Pith. sign in

REVIEW 2 major objections 5 minor 99 references

Position: Certified Robustness Does Not (Yet) Imply Model Security

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Certified robustness certificates bound the distance to the nearest class-flipping example, not the distance to the nearest adversarial example, so a certificate provides no information about whether a sample has been attacked.

desk verdict A useful cautionary position paper whose central logical point is sound, but whose claim that only certificate absence is actionable overstates the case. read the letter →

arxiv 2506.13024 v2 pith:35377EZ3 submitted 2025-06-16 cs.CR cs.LG

Andrew C. Cullen , Paul Montague , Sarah M. Erfani , Benjamin I.P. Rubinstein This is my paper
classification cs.CRcs.LG
keywords certifiedrobustnessadversarialexamplesmodelsecuritytheatercertificationradiusrandomizedsmoothingthreatmodelspositionpaper
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This position paper argues that certified robustness certificates, which are widely presented as guaranteed protection against adversarial examples, should not yet be treated as model security. The key distinction is that a certificate bounds the distance to the nearest example that changes the model's predicted class, not the distance to the nearest example that changes the true class; a misclassified or attacked input can therefore carry a certificate just as a clean input can. Because certificates exist for both clean and adversarial samples, their existence gives no information about whether a sample has been attacked, and the authors conclude that the only reliable, actionable information a certificate currently provides is its absence. The paper also warns that marketing certificates as guarantees can create security theater: overconfidence that diverts attention from other defenses, while certificates themselves can reveal to attackers where adversarial examples cannot exist. If the argument is right, certified robustness should be reframed as one input to risk management and evaluated against realistic threat models, not presented as a standalone security guarantee.

What carries the argument

The load-bearing object is the certification radius $r^{\star}=\inf\{\|x-x'\|_p : x'\in S,\; F(x)\neq F(x')\}$, where $F$ is the one-hot encoded prediction of the model. The paper's move is to read this definition literally: it is a distance to a class change in the model's output, and nothing in the definition mentions whether the predicted class is correct. Randomized smoothing, interval bound propagation, and global Lipschitz margins all produce this same type of quantity, so the ambiguity is not an artifact of one technique. Theorem 1 formalizes the clean/adversarial ambiguity, and Theorem 2 shows how an $\ell_p$ certificate translates to an $\ell_q$ threat model: for $q>p$, $\ell_q$-norm adversarial examples smaller than the certified region can exist, so certificates are tied to the specific norm being certified.

What would settle it

Run a standard attack such as projected gradient descent on a classifier that outputs certified guarantees, and record the guarantee size for each successfully misclassified sample; if many attacked samples receive nonzero guarantees, the paper's Theorem 1 is confirmed. The stronger claim that only the absence of a guarantee is reliable would be falsified by showing that the full distribution of guarantee sizes separates clean from attacked samples with high accuracy that transfers across datasets and models.

Watch

Extended reading notes

Core claim

The central claim is that current certified defenses produce a certification radius that measures the distance to the nearest class-flipping example relative to the model's own prediction, with no reference to ground truth. In deployed settings this distance can be measured from a clean sample to an adversarial one, from an adversarial sample to a different adversarial class, or from an adversarial sample to the true class; the certificate itself cannot distinguish these cases. Theorem 1 states that a certification of size $\epsilon$ could correspond either to a certification of the correct class or to a certification of an incorrect class, so the existence of a certificate provides no intrinsic information about whether the input has been attacked. A corollary is that a certificate does not measure the effort needed to attack a sample, because certificates can be exploited to guide adversarial search. The paper's practical conclusion is that the only reliable, actionable information a certification technique currently provides is the absence of a certification.

Load-bearing premise

The argument's load-bearing premise is that the sizes of the certified regions around samples carry no usable information about whether a sample was attacked; the paper grants that attacked samples may produce smaller guarantees but treats that as an unsupported heuristic, so the conclusion that only the absence of a guarantee is reliable rests on that correlation being useless in practice.

Editorial extensions

If this is right

  • A certificate is not evidence that a sample is benign; deployers should treat it as a bound on where the model's prediction changes, and combine it with other monitoring rather than relying on it as a guarantee.
  • Certificates should be kept secret from untrusted parties, because they encode information about where adversarial examples can and cannot exist and can be used to construct stronger attacks.
  • Security claims must be tied to the exact threat model certified: an $\ell_p$ certificate does not cover an attacker who can use a different $\ell_q$ norm, and geometric or semantic perturbations may be outside the certified region entirely.
  • Certification research needs standardized, application-driven evaluation, covering resource use, parallelism, dataset coverage, and suitability for the deployed task, rather than only average radii on reference datasets.
  • Presenting certificates as guarantees rather than as constrained, heuristic risk indicators risks security theater: users may drop other defenses precisely because they believe the guarantee is absolute.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's logic generalizes beyond $\ell_p$ classifiers: any certificate defined relative to the model's own prediction, such as edit-distance certificates for sequence models or policy-smoothing certificates for reinforcement learning, inherits the same clean/adversarial ambiguity because it never references ground truth.
  • If the conceded empirical correlation between small radii and adversarial inputs is stable, certificates could still be repurposed as risk scores in a statistical sense even though they are not logical proofs; the paper does not rule this out, it only notes the lack of theoretical backing.
  • Whether certificate absence is reliable is an empirical question the paper leaves open: a detector that flags low-radius inputs could make certificates useful for attack detection if its false-positive rate on clean data is acceptable, which would soften the paper's 'only absence is reliable' claim.
  • The security-theater argument implies a testable human-factors prediction: users told a model is 'certified robust' will choose to deploy it with fewer additional controls than users told the same model has a bounded-risk indicator; a simple behavioural experiment could test that.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. This position paper argues that certified robustness certificates, as currently formulated, do not constitute a model-security guarantee. The central logical observation is that a certification bounds the distance to the nearest class-flipping example relative to the predicted class, not to the nearest adversarial example relative to the true label. Hence a misclassified (adversarial) input can itself be certified, and a certificate does not by itself distinguish clean from attacked samples. The paper discusses the three main certification families (randomized smoothing, interval bound propagation, global Lipschitz), notes the risk of norm-mismatch attacks (Theorem 2), warns that certificates can guide attackers, and argues that presenting certifications as guarantees can lead to 'security theater.' It closes with open questions about practical deployment, evaluation, coverage, and secure implementation.

