Certifying Robustness via Topological Representations

Andrea Guidolin; Andrea Martinelli; David Eklund; Jens Agerberg; Martina Scolamiero; Pepijn Roos Hoefgeest

REVIEW 2 major objections 3 minor 14 references

Certifying Robustness via Topological Representations

T0 review · 2 major / 3 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A classifier built from stable ranks of persistence diagrams certifies per-sample robustness radii in one forward pass.

desk verdict Sound idea, F=id experiments likely right, but central certificate has a sign error and learnable F overclaims; fix before citing. read the letter →

arxiv 2501.10876 v1 pith:HWPHSVWF submitted 2025-01-18 stat.ML cs.CGcs.LG

Jens Agerberg , Andrea Guidolin , Andrea Martinelli , Pepijn Roos Hoefgeest , David Eklund , Martina Scolamiero This is my paper · ORCID

classification stat.MLcs.CGcs.LG MSC 55N3168T07

keywords persistenthomologypersistencediagramsstableranksLipschitzneuralnetworkscertifiedrobustnessadversarialtopologicaldataanalysisORBIT5K

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces an architecture, the Stable Rank Network, that turns persistence diagrams into learned vector representations while keeping a known Lipschitz constant. If the claim holds, any classifier built this way carries a per-sample robustness certificate: from one forward pass and the prediction margin, a user knows the largest perturbation radius within which the prediction cannot change. This matters because standard ways of feeding persistence diagrams into neural networks lose the stability guarantees of topological data analysis, and exact robustness verification is generally intractable. On the ORBIT5K benchmark the method reports certified robust accuracy that stays high where a standard PersLay baseline degrades under adversarial perturbation.

What carries the argument

The central object is the Stable Rank Network (SRN). Its first stage maps a persistence diagram $D$ to a vector $r_{p,F}(D)$ of cumulative norms of sorted lifetimes $\ell_F(a,b)=F(b)-F(a)$, where $F$ reparameterizes the filtration scale; by the stable-rank stability inequality this map is $K$-Lipschitz from the $p$-Wasserstein distance on diagrams to the $\ell^\infty$ metric, with $K=1$ when $F=\mathrm{id}$. The second stage is an MLP built from $\ell^\infty$-distance neurons, each 1-Lipschitz, so the full composition $f$ is $K$-Lipschitz. The Tsuzuku margin argument then turns the per-sample prediction margin $M_x$ into the certified radius $M_x/(2K)$.

What would settle it

Compute $\|r_{p,F}(D)-r_{p,F}(D')\|_\infty$ and $K\,W_p(D,D')$ for many pairs of H1 diagrams using the trained Gaussian-mixture $F$; a single pair violating the stable-rank Lipschitz inequality would show the certified radius $M_x/(2K)$ is not guaranteed for that variant. For the identity-$F$ version, run a Wasserstein-space Carlini-Wagner attack and check whether any adversarial example appears at distance below $M_x/(2K)$; finding one would refute the certificate.

Watch

Extended reading notes

Core claim

The paper's central claim is that composing a stable-rank vectorization of persistence diagrams with a 1-Lipschitz neural network yields a classifier whose robustness radius is known: for a test sample $x$, if $f$ is the $K$-Lipschitz logit map, then the classifier $g=\arg\max\circ f$ is certified $\epsilon$-robust for radii up to the margin-based bound $M_x/(2K)$, where $M_x$ is the difference between the correct logit and the second-largest logit. Because $K$ is controlled by design (with $F=\mathrm{id}$ the stable-rank map is 1-Lipschitz and the MLP layers are 1-Lipschitz), the radius is computable from a single forward pass. On ORBIT5K H1 persistence diagrams, SRN reaches 79.6% accuracy and the certified robust accuracy stays at 79.6% for $\epsilon=10^{-5}$ and 51.3% for $\epsilon=1$, while a reimplemented PersLay under adversarial attack drops to 27.4% and 24.8%.

