Research map / Adversarial robustness and security / Certified and empirical robustness
Provably Robust Conformal Prediction with Improved Efficiency
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Fixes the flawed robustness guarantee of randomized smoothed conformal prediction (RSCP) via RSCP+ (Hoeffding bound on Monte Carlo scores) and reduces its conservative, trivial prediction sets with post-training transformation (PTT) and robust conformal training (RCT).
Problem
Randomized smoothed conformal prediction (RSCP) gives flawed robustness certificates when Monte Carlo sampling is used, and its robust prediction sets are so large that they are often trivial (full label set) under adversarial perturbations.
Approach
Use the Monte Carlo smoothed score directly as the conformity score, bound its estimation error with Hoeffding's inequality (inflating the calibration quantile level by 2β), then reduce conservativeness by a rank-plus-sigmoid transformation of the base score (PTT) and by training with simulated RSCP inside conformal training (RCT).
Key results
- On CIFAR10 with RSCP+, PTT+RCT reduces the baseline's trivial full-label set (size 10) to 2.294 with HPS, a 4.36x efficiency gain.
- On CIFAR100, PTT+RCT with HPS achieves size 18.30 vs. baseline 100 (5.46x improvement).
- On ImageNet with APS, PTT+Bernstein reduces prediction set size from 1000 to 70.87 (14.1x), and to 59.12 with HPS (16.9x).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply PTT to the HPS base score | RSCP+ · CIFAR10 | average prediction set size: 10 -> 2.294 | Helped |
| Apply PTT to the APS base score | RSCP+ · CIFAR10 | average prediction set size: 10 -> 2.685 | Helped |
| Add RCT to PTT with HPS base score (ablation) | RSCP+ on CIFAR10 · CIFAR10 | average prediction set size: 2.294 -> 2.294 | No clear effect |
| Add RCT to PTT with APS base score (ablation) | RSCP+ on CIFAR10 · CIFAR10 | average prediction set size: 2.685 -> 2.824 | Hurt |
| Apply PTT to the HPS base score | RSCP+ · CIFAR100 | average prediction set size: 100 -> 26.06 | Helped |
| Add RCT to PTT with HPS base score (ablation) | RSCP+ on CIFAR100 · CIFAR100 | average prediction set size: 26.06 -> 18.30 | Helped |
| Apply PTT to the APS base score | RSCP+ · CIFAR100 | average prediction set size: 100 -> 21.96 | Helped |
| Add RCT to PTT with APS base score (ablation) | RSCP+ on CIFAR100 · CIFAR100 | average prediction set size: 21.96 -> 20.01 | Helped |
| Apply PTT to the HPS base score | RSCP+ · ImageNet | average prediction set size: 1000 -> 1000 | No clear effect |
| Use PTT with the APS base score | RSCP+ · ImageNet | average prediction set size: 1000 -> 94.66 | Helped |
| Add the Empirical Bernstein bound to PTT with HPS base score (ablation) | RSCP+ on ImageNet · ImageNet | average prediction set size: 1000 -> 59.12 | Helped |
| Add the Empirical Bernstein bound to PTT with APS base score (ablation) | RSCP+ on ImageNet · ImageNet | average prediction set size: 94.66 -> 70.87 | Helped |
Surprising findings
- The baseline RSCP+ yields trivial full-label prediction sets on all datasets, even when the holdout set is added to the calibration set for the baseline.
- On ImageNet, PTT alone does not help the HPS score (still 1000), and only works with APS; Empirical Bernstein refinement is needed for HPS.
Limitations
- Only evaluated for l2 (Gaussian smoothing) perturbations on image classification with fixed epsilon values on three datasets.
- PTT may fail to improve efficiency in some constructed cases, per the authors' own analysis.
- Monte Carlo estimation requires many noise samples at test time, increasing computational cost.
Experimental setup
Datasets: CIFAR10 CIFAR100 ImageNet
Benchmarks: CIFAR10 CIFAR100 ImageNet
Metrics: average prediction set size coverage
Baselines: RSCP (HPS base score) RSCP (APS base score)
Builds on: Randomized Smoothed Conformal Prediction (RSCP) Adaptive Prediction Sets (APS) Homogeneous Prediction Sets (HPS) Conformal training (Stutz et al.) Randomized smoothing
Closest papers by meaning
- Verifiably Robust Conformal Prediction (NeurIPS 2024 · similarity 0.93)
- Robust Conformal Prediction with a Single Binary Certificate (ICLR 2025 · similarity 0.92)
- One Sample is Enough to Make Conformal Prediction Robust (NeurIPS 2025 · similarity 0.92)
- Robust Yet Efficient Conformal Prediction Sets (ICML 2024 · similarity 0.90)
- Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks (ICML 2025 · similarity 0.90)
- The Pitfalls and Promise of Conformal Inference Under Adversarial Attacks (ICML 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.