# Probabilistic Safety Regions Via Finite Families of Scalable Classifiers

Alberto Carlevaro, , Teodoro Alamo, , Fabrizio Dabbene, and Maurizio Mongelli,
A.C., F.D., and M.M. are with Cnr-Istituto di Elettronica e di Ingegneria
dell’Informazione e delle Telecomunicazioni, 00185 Rome, Italy. A.C. is with
University of Genoa, Department of Electrical, Electronics and
Telecommunications Engineering and Naval Architecture (DITEN), 16145 Genoa,
Italy. Teodoro Alamo is with the Departamento de Ingeniería de Sistemas y
Automática, Universidad de Sevilla, Escuela Superior de Ingenieros, 41020
Sevilla, Spain. Corresponding author: Alberto Carlevaro,
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>work has been submitted to the IEEE for
possible publication. Copyright may be transferred without notice, after which
this version may no longer be accessible.

###### Abstract

Supervised classification recognizes patterns in the data to separate classes
of behaviours. Canonical solutions contain misclassification errors that are
intrinsic to the numerical approximating nature of machine learning. The data
analyst may minimize the classification error on a class at the expense of
increasing the error of the other classes. The error control of such a design
phase is often done in a heuristic manner. In this context, it is key to
develop theoretical foundations capable of providing probabilistic
certifications to the obtained classifiers. In this perspective, we introduce
the concept of probabilistic safety region to describe a subset of the input
space in which the number of misclassified instances is probabilistically
controlled. The notion of scalable classifiers is then exploited to link the
tuning of machine learning with error control. Several tests corroborate the
approach. They are provided through synthetic data in order to highlight all
the steps involved, as well as through a smart mobility application.

###### Index Terms:

Misclassification error control, probabilistic safety regions, scalable
classifiers, statistical learning

##  I Introduction and Problem Formulation

Safety-critical assessment of machine learning (ML) is currently one of the
main issues in trustworthy artificial intelligence [1, 2]. The scope is to
understand under which conditions autonomous operation may lead to hazards, in
order to reduce to the minimum the risk of operating with detrimental effects
to the human or the environment. Such an assessment is mandatory in several
application domains, such as avionics [3], finance[4], healthcare[5], smart
mobility [6], cybersecurity[7] as well as with autonomous systems [1, 8, 2].
Informally speaking, the safety assurance of ML consists of building
guardrails around the autonomous decision in front of uncertainty [9]. This
can be achieved with a combination of rigorous verification [10], design
validation [11] or standardized safety
analysis111https://standards.ieee.org/practices/mobility/standards/.. However,
those approaches look at ML from the outside, by analyzing risks at system
level. Intrinsically in ML, on the other hand, there is the possibility to
link the search of classification boundaries with error control. More
specifically, the error control may be built around the class of behavior it
is desired to protect, e.g., collision avoidance, disease status, cyber attack
in progress. This may change the theoretical approach to algorithm design
considerably. In this respect, the guardrails are built here on the basis of
order statistics [12], by incorporating them as probabilistic constraints of
the model. The notion of probabilistic safety region is firstly outlined. The
region defines the subset of data samples under which the error is
constrained. Second, a specific class of classifiers, named scalable
classifiers is introduced as a valuable tool to construct probabilistic safety
regions. In particular, the optimal shape of the region may be obtained by
setting the value of the parameters within the set of possible scalable
classifiers.

Namely, scalable classifiers share the property of having a scaling parameter
that can be adjusted to control both the classification boundary and the
inherent error. Suitable classifiers are in this respect, for instance,
support vector machines, support vector data description, logistic regression;
but the class is very rich and several different and new scalable classifiers
may be devised. Probabilistic scaling [13] drives the validation of parameters
setting. Based on this scaling procedure, the proposed design methodology is
capable of probabilistically guaranteeing a given error level valid for the
largest possible region.

###  I-A Contribution

More specifically, the contribution of this research is twofold. First, the
family of Scalable Classifiers (SCs) is studied as a new group of classifiers
that share the property of being scalable, that is, of being controllable by a
single scalar parameter (Section II-A). Then, the definition of Probabilistic
Safety Region (PSR) models the idea of giving probabilistic guarantees on the
prediction of a classification (but in general also a regression) problem
(Section II-B). The link between these two concepts is provided by probalistic
scaling, a state-of-the-art technique for providing probabilistic bounds based
on the field of order statistics [14]. Moreover, we take into account the
variability of the classifier due to the hyperparameter selection. It is known
that the choice of the hyperparameters can affect dramatically the result in
the prediction of the model. Usually, their optimal setting is a hard task. To
cope with this problem, we apply our probabilistic safety framework to
classifiers obtained by finite families of hyperparameters, selecting among
this set of confident classifiers the one which optimizes a certain
statistical index, for example minimizing the false positive rate of the
classification (Section III).
The result is a totally new framework in statistical learning that shares the
requirements of AI trustworthiness, i.e., it is reliable, safe and robust.

###  I-B Related works

The concept of robust Machine Learning has several subtle meanings. Initially,
overfitting was the main issue involved in robustness [15]. More recently,
robustness passes through the capacity of the model to counter adversarial
attacks [16], to handle data-privacy problems [17], to have good
generalisation properties [18], and many other theoretical and practical
challenges [19] facing the scientific community. Today, robustness is
inseparable from safety, and the reason for this is entirely agreeable:
algorithms that cannot handle data fluctuations or fail to provide sufficient
levels of reliability can lead to risky situations for users. Safety and
robustness are, therefore, fundamental requirements that cannot be separated.
In relation with the concept of safety [20], the idea of Safety Region (SR)
[21] deals with the identification of the regions of the input space that lead
to predictions with the same guaranteed level of confidence. Currently, there
are different methodologies addressing this topic: Conformal Prediction (CP)
[22], which deals with the discovery of the confidence interval of each
prediction, thus giving a clear indication of the quality of the prediction.
Error Quantification [23] provides a methodology to quantify uncertainty with
probabilistic maximization. Bayesian learning contexts [24], which provide
probabilistic guarantees by exploiting the degree of belief about the output.
Selective Classification, [25] in which the model can abstain from making a
prediction and the goal is to minimize incorrect predictions while also
minimizing abstentions. Covariate shift [26], where the goal is to learn a
classifier based on samples from training and test that have different
marginal distributions but share the same conditional labelling functions for
all points. CP is one of the most recognised methods for confidence
calculation. In order to meet the probabilistic guarantees, CP might assign
more than a single class to a given point of the input space. The method
proposed here is inspired on the procedure used in the computation of the
confidence level sets of the SR.

Reformulation of classifiers to make them more robust or reliable is well
established and defined. For example, the support vector machine (SVM) model
(which we will show to be a scalable classifier) has been extensively studied
(see [27, 28, 29, 30, 31]).

Recent approaches deal with finding regions with fixed false negative or
positive rates, by means of sensitivity analysis of SVDD in [32], and of
Boolean rules in [33], but they disregard the confidence interval of the
resulting regions.

Understanding the concept of confidence more broadly, the following approaches
can also be considered. Out of distribution detection [34], where statistical
tests are performed to assess if predictions are performed in conditions
different from what was learned from the training stage. Counterfactual
eXplanation [35, 36], which finds the minimum feature variation in order to
change the predicted class.

In summary, the control of the confidence of the model [37] is the goal we
pursue in this paper. The proposed methodology is suitable to address the
potential variations in the underlying probability distribution of the data.

The introduction of the scalable family of classifiers makes it possible to
approximate the PSR while maintaining the same level of confidence. Together
with probabilistic scaling, scalable classifiers provide a new framework for
compliant machine learning. What is new about this approach is that
probabilistic assurance is provided in the design phase of the classifier,
along with the calibration of the model. This is a key point because in the
state of the art all methods that address the problem of providing
probabilistic guarantees in prediction are based on a posteriori approaches.

###  I-C Notation and order statistics concepts

Given an integer $n$, $[n]$ denotes the integers from 1 to $n$. Given
$x\in\mathbbm{R}$, $\lfloor x\rfloor$ denotes the greatest integer no larger
than $x$ and $\lceil x\rceil$ the smallest integer no smaller than $x$. The
set of non-negative reals is denoted $\mathbbm{R}_{+}$. Given integers $k,n$,
and parameter $\varepsilon\in(0,1)$, the Binomial cumulative distribution
function is denoted as

${\mathbf{B}}(k;n,\varepsilon)\doteq\sum\limits_{i=0}^{k}\binom{n}{i}\varepsilon^{i}(1-\varepsilon)^{n-i}.$

${\rm{Pr}}\\{A\\}$ denotes the probability of the event $A$.

The following definition is borrowed from the field of order statistics [14,
23].

######  Definition (Generalized Max).

Given a collection of $n$ scalars
$\Gamma=\\{\gamma_{i}\\}_{i=1}^{n}\in\mathbbm{R}^{n}$, and an integer
$r\in[n]$, we denote by

$\mathrm{\max}^{(r)}(\Gamma)$

the $r$-smallest value of $\Gamma$, so that there are no more than $r-1$
elements of $\Gamma$ strictly larger than $\mathrm{\max}^{(r)}(\Gamma)$.

We will often refer to $r$ as a discarding parameter, since the generalized
max can be interpreted as a classical maximum after the largest $r-1$ points
are discarded. Indeed, to construct $\mathrm{\max}^{(r)}(\Gamma)$ it is
sufficient to order the elements of $\Gamma$ as
$\\{\gamma_{(1)},\gamma_{(2)},\ldots,\gamma_{(n)}\\}$ so that

$\gamma_{(1)}\geq\gamma_{(2)}\geq\cdots\geq\gamma_{(n)}.$

Then, we let $\mathrm{\max}^{(r)}(\Gamma)\doteq\gamma_{(r)}$.

The following result, see Property 3 in [14], states how to obtain a
probabilistic upper bound of a random scalar variable by means of the notion
of generalized max. This result has been used in the context of uncertainty
quantification [23] and chance-constrained optimization [38, 13], and plays a
key role in our successive developments.

######  Property 1 (Scaling factor [14]).

Given probabilistic parameters $\varepsilon\in(0,1)$, $\delta\in(0,1)$ and a
discarding parameter $r\geq 1$, let $n\geq r$ be chosen such that

${\mathbf{B}}(r-1;n,\varepsilon)\leq\delta.$ (1)

Suppose that $\gamma\in\mathbbm{R}$ is a random scalar variable with
probability distribution $\mathcal{W}$. Draw $n$ i.i.d. samples
$\\{\gamma_{i}\\}_{i=1}^{n}$ from distribution $\mathcal{W}$. Then, with a
probability no smaller than $1-\delta$,

${\rm{Pr}}_{\mathcal{W}}\left\\{\gamma>\mathrm{\max}^{(r)}(\\{\gamma_{i}\\}_{i=1}^{n})\right\\}\leq\varepsilon.$

In words, this results shows that, if the number of points is chosen large
enough, the generalized max constitutes with very high probability a good
approximation of the true maximum, in the sense that the probability of
obtaining a larger value may be bounded a-priori.

