Reconcile Certified Robustness and Accuracy for DNN-based Smoothed Majority Vote Classifier
Not on the map. Why?
Abstract (arXiv)
Within the PAC-Bayesian framework, the Gibbs classifier (defined on a posterior Q) and the corresponding Q-weighted majority vote classifier are commonly used to analyze the generalization performance. However, there exists a notable lack in theoretical research exploring the certified robustness of majority vote classifier and its interplay with generalization. In this study, we develop a generalization error bound that possesses a certified robust radius for the smoothed majority vote classifier (i.e., the Q-weighted majority vote classifier with smoothed inputs); In other words, the generalization bound holds under any data perturbation within the certified robust radius. As a byproduct, we find that the underpinnings of both the generalization bound and the certified robust radius draw, in part, upon weight spectral norm, which thereby inspires the adoption of spectral regularization in smooth training to boost certified robustness. Utilizing the dimension-independent property of spherical Gaussian inputs in smooth training, we propose a novel and inexpensive spectral regularizer to enhance the smoothed majority vote classifier. In addition to the theoretical contribution, a set of empirical results is provided to substantiate the effectiveness of our proposed method.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Builds on 79 of its 99 references that are in the map. First posted on arXiv 30 Sep 2025.
Builds on
79 of 99 references.
References · 79
- 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,337
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
- 2013Exact solutions to the nonlinear dynamics of learning in deep linear neural networkscited by 748
- 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
- 2017Spectrally-normalized margin bounds for neural networkscited by 681
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2017Exploring Generalization in Deep Learningcited by 595
38 more
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2017Computing Nonvacuous Generalization Bounds for Deep (Stochastic) Neural Networks with Many More Parameters than Training Datacited by 527
- 2019Fantastic Generalization Measures and Where to Find Themcited by 507
- 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2017A PAC-Bayesian Approach to Spectrally-Normalized Margin Bounds for Neural Networkscited by 309
- 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
- 2017Spectral Norm Regularization for Improving the Generalizability of Deep Learningcited by 178
- 2018Certified Adversarial Robustness with Additive Noisecited by 178
- 2020Skip Connections Matter: On the Transferability of Adversarial Examples Generated with ResNetscited by 165
- 2020Randomized Smoothing of All Shapes and Sizescited by 146
- 2018Scaling provable adversarial defensescited by 141
- 2015All you need is a good initcited by 124
- 2015On the properties of variational approximations of Gibbs posteriorscited by 121
- 2020RAB: Provable Robustness Against Backdoor Attackscited by 115
- 2020MACER: Attack-free and Scalable Robust Training via Maximizing Certified Radiuscited by 114
- 2020Deep Partition Aggregation: Provable Defense against General Poisoning Attackscited by 112
- 2020Tighter risk certificates for neural networkscited by 112
- 2020Certified Robustness to Label-Flipping Attacks via Randomized Smoothingcited by 103
- 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 97
- 2018The Singular Values of Convolutional Layerscited by 95
- 2021CRFL: Certifiably Robust Federated Learning against Backdoor Attackscited by 91
- 2020Intrinsic Certified Robustness of Bagging against Data Poisoning Attackscited by 90
- 2019Achieving Verified Robustness to Symbol Substitutions via Interval Bound Propagationcited by 87
- 2017Entropy-SGD optimizes the prior of a PAC-Bayes bound: Generalization properties of Entropy-SGD and data-dependent priorscited by 81
- 2020In Search of Robust Measures of Generalizationcited by 79
- 2022PAC-Bayes Compression Bounds So Tight That They Can Explain Generalizationcited by 75
- 2018Generalizable Adversarial Training via Spectral Normalizationcited by 68
- 2019Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifierscited by 65
- 2020On the role of data in PAC-Bayes boundscited by 64
- 2020PAC-Bayes Analysis Beyond the Usual Boundscited by 63
- 2020Certified Robustness of Graph Neural Networks against Adversarial Structural Perturbationcited by 57
- 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
- 2020Efficient Robustness Certificates for Discrete Data: Sparsity-Aware Randomized Smoothing for Graphs, Images and Morecited by 56
- 2016A Strongly Quasiconvex PAC-Bayesian Boundcited by 54
- 2019Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothingcited by 54
- 2020Certified Defense to Image Transformations via Randomized Smoothingcited by 51
50 most cited of 79 All 79 (JSON)
Built on by
Citing papers per year: 2025: 1; 2026: 1.
2 papers.