Significance. The paper's core point is correct and important: the field often conflates 'certified robustness' with 'security,' and the distinction between a certificate of prediction invariance and a certificate of correctness is real. If the community heeds the call, this paper could help change how certified robustness results are framed. The paper is honest about relying on earlier work for the key empirical claims (e.g., certifiable adversarial examples and certificate-guided attacks) and includes a formal norm-containment theorem. Its main weakness is that Section 3 overreaches: it dismisses as 'only a heuristic' a theoretically grounded relationship between attacked inputs and small certified radii, and it states Theorem 1 without proof. These issues do not undermine the title claim, but they need to be fixed before the position is publishable in its current form.

major comments (2)
  1. [Section 3, fifth paragraph] The statement that 'the only reliable, actionable information that a certification technique may currently provide is the absence of a certification' is too strong and is contradicted by the paper's own Eq. (2). For any inputs x and y with F(x) != F(y), the certified radius at y satisfies r(y) <= ||y-x||_p, because x is an admissible witness in the infimum defining r(y). Consequently, any adversarial example produced by an epsilon-bounded attack from a correctly classified clean input has certified radius at most epsilon, while a clean input can in principle have a much larger radius. This is a mathematically grounded signal, not 'only a heuristic, with no theoretical backing' as claimed in the same paragraph. The paper conflates the correct logical claim that a certificate does not prove the input is clean with the unsupported claim that certificate radii convey no decision-relevant information. I recommend rewriting this passage to acknowledge that radii can serve as a risk signal while making clear that they are not a certificate of correctness.
  2. [Section 3, Theorem 1] Theorem 1 is stated as a theorem but is not proved, and its key terms are undefined: there is no formal model of the attack process, no sample space over clean and adversarial inputs, and no definition of 'information.' As written, the theorem is effectively an observation that a certified radius is defined relative to the predicted class. That observation is correct and is sufficient for the paper's core thesis. However, the theorem's conclusion ('the existence of a certification does not intrinsically provide any information regarding if the sample x has been attacked') is a stronger statistical claim that is not established by the preceding argument and that repeats the conflation described above. Please either prove a formal version of Theorem 1 or recast it as a definitional observation, and replace 'no information' with 'no logical guarantee of cleanliness.'
minor comments (5)
  1. [Section 4, Theorem 2] The phrase 'Potential adversarial attacks ... exist for rq > ...' overstates what the proof shows. The proof establishes that the certified ℓp ball does not cover the whole ℓq ball, so attacks in that region are not ruled out; it does not establish the existence of an actual class-flipping input. Rephrase as 'the certificate does not rule out attacks for rq > ...'.
  2. [Section 2.2.1] The displayed equations for randomized smoothing (Eq. (3) and Eq. (4)) contain typesetting artifacts that make them difficult to read; in particular, the expectation expression and the certified-radius formula are not fully legible as rendered. Please provide clean, self-contained statements with proper citations, including one for the Cohen et al. certified radius.
  3. [Abstract and Introduction] The abstract introduces 'the paradox of detection without distinction,' but this phrase does not appear in the body of the paper. Please define it in the Introduction or remove it from the abstract.
  4. [Section 3, Open Question 1] The text describes a certification as 'a heuristic measure of how likely it is that a sample may have been manipulated,' which is in tension with the same section's earlier dismissal of the smaller-radius pattern as 'only a heuristic.' These two statements should be aligned after the Section 3 revision.
  5. [Section 2.2] The notation for F is introduced as a one-hot encoding of the predicted class, but later uses (e.g., Eq. (6) and the surrounding text) treat F(x) as a scalar label or as a value comparable to the abstention marker. Please standardize the notation for F throughout.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the central logical claim follows directly from the definition of certification, and the paper's self-citations are transparent, checkable, and not the sole support for any premise.

full rationale

This is a position paper rather than a derivation of predictions from fitted inputs. The key claim—that a certificate bounds the distance to the nearest class-flipping example rather than the distance to the nearest adversarial example—is a definitional consequence of Eq. (2), where r* is defined as inf{||x-x'||_p : F(x) != F(x')}. The paper then observes that because an attacked input is simply a misclassified input whose class prediction may still be far from the decision boundary, the existence of a certificate carries no logical information about whether the sample was attacked. That observation is derived from the stated definitions and is independently illustrated by the location-invariant classifier example in Section 3. The citations to Cullen et al. (2024b) for the facts that certifiable adversarial examples exist and that certificates can guide attackers are self-citations, but they point to a separate published empirical study; moreover, the logical possibility is restated and justified within this paper, so the argument does not reduce to the citation. There are no fitted parameters renamed as predictions, no imported uniqueness theorem, and no ansatz smuggled in via citation. The skeptical objection that Section 3 understates the information carried by certificate radii (e.g., that an epsilon-bounded attack forces a certified radius of at most epsilon) is a challenge to the strength of a practical conclusion, not evidence that the conclusion was assumed as an input. It therefore belongs to correctness risk, not to circularity.

