Research map / Adversarial robustness and security / Certified and empirical robustness
Certified Causal Defense with Generalizable Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes GLEAN, a causality-inspired certified defense that learns invariant causal factors with a 1-Lipschitz encoder and applies randomized smoothing in latent space to certify robustness across domain shifts.
Problem
Randomized-smoothing certified defenses lose certified robustness when test data come from a domain with distribution shift, because models overfit spurious correlations between non-causal features and labels.
Approach
Combine IRM-style invariant learning to extract causal factors with a 1-Lipschitz causal encoder, then perform Gaussian randomized smoothing on the latent causal representation and map the certified radius back to input space via the Lipschitz constant (CR = CR_z / L).
Key results
- On CMNIST at sigma=0.12, GLEAN reaches 64.3% certified accuracy at r=0 and ACR 0.2466, versus 27.2% and 0.0518 for the best baseline (SmoothAdv).
- On CelebA at sigma=0.12, GLEAN ACR is 0.2326 versus 0.1218 for Gaussian (best baseline).
- On DomainNet at sigma=0.12, GLEAN ACR is 0.2088 versus 0.1272 for MACER (best baseline); at sigma=0.25 on DomainNet, GLEAN has lower certified accuracy than baselines at r>=0.5 but highest ACR (0.2749 vs 0.2440).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use GLEAN instead of the strongest ACR baseline (SmoothAdv) | Certified defense on CMNIST · CMNIST test, σ=0.12 | ACR: 0.0518 -> 0.2466 | Helped |
| Use GLEAN instead of the strongest ACR baseline (Gaussian) | Certified defense on CelebA · CelebA test, σ=0.12 | ACR: 0.1218 -> 0.2326 | Helped |
| Use GLEAN instead of the strongest ACR baseline (MACER) | Certified defense on DomainNet · DomainNet test, σ=0.12 | ACR: 0.1272 -> 0.2088 | Helped |
| Use GLEAN instead of the strongest ACR baseline (Consistency) | Certified defense on CMNIST · CMNIST test, σ=0.25 | ACR: 0.0997 -> 0.4100 | Helped |
| Use GLEAN instead of the strongest ACR baseline (Gaussian) | Certified defense on CelebA · CelebA test, σ=0.25 | ACR: 0.1999 -> 0.3772 | Helped |
| Use GLEAN instead of the strongest ACR baseline (MACER) | Certified defense on DomainNet · DomainNet test, σ=0.25 | ACR: 0.2440 -> 0.2749 | Helped |
| Add the invariance regularization term (ablation) | GLEAN · CMNIST | ACR | Helped |
| Add the invariance regularization term (ablation) | GLEAN · CelebA and DomainNet | certified accuracy and ACR | Helped |
| Add 1-Lipschitz constraints (ablation) | GLEAN · CMNIST | certified accuracy and ACR | Helped |
| Add 1-Lipschitz constraints (ablation) | GLEAN · CelebA | certified accuracy and ACR | Helped |
| Add 1-Lipschitz constraints (ablation) | GLEAN · DomainNet | certified accuracy and ACR | Mixed |
| Increase λ (ablation) | GLEAN · CMNIST | certified accuracy | Helped |
Surprising findings
- On DomainNet at sigma=0.25, GLEAN's certified accuracy is lower than some baselines at larger radii, a trade-off the authors attribute to baselines sacrificing small-radius accuracy.
Limitations
- Lipschitz constraint limits network learning capacity, which the authors note can reduce performance on complex real-world data such as DomainNet.
- Certified accuracy comparisons across models are not uniformly dominant; the paper relies on ACR as the primary summary metric.
- Experiments use small models (3-layer MLP, 4-layer CNN) and 64x64 resized images.
Experimental setup
Datasets: CMNIST CelebA DomainNet MNIST
Benchmarks: CMNIST CelebA DomainNet
Metrics: certified accuracy at radius r average certified radius (ACR)
Baselines: Gaussian MACER SmoothAdv Consistency
Builds on: randomized smoothing invariant risk minimization Cayley transform orthogonal layers GroupSort MACER SmoothAdv
Closest papers by meaning
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · similarity 0.89)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.89)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.87)
- Adversarial Robustness via Deformable Convolution with Stochasticity (ICML 2025 · similarity 0.86)
- Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · similarity 0.85)
- Two Heads are Actually Better than One: Towards Better Adversarial Robustness via Transduction and Rejection (ICML 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.