{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T15:56:58Z","timestamp":1784995018941,"version":"3.55.0"},"reference-count":222,"publisher":"IEEE","license":[{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-009"},{"start":{"date-parts":[[2023,5,1]],"date-time":"2023-05-01T00:00:00Z","timestamp":1682899200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-001"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2023,5]]},"DOI":"10.1109\/sp46215.2023.10179303","type":"proceedings-article","created":{"date-parts":[[2023,7,21]],"date-time":"2023-07-21T17:18:15Z","timestamp":1689959895000},"page":"1289-1310","source":"Crossref","is-referenced-by-count":96,"title":["SoK: Certified Robustness for Deep Neural Networks"],"prefix":"10.1109","author":[{"given":"Linyi","family":"Li","sequence":"first","affiliation":[{"name":"University of Illinois Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tao","family":"Xie","sequence":"additional","affiliation":[{"name":"MoE (Peking University),Key Laboratory of High Confidence Software Technologies"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bo","family":"Li","sequence":"additional","affiliation":[{"name":"University of Illinois Urbana-Champaign"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref2","article-title":"Learning multiple layers of features from tiny images","volume-title":"Master\u2019s thesis","author":"Krizhevsky","year":"2009"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.308"},{"key":"ref4","article-title":"Language models are few-shot learners","author":"Brown","year":"2020"},{"key":"ref5","article-title":"Bert: Pre-training of deep bidirectional transformers for language understanding","author":"Devlin","year":"2018"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-40994-3_25"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/1014052.1014066"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1145\/1081870.1081950"},{"key":"ref10","article-title":"Explaining and harnessing adversarial examples","volume-title":"International Conference on Learning Representations","author":"Goodfellow"},{"key":"ref11","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013"},{"key":"ref12","first-page":"274","article-title":"Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples","volume-title":"International Conference on Machine Learning","author":"Athalye"},{"key":"ref13","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","volume-title":"International Conference on Learning Representations","author":"Brendel"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00076"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00175"},{"key":"ref16","article-title":"Thermometer encoding: One hot way to resist adversarial examples","volume-title":"International Conference on Learning Representations","author":"Buckman"},{"key":"ref17","article-title":"Countering adversarial images using input transformations","volume-title":"International Conference on Learning Representations","author":"Guo"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.06083"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2016.41"},{"key":"ref20","article-title":"Defense-GAN: Protecting classifiers against adversarial attacks using generative models","volume-title":"International Conference on Learning Representations","author":"Samangouei"},{"key":"ref21","article-title":"On adaptive attacks to adversarial example defenses","author":"Tramer","year":"2020"},{"key":"ref22","article-title":"Certified adversarial robustness via randomized smoothing","volume-title":"International Conference on Machine Learning","author":"Cohen"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-63387-9_5"},{"key":"ref24","first-page":"15 072","article-title":"Beyond the single neuron convex barrier for neural network certification","author":"Singh","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref25","article-title":"Boosting robustness certification of neural networks","volume-title":"International Conference on Learning Representations","author":"Singh"},{"key":"ref26","first-page":"6367","article-title":"Efficient formal safety analysis of neural networks","author":"Wang","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref27","first-page":"5286","article-title":"Provable defenses against adversarial examples via the convex outer adversarial polytope","volume-title":"International Conference on Machine Learning","author":"Wong"},{"key":"ref28","article-title":"Randomized smoothing of all shapes and sizes","volume-title":"International Conference on Machine Learning","author":"Yang"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"ref30","article-title":"Adversarial attacks and defences: A survey","author":"Chakraborty","year":"2018"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/2046684.2046692"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2018.00035"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1561\/9781680839111"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1016\/j.cosrev.2020.100270"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1561\/2400000035"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2020.2970615"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2018.00058"},{"key":"ref38","first-page":"4939","article-title":"Efficient neural network robustness certification with general activation functions","author":"Zhang","year":"2018","journal-title":"Advances in neural information processing systems"},{"key":"ref39","first-page":"5276","article-title":"Towards fast computation of certified robustness for relu networks","volume-title":"International Conference on Machine Learning","author":"Weng"},{"key":"ref40","first-page":"9832","article-title":"A