Research map / Adversarial robustness and security / Certified and empirical robustness
Randomized smoothing certification
Certify robustness by smoothing classifiers with noise, extending to new norms and tasks.
49 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2019–2026) · an approach in Certified and empirical robustness, keyword cluster “smoothing · randomized · certified robustness”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
17 papers in 2023–24 and 10 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic shrank, from 5.6% to 4.3%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2019 · Certified Adversarial Robustness via Randomized Smoothing (ICML 2019 · 587 citations)
- 2020 · Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablation (AAAI 2020 · 67 citations)
- 2021 · How Robust Are Randomized Smoothing Based Defenses to Data Poisoning? (CVPR 2021 · 24 citations)
- 2022 · Input-Specific Robustness Certification for Randomized Smoothing (AAAI 2022 · 16 citations)
- 2023 · Confidence-Aware Training of Smoothed Classifiers for Certified Robustness (AAAI 2023 · 3 citations)
- 2024 · DRF: Improving Certified Robustness via Distributional Robustness Framework (AAAI 2024 · 5 citations)
- 2025 · Pixel-level Certified Explanations via Randomized Smoothing (ICML 2025 · 0 citations)
- 2026 · Higher-Order Certified Robustness for Regression (ICML 2026 · 0 citations)
Earliest papers here
- Certified Adversarial Robustness via Randomized Smoothing (ICML 2019 · 587 citations)
- Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers (NeurIPS 2019 · 261 citations)
- Tight Certificates of Adversarial Robustness for Randomly Smoothed Classifiers (NeurIPS 2019 · 51 citations)
What has been tried
41 papers here report 417 measured changes (a component added, removed or swapped, compared with a baseline): helped 58%, no clear effect 10%, hurt 26%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Increase initial regularization λ0 | MNIST, σ=1.00 · certified accuracy | Mixed | DRF: Improving Certified Robustness via Distributional Robustness Framework (AAAI 2024 · 5 citations) | |
| Set γ to 0.9 instead of 0.99 | CIFAR-10, int8 · average certified radius | 0.446 -> 0.438 | Hurt | Incremental Randomized Smoothing Certification (ICLR 2024 · 2 citations) |
| Vary α across 0.15, 0.25, and 0.45 | Great Court · certified median error | Mixed | Certified Adversarial Robustness via Randomized $\alpha$-Smoothing for Regression Models (NeurIPS 2024 · 1 citation) | |
| Increase the certified radius | ImageNet classifiers · %certified | Hurt | Pixel-level Certified Explanations via Randomized Smoothing (ICML 2025 · 0 citations) | |
| Add hard-data discarding to Gaussian training | CIFAR-10, σ=0.5 · ACR | 0.525 -> 0.627 | Helped | Average Certified Radius is a Poor Metric for Randomized Smoothing (ICML 2025 · 0 citations) |
| Set deletion probability to a fixed constant instead of adapting it to input length | Edit-distance certification · certificate lower bound | less than 10^{-7} | No clear effect | AdaptDel: Adaptable Deletion Rate Randomized Smoothing for Certified Robustness (NeurIPS 2025 · 0 citations) |
| Use rRCM-B-Deep instead of rRCM-B | ImageNet, certified accuracy across perturbation radii · certified accuracy | Helped | Robust Representation Consistency Model via Contrastive Denoising (ICLR 2025 · 0 citations) | |
| increase EGG exponent from η=2.0 to η=8.0 | CIFAR10, r=1.00 · certified accuracy | 20.2% -> 20.6% | Helped | Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothing (ICML 2024 · 0 citations) |
| train only the mask model for 10 epochs while fixing the base classifier | ImageNet, σ=0.5 · standard accuracy | 57.4 (0.010) -> 56.0 (0.003) | Hurt | Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences (NeurIPS 2024 · 0 citations) |
What reviewers will expect
Datasets and baselines named in the 8 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ImageNet · 4 of 8 papers
- CIFAR-10 · 3 of 8 papers
Baselines
- Gaussian · 2 of 8 papers
- SmoothAdv · 2 of 8 papers
- MACER · 2 of 8 papers
- Consistency · 2 of 8 papers
- SmoothMix · 2 of 8 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 27 papers; from OpenAlex and the papers' affiliations).
- University of Melbourne · 4 papers
- CISPA Helmholtz Center for Information Security · 3 papers
- University of Tuebingen · 3 papers
- University of Illinois, Urbana Champaign · 3 papers
- Technical University Munich · 2 papers
- Technische Universität München · 2 papers
- University of Tübingen · 2 papers
- Saarland University · 2 papers
- Universität Köln · 2 papers
Use it
Download BibTeX of 37 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Certified training and ensembles (35 papers)
- Provable defenses and their limits (23 papers)
Elsewhere in the topic
- Robustness-accuracy trade-off analysis (148 papers)
- Adversarial training with feature consistency (135 papers)
- Provable robust learning guarantees (120 papers)
- Attack evaluation and defense critique (103 papers)
- Adversarial training refinements (87 papers)
- Neural network robustness verification (87 papers)
- Robust overfitting and regularization (79 papers)
- Adversarial training recipes (68 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).