Load-bearing premise

The certificate rests on knowing the exact Lipschitz constant of the whole feature map and on the stable-rank reparameterization being an increasing bijection of the nonnegative reals; the reported learnable variant uses a bounded Gaussian-mixture function, so the proven guarantee applies cleanly only to the identity-$F$ version used in the experiments.

Editorial extensions

If this is right

With the identity reparameterization, every correctly classified ORBIT5K test sample is certified robust at radius $10^{-5}$, and over half at radius $1$, using only a forward pass.
The SRN certified accuracies are lower bounds on true robust accuracy, whereas the PersLay adversarial-attack numbers are upper bounds; the certified values remaining higher strengthens the comparison.
Because the architecture controls $K$ explicitly, the same margin argument applies unchanged to any persistence-diagram input with a Wasserstein or Bottleneck metric.
Composing the network with a PH pipeline whose data-to-diagram map is Lipschitz yields a point-cloud-level robustness guarantee with the radius scaled by that pipeline's Lipschitz constant.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The stated certificate assumes $F$ is an increasing bijection of $\mathbb{R}_{\geq 0}$; the bounded Gaussian-mixture $F$ introduced in Appendix C.4 is not a bijection, so the proven guarantee currently covers the identity-$F$ experiments, not the learnable-$F$ variant.
A testable next step is to verify the stability inequality numerically for the learned $F$ and, if it fails, constrain $F$ to a family of increasing bijections so the certificate extends to the learned case.
The paper certifies robustness with respect to Wasserstein distance between persistence diagrams; for end users perturbing point clouds, the radius would need to be divided by the Lipschitz constant of the alpha-complex and homology map, which the paper does not compute.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: the SRN idea is sound and worth knowing about, but the paper as written has a sign error in its central certificate, and the learnable reparameterization isn't covered by the stated stability theorem. Fix those and this is a clean little contribution; don't cite the current version for the certificate.

What's actually new: composing stable-rank vectorizations with 1-Lipschitz L∞-dist networks to get a certified Lipschitz constant for a persistence-diagram classifier, then applying the standard margin bound. That's a natural but useful combination, and Table 1's comparison against a reimplemented PersLay is the right kind of evidence. The stable-rank chain is solid when F=id: rp,id is 1-Lipschitz with respect to Wp, the MLP is 1-Lipschitz in L∞, so the composition is 1-Lipschitz and the Tsuzuku bound applies. The authors also correctly describe their certified numbers as lower bounds and the attack-based PersLay numbers as upper bounds, which is the honest framing.

Soft spots, in order of severity. First, Section 3.1 states 'g is ε-robust for all ε ≥ Mx/2K'. That is the wrong direction; the Tsuzuku-type bound certifies ε ≤ Mx/2K. As printed, the certificate is invalid—it would claim robustness at arbitrarily large radii, which a non-constant classifier cannot have. Table 1's numbers depend on the corrected inequality, so this has to be fixed before the results can be trusted. I assume it's a typo, but it's load-bearing.

Second, Appendix B insists F is an increasing bijection of R≥0, but the learnable F in C.4 is an integral of a Gaussian mixture, which is bounded and so not surjective. The stability inequality quoted from prior work may or may not need surjectivity; as written, the learnable variant isn't covered. Table 1 uses F=id, so the main experiments are unaffected, but the method section overclaims.

Third, the reproducibility is thin: no code, no hyperparameters for the attack (λ, PGD steps, number of added points), no details on the stable-rank vector dimension or padding. For a workshop abstract that's tolerable; for a full paper it wouldn't be.

Verdict: the central argument holds up for F=id once the inequality direction is corrected. The paper deserves refereeing—the idea is timely for TDA+robustness—but the current version shouldn't be accepted without the typo fixed and the bijectivity gap addressed.

