% Key papers for Provable defenses and their limits (scime atlas, https://atlas.scime.ai). Authors are not included: add them from the paper pages.

@inproceedings{neurips2019_certified_57987,
  title = {{Certified Adversarial Robustness with Additive Noise}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2019},
  url = {https://nips.cc/virtual/2019/poster/13983},
}

@inproceedings{aaai2021_intrinsic_805,
  title = {{Intrinsic Certified Robustness of Bagging against Data Poisoning Attacks}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2021},
  url = {https://aaai.org/papers/07961-intrinsic-certified-robustness-of-bagging-against-data-poisoning-attacks/},
}

@inproceedings{iclr2020_adversarial_29656,
  title = {{Adversarial Training and Provable Defenses: Bridging the Gap}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=SJxSDxrKDr},
}

@inproceedings{neurips2020_de_59220,
  title = {{(De)Randomized Smoothing for Certifiable Defense against Patch Attacks}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2020},
  url = {https://nips.cc/virtual/2020/poster/18518},
}

@inproceedings{cvpr2022_towards_20055,
  title = {{Towards Practical Certifiable Patch Defense With Vision Transformer}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2022},
}

@inproceedings{cvpr2023_the_22334,
  title = {{The Best Defense Is a Good Offense: Adversarial Augmentation Against Adversarial Attacks}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2023},
  url = {https://cvpr.thecvf.com/virtual/2023/poster/21820},
}

@inproceedings{aaai2022_efficient_2028,
  title = {{Efficient Robust Training via Backward Smoothing}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2022},
  url = {https://aaai.org/papers/06222-efficient-robust-training-via-backward-smoothing/},
}

@inproceedings{iclr2021_deep_30409,
  title = {{Deep Partition Aggregation: Provable Defenses against General Poisoning Attacks}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2021},
  url = {https://iclr.cc/virtual/2021/poster/2867},
}

@inproceedings{iclr2020_breaking_29485,
  title = {{BREAKING CERTIFIED DEFENSES: SEMANTIC ADVERSARIAL EXAMPLES WITH SPOOFED ROBUSTNESS CERTIFICATES}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2020},
  url = {https://openreview.net/forum?id=HJxdTxHYvB},
}

@inproceedings{neurips2021_scalecert_62234,
  title = {{ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layers}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2021},
  url = {https://nips.cc/virtual/2021/poster/27128},
}

@inproceedings{icml2022_improved_40680,
  title = {{Improved Certified Defenses against Data Poisoning with (Deterministic) Finite Aggregation}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2022},
  url = {https://icml.cc/virtual/2022/poster/16363},
}

@inproceedings{cvpr2024_mmcert_24069,
  title = {{MMCert: Provable Defense against Adversarial Attacks to Multi-modal Models}},
  booktitle = {IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)},
  year = {2024},
  url = {https://cvpr.thecvf.com/virtual/2024/poster/30936},
}

@inproceedings{icml2023_run_42410,
  title = {{Run-off Election: Improved Provable Defense against Data Poisoning Attacks}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2023},
  url = {https://icml.cc/virtual/2023/poster/24468},
}

@inproceedings{neurips2022_multiguard_65693,
  title = {{MultiGuard: Provably Robust Multi-label Classification against Adversarial Examples}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2022},
  url = {https://nips.cc/virtual/2022/poster/55043},
}

@inproceedings{neurips2024_on_72298,
  title = {{On the Scalability of Certified Adversarial Robustness with Generated Data}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2024},
  url = {https://neurips.cc/virtual/2024/poster/95047},
}

@inproceedings{aaai2025_certified_8402,
  title = {{Certified Causal Defense with Generalizable Robustness}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2025},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/34205},
}

@inproceedings{neurips2022_lethal_64848,
  title = {{Lethal Dose Conjecture on Data Poisoning}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2022},
  url = {https://nips.cc/virtual/2022/poster/55441},
}

@inproceedings{iclr2024_drsm_35168,
  title = {{DRSM: De-Randomized Smoothing on Malware Classifier Providing Certified Robustness}},
  booktitle = {International Conference on Learning Representations (ICLR)},
  year = {2024},
  url = {https://iclr.cc/virtual/2024/poster/17905},
}

@inproceedings{aaai2026_on_106949,
  title = {{On Robustness of Linear Classifiers to Targeted Data Poisoning}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/39301},
}

@inproceedings{icml2025_provably_46543,
  title = {{Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2025},
  url = {https://icml.cc/virtual/2025/poster/46025},
}

@inproceedings{neurips2026_rustmizan_93486,
  title = {{RustMizan: A Compilable, Contamination-Aware Benchmarking Framework for Rust Vulnerabilities}},
  booktitle = {Advances in Neural Information Processing Systems (NeurIPS)},
  year = {2026},
  url = {https://neurips.cc/virtual/2026/poster/139253},
}

@inproceedings{aaai2026_certmask_104187,
  title = {{CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coverage}},
  booktitle = {AAAI Conference on Artificial Intelligence (AAAI)},
  year = {2026},
  url = {https://ojs.aaai.org/index.php/AAAI/article/view/37716},
}

@inproceedings{icml2026_does_50276,
  title = {{Does a Hybrid Space-Aware Randomized Defense Improve Empirical and Certified Adversarial Robustness?}},
  booktitle = {International Conference on Machine Learning (ICML)},
  year = {2026},
  url = {https://openreview.net/forum?id=Alelgxnwgs},
}