certified robustness

Certified robustness provides mathematical proofs that model predictions are invariant within specified input perturbation bounds, offering formal guarantees against adversarial examples that empirical defenses cannot provide. Formal guarantee: for input x and certified radius r, provably f(x') = f(x) for all ||x' - x|| ≤ r—no adversarial attack within bound can change prediction. Certification methods: (1) randomized smoothing (most scalable—average predictions over Gaussian noise), (2) interval bound propagation (IBP—propagate input intervals through network), (3) CROWN/DeepPoly (linear relaxation of nonlinear layers for tighter bounds). Randomized smoothing: smooth classifier g(x) = argmax_c P(f(x+ε)=c) where ε~N(0,σ²); certification via Neyman-Pearson lemma provides radius depending on confidence gap and σ. Trade-offs: (1) larger certified radius requires more noise (σ), degrading accuracy, (2) certification often conservative (actual robustness may be higher), (3) computational cost from Monte Carlo sampling. Certified training: train networks to maximize certifiable accuracy, not just natural accuracy—often yields models with larger certified radii. Metrics: certified accuracy at radius r (percentage of samples with radius ≥ r and correct prediction). Comparison: adversarial training (empirical defense—no formal guarantee, attacks may succeed), certified defense (mathematical proof—guarantee holds by construction). Applications: safety-critical systems requiring formal assurance. Active AI safety research area providing provable security against input manipulation.