Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Authors: Yuan Xin
Dingfan Chen
Michael Backes
Xiao Zhang
Venue: ICML 2025 poster (2025)
Keywords: Certification
cost-sensitive learning
Primary area: social_aspects->robustness

Abstract: As machine learning models are deployed in critical applications, robustness against adversarial perturbations is crucial. While numerous defensive algorithms have been proposed to counter such attacks, they typically assume that all adversarial transformations are equally important, an assumption that rarely aligns with real-world applications. To address this, we study the problem of robust learning against adversarial perturbations under cost-sensitive scenarios, where the potential harm of different types of misclassifications is encoded in a cost matrix. Our solution introduces a provably robust learning algorithm to certify and optimize for cost-sensitive robustness,  building on the scalable certification framework of randomized smoothing. Specifically, we formalize the definition of cost-sensitive certified radius and propose our novel adaptation of the standard certification algorithm to generate tight robustness certificates tailored to any cost matrix.  In addition, we design a robust training method that improves certified cost-sensitive robustness without compromising model accuracy. Extensive experiments on benchmark datasets, including challenging ones unsolvable by existing methods, demonstrate the effectiveness of our certification algorithm and training method across various cost-sensitive scenarios.

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Yuan Xin Dingfan Chen
Michael Backes
Xiao Zhang'
Abstract
plications such as autonomous driving, financial systems, and healtheare diagnostics. In response, numerous defenses have been proposed to improve model robustness, which primarily fall into two categories: empirical defenses (Good- fellow et al., 2014; Gu & Rigazio, 2014; Lyu et al., 2015; Papernot et al., 2016; Kurakin et al., 2016; Madry et al., 2017: Zhang et al., 2019; Carmon et al., 2019) and certifi- able methods (Raghunathan et al., 2018; Wong & Kolter, 2018; Gowal et al., 2018; Cohen et al., 2019; Lecuyer et al., 2019; Jia al., 2019; Li et al., 2019).
As ML models are increasingly deployed in crit- ical applications, robustness against adversarial perturbations is crucial. While numerous defenses have been proposed to counter such attacks, they typically assume that all adversarial transforma- tions are equally important, an assumption that rarely aligns with real-world applications. To ad- dress this, we study the problem of robust learn- ing against adversarial perturbations under cost- sensitive scenarios, where the potential harm of different types of misclassifications is encoded in a cost matrix. Our solution introduces a prov- ably robust learning algorithm to certify and opti- mize for cost-sensitive robustness, building on the scalable certification framework of randomized smoothing. Specifically, we formalize the defini- tion of cost-sensitive certified radius and propose our novel adaptation of the standard certification algorithm to generate tight robustness certificates tailored to any cost matrix. In addition, we design a robust training method that improves certified cost-sensitive robustness without compromising model accuracy. Extensive experiments on bench- mark datasets, including challenging ones unsolv- able by existing methods, demonstrate the effec- tiveness of our certification algorithm and training method across various cost-sensitive scenarios.
Empirical defenses, such as adversarial training (Goodfel- low et al., 2014; Madry et al., 2017: Carmon et al., 2019), defensive distillation (Papernot et al., 2016), and gradient masking (Gu & Rigazio, 2014; Lyu et al., 2015), typically propose to enhance robustness by explicitly incorporating adversarial examples into the model's training process by modifying the training algorithm to make the model less sensitive to input perturbations. These methods are eval- uated based on their performance against known attacks and can be efficiently deployed in practice. However, they are engaged in an everlasting arms race, as new adaptive attacks are continually developed that can easily break these empirical defenses (Carlini & Wagner, 2017; Athalye et al., 2018; 8; Uesato et al., 2018; Croce et al., 2022). In contrast, certifiable methods provide robustness guarantees against any perturbation within the constraint set, thereby avoiding the risks of being compromised by new attacks. Specifi- cally, certifiable methods (Raghunathan et al., 2018; Wong & Kolter, 2018; Gowal al., 2018; Cohen et al., 2019; Lecuyer et al., 2019; Jia et al., 2019; Li et al., 2019) produce robustness certificate that assures the model's prediction will remain unchanged within specified norm-bounded perturbation ball around any test input. These methods then train models to be provably robust with respect to the de- rived certificate, offering a stronger and more reliable form of robustness compared empirical defenses.
1. Introduction
Recent studies have revealed that deep neural networks (DNNs) are highly vulnerable to classifying adversarial ex- amples (Biggio et al., 2013; Szegedy et al., 2013; Goodfel- low et al., 2014), highlighting a critical weakness in these models that poses significant risks for safety-critical ap-
Most existing defenses are designed to improve overall model robustness, assuming the same penalty on all kinds of adversarial misclassifications, For real-world applications, however, it is likely that certain types of misclassifications are more consequential than others (Domingos, 1999; Elkan, 2001). For instance, misclassifying a malignant tumor as benign in the application of medical diagnosis much more detrimental patient than the reverse. Therefore, instead
'CISPA Helmholtz Center for Information Security, Saarbrücken, Germany 'Max Planck Institute for Intelligent Systems, Tübingen, Germany. Correspondence to: Xiao Zhang <xiao. Zsiao.zhang&e @cispa.de>.
Proceedings of the 1nnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Provably Cost-Sensitivee Adversarial Defense via Randomized Smoothing
of solely focusing on overall robustness, the development of defenses should account for the difference in costs induced by different adversarial examples. In line with prior liter- ature on cost- sest--ensitive robust learning (Domingos, 1999;
training configurations and schemes, while largely main- taining overall standard accuracy (Section 6).
2. Related Work
Asif et al., 2015; Zhang & Evans, 2019; Chen et al., 2021), we aim to develop models that are robust to cost-sensitive adversarial misclassifications, while maintaining the stan- dard overall classification accuracy. Nevertheless, previous methods for promoting cost-sensitive robustness robusttsss (Domingos, 1999; Asif et al., 2015; Chen et al., 2021; Zhang & Evans, 2019) are either hindered by their foundational reliance on heuristics, which often fall short of providing a robustness guarantee or suffer from inherent scalability issues when certifying robustness for large models and perturbations.
Certifiable defenses aim to formally guarantee the robustness of a classifier, ensuring that its out- put remains consistent within a neighboring region around any input, usually defined by some lp norn distance metric. These methods can be divided into two main categories: complete and conservative (i.e., "sound but incomplete"), Complete methods (Pulina & Tacchella, 2010; Huang et al., 2017; Katz et al., 2017; Tjeng et al., 2019; Wong & Kolter, 2018; Wong et al., 2018; Raghunathan et al., 2018; Dvi- jotham et al., 2018) strive to exactly determine whether any norm-bounded perturbation can cause the classifier to alter its prediction for any given input. A representative conservative certification framework is Randomized smooth- ing (Cohen et al., 2019), which offers scalable alternative by transforming any classifier into a smoothed version with probabilistic robustness guarantees, ensuring stable predic- tions within an f2-norm ball around any input. This flexible approach is well-suited for deep networks and large datasets, addressing the scalability limitations of complete methods. Building on the randomized smoothing framework, sev- eral training techniques have been developed to enhance certifiable robustness, including applying adversarial train- ing (Salman et al., 2019) or denoising diffusion models to improve the base classifier (Carlini et al., 2022; Xiao et al., 2022; Zhang et al., 2023), and direct optimization of the certified radius (Zhai et al., 2020). However, none of the aforementioned works target optimization for cost-sensitive adversaris defense.
Certifiable Defenses.
To achieve the best of both worlds, we propose to learn provably cost-sensitive robust classifiers by leveraging ran- domized smoothing (Liu et al., 2018; 8; Cohen et al., 2019; Salman et al., 2019), an emerging robustness certification framework known for its broad applicability and scalability. However, adapting the standard randomized smoothing al- gorithm to certify cost-sensitive robustness presents unique challenges. In addition, optimizing smoothed classifiers for cost-sensitive robustness proves more complex than stan- dard cost-sensitive learning due to the added complexity introduced by the smoothing operator and the random Gaus- sian sampling process. The varying structures of cost matri- ces further call for a flexible, targeted optimization scheme that moves beyond optimizing solely for overall robustness.
Contributions. To the best of our knowledge, we are the first to provide a scalable, robust certification and training algorithm for cost-sensitive robustness that is applicable to challenging high-dimensional data distributions (e.g., medi- cal images) and large models (e.g., deep ResNet). Our key contributions are summarized as follows:
Cost-Sensitive Learning. Cost-sensitive learning (Domin- gos, 1999; Elkan, 2001; Liu & Zhou, 2006) addresses un- equal misclassification costs and class imbalance, which are critical in applications like medical diagnosis, where misclassifying malignant cases as benign can have severe consequences. These algorithms balance class importance by reweighting samples, adjusting decision thresholds, and modifying loss functions (Kukar et al., 1998; Zadrozny et al., 2003; Zhou & Liu, 2010; Khan et al., 2017). In the context of adversarial settings, cost-sensitive learning algorithms have been proposed to mostly empirically improve robust- ness of classification models such as naive Bayes, linear discriminant, and neural networks (Dalvi et al., 2004; Asif et al., 2015; Dreossi et al., 2018). The only existing method that addresses a cost-sensitive robustness certification prob- lem similar to ours is Zhang & Evans (2019). However, their approach suffers from inherent flexibility issues, making it inapplicable for certifying deep networks under large pertur- bations, and demonstrates empirically weaker performance compared to ours as demonstrated in Section 6.
We introduce the notion of cost-sensitive certified radius (Definition 4. and prove that our definition guarantees a larger certified radius for any cost-sensitive scenario compared to the standard certified radius (Theorem 4.2).
We develop an easy-to- mosy-tt-implement certification algorithm based on Monte Carlo sampling (Algorithm 1), ensuring a tight certificate for post-sensitig robustness (Theorem 4.4). Additionally, we propose adaptive training meth- ods for cost-sensitive robustness, ranging from standard reweighting techniques to advanced strategies that opti- mize the certified radius for smoothed classifiers across data subgroups (Section 5), effectively expanding the robust radius compared to non-optimized approaches.
Comprehensive experiments across various benchmark and real-world medical datasets demonstrate that our margin-basee approach significantly outperforms base- lines in certified cost-sensitive robustness across diverse
2

