mlsanityData to 7 Oct 2026

Center Smoothing: Certified Robustness for Networks with Structured Outputs

arXiv 2102.09701 ↗First posted 19 Feb 2021cs.LGcited by 18

Not on the map. Why?

Abstract (arXiv)

The study of provable adversarial robustness has mostly been limited to classification tasks and models with one-dimensional real-valued outputs. We extend the scope of certifiable robustness to problems with more general and structured outputs like sets, images, language, etc. We model the output space as a metric space under a distance/similarity function, such as intersection-over-union, perceptual similarity, total variation distance, etc. Such models are used in many machine learning problems like image segmentation, object detection, generative models, image/audio-to-text systems, etc. Based on a robustness technique called randomized smoothing, our textitcenter smoothing procedure can produce models with the guarantee that the change in the output, as measured by the distance metric, remains small for any norm-bounded adversarial perturbation of the input. We apply our method to create certifiably robust models with disparate output spaces - from sets to images - and show that it yields meaningful certificates without significantly degrading the performance of the base model. Code for our experiments is available at: https://github.com/aounon/center-smoothing.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Builds on 50 of its 68 references that are in the map. First posted on arXiv 19 Feb 2021.

Builds on

50 of 68 references.

References · 50

  1. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  6. 2018Large Scale GAN Training for High Fidelity Natural Image Synthesiscited by 2,609
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  9. 2016Adversarial Machine Learning at Scalecited by 934
  10. 2016Joint Face Detection and Alignment using Multi-task Cascaded Convolutional Networkscited by 895
  11. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  12. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
38 more
  1. 2017Countering Adversarial Images using Input Transformationscited by 517
  2. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  3. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  4. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  5. 2017Adversarial Attacks on Neural Network Policiescited by 314
  6. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  7. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  8. 2019Adversarial Policies: Attacking Deep Reinforcement Learningcited by 209
  9. 2017On the (Statistical) Detection of Adversarial Examplescited by 180
  10. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  11. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
  12. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  13. 2017Robust Deep Reinforcement Learning with Adversarial Attackscited by 152
  14. 2017On the Robustness of Semantic Segmentation Models to Adversarial Attackscited by 126
  15. 2020Certified Defenses for Adversarial Patchescited by 100
  16. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 97
  17. 2017Vulnerability of Deep Reinforcement Learning to Policy Induction Attackscited by 91
  18. 2019Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagationcited by 87
  19. 2019Functional Adversarial Attackscited by 82
  20. 2016Adversarial Examples Detection in Deep Networks with Convolutional Filter Statisticscited by 77
  21. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  22. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 59
  23. 2017Adversarial examples for generative modelscited by 58
  24. 2017Adversarial and Clean Data Are Not Twinscited by 52
  25. 2018Training verified learners with learned verifierscited by 50
  26. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  27. 2020Second-Order Provable Defenses against Adversarial Attackscited by 39
  28. 2018Attacks on State-of-the-Art Face Recognition using Attentional Adversarial Attack Generative Networkcited by 38
  29. 2019Evaluating Robustness of Deep Image Super-Resolution against Adversarial Attackscited by 37
  30. 2020Certifying Confidence via Randomized Smoothingcited by 36
  31. 2019Cubic LSTMs for Video Predictioncited by 32
  32. 2019Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attackscited by 25
  33. 2020Improving Robustness of Deep-Learning-Based Image Reconstructioncited by 23
  34. 2020Tight Second-Order Certificates for Randomized Smoothingcited by 10
  35. 2019Robustness Certificates Against Adversarial Examples for ReLU Networkscited by 6
  36. 2017Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioningcited by 5
  37. 2020Adversarial Attacks against Face Recognition: A Comprehensive Studycited by 5
  38. 2020Adversarial Attack on Facial Recognition using Visible Lightcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 4; 2023: 6; 2024: 3; 2025: 1; 2026: 3.

18 papers.

Sort:

By area:

  1. 2023Certifying LLM Safety against Adversarial Promptingcited by 248
  2. 2021Latent Space Smoothing for Individually Fair Representationscited by 18
  3. 2023LipSim: A Provably Robust Perceptual Similarity Metriccited by 15
  4. 2024Endowing Pre-trained Graph Models with Provable Fairnesscited by 10
  5. 2022Invariance-Aware Randomized Smoothing Certificatescited by 7
  6. 2022Certifying Model Accuracy under Distribution Shiftscited by 5
  7. 2022Smoothed Embeddings for Certified Few-Shot Learningcited by 5
  8. 2023Training on Foveated Images Improves Robustness to Adversarial Attackscited by 5
  9. 2024Adaptive Hierarchical Certification for Segmentation using Randomized Smoothingcited by 3
  10. 2022Robustness of Unsupervised Representation Learning without Labelscited by 2
  11. 2023Towards Better Certified Segmentation via Diffusion Modelscited by 2
  12. 2023Provable Robustness for Streaming Models with a Sliding Windowcited by 1
6 more
  1. 2024Certified ℓ2 Attribution Robustness via Uniformly Smoothed Attributionscited by 1
  2. 2026PRA-RAG: Provably Robust Aggregation in Retrieval-Augmented Generation against Retrieval Corruptioncited by 1
  3. 2023Fixed Inter-Neuron Covariability Induces Adversarial Robustnesscited by 0
  4. 2025FairExpand: Individual Fairness on Graphs with Partial Similarity Informationcited by 0
  5. 2026Feature-Space Smoothing: Certified Robustness of Deep Representationscited by 0
  6. 2026Psychoacoustically Aligned Latent Smoothing for Adversarial Robustness of Full-Duplex Speech-to-Speech Dialogue Modelscited by 0