Research map / Adversarial robustness and security / Certified and empirical robustness
Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Adaptive Randomized Smoothing (ARS), using f-DP composition to certify a two-step test-time adaptive (input-dependent masking) defence against L-infinity adversaries, improving standard and certified accuracy on CIFAR-10 (20kBG), CelebA and ImageNet.
Problem
Randomized smoothing is static at test time and scales poorly with input dimension for L-infinity certification on high-dimensional images; existing adaptive RS variants are either unsound or only minimally adaptive.
Approach
Reconnect RS to f-differential privacy so that multi-step adaptive mechanisms can be certified via f-DP adaptive composition; a first noisy step produces an input-dependent mask that reduces the dimension (and thus noise variance) for a second noisy step, yielding sound L-infinity certificates.
Key results
- On CIFAR-10 20kBG with sigma=1.0 and k=96, ARS reaches 56.3% standard accuracy versus 33.8% for Cohen et al.
- On CelebA with sigma=0.5, ARS raises standard accuracy from 91.0% to 94.3% and certified accuracy at r=0.004 from 45.0% to 79.3%.
- On ImageNet, ARS (End-To-End) improves standard accuracy from 57.2% to 57.4% at sigma=0.5 and from 43.6% to 44.5% at sigma=1.0.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use input-adaptive masking with the two-step ARS pipeline instead of static randomized smoothing | ImageNet classification · ImageNet, r∞=0.001, σ=0.5 | certified accuracy: 48.9% to 50.5% | Helped |
| use input-adaptive masking with the two-step ARS pipeline instead of static randomized smoothing | ImageNet classification · ImageNet, r∞=0.005, σ=1.0 | certified accuracy: 21.7% to 23.1% | Helped |
| use input-adaptive masking instead of static randomized smoothing | CIFAR-10 (20kBG) · k=96, σ=1.0 | standard accuracy: 33.8 (3.8) -> 56.3 (2.3) | Helped |
| use input-adaptive masking instead of a learned static mask | CIFAR-10 (20kBG) · k=32, σ=0.25 | standard accuracy: 73.9 (0.8) -> 72.6 (0.9) | Hurt |
| use input-adaptive masking instead of a fixed mask | CelebA mouth slightly open classification · CelebA, σ=0.5 | standard accuracy: 91.0% to 94.3% | Helped |
| use input-adaptive masking instead of a fixed mask | CelebA mouth slightly open classification · CelebA, r∞=0.004, σ=0.5 | certified accuracy: 45.0% to 79.3% | Helped |
| use input-adaptive masking instead of a fixed mask | CelebA mouth slightly open classification · CelebA, r∞=0.002, σ=0.25 | certified accuracy: 68.3% to 84.7% | Helped |
| use input-adaptive masking instead of a fixed mask | CelebA mouth slightly open classification · CelebA, r∞=0.008, σ=1.0 | certified accuracy: 21.3% to 49.3% | Helped |
| train only the mask model for 10 epochs while fixing the base classifier (ablation) | ARS on ImageNet · ImageNet, σ=0.5 | standard accuracy: 57.4 (0.010) -> 56.0 (0.003) | Hurt |
| train only the mask model for 10 epochs while fixing the base classifier (ablation) | ARS on ImageNet · ImageNet, σ=1.0 | standard accuracy: 44.5 (0.010) -> 43.8 (0.002) | Hurt |
| increase input dimension by adding distractor backgrounds while using adaptive masking | ARS on CIFAR-10 (20kBG) · σ=1.0, k=32 vs k=96 | standard accuracy: 49.3 (0.6) -> 56.3 (2.3) | Helped |
Surprising findings
- Adaptivity via f-DP composition incurs no decrease in certified radius for Gaussian mechanisms compared with one-step RS at the same effective variance.
- The ARS masking benefit does not carry over to L2 certification, only to L-infinity, since the variance reduction relies on the L-infinity-to-L2 translation.
Limitations
- Increased model size and computation: ARS takes about 26 s to certify one input versus about 12 s for Cohen et al. on CIFAR-10.
- Improvements are modest on ImageNet and ARS standard accuracy is slightly lower than Cohen et al. at sigma=0.25 when trained end-to-end.
- Experiments use a 200-sample CIFAR-10 certification subset, with results on the full test set reported only in the appendix.
Experimental setup
Datasets: CIFAR-10 CelebA ImageNet 20k background images
Benchmarks: CIFAR-10 (20kBG) CelebA (unaligned, cropped) ImageNet
Metrics: standard accuracy certified accuracy at L-infinity radius
Baselines: Cohen et al. UniCR Static Mask Súkeník et al.
Builds on: randomized smoothing f-differential privacy PixelDP UniCR
Closest papers by meaning
- Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.89)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.89)
- Incremental Randomized Smoothing Certification (ICLR 2024 · similarity 0.89)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.88)
- Certified Robustness for Deep Equilibrium Models via Serialized Random Smoothing (NeurIPS 2024 · similarity 0.88)
- Provable Robustness against Backdoor Attacks via the Primal-Dual Perspective on Differential Privacy (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.