Certified Robustness

The precise input manipulation that certified robustness mathematically defends against. These are imperceptible modifications to data—often pixel-level noise or subtle text alterations—crafted to cause misclassification.

• Lp-norm bounded: Perturbations are constrained within a specific radius (e.g., L∞-norm of 8/255 for images)
• Targeted vs. Untargeted: Attacks can aim for a specific wrong class or just any misclassification
• Physical realizability: Real-world attacks like stickers on stop signs that fool autonomous vehicle classifiers

The primary empirical defense that complements certified methods. The model is retrained on a mixture of clean and adversarially perturbed examples, forcing it to learn robust decision boundaries.

• Min-max optimization: Inner maximization generates strong attacks; outer minimization updates weights to resist them
• Trade-off: Often reduces clean accuracy by 5-15% while dramatically improving robustness
• Limitation: Provides no formal guarantee—a stronger future attack may still break the model

The most scalable technique for achieving certified robustness. It constructs a smoothed classifier that outputs the most probable prediction under Gaussian noise added to the input.

• Probabilistic guarantee: If the top class probability exceeds a threshold, the prediction is provably constant within a certified L2 radius
• Black-box certification: Works on any base classifier without architectural changes
• Scalability: Applied successfully to ImageNet-scale models, unlike exact verification methods

The mathematical techniques that compute the provable lower bound on a model's robustness. These methods analyze the neural network's output landscape to guarantee no adversarial example exists within a given radius.

• Complete verifiers: Exact methods using SMT solvers or MILP—NP-complete and infeasible for large networks
• Incomplete verifiers: Efficient over-approximation using interval bound propagation or linear relaxation
• IBP training: Interval Bound Propagation minimizes the worst-case output bound during training for tight certified guarantees

The inference-time threat that certified robustness directly addresses. Unlike poisoning, evasion attacks modify the input at test time to deceive an already-trained model without altering the model itself.

• White-box: Attacker has full access to model gradients and architecture
• Black-box: Attacker only queries the model API, using transfer attacks or score-based optimization
• Real-world impact: Evasion of malware classifiers, facial recognition spoofing, and content filter bypass

The mathematical property that bounds how much a function's output can change relative to its input. A model with a small Lipschitz constant is inherently robust to input perturbations.

• Definition: |f(x) - f(y)| ≤ L · ||x - y|| for some constant L
• Certification via Lipschitz: If L is known and small, a guaranteed safe radius can be computed directly
• Enforcement: Spectral normalization and gradient penalty regularization constrain the Lipschitz constant during training