Research map / Adversarial robustness and security / Certified and empirical robustness
(De)Randomized Smoothing for Certifiable Defense against Patch Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use structured (column) ablation instead of Chiang et al. IBP defense | patch certified defense · CIFAR-10 5x5 patch | certified accuracy (%): 30.3 -> 57.58 | Helped |
| use structured ablation instead of Chiang et al. IBP defense | patch certified defense · MNIST 5x5 patch | certified accuracy (%): 60.4 -> 52.44 | Hurt |
| derandomize: compute exact certificate over all ablations instead of sampling (ablation) | column smoothing · CIFAR-10 5x5 patch | certified accuracy (%): 50.38 -> 57.36 | Helped |
| derandomize: compute exact certificate instead of sampling (top-1 class) (ablation) | column smoothing · MNIST 5x5 patch | certified accuracy (%): 16.32 -> 22.20 | Helped |
| add abstain threshold on base-classifier logits (ablation) | derandomized column smoothing · MNIST 5x5 patch | certified accuracy (%): 22.20 -> 53.22 | Helped |
| add abstain threshold on base-classifier logits (ablation) | derandomized column smoothing · CIFAR-10 5x5 patch | certified accuracy (%): 57.36 -> 58.08 | No clear effect |
| use column smoothing instead of block smoothing (ablation) | structured ablation · CIFAR-10 5x5 patch | certified accuracy (%): 54.94 -> 58.08 | Helped |
| use column smoothing instead of block smoothing (ablation) | structured ablation · MNIST 5x5 patch | certified accuracy (%): 42.22 -> 53.22 | Helped |
| use rows instead of columns (ablation) | structured ablation · MNIST 5x5 patch | certified accuracy (%): 53.22 -> 45.32 | Hurt |
| retain multiple columns instead of one (ablation) | column smoothing · MNIST 5x5 patch | certified accuracy (%): 53.22 -> 39.18 | Hurt |
| retain two blocks instead of one (ablation) | block smoothing s=4 · MNIST 5x5 patch | certified accuracy (%) | No clear effect |
| use structured ablation instead of naive L0 randomized ablation | patch certification · CIFAR-10 5x5 patch | certified accuracy | Helped |
Closest papers by meaning
- Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.88)
- PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.88)
- Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences (NeurIPS 2024 · similarity 0.87)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.87)
- Average Certified Radius is a Poor Metric for Randomized Smoothing (ICML 2025 · similarity 0.87)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.