Pith. sign in

REVIEW 2 major objections 6 minor 53 references

Clustered Randomized Smoothing for Stochastic Prediction Functions

T0 review · 2 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Clustered $\alpha$-smoothing certifies robust multi-modal predictions for stochastic predictors: rather than averaging all noisy outputs, it smooths each mode separately and mixes the results, with a formal lower bound on the probability…

desk verdict Nice idea with two independent theory bugs; both look fixable, so it deserves a rigorous review rather than a desk reject. read the letter →

arxiv 2608.12037 v1 pith:EDIEDWY4 submitted 2026-08-12 cs.LG cs.SYeess.SY

Eduardo Figueiredo , Frederik Mathiesen , Julian Schumann , Jens Kober , Arkady Zgonnikov , Luca Laurenti This is my paper · ORCID
classification cs.LGcs.SYeess.SY
keywords clusteredα-smoothingrandomizedsmoothingstochasticpredictorsmulti-modalregressionrobustnesscertificationmodecollapsetrajectorypredictionquadrotorcontrol
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to fix a failure of randomized smoothing for stochastic predictors whose outputs are multi-modal: averaging over noisy samples collapses distinct behaviors into a single unrepresentative mean. Its proposal, clustered $\alpha$-smoothing, clusters the noisy predictions in output space, applies $\alpha$-trimmed averaging inside each cluster, and recombines the per-cluster smoothers as a mixture. The central claim is Theorem 3.1, a lower bound on the probability that the clustered smoother's output at any perturbed input lies in a union of per-mode coverage regions, valid for every perturbation of bounded Euclidean norm. If the claim holds, safety-critical predictors such as trajectory forecasters and robot controllers can retain multi-modal uncertainty and still carry formal robustness certificates; the experiments report a $27\%$ lower Wasserstein distance in trajectory prediction and an $81\%$ lower collision rate in quadrotor control relative to state-of-the-art smoothing.

What carries the argument

The central object is the clustered $\alpha$-smoothed predictor, a mixture of per-cluster trimmed means whose weights are the empirical cluster sizes; the $\alpha$-trimming removes the $\lfloor\alpha |I_m|\rfloor$ extreme order statistics in each coordinate before averaging. The argument is carried by two standard tools: the likelihood-ratio lemma of randomized smoothing, which shifts binomial success probabilities when the input is perturbed by bounded-norm Gaussian noise (equations (4)), and a binomial confidence bound that turns observed counts into high-confidence intervals for those success probabilities (Proposition 4.1). To make the general multi-mode certificate tractable, the paper replaces the non-convex infimum in Theorem 3.1 with a linear program over anchor points and a controlled residual (Proposition 3.2). The generalized Voronoi construction in Algorithm 1 is what keeps each coverage region $R_m$ inside its partition cell $V_m$, which the theorem requires.

What would settle it

Run Algorithm 2 on a predictor with two well-separated modes using a small $\beta$ (e.g., $0.05$) and count, over many independent noise and weight draws, how often $\tilde H_{N,\alpha,V}(x+\delta)$ actually lands in the certified region $\tilde R$ for a fixed $\delta$ with $\|\delta\|_2\le r$. If the empirical frequency falls below the certified lower bound even at the nominal $1-\beta$ confidence level, the guarantee as stated fails, because the region was chosen from the same data used to estimate the binomial proportions; repeating the check with counts from an independent sample would isolate the cause.

Watch

Extended reading notes

Core claim

The paper introduces a new smoothed predictor, $\tilde H_{N,\alpha,V}(x)=\sum_{m=1}^{M}\mathbf{1}_{z=m}\tilde H_{N,\alpha,V_m}(x)$, in which the output space is partitioned into cells $V_m$, each cell receives its own $\alpha$-trimmed mean over the noisy samples that fall into it, and a categorical variable $z$ with weights $|I_m|/N$ mixes the per-cell components. Against this object, the paper proves that for any subset of modes $L$ and convex coverage regions $R_l\subset V_l$, the probability that $\tilde H_{N,\alpha,V}(x+\delta)\in \tilde R=\cup_{l\in L}R_l$ is at least the infimum in (5), provided the per-cell probabilities $p_{V_m}$ and $p_{R_l}$ are known or bounded. The argument combines a per-cell shift bound for Gaussian noise, a union bound over the selected modes, and a linear-program relaxation with anchor points to make the infimum computable. Sample versions of the bounds are obtained from binomial counts, so the whole procedure is implementable for black-box stochastic predictors.

Load-bearing premise

The confidence statement presumes the partition and coverage regions are fixed before the binomial counts are collected; in Algorithms 1 and 2 the same samples choose those regions and produce the counts, so the stated $1-\beta$ confidence is not justified without sample splitting or a post-selection correction.

