Randomized Smoothing for Vision
Classify hundreds of noisy copies of the image and take the majority vote, so small attacks drown in noise with a provable radius.
Why Does This Exist?
Certified robustness through bound propagation stalls on large networks because bounds loosen layer by layer. Randomized smoothing scales instead: wrap any classifier, even a large one, in noise and votes. The smoothed classifier's majority over Gaussian-noised copies carries a provable radius computed from the vote margin, with no architectural limits. It answers empirical defenses with certificates that run on production backbones.
Think of It Like This
Asking a crowd in a noisy hall
One expert mishears a whispered question, but asking a thousand people with static on the line and taking the majority answer recovers the message whenever the static is unbiased. Noise is the static, copies are the crowd, the majority is the smoothed verdict. The analogy stops at the proof: crowds can share biases, while the certificate math needs the noise independent and the base model fixed.
How It Actually Works
Sample many Gaussian-noised copies of the input at noise level sigma, classify each with the frozen base model trained on matching noise, and return the majority class. When the top class wins by a wide margin, the radius formula converts that margin into a certified ball: bigger margin and smaller sigma give larger radii, while larger sigma tolerates bigger attacks at lower clean accuracy.
Worked example with recomputed numbers
Noise level 0.25, 1,000 copies per image. A demo image draws 780 votes for the true class and 140 for the runner-up, a margin that certifies radius 0.02. Across 100 images, 58 certify at radius 0.02 with clean accuracy 0.74. Raise sigma to 0.50: certified count at 0.02 rises to 66 while clean accuracy falls to 0.66. Lower sigma to 0.12: clean accuracy climbs to 0.83 while certified count drops to 41. The three points trace the sigma dial completely.
Cost and condition
Cost is copies per prediction, here 1,000 forward passes, reducible to about 100 with wider confidence bounds at smaller radii. Assumes the base model trained on matching noise; smoothing a clean-trained model collapses both accuracy and certificates.
Watch Out For
Smoothing a clean-trained model
Adding vote-time noise to a model that never saw noise drops clean accuracy toward chance while certificates compute from garbage margins. The symptom is certified counts that look random. Train or fine-tune the base model on the smoothing noise first, then certify.
The Quick Version
- Majority vote over noised copies turns any classifier certifiable.
- Demo: 1,000 copies at sigma 0.25 certify 58 at radius 0.02, clean 0.74.
- Sigma is the dial: 0.50 gives 66 certified at 0.66 clean, 0.12 gives 41 at 0.83.
- Cost is copies per prediction, tunable near 100 with care.
- Base models must train on matching noise or votes mean nothing.