CEAR: Certified Ensemble Adversarial Robustness in DNNs

Daniel Sadig; Hamed Karimi; Mohammadreza Maleki; Reza Samavi

REVIEW 2 major objections 2 minor 33 references

CEAR: Certified Ensemble Adversarial Robustness in DNNs

T0 review · 2 major / 2 minor · reviewed 2026-06-28 · grok-4.3

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CEAR extends randomized smoothing to certify robustness of DNN ensembles trained with varied noise and temperatures, achieving higher certified accuracy than baselines.

desk verdict CEAR adds two voting rules on noisy logits and claims to extend randomized smoothing to ensembles, but the certification step looks like it may need a fresh derivation. read the letter →

arxiv 2606.01437 v1 pith:B3JAISGI submitted 2026-05-31 cs.LG cs.AI

Daniel Sadig , Mohammadreza Maleki , Hamed Karimi , Reza Samavi This is my paper

classification cs.LGcs.AI

keywords adversarialrobustnesscertifieddefenseensemblemethodsrandomizedsmoothingdeepneuralnetworksimageclassification

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper seeks to combine empirical defenses like gradient obfuscation with certified guarantees by training an ensemble of networks, each with different Gaussian noise levels and temperatures, then applying voting on noisy logits. It extends randomized smoothing so the ensemble as a whole receives provable robustness bounds. A reader would care because safety-critical systems need defenses that hold against any attacker with full model knowledge, and ensembles often improve accuracy while the certification provides the missing guarantee. The approach is evaluated on standard image datasets to show gains in certified accuracy, radius, and reduced attack transfer.

What carries the argument

Extension of randomized smoothing to ensemble classifiers via two voting mechanisms on noisy logits that preserve the probabilistic majority-vote or smoothed-probability bounds.

What would settle it

An experiment in which the certified accuracy bound fails to hold for the ensemble under the proposed voting schemes, for example by finding adversarial examples inside the certified radius that the smoothed ensemble still misclassifies.

Watch

Extended reading notes

Core claim

CEAR trains each network in the ensemble using varying Gaussian noise and temperatures to obfuscate gradients and logits. Two voting mechanisms are applied to the noisy logits, and randomized smoothing is extended to certify the ensemble classifier. Experiments on MNIST, CIFAR10, and TinyImageNet show superior certified accuracy on average, larger robustness radius, and lower transferability relative to baseline methods.

Load-bearing premise

The voting mechanisms on noisy logits preserve the probabilistic properties required for randomized-smoothing certification to remain valid when applied to the ensemble rather than a single classifier.

Editorial extensions

If this is right

The ensemble receives provable robustness guarantees within a specified perturbation bound.
Certified accuracy is higher on average than single-model baselines on MNIST, CIFAR10, and TinyImageNet.
The certified robustness radius is increased compared with baseline methods.
Transferability of adversarial examples is decreased.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The same voting-based extension could be tested on ensembles of models trained with other empirical defenses beyond noise and temperature.
Certification of larger or more accurate models might become feasible by certifying an ensemble of smaller certified components.
Reduced transferability suggests the method could be useful in settings where models are queried by third parties.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

read the letter

The paper's core move is training an ensemble where each member sees different Gaussian noise and temperature scaling during training, then applying two voting schemes on the noisy logits at inference, plus an extension of randomized smoothing to certify the whole thing. That combination is new enough on its face; prior single-model smoothing results do not automatically cover the ensemble case once you insert a non-linear vote.

What the work does cleanly is run the usual certified-accuracy experiments on MNIST, CIFAR-10, and Tiny-ImageNet and report gains over the obvious baselines in average certified accuracy, radius, and transferability. Those numbers are at least reproducible in principle if the code and exact voting definitions are released.

The soft spot is the certification claim itself. Randomized smoothing gives tight bounds only for a single smoothed classifier; composing it with majority vote or probability aggregation over multiple members changes the effective smoothed function. The abstract does not show whether the authors re-derived the probability bounds to account for dependence across ensemble members or the non-linearity of the vote. If that step is missing or hand-waved, the reported certified radii rest on an unverified transfer of the guarantee.