Assumptions & free parameters 0 free parameters · 6 assumptions · 0 invented entities

No free parameters or invented entities were introduced; the paper contains no fitted values or hand-tuned constants. Its claims are qualitative and definitional, and the burden of the argument rests on the domain assumptions listed above.

assumptions (6)
  • domain assumption A certificate radius r (Eq. 2) is a reliable proxy for detectability of adversarial examples and for attacker cost.
    Invoked in Section 2.2 with a citation to Gilmer et al. (2018). The paper uses this proxy to motivate why certifications are attractive, then argues it is insufficient for security; the proxy itself is not proven.
  • domain assumption Adversarial examples can themselves be certified when the model assigns high confidence to the incorrect class.
    Stated in Section 3 and attributed to Cullen et al. (2024b). It is load-bearing for Theorem 1 and the 'detection without distinction' paradox, but is not demonstrated in this paper.
  • standard math Finite-dimensional ℓp and ℓq norm ball containment relations used in Theorem 2.
    The proof of Theorem 2 in Section 4 relies on the standard inequality between ℓp norms in d dimensions; this is a textbook fact, not an empirical claim.
  • domain assumption A certificate carries no information about whether the predicted class is the true class.
    This premise underlies Theorem 1 and the paper's central claim. It follows from Eq. 2, which defines the certified radius relative to the predicted label F(x), but the paper treats it as an assumption about what practitioners can infer.
  • domain assumption Attacker access to certificate values gives attackers an information advantage that can degrade security.
    Section 3 and Section 3.1 cite Cullen et al. (2024b) for the claim that certificates guide adversarial search; the present paper does not reproduce that result and builds its 'may compromise security' argument on it.
  • domain assumption Users and deployers will over-trust certifications, leading to security theater and net harm.
    This is the behavioral premise of the paper's central normative argument (Sections 1, 3, 6). It is plausible and supported by analogy to privacy theater, but the paper provides no direct evidence for this claim in certification settings.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Position: Certified Robustness Does Not (Yet) Imply Model Security." pith.science (2026). https://pith.science/paper/35377EZ3

@misc{pith2026250613024,
  author       = {Pith},
  title        = {Pith review of: Position: Certified Robustness Does Not (Yet) Imply Model Security},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/35377EZ3}},
  note         = {Machine review of arXiv:2506.13024}
}
read the original abstract

While certified robustness is widely promoted as a solution to adversarial examples in Artificial Intelligence systems, significant challenges remain before these techniques can be meaningfully deployed in real-world applications. We identify critical gaps in current research, including the paradox of detection without distinction, the lack of clear criteria for practitioners to evaluate certification schemes, and the potential security risks arising from users' expectations surrounding ``guaranteed" robustness claims. These create an alignment issue between how certifications are presented and perceived, relative to their actual capabilities. This position paper is a call to arms for the certification research community, proposing concrete steps to address these fundamental challenges and advance the field toward practical applicability.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

99 extracted references · 68 canonical work pages

  1. [1]

    Cullen, and Tansu Alpcan

    Takuma A Adams, Andrew C. Cullen, and Tansu Alpcan. Suboptimality of C onstrained A ction A dversarial C yber- P hysical G ames. Dynamic Games and Applications, pp.\ 1--20, 2025

    2025

  2. [2]

    Politics of Adversarial Machine Learning

    Kendra Albert, Jonathon Penney, Bruce Schneier, and Ram Shankar Siva Kumar. Politics of A dversarial M achine L earning. arXiv preprint arXiv:2002.05648, 2020

    work page Pith review arXiv 2002

  3. [3]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International C onference on M achine L earning , pp.\ 274--283. PMLR, 2018

    2018

  4. [4]

    Differential P rivacy on F inite C omputers

    Victor Balcer and Salil Vadhan. Differential P rivacy on F inite C omputers. arXiv preprint arXiv:1709.05396, 2017

    arXiv 2017

  5. [5]

    Evasion A ttacks A gainst M achine L earning at T est T ime

    Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim S rndi \'c , Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion A ttacks A gainst M achine L earning at T est T ime. In Joint European Conference on Machine Learning and Knowledge Discovery in Databases, ECMLPKDD, pp.\ 387--402. Springer, 2013

    2013

  6. [6]

    The F ourth I nternational V erification of N eural N etworks C ompetition ( VNN - COMP 2023): S ummary and R esults

    Christopher Brix, Stanley Bak, Changliu Liu, and Taylor T Johnson. The F ourth I nternational V erification of N eural N etworks C ompetition ( VNN - COMP 2023): S ummary and R esults. arXiv preprint arXiv:2312.16760, 2023

    arXiv 2023

  7. [7]

    Gender S hades: I ntersectional A ccuracy D isparities in C ommercial G ender C lassification

    Joy Buolamwini and Timnit Gebru. Gender S hades: I ntersectional A ccuracy D isparities in C ommercial G ender C lassification. In Conference on Fairness, Accountability and Transparency, pp.\ 77--91. PMLR, 2018

    2018

  8. [8]

    E fficient D efenses A gainst A dversarial A ttacks

    Nicholas Carlini and David Wagner. Mag N et and " E fficient D efenses A gainst A dversarial A ttacks" are not R obust to A dversarial E xamples. arXiv preprint arXiv:1711.08478, 2017 a

    arXiv 2017

Show all 99 references
  1. [9]

    Towards E valuating the R obustness of N eural N etworks

    Nicholas Carlini and David Wagner. Towards E valuating the R obustness of N eural N etworks. In 2017 IEEE S ymposium on S ecurity and P rivacy (S & P) , pp.\ 39--57. IEEE, 2017 b

    2017

  2. [10]

    Implicit D iversity in I mage S ummarization

    L Elisa Celis and Vijay Keswani. Implicit D iversity in I mage S ummarization. Proceedings of the ACM on Human-Computer Interaction, 4 0 (CSCW2): 0 1--28, 2020

    2020

  3. [11]

    Adversarial A ttacks and D efences: A S urvey

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. Adversarial A ttacks and D efences: A S urvey. arXiv preprint arXiv:1810.00069, 2018

    2018 arXiv

  4. [12]

    Certified D efenses for A dversarial P atches

    Ping-yeh Chiang, Renkun Ni, Ahmed Abdelkader, Chen Zhu, Christoph Studer, and Tom Goldstein. Certified D efenses for A dversarial P atches. In International Conference on Learning Representations, ICLR, 2020