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
3. Preliminaries
Lemma 3.2. Given (æ, y), suppose ge classifies correctly, i.e., y arg meX] P "0- + 6) kl. then ge is provably robust at æ in ε2-norm with the standard certified radius r(æ; ho) defined by:
We use lowercase boldfaced letters to denote vectors and uppercase boldfaced letters for matrices. Let [m]] be the index set {1, 2..,..., m). [S] be the cardinality of set and (()) be the indicator function. For any 2 E IR and i E [d]. the i-th element of is denoted as z;. Denote by M(,, I²)) the multivariate spherical Gaussian distribution with mean and covariance matrix o²I with o > O. Let (-) be the cumulative distribution function (CDF) of (0, 1) and (.) be its inverse. Let so X ++ [m]] be classifier modeled by a DNN with parameter 0.
r(æ; ho) = 2 - ([ho(z))))) Φ 1-1 max (ho (2o(2))))) Regha
where he is defined in Definition 3.1. If the prediction is incorrect, then r(æ; ho) is defined to be 0. When he is clear from the context, we simply write r(x) = r(x; ho)-
4. Certifying Cost-Sensitive Robustness
3.1. Adversarial Robustness
4.1. Cost-Sensitive Robustness
Deep neural networks have been shown to be vulnerable to adversarial examples, where an adversary aims to subtly perturb an input æ to cause the classifier to make incorrect predictions. Specifically, given classifier fa. test input a with ground-truth label y, and norm bound >> 0, the adversary seeks to find a perturbation ô such that:
We consider image classification tasks under cost-sensitive scenarios, where the goal is to learn classifier with high cost-sensitive robustness, while maintaining similar per- formance level of overall accuracy. Specifically, we define a cost matrix C E Rmx that encodes the potential harm asso- ciated with different class-wise adversarial transformations. For any pair of classes j. k [m]. if C5s 0. it indicates that misclassification from class (seed class) class k (target class) incurs non-negligite cost Cjk- Conversely, Cju= = 0 suggests that there is significant incentive for an attacker to induce this specific misclassification.
fo(x + 5) + where ||01p S
(1)
In this context, 5 represents an adversarial perturbation that is often visually imperceptible to humans but sufficient to deceive the classifier. The magnitude of the perturbation ||öl,, is typically measured in f or fo norm.
The goal of cost-sensitive robust learning is to minimize ad- versarial misclassifications that incur a cost as defined by C. For any seed class y E [mm] we let S2 = {k [m]] C5R= > 0} be the set of cost-sensitive target classes. If S2 is an empty set, then all the examples from class j are non-sensitive. Otherwise, any class j with ||2 2 1 is a sensitive seed class. Given a dataset S = { ).) we define the set of cost-sensitive examples as S = { y) E S: | 2 1), while the remaining examples are regarded as non-sensitive.
To defend against such attacks, model fo is said be provably robust for an input æ: if it can be certified that no adversarial perturbation within the allowed norm can change the model's 's prediction:
fa + 8) fo(x), V 8 satisfying || S
(2)
This means that the model's prediction remains unchanged for all possible perturbations å within the e-norm ball.
3.2. Randomized Smoothing
4.2. Cost-Sensitive Certified Radius
Randomized smoothing is probabilistic certification frame- work proposed in Cohen et al. (2019). In particular, it builds upon the following definition of smoothed classifiers:
Similar to the standard certified radius, we introduce the definition of the cost-sensitive certified radius. Figure visu- ally illustrates the smoothed classifier and the cost-sensitive certified radius on a cancer classification task.
Definition 3.1. Let X' S Rdd be the input space and [m]] be the label space. For any classifier fo X + [m] and > O, the smoothed classifier with fo and is defined as:
Definition 4.1 "Cost-Sensitive Certified Radius). Let C be m m cost matrix. For any example (x:, y), suppose 9a classifies correctly.
go (x)) = arg max P oT)) [fo( + 5) = k), Vx X. kc(m]
The groupwise cost-sensitive certified radius, denoted as Tes-group (x; Sy. ha), (x, y) with the smoothed classi- fier go and the cost matrix C is defined
Let he X + [0, 11 be the corresponding function that
maps any æ E X' to the prediction probabilities of go (x)):
[ho(x)) = Po ( [Jo + k), Vk E [m].
a Φ 2
[ha(z))
~ max [ha(z)))) kESt,
max RE(M)
The following lemma, proven in Cohen et al. (2019), char- acterizes the lg perturbation ball with the largest radius for any input æ such that the prediction of go remains the same.
where 2g = (k E [m] : Cyp > 0} represents the set of sensitive target classes.
3

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Malignant
Algorithm 1 Certification for Cost-Sensitive Robustness
1: function SERTIFY__ROUP[[P
no, n, a. R.y)
//Determine the top-1 class
counts0 < SAMPLLEUNDEENOOSSSS/.......
4: čλ < top index in counts@
Per-nai-F 1x* (
5: //Obtain the countss
6: counts + SAMPLEEUDDENNOSEEf...c
Tes-pair (x
7: / //Compute the standard radius a)) a
P1
8: Fadd = (L((CCCccu
9: //Compute the group-wise radius
Benign
10: PA = LCB(counts((a))n,
-)
11: PB = max(UUB
12,1-11 2/2 ): k fy
12: faa-grop = ( (pA) - 4 (pp) 00/2
13: //Return the final result
Figure 1. A visual demonstration of the evaluation of the smoothed classifier ga and the sost-sensitive certified radius respair for the hemign/malignant cancer classification task. The right panel illus- trates the desired predicted probabilities hg for the benign (ar and malignant (x samples.
14: if max(fand fes.grupp) > 0 then
15: return ĆΛ. max fcs fes.grup))
16: else return ABSTAIN
and maxken, [a]]]=]] tends to be larger with a smaller S2 (see Figures 3(b) and 3(c) for empirical evidence). Although the pairwise certified radius (cs:pair== j) provides weaker guarantees (addressing only specific targeted misclassifi- cations), it enables defining an overall robust cost (Defini- tion 4.3), offering fine-grained control to mitigate critical misclassifications defined by the cost matrix (Section 5).
2. The pairwise cost-sensitive certified radius, denoted as Tax--air pair(a;; he), at (at, y) with the smoothed classifier go and the cost matrix C is defined as
σ - 1--'maa max [ho(z)] - -i- -0-(((h((z))))) mm)
2
where j Bay stands for the misclassification target class.
Definition 4.3 (Cost- Cost-Sensitive Robust Cost). Given the cost- sensitive certified radii in Definition 4.1, the overall objec- tive of cost-sensitive robust learning can be formulated as minimizing the total certified robust cost:
For incorrect predictions, all certified radii are defined as O. For brevity, we write Tes grop Qly) or Tes pai j) if hg is clear from the context.
Using similar proof techniques as in Lemma 3.2, can prove that no adversarial samples for exist within the & radius Tes group (z; 92y) that introduce misclassification costs. Likewise, there are no targeted adversarial samples that mis- classify x to class j within the & radius Tes-pair( "=s-pair<: (j) Note that the standard certified radius r rax) defined in Cohen et al. (2019) also serves valid (though conservative) certifi- cate under cost-sensitive settings. The following theorem characterizes the relationship between the cost-sensitive and standard certified radii.
Robeast (00)
1
Σ
Σ
Oui (re-ppi (x: S c),
|S*
(x. jEΩ,
where c is the norm bound for the perturbations. This metric captures the total cost of potential misclassifications for sen- sitive test samples, with each misclassification cost defined by the cost matrix C.
4.3. Proposed Certification Algorithm
Since exact computation of the cost-sensitive certified radius requires infinitely many Gaussian samples, we adopt Monte Carlo methods (Cohen et al., 2019) to obtain its empirical estimates. The main challenge for our adaptation lies in how to ensure statistically rigorous and tighter bounds on the newly proposed cost-sensitive certified radius, as detailed in Algorithm 1 (see Algorithm 2 for CERTIFY _PAIR..
Theorem 4.2. Under the same setting as in Definition 1, suppose that arg max [ha(=)]k & Sty Then, we have T Ter-pair (æ; j)r r's--group (z; S2yy 2 r(ær,, where the first equality holds when 22y [j} and the second holds when Ng - E [m]] : As Ay).
The key distinction between Tes-group (x; ②2y) and the stan- dard certified radius r(æ) arises when [Pty < m - 1 (see Appendix B.1 for detailed proofs of Theorem 4.2). No- tably, the benefit of using the cost-sensitive certified radius is more significant for (x. y) with smaller [Syl. as Φ is monotonically increasing, and the gap between [=)))
Following standard practice, we first compute the (1-o) lower confidence bound for the cost-sensitive certified radius by calculating ics such that Pffes S real 2 1-a. This ensures fes is a valid lower bound on the true radius Tes with high probability, providing rigorous certification even
4