Editorial extensions

If this is right

  • For any stochastic predictor with multi-modal output, clustered $\alpha$-smoothing certifies that the prediction under a bounded input perturbation falls in a union of per-mode coverage regions with high probability, so robustness guarantees no longer force mode collapse.
  • The certificate is agnostic to the clustering algorithm, so DBSCAN, $k$-means, or hand-designed behavioral partitions (as used in the trajectory experiments) all feed into the same bound.
  • In trajectory prediction, the method lowers the 2-Wasserstein distance between smoothed and original distributions by 27% on average compared to $\alpha$-smoothing, and lowers the risk rate of a go/no-go decision from 16.5% to 2.5%.
  • In quadrotor control with a bi-modal policy, clustered smoothing preserves both navigation paths and cuts the collision rate by 81% relative to randomized smoothing, while additionally removing the discrete quantization artifact that $\alpha$-smoothing exhibits on bimodal outputs.
  • Because the multi-mode bound uses a union bound over clusters and a confidence interval for each cluster probability, adding more modes makes the certificate more conservative, a trade-off the paper documents empirically.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural extension the paper does not pursue is input-dependent partitions $V(x)$: the current certificate fixes one partition around $x$ and reuses it for the whole perturbation ball, so adapting the modes to each input would require a new concentration argument.
  • The post-selection gap in the confidence statement (regions and counts from the same samples) could be closed by sample splitting—one batch to construct $V$ and $R$, an independent batch to count the binomial statistics—at the price of roughly doubling inference cost; the paper's Algorithm 2 does not do this.
  • In closed-loop settings the certificate applies per time step, so composing it over a receding horizon would need a union bound over steps; the quadrotor experiments evaluate the smoothed policy in closed loop but the formal guarantee is claimed per step.
  • The per-cluster $\alpha$-trimming suggests an adaptive variant that selects $\alpha_m$ per mode from local dispersion; nothing in the proof requires a shared $\alpha$, so this is a testable modification.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The manuscript proposes clustered α-smoothing for stochastic predictors: given noisy forward samples, it clusters the outputs, applies coordinate-wise α-trimmed averaging within each cluster, and combines the per-cluster predictors as a mixture. It claims a certified lower bound (Theorem 3.1) on the probability that the smoothed prediction lies in a union of convex region subsets of a fixed partition of the output space, under adversarial L2 perturbation of the input. The bound is instantiated in practice via a Clopper-Pearson procedure (Proposition 4.1) and Algorithms 1–2, which construct the partition and coverage sets from samples. The empirical section reports improved Wasserstein distance in trajectory prediction and reduced collision rate in quadrotor control relative to α-smoothing and RS-Reg.

Significance. The problem is well motivated: multi-modal stochastic predictors are common, and standard randomized smoothing collapses their modes. The per-mode smoothing idea is natural, and the empirical results are suggestive, with clearly described benchmarks and released code. If the certificate in Theorem 3.1 and the confidence procedure in Proposition 4.1 were both valid, this would be a useful contribution to certified regression for multi-modal predictors. However, the certificate is not established for the claimed generality and the confidence procedure is invalid as used, so the central claims of the paper are not supported in their current form.

major comments (2)
  1. [Appendix A.1, Lemma A.1 and Theorem 3.1] The proof of Lemma A.1 is invalid for general convex sets R_m. In Definition 3, the α-trimming in (2) is applied coordinate-wise, so the vectors H_{V_m}(x)_{(i)} are coordinate-wise order statistics and need not be elements of the original sample set {h_w(x+ε_i)}. Therefore, from Z_m ≥ s − ⌊αs⌋ it does not follow that 'the average in (2) only contains points in R_m': coordinate-wise trimming can keep a coordinate contributed by a point outside R_m while discarding coordinates of points inside R_m. Convexity of R_m does not imply that the coordinate-wise trimmed mean lies in R_m, so the inequality in (22) is unsupported. The argument can be repaired for axis-aligned hyperrectangles, but Theorem 3.1 explicitly assumes only convex R_l, and the proof of Theorem 3.1 relies on Lemma A.1. Thus the central robustness guarantee is unproven at the claimed level of generality. This issue is independent of the post-selection problem in Proposition 4.1.
  2. [Section 4, Proposition 4.1 and Algorithms 1–2] The high-confidence bounds are not valid as used. Proposition 4.1 is a correct Clopper-Pearson statement for a fixed, data-independent partition V and fixed sets R_l, but Algorithm 1 constructs R_m to cover a fraction p of the observed samples (line 9), and Algorithm 2 then computes the counts Z_{V_m}, Z_{R_m} and the Clopper-Pearson bounds from the same samples. Because the sets R_m and the induced partition V are selected using the same data that are subsequently used for the binomial counts, Z_{R_m} is biased upward and the nominal 1−β confidence of the bounds does not hold. The statement after Proposition 4.1 that 'after observing the samples, one may place the sets V_m and R_m so that the number of outputs inside them (approximately) induces the desired probability level' is precisely the invalid selection step. A valid procedure would require sample splitting or a post-selection adjustment. This invalidates the end-to-end certificate returned by Algorithm 2.
minor comments (6)
  1. [Section 3, Definition 3] The phrase 'where the i-th ordering statist in H_{V_m}(x)_{(i)} is taken element-wise' contains a typo ('statist') and the notation is not defined explicitly; please define the coordinate-wise order-statistic vector clearly.
  2. [Section 3, Theorem 3.1] The sentence mentioning 'correction to the fact that V is a partition of X' should refer to the output space Y, not the input space X.
  3. [Equations (5)–(8) and Lemma A.3] The notation for the lower bounds yp_{R_l}, yp_{V_l} and their Neyman-Pearson-adjusted counterparts is inconsistent: in particular, the residual term in (8) uses p_{V_l} − p_{R_l} while Lemma A.3 is stated with a generic yq{ytilde p}; please make the relationship explicit.
  4. [Algorithm 2] The 'Require' line allows α∈[0,1], but Definition 3 requires α∈[0,1/2); state the domain consistently.
  5. [Footnote 2] The requirement that the same partition be used for all x′ in the δ-neighborhood is not shown to be enforced by Algorithm 1, which constructs V locally at x; please clarify how the algorithm guarantees this.
  6. [Appendix F] Appendix F is a detailed analysis of a quantization artifact of α-smoothing, but it is not referenced by the main results; consider moving it to supplementary material or connecting it explicitly to the design choices in Section 5.

