Dual Randomized Smoothing: Beyond Global Noise Variance
Authors: Chenhao Sun
Yuhao Mao
Martin Vechev
Venue: ICLR 2026 Poster (2026)
Keywords: robustness certification
randomized smoothing
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We extend randomized smoothing with global noise variance to input-dependent locally constant noise variance.

Abstract: Randomized Smoothing (RS) is a prominent technique for certifying the robustness of neural networks against adversarial perturbations. With RS, achieving high accuracy at small radii requires a small noise variance, while achieving high accuracy at large radii requires a large noise variance. However, the global noise variance used in the standard RS formulation leads to a fundamental limitation: there exists no global noise variance that simultaneously achieves strong performance at both small and large radii. To break through the global variance limitation, we propose a dual RS framework which enables input-dependent noise variances. To achieve that, we first prove that RS remains valid with input-dependent noise variances, provided the variance is locally constant around each input. Building on this result, we introduce two components which form our dual RS framework: (i) a variance estimator first predicts an optimal noise variance for each input, (ii) this estimated variance is then used by a standard RS classifier. The variance estimator is independently smoothed via RS to ensure local constancy, enabling flexible design. We also introduce efficient training strategies to iteratively optimize the two components involved in the framework. Extensive experiments on the CIFAR-10 dataset demonstrate that our dual RS method provides strong performance for both small and large radii—unattainable with global noise variance—while incurring only a 60\% computational overhead at inference. Moreover, it consistently outperforms prior input-dependent noise approaches across most radii, with particularly large gains at radii 0.5, 0.75, and 1.0, achieving relative improvements of 15.6\%, 20.0\%, and 15.7\%, respectively. On ImageNet, dual RS remains effective across all radii, with 8.6\%, 17.1\% and 9.1\% performance advantages at radii 0.5, 1.0 and 1.5 respectively. Additionally, the proposed dual RS framework naturally provides a routing perspective for certified robustness, improving the accuracy-robustness trade-off with off-the-shelf expert RS models.  Our code is available at https://github.com/eth-sri/Dual-Randomized-Smoothing.

Published as a conference paper at ICLR 2026
DUAL RANDOMIZED SMOOTHING: BEYOND GLOBAL NOISE VARIANCE
Chenhao Sun, Yuhao Mao, Martin Vechev Department of Computer Science, ETH Zürich, Switzerland (chenhao.sun, yuhao.mao, martin.vechev) @inf.ethz.ch
ABSTRACT
Randomized Smoothing (RS) is prominent technique for certifying the robust- ness of neural networks against adversarial perturbations. With RS, achieving high accuracy at small radii requires small noise variance, while achieving high accu- racy large radii requires large noise variance. However, the global noise vari- ance used in the standard RS formulation leads to fundamental limitation: there exists no global noise variance that simultaneously achieves strong performance at both small and large radii. To break through the global variance limitation, we propose a dual RS framework which enables input-dependens noise variances. To achieve that, we first prove that RS remains valid with input- noise vari- ances, provided the variance locally constant around each input. Building on this result, we introduce a variance estimator first predicts an optimal noise variance for each input, (ii) this estimated variance then used by a standard RS classifier. The variance estimator is independently smoothed via RS to ensure local constancy, enabling flexible de- sign. We also introduce efficient training strategies iteratively optimize the two components involved in the framework. Extensive experiments on the CIFAR- 10 dataset demonstrate that our dual RS method provides strong performance for both small and large addi-unattainable with global noise variance- while incur- ring only a 60% computational overhead at inference. Morcover, consistently outperforms prior input-dependent noise approaches across most radii, with par- ticularly large gains at radii 0.5, 0.75, and 1.0, achieving relative improvements of 15.6%, 20.0%, and 15.7%, respectively. On IMAGENET, dual RS remains ef- fective across all radii, with 8.6%, 17.1% and 9.1% performance advantages at radii 0.5, 1.0 and 1.5 respectively. Additionally, the proposed dual RS framework naturally provides a routing perspective for certified robustness, improving the accuracy-robustnes. trade-off with fff-the-shelf expert RS models. Our code is available at httpps://githu/ http://ggthuu...c/eeettttt com/eth- Sithh-ssr/Duual. Randomized Stttomiiizz-mmmoiiinnngg
components which form our dual RS framework: (i)
INTRODUCTION
Deep neural networks have achieved remarkable success across diverse tasks but remain highly vuinerable to adversarial attacks; small, carefully crafted perturbations can lead to incorrect or un- expected predictions. This vulnerability has made adversarial robustness, which ensures consistent model outputs under small perturbations, critical research focus. As heuristic defenses are often unreliable (Athalye et al.] 2018 Croce& Hein 2020), methods with provable robustness guarantees have become increasingly important.
Randomized Smoothing (RS) prominent technique for certifying robustness against 4g-norm adversarial perturbations. It constructs a smoothed classifier by adding Gaussian noise to the input and taking the majority vote of predictions, thereby ensuring consistent outputs within a certified neighborhood. Prior work has primarily focused on two directions: (1) training-based RS, which improves robustness by explicitly training the base classifier on noisy inputs (Cohen et al. 2019
Salman et al.) 2019; Jeong& & Shin 2020 Zhai et al. 2020 Jeong et al., 2021 2021;202:3 2023), and (2) de- noised smoothing, where noisy inputs are first denoised before classification (Salman et al. 2020)
Carlini et al. 2023). Recent advances in deep learning, particularly diffusion models, have sig-

---

Published as a conference paper at ICLR 2026
Certifled Radius
Frqquenyy
0.3
3.0
Sample
2.5-
Sumple
Sample
0.2
2.0
Sumple
1.5
Sumple
0.1
1.0-
0.5-
0.0-
0.0
0.125
0:25
0:375
055 0.625 0.75
0.855 1.0
0.2
0.1
0.5
0.8
1.0
Optimal o
Figure 1: Left: The distribution of the optimal a on CIFAR-10 test set, where the base model is fixed to the pretrained denoised smoothing model from Carlini et al. (2023). The optimal for each input is defined as the that maximizes the certified radius under the standard RS certification. Right: The certified radii curve of five independent samples against o.
Table I: Comparison of key features of the literature and the proposed Dual RS.
Literature
Flexible
No test-time memorization
Flexible routing
Certificd Routing
Mueller
202
NA
Restricted
Alfama
2022
NA
Wang
2021
V
NA
Adaptive RS
Sükenii ot al
2022
Restricted
NA
Jeong & Simn
2124
Binsed
NA
This work
nificantly enhanced denoised smoothing approaches, enabling state-of-the-art certified accuracy at small perturbation radii (Carlini al. 2023 Xiao al. 2023 Zhang al., (023).
Despite recent advances, RS remains limited by a fundamental accuracy-robustned trade-off. Achieving larger certified radius requires increasing the noise variance, which often reduces cer- tified accuracy at smaller radii. This trade-off arises because prior methods apply global noise variance shared across all inputs (Cohen et al., (2019). As illustrated in Fig. []] the noise variance that maximizes the certified radius varies substantially across samples. Recent work has explored input- dependent RS to mitigate this issue, but existing approaches either rely on test-time memorization (Alfarra et al.) 2022 Wang et al., [021], intrinsically restrict adaptivity (Sūkeník et al. 2022), or systematically over-estimate the optimal variance (Jeong Shin 2024).
Motivated by these limitations, we propose Dual Randomized Smoothing (Dual RS), novel frame- work that enables RS certification with input-dependent noise variances. Our key insight is that RS certification remains valid, with appropriate confidence adjustments, as long as the noise variance is locally constant within the certified region rather than globally fixed across all inputs.
Main Contributions, Our key contributions are:
A generalization of RS certification to locally constant noise variances, enabling flexible models to predict an optimal variance for each input. This generalization supports more favorable accuracy-robusttess. trade-offs, removing the fundamental limitation of global noise variance.
A dual RS framework consisting of a variance estimator and a standard RS classifier. The variance estimator predicts the optimal for each input, which is then used by the classifier for RS inference. We develop an iterative training procedure that sequentially optimizes both components. An alternative routing perspective is also discussed, where the variance estimator acts as a router that selects an appropriate off-the-shelf expert RS classifier based the input. Table I compares key features of prior works with our proposed method.
An extensive experimental evaluation of Dual RS, showing that Dual RS achieves strong performance across both small and large radii, outperforming prior input-dependent noise methods at most radii while adding roughly 60% computational overhead at inference, compared to standard RS. Comparing against prior works, relative improvements of 15.6%, 20.0%, and 15.7% are achieved at radii 0.5, 0.75, and 1.0 on CIFAR-10, respectively, and 8.6%. 17.1% and 9.1 % performance gain is delivered on IMAGENET at radií 0.5, 1.0, and 1.5 respectively.
2

