Research map / Adversarial robustness and security / Certified and empirical robustness
Provable defenses and their limits
Scale, break or extend certified defenses using generated data and partition aggregation.
23 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Certified and empirical robustness, keyword cluster “smoothing · randomized · certified robustness”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
5 papers in 2023–24 and 6 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 1.7% to 2.6%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · 185 citations)
- 2020 · Adversarial Training and Provable Defenses: Bridging the Gap (ICLR 2020 · 79 citations)
- 2021 · Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks (AAAI 2021 · 82 citations)
- 2022 · Towards Practical Certifiable Patch Defense With Vision Transformer (CVPR 2022 · 61 citations)
- 2023 · The Best Defense Is a Good Offense: Adversarial Augmentation Against Adversarial Attacks (CVPR 2023 · 26 citations)
- 2024 · MMCert: Provable Defense against Adversarial Attacks to Multi-modal Models (CVPR 2024 · 7 citations)
- 2025 · Certified Causal Defense with Generalizable Robustness (AAAI 2025 · 2 citations)
- 2026 · On Robustness of Linear Classifiers to Targeted Data Poisoning (AAAI 2026 · 1 citation)
Earliest papers here
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · 185 citations)
- Adversarial Training and Provable Defenses: Bridging the Gap (ICLR 2020 · 79 citations)
- (De)Randomized Smoothing for Certifiable Defense against Patch Attacks (NeurIPS 2020 · 66 citations)
What has been tried
18 papers here report 191 measured changes (a component added, removed or swapped, compared with a baseline): helped 66%, no clear effect 7%, hurt 19%, mixed 7%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| choose larger k1/k2 ratio (sub-sample fewer elements from higher-attack modality) | KITTI Road · certified pixel accuracy/F-score/IoU | k2=9k1 outperforms k2=3k1 when r2>r1, gap grows with r2/r1 | Helped | MMCert: Provable Defense against Adversarial Attacks to Multi-modal Models (CVPR 2024 · 7 citations) |
| Remove dropout | CIFAR-10 (ℓ∞, ϵ = 8/255) · certified accuracy | 41.32 -> 41.78 | Helped | On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · 4 citations) |
| Add the invariance regularization term | CMNIST · ACR | Helped | Certified Causal Defense with Generalizable Robustness (AAAI 2025 · 2 citations) | |
| increase ablated-sequence count from 4 to 24 | PACE test set · standard accuracy | 98.18 -> 90.24 | Hurt | DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness (ICLR 2024 · 1 citation) |
What reviewers will expect
Datasets and baselines named in the 6 papers of this approach from 2024–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- CIFAR-10 · 2 of 6 papers
Baselines
- Gaussian · 2 of 6 papers
- MACER · 2 of 6 papers
- SmoothAdv · 2 of 6 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 11 papers; from OpenAlex and the papers' affiliations).
- University of Maryland, College Park · 2 papers
Use it
Download BibTeX of 23 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Randomized smoothing certification (49 papers)
- Certified training and ensembles (35 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).