This is a paper for people already working inside the certified-robustness niche who want to see whether ensemble tricks can be made to play nicely with smoothing. It is worth sending to referees so they can check the proof and the experimental protocol in detail; the empirical side is standard but the theoretical extension is the part that actually matters.

Referee Report

2 major / 2 minor

Summary. The paper proposes CEAR, a hybrid ensemble defense for DNNs. Each ensemble member is trained with different Gaussian noise levels and temperatures to obfuscate gradients and logits. Two voting mechanisms are applied to the noisy logits from the smoothed members. The authors extend randomized smoothing to certify robustness of the resulting ensemble classifier. Experiments on MNIST, CIFAR-10 and TinyImageNet report higher average certified accuracy, larger robustness radii and lower transferability than baselines.

Significance. If the extension of randomized smoothing is shown to be valid, the approach would combine empirical gradient obfuscation with certified guarantees for ensembles, a direction that could improve practical certified robustness. The use of per-member noise and temperature variation plus post-hoc voting on logits is a concrete design choice whose value would be strengthened by a clear proof that the voting step preserves the necessary probability bounds.

major comments (2)

[Section describing the extension of randomized smoothing (and any associated theorem or proof)] The central claim that randomized smoothing extends directly to the ensemble via the two voting mechanisms on noisy logits is load-bearing for all certified-accuracy results. No derivation is supplied showing that the majority vote or probability-aggregation step yields a new smoothed classifier whose output probabilities remain bounded by the standard closed-form expressions (or by a corrected version that accounts for dependence across ensemble members). Without this step the reported radii and accuracies rest on an unverified transfer of the single-classifier guarantee.
[Experimental evaluation and certification results] Because the certification theorem is not re-derived for the voted ensemble, the experimental claims of superior certified accuracy and increased robustness radius cannot be taken as certified; they are at best empirical observations whose provable status is unclear.

minor comments (2)

Provide explicit pseudocode or equations for both voting mechanisms and state precisely how the final class decision is obtained from the noisy logits.
Clarify whether the temperature parameters are fixed at inference or also randomized, and how this choice affects the smoothing distribution.

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive feedback highlighting the need for a rigorous derivation of the randomized smoothing extension. We address each major comment below and commit to a revised manuscript that supplies the missing formal justification.

read point-by-point responses

Referee: [Section describing the extension of randomized smoothing (and any associated theorem or proof)] The central claim that randomized smoothing extends directly to the ensemble via the two voting mechanisms on noisy logits is load-bearing for all certified-accuracy results. No derivation is supplied showing that the majority vote or probability-aggregation step yields a new smoothed classifier whose output probabilities remain bounded by the standard closed-form expressions (or by a corrected version that accounts for dependence across ensemble members). Without this step the reported radii and accuracies rest on an unverified transfer of the single-classifier guarantee.

Authors: We agree that the current manuscript states the extension of randomized smoothing to the ensemble but does not supply an explicit derivation showing how the two voting mechanisms preserve the required probability bounds. In the revision we will add a formal derivation (in the main text or an appendix) that (i) defines the ensemble classifier as a function of the per-member smoothed logits, (ii) shows that both the majority-vote and probability-aggregation rules produce output probabilities that remain amenable to the standard closed-form lower bounds, and (iii) explicitly accounts for statistical dependence among ensemble members by deriving a (possibly looser) bound that still yields non-trivial certified radii. revision: yes
Referee: [Experimental evaluation and certification results] Because the certification theorem is not re-derived for the voted ensemble, the experimental claims of superior certified accuracy and increased robustness radius cannot be taken as certified; they are at best empirical observations whose provable status is unclear.

