randomized smoothing

**Randomized Smoothing** is the **most scalable certified defense method against adversarial perturbations** — creating a "smoothed classifier" by taking the majority vote of a base classifier's predictions on many noisy copies of the input, with provable robustness guarantees. **How Randomized Smoothing Works** - **Smoothed Classifier**: $g(x) = argmax_c P(f(x + epsilon) = c)$ where $epsilon sim N(0, sigma^2 I)$. - **Certification**: If the top class has probability $p_A$ and the runner-up has $p_B$, the certified radius is $R = frac{sigma}{2}(Phi^{-1}(p_A) - Phi^{-1}(p_B))$. - **Monte Carlo**: Estimate probabilities by sampling many noisy copies and counting votes. - **Trade-Off**: Larger $sigma$ = larger certified radius but lower clean accuracy. **Why It Matters** - **Scalable**: Works with any base classifier (CNNs, transformers) of any size — no architectural constraints. - **Provable**: Provides a mathematically provable robustness guarantee under $L_2$ perturbations. - **Practical**: The most practical certified defense for large-scale, real-world models. **Randomized Smoothing** is **security through noise** — using Gaussian noise to create a provably robust classifier with certifiable guarantees.