Randomized Smoothing

Provides a provable lower bound on the L2 radius within which no adversarial perturbation can change the classifier's prediction. Unlike empirical defenses that can be broken by stronger attacks, this guarantee is attack-agnostic and mathematically rigorous. The certified radius depends on the base classifier's margin and the noise level sigma. For a given input, if the top class probability is pA and the runner-up is pB, the certified radius R = (σ/2) * (Φ⁻¹(pA) - Φ⁻¹(pB)), where Φ⁻¹ is the inverse Gaussian CDF. This transforms a probabilistic prediction into a deterministic safety envelope.

The standard deviation σ of the added Gaussian noise acts as a critical hyperparameter controlling the accuracy-robustness trade-off:

• High σ: Larger certified radii and stronger guarantees, but degrades the base classifier's clean accuracy by blurring semantically meaningful features
• Low σ: Preserves clean accuracy but provides only trivial robustness certificates
• Optimal σ: Must be tuned per dataset and architecture; typical values range from 0.12 to 1.0 for CIFAR-10 This trade-off is fundamental and cannot be eliminated—it reflects the inherent tension between sensitivity to legitimate features and invariance to perturbations.

At inference time, the smoothed classifier g(x) is evaluated by:

1. Sampling n i.i.d. noise vectors from N(0, σ²I)
2. Running the base classifier f on each corrupted copy: f(x + ε₁), f(x + ε₂), ..., f(x + εₙ)
3. Returning the majority vote among the n predictions Typical n values range from 10,000 to 100,000 for certification. A lower-confidence bound (Clopper-Pearson) is used to estimate the true top-class probability with high confidence (1-α). This transforms a single-point prediction into a statistical estimation procedure.

Randomized smoothing functions as a black-box wrapper around any base classifier f, requiring no modification to the model's architecture, training procedure, or internal weights. This property enables:

• Retroactive certification: Existing deployed models can be wrapped without retraining
• Framework independence: Works with PyTorch, TensorFlow, JAX, or any differentiable framework
• Model-agnostic deployment: Applies identically to CNNs, Vision Transformers, MLPs, or ensemble methods The only requirement is that the base classifier accepts perturbed inputs and outputs class predictions. This decoupling of certification from architecture is a key practical advantage.

The standard randomized smoothing framework provides guarantees specifically in the L2 (Euclidean) norm. This is a direct consequence of using isotropic Gaussian noise, which is rotationally symmetric. Extensions exist for other threat models:

• L∞ robustness: Achieved by smoothing with uniform or Laplacian noise distributions
• L1 robustness: Requires exponential or other heavy-tailed noise distributions
• L0 robustness: Addressed via randomized ablation or sparse smoothing techniques Each noise distribution induces guarantees in its corresponding dual norm. The choice of noise distribution must align with the threat model relevant to the deployment context.

Despite its guarantees, randomized smoothing has known limitations:

• Information loss: The smoothing operation destroys fine-grained spatial information, making it unsuitable for tasks requiring precise localization (e.g., segmentation)
• Semantic gaps: The certified radius is often smaller than the empirical robust radius achieved by adversarial training, meaning the guarantee is conservative
• Computational cost: Certification requires thousands of forward passes per input, making real-time certification infeasible without hardware acceleration
• Gradient obfuscation: The smoothed classifier's gradients are stochastic, complicating gradient-based attribution and explainability methods These limitations motivate active research into tighter certification bounds and more efficient sampling strategies.

A formal, mathematical guarantee that a model's prediction will remain constant for any input perturbation within a defined Lp-norm ball. Unlike empirical defenses that can be broken by stronger attacks, certified robustness provides an unconditional lower bound on model accuracy under attack. Randomized smoothing is the most scalable method to achieve this guarantee for large neural networks without modifying the training procedure.

An adversarial attack at inference time that modifies an input sample with imperceptible perturbations to cause misclassification. Unlike poisoning attacks that corrupt training, evasion exploits the model's learned decision boundaries. Randomized smoothing directly counters evasion by averaging predictions over noise, making it impossible for small perturbations to consistently flip the output across all noisy samples.

The resilience of a distributed system to arbitrary failures or malicious actors sending conflicting information. In federated learning, Byzantine clients may submit corrupted gradients to derail training. Robust aggregation rules inspired by BFT principles—such as Krum and median-based aggregators—complement randomized smoothing by ensuring the global model converges despite adversarial participants.