    2020

  5. [13]

    Certified A dversarial R obustness via R andomized S moothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified A dversarial R obustness via R andomized S moothing. In International Conference on Machine Learning, ICML, pp.\ 1310--1320. PMLR, 2019

    2019

  6. [14]

    Reliable E valuation of A dversarial R obustness with an E nsemble of D iverse P arameter- F ree A ttacks

    Francesco Croce and Matthias Hein. Reliable E valuation of A dversarial R obustness with an E nsemble of D iverse P arameter- F ree A ttacks. In International Conference on Machine Learning, ICML, pp.\ 2206--2216. PMLR, 2020

    2020

  7. [15]

    Cullen, Paul Montague, Shijie Liu, Sarah Monazam Erfani, and Benjamin I.P

    Andrew C. Cullen, Paul Montague, Shijie Liu, Sarah Monazam Erfani, and Benjamin I.P. Rubinstein. Double B ubble, T oil and T rouble: E nhancing C ertified R obustness through T ransitivity. In Advances in Neural Information Processing Systems, volume 35, pp.\ 19099--19112. Neu...

    2022

  8. [16]

    Cullen, Benjamin I.P

    Andrew C. Cullen, Benjamin I.P. Rubinstein, Sithamparanathan Kandeepan, Barry Flower, and Philip HW Leong. Predicting D ynamic S pectrum A llocation: A review covering S imulation, M odelling, and P rediction. Artificial Intelligence Review, 56 0 (10): 0 10921--10959, 2023

    2023

  9. [17]

    Cullen, Tansu Alpcan, and Alexander Kalloniatis

    Andrew C. Cullen, Tansu Alpcan, and Alexander Kalloniatis. Game- T heoretic A nalysis of A dversarial D ecision M aking in a C omplex S ocio- P hysical S ystem. Dynamic G ames and A pplications , pp.\ 1--20, 2024 a

    2024

  10. [18]

    Cullen, Shijie Liu, Paul Montague, Sarah M

    Andrew C. Cullen, Shijie Liu, Paul Montague, Sarah M. Erfani, and Benjamin I.P. Rubinstein. Et T u C ertifications: R obustness C ertificates Y ield B etter A dversarial E xamples. In Forty-first International Conference on Machine Learning, 2024 b

    2024

  11. [19]

    Cullen, Paul Montague, Shijie Liu, Sarah Erfani, and Benjamin I

    Andrew C. Cullen, Paul Montague, Shijie Liu, Sarah Erfani, and Benjamin I. P. Rubinstein. It's S implex! D isaggregating M easures to I mprove C ertified R obustness. In 2024 IEEE S ymposium on S ecurity and P rivacy (SP) , 2024 c . Accepted

    2024

  12. [20]

    Imagenet: A L arge-scale H ierarchical I mage D atabase

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A L arge-scale H ierarchical I mage D atabase. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, CVPR, pp.\ 248--255. IEEE, 2009

    2009

  13. [21]

    Privacy A udits for D ifferential P rivacy

    Zeyu Ding, Yuxin Wang, Guanhong Wang, Danfeng Zhang, and Daniel Kifer. Privacy A udits for D ifferential P rivacy. Proceedings on Privacy Enhancing Technologies (Po P E T S ) , 2017

    2017

  14. [22]

    Towards learning with limited labels: Equivariance, Invariance, and Beyond

    Beranger Dumont, Simona Maggio, and Pablo Montalvo. Robustness of R otation- E quivariant N etworks to A dversarial P erturbations. In ICML Workshop on "Towards learning with limited labels: Equivariance, Invariance, and Beyond", 2018

    2018

  15. [23]

    A F ramework for R obustness C ertification of S moothed C lassifiers using f- D ivergences

    Krishnamurthy Dj Dvijotham, Jamie Hayes, Borja Balle, Zico Kolter, Chongli Qin, Andras Gyorgy, Kai Xiao, Sven Gowal, and Pushmeet Kohli. A F ramework for R obustness C ertification of S moothed C lassifiers using f- D ivergences. In International Conference on Learning Represe...

    2020

  16. [24]

    Calibrating N oise to S ensitivity in P rivate D ata A nalysis

    Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating N oise to S ensitivity in P rivate D ata A nalysis. In Theory of Cryptography Conference, TCC, pp.\ 265--284. Springer, 2006

    2006

  17. [25]

    Adversarial A ttacks on M edical M achine L earning

    Samuel G Finlayson, John D Bowers, Joichi Ito, Jonathan L Zittrain, Andrew L Beam, and Isaac S Kohane. Adversarial A ttacks on M edical M achine L earning. Science, 363 0 (6433): 0 1287--1289, 2019

    2019

  18. [26]

    A P rogramming F ramework for O pen D P

    Marco Gaboardi, Michael Hay, and Salil Vadhan. A P rogramming F ramework for O pen D P . Manuscript, May, 2020

    2020

  19. [27]

    Motivating the R ules of the G ame for A dversarial E xample R esearch

    Justin Gilmer, Ryan P Adams, Ian Goodfellow, David Andersen, and George E Dahl. Motivating the R ules of the G ame for A dversarial E xample R esearch. arXiv preprint arXiv:1807.06732, 2018

    2018 arXiv

  20. [28]

    Explaining and H arnessing A dversarial E xamples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and H arnessing A dversarial E xamples. In International Conference on Learning Representations, ICLR, 2015

    2015

  21. [29]

    On S imultaneous C onfidence I ntervals for M ultinomial P roportions

    Leo A Goodman. On S imultaneous C onfidence I ntervals for M ultinomial P roportions. Technometrics, 7 0 (2): 0 247--254, 1965

    1965

  22. [30]

    Scalable C ertified R obustness via I nterval B ound P ropagation

    Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. Scalable C ertified R obustness via I nterval B ound P ropagation. In International Conference on Learning Representations, 2018

    2018

  23. [31]

    Reducing C ertified R egression to C ertified C lassification

    Zayd Hammoudeh and Daniel Lowd. Reducing C ertified R egression to C ertified C lassification. arXiv preprint arXiv:2208.13904, 2022

    2022 arXiv

  24. [32]

    Reinforcement L earning for A utonomous D efence in S oftware- D efined N etworking

    Yi Han, Benjamin IP Rubinstein, Tamas Abraham, Tansu Alpcan, Olivier De Vel, Sarah Erfani, David Hubczenko, Christopher Leckie, and Paul Montague. Reinforcement L earning for A utonomous D efence in S oftware- D efined N etworking. In Decision and Game Theory for Security: 9th...

