mlsanityData to 7 Oct 2026

Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers

arXiv 1906.04584 ↗First posted 9 Jun 2019cs.LG cs.CR stat.MLcited by 328

Not on the map. Why?

Abstract (arXiv)

Recent works have shown the effectiveness of randomized smoothing as a scalable technique for building neural network-based classifiers that are provably robust to ℓ2-norm adversarial perturbations. In this paper, we employ adversarial training to improve the performance of randomized smoothing. We design an adapted attack for smoothed classifiers, and we show how this attack can be used in an adversarial training setting to boost the provable robustness of smoothed classifiers. We demonstrate through extensive experimentation that our method consistently outperforms all existing provably ℓ2-robust classifiers by a significant margin on ImageNet and CIFAR-10, establishing the state-of-the-art for provable ℓ2-defenses. Moreover, we find that pre-training and semi-supervised learning boost adversarially trained smoothed classifiers even further. Our code and trained models are available at http://github.com/Hadisalman/smoothing-adversarial .

Key facts. Cited by 328 papers in the map (data through 7 Oct 2026). First posted on arXiv 9 Jun 2019.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 74; 2022: 71; 2023: 59; 2024: 60; 2025: 32; 2026: 32.

328 papers.

Sort:

By area:

  1. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  2. 2021Robust fine-tuning of zero-shot modelscited by 785
  3. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  4. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  5. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  6. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
  7. 2021Adversarial purification with Score-based generative modelscited by 132
  8. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  9. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  10. 2021Globally-Robust Neural Networkscited by 106
  11. 2021PRIMA: General and Precise Neural Network Certification via Scalable Convex Hull Approximationscited by 77
  12. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 75
38 more
  1. 2021FuseDream: Training-Free Text-to-Image Generation with Improved CLIP+GAN Space Optimizationcited by 71
  2. 2024Defending Large Language Models against Jailbreak Attacks via Semantic Smoothingcited by 68
  3. 2021Skew Orthogonal Convolutionscited by 67
  4. 2021Training Certifiably Robust Neural Networks with Efficient Local Lipschitz Boundscited by 64
  5. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
  6. 2021A Dynamical System Perspective for Lipschitz Neural Networkscited by 59
  7. 2023A Unified Algebraic Perspective on Lipschitz Neural Networkscited by 58
  8. 2022Planting Undetectable Backdoors in Machine Learning Modelscited by 55
  9. 2021Boosting Adversarial Transferability through Enhanced Momentumcited by 53
  10. 2022Certified Training: Small Boxes are All You Needcited by 51
  11. 2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
  12. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  13. 2022Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspectivecited by 48
  14. 2021Boosting Randomized Smoothing with Variance Reduced Classifierscited by 47
  15. 2021Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100cited by 47
  16. 2021Random Noise Defense Against Query-Based Black-Box Attackscited by 46
  17. 2021Fast Certified Robust Training with Short Warmupcited by 45
  18. 2021Certified Patch Robustness via Smoothed Vision Transformerscited by 44
  19. 2021Constrained Learning with Non-Convex Lossescited by 42
  20. 2021CROP: Certifying Robust Policies for Reinforcement Learning through Functional Smoothingcited by 41
  21. 2021Towards Certifying L-infinity Robustness using Neural Networks with L-inf-dist Neuronscited by 40
  22. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  23. 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
  24. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
  25. 2021Adversarial Robustness with Semi-Infinite Constrained Learningcited by 39
  26. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  27. 2021Scalable Certified Segmentation via Randomized Smoothingcited by 35
  28. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustnesscited by 33
  29. 2024Understanding and Improving Training-free Loss-based Diffusion Guidancecited by 31
  30. 2021DetectorGuard: Provably Securing Object Detectors against Localized Patch Hiding Attackscited by 28
  31. 2022Benchmarking Adversarially Robust Quantum Machine Learning at Scalecited by 28
  32. 2021Enhancing Adversarial Robustness via Test-time Transformation Ensemblingcited by 27
  33. 2024Provably Robust Conformal Prediction with Improved Efficiencycited by 27
  34. 2023Towards quantum enhanced adversarial robustness in machine learningcited by 26
  35. 2022COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attackscited by 25
  36. 2022Explicit Regularization in Overparametrized Models via Noise Injectioncited by 25
  37. 2023Probabilistically robust conformal predictioncited by 25
  38. 2021Adversarially Robust Learning with Unknown Perturbation Setscited by 24

50 most cited of 328 All 328 (JSON)