Authors: We concur that, absent the re-derived theorem, the reported certified accuracies and radii cannot yet be claimed as certified. In the revised manuscript we will (a) present the new derivation first, (b) re-state all experimental results under the corrected certification procedure, and (c) clearly distinguish which quantities are now provably certified versus those that remain empirical. Any dependence-induced looseness in the bounds will be reported transparently. revision: yes

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: extension of randomized smoothing to ensembles does not reduce to self-definition or fitted inputs

full rationale

The provided abstract and description present CEAR as training ensemble members with Gaussian noise and temperatures, followed by two voting mechanisms on noisy logits, then extending randomized smoothing for certification. No equations, fitted parameters, or self-referential definitions are shown that would make certified accuracy or radii equivalent to inputs by construction. The method invokes standard randomized smoothing (external prior work) applied after the voting step; any requirement for a fresh proof of the composition is a question of correctness, not circularity. No self-citation load-bearing steps, uniqueness theorems, or ansatzes smuggled via citation are described. This is the common case of a self-contained proposal against external benchmarks, warranting score 0.

Assumptions & free parameters 0 free parameters · 1 assumptions · 0 invented entities

Abstract-only; the method implicitly relies on standard randomized-smoothing assumptions (Gaussian noise distribution, Lipschitz properties of the base classifier) and on the unstated claim that the chosen voting functions commute with the smoothing certification. No explicit free parameters or invented entities are named.

assumptions (1)

domain assumption Randomized smoothing certification remains valid when the base classifier is replaced by an ensemble whose output is produced by one of the two voting mechanisms on noisy logits.
The extension step in the abstract presupposes that the probabilistic majority or averaged vote satisfies the same concentration bounds used in single-model randomized smoothing.

how reviews work

0 comments

Cite this review

Pith. "Pith review of CEAR: Certified Ensemble Adversarial Robustness in DNNs." pith.science (2026). https://pith.science/paper/B3JAISGI

@misc{pith2026260601437,
  author       = {Pith},
  title        = {Pith review of: CEAR: Certified Ensemble Adversarial Robustness in DNNs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/B3JAISGI}},
  note         = {Machine review of arXiv:2606.01437}
}

read the original abstract

Deep Neural Networks (DNNs) are highly susceptible to adversarial perturbations, leading to extensive research on robustness for safety-critical applications. State-of-the-art empirical defense mechanisms improve the robustness of DNNs through the training phase, but still struggle against adaptive white-box attacks. On the other hand, certified defenses offer provable guarantees of robustness within a specified perturbation bound. These guarantees hold regardless of the level of perturbations, even if the attacker is given full knowledge of the model. In this paper, we propose CEAR, an ensemble-based robust method that utilizes a hybrid of empirical and certified defense mechanisms. CEAR trains each network within the ensemble using varying Gaussian noise and temperatures to obfuscate gradients and logits, making the model more resistant to stronger gradient-based attacks. We then use noisy logits and propose two different voting mechanisms to further improve robustness. Furthermore, we extend randomized smoothing to verify the robustness of ensemble-based classifiers. Our experimental evaluations on MNIST, CIFAR10, and TinyImageNet datasets demonstrate superior certified accuracy on average, increased robustness radius, and decreased transferability compared to baseline methods.

Figures

Figures reproduced from arXiv: 2606.01437 by the authors.

**Figure 1.** Overview of Certified Ensemble Adversarial Robustness Section 2.2), we adapt noisy logits [12] to obfuscate the gradients across all layers of the individual student networks in the ensemble and protect the model against stronger attacks such as C&W attack [3]. Since clean inputs are exposed to several stochastic perturbations (due to the addition of Gaussian noise during training and inference phases), degradation … view at source ↗

**Figure 2.** The average certified accuracy under varying radii and noise σv near-zero CA, whereas CEAR(RW) continues to dampen the effects of the perturbations and maintain its accuracy. A similar trend is observed on CIFAR10 and TinyImageNet in Figures 2(h) and 2(l), confirming that robust weighted aggregation is particularly effective in the large-radius regime. In contrast, [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