    2018

  25. [33]

    Formal G uarantees on the R obustness of a C lassifier A gainst A dversarial M anipulation

    Matthias Hein and Maksym Andriushchenko. Formal G uarantees on the R obustness of a C lassifier A gainst A dversarial M anipulation. In Advances in Neural Information Processing Systems, volume 30 of NeurIPS, 2017

    2017

  26. [34]

    Joseph, Blaine Nelson, Benjamin I

    Ling Huang, Anthony D. Joseph, Blaine Nelson, Benjamin I. P. Rubinstein, and J. D. Tygar. Adversarial machine learning. In Proceedings of the 4th ACM Workshop on Security and Artificial Intelligence, pp.\ 43--58, 2011

    2011

  27. [35]

    Zhuoqun Huang, Neil G Marchant, Keane Lucas, Lujo Bauer, Olga Ohrimenko, and Benjamin I. P. Rubinstein. RS-Del : Edit distance robustness certificates for sequence classifiers via randomized deletion. In Advances in Neural Information Processing Systems, NeurIPS, pp.\ 18676--1...

    2023

  28. [36]

    The T hreat of A dversarial A ttacks on M achine L earning in N etwork S ecurity-- A S urvey

    Olakunle Ibitoye, Rana Abou-Khamis, Ashraf Matrawy, and M Omair Shafiq. The T hreat of A dversarial A ttacks on M achine L earning in N etwork S ecurity-- A S urvey. arXiv preprint arXiv:1911.02621, 2019

    1911 arXiv

  29. [37]

    International Organization for Standardization and International Electrotechnical Commission, Geneva, Switzerland, 2022

    ISO/IEC 27001:2022 : Information security, cybersecurity and privacy protection — Information security management systems — Requirements . International Organization for Standardization and International Electrotechnical Commission, Geneva, Switzerland, 2022. Available at: htt...

    2022

  30. [38]

    Are W e T here Y et? T iming and F loating- P oint A ttacks on D ifferential P rivacy S ystems

    Jiankai Jin, Eleanor McMurtry, Benjamin IP Rubinstein, and Olga Ohrimenko. Are W e T here Y et? T iming and F loating- P oint A ttacks on D ifferential P rivacy S ystems. In 2022 IEEE S ymposium on S ecurity and P rivacy (SP) , pp.\ 473--488. IEEE, 2022

    2022

  31. [39]

    Elephants D o N ot F orget: D ifferential P rivacy with S tate C ontinuity for P rivacy B udget

    Jiankai Jin, Chitchanok Chuengsatiansup, Toby Murray, Benjamin IP Rubinstein, Yuval Yarom, and Olga Ohrimenko. Elephants D o N ot F orget: D ifferential P rivacy with S tate C ontinuity for P rivacy B udget. In Proceedings of the 2024 on A C M S I G S A C C onference on C ompu...

    2024

  32. [40]

    Jiankai Jin, Olga Ohrimenko, and Benjamin I. P. Rubinstein. Getting a- Ro und G uarantees: F loating- P oint A ttacks on C ertified R obustness. In Proceedings of the 17th ACM Workshop on Security and Artificial Intelligence, AISec, 2024 b . accepted

    2024

  33. [41]

    Fairface: F ace A ttribute D ataset for B alanced R ace, G ender, and A ge for B ias M easurement and M itigation

    Kimmo Karkkainen and Jungseock Joo. Fairface: F ace A ttribute D ataset for B alanced R ace, G ender, and A ge for B ias M easurement and M itigation. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pp.\ 1548--1558, 2021

    2021

  34. [42]

    Privacy T heater: W hy S ocial N etworks O nly P retend to P rotect Y ou

    Rohit Khare. Privacy T heater: W hy S ocial N etworks O nly P retend to P rotect Y ou. https://techcrunch.com/2009/12/27/privacy-theater/, 2009. TechCrunch (Online); accessed 7 January 2025

    2009

  35. [43]

    Certification of S peaker R ecognition M odels to A dditive P erturbations

    Dmitrii Korzh, Elvir Karimov, Mikhail Pautov, Oleg Y Rogov, and Ivan Oseledets. Certification of S peaker R ecognition M odels to A dditive P erturbations. arXiv preprint arXiv:2404.18791, 2024

    2024 arXiv

  36. [44]

    Learning M ultiple L ayers of F eatures from T iny I mages

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning M ultiple L ayers of F eatures from T iny I mages. Technical report, University of Toronto, 2009

    2009

  37. [45]

    Regularization for D eep L earning: A T axonomy

    Jan Kuka c ka, Vladimir Golkov, and Daniel Cremers. Regularization for D eep L earning: A T axonomy. arXiv preprint arXiv:1710.10686, 2017

    2017 arXiv

  38. [46]

    Policy S moothing for P rovably R obust R einforcement L earning

    Aounon Kumar, Alexander Levine, and Soheil Feizi. Policy S moothing for P rovably R obust R einforcement L earning. arXiv preprint arXiv:2106.11420, 2021

    2021 arXiv

  39. [47]

