# Certified Robustness to Adversarial Examples with Differential Privacy Source: [Certified Robustness to Adversarial Examples with Differential Privacy]() Collection index: [llms.txt]() Data updated: 2025-10-25T21:36:37.771Z Authors: Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, Suman Jana Published: 2018-02-09T22:24:50.000Z ## Abstract Adversarial examples that fool machine learning models, particularly deep neural networks, have been a topic of intense research interest, with attacks and defenses being developed in a tight back-and-forth. Most past defenses are best effort and have been shown to be vulnerable to sophisticated attacks. Recently a set of certified defenses have been introduced, which provide guarantees of robustness to norm-bounded attacks, but they either do not scale to large datasets or are limited in the types of models they can support. This paper presents the first certified defense that both scales to large networks and datasets (such as Google's Inception network for ImageNet) and applies broadly to arbitrary model types. Our defense, called PixelDP, is based on a novel connection between robustness against adversarial examples and differential privacy, a cryptographically-inspired formalism, that provides a rigorous, generic, and flexible foundation for defense. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Certified Robustness on CIFAR-10 (L1 Certified Accuracy Profile)](): Certified Robustness; CIFAR-10; Certified Accuracy (L1, R=0.5): 55.7. - [Certified Robustness on ImageNet](): Certified Robustness; ImageNet; Certified Accuracy (L1 R=0.5): 42.8. ## Original sources and implementation [Original paper]() [PDF]()