Certified Robustness via Randomized Smoothing

Smoothing Parameters

Noise level σ 0.35

Monte Carlo samples N 600

Boundary curvature k 0.80

Attack perturbation ε 0.40

Certification Result

certifying…

p_A (top-class vote)

—

Certified radius R

—

Base label f(x₀)

—

ε vs R

—

Class A samples (majority)

Class B samples

Certified radius ball (safe)

Attack vector to x₀+ε

How it works

The base classifier f(x,z) splits the ground plane into two regions along a wavy boundary z = k·sin(1.3x); everything is coloured by which side of that curve it falls on.

Randomized smoothing (Cohen, Rosenfeld & Kolter, 2019) turns any base classifier f into a provably-robust "smoothed" classifier g by voting over Gaussian noise:

g(x) = argmax_c  P[ f(x + ε) = c ],   ε ~ N(0, σ²I)

We approximate that probability with N Monte-Carlo noise samples drawn around the input point x₀ and count how many land in each class — that fraction is p_A. If p_A > ½ the smoothed prediction is certifiably stable inside a ball of radius:

R = σ · Φ⁻¹(p_A)

where Φ⁻¹ is the inverse standard-normal CDF. This is a hard mathematical guarantee: no adversarial perturbation of L2-norm smaller than R can flip g's prediction, regardless of how it is crafted (FGSM, PGD, CW, …) — unlike empirical defenses such as adversarial training, which offer no such certificate.

σ (noise level) — larger σ smooths the boundary more, which usually raises R but can lower p_A near a curved boundary.
N (samples) — more Monte-Carlo samples give a tighter, more reliable estimate of p_A (a real deployment also applies a statistical confidence correction, omitted here for clarity).
k (curvature) — reshapes the decision boundary; a sharper bend near x₀ shrinks the achievable certified radius.
ε (attack perturbation) — the size of a hypothetical adversarial step. If ε < R the perturbation is mathematically guaranteed to be blocked; if ε ≥ R it may (not must) flip the prediction.

Class A region Class B region Input point x₀

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.