Research map / Adversarial robustness and security / Certified and empirical robustness
Towards Certification of Uncertainty Calibration under Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes certified calibration (certified Brier score in closed form and an ADMM-solved MIP bound on ECE) and adversarial calibration training that fine-tunes randomized-smoothing models to improve certified calibration.
Problem
Adversarial perturbations can degrade model calibration (Brier score and ECE) while leaving accuracy unchanged, and existing certificates bound per-sample confidence but not dataset-level calibration error.
Approach
Derive worst-case calibration bounds under certified confidence intervals: a closed-form upper bound on the top-label Brier score and an approximate certified calibration error (ACCE) via a mixed-integer program solved with ADMM; then train with calibration adversaries (Brier-ACT, ACCE-ACT) on top of SmoothAdv.
Key results
- On CIFAR-10, ACCE-ACT lowers ACCE at radius 1.0 from 56.36 (AT) to 47.08 and CBS from 36.25 to 24.87 while keeping certified accuracy.
- Brier-ACT and ACCE-ACT reduce certified calibration error by up to about 9.3% and CBS by up to about 11.4% at larger radii.
- ADMM-based MIP yields ACCE up to about 0.2 higher than the dECE gradient-ascent baseline on ImageNet.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply a (1,y)-ACE attack without changing predicted labels | Standard-trained ResNet50 · ImageNet, ε=2/255 | AdaECE: 3.70 -> 47.23 | Hurt |
| Apply a (1,ŷ)-ACE attack without changing predicted labels | Adversarially trained ResNet50 · ImageNet, ε=2/255 | AdaECE: 9.03 -> 13.54 | Hurt |
| Fine-tune with Brier-ACT instead of AT | SmoothAdv model · CIFAR-10, certified radii 0.05–1.00 | ACCE: 10.90 -> 9.97; 27.83 -> 27.07; 49.30 -> 41.32; 56.36 -> 52.13 | Helped |
| Fine-tune with ACCE-ACT instead of AT | SmoothAdv model · CIFAR-10, certified radii 0.05–1.00 | ACCE: 10.90 -> 10.06; 27.83 -> 27.22; 49.30 -> 42.16; 56.36 -> 47.08 | Helped |
| Fine-tune with Brier-ACT instead of AT | SmoothAdv model · CIFAR-10, certified radii 0.05–1.00 | CBS: 8.70 -> 8.10; 10.94 -> 10.20; 28.88 -> 19.38; 36.25 -> 32.54 | Helped |
| Fine-tune with ACCE-ACT instead of AT | SmoothAdv model · CIFAR-10, certified radii 0.05–1.00 | CBS: 8.70 -> 8.82; 10.94 -> 10.73; 28.88 -> 20.94; 36.25 -> 24.87 | Mixed |
| Use ACCE-ACT rather than Brier-ACT | SmoothAdv model · CIFAR-10, R=1.00 | ACCE: 52.13 -> 47.08 | Helped |
| Use ACCE-ACT rather than Brier-ACT | SmoothAdv model · CIFAR-10, R=0.05–0.50 | ACCE: 9.97 vs 10.06; 27.07 vs 27.22; 41.32 vs 42.16 | Mixed |
| Use ADMM to estimate ACCE instead of dECE gradient ascent | ACCE estimation · CIFAR-10 and ImageNet | ACCE: up to approximately 0.2 | Helped |
| Increase certified radius | Gaussian-smoothed classifiers · CIFAR-10 and ImageNet | CBS: about a 100% increase; <50% | Hurt |
Surprising findings
- Simple (1,y)-ACE attacks at epsilon=2/255 raise ImageNet ResNet50 ECE from 3.70 to 47.23 while accuracy is preserved.
- Calibration improvements from ACT on ImageNet are marginal (1-2%).
Limitations
- ImageNet improvements from ACT are marginal (1-2%)
- Certified calibration bounds depend on tight confidence certificates and become less informative at larger radii
- ACCE is approximate, obtained by ADMM without guaranteed global optimality
Experimental setup
Datasets: CIFAR-10 ImageNet-1K FashionMNIST SVHN CIFAR-100
Benchmarks: CIFAR-10 ImageNet-1K
Metrics: certified Brier score approximate certified calibration error certified accuracy AdaECE
Baselines: SmoothAdv (AT) Brier confidences ECE bound dECE gradient ascent
Builds on: SmoothAdv Gaussian smoothing (Cohen et al.) CDF certificate for confidences ACE attacks (Galil and El-Yaniv) dECE
Closest papers by meaning
- Improving Calibration through the Relationship with Adversarial Robustness (NeurIPS 2021 · similarity 0.91)
- Better Uncertainty Calibration via Proper Scores for Classification and Beyond (NeurIPS 2022 · similarity 0.90)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.87)
- Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examples (ICML 2024 · similarity 0.86)
- Position: Certified Robustness Does Not (Yet) Imply Model Security (ICML 2025 · similarity 0.86)
- PROSAC: Provably Safe Certification for Machine Learning Models under Adversarial Attacks (AAAI 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.