural nets: certified robustness","Persistence diagrams unlock certified adversarial safety"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000262,"raw_usage":{"total_tokens":1543,"prompt_tokens":839,"completion_tokens":704,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":455,"completion_tokens_details":{"reasoning_tokens":639}},"tokens_in":455,"tokens_out":704,"duration_ms":6961,"temperature":1.0,"reasoning_tokens":639,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T18:54:07.181179+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute $\\|r_{p,F}(D)-r_{p,F}(D')\\|_\\infty$ and $K\\,W_p(D,D')$ for many pairs of H1 diagrams using the trained Gaussian-mixture $F$; a single pair violating the stable-rank Lipschitz inequality would show the certified radius $M_x/(2K)$ is not guaranteed for that variant. For the identity-$F$ version, run a Wasserstein-space Carlini-Wagner attack and check whether any adversarial example appears at distance below $M_x/(2K)$; finding one would refute the certificate.","supporting_citations":[{"cited_title":"Persistent homology and distances A.1","cited_arxiv_id":null,"evidence_quote":"Defines stable ranks and the stability result quoted as inequality (3)."}],"review_version":1}