Referee Report

2 major / 3 minor

Summary. The paper proposes the Stable Rank Network (SRN), which composes a stable-rank vectorization of persistence diagrams with a Lipschitz MLP, and claims that the known Lipschitz constant of the composition can be used to certify adversarial robustness in the space of persistence diagrams under Wasserstein/Bottleneck metrics. The method is evaluated on ORBIT5K, where SRN reports a certified robust accuracy of 79.6% at epsilon=10^-5 and 51.3% at epsilon=1, compared with a reimplemented PersLay baseline whose robust accuracy under attack drops to about 25% at the same radii. The main theoretical ingredients are the stability inequality for stable ranks (Eq. 3), a Lipschitz bound for reparameterizations F (Proposition 1), and a margin-based certificate following Tsuzuku et al. (2018).

Significance. The idea of importing certified robustness into persistence-diagram classification is timely, and the use of stable ranks gives the pipeline a parameter-free 1-Lipschitz constant when F=id. The comparison between a certified lower bound (SRN) and an attack-based upper bound (PersLay) is a sensible experimental design. However, the paper's central certificate contains a reversed inequality, and the learnable reparameterization used in Appendix C.4 does not satisfy the bijectivity assumption under which the stability result is stated. These issues are load-bearing, so the contribution is only conditionally established.

major comments (2)

[Section 3.1] The statement that g is epsilon-robust at x for all epsilon >= Mx/(2K) is the reverse of the standard Lipschitz-margin bound. For a K-Lipschitz f, every x' with d(x,x') <= epsilon has f_c(x') >= f_c(x) - K*epsilon and f_i(x') <= f_i(x) + K*epsilon for i != c, so the margin at x' is at least Mx - 2*K*epsilon; the prediction is preserved when epsilon <= Mx/(2K) (strictly, epsilon < Mx/(2K), depending on tie conventions). As written, the certificate claims robustness for arbitrarily large radii, which is impossible for a nonconstant classifier. Table 1's certified robust accuracies depend on this inequality, so the numerical certification results are unsupported until the inequality is corrected and the numbers are recomputed with the correct direction.
[Appendix B and Appendix C.4] Appendix B defines a reparameterization F as an increasing bijection R>=0 -> R>=0, and Equation (3) and Corollary 2 are stated for such F. The learnable F in Appendix C.4, F(t) = integral_0^t f dlambda with f a Gaussian mixture, is strictly increasing but bounded (its supremum is the integral of f over R>=0), hence it is not surjective onto R>=0 and is not an increasing bijection. The paper therefore does not provide a stability or Lipschitz guarantee for the learnable-F variant. Since Section 3.1's certificate is formulated for the SRN architecture generally, the authors must either prove the stability inequality for bounded increasing F or explicitly restrict the certified claim to bijective F, with the learnable F presented only as a heuristic. The identity-F case used in Table 1 is covered, but only after the inequality in Major Comment 1 is fixed.

minor comments (3)

[Section 1] The third contribution bullet says the method 'provides certified robustness for the SRN architecture'; given Major Comments 1 and 2, this should be qualified to the identity-F variant and with the corrected inequality.
[Appendix B, Eq. (3)] The displayed inequality in Eq. (3) has no factor K and is followed by Proposition 1, which introduces K; this is mathematically correct, but the presentation would be clearer if the final K-Lipschitz statement were displayed as a numbered corollary so that readers do not mistake Eq. (3) for the sharp constant.
[Table 1] The certified numbers should state whether the margin condition is evaluated with strict or non-strict inequality at the boundary epsilon = Mx/(2K), since tie-breaking at the decision boundary can affect the reported percentages.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the certificate is an independent Tsuzuku-type bound applied to an established stable-rank stability result; the self-citations are mathematical theorems, and the main gaps are correctness issues, not circularity.

