The base classifier f(x,z) splits the plane into two regions along a wavy boundary z = k·sin(1.3x); everything is coloured by which side of that curve it falls on. Top-down view: x is horizontal, z is vertical.
Randomized smoothing (Cohen, Rosenfeld & Kolter, 2019) turns any base classifier f into a provably-robust "smoothed" classifier g by voting over Gaussian noise:
g(x) = argmax_c P[ f(x + ε) = c ], ε ~ N(0, σ²I)
We approximate that probability with N Monte-Carlo noise samples drawn around the input point x₀ and count how many land in each class — that fraction is p_A. If p_A > ½ the smoothed prediction is certifiably stable inside a ball of radius:
R = σ · Φ⁻¹(p_A)
where Φ⁻¹ is the inverse standard-normal CDF (verified numerically against known quantiles: Φ⁻¹(0.975)=1.95996, Φ⁻¹(0.9)=1.28155 — the rational approximation below reproduces both to 5+ decimal places). This is a hard mathematical guarantee: no adversarial perturbation of L2-norm smaller than R can flip g's prediction, regardless of how it is crafted (FGSM, PGD, CW, …) — unlike empirical defenses such as adversarial training, which offer no such certificate.
- σ (noise level) — larger σ smooths the boundary more, which usually raises R but can lower p_A near a curved boundary.
- N (samples) — more Monte-Carlo samples give a tighter, more reliable estimate of p_A (a real deployment also applies a statistical confidence correction, omitted here for clarity).
- k (curvature) — reshapes the decision boundary; a sharper bend near x₀ shrinks the achievable certified radius.
- ε (attack perturbation) — the size of a hypothetical adversarial step. If ε < R the perturbation is mathematically guaranteed to be blocked; if ε ≥ R it may (not must) flip the prediction.
The lower analytics panel plots the certified-radius curve R(p) = σ·Φ⁻¹(p) directly, marking the current (p_A, R) point and the ε threshold line — the same relationship that drives the top view, shown as pure math instead of geometry.