mlsanityData to 14 Oct 2026

Boosting Randomized Smoothing with Variance Reduced Classifiers

arXiv 2106.06946 ↗First posted 13 Jun 2021cs.LG cs.AI cs.CVcited by 47

Not on the map. Why?

Abstract (arXiv)

Randomized Smoothing (RS) is a promising method for obtaining robustness certificates by evaluating a base model under noise. In this work, we: (i) theoretically motivate why ensembles are a particularly suitable choice as base models for RS, and (ii) empirically confirm this choice, obtaining state-of-the-art results in multiple settings. The key insight of our work is that the reduced variance of ensembles over the perturbations introduced in RS leads to significantly more consistent classifications for a given input. This, in turn, leads to substantially increased certifiable radii for samples close to the decision boundary. Additionally, we introduce key optimizations which enable an up to 55-fold decrease in sample complexity of RS for predetermined radii, thus drastically reducing its computational overhead. Experimentally, we show that ensembles of only 3 to 10 classifiers consistently improve on their strongest constituting model with respect to their average certified radius (ACR) by 5% to 21% on both CIFAR10 and ImageNet, achieving a new state-of-the-art ACR of 0.86 and 1.11, respectively. We release all code and models required to reproduce our results at https://github.com/eth-sri/smoothing-ensembles.

Key facts. Cited by 47 papers in the map (data through 14 Oct 2026). Builds on 48 of its 82 references that are in the map. First posted on arXiv 13 Jun 2021.

Builds on

48 of 82 references.

References · 48

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  3. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  4. 2016Densely Connected Convolutional Networkscited by 6,720
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  6. 2013Intriguing properties of neural networkscited by 5,155
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  9. 2016Adversarial Machine Learning at Scalecited by 936
  10. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 744
  11. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  12. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
36 more
  1. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  2. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  3. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
  4. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  5. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 328
  6. 2018Certified Defenses against Adversarial Examplescited by 306
  7. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 255
  8. 2017Formal Verification of Piece-Wise Linear Feed-Forward Neural Networkscited by 242
  9. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  10. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 179
  11. 2018Efficient Formal Safety Analysis of Neural Networkscited by 165
  12. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  13. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  14. 2018Decoupling Direction and Norm for Efficient Gradient-Based L2 Adversarial Attacks and Defensescited by 109
  15. 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 108
  16. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  17. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  18. 2020Enabling certification of verification-agnostic networks via memory-efficient semidefinite programmingcited by 66
  19. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  20. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 60
  21. 2020Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbationcited by 57
  22. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  23. 2020Efficient Robustness Certificates for Discrete Data: Sparsity-Aware Randomized Smoothing for Graphs, Images and Morecited by 56
  24. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  25. 2020Certified Defense to Image Transformations via Randomized Smoothingcited by 51
  26. 2020TSS: Transformation-Specific Smoothing for Robustness Certificationcited by 49
  27. 2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
  28. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  29. 2020Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Frameworkcited by 46
  30. 2020Higher-Order Certification for Randomized Smoothingcited by 37
  31. 2020Certifying Confidence via Randomized Smoothingcited by 36
  32. 2020Certified Robustness of Community Detection against Adversarial Structural Perturbation via Randomized Smoothingcited by 29
  33. 2020Certified Robustness of Graph Classification against Topology Attack with Randomized Smoothingcited by 12
  34. 2020Enhancing Certified Robustness via Smoothed Weighted Ensemblingcited by 7
  35. 2021Dynamic Defense Approach for Adversarial Robustness in Deep Neural Networks via Stochastic Ensemble Smoothed Modelcited by 4
  36. 2018Quit When You Can: Efficient Evaluation of Ensembles with Ordering Optimizationcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 2; 2022: 8; 2023: 13; 2024: 14; 2025: 6; 2026: 4.

47 papers.

