mlsanityData to 14 Oct 2026

Input-Specific Robustness Certification for Randomized Smoothing

arXiv 2112.12084 ↗First posted 21 Dec 2021cs.CVcited by 11

Not on the map. Why?

Abstract (arXiv)

Although randomized smoothing has demonstrated high certified robustness and superior scalability to other certified defenses, the high computational overhead of the robustness certification bottlenecks the practical applicability, as it depends heavily on the large sample approximation for estimating the confidence interval. In existing works, the sample size for the confidence interval is universally set and agnostic to the input for prediction. This Input-Agnostic Sampling (IAS) scheme may yield a poor Average Certified Radius (ACR)-runtime trade-off which calls for improvement. In this paper, we propose Input-Specific Sampling (ISS) acceleration to achieve the cost-effectiveness for robustness certification, in an adaptive way of reducing the sampling size based on the input characteristic. Furthermore, our method universally controls the certified radius decline from the ISS sample size reduction. The empirical results on CIFAR-10 and ImageNet show that ISS can speed up the certification by more than three times at a limited cost of 0.05 certified radius. Meanwhile, ISS surpasses IAS on the average certified radius across the extensive hyperparameter settings. Specifically, ISS achieves ACR=0.958 on ImageNet (σ=1.0) in 250 minutes, compared to ACR=0.917 by IAS under the same condition. We release our code in urlhttps://github.com/roy-ch/Input-Specific-Certification.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Builds on 28 of its 32 references that are in the map. First posted on arXiv 21 Dec 2021.

Builds on

28 of 32 references.

References · 28

  1. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  5. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  6. 2016Adversarial Machine Learning at Scalecited by 936
  7. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  8. 2017Countering Adversarial Images using Input Transformationscited by 520
  9. 2017Mitigating Adversarial Effects Through Randomizationcited by 383
  10. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  11. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 293
  12. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 282
16 more
  1. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 244
  2. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 205
  3. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 179
  4. 2018Stochastic Activation Pruning for Robust Adversarial Defensecited by 171
  5. 2018Physical Adversarial Examples for Object Detectorscited by 163
  6. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  7. 2018Scaling provable adversarial defensescited by 143
  8. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  9. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  10. 2018AttriGuard: A Practical Defense Against Attribute Inference Attacks via Adversarial Machine Learningcited by 60
  11. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 60
  12. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  13. 2020Certified Defense to Image Transformations via Randomized Smoothingcited by 51
  14. 2020Adversarial robustness via robust low rank representationscited by 14
  15. 2018PeerNets: Exploiting Peer Wisdom Against Adversarial Attackscited by 8
  16. 2020Regularized Training and Tight Certification for Randomized Smoothed Classifier with Provable Robustnesscited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 1; 2024: 5; 2025: 3; 2026: 2.

11 papers.

  1. 2024Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustnesscited by 8
  2. 2024Estimating the Robustness Radius for Randomized Smoothing with 100× Sample Efficiencycited by 4
  3. 2024Privacy-preserving Universal Adversarial Defense for Black-box Modelscited by 3
  4. 2025Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifiercited by 2
  5. 2023Towards Large Certified Radius in Randomized Smoothing using Quasiconcave Optimizationcited by 1
  6. 2024Accelerated Smoothing: A Scalable Approach to Randomized Smoothingcited by 1
  7. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
  8. 2025Randomized Smoothing Meets Vision-Language Modelscited by 1
  9. 2025Principal Eigenvalue Regularization for Improved Worst-Class Certified Robustness of Smoothed Classifierscited by 0
  10. 2026Laplace-Bridged Randomized Smoothing for Fast Certified Robustnesscited by 0
  11. 2026Halt Fast! Early Stopping for Certified Robustnesscited by 0