Dual Randomized Smoothing: Beyond Global Noise Variance

2025-12-01

AI Summary

Randomized smoothing (RS) with a fixed global noise variance struggles to simultaneously guarantee robustness certification across small and large perturbation radii. To address this, we propose Dual Randomized Smoothing (DRS), the first framework to theoretically establish—under the local constancy assumption—that input-dependent noise variance preserves certification validity. DRS introduces a learnable variance estimator and an independent smoothing mechanism to enable radius-adaptive robustness. Our method integrates a variance estimation network, iterative optimization, and expert routing for flexible noise modeling. On CIFAR-10, DRS achieves relative improvements of 19%, 24%, and 21% in certified accuracy at radii 0.5, 0.75, and 1.0, respectively, with only a 60% increase in inference overhead; it maintains consistent advantages across all radii on ImageNet. The core contribution is breaking the global variance constraint, establishing the first theoretically sound, learnable, input-adaptive randomized smoothing paradigm.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Intelligent Robots: Learning & Optimization for ROB

Application Category

• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Security and Privacy: Large-scale security measurements

Abstract

Randomized Smoothing (RS) is a prominent technique for certifying the robustness of neural networks against adversarial perturbations. With RS, achieving high accuracy at small radii requires a small noise variance, while achieving high accuracy at large radii requires a large noise variance. However, the global noise variance used in the standard RS formulation leads to a fundamental limitation: there exists no global noise variance that simultaneously achieves strong performance at both small and large radii. To break through the global variance limitation, we propose a dual RS framework which enables input-dependent noise variances. To achieve that, we first prove that RS remains valid with input-dependent noise variances, provided the variance is locally constant around each input. Building on this result, we introduce two components which form our dual RS framework: (i) a variance estimator first predicts an optimal noise variance for each input, (ii) this estimated variance is then used by a standard RS classifier. The variance estimator is independently smoothed via RS to ensure local constancy, enabling flexible design. We also introduce training strategies to iteratively optimize the two components. Extensive experiments on CIFAR-10 show that our dual RS method provides strong performance for both small and large radii-unattainable with global noise variance-while incurring only a 60% computational overhead at inference. Moreover, it consistently outperforms prior input-dependent noise approaches across most radii, with particularly large gains at radii 0.5, 0.75, and 1.0, achieving relative improvements of 19%, 24%, and 21%, respectively. On ImageNet, dual RS remains effective across all radii. Additionally, the dual RS framework naturally provides a routing perspective for certified robustness, improving the accuracy-robustness trade-off with off-the-shelf expert RS models.

Problem

• Overcomes global noise variance limitation in Randomized Smoothing
• Enables input-dependent noise variances for robust neural networks
• Improves certified robustness across both small and large radii

Innovation

• Dual RS framework uses input-dependent noise variances
• Variance estimator predicts optimal noise per input
• Independent smoothing ensures local constancy for flexibility