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
if conservative. We now introduce our approach improve the tightness of this estimation. Recall that the certified radius has the following general form:
fsud > foss especially when Qg includes the runner-up class. Overall, the gap between fstd and fex depends input- specific factors, such as the probabilities of the top and runner-up classes, as well as hyperparameters like n and (see visualizations and discussions in Appendix B.3).
2 Φ (pA)) - (ps))-
To lower-bound the radius, we estimate (pa) and 5-1(pn (pD) by computing PA (a lower bound for pa) and PB (an upper bound for pB):
5. Training for Cost-Sensitive Robustness
While the notion of cost-sensitive certified robustness (Sec- tion 4.2) and our certification algorithmss (Section 4.3) can already be applied independently to any classifier in a black- box manner, this section focuses on training methods de- signed to enhance robustness guarantees in these contexts.
Lower-bounding PA: Compute PA as the (1-x) lower confidence bound of PA, and set pB = 1 1-PA- This yields the lower bound radius o6 11 (pA). as pn < 1-PA- This method, used in Cohen et al. (2019), gives the empirical radius fstd, which, as shown in Theo- rem 4.2, is always a valid (1-a) lower bound for the cost-sensitive radius.
Margin-CS: Cost-sensitive Margin Loss. We consider the natural idea of minimizing the total cost-sensitive robust cost (Definition 4.3) directly. However, this is challenging because the certified radius is not differentiable (nor sub- differentiable) due the presence of arg max operations and counting procedures, making it unsuitable for direct incorporation into the objective function. To address this, we employ soft-smoothed classifier approximation for the certified radius, following approaches in Salman et al. (2019); Zhai et al. (2020); Jeong et al. (2021). This replaces the counting probability he with the soft-smoothed predic- tion Gz(az) E (Fo + 5)] when computing the radius, where Fe: R + A m-1 is the soft-base classifier that returns the predicted probability scores (see Appendix A for notation summary). We denote this approximation as V'c--air (æ; j, Go) and Tcs-group (x; j. Go). emphasizing the use of the soft-smoothed classifier Go. In addition, maxi- mizing the certified radius can be interpreted as increasing the margin between the smoothed classifier's confidence in the ground-truth class and the most confusing target class.
Computing both bounds for PA and PB: The radius can also be computed using a (1-a/2) lower confidence bound of p pA and a (1-a/2) upper confidence bound of Pg. For fcs-group. the (1-a/2) upper confidence bound of pa is further approximated by taking the maximum of the (1-a/(2|(ty))) upper confidence bounds for each class l: E S2y. For puir, Pn is directly computed as the (1-a/2) upper confidence bound of the target class j.
The following theorem, proven in Appendix B.2 by union bound, shows the validity of the estimate Pos (1 a) confidence bound on the certified cost-sensitive radius.
(a;;
Theorem 4.4. For any example (ar, u), smoothed classifier ge and cost matrix C, fcs-group and fes-pair are certified cost- sensitive robust radii with at least (1-a) confidence over the randomness of Gaussian sampling.
To achieve numerical stability in this process, we apply hinge loss, which mitigates the instability caused by the large derivative of the inverse cumulative density function & (xz) near the domain boundary, as also highlighted in Zhai et al. (2020). More formally, given thresholds S u. the general margin loss for any v E R is defined as:
Remark 4.5. Unlike standard certified radius derivations, our algorithm introduces a novel method for computing the upper confidence bound PB over cost-sensitive target classes Sy. Standard approaches (Cohen et al., 2019) set Pø = 1-PA assuming concentration of non non-ground-truie -tuuh class probabilities in a single runner-up class. However, this is sub-optimal for certifying cost-sensitive robustness, as the relevant top class in Syy (for groupwise radius) or target class j (for pairwise radius) often differs from the runner-up, yielding looser robustness certificate. Our method refines pn using union bounds and tailored confidence levels, yield- ing tighter certificates (c.g., Line 11, Algorithm 1).
LM((;), max(u 0, [[(sosu]. (3)
where the indicator function selects data points whose cer- tified radius falls within the range of [2, u]. The overall training objective of our method is defined as:
min BrewwDBBwwoo..o (cE(So(x 8eB
+ +))
+ A1 (BlawWD. Lm [T (x; Sy, Go); 01)
(4)
Remark 4.6. Our certification algorithm returns the maxi- mum between the two possible radii fad and f... ensuring the tighter bound is returned. While the thcoretical results suggest that T's pair 2 Tex group 2 r, empirical cases may show
+ A2 (Tg
jEN,
5