Circularity Check

1 steps flagged · score 6.0 of 10

Coverage regions are fitted to the same samples that are then used to certify their probability, making the statistical certificate a data-fitting loop; the analytic inequality in Theorem 3.1 is not itself circular.

  1. fitted input called prediction [Section 4, Proposition 4.1 and Algorithms 1–2 (Alg. 1 lines 9–11; Alg. 2 line 3)]
    "Proposition 4.1 comes from the Clopper-Pearson Lemma [8] combined with a union-bound argument. It gives a natural way to construct the partition V and sets R: after observing the samples {hwi(x+εi)}, one may place the sets Vm and Rm so that the number of outputs inside them (approximately) induces the desired probability level. This reasoning is the core principle of Algorithm 1. ... C(p)m ← Select approximately a fraction p of the points in Cm; Rm ← ENVELOPE(C(p)m) ... Compute ˇpVm, ˆpVm, ˇpRm∈[0,1] with Proposition 4.1 (using β and ¯N)."

    R_m is chosen from the same ¯N samples to contain approximately a fraction p of them, and then Z_Rm counts how many of those same samples fall in R_m and feeds the Clopper-Pearson lower bound ˇp_Rm. The binomial model in Proposition 4.1 requires R_m to be fixed before the sample is drawn; once R_m is selected to cover the realized data, the count is stochastically larger than Binomial(¯N, P(R_m)), so ˇp_Rm is upward-biased and the claimed 1−β confidence does not hold. The certified probability for the coverage region is therefore forced by the data-fitting construction of R_m rather than independently predicted; no sample splitting or post-selection correction is provided.

full rationale

The mathematical derivation of Theorem 3.1 from the Neyman-Pearson bounds and binomial sums is self-contained and does not assume its conclusion: the mixture interpretation of \tilde H_{N,α,V} is used only to decompose the probability, and the theorem's inequality is derived, not posited. The empirical comparisons against α-smoothing and RS-Reg are independent benchmarks and are not circular. The paper's self-citations (e.g., TrajFlow, STEP, prior trajectory-smoothing work) are used for experimental setup or comparison, not as load-bearing evidence for the certificate. The circularity is confined to the statistical layer: Proposition 4.1's Clopper-Pearson confidence statement assumes V and R are fixed subsets, but Algorithms 1–2 construct R_m from the very samples that are then counted in Z_Rm. Because R_m is deliberately built to contain a prescribed fraction p of the realized outputs, the binomial count used to derive ˇp_Rm is selected rather than i.i.d., so the resulting 'confidence 1−β' bound is a fitted quantity being presented as an independent prediction. This is a genuine partial circularity in the certification pipeline. Separately, the proof of Lemma A.1 asserts that coordinate-wise trimming keeps the trimmed mean inside a convex R_m; for general convex sets that is a correctness gap, but it is not a circularity, and it does not further raise the circularity score here.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The framework introduces no new physical or mathematical entities. It introduces a new smoothing operator (clustered alpha-smoother) and a certificate in terms of existing probability bounds. The free parameters are hyperparameters of the algorithm and clustering, while the load-bearing assumptions are the fixed-set requirement for Clopper-Pearson and the convexity/membership property of element-wise trimming.

