# Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces Source: [Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces]() Collection index: [llms.txt]() Data updated: 2026-05-27T05:00:13.467Z Authors: Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen, Nicolas Loizou, Ren\\'e Vidal Published: 2026-05-25T02:12:58.000Z ## Abstract Deep learning models are vulnerable to adversarial perturbations, raising important concerns for safety-critical deployment. Empirical defenses can achieve strong robustness in practice, but lack formal guarantees, motivating the need for certifiably robust classifiers. While certified methods provide formal guarantees, they often yield overly conservative bounds due to their inability to exploit structure in complex data distributions. In this work, we propose a framework for designing certifiably robust classifiers that leverages latent structure in data representations. We first analyze the Gaussian mixture setting, deriving necessary and sufficient conditions for the existence of robust classifiers and constructing a classifier with a closed-form robustness certificate and generalization guarantees. Our main contribution is to show that exact structure is not required: we prove that if a pretrained encoder maps inputs to a latent distribution that is $\\varepsilon$-close (in KL divergence) to a Gaussian mixture, then certified accuracy degrades gracefully, with an explicit bound relating robustness under the true and approximate distributions. This result enables the direct use of pretrained models without requiring exact distributional assumptions. Empirically, our method achieves state-of-the-art or competitive certified accuracy on CIFAR-10 and ImageNet, while maintaining strong clean performance and low computational overhead. Overall, our work establishes approximate latent structure as a practical and principled route to certifiable robustness. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Image Classification on CIFAR-10 (test) (Certified Robustness)](): Image Classification; CIFAR-10 (test); Clean Accuracy: 90.14. - [Certified Image Classification on ImageNet (Epsilon 1.0, 2.0)](): Image Classification; ImageNet; Certified Accuracy (Epsilon 1.0): 45.7. - [Certified Robustness on ImageNet (L2 Perturbation Bounds)](): Certified Robustness; ImageNet; Inference Time (s): 163.74. ## Original sources and implementation [Original paper]() [PDF]()