Research map / Adversarial robustness and security / Certified and empirical robustness
Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothing
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Dual Randomized Smoothing (DRS), which down-samples an image into two lower-dimensional sub-images, smooths each with Gaussian noise, and certifies an l2 radius that decays more slowly with input dimension than standard randomized smoothing.
Problem
Randomized smoothing's l2 certified radius shrinks as 1/sqrt(d) with input dimension d because high-dimensional isotropic Gaussian noise induces large uncertainty, limiting certified robustness on high-resolution images.
Approach
Partition the input into two spatially non-overlapping sub-images via 2x2 diagonal pixel sampling, apply randomized smoothing in each lower-dimensional space, and combine the two smoothed probabilities; the certified radius bound then scales as (1/sqrt m + 1/sqrt n) with m+n=d, which is better than 1/sqrt d.
Key results
- On CIFAR-10 with Gaussian augmentation, DRS improves certified accuracy at r=0.50 by about 7.8% over RS (48.7 vs 42.4 at sigma 0.25 vs 0.50 setup as reported).
- On ImageNet, DRS with diffusion-denoising improves certified accuracy at r=0.5 by about 7.2% over RS.
- On CIFAR-10 Gaussian training, DRS at sigma=0.18 raises clean accuracy from 76.2% (RS, sigma=0.25) to 83.4% with ACR 0.50 vs 0.43.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace RS with dual smoothing at σ=0.18 | Gaussian augmentation, ResNet 110 · CIFAR-10 | accuracy (%): 76.2 -> 83.4 | Helped |
| Replace RS with dual smoothing at σ=0.18 | Gaussian augmentation, ResNet 110 · CIFAR-10 | ACR: 0.43 -> 0.50 | Helped |
| Use dual smoothing at σ=0.25 instead of RS at σ=0.25 | Gaussian augmentation, ResNet 110 · CIFAR-10 | ACR: 0.43 -> 0.56 | Helped |
| Use dual smoothing at σ=0.25 instead of RS at σ=0.25 | Gaussian augmentation, ResNet 110 · CIFAR-10 | accuracy (%): 76.2 -> 78.1 | Helped |
| Replace RS with dual smoothing at σ=0.18 | Consistency training, ResNet 110 · CIFAR-10 | ACR: 0.55 -> 0.57 | Helped |
| Use dual smoothing at σ=0.25 instead of RS at σ=0.25 | Consistency training, ResNet 110 · CIFAR-10 | accuracy (%): 75.5 -> 72.5 | Hurt |
| Use dual smoothing at σ=0.25 instead of RS at σ=0.25 | Consistency training, ResNet 110 · CIFAR-10 | ACR: 0.55 -> 0.67 | Helped |
| Replace RS with dual smoothing at σ=0.18 | Gaussian augmentation, ResNet 50 · ImageNet | accuracy (%): 67.0 -> 70.6 | Helped |
| Replace RS with dual smoothing at σ=0.18 | Gaussian augmentation, ResNet 50 · ImageNet | ACR: 0.48 -> 0.51 | Helped |
| Use dual smoothing at σ=0.25 instead of RS at σ=0.25 | Gaussian augmentation, ResNet 50 · ImageNet | ACR: 0.48 -> 0.62 | Helped |
| Replace RS with dual smoothing at σ=0.18 | Consistency training, ResNet 50 · ImageNet | accuracy (%): 64.8 -> 69.2 | Helped |
| Use dual smoothing at σ=0.25 instead of RS at σ=0.25 | Consistency training, ResNet 50 · ImageNet | accuracy (%): 64.8 -> 64.8 | No clear effect |
Surprising findings
- Using a larger noise level for DRS (sigma=0.50) gives a higher ACR but lower clean accuracy, showing an accuracy-robustness trade-off.
Limitations
- Evaluation subsampled test images (every 5th CIFAR-10 image, every 100th ImageNet image) due to high sampling cost.
- Partitioning relies on spatial redundancy of natural images, so benefit may not hold for images without such redundancy.
- Certified radius from DRS can be below RS at some settings; fair comparison requires choosing sigma per method.
Experimental setup
Datasets: CIFAR-10 ImageNet
Benchmarks: CIFAR-10 ImageNet
Metrics: certified accuracy at l2 radius average certified radius (ACR) clean accuracy
Baselines: Randomized Smoothing (Gaussian augmentation) Consistency regularization RS Diffusion-denoising RS SmoothAdv Boosting
Builds on: randomized smoothing Cohen et al. certified radius via Neyman-Pearson denoised smoothing consistency regularization diffusion denoised smoothing
Closest papers by meaning
- Improving l1-Certified Robustness via Randomized Smoothing by Leveraging Box Constraints (ICML 2023 · similarity 0.92)
- Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothing (ICML 2024 · similarity 0.90)
- Average Certified Radius is a Poor Metric for Randomized Smoothing (ICML 2025 · similarity 0.88)
- The Lipschitz-Variance-Margin Tradeoff for Enhanced Randomized Smoothing (ICLR 2024 · similarity 0.88)
- DRF: Improving Certified Robustness via Distributional Robustness Framework (AAAI 2024 · similarity 0.88)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.