Sort:

By area:

  1. 2022(Certified!!) Adversarial Robustness for Free!cited by 132
  2. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustnesscited by 33
  3. 2021Boosting the Certified Robustness of L-infinity Distance Netscited by 24
  4. 2024Your Diffusion Model is Secretly a Certifiably Robust Classifiercited by 24
  5. 2022Denoising Masked AutoEncoders Help Robust Classificationcited by 21
  6. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  7. 2021CC-Cert: A Probabilistic Approach to Certify General Robustness of Neural Networkscited by 19
  8. 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
  9. 2023Incremental Randomized Smoothing Certificationcited by 12
  10. 2022XRand: Differentially Private Defense against Explanation-Guided Attackscited by 11
  11. 2023TAPS: Connecting Certified and Adversarial Trainingcited by 11
  12. 2023Revisiting Deep Ensemble for Out-of-Distribution Detection: A Loss Landscape Perspectivecited by 10
35 more
  1. 2023Hierarchical Randomized Smoothingcited by 9
  2. 2023Multi-scale Diffusion Denoised Smoothingcited by 9
  3. 2023The Lipschitz-Variance-Margin Tradeoff for Enhanced Randomized Smoothingcited by 8
  4. 2024Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustnesscited by 8
  5. 2023Augment then Smooth: Reconciling Differential Privacy with Certified Robustnesscited by 6
  6. 2022(De-)Randomized Smoothing for Decision Stump Ensemblescited by 5
  7. 2024Gaussian Loss Smoothing Enables Certified Training with Tight Convex Relaxationscited by 4
  8. 2024SPLITZ: Certifiable Robustness via Split Lipschitz Randomized Smoothingcited by 4
  9. 2023Few-shot Classification via Ensemble Learning with Multi-Order Statisticscited by 3
  10. 2023Rethinking Randomized Smoothing from the Perspective of Scalabilitycited by 3
  11. 2022Multi-head Ensemble of Smoothed Classifiers for Certified Robustnesscited by 2
  12. 2023Certifying Ensembles: A General Certification Theory with S-Lipschitznesscited by 2
  13. 2024COMMIT: Certifying Robustness of Multi-Sensor Fusion Systems against Semantic Attackscited by 2
  14. 2024Certifying Adapters: Enabling and Enhancing the Certification of Classifier Adversarial Robustnesscited by 2
  15. 2024Consistency Purification: Effective and Efficient Diffusion Purification towards Certified Robustnesscited by 2
  16. 2025AuditVotes: Elevating Provable Defense for GNNs with Efficient Augmentation and Conditional Smoothingcited by 2
  17. 2025Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifiercited by 2
  18. 2022Smooth-Reduce: Leveraging Patches for Improved Certified Robustnesscited by 1
  19. 2022Learning Robust Kernel Ensembles with Kernel Average Poolingcited by 1
  20. 2023Exploring Transferability for Randomized Smoothingcited by 1
  21. 2024Certified PEFTSmoothing: Parameter-Efficient Fine-Tuning with Randomized Smoothingcited by 1
  22. 2024CR-UTP: Certified Robustness against Universal Text Perturbations on Large Language Modelscited by 1
  23. 2024Boosting Certified Robustness for Time Series Classification with Efficient Self-Ensemblecited by 1
  24. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
  25. 2024Integrating uncertainty quantification into randomized smoothing based robustness guaranteescited by 1
  26. 2025Robust Representation Consistency Model via Contrastive Denoisingcited by 1
  27. 2025Towards Strong Certified Defense with Universal Asymmetric Randomizationcited by 1
  28. 2026Fortifying Time Series: DTW-Certified Robust Anomaly Detectioncited by 1
  29. 2023Promoting Robustness of Randomized Smoothing: Two Cost-Effective Approachescited by 0
  30. 2024Confidence-aware Denoised Fine-tuning of Off-the-shelf Models for Certified Robustnesscited by 0
  31. 2025Principal Eigenvalue Regularization for Improved Worst-Class Certified Robustness of Smoothed Classifierscited by 0
  32. 2025Dual Randomized Smoothing: Beyond Global Noise Variancecited by 0
  33. 2026Laplace-Bridged Randomized Smoothing for Fast Certified Robustnesscited by 0
  34. 2026Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spacescited by 0
  35. 2026Halt Fast! Early Stopping for Certified Robustnesscited by 0