Research map / Adversarial robustness and security / Certified and empirical robustness
DRF: Improving Certified Robustness via Distributional Robustness Framework
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DRF, a distributional-robustness framework that generalizes AT-based randomized smoothing (SmoothAdv, Consistency) and uses a learnable penalty λ in place of a hard L2 ball, improving certified accuracy and ACR on MNIST and CIFAR-10.
Problem
AT-based randomized smoothing methods craft pointwise worst-case adversarial examples within a fixed L2 ball, which ignores smoothed-classifier performance across the data distribution and limits generalization and certified robustness.
Approach
Connects AT-based RS to Wasserstein distributional robustness: the attack is a soft penalty (λ‖x'−x‖₂) with a learnable λ updated so that the average adversarial displacement tracks ϵ, replacing the hard ball projection; SmoothAdv and Consistency are shown to be special cases.
Key results
- On MNIST at σ=1.0, SmoothAdv+DRF reaches ACR 1.788 vs 1.776 for SmoothAdv; Consistency+DRF reaches 1.824 vs 1.818.
- On MNIST at σ=0.5, SmoothAdv+DRF achieves ACR 1.693 vs 1.688 and Consistency+DRF 1.697 vs 1.692, with gains at larger radii.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add DRF to SmoothAdv | SmoothAdv · MNIST, σ=0.25 | ACR: 0.932 -> 0.933 | Helped |
| Add DRF to Consistency | Consistency · MNIST, σ=0.25 | ACR: 0.932 -> 0.933 | Helped |
| Add DRF to SmoothAdv | SmoothAdv · MNIST, σ=0.50 | ACR: 1.688 -> 1.693 | Helped |
| Add DRF to Consistency | Consistency · MNIST, σ=0.50 | ACR: 1.692 -> 1.697 | Helped |
| Add DRF to SmoothAdv | SmoothAdv · MNIST, σ=1.00 | ACR: 1.776 -> 1.788 | Helped |
| Add DRF to Consistency | Consistency · MNIST, σ=1.00 | ACR: 1.818 -> 1.824 | Helped |
| Increase initial regularization λ0 (ablation) | SmoothAdv + DRF · MNIST, σ=1.00 | certified accuracy | Mixed |
| Vary initial regularization λ0 (ablation) | SmoothAdv + DRF · MNIST, σ=1.00 | ACR | Hurt |
| Vary λ learning rate ζλ within 0.001 to 0.02 (ablation) | SmoothAdv + DRF · MNIST, σ=1.00 | ACR | No clear effect |
| Increase λ-update batch size κ (ablation) | SmoothAdv + DRF · MNIST, σ=1.00 | ACR | Helped |
Surprising findings
- Regularization-based baselines (stability training, MACER) give only limited gains over Gaussian training, while DRF gives consistent gains on top of AT-based RS.
Limitations
- Gains on MNIST are small in ACR (roughly 0.01 or less) for most settings.
- Evaluation limited to MNIST and CIFAR-10 with small architectures (LeNet, ResNet-110).
Experimental setup
Datasets: MNIST CIFAR-10
Benchmarks: MNIST CIFAR-10
Metrics: certified accuracy average certified radius (ACR)
Baselines: Gaussian augmentation Stability training MACER SmoothMix SmoothAdv Consistency
Builds on: randomized smoothing SmoothAdv Consistency regularization distributionally robust optimization
Closest papers by meaning
- Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (NeurIPS 2019 · similarity 0.90)
- A FRAMEWORK FOR ROBUSTNESS CERTIFICATION OF SMOOTHED CLASSIFIERS USING F-DIVERGENCES (ICLR 2020 · similarity 0.90)
- Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.89)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.89)
- Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothing (ICML 2024 · similarity 0.88)
- Average Certified Radius is a Poor Metric for Randomized Smoothing (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.