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Here, >1, A2; 71: 72 > O are hyperparameters, D denotes the overall data distribution, D, is the distribution of sensitive examples that incur costs when misclassified, and D, is the distribution of normal examples. Specifically, the first term focuses on model performance, while the last two terms focus on robustness, with the final term incorporating the approximated total robust cost. The interval defined by "i and 72 in the margin loss Lu determines which data subpopulation is prioritized during optimization. Larger values of 7i and ?/2 result in broader data coverage (see Appendix D.3 for detailed ablation studies).
cost-sensitive performance by tuning the weight parameters associated with sensitive examples.
Evaluation Metries. We evaluate the performance of differ- ent methods using the following metrics: (i) Certified robust cost (Definition 4.3), (ii) Certified cost-sensitive robusiness: (g0)s(99) T E(aryess 1 ( Qty) > e}, which measures the fraction of (cost-)sensitive test examples with a certified radius larger than e, indicating robust- ness under la perturbations, where St is the set of sen- sitive test examples, and (iii) Certified overall accuracy: Acc(go) = [ST E(xp))s 11 (r(x)) > >0), which computes the ratio of correctly classified samples by Do over the entire testing dataset. Using the above metries, we can systemat- ically compare the cost-sensitive robustness and standard performance of various robust training methods.
Note that by applying different threshold restrictions to the certified radius for sensitive and non-sensitive samples, the model can focus on optimizing specific data subpopulations rather than treating all data points equally. This targeted approach is particularly beneficial for cost-sensitive learn- ing, with our experiments showing that this fine-graine fine-grained optimization strategy improves certified cost-sensitive ro- bustness without compromising overall standard accuracy.
6.1. Main Results
Equal Costs for Selected Misclassifications. We start by evaluating a straightforward scenario on standard bench- marks where equal costs are assigned to specific miselassi- fication cases. This demonstrates that our approach can ef- fectively emphasize these critical misclassifications, Specif- ically, we examine the following cases: "S-Seed": A single randomly selected sensitive seed class, where misclassifica- tion to any other class is assigned an equal cost. "M-Seed": Multiple sensitive seed classes, where misclassification to any other class is assigned an equal cost. "S-Pair": A single misclassification from sensitive seed class one specific target class. "M-Pair": A single sensitive seed class with misclassifications to multiple target classes, each with an equal cost. In our experiments, we report performance on classes that typically show higher prediction error by a vanilla classifier (i.e., those more vulnerable to attacks).
6. Experiments
Datasets & Configurations. We evaluate our method on the standard benchmark datasets: CIFAR-IO (Krizhevsky et al., 2009), Imagenette,, and the full ImageNet dataset (Deng et al., 2009). In addition, the real-world medical dataset HAM10K (Tschandl et al., 2018) to demonstrate its effectiveness in practical scenar- ios, where cost-sensitive misclassifications can have severe consequences. For CIFAR-10 and HAM10K, we use the ResNet architecture following Cohen et al. (2019) as the target classification model. Specifically, we use ResNet-56, since it attains comparable performance to ResNet- 10 but with reduced computation costs. For ImageNet, we use ResNet-18, 18, following Pethick et al. (2023). Consistent with common evaluation practices (Cohen et al., 2019), we focus on the setting of = 0.5 and o = 0.5 in our experiments, while we observe similar trends under other settings (see Appendix D for all the additional experimental results).
assess its performance
Tables and 2 show that Margin-CS significantly surpasses all standard baselines, improving by approximately 20% over the best standard robust training method while main- taining overall certified accuracy compared to non-cost- sensitive baselines. Beyond the quantitative results, visual demonstration of the distributions of the certified radii in Fig- ure 3(a) (CIFAR-10 "S-Seed" case) shows that our Margin- CS generally increases the certified radii for most samples. These results indicate that our fine-grained thresholding techniques for optimizing the certified radius offer better trade-off between accuracy and cost-sensitive robustness than both non-adaptive baselines and standard adaptations.
Methods. We compare our Margin-CS with existing base- line randomized smoothing- based training methods, includ- ing the Gaussian augmentation- based method (Cohen et al., 2019) (denoted as Gaussian). SmoothAdv (Salman et al., 2019), SmoothMix (Jeong et al., 2021), and MACER (Zhai et al., 2020), which are originally proposed to optimize for overall robustness. For reference, we also adapt these meth- ods for cost-sensitive scenarios (when applicable), intro- ducing Gaussian-CS, SmoothAdv-CS, and SmoothMix-Co CS as adaptive baselines (see Appendix D.1 for detailed de- scriptions). These adaptations use reweighting, a common technique in cost-sensitive learning, and are optimized for
Comparisons with Existing Methods. We compare our method with Zhang & Evans (2019)'s, which, to the best of our knowledge, is the only existing work that provides a certification and training approach for cost-sensitive ro- bustness. While Zhang & Evans (2019) does not provide a certified radius potentially favoring our method due to its
com fastai/ cttp//at.acooaaaac/aaaaaaa sttom//astai/mmmgeeettee mmggeettt..
6

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Table Certification results on CIFAR-I0 selected misclassifications (S-Seed, M-Seed. S-Pair, and M-Pair) with equal costs. Ace
certified overall accuracy (%), Rob,, refers to certified cost- cost-sensitive robustmess (%), and Robeat denotes certified robustness cost.
S-Seed
M-Seed
S-Pair
M-Pair
Method
Acc
Roba
Robeat
Ace
Robs
Robeat
Acc |
Rob,
Robent
Ace
Roba
Robast
Gaussiun
65.4
22.3
65.9
4.67
65.4
50.4
0.18
33.6
0.92
SmoothMix
65.7
65.7
26.4
4.61
65.7
58.0
0.39
65.7
45.2
SmoothAdv
66.9
27.1
4.94
66.9
30.2
4.42
66,9
57.1
0.38
66.9
38.7
MACER
65.9
27.3
5.27
65.9
4.90
54.3
0.23
38.5
0.99
Gaussian- CS
64.2
50.6
33.3
66.2
"34.8"
4.16
64.2
72.3
0.08
64.2
64.3
0.48
SmoothMix-CS
63.2
26.3
5,25
65.0
29.5
4.19
63.2
67.5
0.20
63.2
46.2
1.17
SmoothAdv-CS
66.1
53.5
3.12
67.2
3.14
66.1
80.4
0.31
75.3
0.73
Margin-CS
67.5
54.8
3.04
67.3
46.8
3.07
67.3
92.4
0.05
67.5
80.4
0.35
Table Certification results on Imagenette for selected misclassifications (S-Seed, M-Seed, S-Pair, and M-Puir) with equal costs. Acc certified overall accuracy (%), Rob, refers to certified cost-sensitive robustness (%), and Robeat denotes certified robustness cost.
S-Seed
M-Seed
S-Pair
M-Pair
Method
Acc
Rob,
Rob.s1
Acc
Rob,-
Rob
Acc
Rob,,
Rob
Acc f
Rob,,
Rob
Gaussiun
80.3
3.67
80.4
3.86
88.5
0.236
75.6
SmoothMix
80.2
64.3
80.2
55.5
4.86
80.2
89.4
0.198
80.2
79.2
1.76
SmoothAdy
80.6
59.5
80.6
59.2
3.98
80.6
90.2
0.196
80.6
74.9
1.72
MACER
78.2
63.8
2.46
78.2
57.8
2.72
78.2
89.9
0.169
78.2
78.0
0.34
Gaussian- CS
74.6
73.3
1.67
74.6
61.7
2.52
75..4
91.1
0.167
75,4
83.0
0.26
SmoothMix-CS
77.6
3.82
76.1
4.30
77.6
90.2
0.189
82.6
SmoothAdy-CS
76.1
68.9
2.24
75.7
62.6
2.81
78.6
90.7
0.177
77.6
80.4
1.70
Margin-CS
79.6
81.1
1.35
82.1
2.46
82.7
0.167
86.3
0.21
Table Comparisons of our method with Zhang & Evans (2019) for 22-norm CIFAR-10 10 across different settings.
Table 4. Performance metrics (Accuracy, Precision. Recall in %)
and certification results (Rob, in and Robeat) on HAM10K.
Method
S-Paie
M-Pair (1.1.10)
(1.1.2)
Method
HAMI
Acef
Roh_1
Aec?
Robb.i
Aeef
Roh
Acc
Rob,
Rob
Precision
Recall
Gaussian
79.5
67.4
79.3
5.04
79.3
2.02
Gaussian
82.9
11.8
1.56
51.0
15.0
SmootiMMx
73.0
67.0
73.0
3.96
73.0
2.32
SmoothAdy
82.6
11.4
1.68
36.4
17.8
SmoothAdy
77.9
74.2
77.9
4.45
77.9
2.12
SmoothMix
83.1
0.79
1.86
40.0
0.80
Gaussian-CS
MACER
SmosthMix-CS
77.8
78.4
72.2
81.1
75.7
77.4
77.8
78.1
72.2
2.65
3.25
4.52
77.3
78.4
72.2
1.35
122
1.97
Gaussian-CS
MACER
82.7
80.5
19.7
T,47
38.0
25.0
20.0
SmoothAdy-CS
78.7
$3.8
78.7
3.21
78.7
1.40
SmonthAdy CS
81.8
21.7
1.64
39.6
23.5
Thang & Evans (2019)
92.4
2.78
73.9
1.70
SmoothMix-CS
81.9
2.1
1.70
25.0
2.1
Margin-CS CS
80.9
93.5
79.5
2.39
79.5
0.93
Margin-CS
83.2
34.4
1.17
52.0
41.3
6.2. Applicability to Real- World Medical Data
flexibility all our evaluation metrics remain valid. Since their default setting aligns close to e = 0.25, we perform all comparisons with both training and testing noise set to 0.25. The comparison results in Table 3 focus on seed class "3" under both equal cost (the "S-Pair" setting) and varying unequal cost conditions (the "M-Pair (0), and "M-Pair (1,1 settings). In the unequal cost scenarios, the misclassification costs for class "3" to classes "2", "r"." "4", "5" are set to 1, 1, and 10, and to classes "2", "4", , "6" are set to 1, 1, and 2, respectively.
We consider a practically significant scenario of cost- sensitive robust learning using real-world medical data. Specifically, we evaluate the performance of various ro- bust training methods on the HAM10K (Tschandl al., 2018) 1) dataset, focusing of pigmented lesions as either benign or malignant. This scenario closely mirrors real real-world applications, where mis- classifying malignant tumor as benign can lead to severe consequences and higher associated costs. To account for this, we set the misclassification costs at a ratio of 10:1 for sosegnanttto-bbnige versus -ommi-gga- errors, emphasizing the significantly higher penalty for failing to diagnose malignant condition.
the task of classifying images
As shown in Table 3, our Margin-CS achieves significantly higher certified robustness while maintaining comparable overall standard accuracy when compared with Zhang & Evans (2019), highlighting the superior practicality of our approach. It is important to note that, as a convex relaxation- based method, Zhang & Evans (2019) not feasible for relatively large real-world datasets (c.g., Imagenette and HAM10k in our work), limiting its applicability.
The results, shown in Table 4, include both performance metrics (Accuracy, Precision, Recall) for the smooth clas- sifier, as well as certification metrics (Rob and Rob,). Notably, our Margin-CS method, which directly optimizes