free parameters (7)
  • alpha (trimming fraction) = 0.0, 0.2, 0.4 in trajectory experiments; 0.4 in quadrotor control
    User-selected hyperparameter controlling the fraction of outliers trimmed per cluster in Definition 3; directly controls the tightness of coverage regions and the certificate value in (5).
  • p (coverage level) = 0.85 (trajectory certified bound experiment), 0.9 (quadrotor)
    User-selected in Algorithm 1, Line 9; determines the fraction of samples enclosed by each coverage region R_m, and therefore the size and certified probability of the regions.
  • sigma (smoothing noise standard deviation) = 0.05 (quadrotor); implicitly 1.0 for trajectory (epsilon ~ N(0,I))
    Gaussian input noise scale used in Definitions 2 and 3; fixes the r/sigma trade-off in (4) and influences all probability bounds and the deviation from h_w(x).
  • N (smoothing samples) = 30 in quadrotor benchmark; no explicit value given for trajectory experiments
    Number of i.i.d. noise samples used to construct the smoothed predictor in Definition 3; larger N tightens the per-mode smoothing distribution.
  • bar_N (samples for confidence bounds) = 4000 in quadrotor benchmark
    Sample size in Proposition 4.1 used to estimate \check p_Vm, \hat p_Vm, \check p_Rm; larger values give tighter Clopper-Pearson bounds.
  • beta (confidence parameter) = 1e-2 (quadrotor benchmark)
    Joint confidence parameter for all binomial bounds in Proposition 4.1; smaller beta requires more samples.
  • Clustering hyperparameters (DBSCAN eps_db, min_samples, M_max) = eps_db=0.45, min_samples=50, M_max=3 for quadrotor; two-cluster endpoint heuristic for trajectory
    Hand-chosen values determine the partition V and hence the output mixture; the paper states the quality depends strongly on the clustering choice (Section 6).
assumptions (5)
  • standard math The input noise is Gaussian with fixed sigma and the input space is R^d, so the Neyman-Pearson lemma yields the probability shift bounds in (13)-(15).
    Invoked in Lemma A.1 with epsilon ~ N(0, sigma^2 I); standard in the randomized smoothing literature.
  • standard math Clopper-Pearson bounds give valid high-confidence lower and upper bounds on the probability of a sample falling in a fixed (pre-specified) set.
    Used in Proposition 4.1 to compute \check p_Vm, \hat p_Vm, \check p_Rm; this requires the sets to be fixed before the samples are observed.
  • ad hoc to paper The partition V and the sets R_m are fixed independently of the samples used to estimate the probabilities, so the Clopper-Pearson bounds in Proposition 4.1 are unbiased.
    Algorithm 1 constructs V and R from the same samples later used for estimation; this axiom is violated, invalidating the confidence guarantee.
  • domain assumption R_l is a convex set and the element-wise alpha-trimmed mean of sample points contained in R_l remains in R_l.
    Used in the 'by convexity' step in Lemma A.1. The element-wise trimming in Definition 3 does not generally preserve convex-set membership for arbitrary convex sets; it holds for axis-aligned hyperrectangles, which the experiments use.
  • domain assumption The same partition V is used for all perturbed inputs x+delta within the certified radius, so the smoothing distribution at x+delta is well-defined with the same partition.
    Algorithm 2 constructs V at x and reuses it for x+delta; Theorem 3.1 requires this to make the probability statements coherent.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Clustered Randomized Smoothing for Stochastic Prediction Functions." pith.science (2026). https://pith.science/paper/EDIEDWY4

@misc{pith2026260812037,
  author       = {Pith},
  title        = {Pith review of: Clustered Randomized Smoothing for Stochastic Prediction Functions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EDIEDWY4}},
  note         = {Machine review of arXiv:2608.12037}
}
abstract

Modern stochastic predictors can model rich, multi-modal outcome distributions. However, this expressive power comes with challenges in ensuring robust predictions $-$ a critical requirement in safety-critical domains. Randomized smoothing is a leading technique for improving robustness, particularly against adversarial perturbations. Yet, in stochastic multi-modal regression settings, randomized smoothing often fails due to mode collapse, yielding averaged predictions that do not reflect the underlying distribution. To address this limitation, we propose clustered $\alpha$-smoothing, a framework that (1) partitions noisy samples using an arbitrary clustering algorithm, (2) applies $\alpha$-smoothing locally within each cluster, and (3) combines the resulting predictions into a mixture distribution. By interpreting the smoothing distribution as a mixture of $\alpha$-smoothers, we derive a lower bound on the probability that the smoothed prediction lies within a union of compact regions corresponding to distinct modes. We empirically evaluate our framework on two benchmarks, demonstrating substantial improvements over state-of-the-art methods. In stochastic trajectory prediction on a driving simulator dataset, our approach achieves, on average, a $27\%$ lower Wasserstein distance to the ground-truth distribution compared to $\alpha$-smoothing. In quadrotor control, where modes correspond to distinct feasible paths to a target, our method reduces the collision rate by $81\%$ relative to the state-of-the-art randomized smoothing.

Figures

Figures reproduced from arXiv: 2608.12037 by the authors.

