subscript

The passage around this formula

A universally quantified guarantee over a bounded region is the shape of what such a proof states. For a system f , an input $x_0$ , a perturbation radius $\epsilon$ , and a safe output region S , the property being proved typically has the form $\forall\, x \in B_\epsilon(x_0): \quad f(x) \in S$. read as: for every input within radius $\epsilon$ of $x_0$ , the system’s output stays inside the safe region. That “for every” is doing all the work, and it is exactly what no classifier bypass rate and no red-team hour count can claim — those are statements about a sample of inputs that were tried, not about the full set that could be.

Read this part in the article →