The following corollary, proved in this form in [13], provides a way to
explicitly bound the number of samples $n$ (i.e. the so-called sample
complexity), by “fixing” the discarding parameter $r$ to be a percentage of
the total number of samples, i.e. letting $r=\beta\varepsilon n$.

######  Corollary I.1 (Explicit bound [13]).

Let $r=\left\lceil\beta\varepsilon n\right\rceil$, where $\beta\in(0,1)$, and
define the quantity

$\kappa\doteq\left(\frac{\sqrt{\beta}+\sqrt{2-\beta}}{\sqrt{2}(1-\beta)}\right)^{2}.$

Then, inequality (1) is satisfied for

$n\geq\frac{\kappa}{\varepsilon}\ln\frac{1}{\delta}.$ (2)

Specifically, the choice $\beta=0.5$ leads to
$r=\displaystyle\left\lceil\frac{\varepsilon n}{2}\right\rceil$ and
$\displaystyle n\geq\frac{7.47}{\varepsilon}\ln\frac{1}{\delta}$.

##  II Scalable Classifiers and Safe Sets

Classification algorithms assign to a given input vector
$\boldsymbol{x}\in\mathcal{X}$ a single label $y\in\mathcal{Y}$ based on
certain patterns in the data. We here consider the case of binary
classification, with classes $y\in\\{+1,-1\\}$. Note that this choice of
labels is without loss of generality, since any binary classifier can be
converted to these labels. In our context, we assume that the label $+1$
denotes the target class $\mathrm{S}$, which is to be interpreted as “safe”
configurations. The label $-1$ refers instead to the non-target class
$\mathrm{U}$ (i.e. unsafe configuration). We write
$\boldsymbol{x}{\,\hat{=}\,}\mathrm{S}$ to denote the fact that the vector
$\boldsymbol{x}$ is safe, i.e. it has “true” label $+1$. Similarly,
$\boldsymbol{x}{\,\hat{=}\,}\mathrm{U}$ denotes that $\boldsymbol{x}$ is
unsafe.

The main goal of our approach is to design, based on observations, a safety
region, i.e. a region $\mathcal{S}$ of the feature space $\mathcal{X}$ for
which we have a guarantee that the probability of being unsafe is not larger
than a given risk level $\varepsilon\in(0,1)$. More formally, we consider a
probabilistic framework, and assume that the observations come from a fixed
probability distribution. Then, for a given risk level $\varepsilon\in(0,1)$,
we are interested in constructing a Probabilistic Safety Region (PSR), denoted
by $\mathcal{S}_{\varepsilon}$, satisfying

${\rm{Pr}}\Bigl{\\{}\boldsymbol{x}{\,\hat{=}\,}\mathrm{U}\text{ and
}\boldsymbol{x}\in\mathcal{S}_{\varepsilon}\Bigr{\\}}\leq\varepsilon.$ (3)

In words, a PSR region $\mathcal{S}_{\varepsilon}\subseteq\mathcal{X}$
represents a set such that the probability of observing the event
$\boldsymbol{x}{\,\hat{=}\,}\mathrm{U}$ conditioned to the event
$\boldsymbol{x}\in\mathcal{S}_{\varepsilon}$ is lower or equal than
$\varepsilon$.

This paper provides a general approach to constructing such sets while
maximizing a given performance index (e.g., size). We rely on a two-level of
probability framework in which the final provided set is a probabilistic
safety region with a (prescribed) level of probability. To generate such
probabilistic safety regions, we introduce a special (but rather general)
class of classifiers, that we refer to as scalable classifiers (SCs). Namely,
SCs are classifiers whose formulation can be made to explicitly depend on a
scaling parameter $\rho\in\mathbbm{R}$. The parameter $\rho$ allows to
dynamically adjust the boundary of the classification: changing $\rho$ causes
the classifier to widen, shrink, or change shape completely. With some abuse
of notation, we can think of the different values of $\rho$ as different
“level sets” of the classification function.

###  II-A Scalable Classifiers

Formally, we consider binary classifiers which can be formulated as follows

$\phi_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)\doteq\begin{cases}+1\quad\quad\text{if
}\,f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)<0,\\\
-1\quad\quad\text{otherwise.}\end{cases}$ (4)

where the function
$f_{\boldsymbol{\theta}}:\mathcal{X}\times\mathbbm{R}\longrightarrow\mathbbm{R}$
is the so-called classifier predictor. Note that, in the above notation, we
highlight the fact that $f_{\boldsymbol{\theta}}$ may depend also on a second
set of parameters
${\boldsymbol{\theta}}\subset\mathbbm{R}^{n_{{\boldsymbol{\theta}}}}$. The
vector
${\boldsymbol{\theta}}=[{\boldsymbol{\theta}}_{1},\cdots,{\boldsymbol{\theta}}_{n_{{\boldsymbol{\theta}}}}]^{\top}$
collects the so-called classifier hyperparameters, that is all those
parameters to be adjusted in the model (e.g. different choices of kernel,
regularization parameters, etc.). Obviously, a different choice of
${\boldsymbol{\theta}}$ corresponds to a possibly very different classifier.
The role of different choices of ${\boldsymbol{\theta}}$ in the construction
of the classifier is extremely important, and will be discussed in Section
III.

Note that $\phi_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)$ may be
interpreted as the “tentative” (or predicted) label associated to the point
$\boldsymbol{x}$ by the classifier. In the sequel, with some slight abuse of
notation, we will sometimes refer to $f_{{\boldsymbol{\theta}}}$ as the
classifier itself.

As we will see in the following derivations, the scaling parameter $\rho$
plays a key role for this particular family of classifiers. Specifically, in
order to define a SC, we require that the $\rho$-parametrized classifier
$\phi_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)$ satisfies some special
“ordering” condition, as defined next.

######  Assumption 1 (Scalable Classifier).

We assume that for every $\boldsymbol{x}\in\mathcal{X}$,
$f_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)$ is a continuous and
monotonically increasing function on $\rho$, i.e.

$\rho_{1}>\rho_{2}\;\Rightarrow
f_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho_{1})>f_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho_{2}),\quad\forall\boldsymbol{x}\in\mathcal{X}.$
(5)

We assume also that

$\lim\limits_{\rho\to-\infty}f_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)<0<\lim\limits_{\rho\to\infty}f_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho),\quad\forall\boldsymbol{x}\in\mathcal{X}.$
(6)

######  Property 2 (Boundary radius).

Suppose that Assumption 1 holds. Then, for each
$\boldsymbol{x}\in\mathcal{X}$, there exists a unique
$\bar{\rho}(\boldsymbol{x})$ satisfying
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\bar{\rho}(\boldsymbol{x}))=0$.
Moreover, the classifier $\phi_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)$
given by (4) satisfies

$\phi_{\theta}(\boldsymbol{x},\rho)=-1\Leftrightarrow\rho\geq\bar{\rho}(\boldsymbol{x}).$

The proof of Property 2 is available in Appendix -A. In this paper, and under
Assumption 1, we denote $\bar{\rho}(\boldsymbol{x})$ the unique solution (see
Property 2) to the equation

$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=0.$

In words, a scalable classifier is a classifier for which, given
$\boldsymbol{x}$, there is always a value of $\rho$, denoted
$\bar{\rho}(\boldsymbol{x})$, that establishes the border between the two
classes. Therefore, a SC is a classifier that maintains the target class of a
given feature vector $\boldsymbol{x}$ under a decrease of $\rho$ We also
remark that this definition is implied by condition (5). Indeed, for a given
$\tilde{\boldsymbol{x}}\in\mathcal{X}$ and $\rho_{1}>\rho_{2}$, if
$f_{{\boldsymbol{\theta}}}(\tilde{\boldsymbol{x}},\rho_{1})<0$ (i.e.
$\phi_{{\boldsymbol{\theta}}}(\tilde{\boldsymbol{x}},\rho_{1})=+1$) then
$f_{{\boldsymbol{\theta}}}(\tilde{\boldsymbol{x}},\rho_{2})<f_{{\boldsymbol{\theta}}}(\tilde{\boldsymbol{x}},\rho_{1})<0$
(i.e. $\phi_{{\boldsymbol{\theta}}}(\tilde{\boldsymbol{x}},\rho_{2})=+1$).

Next property shows that any standard binary classifier can be rendered
scalable by simply including the scaling parameter $\rho$ in an additive way.

######  Property 3.

Consider the function
$\hat{f}_{\boldsymbol{\theta}}:\mathcal{X}\to\mathbbm{R}$ and its
corresponding classifier

$\hat{\phi}_{{\boldsymbol{\theta}}}(\boldsymbol{x})\doteq\begin{cases}+1\quad\quad\text{if
}\,\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})<0,\\\
-1\quad\quad\text{otherwise.}\end{cases}$

Then, the function
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})+\rho$
satisfies Assumption 1 and thus provides the scalable classifier

$\phi_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)\doteq\begin{cases}+1\quad\quad\text{if
}\,f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)<0,\\\
-1\quad\quad\text{otherwise.}\end{cases}$

###### Proof.

The result is trivial because
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})+\rho$
is clearly a continuous and monotonically increasing function on $\rho$. It is
also straightforward to check that (6) is satisfied.∎

The next example illustrates the use of the previous property to obtain a
scalable classifier from a standard linear classifier. In subsection II-C we
present other examples of scalable classifiers and we show that the scaling
parameter $\rho$ does not need necessarily to appear in an additive way into
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$ to obtain a SC.

######  Example II.1 (Linear classifier as scalable classifier).

Consider the standard linear classifier defined by means of the function

$\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})=\boldsymbol{w}^{\top}\boldsymbol{x}-b.$

The classifier elements $\boldsymbol{w},b$ may be obtained, for instance, as
the solution of a SVM problem of the form

$\min\limits_{\boldsymbol{w},b}\frac{1}{2\eta}\boldsymbol{w}^{\top}\boldsymbol{w}+\frac{1}{2}\sum\limits_{i=1}^{n}\max\left\\{0,1+y_{i}(\boldsymbol{w}^{\top}\varphi(\boldsymbol{x}_{i})-b)\right\\},$

and notice that we are not using the usual form of the hinge loss with a minus
in front of $y_{i}$
($\max\left\\{0,1-y_{i}(\boldsymbol{w}^{\top}\varphi(\boldsymbol{x}_{i})-b)\right\\}$)
since we would like $\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})$ to be
negative for $y=+1$ and positive otherwise.
In this case, the classifier depends on the choice of the regularization term
$\eta$, and of the specific regressor functional $\varphi(\cdot)$. That is,
for a fixed choice of regressor, the hyperparameter vector is just the scalar
$\boldsymbol{\theta}=\eta$. In this sense, we remark that a more rigorous
notation would be $\boldsymbol{w}=\boldsymbol{w}(\boldsymbol{\theta})$ and
$b=b(\boldsymbol{\theta})$, but we omit this dependence for the sake of
readability.

