# Denoised Smoothing: A Provable Defense for Pretrained Classifiers

arXiv: https://arxiv.org/abs/2003.01908 · HTML: https://mlsanity.com/paper/2003.01908/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 Mar 2020.

## Built on by (most cited first, 8 of 8)

- [On the Certified Robustness for Ensemble Models and Beyond](https://mlsanity.com/paper/2107.10873/) (2021)
- [Better May Not Be Fairer: A Study on Subgroup Discrepancy in Image Classification](https://mlsanity.com/paper/2212.08649/) (2022)
- [Understanding Noise-Augmented Training for Randomized Smoothing](https://mlsanity.com/paper/2305.04746/) (2023)
- [DiffAug: A Diffuse-and-Denoise Augmentation for Training Robust Classifiers](https://mlsanity.com/paper/2306.09192/) (2023)
- [CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Models](https://mlsanity.com/paper/2406.01873/) (2024)
- [Fortifying Time Series: DTW-Certified Robust Anomaly Detection](https://mlsanity.com/paper/2605.07690/) (2026)
- [Learning Representations Robust to Group Shifts and Adversarial Examples](https://mlsanity.com/paper/2202.09446/) (2022)
- [Stochastic BIQA: Median Randomized Smoothing for Certified Blind Image Quality Assessment](https://mlsanity.com/paper/2411.12575/) (2024)

## Abstract (arXiv)

We present a method for provably defending any pretrained image classifier against ℓp adversarial attacks. This method, for instance, allows public vision API providers and users to seamlessly convert pretrained non-robust classification services into provably robust ones. By prepending a custom-trained denoiser to any off-the-shelf image classifier and using randomized smoothing, we effectively create a new classifier that is guaranteed to be ℓp-robust to adversarial examples, without modifying the pretrained classifier. Our approach applies to both the white-box and the black-box settings of the pretrained classifier. We refer to this defense as denoised smoothing, and we demonstrate its effectiveness through extensive experimentation on ImageNet and CIFAR-10. Finally, we use our approach to provably defend the Azure, Google, AWS, and ClarifAI image classification APIs. Our code replicating all the experiments in the paper can be found at: https://github.com/microsoft/denoised-smoothing.