---

Published as a conference paper at ICLR 2026
2 RELATED WORK
Provable Adversarial Robustness Empirical defenses against adversarial attacks are often un- reliable (Athalye al. 2018: Croce Hein 2020), motivating research on provable adversarial robustness. Existing approaches fall into two categories: deterministic and probabilistic. Deter- ministic methods provide exact guarantees but scale poorly large models (Gowal et al., 2018
Mirman et al., 20118 Shi et al. 2021 Mueller et al. 2023 De Palma et al.] [024] Mao et al.
2023
2024 Baader et al., 2024; Balauca et al. 2025; Mao et al., 2025 2026). Therefore, Randomized
Smoothing (RS) (I [euuuer et al. 2019; Cohen et al. 2019) becomes the most widely used proba-
bilistic method due to its scalability. Many works have improved RS by developing better training
algorithms (Salman et al. 2019 Jeong & Shin 2020 Zhai al. [020 Jeong et al. 202T
2023
leveraging pretrained models to construct base classifiers (Salman et al. 2020 Carlini et al.
2023
extending RS to different norms and noise distributions ( (Yang al.]
2020; Kumar et al.
2020
designing alternative certification procedures (Xia et al.) [024 Cullen et al.) 2022 Li et al. 2022
proposing new evaluation metrics (Sun al., 2025). and exploring ensemble techniques (Horváth
et al. 2022, Liu et al., 2021). However, a common limitation of these works is the use of global noise variance in the smoothing distribution for all inputs, which leads an inherent accuracy- robustness trade-off.
trade-off, recent works have explored adapting the noise variance per input. However, existing methods have notable limitations. Some rely on test-time memorization and are computationally expensive (Wang et al. 2021 Alfarra et al. 2022). Sūkeník et al. (2022) provide theoretical guarantees for varying with severely limited adaptivity. Jeong & Shin (022) propose multi-scale RS framework that cascades models with fixed variances, yet it always selects the largest variance that certifies an input, which often yields suboptimal results (Fig. D. Finally, Lyu et al. (2024) introduce two-stage framework for for norm by splitting fixed noise budget, but lacks flexible per-input adaptiveness and fails to generalize to & norms.
Input-dependent Randomized Smoothing To mitigate the
BACKGROUND
This section introduces the key concepts of adversarial robustness and randomized smoothing (RS).
Adversarial Robustness. A model f is adversarially robust if it produces consistent outputs under small perturbations. Given input and label with f(x) = y. f is robust (with regard to l norm) if f(²) = f(x) for all x' in S(x) = {a') ||a' -all2 I <). where e defines the perturbation magnitude.
Randomized Smoothing. RS provides certified robustness by constructing smoothed classifier gx()) = arg max o [f + 6) = y). where f is the base classifier. The classifier 9e certifiably robust within an l2 ball if the predicted class has probability greater than 0.5 (Cohen
ct al. 2019). Improving the probability margin enhances the certified radius.
Denoised Smoothing. Denoised smoothing (Salman al. 2020) applies denoiser before classi- fication, i.c., fxx 8) = fels (denoise(( + o)). where denoise removes noise from the perturbed input and fols performs classification. This approach serves
powerful paradigm for construct- ing RS base classifiers. Diffusion models have proven to be highly effective denoisers (Carlini al. (2023), achieving state-ot of-the-art performance with off- the--shel components. Following Car- lini et al. (2033); Jeong& & Shin (2024), we adopt diffusion based denoised smoothing to build base classifiers in our framework.
4 CERTIFICATION WITH LOCALLY CONSTANT NOISE VARIANCE
In this section, we formalize the main theoretical contribution of this work: we prove that RS cer- tification remains valid when the noise variance is -eput-dep,ndent, long it is constant within the certified region. This result provides the theoretical foundation for our dual RS framework.
Let X C Rd be the input space, y the output space, and fo : X fier. The classifier smoothed with a Gaussian distribution [N00, ((0,021) I² is defined as ga σ) := arg maxyey P P 5) = y). Let Po be the probability of the most likely class, i.e.,
y the base classi-
3

---

Published as a conference paper at ICLR 2026
Po maX PaceeyPa--Aa P6- + 6) = y). Cohen et al. (2019) prove that with global con- stant in X, the smoothed classifier ge. is certifiably robust within an & ball B(x, R(x,a)) of radius R(x, 0) == o (p=)(Ps) centered at the input æ; where is the cumulative distribution function of the standard Gaussian distribution. We replace the global with an input-dependent function a: =x + L, where Σ C IR+ is the discrete set of allowed values, and denote the smoothed classifier with input-dependent noise variance 9x (z)). Building on this setup, we present a certifi- cation theorem that refines the result of Cohen et al. (2019) by relaxing the assumption on or from being globally constant locally constant.
Theorem 4.1 (Certification with Locally Constant rt. Fix 2g E and fe. Assume (xx) is constant within the & ball IB (zo, R.). Then for all æ such that || - xoll2 S min(R, R(x, o (zx))), we have (x o (a=) = (oo or (ar)).
The proof follows by carefully adapting the alternative argument of Salman et al. (019)) on the result of [Cohnn et al. (2019), which leverages Lipschitz continuity, to remove the reliance on the global constancy of o. The detailed proof is deferred to |B.1
Practically, the assumption that a constant within a neighborhood of ato can be satisfied in two ways: (1) by designing (xx) to be piecewise constant (Wang et al. [002 Alfarra et al. 2022). or (2) by certifying that o is locally constant using deterministic certification methods (Singh et al,,
2019 Wong & Kolter 2018 Müller et al., 2022; Shi al. 2024). Approaches in the former category typically rely on test-time memorization, which undesirable in practice. In contrast, approaches in the latter category, though extensively developed, are usually computationally expensive and less scalable. Therefore, in this work, we seek a certification of a (ax that both scales well and eliminates test-time memorization. To this end, we propose to use a separate RS model learn effective (xr) and certify the local constancy. To achieve this, we need to extend Theorem 4.1 to probabilistic setting, since RS in practice only provides probabilliticc guarantees.
Before presenting the theorem, we extend the notion of RS to the practical setting, where Po is lower bounded with uncertainty a. Given N trials of the event [(f(x +ō) = y) and a predefined threshold a, we can derive lower bound Pa such that P(p- 2 pb) 2 1 a (Cohen et al. 2019). Conse- quently, the smoothed classifier ge (x or) is certifiably robust within the & ball (xx op ((p with probability at least 1 a. Now we are ready to present the probabilistic version of Theorem 4.1
Theorem 4.2 (Probabilistic Guarantee with Confidence Adjustment). Fix Zu E X and fc. Assume ga (xx))) is certifiably robust within (z R,) with probability at least 1 - a, and o(x) is constant within [B(r, R,,) with probability at least 1 3. Then for all such that || mol12 S min(R, Rg R.), we have (2, (x)) = (0 a (x:)) with probability at least - a - -8.
The proof follows by applying union bound to upper bound the failure probability. The detailed proof is deferred to $B.2 Note that Theorem failure events, and therefore remains valid even when the two failure events are correlated, e.g., correlated noise samples may be used in two certifications.
does not assume independence between the two
Comparison with Prior Works. Although not explicitly formalized, the idea of using a locally constant a has been explored in prior work (Wang et al.) 2021 Alfarra et al.] 2022). Wang et al. (2021) partition X' into collection of &g balls, referred to as robust regions, and assign constant to each region. These regions are allocated and stored at test time, which prevents parallel inference and leads to dependence on the prior test cases. Similar strategies are adopted by Alfarra et al.) (022)). Beyond formalization and rigorous proof, Theorem 4.1 further improves by eliminating the need for test-time memorization and instead ensuring local constancy through certifying a (x), which can be any learned model or hand-crafee function.
Separately, Sūkeník et al. (2022) also study RS with input-dependent (xx) and show that proofs based on Neyman-Pearson lemma cannot allow reasonably flexible a (xx). We circumvent this limi- tation by leveraging a proof based on Lipschitz continuity, similar to Salman et al.] (2019) [Jeong & Shin 2024), which enables much greater flexibility in defining a (æ). Note that our result does not restrict the behavior of (xx) outside the certified region, which can be arbitrarily complex. Table summarizes the difference between this work and prior works.
Despite these advantanges, Theorem 4.2 introduces a confidence penalty of B to account for the probabilistic guarantee of (xx) being locally constant. This cost inevitable when using any cer- tification method that is not deterministic. However, in practice, we find that this cost is negligible
4