As stated in the proof of Property 3, it is immediate to observe that linear
classifiers belong indeed to the class of scalable classifiers if we introduce
a scaling parameter $\rho$ in an additive way, that is

$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=\boldsymbol{w}^{\top}\boldsymbol{x}-b+\rho.$
(7)

Indeed, given $\rho_{1}>\rho_{2}$ we immediately have that

$\boldsymbol{w}^{\top}\boldsymbol{x}-b+\rho_{1}>\boldsymbol{w}^{\top}\boldsymbol{x}-b+\rho_{2},\quad\forall\boldsymbol{x}\in\mathcal{X},$

and it is straightforward to see that also (6) holds.

###  II-B Main Result: Probabilistic Safety Regions

Consider a given SC classifier $f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$
(i.e. a classifier designed considering a specific choice222Note that in this
section, we assume ${\boldsymbol{\theta}}$ to be fixed and given. Section III
discusses in detail how the possibility of choosing ${\boldsymbol{\theta}}$
may be exploited to improve the SC. of hyperparameter
${\boldsymbol{\theta}}$). Then, for a given value of the scaling parameter
$\rho\in\mathbbm{R}$, we define the $\rho$-safe set

$\mathcal{S}(\rho)=\\{\;\boldsymbol{x}\in\mathcal{X}\;:\;f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)<0\;\\},$

which represents the set of points $\boldsymbol{x}\in\mathcal{X}$ predicted as
safe by the classifier with the specific choice $\rho$ i.e. the safety region
of the classifier $f_{\boldsymbol{\theta}}$ for given $\rho$.

Note that, contrary to the similar concept introduced in [13], the
interpretation of $\rho$ as a “radius” is not valid anymore. That is, $\rho$
shall be viewed as a safety inducing parameter: the larger $\rho$, the more
stringent the requirements will be and thus, the smaller will be the
corresponding $\rho$-safe set. Also, note that $\rho\in\mathbbm{R}$, hence it
can take negative values. 333One may salvage the “radius” interpretation by
introducing a new parameter $\tilde{\rho}\doteq-\rho$, but we prefer not to do
this because this choice would complicate the ensuing derivations.. The reason
why we prefer the current formulation is that it allows us to draw a clear
parallel with the results in conformal prediction, see Remark V.1. Indeed,
following the reasoning above, it is easy to see that the larger $\rho$, the
smaller is the region. In other words, it is easy to see that

$\rho_{1}>\rho_{2}\Longrightarrow\mathcal{S}(\rho_{1})\subset\mathcal{S}(\rho_{2}).$

This behavior is depicted in Fig. 1.

Figure 1: Graphical depiction of the role of the scaling parameter. The blue
circles represent safe points $\boldsymbol{x}{\,\hat{=}\,}\mathrm{S}$, while
the red crosses represent unsafe ones,
$\boldsymbol{x}{\,\hat{=}\,}\mathrm{U}$.

In the next section, for completeness, we present some notable examples of
well-assessed classifiers which can be reformulated in a way so that they
belong to the SC family. We now introduce the main result of the paper, which
is a simple procedure to obtain, from a calibration set
$\mathcal{Z}_{c}\doteq\left\\{(\boldsymbol{x}_{i},y_{i})\right\\}_{i=1}^{n_{c}}$,
a probabilistic safety region $\mathcal{S}_{\varepsilon}$ that with a
probability no smaller than $1-\delta$ satisfies the probability constraint

${\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}\boldsymbol{x}\in\mathcal{S}_{\varepsilon}\Bigr{\\}}\leq\varepsilon.$

We will assume that the pair $(\boldsymbol{x},y)$ is a random variable and
that ${\rm{Pr}}\\{\boldsymbol{x}\in\mathcal{X}\\}=1$. Moreover, the $n_{c}$
samples of $\mathcal{Z}_{c}$ are assumed i.i.d..

######  Theorem II.1 (Probabilistic Safety Region).

Consider the classifier (4), and suppose that Assumption 1 holds and that
${\rm{Pr}}\\{\boldsymbol{x}\in\mathcal{X}\\}=1$. Given a calibration set
$\mathcal{Z}_{c}\doteq\left\\{(\boldsymbol{x}_{i},y_{i})\right\\}_{i=1}^{n_{c}}$
($n_{c}$ i.i.d. samples), suppose that $\delta\in(0,1)$,
$\varepsilon\in(0,1)$, and the integer discarding parameter $r$ satisfies
$n_{c}\geq r\geq 1$, and

${\mathbf{B}}(r-1;n_{c},\varepsilon)\leq\delta.$

Consider the subset
$\mathcal{Z}_{c}^{U}=\left\\{(\tilde{\boldsymbol{x}}^{U}_{j},-1)\right\\}_{j=1}^{n_{U}}$
corresponding to all the unsafe samples in $\mathcal{Z}_{c}$ and define the
probabilistic scaling of level $\varepsilon$ as follows

$\rho_{\varepsilon}\doteq\mathrm{max}^{(r)}\left(\\{\bar{\rho}(\tilde{\boldsymbol{x}}^{U}_{j})\\}_{j=1}^{n_{U}}\right),$
(8)

and define the corresponding $\rho_{\varepsilon}$-safe set

$\displaystyle\mathcal{S}_{\varepsilon}$ $\displaystyle\doteq$
$\displaystyle\left\\{\begin{array}[]{cc}\mathcal{S}\left(\rho_{\varepsilon}\right)&\text{
if }n_{U}\geq r\\\ \mathcal{X}&\text{otherwise.}\end{array}\right.$

Then, with probability no smaller than $1-\delta$,

${\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}\boldsymbol{x}\in\mathcal{S}_{\varepsilon}\Bigr{\\}}\leq\varepsilon.$ (10)

The proof of Theorem II.1 is available in Appendix -B.
From Corollary I.1, it is easy to see that the smaller $\varepsilon$ is, the
larger $\mathrm{max}^{(r)}$ is (i.e., $\rho_{\varepsilon}$).

In this view, $\rho_{\varepsilon}$ is in line with the idea of a safety-
inducing parameter discussed previously, since it operationally encodes the
probabilistic guarantee required by $\varepsilon$.

###  II-C Examples of Scalable Classifiers

As stated by Property 3, any standard classifier can be converted into a
scalable one by means of the inclusion of the scaling parameter $\rho$ in an
additive way. Using this scheme, we present in this section families of
scalable classifiers obtained from Support Vector Machines and Support Vector
Data Description classifiers. Additionaly, we also show how to obtain a
scalable classifier from the Logistic Regression classifier by including the
parameter $\rho$ in a non-additive manner. In the following examples, we
assume we are given a learning set

$\mathcal{Z}_{L}\doteq\left\\{\left(\boldsymbol{x}_{i},y_{i}\right)\right\\}_{i=1}^{n}\subseteq\mathcal{X}\times\left\\{-1,+1\right\\}$

containing observed feature points and corresponding labels
$\boldsymbol{z}_{i}=\left(\boldsymbol{x}_{i},y_{i}\right)$. Then, we introduce
the kernels (see e.g. [39]). In particular, letting

$\varphi:\mathcal{X}\longrightarrow\mathcal{V}$

be a feature map (where $\mathcal{V}$ is an inner product space) we define

$\displaystyle\Phi$ $\displaystyle=$
$\displaystyle\left[\begin{array}[]{cccc}\varphi(\boldsymbol{x}_{1})&\varphi(\boldsymbol{x}_{2})&\ldots&\varphi(\boldsymbol{x}_{n})\end{array}\right],$
(12) $\displaystyle D$ $\displaystyle=$
$\displaystyle\text{diag}\\{y_{1},y_{2},\ldots,y_{n}\\},$ (13) $\displaystyle
K$ $\displaystyle=$ $\displaystyle\Phi^{\top}\Phi,$ (14)

with
$K_{i,j}=K(\boldsymbol{x}_{i},\boldsymbol{x}_{j})=\varphi(\boldsymbol{x}_{i})^{\top}\varphi(\boldsymbol{x}_{j}),\;i\in[n],j\in[n]$
the kernel matrix.
The models considered and their derivation is absolutely classical. However,
since we are interested in scalable classifiers with guaranteed safety, for
each model we will consider two hyperparameters, i.e. we will set
$\boldsymbol{\theta}=[\eta,\,\tau]^{\top}$, where besides the classical
regularization parameter $\eta\in\mathbbm{R}$ we introduce a weighting term
$\tau\in(0,1)$ that penalizes missclassification errors (the role of $\tau$ is
much in the spirit of quantile regression formulation [40]).

####  II-C1 Scalable SVM

SVM is the simplest extension of a linear model and indeed we define its
classifier predictor as

$\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})=\boldsymbol{w}^{\top}\varphi(\boldsymbol{x})-b.$

The SVM formulation we adopt is the classical one proposed by Vapnik in [41],
with the addition of the weighting parameter $\tau$:

$\displaystyle\min\limits_{\boldsymbol{w},b,\xi_{1},\ldots,\xi_{n}}$
$\displaystyle\frac{1}{2\eta}\boldsymbol{w}^{\top}\boldsymbol{w}+\frac{1}{2}\sum\limits_{i=1}^{n}\left((1-2\tau)y_{i}+1\right)\xi_{i}$
s.t. $\displaystyle
y_{i}(\boldsymbol{w}^{\top}\varphi(\boldsymbol{x}_{i})-b)\leq\xi_{i}-1,\;i\in[n],$
$\displaystyle\xi_{i}\geq 0,\;i\in[n].$

We explicitly report the formulation in (II-C1) since our specific definition
of the classifier, which requires
$f_{\boldsymbol{\theta}}(\boldsymbol{x}_{i})$ to be negative when $y_{i}$
equals +1, leads to a slightly different formulation than the classical one.

The offset $b$ can be found exploiting special feature points
$\boldsymbol{x}_{s}$ called support vectors that are such that
$\varphi(\boldsymbol{x}_{s})$ lies on the boundary of the transformed space.
The addition of the scaling parameter $\rho$ changes the model in

$\displaystyle f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$ $\displaystyle=$
$\displaystyle\boldsymbol{w}^{\top}\varphi(\boldsymbol{x})-b+\rho.$ (16)

We observe that, for the linear kernel, the variation of $\rho$ is simply a
rigid translation of the classification hyperplane; for other kernels, for
example, the Gaussian kernel or the polynomial kernel, the effect is the
“deflation” or the “inflation” of the classification boundary. The composition
with the feature map does not affect the scalability property of the linear
classifier, so it is easy to verify from the considerations made in II.1 that
indeed scalable SVM satisfies Assumption 1 (see also Property 3).