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
CIFAR (eede)
CIFAR-10 (M-Pair)
Imagenette (S Seed)
Imagenette Pair)
1.0
3.0
Con-Semittie Rebestnes
066
0.6
0.4
0.4
0.4
0.2
0.2
0.0
1.0
2.0
0.0
0.5
1.5
2.0
0.0
1.0
Gaussian
SmoothMix
SmoothAdy
MACER
Gaussian-CS
SmoothMii-CS
SmoothAdv-CS
Margin-CS
Figure 2. Certified accuracy curves for varying on different datasets under different settings.
0.06
SmoothAdv SmoothAdy-CS Margin-CS
0.05
Set-Sensieeve Robustness
Cost- Cost-Sonsitive Robustness
f
Frequency
0.04
0.6
0.03
0.4
0.4
0.02
0.01
0.2
0.2
0.00
0.0
0.5
1.0
1.5
2.0
0.0
5
0.0
Fcs group
[12g]
[$2g]
(a) Radius Distribution
(b) Gaussian
(c) Margin-CS
Figure 3. Figure 3(a) shows Margin-CS CS improves the distribution of cost-sensitive certified radius compared with the overall strongest baselines, SmoothAdy and SmoothAdv-CS Figures 3(b) and 3(c) compare the cost-sensitive robustness computed using fai and A group.
the certified radius, shows significant improvements in certi- fied robustness and robust cost. We also notice that while all methods demonstrate comparable prediction accuracy, they exhibit substantial differences in precision and recall. The intrinsic imbalance in the data distribution (i.e., higher prevalence of benign samples) leads many training meth- ods to bias predictions toward benign outcomes. Notably, our Margin-CS achieves superior recall (which is of great practical importance as captures potentially malignant cases that require urgent treatment) and precision compared to other cost-sensitive robust training methods well non-cost-sensition baselines. For reference, standard base classifier yields 3.4% precision and 39.3% recall, while our Margin-CS method substantially improves upon these metrics to 52% precision and 41.3% recall.
spond to the default setting we adopted for comparisons. It is evident that our Margin-CS generally outperform all the baseline methods and their adaptations in certified cost- sensitive robustness across different The most significant improvements provided by our cost-sensitive adaptation oc- cur for S 1, with notable gains to s 1.5. Beyond this, larger e values likely exceed the limits of certification methods, causing failures across all approaches.
7. Conclusion
In this work, we developed comprehensive framework based on randomized smoothing to certify and train for cost-sensitive robustness. We investigate various representa- tive training methods, ranging from systematic adaptations of existing approaches to our novel targeted cest-sensitive certified radius maximization technique. Notably, our fine- grained thresholding techniques, which optimize the certi- fied radius across carefully calibrated data subgroups, sig- nificantly improve the model utility- robusstess trade-off. Extensive experiments on benchmark and medical datasets demonstrate the generality and effectiveness of our frame- work compared to existing methods.
6.3. Ablation Studies with Varying e
To provide more comprehensive understanding of each method's behavior across varying levels of (which corre- spond different practical robustness requirements), we compare the cost-sensitive robustness Robs under varying scale of & perturbations for all methods in Figure 2. The performance at e = 0 measures the certified accuracy for cost-sensitive examples, and the results at e 0.5 corre-
8

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Availability
conference on machine learning, pp. 1310-1320. PMLR, 2019.
To ensure reproducibility and accessibility, our method and the implementations of our experiments are avail- able as open source code at: https: //ggtubb.tttt//gg//e com/ AppleXY/ Capplexy/Cost-Sa0 http///ottteneniieeeeeeeeeeeeeee
Croce, F,, Gowal, S., Brunner, T., Shelhamer, E., Hein, M., and Cemgil, T. Evaluating the adversarial robustness of adaptive test-time defenses. In International Conference on Machine Learning (ICML), pp. 4421-4435 4435. PMLR, 2022.
Impact Statement
Dalvi, N., Domingos, P., Sanghai, S., and Verma, D. Ad- versarial classification. In Proceedings of the tenth ACM SIGKDD international conference on Knowledge discov- ery and data mining, pp. 99-108, 2004.
Our work aims to enhance the robustness of machine learn- ing systems under cost-sensitive scenarios, which crucial for safety-critical applications such as healtheare and au- tonomous driving. We are not aware of any ethical issues that might be induced by our work, since main focus is to build better defenses. As for potential societal conse- quences, we believe our work will be particularly helpful for practitioners to incorporate domain knowledge to build better robust machine learning systems that are prioritized to defend against the most consequential attacks.
Deng. J., Dong, W., Socher, R., Li, L..J., Li, K., and Fei-Fei, Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and patlern recognition, pp. 148-255. Icee. 2009.
Domingos, P. Metacost:
A general method for making clas- sifiers cost-sensitive. In Proceedings of the fifth ACM SIGKDD international conference on Knowledge discov- ery and data mining, pp. 155-164, 1999.
References
Asif, K., Xing, W., Behpour, S., and Ziebart, B. D. Adver- sarial cost-sensitive classification. In UAI, pp. 92-101, 2015.
Dreossi, T., Jha, S., and Seshia, S. A. Semantic adver- sarial deep learning. In Computer Aided Verification: 30th International Conference, CAV 2018, Held as Part of the Federated Logic Conference, FloC 2018, Oxford, UK, July 14-17, 2018, Proceedings, Part 30, pp. 3-26. Springer, 2018
Athalye, A., Carlini, N., and Wagner, D. Obfuscated gra- dients give false sense of security: Circumventing de- fenses to adversarial examples. In International confer- ence on machine learning, pp. 274-283. PMLR, 2018.
Dvijotham, K., Stanforth, R., Gowal, S., Mann, T. A., and Kohli, P. A dual approach to scalable verification of deep networks. In UAI, volume 1, pp. 3, 2018.
Biggio, B., Corona, I., Maiorca, D., Nelson, B., Šmniié, N., Laskov, P., Giacinto, G., and Roli, F. Evasion attacks against machine learning at test time. In Machine Learn- ing and Knowledge Discovery in Databases: European Conference, ECML. PKDD, pp. 387-402. Springer, 2013.
Elkan, C. The foundations of cost-sensitive learning. In International joint conference on artificial intelligence, volume 17, pp. 973-978. Lawrence Erlbaum Associates Ltd, 2001.
Carlini, N. and Wagner, D. Towards evaluating the robust- ness of neural networks. In 2017 ieee symposium on security and privacy (sp). pp. 39-57. Ieee, 2017.
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples. arXiv preprint arXiv: 1412.5722 2014.
Carlini, N., Tramer, F,, Dvijotham, K. D., Rice, L., Sun, M., and Kolter, J. Z. (certified!!) adversarial robustness for free! In The Eleventh International Conference on Learning Representations, 2022.
Gowal, S., Dvijotham, K., Stanforth, R., Bunel, R., Qin, C., Uesato, J., Arandjelovic, R., Mann, T., and Kohli, P. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv: 2018
Carmon, Y., Raghunathan, A., Schmidt, L., Duchi, J. C.,, and Liang, P. S. Unlabeled data improves adversarial robustness. Advances in neural information processing systems, 32, 2019.
Gu, S. and Rigazio, L. Towards deep neural network archi- tectures robust to adversarial examples. arXiv preprint arXiv: 1412.5068, 2014.
Chen, Y., Wang. S., Jiang, W., Cidon, A., and Jana, S. Cost- aware robust tree ensembles for security applications. In USENIX Security Symposium, pp. 2291-2308, 2021.
Huang, X., Kwiatkowska, M., Wang, S., and Wa, M. Safety verification of deep neural networks. In Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings. Part 1 30, pp. 3-29. Springer, 2017.
Cohen, J., Rosenfeld, E., and Kolter, Z. Certified adversarial robustness via randomized smoothing. In international

