Randomized Smoothing Threshold Certificate

Derive an exact smoothing certificate from Gaussian mass around a one-dimensional threshold.

Randomized Smoothing Threshold Certificate

Randomized smoothing turns an arbitrary base classifier into one with a mathematically guaranteed certified radius against adversarial perturbations. By injecting Gaussian noise to the input and voting on the resulting predictions, the smoothed model behaves predictably under bounded shifts.

Worked Example: Threshold Classifier

Consider a simple 1D threshold classifier that predicts Positive for x > 0 and Negative otherwise. If we add Gaussian noise N(0, σ²), we can find the exact class probabilities and certified radius.

Initial State: x = 1, σ = 1, δ = -0.5

1. Calculate standard normal probabilities:
   Since x > 0:
   P_pos = Φ(x / σ) = Φ(1 / 1) = Φ(1)
   P_neg = Φ(-x / σ) = Φ(-1 / 1) = Φ(-1)

2. Evaluate probability:
   P_pos ≈ 0.8413447460685429
   P_neg ≈ 0.15865525393145707

3. Determine smoothed prediction:
   P_pos > P_neg, so Smoothed Prediction = Positive

4. Calculate certified radius:
   radius = |x| = 1

5. Check if perturbed input is strictly inside certificate:
   |δ| = |-0.5| = 0.5 < 1
   Strictly inside certificate = Yes

6. Determine perturbed prediction:
   Perturbed point x_pert = x + δ = 1 - 0.5 = 0.5 > 0
   Perturbed Prediction = Positive

Experiment: Interactive Validation

Use the interactive module to verify the mathematical properties of the smoothing certificate. You can adjust the following controls:

Set Input x to different values and observe the certified radius matches |x|.
Adjust Noise sigma and notice how the probabilities change, but the theoretical absolute certified radius for this specific exact-probability linear threshold remains |x|.
Change Attack delta to values beyond the certified radius (e.g., x=1, δ=-1) and see how it falls outside the strictly certified set.

Limitations

This module demonstrates an exact analytical case for a simple 1D threshold. In practice with high-dimensional neural networks:

Exact probabilities cannot be computed. We must rely on Monte Carlo sampling and finite-sample confidence intervals, which bounds the certified radius rather than yielding exact values.
The certified radius theorem assumes isotropic Gaussian noise, which may not be optimal for all types of adversarial threats (e.g., L_infinity norm attacks).
Injecting large noise (high σ) to increase robustness often degrades the base classifier's clean accuracy significantly.

References

For further reading on the rigorous mathematical foundations of randomized smoothing and its applications to robust machine learning, refer to the following primary source:

Cohen, J. M., Rosenfeld, E., & Kolter, J. Z. (2019). Certified Adversarial Robustness via Randomized Smoothing.ICML 2019.

Randomized Smoothing Threshold Certificate