######  Remark II.1 (On the role of $\tau$ parameter.).

Indeed, it is easy to see that small values of $\tau$ add more weight to the
class $+1$, which is the class we are interested in. So, the choice of a
“good” value of $\tau$ is particularly important. This will be discussed in
Section III, where the possibility of considering several values for this
parameter in the context of our approach is discussed in detail.

####  II-C2 Scalable SVDD

(a) Scalable SVM

(b) Scalable SVDD

(c) Scalable LR

(d)

Figure 2: 2D examples of PSRs via, respectively from left to right, scalable
SVM (linear kernel), scalable SVDD (linear kernel) and scalable LR (Gaussian
kernel). Synthetic test data were sampled from Gaussian distributions and
classified for varying values of $\varepsilon$ (from $0.01\ \text{to}\ 0.5$,
from lighter to darker colors), after calibrating the scalable parameters with
a calibration set of size $n_{c}$ according with bound (2) and
$\delta=10^{-6}$. Blue points refer to the safe class
($\boldsymbol{x}{\,\hat{=}\,}\mathrm{S}$) and reds to the unsafe one
($\boldsymbol{x}{\,\hat{=}\,}\mathrm{U}$).

SVDD was introduced in [42] based on the idea of classifying the feature
vectors by enclosing the target points (in the kernel space) in the smallest
hypersphere of radius $R$ and center $\boldsymbol{w}$. With this idea, we
define the scalable classifier predictor for SVDD as

$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=\left\lVert\varphi(\boldsymbol{x})-\boldsymbol{w}\right\rVert^{2}-(R^{2}-\rho),$
(17)

where $\boldsymbol{w},R$ are obtained as the solution of the following
weighted optimization problem

$\displaystyle\min\limits_{\boldsymbol{w},R,\xi_{1},\dots,\xi_{n}}$
$\displaystyle\frac{1}{2\eta}R^{2}+\frac{1}{2}\sum\limits_{i=1}^{n}\left((1-2\tau)y_{i}+1\right)\xi_{i}$
s.t. $\displaystyle
y_{i}\left(\left\lVert\varphi(\boldsymbol{x}_{i})-\boldsymbol{w}\right\rVert^{2}-R^{2}\right)\leq\xi_{i},\;i\in[n],$
$\displaystyle\xi_{i}\geq 0,\;i\in[n]$

that, again, depends on the hyperparameters
$\boldsymbol{\theta}=[\eta,\,\tau]^{\top}$, playing the role of regularization
and missclassification parameters. As for the SVM model, the radius $R$ is
retrieved by support vectors, that are feature points lying on the hypersphere
boundary of the classification in the kernel space. It is immediate to observe
that the introduction of the scaling parameter $\rho$ maintains the idea that
an increase in $\rho$ will result in a smaller radius
$\tilde{R}^{2}={R^{2}-\rho}$, thus implying the meaning of safety induction.
Indeed, the scalable SVDD-classifier predictor (17) clearly satisfies
equations (5) and (6).

####  II-C3 Scalable Logistic Regression

Logistic Regression (LR) classifies points $\boldsymbol{x}\in\mathcal{X}$ on
the basis of the probability expressed by the logistic function

$\displaystyle\frac{1}{1+e^{\boldsymbol{w}^{\top}\varphi(\boldsymbol{x})-b}}$
$\displaystyle=$
$\displaystyle{\rm{Pr}}_{\boldsymbol{\theta}}\left\\{y=+1\mid\boldsymbol{x}\right\\}$
$\displaystyle=$ $\displaystyle
1-{\rm{Pr}}_{\boldsymbol{\theta}}\left\\{y=-1\mid\boldsymbol{x}\right\\},$

where $\boldsymbol{w}$ and $b$ minimize the regularized negative log-
likelihood

$\displaystyle\mathrm{L}\left(\boldsymbol{w},b\mid\boldsymbol{x},y\right)=\dfrac{1}{2\eta}\boldsymbol{w}^{\top}\boldsymbol{w}$
$\displaystyle+\frac{1}{2}\sum\limits_{i=1}^{n}\left((1-2\tau)y_{i}+1\right)\text{log}\left(1+e^{y_{i}\left(\boldsymbol{w}^{\top}\varphi(\boldsymbol{x}_{i})-b\right)}\right),$

with $b$ explicitly computed with the support vectors of the model. Note that,
differently from classical LR and in the spirit of previously described
approaches, we introduce into the cost function the weight parameter
$\tau\in(0,1)$ to penalize misclassification, we also consider the
regularization parameter $\eta>0$. In this case, defining

$\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})=\frac{1}{2}-\frac{1}{1+e^{\boldsymbol{w}^{\top}\varphi(\boldsymbol{x})-b}},$

the standard LR classifier is given by

$\hat{\phi}_{{\boldsymbol{\theta}}}(\boldsymbol{x})\doteq\begin{cases}+1\quad\quad\text{if
}\,\hat{f}_{\boldsymbol{\theta}}(\boldsymbol{x})<0,\\\
-1\quad\quad\text{otherwise.}\end{cases}$

We now show that the following function

$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=\frac{1}{2}-\frac{1}{1+e^{\boldsymbol{w}^{\top}\varphi(\boldsymbol{x})-b+\rho,}}$

satisfies Assumption 1, and thus provides a scalable classifier. Clearly,
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$ is a continuous and
monotonically increasing function on $\rho$. Moreover,

$\lim_{\rho\to-\infty}f_{\theta}(\boldsymbol{x},\rho)=-1/2<0<1/2=\lim_{\rho\to+\infty}f_{\theta}(\boldsymbol{x},\rho).$

Thus, we conclude that

$\phi_{{\boldsymbol{\theta}}}(\boldsymbol{x},\rho)\doteq\begin{cases}+1\quad\quad\text{if
}\,f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)<0,\\\
-1\quad\quad\text{otherwise.}\end{cases}$

is a scalable classifier.

######  Remark II.2 (Generality of SC).

We remark that the three examples above, although already significant in
themselves, represent only a small subset of possible scalable classifiers.
Indeed, as stated in Property 3, any standard classifier can be easily
converted into an scalable one. Thus, the results presented in this paper can
be directly applied, for example, to any deep neural network classifier.

######  Remark II.3.

We emphasize that one of the main advantages of our approach is that the
distribution of the calibration set need not be equal to that of the learning
set. It should be equal to the one for which we want to impose probabilistic
guarantees. This is a crucial observation, since probabilistic guarantees
apply only to the distribution from which the calibration set was drawn, which
must therefore be chosen carefully. Note also that as the desired degree of
guarantee changes, the cardinality required for the the calibration set
changes.

######  Example II.2.

To give the reader a simple but meaningful idea of the method, Figure 2 shows
the behavior of the PSR as $\varepsilon$ varies while $\delta$ is fixed to
$10^{-6}$. For this example, we sampled with equal probability two classes,
“safe” $\mathrm{S}$ and “unsafe” $\mathrm{U}$, from two Gaussian distributions
with respectively means and covariance matrices

$\mu_{\mathrm{S}}=\begin{bmatrix}-1\\\
-1\end{bmatrix},\,\Sigma_{\mathrm{S}}=\mathrm{I}\,\,;\,\,\mu_{\mathrm{U}}=\begin{bmatrix}+1\\\
+1\end{bmatrix},\,\Sigma_{\mathrm{U}}=\mathrm{I}$

where $\mathrm{I}$ is the identity matrix. We sampled $3000$ points for the
training set and $10000$ for the test set, and $n_{c}=n_{c}(\varepsilon)$
points for the calibration set according to Corollary I.1 (from $146$ points
for $\varepsilon=0.5$ up to $7261$ for $\varepsilon=0.01$).
The behaviour of the PSR constructed via the scalable classifiers is in
agreement with the theory developed: the smaller the $\varepsilon$ (i.e. the
smaller is the error required) the smaller is the PSR, to guarantee more
probability of safety. For scalable SVM (left) and scalable SVDD (middle) we
choose a linear kernel, while for scalable LR (right) a Gaussian kernel was
used. The blue cirles represent safe points
$\boldsymbol{x}{\,\hat{=}\,}\mathrm{S}$, while the red crosses represent
unsafe ones, $\boldsymbol{x}{\,\hat{=}\,}\mathrm{U}$.

##  III Finite families of hyperparameters

Probabilistic scaling guarantees confidence in prediction for any given
scalable classifier. In other words, for any fixed value of hyperparameter
$\boldsymbol{\theta}$, the safety set obtained selecting the scaling parameter
$\rho$ according to our procedure will fulfill the required probabilistic
guarantees (Theorem II.1). However, it should be remarked that different
values of $\boldsymbol{\theta}$ will correspond to different models, and the
resulting set will consequently be different, both in “size” and in
“goodness”. In particular, if the starting SC has been chosen badly, our
procedure would lead to a very small PSR, that would be indeed guaranteed
theoretically, but with no practical use.

Hence, the problem of selecting the best initial SC becomes of great
importance. In our setup, this problem translates in choosing the best value
for the hyperparameter. Also, we remark that, in general, there may be other
parameters that affect the performance of a classifier, such as the choice of
different kernels or different weights or different regularizations and many
others. Hence, in general, the hyperparameter $\boldsymbol{\theta}$ may be of
larger dimensions and consider several possible choices.
To formally state our problem, we assume to have a finite set of $m$ possible
hyperparameters to choose from

$\Theta=\left\\{\boldsymbol{\theta}^{(1)},\boldsymbol{\theta}^{(2)},\dots,\boldsymbol{\theta}^{(m)}\right\\},$
(19)

and we consider the problem of selecting the “best” one.

Hence, we assume we are given a performance function $J:\Theta\to\mathbbm{R}$
which measures the goodness of the model described by $\boldsymbol{\theta}$.
Then, we will choose

$\boldsymbol{\theta}^{\star}\doteq\arg\max_{\boldsymbol{\theta}\in\Theta}J(\boldsymbol{\theta}).$

Clearly, depending on the problem at end, different cost functions may be
devised. We discuss a possible meaningful choice of performance function in
Section III-B. In the following section, we show how the scaling procedure can
be easily modified to guarantee that the selected SC, and the ensuing estimate
of the PSR, still enjoy the desired probabilistic guarantees.

###  III-A Probabilistic scaling for finite families of SC

The following results, whose proof is a direct consequence of Bonferroni’s
inequality and is omitted for brevity, shows how the results in Theorem II.1
may be immediately extended to the case of a finite family of classifiers,
i.e. a finite set of candidate SCs described by a finite set of possible
values of hyperparameters.