**Figure 3.** The certified accuracy for MNIST under varying radii and σv CEAR−(RW) rapidly approaches zero certified accuracy once R > 2.0, whereas CEAR(RW) maintains approximately 25% certified accuracy beyond the same radius. Since MNIST is a comparatively simple classification task, the benefits of VGA are visually apparent in the certification curves. Although the effect is less obvious on the more complex CIFAR10 and TinyIm… view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: The certified accuracy for CIFAR-10 under varying radii and σv This is the preprint of the work accepted for publication in the Proceedings of the 39th Canadian Conference on Artificial Intelligence (Canadian AI 2026) [PITH_FULL_IMAGE:figures/full_fig_p018_4.png]

**Figure 5.** Figure 5: The certified accuracy for TinyImageNet under varying radii and σv This is the preprint of the work accepted for publication in the Proceedings of the 39th Canadian Conference on Artificial Intelligence (Canadian AI 2026) [PITH_FULL_IMAGE:figures/full_fig_p019_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

33 extracted references · 1 canonical work pages

[1]

Adversarial example detection for DNN models: A review and experimental comparison

A. Aldahdooh, W. Hamidouche, S. A. Fezza, and O. Déforges. “Adversarial example detection for DNN models: A review and experimental comparison”. In:Artificial Intelligence Review 55.6 (2022), pp. 4403–4462

2022
[2]

Intriguing properties of neural networks

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. “Intriguing properties of neural networks”. In:2nd International Conference on Learning Representations, ICLR 2014. 2014

2014
[3]

Towards evaluating the robustness of neural networks

N. Carlini and D. Wagner. “Towards evaluating the robustness of neural networks”. In:2017 ieee symposium on security and privacy (sp). Ieee. 2017, pp. 39–57

2017
[4]

FailureCasesAreBetterLearnedButBoundarySaysSorry:Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training

Y.WangandL.Liu.“FailureCasesAreBetterLearnedButBoundarySaysSorry:Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training”. In: arXiv preprint arXiv:2508.02186(2025)

work page arXiv 2025
[5]

Distillation as a defense to adver- sarial perturbations against deep neural networks

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. “Distillation as a defense to adver- sarial perturbations against deep neural networks”. In:symp. on security and privacy. IEEE. 2016, pp. 582–597

2016
[6]

Sok: Certified robustness for deep neural networks

L. Li, T. Xie, and B. Li. “Sok: Certified robustness for deep neural networks”. In:2023 IEEE symposium on security and privacy (SP). IEEE. 2023, pp. 1289–1310

2023
[7]

Semidefinite relaxations for certifying ro- bustness to adversarial examples

A. Raghunathan, J. Steinhardt, and P. S. Liang. “Semidefinite relaxations for certifying ro- bustness to adversarial examples”. In:NeurIPS31 (2018)

2018
[8]

Certified robustness to ad- versarial examples with differential privacy

M. Lecuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana. “Certified robustness to ad- versarial examples with differential privacy”. In:symp. on security and privacy (SP). IEEE. 2019, pp. 656–672

2019

Show all 33 references

[9]

Certified adversarial robustness via randomized smoothing

J. Cohen, E. Rosenfeld, and Z. Kolter. “Certified adversarial robustness via randomized smoothing”. In:international conference on machine learning. PMLR. 2019, pp. 1310–1320

2019
[10]

Adversarial robustness of neural networks from the perspective of lipschitz calculus: A survey

M. Zühlke and D. Kudenko. “Adversarial robustness of neural networks from the perspective of lipschitz calculus: A survey”. In:ACM Computing Surveys57.6 (2025), pp. 1–41

2025
[11]

On the Certified Robustness for Ensemble Models and Beyond

Z. Yang, L. Li, X. Xu, B. Kailkhura, T. Xie, and B. Li. “On the Certified Robustness for Ensemble Models and Beyond”. In:Int. Conf. on Learning Representations. 2022

2022
[12]

Advanced defensive distillation with ensemble voting and noisy logits

Y. Liang and R. Samavi. “Advanced defensive distillation with ensemble voting and noisy logits”. In:Applied Intelligence53.3 (2023), pp. 3069–3094

2023
[13]

