Randomized Smoothing

Randomized Smoothing is the most scalable certified defense method against adversarial perturbations — creating a "smoothed classifier" by taking the majority vote of a base classifier's predictions on many noisy copies of the input, with provable robustness guarantees.

How Randomized Smoothing Works

• Smoothed Classifier: $g(x) = argmax_c P(f(x + \epsilon) = c)$ where $\epsilon \sim N(0, \sigma^2 I)$.
• Certification: If the top class has probability $p_A$ and the runner-up has $p_B$, the certified radius is $R = \frac{\sigma}{2}(Phi^{-1}(p_A) - Phi^{-1}(p_B))$.
• Monte Carlo: Estimate probabilities by sampling many noisy copies and counting votes.
• Trade-Off: Larger $\sigma$ = larger certified radius but lower clean accuracy.

Why It Matters

• Scalable: Works with any base classifier (CNNs, transformers) of any size — no architectural constraints.
• Provable: Provides a mathematically provable robustness guarantee under $L_2$ perturbations.
• Practical: The most practical certified defense for large-scale, real-world models.

Randomized Smoothing is security through noise — using Gaussian noise to create a provably robust classifier with certifiable guarantees.