mlsanityData to 7 Oct 2026

Intriguing Properties of Input-dependent Randomized Smoothing

arXiv 2110.05365 ↗First posted 11 Oct 2021cs.LG cs.AI stat.MLcited by 24

Not on the map. Why?

Abstract (arXiv)

Randomized smoothing is currently considered the state-of-the-art method to obtain certifiably robust classifiers. Despite its remarkable performance, the method is associated with various serious problems such as "certified accuracy waterfalls", certification vs. accuracy trade-off, or even fairness issues. Input-dependent smoothing approaches have been proposed with intention of overcoming these flaws. However, we demonstrate that these methods lack formal guarantees and so the resulting certificates are not justified. We show that in general, the input-dependent smoothing suffers from the curse of dimensionality, forcing the variance function to have low semi-elasticity. On the other hand, we provide a theoretical and practical framework that enables the usage of input-dependent smoothing even in the presence of the curse of dimensionality, under strict restrictions. We present one concrete design of the smoothing variance function and test it on CIFAR10 and MNIST. Our design mitigates some of the problems of classical smoothing and is formally underlined, yet further improvement of the design is still necessary.

Key facts. Cited by 24 papers in the map (data through 7 Oct 2026). Builds on 29 of its 41 references that are in the map. First posted on arXiv 11 Oct 2021.

Builds on

29 of 41 references.

References · 29

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  6. 2016Adversarial Machine Learning at Scalecited by 934
  7. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  8. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  9. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  10. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  11. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  12. 2018Certified Defenses against Adversarial Examplescited by 305
17 more
  1. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  2. 2018Sorting out Lipschitz function approximationcited by 211
  3. 2018Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networkscited by 193
  4. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  5. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  6. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  7. 2021Deep Learning Through the Lens of Example Difficultycited by 139
  8. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  9. 2018On the Robustness of the CVPR 2018 White-Box Adversarial Example Defensescited by 40
  10. 2020Data-Dependent Randomized Smoothingcited by 37
  11. 2020Higher-Order Certification for Randomized Smoothingcited by 36
  12. 2020Expressivity of Deep Neural Networkscited by 31
  13. 2021ANCER: Anisotropic Certification via Sample-wise Volume Maximizationcited by 23
  14. 2020Extensions and limitations of randomized smoothing for robustness guaranteescited by 15
  15. 2020Hidden Cost of Randomized Smoothingcited by 5
  16. 2021Insta-RS: Instance-wise Randomized Smoothing for Improved Robustness and Accuracycited by 5
  17. 2020Analyzing Accuracy Loss in Randomized Smoothing Defensescited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 4; 2023: 6; 2024: 7; 2025: 4; 2026: 3.

24 papers.

Sort:

By area:

  1. 2022Double Sampling Randomized Smoothingcited by 22
  2. 2024Provably Unlearnable Data Examplescited by 18
  3. 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
  4. 2022Robust and Accurate -- Compositional Architectures for Randomized Smoothingcited by 12
  5. 2023Projected Randomized Smoothing for Certified Adversarial Robustnesscited by 11
  6. 2023Hierarchical Randomized Smoothingcited by 9
  7. 2023Multi-scale Diffusion Denoised Smoothingcited by 9
  8. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  9. 2023Understanding Noise-Augmented Training for Randomized Smoothingcited by 7
  10. 2023Rethinking Randomized Smoothing from the Perspective of Scalabilitycited by 3
  11. 2022Smooth-Reduce: Leveraging Patches for Improved Certified Robustnesscited by 1
  12. 2022An Overview and Prospective Outlook on Robust Training and Certification of Machine Learning Modelscited by 1
12 more
  1. 2023Towards Large Certified Radius in Randomized Smoothing using Quasiconcave Optimizationcited by 1
  2. 2024Robust width: A lightweight and certifiable adversarial defensecited by 1
  3. 2024Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothingcited by 1
  4. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
  5. 2025CAMP in the Odyssey: Provably Robust Reinforcement Learning with Certified Radius Maximizationcited by 1
  6. 2025Towards Strong Certified Defense with Universal Asymmetric Randomizationcited by 1
  7. 2026Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticitycited by 1
  8. 2024Variational Randomized Smoothing for Sample-Wise Adversarial Robustnesscited by 0
  9. 2025AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustnesscited by 0
  10. 2025Dual Randomized Smoothing: Beyond Global Noise Variancecited by 0
  11. 2026Clustered Randomized Smoothing for Stochastic Prediction Functionscited by 0
  12. 2026The Geometry of Randomized Smoothing on Feasible Setscited by 0