---

Published as a conference paper at ICLR 2026
Oc(x) Ro
ge( σe)
sc(x;oc(x=))
Re
R = min(mnn Re)
Figure 2: The dual framework. First, RS model ge smoothed with global de is deployed to estimate de(x) and return a certified radius for the estimation, Rg. Second, another RS model is smoothed with a)) and then perform a standard classification and return a certified radius for the classification, R.- The final prediction is the result of the second stage, with final certified radius Rimal min Rn, Re). The green indicate activated paths during inference.
when using RS to certify (xx). We list few numerical examples under different configurations in Table in D confirming that 3 has minimal impact on the certified radius.
THE DUAL RANDOMIZED SMOOTHING FRAMEWORK
In this section, we present the dual RS framework implementing RS with input-dependent noise variances. We first give overview of the framework, followed by details of the inference and certification process. Then, we describe the training methods to optimize the performance. Finally, diseuss alternative routing perspective of the dual RS framework.
5.1 INFERENCE & CERTIFICATION
Fig. illustrates the dual RS framework. Given an input æ, a variance estimator predicts an ap- propriate variance, de. followed by a classifier smoothed with ae to perform the final classification. Intuitively, the variance estimator partitions the input space into disjoint subsets associated with dif- ferent values of oe, and assign the imput (ideally also its neighborhood) the corresponding subset. This formulation exactly matches the definition of robustness, in the task of predicting the optimal oe- Therefore, separate RS model is applied, which uses pre-defined global noise variance to certify the estimated Then, another base model can be smoothed via RS with to perform certified classification. The final certified radius is then guaranteed by Theorem 4.2 Note that we set 2 maX.,eE de not limit the final certified radius inherently.
Unless otherwise noted, we use diffusion denoised smoothing to build both the variance estimator and the RS classifier, for the simplicity and efficiency. Formally, we denote the two RS models as:
Ge (x, σe) == arg max Po._ (0 (he (denoise(x + + = =o))
a.E3
Ie g0 == arg max No (h. + 5.)) = ())
JEy
where denoise represents a single-step denoising using an off-the-shelf diffusion denoiser, and he and hg are base models for variance estimation and classification, respectively.
At inference time, given an input xc we sample noise samples {ōe} from (O, I) and use the PRedict function fromn al, (2119) predict the noise variance (xx)) with uncertainty a/2. Then, we sample noise samples fo from A (0, (1) and use the PREDICT function again to predict the class label ý with uncertainty a/2. The final prediction is ÿ. with a total uncertainty of o, using the union bound again on the failure events, similar to the proof of Theorem 4.2 To certify the prediction, we use the CERTIFY function from Cohen et al. (2019) to certify the local constancy of (z( with uncertainty a/2, and certify the classification with uncertainty a/2. The final certified radius is Ramal = min R. R.), where R. is the certified radius for the estimation of (x(x), and R. is the certified radius for the classification. The total uncertainty is a, guaranteed by Theorem 4.2 We note that for simplicity. we use the same uncertainty level a/2 for both certifications, but they can be adjusted fiexibly as long as the total uncertainty does not exceed
5

---

Published as a conference paper at ICLR 2026
5.2 TRAINING METHODS
5.2.1 TRAINING THE VARIANCE ESTIMATOR
Building the Training Dataset. Training he requires ground-truth labels for the optimal noise de(xz) of each input. Given a candidate set Σ and a fixed he. we evaluate for each input the certified radius under each a; E Σ. The label for the optimal noise oz(x) is then arg max; Re(æ, o.). This step is usually the most computationally expensive part of the training, as requires multiple certifications for each imput. However, it only needs to be performed once before training he, and can be parallelized across multiple devices. In practice, we use a smaller budget N than required during certification to estimate (x og). Specifically, much smaller N can be used to estimate AA, then this weaker estimation can be plugged into the radius formula to compute an approximation of the certified radius. In $E.4 we conduct detailed study the effect of using a smaller budget, showing that it can significantly reduce the training cost with minimal performance degradation. As result, we build the dataset with N 100 in the main experiments (c.f. $6), which matches the cost of performing a single RS inference. Another strategy to reduce the training cost is to train only on a subset of the train data, which we also study $E.4 Additionally, we discard inputs with zero certified radius across all og to reduce the noise during the training.
Training with Soft Labels. Estimating optimal variance formulated classification task, but it has certain special properties. Even if the estimated 0r is not optimal, a non-zero certified radius is still likely. For example, assume that given Σ 20.25, 0.5, 1.0), the certified radii of 21 are 0.0, 1.6 and 0.0, respectively, while those of 22 are 0.3, 0.4 and 0.3, respectively. Choosing the wrong a for Ti is more harmful than for 22 intuitively, as the latter still has a reasonably close certified radius. Motivated by this, we propose to use soft labels introduced below to train the variance estimator. Formally, the soft label for the variance estimation is defined as:
exp(Ro(xe,o
Vi E, Loyex exp( (R(())))))
A standard cross-entropy loss is then applied between the soft labels and the predicted class proba- bilities to evaluate the estimation performance.
Consistency Regularization. Many strategies have been proposed to increase the certified radius in the standard RS training. We choose one of them, consistency regularization (Jeong & Shin 2020 to further improve the certified radius of the estimated a. Formally,
Lcon(x)) == AEE [K(f(<)))](( + 6))] + mH(((()))
where f(x) = E(f(= + 8)). KL is the Kullback- divergence, H is the entropy, and À and y are hyperparameters controlling the trade-off between accuracy and robustness. We remark that any other RS training strategies can be alternatively applied; we choose consistency because it is the fastest while being competitive in performance (Jeong et al. (2023), Appendix E).
Overall Objective. between the soft-label cross-entropy loss and the consistency loss:
The overall loss function to train the variance estimator is weighted average
L. = Ex (x) (Csonce + w, (on
where we (x) and (x)x are two weighting functions. We introduce balancing weight we(x) be- cause the distribution of optimal de is usually skewed. Formally, assume the fraction of training samples with optimal noise 0; is qt, then (x) 1/9; if the optimal noise for is d, We ap- ply two versions of the consistency regularization weight w. (æ) in our experiments, i.e. a weaker version Wr,weak (x)) and stronger version Wt.strong(3" We set Wr.weak (x+) R2( OC and Wr,strong (x) = (x, F/xx)/C, where mmin and ōmax are the minimum and maximum variance pre- dicted by the variance estimator among all noisy samples respectively, and both of them are rescaled to [0, 1] by a constant C. The stronger version is more optimistic, as it asks for larger certified radius for the variance estimator, with the risk of over-regularizzttion the weaker version more conservative, as it only asks for necessary certified radius for the variance estimator, with the risk of underr-egullrrization We find the stronger version works slightly better for easy tasks such as CIFAR- 10, while the weaker version is slightly better for harder tasks such as IMAGENET, consis- tent to intuition. In many cases, both versions perform similarly (c.f. (.2)). We keep the choice fixed within each dataset.

---

Published as a conference paper at ICLR 2026
5.2.2 ADAPTING THE CLASSIFIER TO THE VARIANCE ESTIMATOR
Prior work (Carlini al.j 2023) have shown that finetuning the off-the-shelf classifier with regard to the RS framework can significantly improve the performance. In this section, we follow a similar approach, showing how to adapt the classifier to the dual RS framework.
Given fixed variance estimator Je. we finetune the classifier he under the estimated noise variances. Formally, given an input æ, we first query the noise variance oz((z) from ge. Then, we sample noise de (O, ()) and apply the denoising step to obtain क denoise(æ + 6c). Finally, we apply a standard cross-entropy loss between the prediction (.)( and the ground-truth label y- This procedure follows Carlini et al. (2023) with only one difference: the noise variance is input- dependent, estimated by ge, instead of being a global constant.
The described training process naturally leads tively train the variance estimator and finetune the classifier. In practice, we find that one round of classifier finetuning is usually sufficient to achieve good performance, ie., training the variance estimator from scratch based on the off-the-shelf classifier, followed by one round of classifier fine- tuning. More rounds of alternating training may lead marginal improvements, but at much higher computational cost (c.f.
alternating training scheme, where we itera-
5.3 ROUTING WITH EXPERT RS MODELS
Routing is to select the best model from a pool of expert models for each input. It has been widely studied in the context of mixture-of-experts, especially for large language models (Varangot-Reill et al. 2025). In this section, we present a novel perspective of the proposed dual RS framework as a router among pool of pretrained expert RS models.
$5.2.1 proposes strategies to train the variance estimator to predict the best de for a fixed base classifier he. This naturally requires he to perform well under all o, E E, each for subset of inputs. However, as well-known the RS literature (e.g.. Sun et al. (0255), no single model wins uniformly across all noise levels. Luckily, Theorem 4.2 does not restrict he be the same model under different og. Therefore, we can define ge (a)) to be the best expert among a pool of models. Formally, let H == {Ho:} } be the pool of the pretrained expert models where Ho; are expert models performing well under os. Define Ns. == {x 9e (e (z) = = to be the subset of inputs assigned o, by the variance estimator. Then we define (e (z)) := Ha, (x. o²)) for all E Ka. In other words, the variance estimator Je serves not only as predictor for the optimal noise variance, but also as a router to select the best expert RS model for each input. The training process of Ie remains unchanged, except that the certified radius (a o.) is now evaluated using the corresponding expert model Ho,, Note that we do not evaluate the performance of the expert models except with the corresponding variance, i.e., Ho, is not evaluated with σ, for j A i.
The proposed routing perspective of dual RS has several advantages. First, allows leveraging existing expert models without the need for training new base classifier that performs well under all noise levels. This is particularly useful when the training cost is prohibitively high. Second, it enables the use of specialized models that excel in specifie noise regimes, potentially improving overall performance. Third, it provides a flexible framework that can easily incorporate new expert models, with the minimal effort of re-training the variance estimator. This is because certification under dual RS has much smaller overhead given the certified radii of the expert models since the variance estimator is usually lightweight. Fourth, assuming the expert models are trained indepen- dently. improving expert models usually leads to a strict improvement in the overall performance, as we will demonstrate in (6 However, due to the routing nature, the performance of dual RS is upper bounded by the performance of the expert model Ho, within each Xz.-
As final remark, the routing perspective of RS not limited to the dual RS framework, and can be extended to deterministic certification methods as well. Given pool of expert models (potentially trained with different algorithms and hyperparameters), offering different trade-off's between accu- racy and robustness, one can train standard RS model to route each input to the best expert model, then certify the routing choice by RS. The final certified radius is the minimum between the certified radius of the routing RS model and that of the selected expert model. This generalization opens up new possibilities for combining the strengths of various certification methods within a unified framework. We leave the exploration of this direction future work.
7