Diversity supporting robustness: Enhancing adversarial robustness via differentiated ensemble predictions

X. Chen, W. Huang, Z. Peng, W. Guo, and F. Zhang. “Diversity supporting robustness: Enhancing adversarial robustness via differentiated ensemble predictions”. In:Computers & Security142 (2024), p. 103861

2024
[14]

Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

F. Croce and M. Hein. “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks”. In:ICML. PMLR. 2020, pp. 2206–2216

2020
[15]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

A. Athalye, N. Carlini, and D. Wagner. “Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples”. In:International Conference on Machine Learning. PMLR. 2018, pp. 274–283

2018
[16]

MACER: attack-free and scalable robust training via maximizing certified radius

R. Zhai, C. Dan, D. He, H. Zhang, B. Gong, P. Ravikumar, C.-J. Hsieh, and L. Wang. “MACER: attack-free and scalable robust training via maximizing certified radius”. In:In- ternational Conference on Learning Representations (ICLR). 2020

2020
[17]

Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers

H. Salman, J. Li, I. Razenshteyn, P. Zhang, H. Zhang, S. Bubeck, and G. Yang. “Provably Robust Deep Learning via Adversarially Trained Smoothed Classifiers”. In:NeurIPS. Ed. by H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett. Vol. 32. Curran A...

2019
[18]

Double-boosted randomized smoothing: A sharp certified defense against adversarial attacks

B. Li, Y. Wang, Z. Ren, and J. Z. Kolter. “Double-boosted randomized smoothing: A sharp certified defense against adversarial attacks”. In:NeurIPS. 2022

2022
[19]

FASTEN: fast ensemble learning for im- proved adversarial robustness

L. Huang, Q. Huang, P. Qiu, S. Wei, and C. Gao. “FASTEN: fast ensemble learning for im- proved adversarial robustness”. In:IEEE Transactions on Information Forensics and Security 19 (2023), pp. 2565–2580

2023
[20]

Enhancing Certified Robustness via Smoothed Weighted Ensembling

C. Liu, Y. Feng, R. Wang, and B. Dong. “Enhancing Certified Robustness via Smoothed Weighted Ensembling”. In:ICML 2021 Workshop on Adv. Machine Learning. 2020

2021
[21]

Dynamically weighted ensemble neural networks for classification

D. Jiménez. “Dynamically weighted ensemble neural networks for classification”. In:1998 IEEE International Joint Conference on Neural Networks Proceedings. IEEE World Congress on Computational Intelligence (Cat. No. 98CH36227). Vol. 1. IEEE. 1998, pp. 753–756. This is the prep...

1998
[22]

Towards certified robustness under label noise

K. Zhang, H. Zhu, X. Li, and D. Evans. “Towards certified robustness under label noise”. In: International Conference on Learning Representations (ICLR). 2021

2021
[23]

DENL: Diverse Ensemble and Noisy Logits for Improved Robustness of Neural Networks

M. Yazdani, H. Karimi, and R. Samavi. “DENL: Diverse Ensemble and Noisy Logits for Improved Robustness of Neural Networks”. In:ACML. PMLR. 2024, pp. 1574–1589

2024
[24]

On calibration of modern neural networks

C. Guo, G. Pleiss, Y. Sun, and K. Q. Weinberger. “On calibration of modern neural networks”. In:International Conference on Machine Learning. PMLR. 2017, pp. 1321–1330

2017
[25]

The limitations of deep learning in adversarial settings

N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami. “The limitations of deep learning in adversarial settings”. In:2016 IEEE European Symposium on Security and Privacy (EuroS&P). IEEE. 2016, pp. 372–387

2016
[26]

Note on the median of a multivariate distribution

J. Haldane. “Note on the median of a multivariate distribution”. In:Biometrika35.3-4 (1948), pp. 414–417

1948
[27]

Sur le point pour lequel la somme des distances de n points donnés est mini- mum

E. Weiszfeld. “Sur le point pour lequel la somme des distances de n points donnés est mini- mum”. In:Tohoku Mathematical Journal, First Series43 (1937), pp. 355–386

