mlsanityData to 14 Oct 2026

Certified Adversarial Robustness via Randomized Smoothing

arXiv 1902.02918 ↗First posted 8 Feb 2019cs.LG stat.MLcited by 1,340

Not on the map. Why?

Cited by 95 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

We show how to turn any classifier that classifies well under Gaussian noise into a new classifier that is certifiably robust to adversarial perturbations under the ℓ2 norm. This "randomized smoothing" technique has been proposed recently in the literature, but existing guarantees are loose. We prove a tight robustness guarantee in ℓ2 norm for smoothing with Gaussian noise. We use randomized smoothing to obtain an ImageNet classifier with e.g. a certified top-1 accuracy of 49% under adversarial perturbations with ℓ2 norm less than 0.5 (=127/255). No certified defense has been shown feasible on ImageNet except for smoothing. On smaller-scale datasets where competing approaches to certified ℓ2 robustness are viable, smoothing delivers higher certified accuracies. Our strong empirical results suggest that randomized smoothing is a promising direction for future research into adversarially robust classification. Code and models are available at http://github.com/locuslab/smoothing.

Key facts. Cited by 1,340 papers in the map (data through 14 Oct 2026). First posted on arXiv 8 Feb 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 249; 2022: 226; 2023: 260; 2024: 234; 2025: 177; 2026: 194.

1,340 papers.

Sort:

By area:

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  2. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  4. 2021Robust fine-tuning of zero-shot modelscited by 797
  5. 2024Diffusion Forcing: Next-token Prediction Meets Full-Sequence Diffusioncited by 681
  6. 2022Diffusion Models for Adversarial Purificationcited by 476
  7. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  8. 2023Detecting Language Model Attacks with Perplexitycited by 431
  9. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 328
  10. 2021Unsolved Problems in ML Safetycited by 292
  11. 2023Certifying LLM Safety against Adversarial Promptingcited by 266
  12. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
38 more
  1. 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
  2. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 232
  3. 2022Extremely Simple Activation Shaping for Out-of-Distribution Detectioncited by 212
  4. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 192
  5. 2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
  6. 2021The Values Encoded in Machine Learning Researchcited by 172
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 172
  8. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 156
  9. 2024Certifiably Robust RAG against Retrieval Corruptioncited by 151
  10. 2024WARM: On the Benefits of Weight Averaged Reward Modelscited by 147
  11. 2021Adversarial purification with Score-based generative modelscited by 134
  12. 2023Open Sesame! Universal Black Box Jailbreaking of Large Language Modelscited by 134
  13. 2022(Certified!!) Adversarial Robustness for Free!cited by 132
  14. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  15. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 120
  16. 2021DropGNN: Random Dropouts Increase the Expressiveness of Graph Neural Networkscited by 118
  17. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  18. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 111
  19. 2021Globally-Robust Neural Networkscited by 108
  20. 2021On the Adversarial Robustness of Vision Transformerscited by 106
  21. 2021Orthogonalizing Convolutional Layers with the Cayley Transformcited by 105
  22. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  23. 2023Federated Learning for Generalization, Robustness, Fairness: A Survey and Benchmarkcited by 99
  24. 2021Trustworthy AI: A Computational Perspectivecited by 93
  25. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  26. 2023A Survey of Safety and Trustworthiness of Large Language Models through the Lens of Verification and Validationcited by 93
  27. 2022Complete Verification via Multi-Neuron Relaxation Guided Branch-and-Boundcited by 92
  28. 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
  29. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  30. 2023A Comprehensive Study on Robustness of Image Classification Models: Benchmarking and Rethinkingcited by 85
  31. 2023Robust Classification via a Single Diffusion Modelcited by 79
  32. 2025Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyondcited by 79
  33. 2024Safeguarding Large Language Models: A Surveycited by 78
  34. 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
  35. 2022What do Vision Transformers Learn? A Visual Explorationcited by 76
  36. 2023DeepZero: Scaling up Zeroth-Order Optimization for Deep Model Trainingcited by 76
  37. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 74
  38. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74

50 most cited of 1,340 All 1,340 (JSON)