---

Published as a conference paper at ICLR 2026
Accuracy
Accuaccy
1.0-
1.0-
Carlini et a 0.26
Malticoll- Encturing
0.8
Carlini
0.8
finctuning
Carlini et
0.6
Dual RS
0.6-
0.4
0.4
0.2
0.2
0.0-
0.5
1.0
1.5
3.0
3.5
0.0g
0.5
1.0
1.5
2.0
2.5
3.5
Todras
Rodina
(a) Comparison with Standard RS
(b) Comparison with Input- depeedeenddnnt R$
Figure 3: Certified accuracy on CIFAR-10 across radii.
Table 2: Certified accuracy on CIFAR- 10 across different certification radii. Bold entries indicate whenever Dual RS outperforms Multiscale.
Method
0.25
0.50
0.75
1.75
2,00
2.25
2.50
0.25
86.61
73.90
57.02
35.30
0.00
0.00
0.00
0.00
0.00
0.00
0.00
Off-hhe-heii
Catini et al.
0.5
1.0
47.98
73.49
62.23
39.85
49.46
32.17
38.
25.
28.58
19.34
14:49
19.51
10.30
11.22
0.00
7.32
4.89
0.00
0.00
3.35
0.00
2.15
Ours
[0.25,0.5
68.34
55.25
41.28
29.01
19.85
4.73
3.54
Adaptive finetuning
Multiscale
Ours
[0.25, 0.5, 1.0)
00:25.0.5, 0.5. 1.D]
76.51
70.53
54.78
57.48
45.27
39.15
28.46
34.15
21.33
24.68
15.95
17.84
11.40
12,46
7.91
8.83
6.65
5.31
4.73
3.63
3.14
2.34
Comparison with Prior Works Mueller et al. (2021) presents a similar idea which routes among a standard network and robust network using deterministically certified router. We generalize their idea in the following ways: (i) they only considers routing between two models due to the design of their router, while our framework allows routing among multiple models natively; (ii) they uses deterministic certification method to certify a heuristically trained router, while our framework uses RS to train and certify the router, which is more scalable and flexible; (iii) they focus improving the accuracy-robee robustness trade-off under the given radii, while our objective is to optimize the overall performance across all radii.
6 EXPERIMENTAL EVALUATION
In this section, extensively evaluate the proposed dual RS method CIFAR-10 and IMAGENET. The results demonstrate that dual RS can achieve strong performance across different radii, which unattainable with a global noise variance. Further, it incurs only modest computational over- head compared to standard RS. We include all implementation details in $C and only highlight key experimental settings here.
Baselines. We compare our method against two baselines: (i) diffusion denoised smoothing with global noise variances (Carlini et al. (2023), which we use as the base classifiers, and (ii) the state-of- the-art input-dependen RS method (Jeong & Shin (024), denoted as Mulriscale. Unless otherwise stated, all results are reported with N 10,000 noise samples for certification with the overall uncertainty level = 0.001.
CIFAR-10 Setup. Unless otherwise stated, Σ is set to (0.25, 0.5, 1.0). Following the baselines, we
employ 50M-parameter diffusion model (Nichol & Dhariwal 2021 the denoiser, and 87M- parameter ViT model (Dosovitskiy et al. 2020) as the classifier. A ResNet-110 (He et al. 2016) is
used the base model for the variance estimator, and N 100 is used to estimate R. [x) 0 during training.
IMAGENET Setup. Unless otherwise stated, Σ is set to {0.5, 1.0]. Following Carlini et al. 2023 we utilize 552M--aareeter class- dlass-unccnditional diffusion model (Dhariwal & Nichol 2021 as the denoiser and 305 --aramemee BEIT model (Bao al. (021) the classifier. A ResNet-50 is used as the variance estimator, and N 100 is used to estimate (2; during training.
6.1 KEY RESULTS
Dual RS with Single Pretrained Classifier. We first evaluate the performance of dual RS with a pretrained global classifier, as described in $5.2.1 Fig, Ba and Table [ compare the pretrained diffusion denoised smoothing model with different global noise variances and dual RS using the
8

---

Published as a conference paper at ICLR 2026
Accuracy
1.0-
Work Expert Small
0.8
Export Large
Dasd ItS with Wiek Reperts
0.6-
Stuogg Expest Suall
Stroex Export Lupe
0.4
Dasl ItS wnth Strong Reperto
0.2-
0
0.5
1.0
1.5
2.0
3.5
Racius
Figure 4: Comparison between dual RS built on weak and strong experts, respectively, along with the experts.
Table 3: Certified accuracy on IMAGENET, structured in the same way as Table
Method
0.0
0.5
1.0
1.5
2.0
Carlini at al.
74.4
64.4
52.4
34.8
Off-the-shelf
1,0
56.0
47,8
37.4
29.4
24.0
Ours
(0.5, 1.0)
67.8
54.6
40.4
28.0
15.6
Adaptive finetuning
Multiscale
(0.5, 1.0)
75.0
55.8
41.0
30.8
25.2
Ours
74.0
60.6
48.0
33.6
17.0
same classifier on CIFAR-10. While the baseline models with small global noise variance (e.g., 0.25 or 0.5) achieve high certified accuracy at small radii, they fail to provide non-trivial guarantees at larger radii. Conversely, the model with large global noise variance (a = 1.0) attains good certified accuracy at large radii but suffers from low accuracy small radii. In contrast, dual RS has strong performance across all radii, achieving superior accuracy-robustness trade-off. This demonstrates that dual RS can effectively leverage the pretrained classifier.
Dual RS with Single Classifier Finetuning. Fig- 3b and Table 2 compare dual RS with Multi- scale (Jeong& & Shin 2024). the
input-dependen RS method. For a fair comparison, finetune the classifier in dual RS described in $52..2 while Multiscale adopts the finetuned diffusion denoiser described in Jeong & Shin (2024). The result shows that dual RS consistently outperforms Multiscale across most radii, with especially strong improvements in the small-radius region. At radii 0.5, 0.75, and 1.0, dual RS improves certified accuracy by 15.6%, 20.0%, and 15.7%, respectively. On single NVIDIA RTX 4090 GPU with batch size 1000 and N 10,000, certifying with dual RS requires 22.58 seconds per input on average, compared to 14.07 seconds for standard RS and 20.21 seconds for Multiscale. Thus, dual RS incurs only a modest computational overhead relative to standard RS, while achieving significant performance gains. We remark that Multiscale requires multiple rounds of certification for inputs with small certified radii, leading to higher worst-case certification time (14.07, 28.14, and 42.21 seconds on average for 1, 2, and rounds, respectively), while dual RS spends a fixed amount of time for all inputs.
Dual RS with Multiple Pretrained Experts (Routing). We further evaluate the efficacy of dual RS as a routing mechanism with multiple pretrained expert classifiers, as discussed in |5.3] Specifically. consider two experts: one specialized for 0.25 and another specialized for
1.0. For = 0.25, we define the Weak Experi for Small to be an off-the-shelf denoised smoothing model, and the Strong Expert for Small to be finetuned denoised smoothing model by Carlini et al. (2023) on 0.25. For o = 1.0, we define the Weak Expert for Large to be the same off-thc--heeli model, and the Strong Expert Large be another off off-the-shelf model, pretrained by SunSun al. (025). which achieves the state-of-the-arr performance for large radii. We found that incorporating the weight for all æ in this experiment.
w. (xx)) degrades performance on strong experts, so we set (x)
Fig. 4 compares these four experts and dual RS built upon weak and strong experts, respectively.
The results show that dual RS effectively leverages the improved performance of the strong experts, achieving better accuracy-robustnee trade-off than that of the weak experts. This demonstrates that dual RS can flexibly incorporate different expert models to further enhance performance.
Dual RS on Large Datasets. We further evaluate dual RS on IMAGENET. As shown in Table 3 Dual RS achieves strong certified accuracy in the medium and small radii region. Compared to Mul- tiscale, the state-of-the-a arr input-dependent R.S dual RS gets 8.6%, 17.1% 1% and 9.1% % performance advantage at radii 0.5. 1.0 and 1.5 respectively. Overall, these results show that Dual RS scales effectively to large datasets and high- -ish-iinnnsional input spaces.
We further conduct ablation studies on three aspects: strategies for constructing the train set of the variance estimator, and (3) different architectures of
(I) different choices of a candidate sets, (2)