convex relaxation barrier to tight robustness verification of neural networks","author":"Salman","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-14295-6_24"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.3233\/aic-2012-0525"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-68167-2_18"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-77935-5_9"},{"key":"ref45","article-title":"An approach to reachability analysis for feed-forward relu neural networks","author":"Lomuscio","year":"2017"},{"key":"ref46","article-title":"Evaluating robustness of neural networks with mixed integer programming","volume-title":"International Conference on Learning Representations","author":"Tjeng"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-25540-4_26"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-53288-8_4"},{"issue":"2020","key":"ref49","article-title":"Branch and bound for piecewise linear neural network verification","volume":"21","author":"Bunel","year":"2020","journal-title":"Journal of Machine Learning Research"},{"key":"ref50","first-page":"4790","article-title":"A unified view of piecewise linear neural network verification","author":"Bunel","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref51","article-title":"Improved branch and bound for neural network verification via lagrangian decomposition","author":"De Palma","year":"2021"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-68167-2_19"},{"key":"ref53","article-title":"Complete verification via multi-neuron relaxation guided branch-and-bound","volume-title":"International Conference on Learning Representations","author":"Ferrari"},{"key":"ref54","article-title":"Fast geometric projections for local robustness certification","volume-title":"International Conference on Learning Representations","author":"Fromherz"},{"key":"ref55","first-page":"14 059","article-title":"Provable certificates for adversarial examples: Fitting a ball in the union of polytopes","author":"Jordan","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref56","article-title":"Neural network branching for neural network verification","volume-title":"International Conference on Learning Representations","author":"Lu"},{"key":"ref57","first-page":"1599","article-title":"Formal security analysis of neural networks using symbolic intervals","volume-title":"27th USENIX Security Symposium (USENIX) Security 18)","author":"Wang"},{"key":"ref58","article-title":"Beta-crown: Efficient bound propagation with per-neuron split constraints for neural network robustness verification","volume":"34","author":"Wang","year":"2021","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref59","article-title":"Fast and complete: Enabling complete neural network verification with rapid and massively parallel incomplete verifiers","volume-title":"International Conference on Learning Representations","author":"Xu"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.21655\/ijsi.1673-7288.00281"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00494"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5944"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00429"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1145\/3290354"},{"key":"ref65","article-title":"Automatic perturbation analysis for scalable certified robustness and beyond","volume":"33","author":"Xu","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1145\/3314221.3314614"},{"key":"ref67","first-page":"3575","article-title":"Differentiable abstract interpretation for provably robust neural networks","volume-title":"International Conference on Machine Learning","author":"Mirman"},{"key":"ref68","first-page":"10 802","article-title":"Fast and effective robustness certification","author":"Singh","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref69","article-title":"Training verified learners with learned verifiers","author":"Dvijotham","year":"2018"},{"key":"ref70","first-page":"550","article-title":"A dual approach to scalable verification of deep networks","volume-title":"Proceedings of the Thirty-Fourth Conference on Uncertainty in Artificial Intelligence","volume":"1","author":"Dvijotham"},{"key":"ref71","first-page":"8400","article-title":"Scaling provable adversarial defenses","author":"Wong","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref72","first-page":"1","article-title":"PRIMA: Precise and general neural network certification via multi-neuron convex relaxations","volume-title":"Proceedings of the ACM on Programming Languages","volume":"6","author":"M\u00fcller"},{"key":"ref73","article-title":"Scaling the convex barrier with active sets","volume-title":"International Conference on Learning Representations","author":"Palma"},{"key":"ref74","first-page":"21 675","article-title":"The convex relaxation barrier, revisited: Tightened single-neuron relaxations for neural network verification","volume":"33","author":"Tjandraatmadja","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref75","first-page":"5318","article-title":"Enabling certification of verification-agnostic networks via memory-efficient semidefinite programming","volume":"33","author":"Dathathri","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref76","first-page":"164","article-title":"Efficient neural network verification with exactness characterization","volume-title":"Proc. Uncertainty in Artificial Intelligence","author":"Dvijotham"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1109\/TAC.2020.3046193"},{"key":"ref78","article-title":"Certified defenses against adversarial examples","volume-title":"International Conference on Learning Representations","author":"Raghunathan"},{"key":"ref79","first-page":"10 