    Adversarial M achine L earning- I ndustry P erspectives

    Ram Shankar Siva Kumar, Magnus Nystr \"o m, John Lambert, Andrew Marshall, Mario Goertzel, Andi Comissoneru, Matt Swann, and Sharon Xia. Adversarial M achine L earning- I ndustry P erspectives. In 2020 IEEE Security and Privacy Workshops (SPW), pp.\ 69--75. IEEE, 2020

    2020

  40. [48]

    Adversarial machine learning at scale

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, ICLR, 2020

    2020

  41. [49]

    Gradient- B ased L earning A pplied to D ocument R ecognition

    Yann LeCun, L \'e on Bottou, Yoshua Bengio, and Patrick Haffner. Gradient- B ased L earning A pplied to D ocument R ecognition. Proceedings of the IEEE, 86 0 (11): 0 2278--2324, 1998

    1998

  42. [50]

    Certified R obustness to A dversarial E xamples with D ifferential P rivacy

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified R obustness to A dversarial E xamples with D ifferential P rivacy. In 2019 IEEE S ymposium on S ecurity and P rivacy (S & P) , pp.\ 656--672. IEEE, 2019

    2019

  43. [51]

    Globally- R obust N neural N etworks

    Klas Leino, Zifan Wang, and Matt Fredrikson. Globally- R obust N neural N etworks. In International Conference on Machine Learning, pp.\ 6212--6222. PMLR, 2021

    2021

  44. [52]

    (de) R andomized S moothing for C ertifiable D efense against P atch A ttacks

    Alexander Levine and Soheil Feizi. (de) R andomized S moothing for C ertifiable D efense against P atch A ttacks. In Advances in Neural Information Processing Systems, volume 33, pp.\ 6465--6475. NeurIPS, 2022

    2022

  45. [53]

    Certified A dversarial R obustness with A dditive N oise

    Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified A dversarial R obustness with A dditive N oise. In Advances in Neural Information Processing Systems, volume 32, pp.\ 9459--9469. NeurIPS, 2019

    2019

  46. [54]

    Cullen, Paul Montague, Sarah M

    Shijie Liu, Andrew C. Cullen, Paul Montague, Sarah M. Erfani, and Benjamin I.P. Rubinstein. Enhancing the A ntidote: I mproved P ointwise C ertifications against P oisoning A ttacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp.\ 8861--8869, 2023

    2023

  47. [55]

    Cullen, Paul Montague, Sarah M

    Shijie Liu, Andrew C. Cullen, Paul Montague, Sarah M. Erfani, and Benjamin I.P. Rubinstein. Multi-level C ertified D efense against P oisoning A ttacks in O ffline R einforcement L earning. In International Conference on Learning Representations, ICLR, 2025 a

    2025

  48. [56]

    Cullen, Paul Montague, Sarah Monazam Erfani, and Benjamin IP Rubinstein

    Shijie Liu, Andrew C. Cullen, Paul Montague, Sarah Monazam Erfani, and Benjamin IP Rubinstein. Fox in the H enhouse: S upply- C hain B ackdoor A ttacks against R einforcement L earning. arXiv preprint arXiv:2505.19532, 2025 b

    2025 arXiv

  49. [57]

    Group and A ttack: A uditing D ifferential P rivacy

    Johan Lokna, Anouk Paradis, Dimitar I Dimitrov, and Martin Vechev. Group and A ttack: A uditing D ifferential P rivacy. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pp.\ 1905--1918, 2023

    2023

  50. [58]

    o rn L \

    Bj \"o rn L \"u tjens, Michael Everett, and Jonathan P How. Certified A dversarial R obustness for D eep R einforcement L earning. In Conference on Robot Learning, pp.\ 1328--1337. PMLR, 2020

    2020

  51. [59]

    Towards E valuating and T raining R erifiably R obust N eural N etworks

    Zhaoyang Lyu, Minghao Guo, Tong Wu, Guodong Xu, Kehuan Zhang, and Dahua Lin. Towards E valuating and T raining R erifiably R obust N eural N etworks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, pp.\ 4308--4317, 2021

    2021

  52. [60]

    Towards D eep L earning M odels R esistant to A dversarial A ttacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards D eep L earning M odels R esistant to A dversarial A ttacks. In International Conference on Learning Representations, ICLR, 2018

    2018

  53. [61]

    Dataset D iversity: M easuring and M itigating G eographical B ias in I mage S earch and R etrieval

    Abhishek Mandal, Susan Leavy, and Suzanne Little. Dataset D iversity: M easuring and M itigating G eographical B ias in I mage S earch and R etrieval. In Proceedings of the 1st International Workshop on Trustworthy AI for Multimedia Computing, pp.\ 19--25, 2021

    2021

  54. [62]

    Is C ertifying _p R obustness S till W orthwhile? arXiv preprint arXiv:2310.09361, 2023

    Ravi Mangal, Klas Leino, Zifan Wang, Kai Hu, Weicheng Yu, Corina Pasareanu, Anupam Datta, and Matt Fredrikson. Is C ertifying _p R obustness S till W orthwhile? arXiv preprint arXiv:2310.09361, 2023

    2023 arXiv

  55. [63]

    Mag N et: A T wo- P ronged D efense A gainst A dversarial E xamples

    Dongyu Meng and Hao Chen. Mag N et: A T wo- P ronged D efense A gainst A dversarial E xamples. In Proceedings of the 2017 ACM SIGSAC C onference on C omputer and C ommunications S ecurity , pp.\ 135--147, 2017

    2017

  56. [64]

    Differentiable A bstract I nterpretation for P rovably R obust N eural N etworks

    Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable A bstract I nterpretation for P rovably R obust N eural N etworks. In International Conference on Machine Learning, ICML, pp.\ 3578--3586. PMLR, 2018

    2018

  57. [65]

