Research map / Adversarial robustness and security / Certified and empirical robustness
Neural network robustness verification
Certify robustness with semidefinite, probabilistic or bound-propagation verifiers.
87 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Certified and empirical robustness, keyword cluster “verification · bounds · worst case”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
27 papers in 2023–24 and 13 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 8.9% to 5.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Differentiable Abstract Interpretation for Provably Robust Neural Networks (ICML 2018 · 287 citations)
- 2019 · Evaluating Robustness of Neural Networks with Mixed Integer Programming (ICLR 2019 · 328 citations)
- 2020 · Towards Verifying Robustness of Neural Networks Against A Family of Semantic Perturbations (CVPR 2020 · 60 citations)
- 2021 · Achieving Robustness in Classification Using Optimal Transport With Hinge Regularization (CVPR 2021 · 40 citations)
- 2022 · CC-CERT: A Probabilistic Approach to Certify General Robustness of Neural Networks (AAAI 2022 · 19 citations)
- 2023 · Towards Verifying the Geometric Robustness of Large-Scale Neural Networks (AAAI 2023 · 7 citations)
- 2024 · GaLileo: General Linear Relaxation Framework for Tightening Robustness Certification of Transformers (AAAI 2024 · 3 citations)
- 2025 · Towards Certification of Uncertainty Calibration under Adversarial Attacks (ICLR 2025 · 1 citation)
- 2026 · What Was That Again? Certified Robustness for Automatic Speech Recognition (NeurIPS 2026 · 0 citations)
Earliest papers here
- Differentiable Abstract Interpretation for Provably Robust Neural Networks (ICML 2018 · 287 citations)
- Fast and Effective Robustness Certification (NeurIPS 2018 · 243 citations)
- Verifying Properties of Binarized Deep Neural Networks (AAAI 2018 · 202 citations)
What has been tried
72 papers here report 656 measured changes (a component added, removed or swapped, compared with a baseline): helped 69%, no clear effect 7%, hurt 19%, mixed 5%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Add orthogonal FC layer | MNIST, PGD ε=8/255 · accuracy | 23.23 -> 50.35 | Helped | Lyapunov-Stable Deep Equilibrium Models (AAAI 2024 · 3 citations) |
| Add RCT to PTT with HPS base score | CIFAR10 · average prediction set size | 2.294 -> 2.294 | No clear effect | Provably Robust Conformal Prediction with Improved Efficiency (ICLR 2024 · 1 citation) |
| add 8 Spatial-MLP blocks after the last convolution layers | CIFAR-10 and CIFAR-100, ε=36/255 · VRA (%) | 70.0 -> 70.2; 41.5 -> 41.2 | Mixed | A Recipe for Improved Certifiable Robustness (ICLR 2024 · 1 citation) |
| Vary search angle, initialization shift, and random seed | MNIST · distribution of verifiable ball centers | Helped | LEVIS: Large Exact Verifiable Input Spaces for Neural Networks (ICML 2025 · 0 citations) | |
| Add the redundant quadratic tautology constraints to the tighter first-order SDP | BNN verification, affine objective · lower bound | Helped | Verifying Properties of Binary Neural Networks Using Sparse Polynomial Optimization (ICLR 2025 · 0 citations) | |
| Increase the size of the delta set | FIRE, ε=25% · Baseline SNR | Helped | Support is All You Need for Certified VAE Training (ICLR 2025 · 0 citations) | |
| Add cross-executional bound refinement rather than individual bound refinement | MNIST DiffAI, 2-UAP · LP bound t | -0.2 -> -0.05 | Helped | Relational DNN Verification With Cross Executional Bound Refinement (ICML 2024 · 0 citations) |
| remove finite-sample correction | CIFAR-10 feature poisoning, r=0.12, k=3 · average set size | 1.84 -> 1.83 | No clear effect | Robust Yet Efficient Conformal Prediction Sets (ICML 2024 · 0 citations) |
| use strong bounding instead of strong branching alone | CIFAR10 and MNIST networks in Table 1 · worst-case UAP accuracy | 63.8 (+1.6) vs 63.2 (+1.0); 83.0 (+3.0) vs 83.8 (+3.8) | Mixed | Relational Verification Leaps Forward with RABBit (NeurIPS 2024 · 0 citations) |
| Increase ε to 0.3 | MNIST · accuracy | above 90% -> 80% | Hurt | VNN: Verification-Friendly Neural Networks with Hard Robustness Guarantees (ICML 2024) |
What reviewers will expect
Datasets and baselines named in the 10 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 6 of 10 papers
- MNIST · 5 of 10 papers
- CIFAR-100 · 2 of 10 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 40 papers; from OpenAlex and the papers' affiliations).
- University of Illinois, Urbana Champaign · 5 papers
- Imperial College London · 2 papers
- Simon Fraser University · 2 papers
- Inria · 2 papers
- IRT Saint Exupéry · 2 papers
- IRT Saint Exupery · 2 papers
- University of Melbourne · 2 papers
- Defence Science and Technology Group · 2 papers
- Johns Hopkins University · 2 papers
- University of Szeged · 2 papers
Use it
Download BibTeX of 40 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Provable robust learning guarantees (120 papers)
- Decision-boundary geometry of robustness (61 papers)
- Robustness to poisoning and multiple attacks (32 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
- Theory of adversarial risk (59 papers)
- Randomized smoothing certification (49 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).