---

Published as a conference paper at ICLR 2026
ECDF
ECDF
Artrzacs
10-
10--
0.-
9.-
05-
9.5
07-
Sut CE
0.1
0.4
06-
05-
Sun CE Crekktnn
Su1 CE Cheadeay Roak
Pwine Foteeiieo
0.2
0..
84-
00
02
c4
05 08
10
0
2
01
03
1.0
1'
2.0 Rudis
25
35
AE
A.R.
(a)
(b)
(c)
Figure 5: Comparison of dual RS models with different variance estimators.
the variance estimator, detailed in $E.3 $E.4 and $E.5 respectively. The key findings are: (1) the candidate set strongly affects the favored radii, similar to the observation in the global variance methods; (2) the variance estimator can be trained with minimal performance degradation on much smaller N than certification (up to 99% cost reduction) or a much smaller train set (up to 80% cost reduction); and (3) the performance of dual RS is robust to the architecture of the variance estimator.
6.2 DELVING INTO DUAL RS
In this section, we conduct an in in-depth study on dual RS on CIFAR-10. We use diffusion denoised smoothing as the classifier with off-the-shelf models and Σ = {0.25, 0.5, 1.0].
To evaluate the performance of the variance estimation, we define A R. == (x) Rc(x). where R is the maximum classification certified radius among all candidate noise variances for input r. This metric reflects how much Rg reduced due to the suboptimal variance estimation. Fig. 5a shows the empirical cumulative distribution function (ECDF) of this metric for variance estimators trained with different loss functions and hyperparameters on CIFAR-IO. The intercept at ARt = 0 indicates the proportion of samples for which the variance estimator predicts the optimal noise variance, and the area between the curve and the the perfect estimation (black dash line) reflects the overall loss in the certified radius due suboptimal variance estimation. We observe that using soft cross-entropy (CE) loss instead of standard CE loss reduces the variance estimation accuracy, as it encourages the model predict suboptimal noise variance that yields a similar certified radius rather than the optimal one. However, fewer inputs are constrained significantly when using soft CE loss, as the curve closer to the perfect estimation line when AR, is large. Further, adding the consistency loss reduces the variance estimation accuracy in general, since it puts additional regularization on the robustness of the variance estimator.
Since the final certified radius is the minimum between the classification certified radius and the variance certified radius, the alignment between these two radii of interest as well. We define AR, as AR, = R2 R.. A negative AR, means that the final radius is constrained by the R., while a positive A AR, means it is constrained by Rg Ideally, we want AR, to be positive for as many samples as possible, so that the final certified radius is not constrained by Rg Fig. 5b) shows the ECDF of A R.. The intercept at AR, = 0 indicates the proportion of samples constrained by Rg. We observe that using soft CE loss decreases this ratio, and adding consistency loss further decreases it significantly. Furthermore, using the stronger version the consistency weight, less samples are constrained by R2 This aligns with our intuition in the design.
As a reference, Fig. Sc/shows the accuracy-radius curves for these models. Using soft CE loss almost improves over the standard CE loss uniformly, while adding consistency loss slightly degrades the performance at small radii but improves it at large radii. Overall, the model trained with soft CE trade-off.
loss and consistency loss achieves the best
CONCLUSION
In this work, we address the fundamental trade-off between certified accuracy and certified radius in Randomized Smoothing (RS). We prove that RS remains valid under input-dependent noise vari- ances, provided the variance is locally constant within the certified region. Building on this result, we introduce dual RS framework, which achieves strong performance across both small and large radii, unattainable with fixed noise variance, while incurring modest computational overhead. Our method consistently outperforms prior input-dependent noise approaches across most radii. Further, the dual RS framework offers a novel routing perspective for certified robustness, enhancing the accuracy-robusteen trade-off using off-the-shelf expert RS models.
10

---

Published as a conference paper at ICLR 2026
8 REPRODUCIBILITY STATEMENT
We have made extensive efforts to ensure the reproducibility of our work. For theoretical results, we provide precise definitions and formal statements in $ with complete proofs given in [B] For the proposed framework, detailed descriptions of the inference, certification, and training procedures presented in $ Experimental settings, including architectures, hyperparameters, and training details, are reported in şoland $C To further support reproducibility, we include the link to our code
and data in the abstract.
REFERENCES
Motasem Alfarra, Adel Bibi, Philip HS Torr, and Bernard Ghanem. Data dependent randomized smoothing. In Uncertainty in Artificial Intelligence, pp. 64-74. PMLR, 2022.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of se- curity: Circumventing defenses adversarial examples. In International conference on machine learning, pp. 274-283. PMLR, 2018.
Maximilian Baader, Mark Niklas Mueller, Yuhao Mao, and Martin Vechev. Expressivity of reLU- networks under convex relaxations. In The Twelfth International Conference on Learning Repre- sentations, 2024.
Stefan Balauca, Mark Niklas Müller, Yuhao Mao, Maximilian Baader, Mare Fischer, and Martin Vechev. Gaussian loss smoothing enables certified training with tight convex relaxations. Trans. Mach. Learn. Res., 2025.
Hangbo Bao, Li Dong, Songhao Piao, and Furu Wei. Beit: Bert pre-training of image transformers. arXiv preprint arXiv:2106.08254 2021.
Nicholas Carlini, Florian Tramer, Krishnamurthy Dj Dvijotham, Leslie Rice, Mingjie Sun, and Zico Kolter. (certified!!) adversarial robustness for free! In The Eleventh International Confer- ence on Learning Reprexentations, 2023.
Jeremy M. Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via random- ized smoothing. In Proc. of ICML, volume 97, 2019.
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICMI., volume 119 of Proceedings of Machine Learning Research, pp. 2206-2216. PMLR, 2020.
Andrew Cullen, Paul Montague, Shijie Liu, Sarah Erfani, and Benjamin Rubinstein. Double bubble, toil and trouble: enhancing certified robustness through transitivity. Advances in Neural Informa- fion Processing Systems, 35: 15:1999--11111 2022.
Alessandro De Palma, Rudy Bunel, Krishnamurthy Dvijotham, M Pawan Kumar, Robert Stanforth, and Alessio Lomuscio. Expressive losses for verified robustness via convex combinations. In ICLR 2024-nntera Conference on Learning Representations, 2024.
Prafulla Dhariwal and Alexander Nichol. Diffusion models beat gans image synthesis. Advances in neural information processing systems, 34:8780-8794, 2021.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, G Heigold. S Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learn- ing Representations, 2020.
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Ue- sato, Relja Arandjelovic, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv: 1a0e:://00.2222 2018.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp- 770-778, 2016.
11

---

Published as a conference paper at ICLR 2026
Miklós Z Horváth, Mark Niklas Mueller, Mare Fischer, and Martin Vechev. Boosting randomized smoothing with variance reduced classifiers. International Conference on Learning Represen- tations, 2022.
Jongheon Jeong and Jinwoo Shin. Consistency regularization for certified robustness of smoothed classifiers. In NeurIPS, 2020.
Jongheon Jeong and Jinwoo Shin. Multi-scale diffusion denoised smoothing. Advances in Neural Information Processing Systems, 36, 2024.
Jongheon Jeong, Sejun Park, Minkyu Kim, Heung-Chamy Lee, Do-Guk Kim, and Jinwoo Shin. Smoothmix: Training confidence-calibratee smoothed classifiers for certified robustness. In NewrlPS, pp. 30153-30168, 2021.
Jongheon Jeong, Seojin Kim, and Jinwoo Shin. Confidence-aware training of smoothed classifiers for certified robustness. In AAAI, pp- 8005-8013. AAAI Press, 2023.
Aounon Kumar, Alexander Levine, Tom Goldstein, and Soheil Feizi. Curse of dimensionality randomized smoothing for certifiable robustness. In International Conference on Machine Learn- ing. pp. 5458-5467. PMLR, 2020.
Mathias Lécuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium Security and Privacy, SP 2019, San Francisco, CA, USA, May 19-23, 2019, 2019. doi: 10.1 109//P.99. 00044.
Linyi Li, Jiawei Zhang, Tao Xie, and Bo Li. Double sampling randomized smoothing. In Interna- tional Conference on Machine Learning, pp. 13163-13208. PMLR, 2022.
Chizhou Liu, Yunzhen Feng, Ranran Wang, and Bin Dong. Enhancing certified robustness via smoothed weighted ensembling. In ICML 2021 Workshop on Adversarial Machine Learning, 2021.
Saiyue Lyu, Shadab Shaikh, Frederick Shpilevskiy, Evan Shelhamer, and Mathias Lécuyer. Adaptive randomized smoothing: Certifying multi-step defences against adversarial examples. arXiv e- prints, pp. 2406, 2024.
Yuhao Mao, Mark Müller, Mare Fischer, and Martin Vechev. Connecting certified and adversarial training. Advances in Neural Information Processing Systems, 36.73422-73440. 2023.
Yuhao Mao, Mark Niklas Mueller, Mare Fischer, and Martin Vechev. Understanding certified train- ing with interval bound propagation. In The Twelfth International Conference on Learning Rep- resentations, 2024.
Yuhao Mao, Stefan Balauca, and Martin Vechev, Ctbench: A library and benchmark for certified training. In Ferty- International Conference Machine Learning, 2025.
Yuhao Mao, Yani Zhang, and Martin Vechev. Expressiveness multi-neuron convex relaxations in neural network certification. In The Fourleenth International Conference Learning Represen- tutions, 2026.
Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for prov- ably robust neural networks. In International Conference on Machine Learning, pp. 3578-3586. PMLR, 2018.
Mark Niklas Mueller, Mislav Balunović, and Martin Vechev. Boosting certified robustness of deep networks via compositional architecture. In International Conference Learning Representa- tions, 2021.
Mark Niklas Mueller, Franziska Eckert, Mare Fischer, and Martin Vechev. Certified training: Small boxes are all you need. The Eleventh International Conference on Learning Representations, 2023.
12