1937
[28]

LeCun, C

Y. LeCun, C. Cortes, and C. J. C. Burges.The MNIST Database of Handwritten Digits. http://yann.lecun.com/exdb/mnist/. 1998

1998
[29]

Krizhevsky.Learning Multiple Layers of Features from Tiny Images

A. Krizhevsky.Learning Multiple Layers of Features from Tiny Images. Technical Report, University of Toronto. CIFAR-10 dataset. 2009.url:https://www.cs.toronto.edu/~kriz/ learning-features-2009-TR.pdf

2009
[30]

ImageNet: A Large-Scale Hierarchical Image Database

J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei. “ImageNet: A Large-Scale Hierarchical Image Database”. In:Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 2009, pp. 248–255

2009
[31]

TensorFlow: a system for Large-Scale machine learning

M. Abadi, P. Barham, J. Chen, Z. Chen, A. Davis, J. Dean, M. Devin, S. Ghemawat, G. Irving, M. Isard, et al. “TensorFlow: a system for Large-Scale machine learning”. In:12th USENIX symposium on OSDI 16. 2016, pp. 265–283

2016
[32]

Gradient-based learning applied to docu- ment recognition

Y. LeCun, L. Bottou, Y. Bengio, and P. Haffner. “Gradient-based learning applied to docu- ment recognition”. In:Proceedings of the IEEE86.11 (2002), pp. 2278–2324

2002
[33]

Deep residual learning for image recognition

K. He, X. Zhang, S. Ren, and J. Sun. “Deep residual learning for image recognition”. In:Proc. of the IEEE conf. on computer vision and pattern recognition. 2016, pp. 770–778. This is the preprint of the work accepted for publication in the Proceedings of the 39th Canadian Conf...

2016

Pith tools

Reviewed June 28, 2026 · model on record in the stance chip above.

[1] [1]

Adversarial example detection for DNN models: A review and experimental comparison

A. Aldahdooh, W. Hamidouche, S. A. Fezza, and O. Déforges. “Adversarial example detection for DNN models: A review and experimental comparison”. In:Artificial Intelligence Review 55.6 (2022), pp. 4403–4462

2022

[2] [2]

Intriguing properties of neural networks

C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus. “Intriguing properties of neural networks”. In:2nd International Conference on Learning Representations, ICLR 2014. 2014

2014

[3] [3]

Towards evaluating the robustness of neural networks

N. Carlini and D. Wagner. “Towards evaluating the robustness of neural networks”. In:2017 ieee symposium on security and privacy (sp). Ieee. 2017, pp. 39–57

2017

[4] [4]

FailureCasesAreBetterLearnedButBoundarySaysSorry:Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training

Y.WangandL.Liu.“FailureCasesAreBetterLearnedButBoundarySaysSorry:Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Training”. In: arXiv preprint arXiv:2508.02186(2025)

work page arXiv 2025

[5] [5]

Distillation as a defense to adver- sarial perturbations against deep neural networks

N. Papernot, P. McDaniel, X. Wu, S. Jha, and A. Swami. “Distillation as a defense to adver- sarial perturbations against deep neural networks”. In:symp. on security and privacy. IEEE. 2016, pp. 582–597

2016

[6] [6]

Sok: Certified robustness for deep neural networks

L. Li, T. Xie, and B. Li. “Sok: Certified robustness for deep neural networks”. In:2023 IEEE symposium on security and privacy (SP). IEEE. 2023, pp. 1289–1310

2023

[7] [7]

Semidefinite relaxations for certifying ro- bustness to adversarial examples

A. Raghunathan, J. Steinhardt, and P. S. Liang. “Semidefinite relaxations for certifying ro- bustness to adversarial examples”. In:NeurIPS31 (2018)

2018

[8] [8]

Certified robustness to ad- versarial examples with differential privacy

M. Lecuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana. “Certified robustness to ad- versarial examples with differential privacy”. In:symp. on security and privacy (SP). IEEE. 2019, pp. 656–672

2019