full rationale

The robustness certificate in Section 3.1 is not circular. It takes the external Lipschitz-margin bound of Tsuzuku et al. (2018) and applies it to a K-Lipschitz logit map f; the certified radius is computed from the test-time margin Mx and the known constant K, not from any fitted quantity. The stable-rank stability inequality (Eq. 3) is cited from prior work by overlapping authors (Scolamiero et al., 2017; Agerberg et al., 2023), but these are mathematical theorems with stated assumptions (persistence diagrams with no points at infinity, F an increasing bijection) that do not include the robustness claim; the present paper's contribution is the composition with a Lipschitz MLP and the ORBIT5K evaluation. No prediction is equivalent to an input by construction, no fitted parameter is renamed as a certified quantity, and no uniqueness or ansatz is smuggled in via self-citation. There are two non-circular defects that a reader should weigh separately: (i) the displayed inequality epsilon >= Mx/(2K) in Section 3.1 has the direction reversed relative to the Tsuzuku-type bound, so as printed the certificate is invalid; and (ii) the learnable F(t)=int_0^t f dL with Gaussian mixture f is bounded and hence not an increasing bijection of R>=0, so the stability theorem's assumptions are not satisfied for the learnable variant, leaving only the identity-F experiments supported. Neither defect is a circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The central certificate rests on cited stability theorems and design choices; no invented entities or fitted physical constants appear. The main unproved input is the stable-rank Wasserstein stability from the authors' own prior work, plus the margin-Lipschitz certification theorem.

free parameters (4)

Lipschitz MLP trained weights
Weights and biases of the 5-layer (1200,700,300,80,5) network are fit to ORBIT5K; they determine the margins M_x that size certified radii, although the Lipschitz constant K=1 is architecture-fixed.
Perslay attack hyperparameters (λ, PGD steps, added points)
Not reported; the Perslay robust-accuracy upper bounds in Table 1 depend on attack strength, so the comparison is under-specified.
Stable rank vector dimension and padding
The network needs fixed-dimension inputs but the paper does not state the maximum rank d or the padding/truncation rule used for variable-cardinality H1 diagrams.
Gaussian mixture F parameters (means, weights, stds)
Proposed as a learnable reparameterization but not used in reported experiments; as specified it is not a bijection of R≥0.

assumptions (5)

standard math Stable ranks satisfy ∥r_{p,F}(D)-r_{p,F}(D')∥∞ ≤ W_p(F(D),F(D')) (Eq. 3)
Quoted from Agerberg et al. (2023, Sect. 5) and Scolamiero et al. (2017, Prop. 9.3); this inequality is load-bearing for the certificate.
standard math Tsuzuku et al. (2018) margin bound: a K-Lipschitz classifier is robust for radii below M_x/(2K)
Used in Section 3.1 to convert the Lipschitz constant into certified robustness.
standard math Layers using L∞-dist neurons are 1-Lipschitz with respect to L∞, and centering preserves this
From Zhang et al. (2021); guarantees the MLP does not inflate the Lipschitz constant.
domain assumption F : R≥0 → R≥0 is an increasing bijection
Required by the definition of stable ranks in Appendix B; the Gaussian mixture F in C.4 does not satisfy bijectivity, so this assumption is violated by the proposed learnable variant.
domain assumption Persistence diagrams are finite and have no points at infinity
Assumed in Appendix A and B; true for alpha-complex H_q with q>0 on finite point clouds.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Certifying Robustness via Topological Representations." pith.science (2026). https://pith.science/paper/HWPHSVWF

@misc{pith2026250110876,
  author       = {Pith},
  title        = {Pith review of: Certifying Robustness via Topological Representations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HWPHSVWF}},
  note         = {Machine review of arXiv:2501.10876}
}

abstract

We propose a neural network architecture that can learn discriminative geometric representations of data from persistence diagrams, common descriptors of Topological Data Analysis. The learned representations enjoy Lipschitz stability with a controllable Lipschitz constant. In adversarial learning, this stability can be used to certify $\epsilon$-robustness for samples in a dataset, which we demonstrate on the ORBIT5K dataset representing the orbits of a discrete dynamical system.

Figures

Figures reproduced from arXiv: 2501.10876 by the authors.

