Skip to yearly menu bar Skip to main content


Improving l1-Certified Robustness via Randomized Smoothing by Leveraging Box Constraints

Václav Voráček · Matthias Hein

Exhibit Hall 1 #819
[ ]
[ PDF [ Poster

Abstract: Randomized smoothing is a popular method to certify robustness of image classifiers to adversarial input perturbations. It is the only certification technique which scales directly to datasets of higher dimension such as ImageNet. However, current techniques are not able to utilize the fact that any adversarial example has to lie in the image space, that is $[0,1]^d$; otherwise, one can trivially detect it. To address this suboptimality, we derive new certification formulae which lead to significant improvements in the certified $\ell_1$-robustness without the need of adapting the classifiers or change of smoothing distributions. The code is released at

Chat is not available.