mlsanityData to 7 Oct 2026

Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences

arXiv 2406.10427 ↗First posted 14 Jun 2024cs.LG cs.CRcited by 9

Not on the map. Why?

Abstract (arXiv)

We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-time adaptive models against adversarial examples. ARS extends the analysis of randomized smoothing using f-Differential Privacy to certify the adaptive composition of multiple steps. For the first time, our theory covers the sound adaptive composition of general and high-dimensional functions of noisy inputs. We instantiate ARS on deep image classification to certify predictions against adversarial examples of bounded L∞ norm. In the L∞ threat model, ARS enables flexible adaptation through high-dimensional input-dependent masking. We design adaptivity benchmarks, based on CIFAR-10 and CelebA, and show that ARS improves standard test accuracy by 1 to 15% points. On ImageNet, ARS improves certified test accuracy by up to 1.6% points over standard RS without adaptivity. Our code is available at https://github.com/ubc-systopia/adaptive-randomized-smoothing .

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Builds on 35 of its 42 references that are in the map. First posted on arXiv 14 Jun 2024.

Builds on

35 of 42 references.

References · 35

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  3. 2013Intriguing properties of neural networkscited by 5,114
  4. 2014Deep Learning Face Attributes in the Wildcited by 3,679
  5. 2016Deep Learning with Differential Privacycited by 2,682
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  8. 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
  9. 2022Diffusion Models for Adversarial Purificationcited by 469
  10. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  11. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
  12. 2018Adversarial Attacks and Defences: A Surveycited by 259
23 more
  1. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  2. 2021Numerical Composition of Differential Privacycited by 174
  3. 2020Randomized Smoothing of All Shapes and Sizescited by 146
  4. 2021Adversarial purification with Score-based generative modelscited by 132
  5. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  6. 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
  7. 2020Bridging Composite and Real: Towards End-to-end Deep Image Mattingcited by 89
  8. 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
  9. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 65
  10. 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
  11. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  12. 2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
  13. 2020Data-Dependent Randomized Smoothingcited by 37
  14. 2020Higher-Order Certification for Randomized Smoothingcited by 36
  15. 2020Random Smoothing Might be Unable to Certify ℓ_∞ Robustness for High-Dimensional Imagescited by 35
  16. 2016Privacy Odometers and Filters: Pay-as-you-Go Compositioncited by 32
  17. 2021Combating Adversaries with Anti-Adversariescited by 27
  18. 2021Intriguing Properties of Input-dependent Randomized Smoothingcited by 24
  19. 2022Fully Adaptive Composition in Differential Privacycited by 22
  20. 2022Double Sampling Randomized Smoothingcited by 22
  21. 2021Practical Privacy Filters and Odometers with R'enyi Differential Privacy and Applications to Differentially Private Deep Learningcited by 12
  22. 2021AID-Purifier: A Light Auxiliary Network for Boosting Adversarial Defensecited by 10
  23. 2022UniCR: Universally Approximated Certified Robustness via Randomized Smoothingcited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 6.

9 papers.

  1. 2024SPLITZ: Certifiable Robustness via Split Lipschitz Randomized Smoothingcited by 4
  2. 2026Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothingcited by 3
  3. 2026A Provable Energy-Guided Test-Time Defense Boosting Adversarial Robustness of Large Vision-Language Modelscited by 1
  4. 2026Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticitycited by 1
  5. 2025Adaptive Diffusion Denoised Smoothing : Certified Robustness via Randomized Smoothing with Differentially Private Guided Denoising Diffusioncited by 0
  6. 2025AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustnesscited by 0
  7. 2026Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacycited by 0
  8. 2026Test-Time Collective Action: Proxy-Based Perturbations for Correcting Algorithmic Harmscited by 0
  9. 2026The Geometry of Randomized Smoothing on Feasible Setscited by 0