Certified Robustness

Empirical defences are claims that nobody has broken them yet, and the history of the field is a list of such claims that were later broken. A certificate is different: a proof that no perturbation within a stated radius can change this prediction. It is much weaker in radius than empirical defences appear to be, and it is actually true.

Randomised smoothing is the practical route — classify a noisy vote rather than the input, and the smoothed classifier's margin yields a radius directly. The trade is that the certificate covers a specific norm ball and says nothing outside it, so a certified model is not a safe model; it is a model with one honest guarantee attached to it. Inference costs a batch of samples per prediction.

With g(x) = argmax P over noise η ~ N(0, σ²I) of f(x+η) = c, the prediction is certified within radius (σ/2)·(Φ super ^-1 (p sub _A ) − Φ super ^-1 (p sub _B )) for top-two class probabilities p sub _A , p sub _B . Radius grows with σ and with confidence, so more noise buys a larger certificate and a less accurate classifier — the trade is in one formula.