The eleventh member of the Tsetlin Machine family (TM, GTM, HTM, HGTM, THGTM, RGTM, CCTM, DiTM, ConfTM, FedTM).

---

RobTM equips any Tsetlin Machine with three first-class outputs:

• Per-sample certified flip-distance radius $\rho(x)$: the exact minimum number of feature flips required to change the prediction.
• Adversarial training (PGD-analog): Type-I/II feedback augmented with greedy flip-attack samples.
• Predict-or-abstain machinery: a CertifiedPredictor that refuses to predict when $\rho(x) < \tau$.

Plus a conformal-robust composition that bridges RobTM with ConfTM: prediction sets whose members all have certified radius $\geq \tau$.

The paper is at paper/robtm.pdf.

Quick start

pip install -e .
pytest -q tests/         # 8 unit tests (7 pass + 1 conditional skip), ~20s
make reproduce           # all 3 experiments, ~5 min on CPU
make paper               # build paper/robtm.pdf

What's in the box

Path	Purpose
robtm/ta.py	Canonical Tsetlin Automaton bank
robtm/tm.py	Binary + multi-class Tsetlin Machine
robtm/attack.py	Flip-distance attacks (exact enumeration + greedy descent)
robtm/verify.py	Per-sample certified radius computation
robtm/training.py	Adversarial (PGD-analog) training
robtm/robust.py	CertifiedPredictor with abstention
robtm/conformal.py	RobConfTM: ConfTM + certificate filtering
robtm/data.py	Bundled medical-risk dataset
tests/	8 unit tests, all green/skipped
experiments/attack_accuracy.py	Std vs RobTM under flip attacks
experiments/certified_radius.py	Radius distribution histogram
experiments/selective_prediction.py	CertifiedPredictor tradeoff curves
scripts/make_figures.py	Build every figure from results/*.json
paper/robtm.tex, references.bib	Paper source
paper/figures/*.pdf	Figures from real data

Headline results (honest reading)

Experiment	Result	Interpretation
Clean accuracy (medical-risk)	std 0.944 / RobTM 0.938	Both train fine
Robust accuracy at $\epsilon_{attack}=1$	std 0.018 / RobTM 0.009	Both highly fragile to single flip
Robust accuracy at $\epsilon_{attack}\geq 2$	both 0.000	Universally vulnerable
Certified radius distribution (medical-risk)	276/277 samples have $\rho=1$	Inherent flip-fragility on dense task
Selective prediction (med-risk, $\tau=2$)	coverage 1-2% / acc 0-100%	Too pessimistic on dense task
Selective prediction (XOR-pairs, $\tau=2$)	34% coverage / 83% selective acc	Mechanism works on tasks with richer radius
Receipt-style certificate latency	~0.05 ms per sample at $d=10$, $B=3$	Cheap

Honest limitations

The contribution is the certificate + abstention machinery, not robust-accuracy gains from adversarial training. Section 6 of the paper is explicit about three sharper mechanisms (margin-based clause regularisation, multi-clause majority voting, GraphTM depth) that may close the empirical gap on dense tabular tasks.

• Adversarial training does not help on dense tabular. Real and documented; PGD-analog is implemented correctly but underlying clause representations centred on a few load-bearing features inherit the brittleness.
• Verifier scaling. Exact enumeration is tractable up to $d \approx 14$, budget 4. Greedy fallback for larger.
• Synthetic data. Real benchmarks (Adult-Income, MIMIC-IV) are future work.
• Binary features only. Continuous-feature $\ell_\infty$ attacks not addressed.
• No hardware co-design. Verifier-on-ASIC unmeasured.

License

MIT.

Citing

@misc{debes2026robtm,
  title  = {RobTM: An Adversarially-Robust Tsetlin Machine with
            Certified Flip-Distance Radius},
  author = {Debes, Anwar},
  year   = {2026},
  note   = {Reference implementation v0.1, May 2026}
}