# Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences

Source: [Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defences](<https://www.sota2.com/research/paper/68fa79eb1e209131cea7ff89>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2025-10-26T05:07:32.191Z

Authors: Saiyue Lyu, Shadab Shaikh, Frederick Shpilevskiy, Evan Shelhamer, Mathias L\\'ecuyer

Published: 2024-06-14T22:11:02.000Z

## Abstract

We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of our test-time adaptive models against adversarial examples. ARS extends the analysis of randomized smoothing using $f$-Differential Privacy to certify the adaptive composition of multiple steps. For the first time, our theory covers the sound adaptive composition of general and high-dimensional functions of noisy inputs. We instantiate ARS on deep image classification to certify predictions against adversarial examples of bounded $L\_{\\infty}$ norm. In the $L\_{\\infty}$ threat model, ARS enables flexible adaptation through high-dimensional input-dependent masking. We design adaptivity benchmarks, based on CIFAR-10 and CelebA, and show that ARS improves standard test accuracy by $1$ to $15\\%$ points. On ImageNet, ARS improves certified test accuracy by up to $1.6\\%$ points over standard RS without adaptivity. Our code is available at https://github.com/ubc-systopia/adaptive-randomized-smoothing .

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2406.10427>)

[PDF](<https://arxiv.org/pdf/2406.10427.pdf>)