We instead propose a tractable upper bound by constructing a set O(z, θ) ⊇ F(z, θ).
note that whenever max O 0-1 (z, θ) = 0, this fact is sufficient to certify robustness to all perturbed examples B perturb (z).