mlsanityData to 7 Oct 2026

SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustness

arXiv 2111.09277 ↗First posted 17 Nov 2021cs.LG cs.AIcited by 49

Not on the map. Why?

Abstract (arXiv)

Randomized smoothing is currently a state-of-the-art method to construct a certifiably robust classifier from neural networks against ℓ2-adversarial perturbations. Under the paradigm, the robustness of a classifier is aligned with the prediction confidence, i.e., the higher confidence from a smoothed classifier implies the better robustness. This motivates us to rethink the fundamental trade-off between accuracy and robustness in terms of calibrating confidences of a smoothed classifier. In this paper, we propose a simple training scheme, coined SmoothMix, to control the robustness of smoothed classifiers via self-mixup: it trains on convex combinations of samples along the direction of adversarial perturbation for each input. The proposed procedure effectively identifies over-confident, near off-class samples as a cause of limited robustness in case of smoothed classifiers, and offers an intuitive way to adaptively set a new decision boundary between these samples for better robustness. Our experimental results demonstrate that the proposed method can significantly improve the certified ℓ2-robustness of smoothed classifiers compared to existing state-of-the-art robust training methods.

Key facts. Cited by 49 papers in the map (data through 7 Oct 2026). Builds on 56 of its 69 references that are in the map. First posted on arXiv 17 Nov 2021.

Builds on

56 of 69 references.

References · 56

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2017On Calibration of Modern Neural Networkscited by 4,860
  8. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  9. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  10. 2016A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networkscited by 2,362
  11. 2016Concrete Problems in AI Safetycited by 1,582
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
38 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  2. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  4. 2018Robustness May Be at Odds with Accuracycited by 873
  5. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  6. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  7. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  8. 2019Using Self-Supervised Learning Can Improve Model Robustness and Uncertaintycited by 511
  9. 2020Overfitting in adversarially robust deep learningcited by 504
  10. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  11. 2017Regularizing Neural Networks by Penalizing Confident Output Distributionscited by 461
  12. 2019On Evaluating Adversarial Robustnesscited by 442
  13. 2020CSI: Novelty Detection via Contrastive Learning on Distributionally Shifted Instancescited by 441
  14. 2017Training Confidence-calibrated Classifiers for Detecting Out-of-Distribution Samplescited by 389
  15. 2019A Survey of Autonomous Driving: Common Practices and Emerging Technologiescited by 373
  16. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  17. 2018Adversarially Robust Generalization Requires More Datacited by 318
  18. 2019Verified Uncertainty Calibrationcited by 307
  19. 2020Puzzle Mix: Exploiting Saliency and Local Statistics for Optimal Mixupcited by 260
  20. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  21. 2018To Trust Or Not To Trust A Classifiercited by 205
  22. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  23. 2018Spatially Transformed Adversarial Examplescited by 195
  24. 2020How Does Mixup Help With Robustness and Generalization?cited by 193
  25. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  26. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  27. 2021Co-Mixup: Saliency Guided Joint Mixup with Supermodular Diversitycited by 127
  28. 2019Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognitioncited by 123
  29. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  30. 2020SoK: Certified Robustness for Deep Neural Networkscited by 100
  31. 2019Unrestricted Adversarial Examples via Semantic Manipulationcited by 84
  32. 2020Adversarial Vertex Mixup: Toward Better Adversarially Robust Generalizationcited by 73
  33. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  34. 2019Towards neural networks that provably know when they don't knowcited by 69
  35. 2018Training for Faster Adversarial Robustness Verification via Inducing ReLU Stabilitycited by 67
  36. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  37. 2018Provable Robustness of ReLU networks via Maximization of Linear Regionscited by 51
  38. 2019Interpolated Adversarial Training: Achieving Robust Neural Networks without Sacrificing Too Much Accuracycited by 49

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 12; 2023: 15; 2024: 15; 2025: 6; 2026: 1.

49 papers.

