Research map / Adversarial robustness and security / Certified and empirical robustness
Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Extends randomized smoothing to regression with unbounded outputs by using α-trimmed mean as the smoothing function, yielding probabilistic certificates against ℓp attacks, and benchmarks certified camera re-localization with DSAC* on Cambridge Landmarks.
Problem
Certified adversarial robustness via randomized smoothing has been developed for classifiers but not for deep regression models with continuous, unbounded outputs; prior regression smoothing relied on averaging and bounded outputs.
Approach
Use the α-trimmed mean as the smoothing aggregator for regression outputs over Gaussian-noised inputs, giving a black-box probabilistic certificate for unbounded outputs whose validity probability is given by a regularized incomplete beta function of the base validity probability, with ℓp input radii via Hölder's inequality.
Key results
- On the synthetic function with alpha=0.35, empirical probability of valid outputs under attack rises to nearly 1 for smoothed models versus large variation for the base model, against target P=0.8.
- On Cambridge Landmarks with DSAC*, alpha-trimmed smoothing consistently lowers the certified median error across input perturbation radii compared with RS-Reg's bounded-output averaging result on Great Court.
- Theoretical result: for q=0.9 and n=50, alpha=0.15 and 0.2 give validity probabilities 0.94 and 0.99 respectively, versus base q=0.9.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply α-trimming with α=0.15 rather than using the base validity probability | Synthetic regression model · Synthetic regression (q=0.9, n=50) | validity probability: 0.9 to 0.94 | Helped |
| Apply α-trimming with α=0.2 rather than using the base validity probability | Synthetic regression model · Synthetic regression (q=0.9, n=50) | validity probability: 0.9 to 0.99 | Helped |
| Use α-trimming with α=0.35 instead of the base regressor | Synthetic regression model · Synthetic simulation, evaluated points | empirical probability of valid outputs | Helped |
| Use α-trimming with α=0.35 instead of the base regressor | DSAC∗ · Cambridge Landmarks: Great Court, King’s College, and St. Mary Church | certified median error | Helped |
| Use α-trimming with α=0.35 and no output discount instead of RS-Reg with 200% output discount | DSAC∗ · Cambridge Landmarks: Great Court | certified median error | No clear effect |
| Vary α across 0.15, 0.25, and 0.45 (ablation) | DSAC∗ · Great Court | certified median error | Mixed |
| Increase α (ablation) | DSAC∗ · Great Court | certified mean error | Helped |
| Vary the α-trimming sample count n across 10, 20, and 30 (ablation) | DSAC∗ · Great Court | certified median and mean error | No clear effect |
| Decrease β, increasing the required confidence level (ablation) | DSAC∗ · Great Court | certified error | Hurt |
| Reduce the number of samples ntr used to estimate pAi (ablation) | DSAC∗ · Great Court | certified error | Hurt |
Surprising findings
- Averaging (alpha=0) can make the certified validity probability fall to q^n, so a single large invalid output can break the result; alpha-trimming is needed to recover robustness.
Limitations
- Guarantees cover only ℓp-bounded input perturbations (p ≥ 2); semantic attacks are not addressed.
- Certificates depend on user-chosen accepted output region and probability P, and the base model's validity probability q.
- Experiments are limited to a synthetic function and three Cambridge Landmarks scenes with one base model (DSAC*).
Experimental setup
Datasets: Cambridge Landmarks synthetic function samples
Benchmarks: Cambridge Landmarks (Great Court, King's College, St. Mary Church) synthetic 2D regression grid
Metrics: certified median error certified mean error empirical probability of valid outputs certified radius
Baselines: RS-Reg base regression model (no smoothing) averaging smoothing
Builds on: randomized smoothing (Cohen et al.) RS-Reg DSAC*
Closest papers by meaning
- Incremental Randomized Smoothing Certification (ICLR 2024 · similarity 0.90)
- Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.90)
- Certified Robustness for Deep Equilibrium Models via Serialized Random Smoothing (NeurIPS 2024 · similarity 0.90)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.89)
- Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences (NeurIPS 2024 · similarity 0.89)
- Average Certified Radius is a Poor Metric for Randomized Smoothing (ICML 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.