**Figure 2.** A Persistent Homology Machine Learning pipeline using Stable Rank Network. [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗

**Figure 3.** Distribution of certified ϵ-robustness for correctly classified samples of the test set, for the different classes [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

14 extracted references · 10 canonical work pages

[1]

The Alpha complex Aα at a scale parameter α is constructed by first considering the union of balls centered at the points in P with radius α

The Alpha complex filtration is a method to generate a filtered simplicial complex, starting from a point cloud P in Rd. The Alpha complex Aα at a scale parameter α is constructed by first considering the union of balls centered at the points in P with radius α. The simplices in Aα correspond to the simplices in the Delaunay triangulation of P that are en...

work page 2020
[7]

Persistence weighted gaussian kernel for topological data analysis

Genki Kusano, Yasuaki Hiraoka, and Kenji Fukumizu. Persistence weighted gaussian kernel for topological data analysis. In International conference on machine learning , pages 2004–2013. PMLR,

work page 2004
[8]

URL https://doi

doi: 10.1038/ncomms15396. URL https://doi. org/10.1038/ncomms15396. Linyi Li, Tao Xie, and Bo Li. Sok: Certified robustness for deep neural networks. In 2023 IEEE symposium on security and privacy (SP) , pages 1289–1310. IEEE,

doi:10.1038/ncomms15396 2023
[9]

Wasserstein stability for persistence diagrams

Primoz Skraba and Katharine Turner. Wasserstein stability for persistence diagrams. arXiv preprint arXiv:2006.16824,

arXiv 2006
[11]

By construction (see (Agerberg et al., 2023, Sect

We remark that, thanks to the assumption that the persistence diagram D has no points at infinity, all tj and all ri are real numbers. By construction (see (Agerberg et al., 2023, Sect. 5)), the entries ofrp,F (D) satisfy ri = min{t ∈ R≥0 | drankp,F (D) ≤ i}, for all i ∈ {0, . . . , m}. Computing distances between stable ranks Since m = rank( D) depends o...

work page 2020
[13]

In order to test the robustness of Perslay in PyTorch we reimplement it with the following DeepSet (Zaheer et al.,

and Persistence Fisher Kernel (Le and Yamada, 2018). In order to test the robustness of Perslay in PyTorch we reimplement it with the following DeepSet (Zaheer et al.,

work page 2018
[14]

(2020): each point in the persistence diagram is upsampled from 2 dimensions to 25 13 Agerberg Guidolin Martinelli Hoefgeest Eklund Scolamiero through 2 layers

architecture, similar to the architecture described in Carri` ere et al. (2020): each point in the persistence diagram is upsampled from 2 dimensions to 25 13 Agerberg Guidolin Martinelli Hoefgeest Eklund Scolamiero through 2 layers. The point embeddings are further aggregated with a top 5 aggregation for each dimension, which is composed with a final lin...

work page 2020
[1995]

Reluplex: An efficient smt solver for verifying deep neural networks

Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. In Computer Aided Verifica- tion: 29th International Conference, CA V 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part I 30, pages 97–117. Springer,

work page 2017

Show all 14 references

[2014]

ISBN 9781450325943

Association for Computing Machinery. ISBN 9781450325943. doi: 10.1145/2582112.2582128. URL https://doi.org/10.1145/ 2582112.2582128. David Cohen-Steiner, Herbert Edelsbrunner, and John Harer. Stability of persistence dia- grams. In Proceedings of the twenty-first annual sympos...
[2015]

Nicholas Carlini and David Wagner

ISSN 1532-4435. Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp) , pages 39–57. Ieee,

2017
[2017]

Algebraic wasserstein distances and stable homological invariants of data

Jens Agerberg, Andrea Guidolin, Isaac Ren, and Martina Scolamiero. Algebraic wasserstein distances and stable homological invariants of data. arXiv preprint arXiv:2301.06484 ,

arXiv
[2021]

Persistent homology and distances A.1

7 Agerberg Guidolin Martinelli Hoefgeest Eklund Scolamiero Appendix A. Persistent homology and distances A.1. Persistence diagrams Consider the subset U := {(a, b) ∈ R≥0 × [0, ∞] | a ≤ b} of the extended plane. A persistence diagram D is a multiset of elements of U , which in ...