877","article-title":"Semidefinite relaxations for certifying robustness to adversarial examples","author":"Raghunathan","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref80","article-title":"Lipschitz-certifiable training with a tight outer bound","volume":"33","author":"Lee","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref81","first-page":"6212","article-title":"Globally-robust neural networks","volume-title":"Proceedings of the 38th International Conference on Machine Learning","volume":"139","author":"Leino"},{"key":"ref82","article-title":"Fantastic four: Differentiable and efficient bounds on singular values of convolution layers","volume-title":"International Conference on Learning Representations","author":"Singla"},{"key":"ref83","article-title":"Lipschitz-margin training: scalable certification of perturbation invariance for deep neural networks","author":"Tsuzuku","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33015757"},{"key":"ref85","first-page":"2266","article-title":"Formal guarantees on the robustness of a classifier against adversarial manipulation","author":"Hein","year":"2017","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref86","first-page":"15 390","article-title":"Preventing gradient attenuation in lipschitz constrained convolutional networks","volume":"32","author":"Li","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref87","article-title":"Improved deterministic l2 robustness on CIFAR-10 and CIFAR-100","volume-title":"International Conference on Learning Representations","author":"Singla"},{"key":"ref88","article-title":"Orthogonalizing convolutional layers with the cayley transform","volume-title":"International Conference on Learning Representations","author":"Trockman"},{"key":"ref89","first-page":"12 368","article-title":"Towards certifying l-infinity robustness using neural networks with l-inf-dist neurons","volume-title":"International Conference on Machine Learning","volume":"139","author":"Zhang"},{"key":"ref90","article-title":"Second-order provable defenses against adversarial attacks","volume-title":"International Conference on Machine Learning","author":"Singla"},{"key":"ref91","first-page":"6254","article-title":"Improved, deterministic smoothing for l1 certified robustness","volume-title":"Proceedings of the 38th International Conference on Machine Learning","volume":"139","author":"Levine"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2019.00044"},{"key":"ref93","first-page":"9459","article-title":"Certified adversarial robustness with additive noise","author":"Li","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref94","article-title":"A framework for robustness certification of smoothed classifiers using f-divergences","volume-title":"International Conference on Learning Representations","author":"Dvijotham"},{"key":"ref95","article-title":"\u21131 adversarial robustness certificates: a randomized smoothing approach","author":"Teng","year":"2020"},{"key":"ref96","first-page":"2316","article-title":"Black-box certification with randomized smoothing: A functional optimization based framework","volume-title":"Advances in Neural Information Processing Systems","volume":"33","author":"Zhang","year":"2020"},{"key":"ref97","first-page":"11 391","article-title":"Adversarial robustness via robust low rank representations","volume":"33","author":"Awasthi","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref98","first-page":"11 289","article-title":"Provably robust deep learning via adversarially trained smoothed classifiers","author":"Salman","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref99","article-title":"Tight second-order certificates for randomized smoothing","author":"Levine","year":"2020"},{"key":"ref100","article-title":"Higher-order certification for randomized smoothing","volume":"33","author":"Mohapatra","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v33i01.33013240"},{"key":"ref102","article-title":"Robustness verification for transformers","volume-title":"International Conference on Learning Representations","author":"Shi"},{"key":"ref103","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref104","first-page":"2206","article-title":"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks","volume-title":"International conference on machine learning","author":"Croce"},{"key":"ref105","article-title":"Trs: Transferability reduced ensemble via promoting gradient diversity and model smoothness","volume-title":"Advances in Neural Information Processing Systems 34 (NeurIPS 2021)","author":"Yang"},{"key":"ref106","first-page":"7472","article-title":"Theoretically principled trade-off between robustness and accuracy","volume-title":"International conference on machine learning","author":"Zhang"},{"key":"ref107","article-title":"Improving robustness using generated data","volume":"34","author":"Gowal","year":"2021","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref108","article-title":"Bag of tricks for adversarial training","volume-title":"International Conference on Learning Representations","author":"Pang"},{"key":"ref109","article-title":"Fast is better than free: Revisiting adversarial training","volume-title":"International Conference on Learning Representations","author":"Wong"},{"key":"ref110","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-78800-3_24"},{"key":"ref111","article-title":"Gurobi - the fastest solver - gurobi","year":"2020"},{"key":"ref112","article-title":"Towards stable and efficient training of verifiably robust neural networks","volume-title":"International Conference on Learning Representations","author":"Zhang"},{"key":"ref113","article-title":"Speeding up neural network verification via