---

Published as a conference paper at ICLR 2026
Mark Niklas Müller, Gleb Makarchuk, Gagandeep Singh, Markus Püschel, and Martin T. Vechev. PRIMA: general and precise neural network certification via scalable convex hull approximations. Proc. ACM Program. Lang., 6(POPL), 2022. doi: 10. 145/3498477
Alexander Quinn Nichol and Prafulla Dhariwal. Improved denoising diffusion probabilistic models. In International conference on machine learning, pp. 8162-8171. PMLR, 2021.
Hadi Salman, Jerry Li, Ilya P. Razenshteyn, Pengchuan Zhang, Huan Zhang, Sébastien Bubeck, and Greg Yang. Provably robust deep learning via adversarially trained smoothed classifiers. In Proc. of NeurlPS, 2019.
Hadi Salman, Mingjie Sun, Greg Yang. Ashish Kapoor, and J. Zico Kolter. Denoised smoothing: A provable defense for pretrained classifiers. In NeurlPS, 2020.
Zhouxing Shi. Yihan Wang, Huan Zhang, Jinfeng Yi, and Cho-Jui Hsich. Fast certified robust training with short warmup. Advances in Neural Information Processing Systems, 34:18335- 18349, 2021.
Zhouxing Shi, Qirui Jin, Zico Kolter, Suman Jana, Cho-Jui Hsieh, and Huan Zhang. Neural network verification with branch-and-bound for general nonlinearities. CoRR, abs/2405.210633, 2024. doi: 10.48550/ARXIV.20055. 10060 URL
Gagandeep Singh, Timon Gehr, Markus Püschel, and Martin T. Vechev. An abstract domain for certifying neural networks. Proc. ACM Program. Lang., 3(POPL), 2019. doi: 10. 10.1145/329055,
Peter Súkeník, Aleksei Kuvshinov, and Stephan Günnemann. Intriguing properties of input- dependent randomized smoothing. In International Conference on Machine Learning. PMLR, 2022.
Chenhao Sun, Yuhao Mao. Mark Niklas Müller, and Martin T. Vechev. Average certified radius is a poor metric for randomized smoothing. The Forty-Second International Conference on Machine Learning. 2025.
Clovis Varangot- Christophe Bouvard, Antoine Gourru, Mathieu Ciancone, Marion Schaef- fer, and François Jacquenet. Doing more with less: A survey on routing strategies for resource optimisation in large language model-based systems. 2025.
Lei Wang, Runtian Zhai, Di He, Liwei Wang, and Li Jian. Pretrain-tofinntume adversarial training via sample-wise randomized smoothing. 2021.
Eric Wong and J. Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In Proc. of ICML, volume 80, 2018
Song Xia, Yi Yu, Xudong Jiang, and Henghui Ding. Mitigating the curse of dimensionality for certified robustness via dual randomized smoothing. In ICLR, 2024.
Chaowei Xiao, Zhongzhu Chen, Kun Jin, Jiongxiao Wang, Weili Nie, Mingyan Liu, Anima Anand- kumar, Bo Li, and Dawn Song. Densepure: Understanding diffusion models for adversarial robustness. The Eleventh International Conference on Learning Representations, 2023.
Greg Yang, Tony Duan, J Edward Hu, Hadi Salman, Ilya Razenshteyn, and Jerry Li. Randomized smoothing of all shapes and sizes. In International conference on machine learning, pp. 10693- 10705. PMLR, 2020.
Runtian Zhai, Chen Dan. Di He, Huan Zhang, Boqing Gong, Pradeep Ravikumar, Cho-Jui Hsieh, and Liwei Wang. MACER: attack-free and scalable robust training via maximizing certified radius. In ICLR. OpenReview.net, 2020.
Jiawei Zhang, Zhongzhu Chen, Huan Zhang, Chaowei Xiao, and Bo Li. mDitffmooth): Certifiably robust learning via diffuuson models and local smoothing, In 32nd USENIX Security Symposium (USENIX Security 23), pp. 4787-4804, 2023.
13

---

Published as a conference paper at ICLR 2026
GPU hours on single NVIDIA RTX 4090 for the main components of our training pipeline. The costs of building the optimal-variane dataset, training variances estimator and fine- tuning the classifier are reported as (number of parallel GPUs wall-clock time in hours).
Table 4:
Component
CIFAR-10
IMAGENET
Building optimal variances dataset
6.0
128 42.2
Training variance estimator
X 2.5
x 63
Generating estimated variances
1.5
9.9
Finetuning the classifier
x 1.0
x 0.7
A USAGE OF LARGE LANGUAGE MODELS
We used a large language model (GPT-5) solely assist with polishing and grammar correction of the paper. The LLM was not involved in other aspects of this paper.
B DEFERRED PROOFS
B. PROOF OF THEOREM
We first cite the following lemma from Salman al. (2019), using the formulation as in Lemma D.1 of Jeong & Shin (202)). Note that we adapt the notation to be consistent with our paper. We slightly abuse the notation and let pa be the probability a certain class, i.c., Po (x) := P (f 5) = v) for some y.
Lemma B.1. hy(xx) == σ o (p. (x)) is 1-Lipschitz with respect to the & norm.
Lemma B.1 can be extended to locally constant (xx) as follows.
Lemma B.2. Let X' be partitioned into non-overlapping subsets ULer Xr X, and assume (xx) is
constant within each X4 Let hx)( := <()) ((=)))(((P)))) (Po(z)(<))) (z)). Then for all i 1, Væl. 02 Nr
have (x,) hy (x2)) I ||>|
x2ll2-
Proof. For any let or be the constant value of (xx) for E N. Then for any 1 32 E X,
we have
hx1( (x22) 1, (Po, (x1)) 0, - (xx))
S |x1 x21l2,
where the last inequality follows from Lemma B.1
Now we are ready to prove Theorem restated below for convenience.
Theorem 4.1 (Certification with Locally Constant Fix mo E A' and fe. Assume (Ix) is constant within the &g ball (x R.). Then for all æ such that || - æall2 S min Ro, R(x, a (xx))) we have (xv or (x)) = (wo (xF)).
Proof. Let X, (x) o.}. where d; are distinct values taken by (x)). Then X' Uier X; is partition of X' into non-overlapping subsets. By Lemma B.2 for any i E I, Vaz, 22 E X, we have
[h,((11) - h,, [2=2] S | #2l12- Further, given æ. there exists exactly one j such that x E Xy- This implies [B (x0 Ra) C Xy. If there is adversarial perturbation 8 such that ||ō||2 < R, and ge(#0 + 8) * go (x)). then the claim holds trivially. In the following, we consider the case where such adversarial perturbation exists.
Given the smoothing distribution (0, o²I) where a = oj let A be the most likely class at æg, and B be any other class. Let (z) be the probability of class A at under the smoothing distribution, and pn (x) (z) be the probability of class at æ. Therefore, Vxp + ò E X, we have o (p (xx)) o -1 (p + +5) h (2%g) ( 5) [|0||2- Let be adversarial perturbation such that
14

---

Published as a conference paper at ICLR 2026
||0|| < Rg and let B be the most likely class zo + 6. Then, since PA + 6) S p + 6)
and Φ (t) is monotonically increasing in t, we have
oΦ (p-((()))) oΦ -p (p + 5)) I c (pA(zo)) o (PA + +))
S |
Further, applying Lemma B.2 again gives o - (pB + 8)) -0 ( = h + 5)
h (To) S || l2- Combining the two inequalities gives
oΦ (ps(xr)) - oΦ ((Da(x)) s 2|
Thus, we have
| 2 0
4 (pa
$ (p'(D
2
- (w1()0))
-- PA (2x0))
oΦ o ((x((0)))
= (2)))
This completes the proof.
B.2 PROOF OF THEOREM 4.2
We restate Theorem 4.2 below for convenience.
Theorem 4.2 (Probabilistic Guarantee with Confidence Adjustment). Fix Tu E X' and fc. Assume
ga (xx)) certifiably robust within (xx, Re) with probability at least 1 a. and (xx) is constant within [E R,) with probability at least 1 - 3. Then for all such that || - Toll2 S min( (R,, Re), we have (2( (ar) = ge( or (xr)) with probability at least - a 1--a--
Proof. Let Fi be the event that (xn + 8) * ge ge()))) for some such that |8||2 S R.. Let F2 be the event that (mp 5) * (x0)) for some d such that ||0||2 < R.. Then we have P(F)) a and
P(F2) < B by the assumption. Let F= = F1 U F2. Then we have ((F) S ((F) + (F2) < a + 3, where the first inequality follows from the union bound. Applying Theorem 4.1 the complement of F implies that ge (x = (x for all ò such that |00|2 S min( R,), The result follows. O
C EXPERIMENT DETAILS
C.1 EXPERIMENT SETUP
CIFAR-10 In the main experiments, the variance estimator model is trained from scratch for 90 epochs with a batch size of 256. We use the AdamW optimizer with an initial learning rate of 0.01 and weight decay of 0.01. The learning rate is decayed by factor of 0.5 every 30 epochs. Unless otherwise stated, we set X = 40 and rj = 0.5 for the consistency loss, and use a. 1.0 for variance estimation certification. To compute the consistency loss, we always use two noise samples (m 2) following Jeong & Shin (2020). For classifier finetuning, we apply the Cross-Entropy loss on denoised images denoise( x + δ). The classifier is finetuned for 15 epochs with batch size of 128 using Adam W with a learning rate of 2 x 10 and a weight decay of 0.01.
IMAGENET
The variance estimator model trained from scratch for 9 epochs with a batch size of 200. We use the AdamW optimizer with an initial learning rate of 0.005 and a weight decay of 0.01. The learning rate is decayed by factor of 0.5 every 3 epochs. Unless otherwise stated, we set X = 10 and 17 0.5 for the consistency loss, and use a. 1.0 for variance estimation certification. For the classifier finetuning, we randomly choose 2% of the training set to finetune the classifier for 1 epoch with batch size of 32 using AdamW with learning rate of 2 x 10-5 and weight decay of 0.01. On IMAGENET, after finetuning the classifier, we do not retrian the variance estimator due to the high computational cost.
15

