mlsanityData to 7 Oct 2026

Improved, Deterministic Smoothing for L_1 Certified Robustness

arXiv 2103.10834 ↗First posted 17 Mar 2021cs.LGcited by 39

Not on the map. Why?

Abstract (arXiv)

Randomized smoothing is a general technique for computing sample-dependent robustness guarantees against adversarial attacks for deep classifiers. Prior works on randomized smoothing against L_1 adversarial attacks use additive smoothing noise and provide probabilistic robustness guarantees. In this work, we propose a non-additive and deterministic smoothing method, Deterministic Smoothing with Splitting Noise (DSSN). To develop DSSN, we first develop SSN, a randomized method which involves generating each noisy smoothing sample by first randomly splitting the input space and then returning a representation of the center of the subdivision occupied by the input sample. In contrast to uniform additive smoothing, the SSN certification does not require the random noise components used to be independent. Thus, smoothing can be done effectively in just one dimension and can therefore be efficiently derandomized for quantized data (e.g., images). To the best of our knowledge, this is the first work to provide deterministic "randomized smoothing" for a norm-based adversarial threat model while allowing for an arbitrary classifier (i.e., a deep model) to be used as a base classifier and without requiring an exponential number of smoothing samples. On CIFAR-10 and ImageNet datasets, we provide substantially larger L_1 robustness certificates compared to prior works, establishing a new state-of-the-art. The determinism of our method also leads to significantly faster certificate computation. Code is available at: https://github.com/alevine0/smoothingSplittingNoise

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). Builds on 32 of its 39 references that are in the map. First posted on arXiv 17 Mar 2021.

Builds on

32 of 39 references.

References · 32

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2013Intriguing properties of neural networkscited by 5,114
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  6. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  7. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  8. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  9. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  10. 2018Sorting out Lipschitz function approximationcited by 211
  11. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  12. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 178
20 more
  1. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  2. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  3. 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
  4. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  5. 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
  6. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
  7. 2020Certified Defenses for Adversarial Patchescited by 100
  8. 2020SoK: Certified Robustness for Deep Neural Networkscited by 100
  9. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 97
  10. 2019Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networkscited by 86
  11. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  12. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  13. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 59
  14. 2020Certified Defense to Image Transformations via Randomized Smoothingcited by 51
  15. 2020Second-Order Provable Defenses against Adversarial Attackscited by 39
  16. 2020Higher-Order Certification for Randomized Smoothingcited by 36
  17. 2019Certifiably Robust Interpretation in Deep Learningcited by 35
  18. 2019Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attackscited by 25
  19. 2020PatchGuard: A Provably Robust Defense against Adversarial Patches via Small Receptive Fields and Maskingcited by 13
  20. 2020Deterministic Certification to Adversarial Attacks via Bernstein Polynomial Approximationcited by 1

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 5; 2022: 9; 2023: 12; 2024: 8; 2025: 4; 2026: 1.

39 papers.

Sort:

By area:

  1. 2021Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100cited by 47
  2. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  3. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 39
  4. 2021ANCER: Anisotropic Certification via Sample-wise Volume Maximizationcited by 23
  5. 2022Double Sampling Randomized Smoothingcited by 22
  6. 2022Explicit Tradeoffs between Adversarial and Natural Distributional Robustnesscited by 20
  7. 2021Mutual Adversarial Training: Learning together is better than going alonecited by 17
  8. 2024Robust Yet Efficient Conformal Prediction Setscited by 16
  9. 2023Stability Guarantees for Feature Attributions with Multiplicative Smoothingcited by 14
  10. 2023Projected Randomized Smoothing for Certified Adversarial Robustnesscited by 11
  11. 2023Randomized Message-Interception Smoothing: Gray-box Certificates for Graph Neural Networkscited by 10
  12. 2023Hierarchical Randomized Smoothingcited by 9
27 more
  1. 2023Multi-scale Diffusion Denoised Smoothingcited by 9
  2. 2025Probabilistic Stability Guarantees for Feature Attributionscited by 9
  3. 2022A.I. Robustness: a Human-Centered Perspective on Technological Challenges and Opportunitiescited by 8
  4. 2023Asymmetric Certified Robustness via Feature-Convex Neural Networkscited by 8
  5. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
  6. 2024Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustnesscited by 8
  7. 2022Invariance-Aware Randomized Smoothing Certificatescited by 7
  8. 2025Towards the Worst-case Robustness of Large Language Modelscited by 7
  9. 2022Certifying Model Accuracy under Distribution Shiftscited by 5
  10. 2022(De-)Randomized Smoothing for Decision Stump Ensemblescited by 5
  11. 2024Adversarial Feature Alignment: Balancing Robustness and Accuracy in Deep Learning via Adversarial Trainingcited by 5
  12. 2023Fast Certification of Vision-Language Models Using Incremental Randomized Smoothingcited by 4
  13. 2025Robust Conformal Prediction with a Single Binary Certificatecited by 4
  14. 2022Sound Randomized Smoothing in Floating-Point Arithmeticscited by 2
  15. 2023Exploring Geometry of Blind Spots in Vision Modelscited by 2
  16. 2022Smooth-Reduce: Leveraging Patches for Improved Certified Robustnesscited by 1
  17. 2023Towards Large Certified Radius in Randomized Smoothing using Quasiconcave Optimizationcited by 1
  18. 2023Provable Robustness for Streaming Models with a Sliding Windowcited by 1
  19. 2024Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothingcited by 1
  20. 2024Integrating uncertainty quantification into randomized smoothing based robustness guaranteescited by 1
  21. 2025AuditVotes: Elevating Provable Defense for GNNs with Efficient Augmentation and Conditional Smoothingcited by 1
  22. 2022Provable Adversarial Robustness for Fractional Lp Threat Modelscited by 0
  23. 2023General Lipschitz: Certified Robustness Against Resolvable Semantic Transformations via Transformation-Dependent Randomized Smoothingcited by 0
  24. 2024Optimal Zero-Shot Detector for Multi-Armed Attackscited by 0
  25. 2024Distributional Adversarial Losscited by 0
  26. 2024Certified Adversarial Robustness via Partition-based Randomized Smoothingcited by 0
  27. 2026Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothingcited by 0