mlsanityData to 14 Oct 2026

Randomized Smoothing under Attack: How Good is it in Pratice?

arXiv 2204.14187 ↗First posted 28 Apr 2022cs.CR cs.AI cs.LGcited by 7

Not on the map. Why?

Abstract (arXiv)

Randomized smoothing is a recent and celebrated solution to certify the robustness of any classifier. While it indeed provides a theoretical robustness against adversarial attacks, the dimensionality of current classifiers necessarily imposes Monte Carlo approaches for its application in practice. This paper questions the effectiveness of randomized smoothing as a defense, against state of the art black-box attacks. This is a novel perspective, as previous research works considered the certification as an unquestionable guarantee. We first formally highlight the mismatch between a theoretical certification and the practice of attacks on classifiers. We then perform attacks on randomized smoothing as a defense. Our main observation is that there is a major mismatch in the settings of the RS for obtaining high certified robustness or when defeating black box attacks while preserving the classifier accuracy.

Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Builds on 18 of its 22 references that are in the map. First posted on arXiv 28 Apr 2022.

Builds on

18 of 22 references.

References · 18

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  5. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  6. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  7. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 333
  8. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  9. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 104
  10. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 96
  11. 2020GeoDA: a geometric framework for black-box adversarial attackscited by 66
  12. 2020SurFree: a fast surrogate-free black-box attackcited by 60
6 more
  1. 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
  2. 2019Walking on the Edge: Fast, Low-Distortion Adversarial Examplescited by 18
  3. 2021Adversarial defense for automatic speaker verification by cascaded self-supervised learning modelscited by 16
  4. 2020Extensions and limitations of randomized smoothing for robustness guaranteescited by 15
  5. 2020Adversarial defense for deep speaker recognition using hybrid adversarial trainingcited by 5
  6. 2021Adversarial Examples Detection beyond Image Spacecited by 5

Built on by

Cited by year

Citing papers per year: 2022: 1; 2023: 2; 2024: 2; 2025: 2.

7 papers.

  1. 2023Projected Randomized Smoothing for Certified Adversarial Robustnesscited by 11
  2. 2025Cert-SSBD: Certified Backdoor Defense with Sample-Specific Smoothing Noisescited by 4
  3. 2025Bridging the Theoretical Gap in Randomized Smoothingcited by 2
  4. 2022FBI: Fingerprinting models with Benign Inputscited by 1
  5. 2024Classification-Denoising Networkscited by 1
  6. 2023A Minimax Approach Against Multi-Armed Adversarial Attacks Detectioncited by 0
  7. 2024Certified Adversarial Robustness via Partition-based Randomized Smoothingcited by 0