    On S ignificance of the L east S ignificant B its for D ifferential P rivacy

    Ilya Mironov. On S ignificance of the L east S ignificant B its for D ifferential P rivacy. In Proceedings of the 2012 ACM conference on C omputer and C ommunications S ecurity , pp.\ 650--661, 2012

    2012

  58. [66]

    Towards V erifying R obustness of N eural N etworks A gainst A F amily of S emantic P erturbations

    Jeet Mohapatra, Tsui-Wei Weng, Pin-Yu Chen, Sijia Liu, and Luca Daniel. Towards V erifying R obustness of N eural N etworks A gainst A F amily of S emantic P erturbations. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, CVPR, pp.\ 244--252, 2020

    2020

  59. [67]

    Deep F ool: A S imple and A ccurate M ethod to F ool D eep N eural N etworks

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deep F ool: A S imple and A ccurate M ethod to F ool D eep N eural N etworks. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, CVPR, pp.\ 2574--2582, 2016

    2016

  60. [68]

    Certified P olicy S moothing for C ooperative M ulti- A gent R einforcement L earning

    Ronghui Mu, Wenjie Ruan, Leandro Soriano Marcolino, Gaojie Jin, and Qiang Ni. Certified P olicy S moothing for C ooperative M ulti- A gent R einforcement L earning. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp.\ 15046--15054, 2023

    2023

  61. [69]

    The T hird I nternational V erification of N eural N etworks C ompetition ( VNN - COMP 2022): S ummary and R esults

    Mark Niklas M \"u ller, Christopher Brix, Stanley Bak, Changliu Liu, and Taylor T Johnson. The T hird I nternational V erification of N eural N etworks C ompetition ( VNN - COMP 2022): S ummary and R esults. arXiv preprint arXiv:2212.10376, 2022

    2022 arXiv

  62. [70]

    Instance S paces for M achine L earning C lassification

    Mario A Mu \ n oz, Laura Villanova, Davaatseren Baatar, and Kate Smith-Miles. Instance S paces for M achine L earning C lassification. Machine L earning , 107: 0 109--147, 2018

    2018

  63. [71]

    AI Risk Management Framework (AI RMF) 1.0

    National Institute of Standards and Technology . AI Risk Management Framework (AI RMF) 1.0 . Gaithersburg, MD, USA, 2022. Available at: https://www.nist.gov/itl/ai-risk-management-framework

    2022

  64. [72]

    The O pen D P W hite P aper

    Open D P . The O pen D P W hite P aper. Technical report, Open D P , 2020

    2020

  65. [73]

    The limitations of deep learning in adversarial settings

    Nicolas Papernot, Patrick McDaniel, Somesh Jha, Matt Fredrikson, Z Berkay Celik, and Ananthram Swami. The limitations of deep learning in adversarial settings. In 2016 IEEE European S ymposium on S ecurity and P rivacy (EuroS&P) , pp.\ 372--387. IEEE, 2016 a

    2016

  66. [74]

    Distillation as a D efense to A dversarial P erturbations against D eep N eural N etworks

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a D efense to A dversarial P erturbations against D eep N eural N etworks. In 2016 IEEE S ymposium on S ecurity and P rivacy (S & P) , pp.\ 582--597. IEEE, 2016 b

    2016

  67. [75]

    Practical B lack- B ox A ttacks against M achine L earning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical B lack- B ox A ttacks against M achine L earning. In Proceedings of the 2017 ACM on Asia Conference on C omputer and C ommunications S ecurity , pp.\ 506--519, 2017

    2017

  68. [76]

    Playing the G ame of U niversal A dversarial P erturbations

    Julien Perolat, Mateusz Malinowski, Bilal Piot, and Olivier Pietquin. Playing the G ame of U niversal A dversarial P erturbations. arXiv preprint arXiv:1809.07802, 2018

    2018 arXiv

  69. [77]

    Aref Miri Rekavandi, Farhad Farokhi, Olga Ohrimenko, and Benjamin I. P. Rubinstein. Certified adversarial robustness via randomized -smoothing for regression models. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, NeurIPS, 2024

    2024

  70. [78]

    Imagenet L arge S cale V isual R ecognition C hallenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet L arge S cale V isual R ecognition C hallenge. International Journal of Computer Vision, 115 0 (3): 0 211--252, 2015

    2015

  71. [79]

    Provably R obust D eep L earning via A dversarially T rained S moothed C lassifiers

    Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably R obust D eep L earning via A dversarially T rained S moothed C lassifiers. In Advances in Neural Information Processing Systems, volume 32, pp.\ 11292--11303. NeurI...

    2019

  72. [80]

    A C onvex R elaxation B arrier to T ight R obustness V erification of N eural N etworks

    Hadi Salman, Greg Yang, Huan Zhang, Cho-Jui Hsieh, and Pengchuan Zhang. A C onvex R elaxation B arrier to T ight R obustness V erification of N eural N etworks. In Advances in Neural Information Processing Systems, volume 32, pp.\ 9835--9846. NeurIPS, 2019 b

    2019

  73. [81]

    Formal V erification for N eural N etworks with G eneral N onlinearities via B ranch- A nd- B ound

    Zhouxing Shi, Qirui Jin, Huan Zhang, Zico Kolter, Suman Jana, and Cho-Jui Hsieh. Formal V erification for N eural N etworks with G eneral N onlinearities via B ranch- A nd- B ound. In 2nd Workshop on Formal Verification of Machine Learning (WFVML 2023), 2023

    2023

  74. [82]

    Fast and E ffective R obustness C ertification

    Gagandeep Singh, Timon Gehr, Matthew Mirman, Markus P \"u schel, and Martin Vechev. Fast and E ffective R obustness C ertification. In Advances in Neural Information Processing Systems, NeurIPS, 2018

    2018

  75. [83]

    An A bstract D omain for C ertifying N eural N etworks

    Gagandeep Singh, Timon Gehr, Markus P \"u schel, and Martin Vechev. An A bstract D omain for C ertifying N eural N etworks. Proceedings of the ACM on Programming Languages, 3 0 (POPL): 0 1--30, 2019