Figure 1
Figure 1. Conceptual illustration of mode collapse in randomized smoothing. In (a), an ego vehicle (red) is [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. An example of α-smoothing and clustered α-smoothing at x = 2 of a stochastic base predictor hw(x) = wx where w ∼ P3 i=1 πiN (· | µi, σ2 i ) is a mixture of three Gaussians with means µ = (1, 0, 2) and equal variance σ 2 i = 0.01, and weights π = (0.2, 0.2, 0.6). The histograms are obtained by Monte Carlo sampling the distributions of hw(x + ε), H˜N,α,{Y}(x) (in (a), equivalent to α-smoothing, see Remark 1), and our … view at source ↗
Figure 3
Figure 3. Probability bounds PN s=1 s N Ps j=s−⌊αs⌋ fs,j  pR pV  fN,s (pV ) from (6) attributable to each mode for different combinations of number of smoothing samples N, trimming parameter α, partition set probability pV and coverage ratio pR/pV . The right-most column (where pV = 1) is equivalent to the bound in [30], by noting that only the term s = N in (6) is non-zero when p V = pV = ¯pV = 1. Then, for any δ ∈ R d suc… view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Safety analysis for 200 randomly selected inputs xi from the L-GAP dataset. In this dataset, human drivers face a decision whether to turn left in front of an oncoming vehicle (go) or wait for it to pass before turning (yield). The recorded trajectories are converted i…
Figure 5
Figure 5. Figure 5: Robustness lower-bounds (with one std. dev. shaded band) for 20 distinct inputs xi. Finally, we perform a parameter analysis of the robustness lower-bounds in Theorem 3.1 for various trimming parameters α ∈ {0.0, 0.2, 0.4} and robustness radii r ≥ 0, where the sets R a…
Figure 6
Figure 6. Figure 6: Top row: rollouts of the quadrotor from the starting state (blue marker) where the con [PITH_FULL_IMAGE:figures/full_fig_p009_6.png]
Figure 7
Figure 7. Figure 7: Given a particular trajectory input x from the L-GAP dataset [47], we show the last time step of trajectory samples from hw(x), hw(x+ε), where ε ∼ N (0, I), the α-smoothing in (1), and our clustered α-smoothing. We also show the projection to the last time step subspac…
Figure 8
Figure 8. Figure 8: An overview of TrajFlow’s architecture, taken from [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: Generalized Voronoi partition of four disjoint axis-aligned rectangles [PITH_FULL_IMAGE:figures/full_fig_p021_9.png]
Figure 10
Figure 10. Figure 10: Quantization of the single-cluster α-trimmed predictor on a bimodal output. Top: the underlying mixture 0.4N (−3, 0.3 2 )+0.6 N (+3, 0.3 2 ). Bottom: histogram of µˆα for N = 30, α = 0.4 over 20,000 realizations. Dashed lines are the predicted quantization levels ¯ℓj …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

53 extracted references · 44 canonical work pages

  1. [1]

    Bnn-dp: robustness certification of bayesian neural networks via dynamic programming

    Steven Adams, Andrea Patane, Morteza Lahijanian, and Luca Laurenti. Bnn-dp: robustness certification of bayesian neural networks via dynamic programming. InInternational Conference on Machine Learning, pages 133–151. PMLR, 2023

    work page 2023

  2. [2]

    Data dependent randomized smoothing

    Motasem Alfarra, Adel Bibi, Philip HS Torr, and Bernard Ghanem. Data dependent randomized smoothing. In Uncertainty in Artificial Intelligence, pages 64–74. PMLR, 2022

    work page 2022

  3. [3]

    Robust control for dynamical systems with non-gaussian noise via formal abstractions.Journal of Artificial Intelligence Research, 76:341–391, 2023

    Thom Badings, Licio Romao, Alessandro Abate, David Parker, Hasan A Poonawala, Marielle Stoelinga, and Nils Jansen. Robust control for dynamical systems with non-gaussian noise via formal abstractions.Journal of Artificial Intelligence Research, 76:341–391, 2023

    work page 2023

  4. [4]

    Singulartrajectory: Universal trajectory predictor using diffusion model

    Inhwan Bae, Young-Jae Park, and Hae-Gon Jeon. Singulartrajectory: Universal trajectory predictor using diffusion model. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 17890–17901, 2024

    work page 2024

  5. [5]

    Lang, Sourabh V ora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom

    Holger Caesar, Varun Bankiti, Alex H. Lang, Sourabh V ora, Venice Erin Liong, Qiang Xu, Anush Krishnan, Yu Pan, Giancarlo Baldan, and Oscar Beijbom. nuScenes: A Multimodal Dataset for Autonomous Driving. InIEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11618–11628. IEEE Computer Society, June 2020

    work page 2020

  6. [6]

    Diffusion policy attacker: Crafting adversarial attacks for diffusion-based policies.Advances in Neural Information Processing Systems, 37:119614–119637, 2024

    Yipu Chen, Haotian Xue, and Yongxin Chen. Diffusion policy attacker: Crafting adversarial attacks for diffusion-based policies.Advances in Neural Information Processing Systems, 37:119614–119637, 2024

    work page 2024

  7. [7]

    Detection as regression: Certified object detection with median smoothing.Advances in Neural Information Processing Systems, 33:1275–1286, 2020