(a) $\eta=10^{-2},\tau=0.1$
$J(\eta,\tau)=535$

(b) $\eta=10^{-1},\tau=0.1$
$J(\eta,\tau)=563$

(c) $\eta=1,\tau=0.1$
$J(\eta,\tau)=590$

(d) $\eta=10^{-2},\tau=0.5$
$J(\eta,\tau)=697$

(e) $\eta=10^{-1},\tau=0.5$
$J(\eta,\tau)=776$

(f) $\eta=1,\tau=0.5$
$J(\eta,\tau)=736$

(g) $\eta=10^{-2},\tau=0.9$
$J(\eta,\tau)=662$

(h) $\eta=10^{-1},\tau=0.9$
$J(\eta,\tau)={\mathbf{811}}$

(i) $\eta=1,\tau=0.9$
$J(\eta,\tau)=770$

Figure 3: Plots of PSRs at the $varepsilon=0.05$ level for Gaussian SVDD with
different regularization parameters ($\eta$) and different weights ($\tau$).
The shape of the region changes by varying the design parameters, but
maintaining the probabilistic guarantee on the number of unsafe points within
it. The best configuration is chosen by maximizing a performance index, in
this case the number of calibration points contained in the region (see the
equation (25)). For this toy example, the best configuration is obtained for
$epsilon=10^{-1}$ and $tau=0.9$, but others can be found by increasing the
number of candidate design parameters.

######  Theorem III.1 (Probabilistic Safety Region for finite families of
hyperparameters).

Consider the classifier (4), a finite set of possible hyperparameter values
$\boldsymbol{\theta}\in\Theta=\left\\{\boldsymbol{\theta}^{(1)},\boldsymbol{\theta}^{(2)},\dots,\boldsymbol{\theta}^{(m)}\right\\}$,
and suppose that Assumption 1 holds and that
${\rm{Pr}}\\{\boldsymbol{x}\in\mathcal{X}\\}=1$. Fix a risk parameter
$\varepsilon\in(0,1)$, a probability level $\delta\in(0,1)$ and an integer
discarding parameter $r\geq 1$. Given
$\mathcal{Z}_{c}^{U}=\left\\{(\tilde{\boldsymbol{x}}^{U}_{j},-1)\right\\}_{j=1}^{n_{U}}$
corresponding to all the unsafe samples in a calibration set $\mathcal{Z}_{c}$
of $n_{c}\geq r$ i.i.d. samples, for all $\boldsymbol{\theta}^{(k)}$,
$k\in[m]$, compute the corresponding scaling factors:

  * •

compute the scaling parameters

$\bar{\rho}_{j}^{(k)}\text{ such that
}f_{\boldsymbol{\theta}^{(k)}}(\tilde{\boldsymbol{x}}_{j}^{U},\bar{\rho}_{j}^{(k)})=0,\quad
j\in[n_{U}],k\in[m],$

  * •

compute the $k$-th probabilistic radius and the $k$-th probabilistic safety
region of level $\varepsilon$, i.e.

$\displaystyle\rho_{\varepsilon}^{(k)}$ $\displaystyle\doteq$
$\displaystyle\mathrm{max}^{(r)}\left(\\{\bar{\rho}_{j}^{(k)}\\}_{j=1}^{n_{U}}\right),$
(20) $\displaystyle\mathcal{S}^{(k)}_{\varepsilon}$ $\displaystyle\doteq$
$\displaystyle\left\\{\begin{array}[]{cc}\mathcal{S}\left(\rho_{\varepsilon}^{(k)}\right)&\text{
if }n_{U}\geq r\\\ \mathcal{X}&\text{otherwise.}\end{array}\right..$ (23)

Then, the following holds

${\rm{Pr}}\left\\{{\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}\boldsymbol{x}\in\mathcal{S}^{(k)}_{\varepsilon}\Bigr{\\}}\leq\varepsilon\right\\}\geq
1-m{\mathbf{B}}(r-1;n_{c},\varepsilon),$ (24)

$\forall k\in[m]$.

In particular, this means that all sets $\mathcal{S}^{(k)}_{\varepsilon}$ are
valid PSR candidates, and we have the possibility of selecting among those the
“best” one according to some specific measure on how we expect the SC to
behave. In the next subsection, we propose a possible criterion which proved
to be very effective in our experience.

###  III-B Increase of safe points

In general, one is interested in a solution which, besides providing
probabilistic guarantees on the safe region, i.e. minimizing the probability
of having unsafe points in the set $\mathcal{S}^{(k)}_{\varepsilon}$, it also
maximises the number of safe points captured by the region itself. To this
end, we first notice that, when applying the scaling procedure, we are
basically only exploiting the unsafe points in calibration set
$\mathcal{Z}_{c}$ (i.e. the points belonging to $\mathcal{Z}_{c}^{U}$).

It is thus immediately to observe that the remaining points in the calibration
set, i.e. the points belonging to

$\mathcal{Z}_{c}^{S}=\mathcal{Z}_{c}\setminus\mathcal{Z}_{c}^{U},$

i.e. the set containing all the safe ($+1$) points in $\mathcal{Z}_{c}$ may be
exploited in evaluating the goodness of the candidate sets. To this end, given
a candidate set $\mathcal{S}^{(k)}_{\varepsilon}$, we can measure its goodness
by choosing the cardinality of that set as the performance function

$J(\boldsymbol{\theta}^{(k)})\doteq\left|\left\\{\boldsymbol{z}\in\mathcal{Z}_{c}^{S}:\boldsymbol{z}\in\mathcal{S}^{(k)}_{\varepsilon}\right\\}\right|.$
(25)

######  Example III.1.

Considering the scalable SVDD with Gaussian kernel, in the same design as
ExampleII.2, but with a probability of sampling outliers per class set at
$p_{O}=0.1$ (to allow for some noise), with only $1,000$ points for the test
set (to make the boundary plot clearer, see Figure 3) and with $\varepsilon$
set to $0.05$ (that gives a calibration set with $2,064$ points), we computed
the probabilistic safety region $\mathcal{S}_{\varepsilon}$ for different
values of the hyperparameters $\boldsymbol{\theta}=[\eta,\tau]$, specifically
$\eta=[10^{-2},10^{-1},1]$ and $\tau=[0.1,0.2,\dots,0.9]$. All regions satisfy
the probabilistic bound on the number of unsafe points within
$\mathcal{S}_{\varepsilon}$, i.e.
${\rm{Pr}}\\{\boldsymbol{x}{\,\hat{=}\,}\textrm{U}\ \text{and}\
\boldsymbol{x}\in\mathcal{S}_{\varepsilon}\\}<0.05$, but the area covered
changes as the design parameters change. The best region can be chosen as the
one that maximizes an index parameter, as in this case the equation (25) that
increases the number of safe points in the PSR.

Finally, it is worth noting that, more generally, the parameter to be
optimized can be specified in principle according to the specific problem to
be solved. For example, $J$ can be defined such that it maximizes accuracy or
minimizes only false positives or false negatives or optimizes any other
performance index.

Table I: Table of the performance of PSRs for vehicle platoon as the collision
probability ($\varepsilon=0.01,0.05,0.1$) and design parameters
($\eta=10^{-2},10^{-1},1$ and $\tau=0.1,0.5,0.9$) variation. The kernel was
set as Gaussian. In bold, the best results for each combination of classifier
and parameters.

|  | $\boldsymbol{\eta=10^{-2}}$ | $\boldsymbol{\eta=10^{-1}}$ |  $\boldsymbol{\eta=1}$
---|---|---|---|---
|  | $\boldsymbol{\tau=0.1}$ | $\boldsymbol{\tau=0.5}$ | $\boldsymbol{\tau=0.9}$ | $\boldsymbol{\tau=0.1}$ | $\boldsymbol{\tau=0.5}$ | $\boldsymbol{\tau=0.9}$ | $\boldsymbol{\tau=0.1}$ | $\boldsymbol{\tau=0.5}$ |  $\boldsymbol{\tau=0.9}$
|  | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ | $J(\boldsymbol{\theta})$ | ${\rm{Pr}}\\{\\}$ |  $J(\boldsymbol{\theta})$
|  |  $\boldsymbol{\varepsilon=0.01}$
Vehicle Platooning | SC-SVM | 0.04 | 825 | 0.02 | 1254 | 0.03 | 1054 | 0.02 | 1211 | 0.01 | 1839 | 0.01 | 2030 | 0.01 | 1390 | 0.01 | 1833 | 0.01 |  2361
SC-SVDD | 0.01 | 3347 | 0.02 | 2395 | 0.01 | 3532 | 0.01 | 3342 | 0.02 | 2395 | 0.01 | 3547 | 0.01 | 3342 | 0.01 | 3032 | 0.01 |  3548
SC-LR | 0.02 | 5373 | 0.02 | 5372 | 0.02 | 5372 | 0.02 | 5378 | 0.02 | 5373 | 0.02 | 5372 | 0.02 | 5372 | 0.02 | 5376 | 0.02 | 5350
|  $\boldsymbol{\varepsilon=0.05}$
SC-SVM | 0.06 | 486 | 0.07 | 568 | 0.08 | 518 | 0.05 | 707 | 0.05 | 780 | 0.06 | 752 | 0.05 | 805 | 0.04 | 797 | 0.05 |  844
SC-SVDD | 0.05 | 886 | 0.06 | 678 | 0.05 | 876 | 0.05 | 889 | 0.06 | 678 | 0.05 | 880 | 0.05 | 889 | 0.06 | 763 | 0.05 | 880
SC-LR | 0.03 | 909 | 0.03 | 910 | 0.03 | 909 | 0.03 | 915 | 0.03 | 911 | 0.02 | 907 | 0.03 | 953 | 0.03 | 951 | 0.00 | 889
|  $\boldsymbol{\varepsilon=0.1}$
SC-SVM | 0.10 | 360 | 0.12 | 394 | 0.16 | 357 | 0.14 | 430 | 0.10 | 456 | 0.10 | 449 | 0.12 | 466 | 0.09 | 495 | 0.09 |  487
SC-SVDD | 0.10 | 508 | 0.11 | 463 | 0.09 | 528 | 0.10 | 508 | 0.11 | 463 | 0.09 | 529 | 0.09 | 508 | 0.10 | 485 | 0.09 |  529
SC-LR | 0.10 | 566 | 0.10 | 574 | 0.10 | 574 | 0.10 | 577 | 0.09 | 586 | 0.09 | 567 | 0.09 | 597 | 0.07 | 568 | 0.06 | 558

##  IV A real-world application:
Vehicle Platooning

Safety critical assessment represents a fundamental requirement in the
automotive industry and vehicle platooning (VP) [43] represents one of the
most challenging CPS (Cyber Physical System) in this context. The main goal of
VP is to find the best trade-off between performance (i.e., maximizing speed
and minimizing vehicle mutual distance) and safety (i.e., collision
avoidance). With the idea of finding the largest region in the input space
where safety is probabilistically guaranteed, we tested our scalable
classifiers on the following scenario: given the platoon at a steady state of
speed and reciprocal distance of the vehicles, a braking is applied by the
leader of the platoon [44, 45]. Safety is referred to a collision between
adjacent vehicles (in the study, it is actually registered when the reciprocal
distance between vehicles achieves a lower bound, e.g. 2 m). The dynamic of
the system is generated by the following differential equations [44]:

$\begin{cases}\dot{v_{\ell}}=\frac{1}{m_{\ell}}(F_{\ell}-(a_{\ell}+b_{\ell}\cdot
v_{\ell}^{2}))\\\ \dot{d}_{\ell}=v_{\ell-1}-v_{\ell}\end{cases}$ (26)

where $v_{\ell},m_{\ell},a_{\ell},b_{\ell}$ and $F_{\ell}$ are, respectively,
the speed, the mass, the tire-road rolling distance, the aerodynamic drag and
the braking force (the control law) of vehicle $\ell$ and $d_{\ell}$ is the
distance of vehicle $\ell$ from the previous one $\ell-1$.

