mlsanityData to 14 Oct 2026

Projected Randomized Smoothing for Certified Adversarial Robustness

arXiv 2309.13794 ↗First posted 25 Sep 2023cs.LGcited by 11

Not on the map. Why?

Abstract (arXiv)

Randomized smoothing is the current state-of-the-art method for producing provably robust classifiers. While randomized smoothing typically yields robust ℓ2-ball certificates, recent research has generalized provable robustness to different norm balls as well as anisotropic regions. This work considers a classifier architecture that first projects onto a low-dimensional approximation of the data manifold and then applies a standard classifier. By performing randomized smoothing in the low-dimensional projected space, we characterize the certified region of our smoothed composite classifier back in the high-dimensional input space and prove a tractable lower bound on its volume. We show experimentally on CIFAR-10 and SVHN that classifiers without the initial projection are vulnerable to perturbations that are normal to the data manifold and yet are captured by the certified regions of our method. We compare the volume of our certified regions against various baselines and show that our method improves on the state-of-the-art by many orders of magnitude.

Key facts. Cited by 11 papers in the map (data through 14 Oct 2026). Builds on 47 of its 64 references that are in the map. First posted on arXiv 25 Sep 2023.

Builds on

47 of 64 references.

References · 47

  1. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  2. 2013Intriguing properties of neural networkscited by 5,155
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  5. 2016End to End Learning for Self-Driving Carscited by 1,009
  6. 2016Adversarial Machine Learning at Scalecited by 936
  7. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 776
  8. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  9. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 567
  10. 2020On Adaptive Attacks to Adversarial Example Defensescited by 555
  11. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 546
  12. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
35 more
  1. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  2. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 255
  3. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  4. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  5. 2018Semidefinite relaxations for certifying robustness to adversarial examplescited by 179
  6. 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 158
  7. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  8. 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
  9. 2019Image Super-Resolution as a Defense Against Adversarial Attackscited by 65
  10. 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
  11. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  12. 2016SqueezeDet: Unified, Small, Low Power Fully Convolutional Neural Networks for Real-Time Object Detection for Autonomous Drivingcited by 55
  13. 2021SmoothMix: Training Confidence-calibrated Smoothed Classifiers for Certified Robustnesscited by 49
  14. 2020Black-Box Certification with Randomized Smoothing: A Functional Optimization Based Frameworkcited by 46
  15. 2021The Dimpled Manifold Model of Adversarial Examples in Machine Learningcited by 41
  16. 2021Improved, Deterministic Smoothing for L_1 Certified Robustnesscited by 39
  17. 2017Enhancing Robustness of Machine Learning Systems via Data Transformationscited by 38
  18. 2020Data-Dependent Randomized Smoothingcited by 37
  19. 2020On Adversarial Bias and the Robustness of Fair Machine Learningcited by 36
  20. 2019Wasserstein Smoothing: Certified Robustness against Wasserstein Adversarial Attackscited by 25
  21. 2021Intriguing Properties of Input-dependent Randomized Smoothingcited by 24
  22. 2021ANCER: Anisotropic Certification via Sample-wise Volume Maximizationcited by 23
  23. 2022Double Sampling Randomized Smoothingcited by 22
  24. 2021Adversarial Robustness with Non-uniform Perturbationscited by 17
  25. 2020Tightened Convex Relaxations for Neural Network Robustness Certificationcited by 14
  26. 2018Thwarting Adversarial Examples: An L0-RobustSparse Fourier Transformcited by 13
  27. 2018Robustness via Deep Low-Rank Representationscited by 11
  28. 2018Combatting Adversarial Attacks through Denoising and Dimensionality Reduction: A Cascaded Autoencoder Approachcited by 10
  29. 2019Adversarially Robust Low Dimensional Representationscited by 7
  30. 2022Randomized Smoothing under Attack: How Good is it in Pratice?cited by 7
  31. 2019On Certifying Non-uniform Bound against Adversarial Attackscited by 6
  32. 2020The Dilemma Between Data Transformations and Adversarial Robustness for Time Series Application Systemscited by 6
  33. 2020A Sequential Framework Towards an Exact SDP Verification of Neural Networkscited by 6
  34. 2021Certified Defense via Latent Space Randomized Smoothing with Orthogonal Encoderscited by 3
  35. 2013Fast Approximate L_infty Minimization: Speeding Up Robust Regressioncited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 3; 2024: 4; 2025: 1; 2026: 3.

11 papers.

  1. 2024MixedNUTS: Training-Free Accuracy-Robustness Balance via Nonlinearly Mixed Classifierscited by 16
  2. 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
  3. 2023Adversarial Examples Might be Avoidable: The Role of Data Concentration in Adversarial Robustnesscited by 11
  4. 2023Rethinking Randomized Smoothing from the Perspective of Scalabilitycited by 3
  5. 2023Mixing Classifiers to Alleviate the Accuracy-Robustness Trade-Offcited by 2
  6. 2024CERT-ED: Certifiably Robust Text Classification for Edit Distancecited by 2
  7. 2024Certified Robustness against Sparse Adversarial Perturbations via Data Localizationcited by 1
  8. 2025Adversarial Examples in Environment Perception for Automated Driving (Review)cited by 1
  9. 2026RRISE: Robust Radius Inference via a Surrogate Estimatorcited by 0
  10. 2026Representation Matters in Randomized Smoothing for Audio Classificationcited by 0
  11. 2026The Geometry of Randomized Smoothing on Feasible Setscited by 0