mlsanityData to 7 Oct 2026

Double Sampling Randomized Smoothing

arXiv 2206.07912 ↗First posted 16 Jun 2022cs.LG cs.CR math.STcited by 22

Not on the map. Why?

Abstract (arXiv)

Neural networks (NNs) are known to be vulnerable against adversarial perturbations, and thus there is a line of work aiming to provide robustness certification for NNs, such as randomized smoothing, which samples smoothing noises from a certain distribution to certify the robustness for a smoothed classifier. However, as shown by previous work, the certified robust radius in randomized smoothing suffers from scaling to large datasets ("curse of dimensionality"). To overcome this hurdle, we propose a Double Sampling Randomized Smoothing (DSRS) framework, which exploits the sampled probability from an additional smoothing distribution to tighten the robustness certification of the previous smoothed classifier. Theoretically, under mild assumptions, we prove that DSRS can certify Theta(√ d) robust radius under ℓ2 norm where d is the input dimension, implying that DSRS may be able to break the curse of dimensionality of randomized smoothing. We instantiate DSRS for a generalized family of Gaussian smoothing and propose an efficient and sound computing method based on customized dual optimization considering sampling error. Extensive experiments on MNIST, CIFAR-10, and ImageNet verify our theory and show that DSRS certifies larger robust radii than existing baselines consistently under different settings. Code is available at https://github.com/llylly/DSRS.

Key facts. Cited by 22 papers in the map (data through 7 Oct 2026). Builds on 39 of its 66 references that are in the map. First posted on arXiv 16 Jun 2022.

Builds on

39 of 66 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  5. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  9. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  10. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  11. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  12. 2018Certified Defenses against Adversarial Examplescited by 305
27 more
  1. 2021Adversarial GLUE: A Multi-Task Benchmark for Robustness Evaluation of Language Modelscited by 227
  2. 2019Algorithms for Verifying Deep Neural Networkscited by 221
  3. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  4. 2018Certified Adversarial Robustness with Additive Noisecited by 178
  5. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  6. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  7. 2020QEBA: Query-Efficient Boundary-Based Blackbox Attackcited by 103
  8. 2019SemanticAdv: Generating Adversarial Examples via Attribute-conditional Image Editingcited by 93
  9. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  10. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  11. 2021Introduction to Neural Network Verificationcited by 63
  12. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  13. 2020TSS: Transformation-Specific Smoothing for Robustness Certificationcited by 49
  14. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  15. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  16. 2020Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Frameworkcited by 45
  17. 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
  18. 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
  19. 2020Data-Dependent Randomized Smoothingcited by 37
  20. 2020Certifying Confidence via Randomized Smoothingcited by 36
  21. 2020Random Smoothing Might be Unable to Certify ℓ_∞ Robustness for High-Dimensional Imagescited by 35
  22. 2021Intriguing Properties of Input-dependent Randomized Smoothingcited by 24
  23. 2021ANCER: Anisotropic Certification via Sample-wise Volume Maximizationcited by 23
  24. 2020Extensions and limitations of randomized smoothing for robustness guaranteescited by 15
  25. 2020Adversarial robustness via robust low rank representationscited by 14
  26. 2020Tight Second-Order Certificates for Randomized Smoothingcited by 10
  27. 2021Progressive-Scale Boundary Blackbox Attack via Projective Gradient Estimationcited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 2; 2023: 5; 2024: 8; 2025: 5; 2026: 2.

22 papers.

Sort:

By area:

  1. 2022LOT: Layer-wise Orthogonal Training on Improving ℓ2 Certified Robustnesscited by 32
  2. 2025SafeAuto: Knowledge-Enhanced Safe Autonomous Driving with Multimodal Foundation Modelscited by 22
  3. 2024Provably Unlearnable Data Examplescited by 18
  4. 2022Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivitycited by 15
  5. 2023Projected Randomized Smoothing for Certified Adversarial Robustnesscited by 11
  6. 2023Multi-scale Diffusion Denoised Smoothingcited by 9
  7. 2024COLEP: Certifiably Robust Learning-Reasoning Conformal Prediction via Probabilistic Circuitscited by 9
  8. 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
  9. 2023Node-aware Bi-smoothing: Certified Robustness against Graph Injection Attackscited by 8
  10. 2024Relational DNN Verification With Cross Executional Bound Refinementcited by 5
  11. 2023Rethinking Randomized Smoothing from the Perspective of Scalabilitycited by 3
  12. 2024COMMIT: Certifying Robustness of Multi-Sensor Fusion Systems against Semantic Attackscited by 2
10 more
  1. 2025BEAVER: An Efficient Deterministic LLM Verifiercited by 2
  2. 2024Accelerated Smoothing: A Scalable Approach to Randomized Smoothingcited by 1
  3. 2024Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothingcited by 1
  4. 2024Average Certified Radius is a Poor Metric for Randomized Smoothingcited by 1
  5. 2025CAMP in the Odyssey: Provably Robust Reinforcement Learning with Certified Radius Maximizationcited by 1
  6. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  7. 2023[Re] Double Sampling Randomized Smoothingcited by 0
  8. 2025Dual Randomized Smoothing: Beyond Global Noise Variancecited by 0
  9. 2026Laplace-Bridged Randomized Smoothing for Fast Certified Robustnesscited by 0
  10. 2026The Geometry of Randomized Smoothing on Feasible Setscited by 0