# Extensions and limitations of randomized smoothing for robustness guarantees

arXiv: https://arxiv.org/abs/2006.04208 · HTML: https://mlsanity.com/paper/2006.04208/

## Key facts

- Cited by 15 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Jun 2020.

## Built on by (most cited first, 15 of 15)

- [Intriguing Properties of Input-dependent Randomized Smoothing](https://mlsanity.com/paper/2110.05365/) (2021)
- [GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothing](https://mlsanity.com/paper/2206.04310/) (2022)
- [Double Sampling Randomized Smoothing](https://mlsanity.com/paper/2206.07912/) (2022)
- [DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothing](https://mlsanity.com/paper/2308.14333/) (2023)
- [Input-agnostic Certified Group Fairness via Gaussian Parameter Smoothing](https://mlsanity.com/paper/2206.11423/) (2022)
- [CARE: Certifiably Robust Learning with Reasoning via Variational Inference](https://mlsanity.com/paper/2209.05055/) (2022)
- [ε-weakened Robustness of Deep Neural Networks](https://mlsanity.com/paper/2110.15764/) (2021)
- [Randomized Smoothing under Attack: How Good is it in Pratice?](https://mlsanity.com/paper/2204.14187/) (2022)
- [Certified Policy Smoothing for Cooperative Multi-Agent Reinforcement Learning](https://mlsanity.com/paper/2212.11746/) (2022)
- [Rethinking Adversarial Policies: A Generalized Attack Formulation and Provable Defense in RL](https://mlsanity.com/paper/2305.17342/) (2023)
- [Certified Robustness via Randomized Smoothing over Multiplicative Parameters of Input Transformations](https://mlsanity.com/paper/2106.14432/) (2021)
- [Certification of Speaker Recognition Models to Additive Perturbations](https://mlsanity.com/paper/2404.18791/) (2024)
- [Towards Evading the Limits of Randomized Smoothing: A Theoretical Analysis](https://mlsanity.com/paper/2206.01715/) (2022)
- [Towards Better Certified Segmentation via Diffusion Models](https://mlsanity.com/paper/2306.09949/) (2023)
- [[Re] Double Sampling Randomized Smoothing](https://mlsanity.com/paper/2306.15221/) (2023)

## Abstract (arXiv)

Randomized smoothing, a method to certify a classifier's decision on an input is invariant under adversarial noise, offers attractive advantages over other certification methods. It operates in a black-box and so certification is not constrained by the size of the classifier's architecture. Here, we extend the work of Li et al. citeli2018second, studying how the choice of divergence between smoothing measures affects the final robustness guarantee, and how the choice of smoothing measure itself can lead to guarantees in differing threat models. To this end, we develop a method to certify robustness against any ℓp (p∈mathbbN>0) minimized adversarial perturbation. We then demonstrate a negative result, that randomized smoothing suffers from the curse of dimensionality; as p increases, the effective radius around an input one can certify vanishes.