---

Published as a conference paper at ICLR 2026
Table 5: Numerical examples of the confidence penalty 3 under the given uncertainty level. We assume large enough Rg. such that the final certified radius equals Rg. When 3 = 1 0, it matches the standard RS setting. The budget is fixed N 10", a fixed to 1.0 and a is fixed to 0.001, following the standard certification setting.
0:
Ps
certified radius
1: 0
0.99
2.2900
1:1
0.99
2.2877
1:4
0.99
2.2848
0.8
0.8277
1:1
0.8
0.8267
0.8
0.8256
1: 0
0.6
0,2409
1::0
0.6
0.2401
1:44
0.6
0.2391
ECOP
ECOP
Accuracy
1.0-
1.-
1.-
09-
0.5-
022-
1- 910
3- 318
0.1-
0.4
0.5
A- 911
0.-
04
0.0
02
04
96
0.8
10
12 1A
-2
-1
6
0.0
0.5
1.0
1.5
2.0 Radios
2.5
30
55
A..
(a)
(b)
(c)
Figure 6: Abaltion study on À in the consistency loss. The figures are organized in the same way as Fig.
C.2 TRAINING COST
We report the computational cost of training dual RS framework. All experiments conducted on NVIDIA RTX 4090 GPUs. Table GPUs.Table summarizes T the GPU hours required for each major compo- of the training pipeline. The highest cost arises from constructing the optimal variances dataset, which involves performing classification certification on the full dataset under all three noise vari- ances. For the CIFAR-10 10 main experiments, two variance estimators are trained and one classifier finetuning is performed, resulting in approximately 19.5 GPU hours on single RTX 4090.
In practice on IMAGENET, parallelized the dataset construction step across 128 GPUs. The overall training pipeline requires approximately 115.8 hours.
D NUMERICAL EXAMPLES FOR THE CONFIDENCE PENALTY
We list numerical examples of the confidence penalty 3 under different uncertainty levels in Table
E ADDITIONAL STUDIES
In this section, we present additional studies to further investigate different components of our dual RS framework on CIFAR-10.
E. ABLATION ON CONSISTENCY Loss HYPERPARAMETER À
We employ the off-the-shelf diffusion denoiser and classifier in this study. Fig. 6 illustrates the effect of À in the consistency loss. As À increases, the accuracy of variance estimation decreases and fewer samples
constrained by R., Beyond À 40.0, the impact of further increases becomes negligible. With a moderate value (c.g., 40.0), dual RS achieves strong performance in the medium-radius region, while incurring slight performance drop in the small-radius region.
16

---

Published as a conference paper at ICLR 2026
Accuracy
1.0
Training
0.8
Enimaato Training 1 Closdfer Fine-toning
Estimator Tonining Chosilar Finestning
0.6
0.4-
0.2-
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
Figure 7: Effect of training rounds for the variance estimator and the classifier. I Estimator Training trains the variance estimator using the off-the-shelf classifier. Estimator Training I Classifter Finetuning finetunes the classifier using the estimated variances by the trained variance estimator. Estimator Training I Classifier Finetuning further re-train variance estimator based finetuned classifier.
Accuracy
1.0-
63.0
A 50.0
0.8-
0311
3300
0.6
A 23.0
0.2
0.0:
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
Figure 8: Accuracy-Ronn Runal curves after / Estimator Training + I Classifier Finetuning with different À in the consistency loss.
Accuracy
1.0
0.250, 0.500, 1.000
0.8
0.250, 1.000
0.500, 1.000
0.250, 0.500
0.6
0.500, 0.625
0.250, 0.500,
0.4
0.2-
0.0-
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
Figure 9; Certified accuracy Raoa with different candidate sets.
17

---

Published as a conference paper at ICLR 2026
Table 6: Certified accuracy (%) different radii with different candidate sets. The denoiser and classifier are fixed (off-the-shelf), and only the variance estimator is trained. The best performance each radius is highlighted in bold, and the worst and second worst grayed.
candidates sel
0.00
0.25
0.50
0.75
1.00
1.25
1.50
1.75
2.00
2.25
2.50
(0.25, 0.5, 1.0]
69.34
55.25
41.28
29.01
19.85
12.73
7.62
4.73
3.54
2.62
1.83
(0.25, 1.0]
68.80
54.88
40.64
26.86
17.22
13.26
9.52
6.82
4.70
3.24
2.10
[0.5,
65.58
51.95
38.39
27.02
18.88
13.06
8.77
6.09
4.30
3.04
2.03
(0.25, 0.5]
78.37
63.52
48.42
35.61
25.90
18.41
11.60
0.00
0.00
0.00
0.00
(0.5, 0.625]
70.29
56.66
42.90
32.04
23.49
16.42
11.48
7.40
0.00
0.00
0.00
[0.25, 0.5, 0.75, 1.0)
66.44
50.17
35.03
23.55
15.73
10.27
6.99
4.54
3.01
2.13
1.47
Accuracy
Accuracy
1.0-
1.0-
X0% training sct
1000
0.8
training eet
N 10000
Pull trnining
0.6
0.6
0.4-
0.4-
0.2
0.2
0.0g
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
0.0-
0.0
0.3
1.0
1.5
2.0 Radius
2.5
3.0
3.5
())
(h)
Figure 10: Study on reducing training set construction cost. (a) Accuracy Ruat curves with different number of samples N when calculating the certified radius for each a candidate. (b) Accuracy Rimal curves with different portion of training data used to train the variance estimator.
Accuracy
Nome::0
0.8
resues36
resmes1 10
0.4
0.0
0.0
0.5
1.0
1.5
2.0 Radius
2.5
3.0
3.5
Figure 11: Accuracy Runi with different estimator architectures.
18

---

Published as a conference paper at ICLR 2026
E.2 ITERATIVE TRAINING
Fig. shows training the variance estimator and finetune the classifier for different number of times. Finetuning the classifier with the estimated variances significantly improves the performance of dual RS across all radii. Moreover, re- re-training the variance estimator after classifier finetuning yields additional gains, particularly in the medium-radius region. Fig reportts the Rccuracy-Raaal curves after / Estimator Training + Classifier Finetuning with different values of À in the consistency loss. Compared with Fig. [cc] which uses the off-the-shelf classifier, the influence of À becomes larger after finetuning. This occurs because larger À induces larger Rg thereby constraining fewer samples after finetuning, which amplifies the performance gap across different À values.
E.3 CHOICE OF CANDIDATES
Dual RS requires selecting a set of candidate noise variances. We conduct an ablation study to study how this choice affects certified accuracy on CIFAR-10. In this ablation study, we use the off-the-shelf denoiser and classifier, and train the variance estimator only. In addition to the original candidate set {0.25, 0.5, 1.0]. we evaluate five alternative candidate sets: {0.25, 0.5), {0.5, 0.625). (0.25, 1.0). {0.5, 1.0), and {0.25, 0.5, 0.75, 1.0]. For each set, we use the maximum of the candi- dates the estimator's global noise level, de. Fig. 9 shows the accuracy Ranal curves and Table presents the numerical results.
Compared with (0.25, 0.5, 1.0), using only two candidates (f0.25, 0.5), f0.5, 0.625), {0.25, 1.0), or (0.5, 1.0)) leads to performance degradation at radii unfavored by the candidate set, but improv- ing the performance radii favored by the candidate set. Specifically, the candidate and {0.5, 0. 3.625) cannot achieve non-trivial accuracy at radii larger than 2.0, but achieve stronger performance radii smaller than 2.0. The candidate set (0.25, 1.0] leads reduced accuracy in the medium-radi range (radii from 0.75 to 1 1.00), but improves at large radii (radii larger than 1.00).
{0.25, 0.5)
Increasing the number of candidates, e.g., using {0.25, 0.5, 0.75, 1.0), does not improve perfor- mance over {0.25, 0.5, 1.0), potentially due to the increased difficulty of accurately estimating the optimal a and obtaining a sufficiently large certified radius for the estimated a.
E.4 REDUCING TRAINING COST
To avoid the high cost of building training dataset, we adopt N 100 budget to estimate the certified radius for each candidate in the main experiments. We further explore the effect of N in this section. Moreover, we also explore the effect of using only a subset of the training data to train the variance estimator, which further reduces the training cost. All experiments here use off-the-shelf denoiser and classifier, on the CIFAR- 10 dataset.
To see if a more accurate estimation optimal certified radius brings performance gains, we addi- tionally explore N 1000 and N 10, 000. This increases the dataset construction cost by 10x and 100x, respectively. As shown in Fig. T0a decreasing N has minimal effect on performance, demonstrating that a relatively small is sufficient for training the variance estimator.
We also study whether the variance estimator can be trained only a subset of the training data. Specifically, we randomly sample (20%, 60%) of the training data and train the variance estimator solely based on the sampled training subset, thereby cutting down the training cost respectively. As shown in Fig. Tob using a significantly smaller training set for the variance estimator has minimal effect on the performance. This shows that relatively small portion of the training data is sufficient to train a high-quality variance estimator.
In summary, both strategies substantially reduce the training cost while maintaining estimator per- formance. Therefore, in practice, we suggest to start with small subset of the training data and estimate the radius based on small N, then progressively grow the size and the estimation quality until the performance gain diminishes.
E.5 ARCHITECTURE OF THE VARIANCE ESTIMATOR
In the main CIFAR-10 experiments. we used a ResNet- estimator, which is a standard choice in training-based RS. We additionally evaluate smaller architectures (ResNet-20 and ResNet-56)
19

