Research map / Adversarial robustness and security / Certified and empirical robustness
Incremental Randomized Smoothing Certification
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Incremental Randomized Smoothing (IRS), which reuses cached randomized-smoothing certification of an original DNN to certify quantized or pruned variants with far fewer samples, achieving up to 4.1x speedup.
Problem
Randomized smoothing certification is computationally expensive, and when a DNN is approximated (quantized or pruned) the certificates no longer hold and recertification from scratch is needed for each approximate network.
Approach
Bound the disagreement probability between the original and approximated base classifiers (zeta_x, estimated with Clopper-Pearson on reused noise seeds) and combine it with the cached lower bound pA of the original smoothed classifier to certify the approximate smoothed classifier with few samples; the radius becomes sigma*Phi^{-1}(pA - zeta_x).
Key results
- On ResNet-110 CIFAR-10 with int8 quantization, IRS reduced certification time from 2.91 hours to 0.71 hours (4.1x) on 500 images.
- On ResNet-50 ImageNet, IRS achieved 1.24x to 1.33x speedup at matched ACR of 0.875 and 0.90.
- Average speedups across quantizations (fp16, bf16, int8) reached up to 3.02x on CIFAR-10 ResNet-110 at sigma=1.0; pruning speedups range from 0.99x to 2.7x.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Reuse the original model's RS certification to certify an int8 approximation rather than certifying it from scratch | ResNet-110 · CIFAR-10, σ=1.0 | certification time: 2.91 hours -> 0.71 hours; 4.1x faster | Helped |
| Reuse the original model's RS certification to certify an int8 approximation rather than certifying it from scratch | ResNet-50 · ImageNet, ACR 0.875 | certification time: 27.82 hours -> 22.45 hours; 1.24x faster | Helped |
| Reuse the original model's RS certification to certify an int8 approximation rather than certifying it from scratch | ResNet-50 · ImageNet, ACR 0.90 | certification time: 53.93 hours -> 40.58 hours; 1.33x faster | Helped |
| Use IRS instead of standard RS from scratch | ResNet-110 · CIFAR-10, int8, σ=1.0 | average certified radius | Helped |
| Increase pruning from 5% or 10% to 20% | IRS · CIFAR-10 and ImageNet pruning experiments | IRS speedup: 0.99x to 2.7x | Hurt |
| Reuse the Gaussian sample seeds rather than estimate disparity with fresh Gaussian samples | IRS disparity estimation · Randomized smoothing certification | estimation speed: 2x faster | Helped |
| Set γ to 0.9 instead of 0.99 (ablation) | IRS, ResNet-20 · CIFAR-10, int8 | average certified radius: 0.446 -> 0.438 | Hurt |
| Set γ to 0.95 instead of 0.99 (ablation) | IRS, ResNet-20 · CIFAR-10, int8 | average certified radius: 0.446 -> 0.442 | Hurt |
| Set γ to 0.975 instead of 0.99 (ablation) | IRS, ResNet-20 · CIFAR-10, int8 | average certified radius: 0.446 -> 0.445 | Hurt |
| Set γ to 0.995 instead of 0.99 (ablation) | IRS, ResNet-20 · CIFAR-10, int8 | average certified radius: 0.446 -> 0.445 | Hurt |
| Set γ to 0.999 instead of 0.99 (ablation) | IRS, ResNet-20 · CIFAR-10, int8 | average certified radius: 0.446 -> 0.444 | Hurt |
| Set γ to 0.9 instead of 0.99 (ablation) | IRS, ResNet-110 · CIFAR-10, int8 | average certified radius: 0.443 -> 0.436 | Hurt |
Surprising findings
- Speedup is lower for smaller sigma (e.g., 0.25), and for aggressive pruning (20%) speedup can fall below 1x (0.99x on ResNet-20 CIFAR-10 sigma=0.25).
Limitations
- Requires caching top class, lower bound pA, and sampling seeds from the original certification.
- Speedup depends on sigma and approximation severity; larger zeta_x (aggressive pruning) reduces gains.
- Certified radius can be smaller than baseline when n_p is large (above about 70% of n).
Experimental setup
Datasets: CIFAR-10 ImageNet
Benchmarks: CIFAR-10 ImageNet
Metrics: average certified radius (ACR) certification time speedup
Baselines: standard randomized smoothing certification (from scratch)
Builds on: randomized smoothing Clopper-Pearson confidence interval Cohen et al. certification
Closest papers by meaning
- Certified Robustness for Deep Equilibrium Models via Serialized Random Smoothing (NeurIPS 2024 · similarity 0.91)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.90)
- The Lipschitz-Variance-Margin Tradeoff for Enhanced Randomized Smoothing (ICLR 2024 · similarity 0.89)
- Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences (NeurIPS 2024 · similarity 0.89)
- Halt Fast! Early Stopping for Certified Robustness (NeurIPS 2026 · similarity 0.89)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.