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Jeong, J., Park, S., Kim, M., Lee, H.-C., Kim, D.-G., and Shin, J. Smoothmix: Training confidence-calibraaee smoothed classifiers for certified robustness. Advances in Neural Information Processing Systems, 34:30153- 30168, 2021.
Madry, A., Makelov, A., Schmidt, L.., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. arXiv preprint vrXiv:1706.0600 2017.
Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. Distillation defense to adversarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP), pp. 582-597. IEEE, 2016.
Jia, J., Cao, X., Wang, B., and Gong, N. Z. Certified ro- bustness for top-k predictions against adversarial per- turbations via randomized smoothing, arXiv preprint arXiv: 192.0899 2019.
Pethick, T., Chrysos, G., and Cevher, V. Revisiting adversar- ial training for the worst-performing class. Transactions on Machine Learning Research, 2023. ISSN 2835-8856.
Katz, G., Barrett, C., Dill, D. L.,, Julian, K., and Kochender- fer, M. J. Reluplex: An efficient smt solver for verifying deep neural networks. In Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017, Proceedings, Part I 30, pp- 97-117. Springer, 2017.
Pulina, L. and Tacchella, An abstraction-refiiemen ap- proach to verification of artificial neural networks. In Computer Aided Verification: 22nd International Con- ference, CAV 2010, Edinburgh, UK, July 15-19, 2010. Proceedings 22, pp. 243-257. Springer, 2010.
Khan, S. H., Hayat, M., Bennamoun, M., Sohel, F. A., and Togneri, R. Cost-sensitive learning of deep feature representations from imbalanced data. IEEE transactions on neural networks and learning systems, 2973)35733 2017.
Raghunathan, A., Steinhardt, J., and Liang, Certified defenses against adversarial examples. In International Conference on Learning Representations, 2018.
Russakovsky, O., Deng, J., Su, H., Krause, J., Satheesh, S., Ma, S., Huang, Z.., Karpathy, A., Khosla, A., Bern- stein, M., al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115: 211 211-252, 2015.
Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009.
Kukar, M., Kononenko, I., al. Cost-sensitive learning with neural networks. In ECAL, volume 15, pp. 88-94. Citeseer, 1998.
Salman, H., Li, J., Razenshteyn, I., Zhang, P., Zhang, H., Bubeck, S., and Yang. G. Provably robust deep learning via adversarially trained smoothed classifiers. Advances in Neural Information Processing Systems, 32, 2019.
Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial ma- chine learning scale. arXiv preprint 161 2016.
Lecuyer, M., Atlidakis, V., Geambasu, R., Hsu, D., and Jana, S. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium Security and Privacy (SP), pp. 656 662.. IEEE, 2019.
Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R. Intriguing properties of neural networks. arXiv preprint arXiv: 1312.6199, 2013.
Tjeng, V., Xiao, K. Y., and Tedrake, R. Evaluating robust- ness of neural networks with mixed integer programming. In International Conference on Learning Representations, 2019.
Li, B., Chen, C., Wang. W., and Carin, L. Certified adver- sarial robustness with additive noise, Advances in neural information processing systems, 32. 2019.
Liu, X., Cheng, M., Zhang, H., and Hsieh, C.-J. Towards robust neural networks via random self-ensemble. In Proceedings of the European Conference on Computer Vision (ECCV), pp. 369-385, 2018
Tschandl, P., Rosendahl, C., and Kittler, H. The ham 10000 dataset, a large collection of multi- dermatoscopic images of common pigmented skin lesions. Scientific data, 5(1):1 2018.
Liu, X.-Y. and Zhou, Z. The influence of class imbalance on cost-sensitive learning: An empirical study. In sixth international conference on data mining (ICDM '06), pp- 970-974. IEEE, 2006.
Uesato, J., O' O'donoghue, B., Kohli, P., and Oord, A. Ad- versarial risk and the dangers of evaluating against weak attacks. In International conference on machine learn- ing(ICML), pp. 5025-5034. PMLR, 2018
Lyu, C., Huang, K., and Liang, H.-N. A unified gradient regularization family for adversarial examples. In IEEE International Conference on Data Mining (ICDM). pp- 301-309. IEEE, 2015.
Wong, E. and Kolter, Z. Provable defenses against adversat ial examples via the convex outer adversarial polytope. In International conference on machine learning, pp. 5286- 5295. PMLR, 2018
10

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Wong, E., Schmidt, F., Metzen, J. H., and Kolter, J. Z. Scal- ing provable adversarial defenses. Advances in Neural Information Processing Systems, 31, 2018.
Xiao, C., Chen, Z., Jin, K., Wang, J., Nie, W., Liu, M., Anandkumar, A., Li, B., and Song, D. Densepure: Un- derstanding diffusion models for adversarial robustness. In The Eleventh International Conference Learning Representations. 2022.
Zadrozny, B., Langford, J., and Abe, N. Cost-sensitive learning by cost-proportionate example weighting. In Third IEEE international conference on data mining, pp. 435 442. IEEE, 2003.
Zhai, R., Dan, C., He, D., Zhang, H., Gong, B., Ravikumar, P. Hsieh, C.-J,, and Wang, L. Macer: Attack-free and scalable robust training via maximizing certified radius. In International Conference on Learning Representations, 2020.
Zhang, H., Yu, Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. Theoretically principled trade-off between robustness and accuracy. In International conference machine learming, pp. 7472-7482, PMLR, 2019.
Zhang, J., Chen, Z., Zhang. H., Xiao, C., and Li, B. (DiffSmooth): Certifiably robust learning via diffusion models and local smoothing. In 32nd USENIX Security Symposium (USENIX Security 23), pp. 4787-4804, 2023.
Zhang. X. and Evans, D. Cost-sensitive robustness against adversarial examples. In International Conference Learning Representationss, 2019.
Zhou, Z. and Liu, X.-Y. On multi-class cost-sensitive learning. Computational Intelligence, 26(3):232-257, 2010.

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Appendix
Algorithm 2 Certification for Cost-Sensitive Robustness
1: function CERTIFY PAIR(fee o, æ; no, n, a.j):
A. Notations
/DDetermine the top-1 class
counts0 < SAMPLEUUNDEROOSSEEf.. no.
We present below in Table 5 summary of the notations
4: čλ < top index in counts@
used throughout this paper. 'D represents the underlying data
5: //Obtain the countss
distribution, Dj the distribution of all sensitive examples
6: counts + -AMPPEEUNDDENOOSSSO....
that ineur costs if misclassified, and D, is the distribution of the remaining normal examples. The base classifier is denoted by fa R + [m]] while Fe R + A refers
7: / /Cmpptte the standard radius
8: Fadd = (-L[CBBccunnts(lll_
a))
to the soft-base classifier that outputs predicted probabil- ity scores, where A is the probability simplex in R
9: //Compute the pair-wise radius
10: PA = LCB(counts((2)),
2
Specifically, fo( = arg [mm) (z))ee
11: PB = UCB[counts[]],n..
12: Parpuir - (0- - $ (pB)) 00/2
In addition, go: _2 - [m]] denotes the smoothed classifier,
13: // //Return the final result
and Gg R + A A- represents the soft- smoothed classi- fier with (z( = (0, [ax + 5)], which serves as an approximation of ho introduced in Definition 3.1. In essence, hy captures the frequency of hard label predictions given by the base classifier f on noisy inputs æ + 6, while Gg represents the expected soft label predictions produced by the soft-base classifier F' on noisy inputs.
14: if max(fatd, fos-parr) > then
15: return ćλ. max(faad, fco-pair)
16: else return ABSTAIN
Tes-pair (x;:)air(3; = 2 Φ (1-((())))) x (0-((((()))
Note that the first term is identical across all definitions; the differences arise in the second term. Depending on the setting of 22y we can make the following observations:
Table 5. Summary of Notations.
Notation
Description
Overall data distribution
D.
Distribution of all sensitive examples
By definition we require that 22p C [m] \ {y}, thus
Dn
Distribution of the remaining normal examples
maxkyl [he (x)) 2 maxkes,, [ha(2)] k [he (z)]
fo : Rd + [m]
The base classifier
Fo: Pd
A
The soft-base classifier
Due to the monotonicity of Φ-1, we therefore have r(æ) S Vax-gropp (2; Pyy) S (2)
9e Rd
[m]
The smoothed classifier
Go :
m
The soft-smoothed classifier
When [0yl m - 1, Sy = {ilí * v.J E [m]] encom- passes all incorrect classes, the two probability terms are fully matched for (a:group(2:200) 2,y) and r(z), leading to Tes-gromp (z;; {2y,) = r(x).
he: Rd 1-
The prediction probabilities of ge The query sample
E Rd
2 E R
The fx-bounded adversarial sample of æ on 90
3' e Rd
The unrestricted adversarial sample of x ge
When [2yl = 1, specifically Gy = {j), it is straight- forward to observe that maxked, [ho = (h)()))]
B. Certification Algorithm
resulting res (z:; (2y)) = "air (ax; J).
Algorithm 2 provides the pseudocode for computing the pair-wise certified radius, as referenced Section 4 of the main paper.
Therefore, we complete the proof of Theorem 4.2.
B.2. Proof of Theorem 4.4
B.1. Proof of Theorem 4.2
Proof of Theorem 4.4, Our goal is to show that fcr (i.e., both fos-group and fes-pair) specified in Algorithms 1 and 2 is a cost-sensitive certified radius with at least (1 a) con- fidence over the randomness of the Gaussian sampling. Let m be the total number of label classes, and let (PI...., Pm)) be the ground-truth probability distribution of the smoothed classifier go for given example (x, y). Denote by PA PB the maximum probabilities in [m]] and in Syy respectively. According to the design of Algorithms and 2, we can compute the empirical estimate of pk for any k E [m] based on n Gaussian samples and the base classifier fe. Let (fI,...,Pm) be the corresponding empirical estimates,
Proof of Theorem 4.2. Note that æ assumed to be cor- rectly classified by ge in the definition of certified radius (otherwise the radius is defined to be 0), suggesting that the ground-truth y is also the top-1 class. Recall that standard certified radius is defined as:
r(x)
σ Φ 11 (Iha()))m) 2 (max (m))(((((())))) [1)( (5) key
2
Recall that our cost-sensitive certified radius is defined as:
Per-goup(:;; (1;; P.y) ([0(([[(())),, -
ken, [ho(=)).)]
max
12