The behaviour of the dynamical system is synthesised by the following vector
of features:

$\boldsymbol{x}=[N,\boldsymbol{\iota}(0),F_{0},\mathbf{m},\mathbf{q},\mathbf{p}],$
(27)

$N+1$ being the number of vehicles in the platoon,
$\boldsymbol{\iota}=[\mathbf{d},\mathbf{v},\mathbf{a}]$ are the vectors of
reciprocal distance, speed, and acceleration of the vehicles, respectively
($\boldsymbol{\iota}$(0) denotes that the quantities are sampled at time
$t=0$, after which a braking force is applied by the leader [45] and
simulations are set in order to manage possible transient periods and achieve
a steady state of $\boldsymbol{\iota}$ before applying the braking), m is the
vector of weights of the vehicles, $F_{0}$ is the braking force applied by the
leader, q is the vector of quality measures of the communication medium (fixed
delay and packet error rate (PER) are considered in the simulations) and
finally p is the vector of tuning parameters of the control scheme.

The Plexe simulator [45, 44] has been used to register $20000$ observations in
the following ranges: $N\in[3,8],\ F_{0}\in[-8,-1]\times 10^{3}N$,
$\mathbf{q}\in[0,0.5],\ \mathbf{d}(0)\in[4,9]\ \text{m},\
\mathbf{v}(0)\in[10,90]\ \text{Km/h}$. Initial acceleration $\mathbf{a}(0)$ is
computed as $\mathbf{a}(0)=F_{0}/\mathbf{m}\ \text{Km/h}^{2}$. The output
variable is then defined as $y\in\mathcal{Y}=\\{-1,+1\\}$, where $-1$ means
“collision” and $+1$ means “non-collision”.
We searched safety for three levels of guarantee ($\varepsilon=0.01,0.05,0.1$)
and different hyperparameters ($\eta=10^{-2},10^{-1},1$ and
$\tau=0.1,0.5,0.9$), evaluating the performance on the test set (reported in
Table I) computing the empirical probability of getting a collision inside the
“non-collision” probabilistic safety region $\mathcal{S}_{\varepsilon}$,
${\rm{Pr}}\Bigl{\\{}\boldsymbol{x}{\,\hat{=}\,}\\{\text{collision}\\}\
\text{and}\ \mathbf{\boldsymbol{x}}\in\mathcal{S}_{\varepsilon}\Bigr{\\}}$,
and the number of non-collision points of the calibration set contained in
$\mathcal{S}_{\varepsilon}$, varying the hyperparameters,
$J(\boldsymbol{\eta},\boldsymbol{\tau})$.

We divided the dataset in training set ($n_{tr}=3000$ points), calibration set
($n_{c}=10320,2064,1032$ respectively for $\varepsilon=0.01,0.05,0.1$) and
test set ($n_{ts}=n_{tr}-n_{c}$).
In this numerical example, we use the scalable classifiers presented in
Subsection II-C; scalable SVM (SC-SVM), scalable SVDD (SC-SVDD) and scalable
LR (SC-LR). In all of them, the Gaussian kernel has been employed. For all
scalable classifiers, the trade-off between the guarantee and the number of
safe points of the calibration set within the “non-collision” safety region is
good, allowing for the construction of operational regions where safety can be
guaranteed. In particular, the best performance obtained by each classifier at
different levels of $\varepsilon$ is highlighted in bold in Table I.
Furthermore, Figure 4 shows the trend of the probability of getting a
collision within the safety region as $\varepsilon$ varies, with $\eta=1$ and
$\tau=0.5$ (i.e., without regularizing and weighting equally both the
classes). As expected, the behavior is (almost) linear with $\varepsilon$,
with SC-LR deviating slightly from SC-SVM and SC-SVDD.
It should be mentioned that this work represents a significant improvement of
the results obtained on the same dataset by [46]. In this previous research, a
safety set was searched by numerically minimizing the number of false
positives by controlling the radius of an SVDD classifier. Here, with the new
theory based on SCs and probabilistic scaling, we obtain better results in
terms of performance (i.e., size of safety regions) and, more importantly,
with a formally solid mathematical framework, applicable to any binary
classifier.

Figure 4: Empirical probability of collision, measured in the test set, as a
function of $\varepsilon$.

##  V Conclusions

Statistical learning can rely on two significant new concepts: scalable
classifiers and probabilistic safety regions SCs constitute a new family of
classifiers, expanding the knowledge in the field of ML classification, which
has been state of the art for many years. Three examples of SCs have been
proposed (SC-SVM, SC-SVDD and SC-LR), but more can be developed. For example,
the results of the paper can be straightforwardly applied in the field of deep
neural networks, which, in principle, would have a crucial impact: they would
allow classification performance to be controlled without lengthy retraining.
Also, the definition of PSR and its proved properties provide the field of
CPSs with a new relevant methodology for evaluating safety. The range of
applications in which PSRs can be introduced is definitely wide: from safety
monitoring to performance improvement and conformity guarantee, just to name a
few. Moreover, the ideas here introduced open up new research directions and
parallels with other theories. In particular, and with this remark we conclude
the paper, our theory has much in common with Conformal Prediction, allowing
for connections that both methodologies can use to improve each other.

######  Remark V.1 (Link with Conformal Prediction).

We shall remark that our approach bears various similarities with the
Conformal Prediction approach. Conformal Prediction is a framework developed
starting in the late nineties and early two thousand by V. Vovk. We refer the
reader to the surveys [47, 48, 49] for a nice introduction to this
methodology. Similarly to our approach, CP makes use of a calibration set to
perform an a-posteriori verification of the designed classifier. In practice,
it returns a measure of its ”conformity” to the calibration data, based on the
introduction of specific score functions. We are currently working in showing
how specific score functions may be designed in the case of scalable
classifier. Preliminary results, which go beyond the scope of present work,
seem to prove how the scaling setup proposed here may be used to prove
interesting safety properties of CPs.

## Acknowledgment

We would like to thank A. Angelopoulos for the inspiring discussions on
possible links between scalable classifiers and conformal predictions.

This appendix is devoted to the proofs and derivations of all the original
results presented in this paper.

###  -A Property 2

###### Proof.

Because of (6) we have that if $\rho$ is small enough then
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)<0$. On the other hand, if $\rho$
is large enough then $f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)>0$. This,
along with the continuity nature of
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$, guarantees the existence of
$\rho$ such that $f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)=0$. The
uniqueness follows from the monotonic assumption on
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$. Denote
$\bar{\rho}(\boldsymbol{x})$ this unique value of $\rho$ satisfying
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\bar{\rho}(\boldsymbol{x}))=0$. From
the monotonically increasing nature of
$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)$ we have

$f_{\boldsymbol{\theta}}(\boldsymbol{x},\rho)\geq
0\;\;\Leftrightarrow\;\;\rho\geq\bar{\rho}(\boldsymbol{x}).$

Thus,

$\phi_{\theta}(\boldsymbol{x},\rho)=-1\Leftrightarrow\rho\geq\bar{\rho}(\boldsymbol{x}).$

∎

###  -B Theorem II.1

###### Proof.

Let us introduce the auxiliary function

$\psi:\mathcal{X}\times\\{-1,1\\}\to[-1,1),$

which is defined as

$\psi(\boldsymbol{x},y)\doteq\left\\{\begin{array}[]{cl}-1&\text{if
}\,y=+1,\\\
\frac{\bar{\rho}(\boldsymbol{x})}{1+|\bar{\rho}(\boldsymbol{x})|}&\text{otherwise.}\end{array}\right.$
(28)

Denote now

$\psi_{\varepsilon}=\mathrm{max}^{(r)}\left(\\{\psi(\boldsymbol{x}_{i},y_{i})\\}_{i=1}^{n_{c}}\right)).$

Since $\delta\in(0,1)$, $\varepsilon\in(0,1)$ and the integers $n_{c}\geq
r\geq 1$ satisfy

$\sum\limits_{i=0}^{r-1}\binom{n_{c}}{i}\varepsilon^{i}(1-\varepsilon)^{n_{c}-i}\leq\delta,$

we have from Property 1 that, with a probability no smaller than $1-\delta$,

${\rm{Pr}}\Bigl{\\{}\psi(\boldsymbol{x},y)>\psi_{\epsilon}\Bigr{\\}}\leq\varepsilon.$
(29)

The rest of the proof shows that the previous inequality is equivalent to the
claim of the theorem. That is,

${\rm{Pr}}\Bigl{\\{}\psi(\boldsymbol{x},y)>\psi_{\varepsilon}\Bigr{\\}}\leq\varepsilon\;\;\Leftrightarrow\;\;\mathbbm{P}\Bigl{\\{}y=-1\text{
and }\boldsymbol{x}\in S_{\epsilon}\Bigr{\\}}\leq\varepsilon.$

We consider two cases $n_{U}<r$ and $n_{U}\geq r$.

