Research map / Adversarial robustness and security / Certified and empirical robustness
AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Extends deletion-based randomized smoothing to variable, input-dependent deletion rates (AdaptDel, AdaptDel+) for certified edit-distance robustness of text classifiers.
Problem
Certifying sequence classifiers against edit distance perturbations with fixed-rate deletion smoothing is suboptimal because inputs vary in length and longer inputs tolerate higher deletion rates.
Approach
Derives lower and upper bounds on smoothed class probabilities under neighboring inputs for arbitrary input-dependent deletion rates (solved as bounded knapsack problems), then uses length-dependent deletion rates (AdaptDel) and binned, empirically calibrated rates (AdaptDel+) to certify edit distance.
Key results
- AdaptDel and AdaptDel+ improve mean certified radius by over 50% on average versus CERT-ED and RanMASK.
- Median certified region cardinality improves by up to 30 orders of magnitude over state-of-the-art certifications.
- Clean accuracy drops only 0-2% relative to RanMASK and CERT-ED.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use length-dependent deletion rates (AdaptDel or AdaptDel+) instead of fixed-rate deletion | RoBERTa sequence classifier · Yelp, SpamAssassin, IMDB, and LUN | certified robustness at the same certified accuracy | Helped |
| Use adaptive deletion rates (AdaptDel or AdaptDel+) instead of fixed-rate deletion | RoBERTa sequence classifier · Four NLP datasets | mean certified radius: over 50% | Helped |
| Use adaptive deletion rates (AdaptDel or AdaptDel+) instead of fixed-rate deletion | RoBERTa sequence classifier · Four NLP datasets | median cardinality of the certified region: up to 30 orders of magnitude | Helped |
| Use AdaptDel+ with input binning and empirical calibration | AdaptDel · Four NLP datasets | certified accuracy at larger certified regions | Helped |
| Use AdaptDel+ with input binning and empirical calibration | AdaptDel · Yelp and SpamAssassin, length quartiles | certified accuracy across input lengths | Helped |
| Use adaptive deletion rates rather than fixed-rate deletion | RoBERTa sequence classifier · Yelp, first two length quartiles | certified accuracy | Mixed |
| Use adaptive deletion rates rather than fixed-rate deletion | RoBERTa sequence classifier · Yelp, fourth length quartile | certified accuracy | Helped |
| Use adaptive deletion rates rather than fixed-rate deletion | RoBERTa sequence classifier · Clean test inputs | clean accuracy: 0--2% drop | Hurt |
| Set deletion probability to a fixed constant instead of adapting it to input length (ablation) | Variable-rate deletion certification · Edit-distance certification | certificate lower bound: less than $10^{-7}$ | No clear effect |
Limitations
- Edit distance is a syntactic surrogate that may not match semantics-preserving attacks.
- Only length-dependent deletion rates are explored; more general input-dependent rates may yield better robustness.
Experimental setup
Datasets: Yelp SpamAssassin IMDB LUN
Benchmarks: Yelp SpamAssassin IMDB LUN
Metrics: clean accuracy certified radius log-cardinality of certified region certified accuracy
Baselines: NoSmooth RoBERTa CERT-ED RanMASK
Builds on: randomized smoothing CERT-ED RanMASK Clopper-Pearson confidence bounds
Closest papers by meaning
- What Was That Again? Certified Robustness for Automatic Speech Recognition (NeurIPS 2026 · similarity 0.85)
- Token Cleaning: Fine-Grained Data Selection for LLM Supervised Fine-Tuning (ICML 2025 · similarity 0.85)
- Certifying Language Model Robustness with Fuzzed Randomized Smoothing: An Efficient Defense Against Backdoor Attacks (ICLR 2025 · similarity 0.84)
- Calibrated Language Models and How to Find Them with Label Smoothing (ICML 2025 · similarity 0.84)
- UniEdit: A Unified Knowledge Editing Benchmark for Large Language Models (NeurIPS 2025 · similarity 0.84)
- Mitigating Heterogeneous Token Overfitting in LLM Knowledge Editing (ICML 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.