Research map / Adversarial robustness and security / Certified and empirical robustness

Position: Certified Robustness Does Not (Yet) Imply Model Security

ICML 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Certified training and ensembles · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

A position paper arguing that certified robustness (especially randomized smoothing, IBP and Lipschitz certifications) does not yet imply model security, because certificates only bound distance to the nearest class-changing example and can mislead users, and it proposes open questions for the community.

Problem

Certified robustness is presented as a guarantee against adversarial examples, but certificates bound the distance to the nearest class-changing example, providing no information on whether a sample is clean or attacked, which creates a gap between perceived and actual security.

Approach

Argues that certifications should be treated as heuristic risk signals rather than security guarantees, shows via a theorem that a certificate cannot distinguish clean from attacked samples, shows norm-mismatch can leave gaps across l_p balls, and lays out open questions on deployment, testing, coverage, generalization and secure code development.

Key results

• Theorem 1 argues a certificate of size epsilon may correspond either to the correct class or an incorrect class, so existence of a certificate carries no information about whether a sample was attacked.
• Theorem 2 shows that for l_p certification of radius r_p, l_q adversarial examples can exist at distances r_q > min(d^(1/q-1/p), 1) r_p, so norm mismatch can induce false security.
• Argues that VNN-COMP comparisons exist only for IBP-style certifiers and not for randomized smoothing or Lipschitz approaches.

Surprising findings

• A certification can be exploited to guide adversarial attackers, so access to certificates may compromise security.
• Certified examples can exist for adversarial inputs, so a certificate is not necessarily the distance to the nearest adversarial example.

Limitations

• No new experiments; claims are argued from theory and literature review.
• Theorems are informal and illustrated by a single hypothetical example.
• Focus is mostly on image classifiers under l_p threat models.

Experimental setup

Builds on: randomized smoothing interval bound propagation convex relaxation AutoAttack

Closest papers by meaning

• Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examples (ICML 2024 · similarity 0.92)
• On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.90)
• Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.88)
• Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.87)
• PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks (AAAI 2025 · similarity 0.86)
• Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.86)