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
then we immediately know
where P4 is defined as the (1 (1-o/(2(0,,))) upper confidence bound computed using ÿr-- We remark that the choice of (1 a a can in fact be varied for each k E Ωy and even optimized for obtaining tighter bounds, as long as the summation of the probabilities of bad event happening is at most a/2. Here, we choose the same value of ax /2/22(2n) across different k for simplicity, which already achieves reasonably good performance in our preliminary experiments. According to the union bound, we have
Pk Binomial(n, pk), for any k E [m]]
For fstd. we follow the procedure in Cohen et al. (2019) to compute the (1 - <x) lower confidence bound by first caleu- lating the (1 ax) lower confidence bound on PA (denoted as PA). Then, given the fact that pn < 1 PA, this leads to an upper confidence bound on PB = - PA- However, for the computation of ft.. we need to compute both a lower confidence bound on PA and an upper confidence bound on PB. which requires additional care to make the compu- tation rigorous. In particular, we adapt the definition of
Pr max PI 2 PB KER,
= Pr
max Pk 2 max Pk kED,
RESt
standard certified radius (Theorem 1 in Cohen et al. (2019)) to cost-sensitive scenarios for deriving fex. Based on the construction PA = I.CB(count [2A], n, a/2), we have
2 1 -
Pr
ph S Phc
RE
2 1 - |ر a/ (212,)) = = 2
a
Pr PA S PA
2 1
(6)
2
where the first inequality holds because of the union bound, which completes the proof.
Therefore, the remaining task is prove
2 1 a 2
Pr pn 2 pm
B.3. Demonstrations for Remarks 4.6
If the above inequalities hold true, we immediately know that by the union bound,
In Figure 4, we illustrate various scenarios involving the probability prediction scores of gu on a given sample (æ: y) that can lead to different orderings of the estimated certi- fied radius. The plot considers an example with five label classes, where Py denotes the true underlying prediction probability of the smoothed classifier go the ground- truth class y, and P&1 through Pą4 represent the remain- ing non- non-ground truth classes. The corresponding colored curves depict the observable distributions of these underly- ing values, obtained through Monte Carlo sampling, which follow binomial distributions. We focus on the most favor- able cases for Asd (as otherwise, our sensitive radius is always larger) by setting S2y [k:1, 1:2, 13,, k4), which includes all non-ground-truth classes, for the groupwise ra- dius Tes-group (x; (2; and designating j as the index of the runner-up class (here j = 11,, as shown in the figure) for the pairwise radius res (=:: (z: The figure sequentially displays all typical cases from top to bottom. We note the following points associated with the demonstration:
Pr Prfpa I rex (2; fqy)
= Pr o Φ 1 (pa) - -0 -p-1(p))
2
S 2
$ 1 (pa) -Φ Φ 3 (pB))
2 1 - (Pr
Pa 2 pd
+ Pr pt S pB
11
For the pairwise cost-sensitive certified radius, based Equation 7, we directly have by setting:
PB- = UCB((cout [], n,
a ).
For the groupwise cost-sensitive certified radius,
PB- max UCCB(tunt n, 2|
: k E 02y),
The estimation of PA PA generated by fad is closer to the true underlying PA (as it allows a larger lower region, i.e., a vs. a/2) while the differences between various estimates of PA diminish with more random noisy samples and as PA approaches 1.
as defined in Algorithm 1. 2y denotes the set of cost- sensitive target classes, and pa = maxeen, {pk} is used to define Tes-group( (z, Ply). The challenge for proving Equation 7 lies in the fact that we do not know the top class within 22 which is different from the case of P.a Therefore, we resort to upper bounding the maximum over all the ground-trut truth class probabilities within Dy. Based on the distribution of Pr. we know for any Szy.
When the prediction probability mass is not concen- trated on the top two classes (e.g., subplot (a)), our cost- sensitive radii tend to be larger due to their more precise estimation of pg. However, when the prediction proba- bility mass is concentrated on the top two classes (e.g.. subplots (b) and (c)), As will be more advantageous.
Pr pk 2 pk 2 2 122a/(2122y)).
(9)
13

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Ad
Table 6. Percentage for Paid > Fergropp under different cost matri- ces settings on CIFAR-I0, 10. We fix one seed class "cat" and vary the number of sensitive target classes f2g.
Pi
Pic
Pi
Lower d region
12y
3
9
Lower region
Upper a/2 region
Gaussian 0.9%
1.7%
13.7%
16.2%
22. 1%
Upper e/jjj region
Margin-CS 1.7%
6.8%
7.7%
10.8%
18.1%
Pafff jolrfo goop (oo)
antees by returning the maximum of the standard estimate fadd and our cost-sensitive estimate for. To evaluate its ef- fectiveness, we compare certified cost-sensitive robustness using fatd and fes-group under various settings. Figures 3(b) and 3(c) illustrate results for a fixed seed class "cat" (class "3") and cost-sensitive target sets of varying sizes. We as- sess models trained with Gaussian smoothing (Cohen et al., 2019) and our Margin-CS approach. Our results show that fer-group generally provides tighter cost-sensitive robustness guarantees than fstd. with the gap increasing as |9tyl de- creases. This occurs because a smaller Ωg is less likely to include the runner-up class, causing the true pB (top class probability in Sty) to be lower than the estimated pø used for fstd- These findings highlight the advantage of fcs and the importance of our algorithm. However, as noted in Re- mark 4.6, when S,y includes the runner-up class, fas group can occasionally be smaller than fsta Table 6 shows that this occurs in less than 20% of cases across various cost matrix settings. This supports our observation that Faid only outper- forms gox-goup when Pø = 1 - PA holds tightly, confirming the need for the maximum operation in our algorithm.
PA
(a) And < Pes-group < fes-gair
Pu
Par
P3
region
Lower oi2 region
Upper region
Upper a/200/] region
pad goop Feae)
fx
(b) Por group < fud Paoppirr
Aa
Ad
Pr
C. Discussions & Insights
P 99
Lower region
Lower al2 region
Denuity
Upper a/2 region
Existing robust training methods based on randomized smoothing can be roughly categorized into two main classes: (1) auggented training, which enhance robustness by incorporating noise into the training process (Cohen et al., 2019; Salman et al., 2019; Jeong et al., 2021), and (2) certi- fied radius optimization, which focus on directly maximiz- ing the certified radius (Zhai et al., 2020). Both classes considered in our work for completeness, as discussed in Section D.1 (in the appendix) and Section 5 (in the main paper), respectively. Below, we discuss the key strengths and limitations of each class in the context of cost-sensitive learning and compare them with alternative frameworks.
Upper a/200y) region
1- RalBaa
Pis
A
PA
(c) for group Pei
Fad
Figure 4. Visualizations of scenarios that result in different order- ings the estimated certified radius. The vertical dashed lines, shown in different colors, indicate the lower and upper hounds for PA and pa as determined by different estimation methods.
Control vs. Flexibility. Noise-augmented training meth- ods are generally easy to implement and broadly applicable across various models and data modalities. However, this flexibility often comes at the cost of reduced granular con- trol, making them less suitable for cost-sensitive scenarios. In such cases, adaptations typically rely on reweighting, a straightforward but restricted technique for cost-sensitive learning. Achieving more specific adaptations would re- quire adjusting the noise distribution or perturbation strategy
Comparing the two types of our cost-sensitive radius, Fes-pair will always be larger than Tes-groop, as they share the same estimation of PA. but the estimation of pg from Tex-pair is closer to the true pn because it allows a larger upper confidence region (i.c., a/2 vs. l.
Comparing fos with feaa. As noted in Remark 4.6, our cer- tification algorithm tightens cost-sensitive robustness guar-
14