  * •

Case $n_{U}<r$: By definition,

$-1=\psi(\boldsymbol{x},+1)<\psi(\boldsymbol{x},-1)\in(-1,1),\;\forall\boldsymbol{x}\in\mathcal{X}.$

This means that the smallest values for $\psi(\boldsymbol{x},y)$ are attained
at the safe samples. From $n_{U}<r$ we have that at most $r-1$ elements of the
calibration set correspond to unsafe samples. Equivalently, no more than $r-1$
elements of $\\{\psi(\boldsymbol{x}_{i},y_{i})\\}_{i=1}^{n_{c}}$ are larger
than $-1$. This implies that the $r$-th largest value in
$\\{\psi(\boldsymbol{x}_{i},y_{i})\\}_{i=1}^{n_{c}}$ corresponds to a safe
sample and is equal to $-1$. That is,

$\psi_{\varepsilon}=\mathrm{max}^{(r)}\left(\\{\psi(\boldsymbol{x}_{i},y_{i})\\}_{i=1}^{n_{c}}\right))=-1.$

Thus, the inequality (29) is equivalent in this case to

${\rm{Pr}}\Bigl{\\{}\psi(\boldsymbol{x},y)>-1\Bigr{\\}}\leq\varepsilon.$

By definition, for every $\boldsymbol{x}\in\mathcal{X}$ we have

$\psi(\boldsymbol{x},y)>-1\;\Leftrightarrow\;y=-1.$

Thus, we obtain that in this case, $\psi_{\varepsilon}=-1$ and

$\displaystyle{\rm{Pr}}\Bigl{\\{}\psi(\boldsymbol{x},y)>\psi_{\varepsilon}\Bigr{\\}}\leq\varepsilon$
$\displaystyle\Leftrightarrow$
$\displaystyle{\rm{Pr}}\Bigl{\\{}y=-1\Bigr{\\}}\leq\varepsilon$
$\displaystyle\Leftrightarrow$ $\displaystyle{\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}\boldsymbol{x}\in\mathcal{X}\Bigr{\\}}\leq\varepsilon.$

From the assumptions of the Theorem, we have that, by definition, $n_{U}<r$
implies $S_{\varepsilon}=\mathcal{X}$. Thus, we conclude that in this case,

${\rm{Pr}}\Bigl{\\{}\psi(\boldsymbol{x},y)>\psi_{\varepsilon}\Bigr{\\}}\leq\varepsilon\;\Leftrightarrow{\rm{Pr}}\Bigl{\\{}y=-1\text{
and }\boldsymbol{x}\in S_{\varepsilon}\Bigr{\\}}\leq\varepsilon.$

  * •

Case $n_{U}\geq r$: In this case, the $r$-largest value of
$\\{\psi(\boldsymbol{x}_{i},y_{i})\\}_{i=1}^{n_{c}}$ is attained at an element
of the unsafe calibration set
$\mathcal{Z}_{c}^{U}=\left\\{(\tilde{\boldsymbol{x}}^{U}_{j},-1)\right\\}_{j=1}^{n_{U}}\subseteq\mathcal{Z}_{c}$.
That is,

$\displaystyle\psi_{\varepsilon}$ $\displaystyle=$
$\displaystyle\mathrm{max}^{(r)}\left(\\{\psi(\boldsymbol{x}_{i},y_{i})\\}_{i=1}^{n_{c}}\right)$
$\displaystyle=$
$\displaystyle\mathrm{max}^{(r)}(\\{\psi(\tilde{\boldsymbol{x}}^{U}_{j},-1)\\}_{j=1}^{n_{U}})\in(-1,1).$

Define now

$\rho_{\varepsilon}=\mathrm{max}^{(r)}\left(\\{\bar{\rho}(\tilde{\boldsymbol{x}}^{U}_{j})\\}_{j=1}^{n_{U}}\right).$

Since $\frac{\bar{\rho}(\boldsymbol{x})}{1+|\bar{\rho}(\boldsymbol{x})|}$ is a
monotonically increasing function on $\bar{\rho}(\boldsymbol{x})$, we have
that $\psi_{\epsilon}$ can be obtained by means of $\rho_{\varepsilon}$. That
is,

$\psi_{\varepsilon}=\mathrm{max}^{(r)}(\\{\psi(\tilde{\boldsymbol{x}}^{U}_{j},-1)\\}_{j=1}^{n_{U}})=\frac{\rho_{\varepsilon}}{1+|\rho_{\varepsilon}|}.$

Thus, from $\psi_{\varepsilon}>-1$ and the previous expression we obtain the
equivalences

$\displaystyle\psi(\boldsymbol{x},y)>\psi_{\varepsilon}$
$\displaystyle\Leftrightarrow$ $\displaystyle y=-1\text{ and
}\frac{\bar{\rho}(\boldsymbol{x})}{1+|\bar{\rho}(\boldsymbol{x})|}>\frac{\rho_{\varepsilon}}{1+|\rho_{\varepsilon}|}$
$\displaystyle\Leftrightarrow$ $\displaystyle y=-1\text{ and
}\bar{\rho}(\boldsymbol{x})\geq\rho_{\varepsilon}.$

Therefore,
${\rm{Pr}}\Bigl{\\{}\psi(x,y)>\psi_{\varepsilon}\Bigr{\\}}\leq\varepsilon$ is
equivalent to

${\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}\bar{\rho}(\boldsymbol{x})>\rho_{\varepsilon}\Bigr{\\}}\leq\varepsilon.$

From the monotonicity of $f_{\theta}(\boldsymbol{x},\rho)$ on $\rho$
(Assumption 1) we obtain that the previous inequality can be rewritten as

${\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}f_{\theta}(\boldsymbol{x},\bar{\rho}(x))>f_{\theta}(\boldsymbol{x},\rho_{\varepsilon})\Bigr{\\}}\leq\varepsilon.$

Taking into consideration that $f_{\theta}(\boldsymbol{x},\bar{\rho}(x))=0$ we
obtain that
${\rm{Pr}}\Bigl{\\{}\psi(x,y)>\psi_{\varepsilon}\Bigr{\\}}\leq\varepsilon$ is
equivalent to

${\rm{Pr}}\Bigl{\\{}y=-1\text{ and
}f_{\theta}(\boldsymbol{x},\rho_{\varepsilon})<0\Bigr{\\}}\leq\varepsilon.$

From the assumptions of the Theorem we have that, by definition, $n_{U}\geq r$
implies that $S_{\varepsilon}$ is equal to
$\\{\;\boldsymbol{x}\in\mathcal{X}\;:\;f_{\theta}(\boldsymbol{x},\rho_{\varepsilon})<0\;\\}$.
Thus, we conclude in this case that

${\rm{Pr}}\Bigl{\\{}\psi(\boldsymbol{x},y)>\psi_{\varepsilon}\Bigr{\\}}\leq\varepsilon\;\Leftrightarrow{\rm{Pr}}\Bigl{\\{}y=-1\text{
and }\boldsymbol{x}\in S_{\varepsilon}\Bigr{\\}}\leq\varepsilon.$