automated algorithm configuration","volume-title":"ICLR 2021 Workshop on Security and Safety in Machine Learning Systems","author":"K\u00f6nig"},{"key":"ref114","volume-title":"Linear programming","author":"Ignizio","year":"1994"},{"key":"ref115","article-title":"The second international verification of neural networks competition (vnn-comp 2021): Summary and results","author":"Bak","year":"2021"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/DASC.2016.7778091"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-81685-8_6"},{"key":"ref118","article-title":"Fooling a complete neural network verifier","volume-title":"International Conference on Learning Representations","author":"Zombori"},{"key":"ref119","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-88806-0_9"},{"key":"ref120","article-title":"Certified defenses: Why tighter relaxations may hurt training?","author":"Jovanovi\u0107","year":"2021"},{"key":"ref121","article-title":"Fast certified robust training with short warmup","volume-title":"Thirty-Fifth Conference on Neural Information Processing Systems","author":"Shi"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-99524-9_19"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2021\/301"},{"key":"ref124","doi-asserted-by":"publisher","DOI":"10.1002\/zamm.19290090105"},{"key":"ref125","first-page":"11 423","article-title":"Efficient and accurate estimation of lipschitz constants for deep neural networks","author":"Fazlyab","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref126","article-title":"Boosting the certified robustness of l-infinity distance nets","volume-title":"International Conference on Learning Representations","author":"Zhang"},{"key":"ref127","article-title":"Can we gain more from orthogonality regularizations in training deep networks?","volume":"31","author":"Bansal","year":"2018","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref128","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.00646"},{"key":"ref129","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01152"},{"key":"ref130","doi-asserted-by":"publisher","DOI":"10.1214\/17-AOS1634"},{"key":"ref131","first-page":"4911","article-title":"Tight certificates of adversarial robustness for randomly smoothed classifiers","author":"Lee","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref132","doi-asserted-by":"publisher","DOI":"10.1098\/rsta.1933.0009"},{"key":"ref133","first-page":"211","article-title":"Random smoothing might be unable to certify \u2113\u221e robustness for high-dimensional images","volume":"21","author":"Blum","year":"2020","journal-title":"J. Mach. Learn. Res."},{"key":"ref134","first-page":"5458","article-title":"Curse of dimensionality on randomized smoothing for certifiable robustness","volume-title":"International Conference on Machine Learning","author":"Kumar"},{"key":"ref135","first-page":"4033","article-title":"Hidden cost of randomized smoothing","volume-title":"International Conference on Artificial Intelligence and Statistics","author":"Mohapatra"},{"key":"ref136","doi-asserted-by":"publisher","DOI":"10.1109\/CVPRW50498.2020.00401"},{"key":"ref137","article-title":"Double sampling randomized smoothing","volume-title":"International Conference on Machine Learning","author":"Li"},{"key":"ref138","article-title":"Smoothmix: Training confidence-calibrated smoothed classifiers for certified robustness","volume-title":"Thirty-Fifth Conference on Neural Information Processing Systems","author":"Jeong"},{"key":"ref139","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/654"},{"key":"ref140","article-title":"Consistency regularization for certified robustness of smoothed classifiers","volume":"33","author":"Jeong","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref141","first-page":"11 190","article-title":"Unlabeled data improves adversarial robustness","author":"Carmon","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref142","article-title":"Adversarial training and provable defenses: Bridging the gap","volume-title":"International Conference on Learning Representations","author":"Balunovic"},{"key":"ref143","article-title":"Macer: Attack-free and scalable robust training via maximizing certified radius","volume-title":"International Conference on Learning Representations","author":"Zhai"},{"key":"ref144","article-title":"On the certified robustness for ensemble models and beyond","volume-title":"International Conference on Learning Representations","author":"Yang"},{"key":"ref145","article-title":"RobustBench: a standardized adversarial robustness benchmark","volume-title":"Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks 1","author":"Croce"},{"key":"ref146","article-title":"CROP: Certifying robust policies for reinforcement learning through functional smoothing","volume-title":"International Conference on Learning Representations","author":"Wu"},{"issue":"2","key":"ref147","first-page":"3","article-title":"A rotation and a translation suffice: Fooling cnns with simple transformations","volume":"1","author":"Engstrom","year":"2017"},{"key":"ref148","doi-asserted-by":"publisher","DOI":"10.1145\/3132747.3132785"},{"key":"ref149","article-title":"Spatially transformed adversarial examples","volume-title":"International Conference on Learning Representations","author":"Xiao"},{"key":"ref150","first-page":"8404","article-title":"Certified defense to image transformations via randomized smoothing","volume":"33","author":"Fischer","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref151","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485258"},{"key":"ref152","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v36i7.20768"},{"key":"ref153","first-page":"8465","article-title":"GSmooth: Certified robustness against semantic transformations via generalized randomized smoothing","volume-title":"Proceedings of the 39th International Conference on Machine Learning","volume":"162","author":"Hao"},{"key":"ref154","article-title":"Generative adversarial nets","volume":"27","author":"Goodfellow","year":"2014","journal-title":"Advances in neural information processing systems"},{"key":"ref155","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454100"},{"key":"ref156","article-title":"Learning perturbation sets for robust machine learning","volume-title":"International Conference on Learning Representations","author":"Wong"},{"key":"ref157","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5888"},{"key":"ref158","article-title":"Almost tight l0-norm certified robustness of top-k predictions against adversarial perturbations","volume-title":"International Conference on Learning Representations","author":"Jia"},{"key":"ref159","article-title":"Scalecert: Scalable certified defense against adversarial patches with sparse superficial layers","volume":"34","author":"Han","year":"2021","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref160","first-page":"6465","article-title":"(de) randomized smoothing for certifiable defense against patch attacks","volume":"33","author":"Levine","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref161","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01471"},{"key":"ref162","first-page":"2237","article-title":"PatchGuard: A provably robust defense against adversarial patches via small receptive fields and masking","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Xiang"},{"key":"ref163","article-title":"PatchCleanser: Certifiably robust defense against adversarial patches for any image classifier","volume-title":"31st USENIX Security Symposium (USENIX Security)","author":"Xiang"},{"key":"ref164","article-title":"Towards out-of-distribution generalization: A survey","author":"Shen","year":"2021"},{"key":"ref165","article-title":"Certifying some distributional robustness with principled adversarial training","volume-title":"International Conference on Learning Representations","author":"Sinha"},{"key":"ref166","article-title":"Certifying model accuracy under distribution shifts","author":"Kumar","year":"2022"},{"key":"ref167","first-page":"23 527","article-title":"Certifying out-of-domain generalization for blackbox functions","volume-title":"International Conference on Machine Learning","author":"Weber"},{"key":"ref168","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484776"},{"key":"ref169","article-title":"Deep partition aggregation: Provable defenses against general poisoning attacks","volume-title":"International Conference on Learning Representations","author":"Levine"},{"key":"ref170","article-title":"Certified robustness to label-flipping attacks via randomized smoothing","volume-title":"International Conference on Machine Learning","author":"Rosenfeld"},{"key":"ref171","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179451"},{"key":"ref172","article-title":"COPA: Certifying robust policies for offline reinforcement learning against poisoning attacks","volume-title":"International Conference on Learning Representations","author":"Wu"},{"key":"ref173","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484538"},{"key":"ref174","first-page":"3468","article-title":"Popqorn: Quantifying robustness of recurrent neural networks","volume-title":"International Conference on Machine Learning","author":"Ko"},{"key":"ref175","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-81685-8_10"},{"key":"ref176","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454056"},{"key":"ref177","doi-asserted-by":"publisher","DOI":"10.1145\/3453483.3454100"},{"key":"ref178","article-title":"Enhancing certifiable robustness via a deep model ensemble","author":"Zhang","year":"2019"},{"key":"ref179","first-page":"12 997","article-title":"Provably robust boosted decision stumps and trees against adversarial attacks","author":"Andriushchenko","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref180","first-page":"12 317","article-title":"Robustness verification of tree-based models","author":"Chen","year":"2019","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref181","first-page":"10 104","article-title":"On lp-norm robustness of ensemble decision stumps and trees","volume-title":"International Conference on Machine Learning","author":"Wang"},{"key":"ref182","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D19-1423"},{"key":"ref183","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.317"},{"key":"ref184","article-title":"Robustness to programmable string transformations via augmented abstract training","volume-title":"International Conference on Machine Learning","author":"Zhang"},{"key":"ref185","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.82"},{"key":"ref186","first-page":"1275","article-title":"Detection as regression: Certified object detection with median smoothing","volume":"33","author":"Chiang","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref187","first-page":"3340","article-title":"Scalable certified segmentation via randomized smoothing","volume-title":"International Conference on Machine Learning","author":"Fischer"},{"key":"ref188","first-page":"4035","article-title":"TPC: Transformation-specific smoothing for point cloud models","volume-title":"Proceedings of the 39th International Conference on Machine Learning","author":"Chu"},{"key":"ref189","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.00612"},{"key":"ref190","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.514"},{"key":"ref191","article-title":"Policy