Sort:

By area:

  1. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  2. 2022Adversarial Robustness of Deep Neural Networks: A Survey from a Formal Verification Perspectivecited by 41
  3. 2022DensePure: Understanding Diffusion Models towards Adversarial Robustnesscited by 33
  4. 2024Your Diffusion Model is Secretly a Certifiably Robust Classifiercited by 24
  5. 2022Double Sampling Randomized Smoothingcited by 22
  6. 2022Denoising Masked AutoEncoders Help Robust Classificationcited by 21
  7. 2023DiffSmooth: Certifiably Robust Learning via Diffusion Models and Local Smoothingcited by 20
  8. 2024Provably Unlearnable Data Examplescited by 18
  9. 2024A Survey on Mixup Augmentations and Beyondcited by 18
  10. 2023Calibrating Multimodal Learningcited by 17
  11. 2023Adversarial AutoMixupcited by 16
  12. 2023Unlocking Deterministic Robustness Certification on ImageNetcited by 13
37 more
  1. 2023Projected Randomized Smoothing for Certified Adversarial Robustnesscited by 11
  2. 2022Confidence-aware Training of Smoothed Classifiers for Certified Robustnesscited by 9
  3. 2023Multi-scale Diffusion Denoised Smoothingcited by 9
  4. 2022GeoECG: Data Augmentation via Wasserstein Geodesic Perturbation for Robust Electrocardiogram Predictioncited by 8
  5. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
  6. 2022Accelerating Certified Robustness Training via Knowledge Transfercited by 7
  7. 2024Towards Certification of Uncertainty Calibration under Adversarial Attackscited by 5
  8. 2023A Recipe for Improved Certifiable Robustnesscited by 4
  9. 2023Fast Certification of Vision-Language Models Using Incremental Randomized Smoothingcited by 4
  10. 2024Gaussian Loss Smoothing Enables Certified Training with Tight Convex Relaxationscited by 4
  11. 2024SPLITZ: Certifiable Robustness via Split Lipschitz Randomized Smoothingcited by 4
  12. 2023Interpolation for Robust Learning: Data Augmentation on Wasserstein Geodesicscited by 3
  13. 2022A Comparative Study of Confidence Calibration in Deep Learning: From Computer Vision to Medical Imagingcited by 2
  14. 2022Provably Adversarially Robust Nearest Prototype Classifierscited by 2
  15. 2022Multi-head Ensemble of Smoothed Classifiers for Certified Robustnesscited by 2
  16. 2024Certifying Adapters: Enabling and Enhancing the Certification of Classifier Adversarial Robustnesscited by 2
  17. 2024Consistency Purification: Effective and Efficient Diffusion Purification towards Certified Robustnesscited by 2
  18. 2026LipNeXt: Scaling up Lipschitz-based Certified Robustness to Billion-parameter Modelscited by 2
  19. 2022Smooth-Reduce: Leveraging Patches for Improved Certified Robustnesscited by 1
  20. 2023Is Certifying ℓp Robustness Still Worthwhile?cited by 1
  21. 2023Exploring Transferability for Randomized Smoothingcited by 1
  22. 2024Accelerated Smoothing: A Scalable Approach to Randomized Smoothingcited by 1
  23. 2024Certified PEFTSmoothing: Parameter-Efficient Fine-Tuning with Randomized Smoothingcited by 1
  24. 2024Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothingcited by 1
  25. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
  26. 2024Integrating uncertainty quantification into randomized smoothing based robustness guaranteescited by 1
  27. 2025Robust Representation Consistency Model via Contrastive Denoisingcited by 1
  28. 2025CAMP in the Odyssey: Provably Robust Reinforcement Learning with Certified Radius Maximizationcited by 1
  29. 2025Towards Strong Certified Defense with Universal Asymmetric Randomizationcited by 1
  30. 2023[Re] Double Sampling Randomized Smoothingcited by 0
  31. 2023Promoting Robustness of Randomized Smoothing: Two Cost-Effective Approachescited by 0
  32. 2023Provably Cost-Sensitive Adversarial Defense via Randomized Smoothingcited by 0
  33. 2024Certified Causal Defense with Generalizable Robustnesscited by 0
  34. 2024Confidence-aware Denoised Fine-tuning of Off-the-shelf Models for Certified Robustnesscited by 0
  35. 2025CAPMix: Robust KPI Anomaly Detection for AIOps in Noisy and Dynamic Environmentscited by 0
  36. 2025Robustifying Diffusion-Denoised Smoothing Against Covariate Shiftcited by 0
  37. 2025Dual Randomized Smoothing: Beyond Global Noise Variancecited by 0