Certified Robustness for Vision
Prove a radius around each image where no attack can flip the prediction, instead of merely surviving the attacks tried so far.
Why Does This Exist?
Empirical defenses survive the attacks tested and fall to the next one, leaving safety arguments resting on effort rather than proof. Certified robustness replaces testing with verification: for each image, prove that every input within a radius keeps the prediction, regardless of attack ingenuity. Where the proof holds, no future attack inside the radius can succeed, including unpublished ones.
The price is radius size, accuracy, and scale. Practical certificates cover small radii on modest models, and the method that scales them is randomized smoothing.
Think of It Like This
A surveyed flood line versus sandbags that held once
Sandbags that survived last year's flood prove nothing about next year's water, while a surveyed line marks ground provably above any flood under a stated height. Empirical defenses are sandbags, certificates are survey lines drawn per house. The analogy stops at cost: surveys are expensive per house, and certification is expensive per prediction.
How It Actually Works
Bound the network's output range over the whole input ball: propagate intervals, linear relaxations, or Lipschitz bounds layer by layer from the perturbed input to the logits. When the true class lower bound stays above every other class upper bound, the radius is certified for that image. Training with the bound in the loop widens certified radii at the cost of clean accuracy.
Worked example with recomputed numbers
Demo classifier at radius 0.01: interval propagation certifies 61 of 100 test images, meaning 61 predictions provably cannot flip inside that ball. Clean accuracy is 0.78 against 0.90 for the uncertified model, a 0.12 price. Double the radius to 0.02 and certified count falls to 34 while clean accuracy stays 0.78, showing radius as the independent dial. PGD at 0.01 flips zero certified images and 9 uncertified ones, confirming the proof means what it says inside its boundary.
Condition and limit
Certificates hold for the stated norm and radius only; larger budgets, different norms, and semantic changes sit outside the proof. Scaling to large backbones multiplies bound looseness, which is why production certificates pair small certifiable heads with empirical monitoring around them.
Watch Out For
Reading certified accuracy as clean accuracy
Certified 61 of 100 at radius 0.01 is not 0.61 accuracy: the other 39 may still classify correctly without proof. The symptom is a model rejected as weak that actually scores 0.78 clean. Report certified count, clean accuracy, and radius together, never one number alone.
The Quick Version
- Proof per image that no attack inside the radius flips it.
- Demo: 61 of 100 certified at radius 0.01, clean 0.78.
- Radius is the dial: 0.02 keeps 34 certified at the same clean score.
- Holds for the stated norm only; other budgets need other proofs.
- Pair small certifiable heads with monitoring at production scale.