smoothing for provably robust reinforcement learning","volume-title":"International Conference on Learning Representations","author":"Kumar"},{"key":"ref192","article-title":"Certified adversarial robustness for deep reinforcement learning","volume-title":"Conference on Robot Learning 2019","volume":"100","author":"L\u00fctjens"},{"key":"ref193","article-title":"Verification of neural network control policy under persistent adversarial perturbation","author":"Wang","year":"2019"},{"key":"ref194","doi-asserted-by":"publisher","DOI":"10.1145\/512950.512973"},{"key":"ref195","article-title":"Sound randomized smoothing in floating-point arithmetics","author":"Vor\u00e1\u010dek","year":"2022"},{"key":"ref196","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01304"},{"key":"ref197","article-title":"Universal approximation with certified networks","volume-title":"International Conference on Learning Representations","author":"Baader"},{"key":"ref198","doi-asserted-by":"publisher","DOI":"10.1145\/3498675"},{"key":"ref199","article-title":"On the convergence of certified robust training with interval bound propagation","volume-title":"International Conference on Learning Representations","author":"Wang"},{"key":"ref200","first-page":"388","article-title":"Black-box certification and learning under adversarial perturbations","volume-title":"International Conference on Machine Learning","author":"Ashtiani"},{"key":"ref201","first-page":"19 655","article-title":"Hydra: Pruning adversarially robust neural networks","volume":"33","author":"Sehwag","year":"2020","journal-title":"Advances in Neural Information Processing Systems"},{"key":"ref202","article-title":"Learning certified individually fair representations","author":"Ruoss","year":"2020","journal-title":"Advances in Neural Information Processing Systems 33 pre-proceedings"},{"key":"ref203","doi-asserted-by":"publisher","DOI":"10.1145\/3428253"},{"key":"ref204","article-title":"Certifying some distributional fairness with subpopulation decomposition","author":"Kang","year":"2022"},{"key":"ref205","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00019"},{"key":"ref206","article-title":"Probabilistic logic neural networks for reasoning","volume":"32","author":"Qu","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref207","article-title":"Embedding symbolic knowledge into deep networks","volume":"32","author":"Xie","year":"2019","journal-title":"Advances in neural information processing systems"},{"key":"ref208","article-title":"Efficient probabilistic logic reasoning with graph neural networks","volume-title":"International Conference on Learning Representations","author":"Zhang"},{"key":"ref209","article-title":"Security analysis of camera-lidar fusion against black-box attacks on autonomous vehicles","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Hallyburton"},{"key":"ref210","article-title":"Self-driving uber car kills pedestrian in arizona, where robots roam","author":"Wakabayashi"},{"key":"ref211","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511804441"},{"key":"ref212","first-page":"370","article-title":"Lagrangian decomposition for neural network verification","volume-title":"Conference on Uncertainty in Artificial Intelligence","author":"Bunel"},{"key":"ref213","article-title":"Training for faster adversarial robustness verification via inducing reLU stability","volume-title":"International Conference on Learning Representations","author":"Xiao"},{"key":"ref214","first-page":"2057","article-title":"Provable robustness of relu networks via maximization of linear regions","volume-title":"the 22nd International Conference on Artificial Intelligence and Statistics","author":"Croce"},{"key":"ref215","article-title":"Provable robustness against all adversarial lp-perturbations for p \u2265 1","volume-title":"International Conference on Learning Representations","author":"Croce"},{"key":"ref216","article-title":"Mixtrain: Scalable training of verifiably robust neural networks","author":"Wang","year":"2018"},{"key":"ref217","article-title":"Towards better understanding of training certifiably robust models against adversarial examples","volume-title":"Thirty-Fifth Conference on Neural Information Processing Systems","author":"Lee"},{"key":"ref218","article-title":"Boosting randomized smoothing with variance reduced classifiers","volume-title":"International Conference on Learning Representations","author":"Horv\u00e1th"},{"key":"ref219","article-title":"Score-based generative modeling through stochastic differential equations","volume-title":"International Conference on Learning Representations","author":"Song"},{"key":"ref220","article-title":"(certified!!) adversarial robustness for free!","author":"Carlini","year":"2022"},{"key":"ref221","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i04.5798"},{"key":"ref222","first-page":"8026","article-title":"Pytorch: An imperative style, high-performance deep learning library","author":"Paszke","year":"2019","journal-title":"Advances in neural information processing systems"}],"event":{"name":"2023 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2023,5,21]]},"end":{"date-parts":[[2023,5,25]]}},"container-title":["2023 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/10179215\/10179280\/10179303.pdf?arnumber=10179303","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,20]],"date-time":"2024-07-20T05:12:56Z","timestamp":1721452376000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10179303\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,5]]},"references-count":222,"URL":"https:\/\/doi.org\/10.1109\/sp46215.2023.10179303","relation":{},"subject":[],"published":{"date-parts":[[2023,5]]}}}