    Ping-yeh Chiang, Michael Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. Detection as regression: Certified object detection with median smoothing.Advances in Neural Information Processing Systems, 33:1275–1286, 2020

    work page 2020

  8. [8]

    Certified adversarial robustness via randomized smoothing

    Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In international conference on machine learning, pages 1310–1320. PMLR, 2019

    2019

Show all 53 references
  1. [9]

    False data injection on state estimation in power systems—attacks, impacts, and defense: A survey.IEEE transactions on industrial informatics, 13(2):411–423, 2016

    Ruilong Deng, Gaoxi Xiao, Rongxing Lu, Hao Liang, and Athanasios V Vasilakos. False data injection on state estimation in power systems—attacks, impacts, and defense: A survey.IEEE transactions on industrial informatics, 13(2):411–423, 2016. 10

    2016

  2. [10]

    An introduction to variational autoencoders.Foundations and Trends® in Machine Learning, 12(4):307–392, 2019

    P Kingma Diederik and Welling Max. An introduction to variational autoencoders.Foundations and Trends® in Machine Learning, 12(4):307–392, 2019

    2019

  3. [11]

    Neuralsat: A high-performance verification tool for deep neural networks

    Hai Duong, ThanhVu Nguyen, and Matthew B Dwyer. Neuralsat: A high-performance verification tool for deep neural networks. InInternational Conference on Computer Aided Verification, pages 409–423. Springer, 2025

    2025

  4. [12]

    On the expressiveness of approximate inference in bayesian neural networks.Advances in Neural Information Processing Systems, 33:15897–15908, 2020

    Andrew Foong, David Burt, Yingzhen Li, and Richard Turner. On the expressiveness of approximate inference in bayesian neural networks.Advances in Neural Information Processing Systems, 33:15897–15908, 2020

    2020

  5. [13]

    Ai2: Safety and robustness certification of neural networks with abstract interpretation

    Timon Gehr, Matthew Mirman, Dana Drachsler-Cohen, Petar Tsankov, Swarat Chaudhuri, and Martin Vechev. Ai2: Safety and robustness certification of neural networks with abstract interpretation. In2018 IEEE symposium on security and privacy (SP), pages 3–18. IEEE, 2018

    2018

  6. [14]

    Gaussian process priors with uncertain inputs application to multiple-step ahead time series forecasting.Advances in neural information processing systems, 15, 2002

    Agathe Girard, Carl Rasmussen, Joaquin Q Candela, and Roderick Murray-Smith. Gaussian process priors with uncertain inputs application to multiple-step ahead time series forecasting.Advances in neural information processing systems, 15, 2002

    2002

  7. [15]

    Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  8. [16]

    Reluplex: An efficient smt solver for verifying deep neural networks

    Guy Katz, Clark Barrett, David L Dill, Kyle Julian, and Mykel J Kochenderfer. Reluplex: An efficient smt solver for verifying deep neural networks. InInternational conference on computer aided verification, pages 97–117. Springer, 2017

    2017

  9. [17]

    Certified robustness to adversarial examples with differential privacy

    Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In2019 IEEE symposium on security and privacy (SP), pages 656–672. IEEE, 2019

    2019

  10. [18]

    Wasserstein smoothing: Certified robustness against wasserstein adversarial attacks

    Alexander Levine and Soheil Feizi. Wasserstein smoothing: Certified robustness against wasserstein adversarial attacks. InInternational conference on artificial intelligence and statistics, pages 3938–3947. PMLR, 2020

    2020

  11. [19]

    Certified adversarial robustness with additive noise

    Bai Li, Changyou Chen, Wenlin Wang, and Lawrence Carin. Certified adversarial robustness with additive noise. Advances in neural information processing systems, 32, 2019

    2019

  12. [20]

    Towards robust neural networks via random self- ensemble

    Xuanqing Liu, Minhao Cheng, Huan Zhang, and Cho-Jui Hsieh. Towards robust neural networks via random self- ensemble. InProceedings of the european conference on computer vision (ECCV), pages 369–385, 2018

    2018

  13. [21]

    A universal approximation theorem of deep neural networks for expressing probability distributions.Advances in neural information processing systems, 33:3094–3105, 2020

    Yulong Lu and Jianfeng Lu. A universal approximation theorem of deep neural networks for expressing probability distributions.Advances in neural information processing systems, 33:3094–3105, 2020

    2020

  14. [22]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In6th International Conference on Learning Representations, ICLR, 2018

    2018

  15. [23]

    Charles Meyers, Tommy Löfstedt, and Erik Elmroth. Safety-critical computer vision: an empirical survey of adversarial evasion attacks and defenses on computer vision systems.Artificial Intelligence Review, 56(Suppl 1):217–251, 2023

    2023

  16. [24]

    Uncertainty quantification with statistical guarantees in end-to-end autonomous driving control

    Rhiannon Michelmore, Matthew Wicker, Luca Laurenti, Luca Cardelli, Yarin Gal, and Marta Kwiatkowska. Uncertainty quantification with statistical guarantees in end-to-end autonomous driving control. In2020 IEEE international conference on robotics and automation (ICRA), pages 7...

