mlsanityData to 14 Oct 2026

Position: Certified Robustness Does Not (Yet) Imply Model Security

arXiv 2506.13024 ↗First posted 16 Jun 2025cs.CR cs.LGcited by 4

Not on the map. Why?

Abstract (arXiv)

While certified robustness is widely promoted as a solution to adversarial examples in Artificial Intelligence systems, significant challenges remain before these techniques can be meaningfully deployed in real-world applications. We identify critical gaps in current research, including the paradox of detection without distinction, the lack of clear criteria for practitioners to evaluate certification schemes, and the potential security risks arising from users' expectations surrounding ``guaranteed" robustness claims. These create an alignment issue between how certifications are presented and perceived, relative to their actual capabilities. This position paper is a call to arms for the certification research community, proposing concrete steps to address these fundamental challenges and advance the field toward practical applicability.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Builds on 59 of its 95 references that are in the map. First posted on arXiv 16 Jun 2025.

Builds on

59 of 95 references.

References · 59

  1. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2013Intriguing properties of neural networkscited by 5,155
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  8. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  10. 2016Adversarial Machine Learning at Scalecited by 936
  11. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  12. 2015The Limitations of Deep Learning in Adversarial Settingscited by 790
38 more
  1. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  2. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 468
  3. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 445
  4. 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 330
  5. 2017MagNet: a Two-Pronged Defense against Adversarial Examplescited by 269
  6. 2018Adversarial Attacks and Defences: A Surveycited by 259
  7. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 255
  8. 2021Beta-CROWN: Efficient Bound Propagation with Per-neuron Split Constraints for Complete and Incomplete Neural Network Robustness Verificationcited by 228
  9. 2018Spatially Transformed Adversarial Examplescited by 195
  10. 2018Lipschitz-Margin Training: Scalable Certification of Perturbation Invariance for Deep Neural Networkscited by 195
  11. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 185
  12. 2018Certified Adversarial Robustness with Additive Noisecited by 180
  13. 2019Making an Invisibility Cloak: Real World Adversarial Attacks on Object Detectorscited by 155
  14. 2020Randomized Smoothing of All Shapes and Sizescited by 147
  15. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 125
  16. 2020Adversarial Machine Learning -- Industry Perspectivescited by 122
  17. 2020Certified Defenses for Adversarial Patchescited by 101
  18. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
  19. 2017Regularization for Deep Learning: A Taxonomycited by 91
  20. 2018Motivating the Rules of the Game for Adversarial Example Researchcited by 57
  21. 2019Certified Adversarial Robustness for Deep Reinforcement Learningcited by 47
  22. 2017MagNet and "Efficient Defenses Against Adversarial Attacks" are Not Robust to Adversarial Examplescited by 46
  23. 2021Policy Smoothing for Provably Robust Reinforcement Learningcited by 40
  24. 2022The Third International Verification of Neural Networks Competition (VNN-COMP 2022): Summary and Resultscited by 39
  25. 2023The Fourth International Verification of Neural Networks Competition (VNN-COMP 2023): Summary and Resultscited by 38
  26. 2022COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attackscited by 26
  27. 2019Implicit Diversity in Image Summarizationcited by 18
  28. 2018Reinforcement Learning for Autonomous Defence in Software-Defined Networkingcited by 17
  29. 2023RS-Del: Edit Distance Robustness Certificates for Sequence Classifiers via Randomized Deletioncited by 17
  30. 2021Towards Evaluating and Training Verifiably Robust Neural Networkscited by 15
  31. 2022Double Bubble, Toil and Trouble: Enhancing Certified Robustness through Transitivitycited by 15
  32. 2020Politics of Adversarial Machine Learningcited by 12
  33. 2018Playing the Game of Universal Adversarial Perturbationscited by 9
  34. 2020Towards Effective Differential Privacy Communication for Users' Data Sharing Decision and Comprehensioncited by 9
  35. 2017Differential Privacy on Finite Computerscited by 8
  36. 2021Are We There Yet? Timing and Floating-Point Attacks on Differential Privacy Systemscited by 8
  37. 2022Reducing Certified Regression to Certified Classification for General Poisoning Attackscited by 7
  38. 2022Certified Policy Smoothing for Cooperative Multi-Agent Reinforcement Learningcited by 7

50 most cited of 59 All 59 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attackscited by 21
  2. 2026Contract And Conquer: How to Provably Compute Adversarial Examples for a Black-Box Model?cited by 0
  3. 2026Halt Fast! Early Stopping for Certified Robustnesscited by 0
  4. 2026An Investigation of the NeurIPS and ICML 2025 Position Trackscited by 0