Venue: ICML 2021 Workshop AML

Reviews:

final_score: rating: Accept
review_content: This paper proposed an interesting idea that patch attacks can be certifiably defended by random cropping. The idea of randomized cropping comes from that randomized smoothing is an effective way for l-2 attacks. The author generalized the idea to patch attacks that only modify certain pixels. Both the theoretical and experimental results are effective.
review_title: A novel idea for improving certified robustness against patch attacks

Meta-review: A good paper for certifying robustness against patch attacks. The idea of randomized cropping is a natural extension of randomized smoothing.
Decision: Accept (Oral)