mlsanityData to 7 Oct 2026

Sound Randomized Smoothing in Floating-Point Arithmetics

arXiv 2207.07209 ↗First posted 14 Jul 2022cs.LG cs.CRcited by 2

Not on the map. Why?

Abstract (arXiv)

Randomized smoothing is sound when using infinite precision. However, we show that randomized smoothing is no longer sound for limited floating-point precision. We present a simple example where randomized smoothing certifies a radius of 1.26 around a point, even though there is an adversarial example in the distance 0.8 and extend this example further to provide false certificates for CIFAR10. We discuss the implicit assumptions of randomized smoothing and show that they do not apply to generic image classification models whose smoothed versions are commonly certified. In order to overcome this problem, we propose a sound approach to randomized smoothing when using floating-point precision with essentially equal speed and matching the certificates of the standard, unsound practice for standard classifiers tested so far. Our only assumption is that we have access to a fair coin.

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 28 of its 45 references that are in the map. First posted on arXiv 14 Jul 2022.

Builds on

28 of 45 references.

References · 28

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  5. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  6. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  7. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  9. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  10. 2019On Evaluating Adversarial Robustnesscited by 442
  11. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  12. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
16 more
  1. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  2. 2018Scaling provable adversarial defensescited by 141
  3. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  4. 2020The Discrete Gaussian for Differential Privacycited by 134
  5. 2021Globally-Robust Neural Networkscited by 106
  6. 2021Orthogonalizing Convolutional Layers with the Cayley Transformcited by 105
  7. 2019Wasserstein Adversarial Examples via Projected Sinkhorn Iterationscited by 89
  8. 2019Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networkscited by 86
  9. 2021Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100cited by 47
  10. 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
  11. 2020Exploiting Verified Neural Networks via Floating Point Numerical Errorcited by 35
  12. 2019Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attackscited by 25
  13. 2021Boosting the Certified Robustness of L-infinity Distance Netscited by 24
  14. 2021Are We There Yet? Timing and Floating-Point Attacks on Differential Privacy Systemscited by 8
  15. 2021Integer-arithmetic-only Certified Robustness for Quantized Neural Networkscited by 7
  16. 2022Getting a-Round Guarantees: Floating-Point Attacks on Certified Robustnesscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 1; 2024: 0; 2025: 0; 2026: 1.

2 papers.

  1. 2023Incremental Randomized Smoothing Certificationcited by 12
  2. 2026The Geometry of Randomized Smoothing on Feasible Setscited by 0