    2020

  17. [25]

    Robust construction of the voronoi diagram of a polyhedron

    Victor Milenkovic. Robust construction of the voronoi diagram of a polyhedron. InCanadian Conference on Computa- tional Geometry, volume 93, pages 473–478, 1993

    1993

  18. [26]

    Schumann, Javier Alonso-Mora, Arkady Zgonnikov, and Jens Kober

    Anna Mészáros, Julian F. Schumann, Javier Alonso-Mora, Arkady Zgonnikov, and Jens Kober. TrajFlow: Learning Distributions over Trajectories for Human Behavior Prediction. In2024 IEEE Intelligent Vehicles Symposium (IV), Jeju, June 2024

    2024

  19. [27]

    Refaat, and Benjamin Sapp

    Nigamaa Nayakanti, Rami Al-Rfou, Aurick Zhou, Kratarth Goel, Khaled S. Refaat, and Benjamin Sapp. Wayformer: Motion Forecasting via Simple & Efficient Attention Networks. In2023 IEEE International Conference on Robotics and Automation (ICRA), pages 2980–2987, May 2023

    2023

  20. [28]

    Normalizing flows for probabilistic modeling and inference.Journal of Machine Learning Research, 22(57):1–64, 2021

    George Papamakarios, Eric Nalisnick, Danilo Jimenez Rezende, Shakir Mohamed, and Balaji Lakshminarayanan. Normalizing flows for probabilistic modeling and inference.Journal of Machine Learning Research, 22(57):1–64, 2021

    2021

  21. [29]

    Boosting the transferability of adversarial attacks with reverse adversarial perturbation.Advances in neural information processing systems, 35:29845– 29858, 2022

    Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. Boosting the transferability of adversarial attacks with reverse adversarial perturbation.Advances in neural information processing systems, 35:29845– 29858, 2022

    2022

  22. [30]

    Certified adversarial robustness via randomizedα-smoothing for regression models.Advances in Neural Information Processing Systems, 37:134127– 134150, 2024

    Aref Rekavandi, Farhad Farokhi, Olga Ohrimenko, and Benjamin Rubinstein. Certified adversarial robustness via randomizedα-smoothing for regression models.Advances in Neural Information Processing Systems, 37:134127– 134150, 2024. 11

    2024

  23. [31]

    Rs-reg: Probabilistic and robust certified regression through randomized smoothing.Transactions on Machine Learning Research, 2025

    Aref Miri Rekavandi, Olga Ohrimenko, and Benjamin IP Rubinstein. Rs-reg: Probabilistic and robust certified regression through randomized smoothing.Transactions on Machine Learning Research, 2025

    2025

  24. [32]

    Probabilistic mixture-of-experts for efficient deep reinforcement learning.arXiv preprint arXiv:2104.09122, 2021

    Jie Ren, Yewen Li, Zihan Ding, Wei Pan, and Hao Dong. Probabilistic mixture-of-experts for efficient deep reinforcement learning.arXiv preprint arXiv:2104.09122, 2021

    2021 arXiv

  25. [33]

    Predictions of component remaining useful lifetime using bayesian neural network.Progress in Nuclear Energy, 146:104143, 2022

    Andy Rivas, Gregory Kyriakos Delipei, and Jason Hou. Predictions of component remaining useful lifetime using bayesian neural network.Progress in Nuclear Energy, 146:104143, 2022

    2022

  26. [34]

    Real and complex analysis, 1987

    Walter Rudin. Real and complex analysis, 1987

    1987

  27. [35]

    Provably robust deep learning via adversarially trained smoothed classifiers.Advances in neural information processing systems, 32, 2019

    Hadi Salman, Jerry Li, Ilya Razenshteyn, Pengchuan Zhang, Huan Zhang, Sebastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers.Advances in neural information processing systems, 32, 2019

    2019

  28. [36]

    Evaluating randomized smoothing as a defense against adversarial attacks in trajectory prediction.arXiv preprint arXiv:2603.10821, 2026

    Julian F Schumann, Eduardo Figueiredo, Frederik Baymler Mathiesen, Luca Laurenti, Jens Kober, and Arkady Zgonnikov. Evaluating randomized smoothing as a defense against adversarial attacks in trajectory prediction.arXiv preprint arXiv:2603.10821, 2026

    2026

  29. [37]

    Schumann, Jeroen Hagenus, Frederik Baymler Mathiesen, and Arkady Zgonnikov

    Julian F. Schumann, Jeroen Hagenus, Frederik Baymler Mathiesen, and Arkady Zgonnikov. Realistic Adversarial Attacks for Robustness Evaluation of Trajectory Prediction Models via Future State Perturbation.ACM Journal on Autonomous Transportation Systems, 2026

    2026

  30. [38]

    STEP: Structured training and evaluation platform for benchmarking trajectory prediction models.arXiv preprint arXiv:2509.14801, 2025