---

Published as a conference paper at ICLR 2026
while keeping the denoiser and classifier fixed. As shown in Fig. II using smaller variance estimator has minimal effect on the accuracy Rinal curves. This indicates that even though smaller estimators have lower representational capacity, they remain sufficiently expressive to approximate locally constant variance in practice.
20


Reviews:
[{"review_id": "dCKifWuq31", "reviewer": "Reviewer_Ee6d", "summary": "This paper introduces Dual Randomized Smoothing (Dual RS), a novel framework that addresses the fundamental limitation of standard Randomized Smoothing (RS), which uses a global noise variance across all inputs. The authors prove that RS certification remains valid with input-dependent noise variances, provided the noise variances are locally constant within the certified region. Based on this theoretical foundation, they propose a two-stage framework: (1) a variance estimator that predicts optimal noise variance for each input, and (2) a classifier that uses the predicted variance for certification. The authors also introduce a new procedure for jointly training the prediction of $\\sigma$ and the base classifier. Finally, the authors also introduce a MoE setting for RS. The method is evaluated on CIFAR-10 and shows significant improvements over existing approaches.", "questions": "Please refer to the Weaknesses section above.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 4, "presentation": 4, "contribution": 4, "strengths": "The paper provides a rigorous theoretical foundation by proving that RS certification remains valid with locally constant noise variances (Theorems 4.1 and 4.2). This generalizes the original RS framework and opens new possibilities for adaptive certification methods.\n\nThe paper also provides a new training methodology using soft labels based on certified radius quality rather than hard labels for variance estimation. The proposed iterative training scheme, which alternates between learning the variance estimator given a classifier and classifier optimization given a variance estimator, is also interesting.  \n\nThe Mixture of Experts generalization of the certification procedure also provides a novel method for improving certified accuracy.\n\nThe experiments in the paper demonstrate consistent improvements over state-of-the-art methods with only 60% computational overhead compared to standard RS. The paper provides a detailed analysis of design choices, including the effects of hyperparameters for consistency loss, training iterations, and variants of the loss function.", "weaknesses": "The evaluation is restricted to CIFAR-10. The paper would benefit from experiments on larger datasets (e.g., ImageNet) and across other domains to demonstrate generalizability.\n\nThe training process requires substantial computational resources (1517 GPU hours total, with 703 hours just for building the optimal variance dataset). This high cost may limit practical adoption. As the framework relies on a discrete set of candidate variances $\\Sigma = \\{0.25, 0.5, 1.0\\}$, there should be ablation studies examining how the choice, number, and granularity of $\\Sigma$ affect performance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6G5jozllZm", "reviewer": "Reviewer_AMmt", "summary": "This paper proposes Dual Randomized Smoothing (Dual RS), a framework that generalizes randomized smoothing (RS) to input-dependent noise variances while maintaining valid robustness guarantees. The key theoretical result (Theorem 4.1–4.2) shows that RS remains certifiably correct when the variance function $\\sigma(x)$ is locally constant within the certified region. Building on this, the authors introduce a two-stage “dual” framework: a smoothed variance estimator predicts $\\sigma(x)$, and a standard RS classifier uses this estimate for certification. The resulting method achieves stronger accuracy–robustness trade-offs on CIFAR-10 compared to both standard and multiscale RS baselines.", "questions": "See weakness\n\nCan you please experiment on ImageNet? If results scale to this dataset, I will upgrade my score.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "The theoretical contribution is clear, rigorous, and well-motivated. Previous input-dependent RS methods (e.g., Súkeník et al., 2022; Alfarra et al., 2022) were conceptually appealing but failed to provide valid certification due to the dependence of $\\sigma(x)$ on the evaluation point. Here, the authors convincingly fix this flaw by proving that local constancy of $\\sigma(x)$ is sufficient for correctness. The proof is clean, self-contained, and does not rely on unreviewed external results. I found the argument based on Lipschitz continuity much more convincing than earlier Neyman–Pearson-based approaches. The routing interpretation in Section 5.3 is also insightful and connects RS to the mixture-of-experts design.", "weaknesses": "The framework introduces double certification: one for the classifier and one for the variance estimator. While theoretically sound, this adds non-trivial complexity and sampling cost. More importantly, ensuring or certifying local constancy of $\\sigma(x)$ can be difficult as the input space scales up. In high-dimensional domains such as ImageNet, verifying that $\\sigma(x)$ is approximately constant in a local neighborhood is challenging, and the accuracy of the second-stage certification will heavily depend on how stable the variance estimator itself is. I would like to see a discussion (or experiment) analyzing the behavior of the variance estimator in such large-scale settings.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "v29t3CezLv", "reviewer": "Reviewer_8RPB", "summary": "This paper extends randomized smoothing (RS) to allow input-dependent noise variances, addressing the accuracy–robustness trade-off inherent in global noise settings. The authors theoretically prove that RS remains valid under locally constant variance, and propose a “dual RS” framework with a variance estimator and a standard RS classifier, showing empirical improvements on CIFAR-10. While the idea is clearly presented and theoretically sound, the paper’s novelty and empirical depth are limited, reducing its potential impact.", "questions": "I have no further questions. Please refer to the weaknesses.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The paper identifies a well-known limitation of traditional RS and provides a theoretically justified extension to input-dependent noise while maintaining certification validity.\n\n2. The decomposition into a variance estimator and a classifier, with the option to interpret it as a routing system among expert models, is conceptually clean and practical.", "weaknesses": "1. The core idea, using input-dependent noise variance in randomized smoothing, has already been discussed in several prior works. The theoretical extension to “locally constant variance” is incremental rather than fundamentally new.\n\n2. The paper repeatedly claims distinctions from prior approaches in different sections (sections 4 and 5), but these differences are scattered and qualitative. I would like to suggest that the authors add a clear summary table comparing key assumptions, theoretical guarantees, and computational overhead across existing input-dependent RS methods (e.g., Data-Dependent RS, Multiscale RS, Adaptive RS, etc.) to make the claimed advances more transparent.\n\n3. The experiments are limited to CIFAR-10 only, without ablation on larger or diverse datasets (e.g., ImageNet, CIFAR-100). Moreover, many results are shown in curves without concrete numerical tables, making it hard to assess statistical significance.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "yLbv7ozvG4", "reviewer": "Reviewer_ERq3", "summary": "This paper introduces a novel Randomized Smoothing (RS) method called Dual Randomized Smoothing. It dynamically estimates an optimal noise variance for each input and then apply it to the RS classifier, which shows stronger performance than prior input-dependent RS.", "questions": "1. Could you show the trade-off between the amount of training data? Such as 20000, 10000 rather than 50000 in whole CIFAR-10 (Just randomly separate it from the dataset you have already processed). Thereby reducing the processing time for the training data.\n2. Could you adjust the presentation method of the results based on weakness 2?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper introduces a dynamically method to find the optimal $\\sigma(x)$ for each input $x$ to maximize the verifiable robustness radius $R$, obtaining the stronger robustness. And it is supported by theory.\n2. They show the strong performance compared with SOTA input-dependent RS method. And show the comprehensive ablations study such as alternating fine-tuning, expert classifiers, and the trade-off between accuracy and robustness.", "weaknesses": "1. For each type of data, specific processing for training data is required. Only a relatively small dataset (CIFAR-10) is shown, and there is no research on generalization (for ImageNet). And the generation of training data takes a huge amount of time, reaching an extremely long duration of 703 hours just for CIFAR-10 alone.\n2. The presentation of empirical accuracy lacks clarity. And all the results are almost presented in the form of figures. The important results are clearer in the form of tables. (Refer to the Multiscale [1] that they compared with.)\n\n[1] Multi-scale diffusion denoised smoothing, NeurIPS 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)