mlsanityData to 7 Oct 2026

Certified Robustness to Adversarial Examples with Differential Privacy

arXiv 1802.03471 ↗First posted 9 Feb 2018stat.ML cs.AI cs.CRcited by 462

Not on the map. Why?

Cited by 20 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set of certified defenses have been introduced, which provide guarantees of robustness to norm-bounded attacks, but they either do not scale to large datasets or are limited in the types of models they can support. This paper presents the first certified defense that both scales to large networks and datasets (such as Google's Inception network for ImageNet) and applies broadly to arbitrary model types. Our defense, called PixelDP, is based on a novel connection between robustness against adversarial examples and differential privacy, a cryptographically-inspired formalism, that provides a rigorous, generic, and flexible foundation for defense.

Key facts. Cited by 462 papers in the map (data through 7 Oct 2026). First posted on arXiv 9 Feb 2018.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 122; 2022: 100; 2023: 85; 2024: 64; 2025: 42; 2026: 49.

462 papers.

Sort:

By area:

  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  2. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  3. 2021Membership Inference Attacks on Machine Learning: A Surveycited by 306
  4. 2021Unsolved Problems in ML Safetycited by 291
  5. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  6. 2021Trustworthy AI: From Principles to Practicescited by 206
  7. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  8. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  9. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  10. 2021Globally-Robust Neural Networkscited by 106
  11. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  12. 2022Membership Inference Attacks by Exploiting Loss Trajectorycited by 93
38 more
  1. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  2. 2021Large Scale Private Learning via Low-rank Reparametrizationcited by 87
  3. 2021ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Modelscited by 79
  4. 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
  5. 2021Skew Orthogonal Convolutionscited by 67
  6. 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 64
  7. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  8. 2023Fourier-DeepONet: Fourier-enhanced deep operator networks for full waveform inversion with improved accuracy, generalizability, and robustnesscited by 60
  9. 2021A Dynamical System Perspective for Lipschitz Neural Networkscited by 59
  10. 2021Certified Robustness to Text Adversarial Attacks by Randomized [MASK]cited by 57
  11. 2021Handcrafted Backdoors in Deep Neural Networkscited by 57
  12. 2021Natural Language Understanding with Privacy-Preserving BERTcited by 54
  13. 2022Mixed Differential Privacy in Computer Visioncited by 53
  14. 2022Certified Training: Small Boxes are All You Needcited by 51
  15. 2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
  16. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  17. 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 48
  18. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  19. 2021Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100cited by 47
  20. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
  21. 2021Fast Certified Robust Training with Short Warmupcited by 45
  22. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 44
  23. 2021CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothingcited by 41
  24. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  25. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  26. 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
  27. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
  28. 2022Certified Neural Network Watermarks with Randomized Smoothingcited by 39
  29. 2021Adversarial Training Helps Transfer Learning via Better Representationscited by 36
  30. 2021Scalable Certified Segmentation via Randomized Smoothingcited by 35
  31. 2021Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descentcited by 34
  32. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustnesscited by 33
  33. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 32
  34. 2021Attacking Adversarial Attacks as A Defensecited by 31
  35. 2021Improving Contrastive Learning on Imbalanced Seed Data via Open-World Samplingcited by 30
  36. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  37. 2021Deep Learning-Based Autonomous Driving Systems: A Survey of Attacks and Defensescited by 29
  38. 2021Practical Defences Against Model Inversion Attacks for Split Neural Networkscited by 29

50 most cited of 462 All 462 (JSON)