2017
[2022]

Topological data analysis for arrhythmia detection through modular neural networks

Meryll Dindin, Yuhei Umeda, and Frederic Chazal. Topological data analysis for arrhythmia detection through modular neural networks. In Advances in Artificial Intelligence: 33rd Canadian Conference on Artificial Intelligence, Canadian AI 2020, Ottawa, ON, Canada, May 13–15, 20...

2020
[2023]

doi: 10.1109/tpami.2023.3308391

ISSN 1939-3539. doi: 10.1109/tpami.2023.3308391. URL http://dx. doi.org/10.1109/TPAMI.2023.3308391. Peter Bubenik. Statistical topological data analysis using persistence landscapes. J. Mach. Learn. Res., 16(1):77–102, jan

1939

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.

[1] [1]

The Alpha complex Aα at a scale parameter α is constructed by first considering the union of balls centered at the points in P with radius α

The Alpha complex filtration is a method to generate a filtered simplicial complex, starting from a point cloud P in Rd. The Alpha complex Aα at a scale parameter α is constructed by first considering the union of balls centered at the points in P with radius α. The simplices in Aα correspond to the simplices in the Delaunay triangulation of P that are en...

work page 2020

[2] [7]

Persistence weighted gaussian kernel for topological data analysis

Genki Kusano, Yasuaki Hiraoka, and Kenji Fukumizu. Persistence weighted gaussian kernel for topological data analysis. In International conference on machine learning , pages 2004–2013. PMLR,

work page 2004

[3] [8]

URL https://doi

doi: 10.1038/ncomms15396. URL https://doi. org/10.1038/ncomms15396. Linyi Li, Tao Xie, and Bo Li. Sok: Certified robustness for deep neural networks. In 2023 IEEE symposium on security and privacy (SP) , pages 1289–1310. IEEE,

doi:10.1038/ncomms15396 2023

[4] [9]

Wasserstein stability for persistence diagrams

Primoz Skraba and Katharine Turner. Wasserstein stability for persistence diagrams. arXiv preprint arXiv:2006.16824,

arXiv 2006

[5] [11]

By construction (see (Agerberg et al., 2023, Sect

We remark that, thanks to the assumption that the persistence diagram D has no points at infinity, all tj and all ri are real numbers. By construction (see (Agerberg et al., 2023, Sect. 5)), the entries ofrp,F (D) satisfy ri = min{t ∈ R≥0 | drankp,F (D) ≤ i}, for all i ∈ {0, . . . , m}. Computing distances between stable ranks Since m = rank( D) depends o...

work page 2020

[6] [13]

In order to test the robustness of Perslay in PyTorch we reimplement it with the following DeepSet (Zaheer et al.,

and Persistence Fisher Kernel (Le and Yamada, 2018). In order to test the robustness of Perslay in PyTorch we reimplement it with the following DeepSet (Zaheer et al.,

work page 2018

[7] [14]

(2020): each point in the persistence diagram is upsampled from 2 dimensions to 25 13 Agerberg Guidolin Martinelli Hoefgeest Eklund Scolamiero through 2 layers

architecture, similar to the architecture described in Carri` ere et al. (2020): each point in the persistence diagram is upsampled from 2 dimensions to 25 13 Agerberg Guidolin Martinelli Hoefgeest Eklund Scolamiero through 2 layers. The point embeddings are further aggregated with a top 5 aggregation for each dimension, which is composed with a final lin...

work page 2020

[8] [1995]

Reluplex: An efficient smt solver for verifying deep neural networks

Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. In Computer Aided Verifica- tion: 29th International Conference, CA V 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part I 30, pages 97–117. Springer,

work page 2017