Research map / Adversarial robustness and security / Certified and empirical robustness
Certified training and ensembles
Train models to be certifiably robust, including ensembles and bounded-support settings.
35 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2020–2026) · an approach in Certified and empirical robustness, keyword cluster “smoothing · randomized · certified robustness”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
15 papers in 2023–24 and 4 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 5.0% to 1.7%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2020 · Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond (NeurIPS 2020 · 112 citations)
- 2021 · Fast Training of Provably Robust Neural Networks by SingleProp (AAAI 2021 · 4 citations)
- 2022 · Rethinking Lipschitz Neural Networks and Certified Robustness: A Boolean Function Perspective (NeurIPS 2022 · 12 citations)
- 2023 · (Certified!!) Adversarial Robustness for Free! (ICLR 2023 · 17 citations)
- 2024 · Diffusion Models are Certifiably Robust Classifiers (NeurIPS 2024 · 14 citations)
- 2025 · Certified Human Trajectory Prediction (CVPR 2025 · 4 citations)
- 2026 · Rethinking Evaluation Paradigms in IBP-based Certified Training (ICML 2026 · 0 citations)
Earliest papers here
- Automatic Perturbation Analysis for Scalable Certified Robustness and Beyond (NeurIPS 2020 · 112 citations)
- Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing (ICLR 2020 · 33 citations)
- Scalable Differential Privacy with Certified Robustness in Adversarial Learning (ICML 2020 · 24 citations)
What has been tried
28 papers here report 288 measured changes (a component added, removed or swapped, compared with a baseline): helped 64%, no clear effect 8%, hurt 22%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase APNDC timestep count from T′=100 to T′=1000 | CIFAR-10 · certified accuracy | 80.7 -> 82.2; 68.8 -> 70.7; 50.8 -> 54.5; 35.2 -> 38.2 | Helped | Diffusion Models are Certifiably Robust Classifiers (NeurIPS 2024 · 14 citations) |
| Use median rather than mean aggregation | Trajnet++ · FBD | Helped | Certified Human Trajectory Prediction (CVPR 2025 · 4 citations) | |
| Add Jacobian regularization | CIFAR-10, radius 0.5 · certified accuracy | 38% -> 38% | No clear effect | Certified Robustness for Deep Equilibrium Models via Serialized Random Smoothing (NeurIPS 2024 · 1 citation) |
| Increase the number of convolutional layers | AG-News and SST-2, k=1 · clean and verified accuracy | Hurt | Certified Robustness Under Bounded Levenshtein Distance (ICLR 2025 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 8 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 3 of 8 papers
Baselines
- IBP · 2 of 8 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 19 papers; from OpenAlex and the papers' affiliations).
- Swiss Federal Institute of Technology · 3 papers
- ETHZ - ETH Zurich · 2 papers
- University of Illinois, Urbana Champaign · 2 papers
- University of California, Berkeley · 2 papers
Use it
Download BibTeX of 26 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Randomized smoothing certification (49 papers)
- Provable defenses and their limits (23 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).