    Julian F Schumann, Anna Mészáros, Jens Kober, and Arkady Zgonnikov. STEP: Structured training and evaluation platform for benchmarking trajectory prediction models.arXiv preprint arXiv:2509.14801, 2025

    2025

  31. [39]

    Smoothguard: Defending multimodal large language models with noise perturbation and clustering aggregation.arXiv preprint arXiv:2510.26830, 2025

    Guangzhi Su, Shuchang Huang, Yutong Ke, Zhuohang Liu, Long Qian, and Kaizhu Huang. Smoothguard: Defending multimodal large language models with noise perturbation and clustering aggregation.arXiv preprint arXiv:2510.26830, 2025

  32. [40]

    Intriguing properties of input-dependent randomized smoothing

    Peter Sukenik, Aleksei Kuvshinov, and Stephan Günnemann. Intriguing properties of input-dependent randomized smoothing. InInternational Conference on Machine Learning, 2021

    2021

  33. [41]

    Nnv: the neural network verification tool for deep neural networks and learning-enabled cyber-physical systems

    Hoang-Dung Tran, Xiaodong Yang, Diego Manzanas Lopez, Patrick Musau, Luan Viet Nguyen, Weiming Xiang, Stanley Bak, and Taylor T Johnson. Nnv: the neural network verification tool for deep neural networks and learning-enabled cyber-physical systems. InInternational conference o...

    2020

  34. [42]

    Clucert: Certifying llm robustness via clustering-guided denoising smoothing

    Zixia Wang, Gaojie Jin, Jia Hu, and Ronghui Mu. Clucert: Certifying llm robustness via clustering-guided denoising smoothing. InProceedings of the AAAI Conference on Artificial Intelligence, volume 40, pages 37998–38006, 2026

    2026

  35. [43]

    Turner, José Miguel Hernández-Lobato, and Alexander L

    Anqi Wu, Sebastian Nowozin, Edward Meeds, Richard E. Turner, José Miguel Hernández-Lobato, and Alexander L. Gaunt. Deterministic variational inference for robust bayesian neural networks. In7th International Conference on Learning Representations, ICLR, 2019

    2019

  36. [44]

    Marabou 2.0: a versatile formal analyzer of neural networks

    Haoze Wu, Omri Isac, Aleksandar Zelji´c, Teruhiro Tagomori, Matthew Daggitt, Wen Kokke, Idan Refaeli, Guy Amir, Kyle Julian, Shahaf Bassan, et al. Marabou 2.0: a versatile formal analyzer of neural networks. InInternational Conference on Computer Aided Verification, pages 249–...

    2024

  37. [45]

    Automatic perturbation analysis for scalable certified robustness and beyond.Advances in Neural Information Processing Systems, 33:1129–1141, 2020

    Kaidi Xu, Zhouxing Shi, Huan Zhang, Yihan Wang, Kai-Wei Chang, Minlie Huang, Bhavya Kailkhura, Xue Lin, and Cho-Jui Hsieh. Automatic perturbation analysis for scalable certified robustness and beyond.Advances in Neural Information Processing Systems, 33:1129–1141, 2020

    2020

  38. [46]

    Randomized smoothing of all shapes and sizes

    Greg Yang, Tony Duan, J Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. InInternational conference on machine learning, pages 10693–10705. PMLR, 2020

    2020

  39. [47]

    Arkady Zgonnikov, David Abbink, and Gustav Markkula. Should I Stay or Should I Go? Cognitive Modeling of Left-Turn Gap Acceptance Decisions in Human Drivers.Human Factors: The Journal of the Human Factors and Ergonomics Society, 66(5):1399–1413, May 2024

    2024

  40. [48]

    Efficient neural network robustness certification with general activation functions.Advances in neural information processing systems, 31, 2018

    Huan Zhang, Tsui-Wei Weng, Pin-Yu Chen, Cho-Jui Hsieh, and Luca Daniel. Efficient neural network robustness certification with general activation functions.Advances in neural information processing systems, 31, 2018

    2018

  41. [49]

    A prognostic driven predictive maintenance framework based on bayesian deep learning.Reliability Engineering & System Safety, 234:109181, 2023

    Liangliang Zhuang, Ancha Xu, and Xiao-Lin Wang. A prognostic driven predictive maintenance framework based on bayesian deep learning.Reliability Engineering & System Safety, 234:109181, 2023. 12 A Technical Proofs A.1 Proof of Theorem 3.1 As Theorem 3.1 is built from a union-b...

    2023

  42. [50]

    if[x k,yk,zk]is outside the corridor,

  43. [51]

    ifanypoint on the line segment between [xk,yk,zk] and [xk+1,yk+1,zk+1] touches an obstacle,

  44. [52]

    if[x k,yk,zk]is inside the goal region, or

  45. [53]

    quantized

    if the max episode length is reached. The parameters of the environment are summarized in Table 3. Policy and value networks.The policy is a tanh-squashed Gaussian mixture: at state s, sample a modez∼Cat(softmax(g ϕ(s))) where Cat is a categorical distribution, sample an unsca...

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.