    2019

  76. [84]

    Understanding R isks of P rivacy T heater with D ifferential P rivacy

    Mary Anne Smart, Dhruv Sood, and Kristen Vaccaro. Understanding R isks of P rivacy T heater with D ifferential P rivacy. Proceedings of the ACM on H uman- C omputer I nteraction , 6 0 (CSCW2): 0 1--24, 2022

    2022

  77. [85]

    Understanding TSP D ifficulty by L earning from E volved I nstances

    Kate Smith-Miles, Jano Van Hemert, and Xin Yu Lim. Understanding TSP D ifficulty by L earning from E volved I nstances. In Learning and Intelligent Optimization: 4th International Conference, LION 4, Venice, Italy, January 18-22, 2010. Selected Papers 4, pp.\ 266--280. Springer, 2010

    2010

  78. [86]

    Cullen, and Benjamin I.P

    Guoxin Sun, Tansu Alpcan, Seyit Camtepe, Andrew C. Cullen, and Benjamin I.P. Rubinstein. An A dversarial S trategic G ame for M achine L earning as a S ervice using S ystem F eatures. In Proceedings of the 2023 International Conference on Autonomous Agents and Multiagent Syste...

    2023

  79. [87]

    Intriguing P roperties of N eural N etworks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing P roperties of N eural N etworks. In International Conference on Learning Representations, ICLR, 2014

    2014

  80. [88]

    Lipschitz- M argin T raining: S calable C ertification of P erturbation I nvariance for D eep N eural N etworks

    Yusuke Tsuzuku, Issei Sato, and Masashi Sugiyama. Lipschitz- M argin T raining: S calable C ertification of P erturbation I nvariance for D eep N eural N etworks. In Advances in Neural Information Processing Systems, volume 31. NeurIPS, 2018

    2018

  81. [89]

    Beta- CROWN : E fficient B ound P ropagation with P er- N euron S plit C onstraints for N eural N etwork R obustness V erification

    Shiqi Wang, Huan Zhang, Kaidi Xu, Xue Lin, Suman Jana, Cho-Jui Hsieh, and J Zico Kolter. Beta- CROWN : E fficient B ound P ropagation with P er- N euron S plit C onstraints for N eural N etwork R obustness V erification. In Advances in Neural Information Processing Systems, vo...

    2021

  82. [90]

    Towards F ast C omputation of C ertified R obustness for R e LU N etworks

    Lily Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsieh, Luca Daniel, Duane Boning, and Inderjit Dhillon. Towards F ast C omputation of C ertified R obustness for R e LU N etworks. In International Conference on Machine Learning, ICML, pp.\ 5276--5285. PMLR, 2018

    2018

  83. [91]

    C OPA : C ertifying R obust P olicies for O ffline R einforcement L earning against P oisoning A ttacks

    Fan Wu, Linyi Li, Chejian Xu, Huan Zhang, Bhavya Kailkhura, Krishnaram Kenthapadi, Ding Zhao, and Bo Li. C OPA : C ertifying R obust P olicies for O ffline R einforcement L earning against P oisoning A ttacks. arXiv preprint arXiv:2203.08398, 2022

    2022 arXiv

  84. [92]

    Making an I nvisibility C loak: R eal W orld A dversarial A ttacks on O bject D etectors

    Zuxuan Wu, Ser-Nam Lim, Larry S Davis, and Tom Goldstein. Making an I nvisibility C loak: R eal W orld A dversarial A ttacks on O bject D etectors. In Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part IV 16, pp.\ 1--17. S...

    2020

  85. [93]

    Spatially T ransformed A dversarial E xamples

    Chaowei Xiao, Jun-Yan Zhu, Bo Li, Warren He, Mingyan Liu, and Dawn Song. Spatially T ransformed A dversarial E xamples. In International Conference on Learning Representations, 2018

    2018

  86. [94]

    Towards E ffective D ifferential P rivacy C ommunication for U sers’ D ata S haring D ecision and C omprehension

    Aiping Xiong, Tianhao Wang, Ninghui Li, and Somesh Jha. Towards E ffective D ifferential P rivacy C ommunication for U sers’ D ata S haring D ecision and C omprehension. In 2020 IEEE S ymposium on S ecurity and P rivacy (SP) , pp.\ 392--410. IEEE, 2020

    2020

  87. [95]

    Automatic P erturbation A nalysis for S calable C ertified R obustness and B eyond

    Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsieh. Automatic P erturbation A nalysis for S calable C ertified R obustness and B eyond. In Advances in Neural Information Processing Systems, volume 33, pp.\ ...

    2020

  88. [96]

    Randomized S moothing of A ll S hapes and S izes

    Greg Yang, Tony Duan, J Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized S moothing of A ll S hapes and S izes. In International Conference on Machine Learning, pp.\ 10693--10705. PMLR, 2020

    2020

  89. [97]

    Efficient N eural N etwork R obustness C ertification with G eneral A ctivation F unctions

    Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient N eural N etwork R obustness C ertification with G eneral A ctivation F unctions. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Advances in Neural I...

    2018

  90. [98]

    Efficient N eural N etwork R obustness C ertification with G eneral A ctivation F unctions

    Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient N eural N etwork R obustness C ertification with G eneral A ctivation F unctions. In S. Bengio, H. Wallach, H. Larochelle, K. Grauman, N. Cesa-Bianchi, and R. Garnett (eds.), Advances in Neural I...

    2018

  91. [99]

    A S urvey of G ame T heoretic A pproach for A dversarial M achine L earning

    Yan Zhou, Murat Kantarcioglu, and Bowei Xi. A S urvey of G ame T heoretic A pproach for A dversarial M achine L earning. Wiley Interdisciplinary Reviews: Data Mining and Knowledge Discovery, 9 0 (3): 0 e1259, 2019

    2019

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.