∎

## References

  * [1] D. Amodei, C. Olah, J. Steinhardt, P. F. Christiano, J. Schulman, and D. Mané, “Concrete problems in AI safety,” _CoRR_ , vol. abs/1606.06565, 2016. [Online]. Available: http://arxiv.org/abs/1606.06565
  * [2] S. Jain, M. Luthra, S. Sharma, and M. Fatima, “Trustworthiness of artificial intelligence,” in _2020 6th International Conference on Advanced Computing and Communication Systems (ICACCS)_ , 2020, pp. 907–912.
  * [3] T. J. Wignall and H. Houlden, _Uncertainty Quantification for Launch Vehicle Aerodynamic Lineloads_. [Online]. Available: https://arc.aiaa.org/doi/abs/10.2514/6.2020-1521
  * [4] J. Chen, M. D. Flood, and R. B. Sowers, “Measuring the Unmeasurable: An Application of Uncertainty Quantification to Financial Portfolios,” Office of Financial Research, US Department of the Treasury, Working Papers 15-19, Oct. 2015. [Online]. Available: https://ideas.repec.org/p/ofr/wpaper/15-19.html
  * [5] K. Zou, Z. Chen, X. Yuan, X. Shen, M. Wang, and H. Fu, “A review of uncertainty estimation and its application in medical imaging,” 2023.
  * [6] B. Xu, Q. Li, T. Guo, Y. Ao, and D. Du, “A quantitative safety verification approach for the decision-making process of autonomous driving,” in _2019 International Symposium on Theoretical Aspects of Software Engineering (TASE)_ , 2019, pp. 128–135.
  * [7] S. Jorgensen, J. Holodnak, J. Dempsey, K. de Souza, A. Raghunath, V. Rivet, N. DeMoes, A. Alejos, and A. Wollaber, “Extensible machine learning for encrypted network traffic application labeling via uncertainty quantification,” _IEEE Transactions on Artificial Intelligence_ , pp. 1–15, 2023. [Online]. Available: https://doi.org/10.1109%2Ftai.2023.3244168
  * [8] B. Li, P. Qi, B. Liu, S. Di, J. Liu, J. Pei, J. Yi, and B. Zhou, “Trustworthy AI: from principles to practices,” _CoRR_ , vol. abs/2110.01167, 2021. [Online]. Available: https://arxiv.org/abs/2110.01167
  * [9] B. Nagy, “System safety considerations for al/ml (categorization/attributes) versus traditional code regarding interlocks.” Naval Ordinance Safety and Security Activity (NOSSA) workshop, 2023\.
  * [10] L. Lucas, H. Owhadi, and M. Ortiz, “Rigorous verification, validation, uncertainty quantification and certification through concentration-of-measure inequalities,” _Computer Methods in Applied Mechanics and Engineering_ , vol. 197, no. 51, pp. 4591–4609, 2008. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0045782508002326
  * [11] R. Yan, J. Yang, D. Zhu, and K. Huang, “Design verification and validation for reliable safety-critical autonomous control systems,” in _2018 23rd International Conference on Engineering of Complex Computer Systems (ICECCS)_ , 2018, pp. 170–179.
  * [12] H. A. David, _Order Statistics_. Berlin, Heidelberg: Springer Berlin Heidelberg, 2011, pp. 1039–1040. [Online]. Available: https://doi.org/10.1007/978-3-642-04898-2_436
  * [13] M. Mammarella, V. Mirasierra, M. Lorenzen, T. Alamo, and F. Dabbene, “Chance-constrained sets approximation: A probabilistic scaling approach,” _Automatica_ , vol. 137, p. 110108, 2022. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0005109821006373
  * [14] T. Alamo, J. M. Manzano, and E. F. Camacho, _Robust Design Through Probabilistic Maximization_. Cham: Springer International Publishing, 2018, pp. 247–274. [Online]. Available: https://doi.org/10.1007/978-3-030-04630-9_7
  * [15] D. Anderson and K. Burnham, “Model selection and multi-model inference,” _Second. NY: Springer-Verlag_ , vol. 63, no. 2020, p. 10, 2004.
  * [16] J. Lin, L. L. Njilla, and K. Xiong, “Robust machine learning against adversarial samples at test time,” in _ICC 2020 - 2020 IEEE International Conference on Communications (ICC)_ , 2020, pp. 1–6.
  * [17] Y. Wang, S. Aeron, A. S. Rakin, T. Koike-Akino, and P. Moulin, “Robust machine learning via privacy/rate-distortion theory,” _CoRR_ , vol. abs/2007.11693, 2020. [Online]. Available: https://arxiv.org/abs/2007.11693
  * [18] H. Xu and S. Mannor, “Robustness and generalization,” _CoRR_ , vol. abs/1005.2243, 2010. [Online]. Available: http://arxiv.org/abs/1005.2243
  * [19] M. Shafique, M. Naseer, T. Theocharides, C. Kyrkou, O. Mutlu, L. Orosa, and J. Choi, “Robust machine learning systems: Challenges, current trends, perspectives, and the road ahead,” _CoRR_ , vol. abs/2101.02559, 2021. [Online]. Available: https://arxiv.org/abs/2101.02559
  * [20] K. R. Varshney, “Engineering safety in machine learning,” in _2016 Information Theory and Applications Workshop (ITA)_ , 2016, pp. 1–5.
  * [21] C. Park and N. H. Kim, “Safety envelope for load tolerance of structural element design based on multi-stage testing,” _Advances in Mechanical Engineering_ , vol. 8, no. 9, p. 1687814016668140, 2016. [Online]. Available: https://doi.org/10.1177/1687814016668140
  * [22] G. Shafer and V. Vovk, “A tutorial on conformal prediction,” _Journal of Machine Learning Research_ , vol. 9, no. 12, pp. 371–421, 2008. [Online]. Available: http://jmlr.org/papers/v9/shafer08a.html
  * [23] V. Mirasierra, M. Mammarella, F. Dabbene, and T. Alamo, “Prediction error quantification through probabilistic scaling,” _IEEE Control Systems Letters_ , vol. 6, pp. 1118–1123, 2022.
  * [24] D. Barber, _Bayesian Reasoning and Machine Learning_. USA: Cambridge University Press, 2012.
  * [25] R. Herbei and M. H. Wegkamp, “Classification with reject option,” _The Canadian Journal of Statistics / La Revue Canadienne de Statistique_ , vol. 34, no. 4, pp. 709–721, 2006. [Online]. Available: http://www.jstor.org/stable/20445230
  * [26] J. Quionero-Candela, M. Sugiyama, A. Schwaighofer, and N. D. Lawrence, _Dataset Shift in Machine Learning_. The MIT Press, 2009.
  * [27] V. Koltchinskii and D. Panchenko, “Empirical margin distributions and bounding the generalization error of combined classifiers,” _Annals of Statistics_ , vol. 30, 04 2000.
  * [28] T. Evgeniou, M. Pontil, and T. A. Poggio, “Regularization networks and support vector machines,” _Advances in Computational Mathematics_ , vol. 13, pp. 1–50, 2000.
  * [29] D. Bertsimas and M. Sim, “The price of robustness,” _Operations Research_ , vol. 52, pp. 35–53, 02 2004.
  * [30] A. Ben-Tal and A. Nemirovski, “Robust solutions of uncertain linear programs,” _Operations Research Letters_ , vol. 25, no. 1, pp. 1–13, 1999\. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167637799000164
  * [31] L. Wang, M. Han, X. Li, N. Zhang, and H. Cheng, “Review of classification methods on unbalanced data sets,” _IEEE Access_ , vol. 9, pp. 64 606–64 628, 2021.
  * [32] A. Carlevaro and M. Mongelli, “Reliable AI trough SVDD and rule extraction,” _International IFIP Cross Domain (CD) Conference for Machine Learning & Knowledge Extraction (MAKE), CD-MAKE 2021._, 2021.
  * [33] S. Narteni, V. Orani, I. Vaccari, E. Cambiaso, and M. Mongelli, “Sensitivity of logic learning machine for reliability in safety-critical systems,” _IEEE Intelligent Systems_ , pp. 1–1, 2022.
  * [34] J. Bitterwolf, A. Meinke, and M. Hein, “Certifiably adversarially robust detection of out-of-distribution data,” in _Advances in Neural Information Processing Systems_ , H. Larochelle, M. Ranzato, R. Hadsell, M. Balcan, and H. Lin, Eds., vol. 33. Curran Associates, Inc., 2020, pp. 16 085–16 095. [Online]. Available: https://proceedings.neurips.cc/paper/2020/file/b90c46963248e6d7aab1e0f429743ca0-Paper.pdf
  * [35] I. Stepin, J. M. Alonso, A. Catala, and M. Pereira-Fariña, “A survey of contrastive and counterfactual explanation generation methods for explainable artificial intelligence,” _IEEE Access_ , vol. 9, pp. 11 974–12 001, 2021\.
  * [36] A. Carlevaro, M. Lenatti, A. Paglialonga, and M. Mongelli, “Counterfactual building and evaluation via explainable support vector data description,” _IEEE Access_ , vol. 10, pp. 60 849–60 861, 2022.
  * [37] E. Hüllermeier and W. Waegeman, “Aleatoric and epistemic uncertainty in machine learning: an introduction to concepts and methods,” _Machine Learning_ , vol. 110, no. 3, pp. 457–506, mar 2021. [Online]. Available: https://doi.org/10.1007%2Fs10994-021-05946-3
  * [38] T. Alamo, V. Mirasierra, F. Dabbene, and M. Lorenzen, “Safe approximations of chance constrained sets by probabilistic scaling,” in _2019 18th European Control Conference (ECC)_ , 2019, pp. 1380–1385.
  * [39] T. Hofmann, B. Schölkopf, and A. J. Smola, “Kernel methods in machine learning,” _The Annals of Statistics_ , vol. 36, no. 3, jun 2008. [Online]. Available: https://doi.org/10.1214%2F009053607000000677
  * [40] R. Koenker, _Quantile Regression_ , ser. Econometric Society Monographs. Cambridge University Press, 2005.
  * [41] C. Cortes and V. Vapnik, “Support-vector networks,” _Mach. Learn._ , vol. 20, no. 3, p. 273–297, sep 1995. [Online]. Available: https://doi.org/10.1023/A:1022627411411
  * [42] D. M. J. Tax and R. P. W. Duin, “Support vector data description,” _Mach. Learn._ , vol. 54, no. 1, p. 45–66, jan 2004. [Online]. Available: https://doi.org/10.1023/B:MACH.0000008084.60811.49
  * [43] D. Jia, K. Lu, J. Wang, X. Zhang, and X. Shen, “A survey on platoon-based vehicular cyber-physical systems,” _IEEE Communications Surveys & Tutorials_, vol. 18, no. 1, pp. 263–284, 2016.
  * [44] L. Xu, L. Y. Wang, G. Yin, and H. Zhang, “Communication information structures and contents for enhanced safety of highway vehicle platoons,” _IEEE Transactions on Vehicular Technology_ , vol. 63, no. 9, pp. 4206–4220, 2014.
  * [45] S. Santini, A. Salvi, A. S. Valente, A. Pescapé, M. Segata, and R. Lo Cigno, “A consensus-based approach for platooning with intervehicular communications and its validation in realistic scenarios,” _IEEE Transactions on Vehicular Technology_ , vol. 66, no. 3, pp. 1985–1999, 2017.
  * [46] A. Carlevaro and M. Mongelli, “A new SVDD approach to reliable and eXplainable AI,” _IEEE Intelligent Systems_ , vol. in press, pp. 1–1, 2021.
  * [47] A. N. Angelopoulos and S. Bates, “A gentle introduction to conformal prediction and distribution-free uncertainty quantification,” 2021. [Online]. Available: https://arxiv.org/abs/2107.07511
  * [48] G. Shafer and V. Vovk, “A tutorial on conformal prediction,” 2007. [Online]. Available: https://arxiv.org/abs/0706.3188
  * [49] G. Zeni, M. Fontana, and S. Vantini, “Conformal prediction: a unified review of theory and new challenges,” _CoRR_ , vol. abs/2005.07972, 2020. [Online]. Available: https://arxiv.org/abs/2005.07972

|  Alberto Carlevaro (Student Member, IEEE) received the Master Degree in
Applied Mathematics from the University of Genoa, Italy, in 2020 with a
physics-mathematics thesis. He is now a PhD student in electronics at the
Department of Electrical, Electronic and Telecommunications Engineering and
Naval Architecture (DITEN) of the University of Genoa, in collaboration with
CNR-IEIIT and Aitek S.p.A., and now visiting research scholar at EECS
department of UC Berkeley. His current fields of research are Machine
Learning, Statistical Learning, Explainable AI and Physics Informed Machine
Learning.
---|---
|  Fabrizio Dabbene (Senior Member, IEEE) received the Laurea and Ph.D.
degrees from the Politecnico di Torino, Italy, in 1995 and 1999, respectively.
He is currently the Director of Research with the Institute IEIIT, National
Research Council of Italy (CNR), Milan, Italy, where he is coordinates the
Information and Systems Engineering Group. He has held visiting and research
positions with The University of Iowa, Penn State University, and the Russian
Academy of Sciences, Institute of Control Science, Moscow, Russia. He has
authored or coauthored more than 100 research papers and two books. Dr.
Dabbene was an Elected Member of the Board of Governors, from 2014 to 2016. He
has served as the vice president for publications, from 2015 to 2016. He is
currently chairing the IEEE-CSS Italy Chapter. He has also served as an
Associate Editor for Automatica, from 2008 to 2014, and IEEE Transactions on
Automatic Control, from 2008 to 2012. He is also a Senior Editor of the IEEE
Control Systems Society Letters.
---|---
|  Teodoro Alamo (Member, IEEE) was born in Spain in 1968. He received the
M.Eng. degree in telecommunications engineering from the Polytechnic
University of Madrid, Spain, in 1993 and the Ph.D. degree in
telecommunications engineering from the University of Seville, Spain, in 1998.
From 1993 to 2000, he was an Assistant Professor with the Department of System
Engineering and Automatic Control, University of Seville, where he was an
Associate Professor from 2001 to 2010 and has been a Full Professor since
March 2010. He was at the Ecole Nationale Superieure des Télécommunications
(Telecom Paris) from September 1991 to May 1993. Part of his Ph.D. was done at
RWTH Aachen, Alemania, from June to September 1995. He is the author or
coauthor of more than 200 publications including books, book chapters, journal
papers, conference proceedings, and educational books. (google scholar profile
available at http://scholar.google.es/citations?user=W3ZDTkIAAAAJ&hl=en). His
current research interests include decision making, model predictive control,
data-driven methods, randomized algorithms, and optimization strategies.
---|---
|  Maurizio Mongelli (Member, IEEE) obtained his PhD. Degree in Electronics
and Computer Engineering from the University of Genoa in 2004. He worked for
Selex and the Italian Telecommunications Consortium (CNIT) from 2001 until
2010. He is now a researcher at CNR-IEIIT, where he deals with machine
learning applied to health and cyber-physical systems. He is co-author of over
100 international scientific papers, 2 patents and is participating in the SAE
G-34/EUROCAE WG-114 AI in Aviation Committee.
---|---