J. Jia, X. Cao, and N. Z. Gong, “Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks”, AAAI, vol. 35, no. 9, pp. 7961-7969, May 2021.