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
for different cost matrices, which complicates implemen- tation and yielded suboptimal results in preliminary tests. While these methods generally offer reasonable per- formance, they often fall short of achieving optimal robust- ness. In contrast, certified radius optimization methods offer greater control by focusing directly on maximizing the robustness measure. This approach well-suited for inte- grating the certified radius into cost-sensitive frameworks, allowing for more precise management of different misclas- sification types as defined by the cost matrix.
these (cost-sensitive) adaptive baselines.
Gaussian-CS. We first consider the base classifier training method introduced in Cohen et al. (2019), which proposes injecting Gaussian noise into all inputs during the training of fo to mitigate the negative effects of the noise introduced during inference. In cost-sensitive settings, the reweight- ing scheme involves increasing the weights assigned to the loss function of sensitive examples, a method we re- fer to as Gaussian-Ch CCS. Specifically, the training objective of Gaussian- CS is defined as follows:
Scalability vs. Tightness. While this work focuses the randomized smoothing framework, it is worth noting that the convex relaxation framework has also been adopted for cost-sensitive certification (Zhang & Evans, 2019). In com- parison, this alternative framework may be slightly more advantageous in providing tighter robustness guarantees, as it allows for more precise control over the perturbation sets and leverages well-established optimization techniques such semidefinite programming and duality theory. How- ever, these advantages come at the expense of significant scalability challenges, rendering the approach infeasible for worldworld, high-dimensional data. In contrast, randomized smoothing is highly scalable, making it well-suited for large datasets. However, our certification method, while smoothly scaling with input dimensions, faces worst-case quadratic scaling with the number of label classes. This could be concern when aiming for precise control over all types of misclassifications. Despite this, its practical impact is often mitigated in real-world scenarios, where strong priors exist for only a few critical misclassification types. In fact, many cost-sensitive learning tasks in practice are either binary or involve a small subset of classes where misclassification is particularly costly. This results in a sparse cost matrix, which simplifies the optimization process and ensures that our approach remains efficient in typical practical scenarios.
min AE
E Es NinN Lee + +)),))
+ A B(a.y)D, ES LCE (Fo ( + {)
where À > I is a trade-off parameter that controls the perfor- mance between sensitive and non-sensitive examples. When
X = 1, the above objective function is equivalent to the training loss used in standard randomized smoothing.
Smooth CS. SmoothAdv (Salman et al., 2019) applies adversarial training to the smoothed classifiers ge to improve its certified robustness, which involves incorporating adver- sarial samples into the updating process of the smoothed classifier. Similarly to Gaussian-Ch, we adapt SmoothAdv by reweighting the cost-sensitive samples:
min "ow AE
+ +A-Baag))D EB Cce (fo(@ + +6)
where a represents adversarial example of x against smoothed classifiers go. which is found by:
σ arg max LCE(90(x'), 1)
D. Additional Details & Experiments Results
ot I| -a - 125cc
D.I. Adaptive Baselines
arg max
LCE(Ge(Z))
(10)
o' "| fee--wie #lose
The muddmmzzed-mmoolte framework is built on the prin- ciple of introducing noise into input samples during infer- ence. To further enhance both performance and robust- ness, existing works typically proposed accounting for this noise when updating the base or smoothed classifier (Co- hen et al., 2019; Salman et al., 2019; Jeong et al., 2021) (i.e., noise-augmented training). In this context, adapting to cost-sensitive samples can be effectively addressed through reweighting, standard and widely accepted approach in cost-sensitive learning. By assigning higher importance to these sensitive samples during the training process, reweight- ing ensures the model is better equipped to handle misclassi- fications that incur higher costs. In this section, we present
arg max !| - glaSe (-log log Ea- [Fo + +8)1,)
(11)
where denotes the maximum allowable fy-norm distance between the adversarial example x' and the original input
x, Fe and Go represent the soft-base and soft-smoothed classifiers, respectively. The approximation in Equations 10 and 11 introduces a differentiable objective, which is further approximated using Monte Carlo sampling with a small number of Gaussian noise samples for 6.
SmoothMix-CS Smoothed classifiers exhibit a crucial re- lationship between prediction confidence and adversarial
15

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
robustness: higher confidence typically leads to better cer- tified robustness. In this regard, SmoothMix (Jeong al., 2021) suggests that the "over-confident but semantically off-class" samples can undermine the classifier's ss robustness. They further observe that such over-confident examples can be efficiently found along the direction of adversarial per- turbations for a given input and propose to regularize the over-confident predictions along the adversarial direction toward the uniform prediction through mixup loss. The training objective is as follows:
32 x 32 colour images in 10 classes (airplane, automobile, bird, cat, deer, dog. frog, horse, ship, truck), with 6,000 images per class, with 50,000 training images and 10,000 test images. The training set contains exactly 5000 images per class, while the test set contains exactly 1,000 randomly selected images per class, making it a balanced dataset.
Imagenette. The Imagenette dataset² is a curated sub- set of 10 easily recognizable classes from the larger Im- ageNet dataset. It includes images from the following cat- egories: tench, English springer, cassette player, chainsaw, church, French hom, garbage truck, gas pump, golf ball, and parachute. The images are resized to 160 x 160 pixels, making it a compact and focused dataset ideal for efficient experimentation and model benchmarking.
min REG
Bla.wi-DBs-N Cox (fo(x + 8).9)
(12)
+ .. E(a.s) Lox +8).8m²) (m)
where
x mix =1 - 1)- xx + x',
ImageNet. ImageNet (Russakovsky et al., 2015) is a large- scale visual database widely used in visual object recog- nition research. It contains over 14 million color images spanning more than 20,000 categories. popular subset of ImageNet, commonly used in research, comprises 1.2 mil- lion high-resolution images categorized into 1,000 classes, including animals, vehicles, and everyday objects. The dataset is divided into a training set with 1.2 million images and a validation set with 50,000 images. The validation set includes 50 images per class, ensuring balanced representa- tion across all categories. During preprocessing. the images are typically cropped to a size of 224 224 pixels.
gm = (1- - ())()) + t m
t~ U[0, 1/2)),
Here, / is uniformly sampled from [0, 1/2), forming con- vex combination between the original input and an adver- sarial sample, 1 is the uniform probability vector over the m labels, and Go (a:) denotes the estimated soft-smoothed prediction of æ calculated as the average softmax predic- tions of the base classifier the noisy sample + 6. The e' corresponds to the unrestricted adversarial sample of the smoothed classifier go for æ, which is obtained by solving:
HAM10K. The HAM10K dataset (Tschandl et al., 2018) comprises 10,015 images resulting from a comprehensive study conducted by multiple entities. Each image is in RGB format and has dimensions of 600 x 450 pixels (length x width). During preprocessing, the images are typically
K' = arg max (Ce v) B||x' - =01²) (13) x²'
Here, 3 ensures that the adversarial sample n' remains within a reasonable distance from æ, preventing it from being arbitrarily far. Note that while both mix and y depends on the model parameter 0, they are used only as targets during the forward pass, and the gradient with respect to 0 from this path is not propagated in the backward pass. For our reweighting adaptation, we modify the first term of the objective in Equation 12 to rebalance the robustness of cost-sensitive examples and normal examples. The final objective is defined as:
cropped to a size of 299 x 299 pixels. The dataset is de- signed to facilitate the study and classification of seven distinct types of skin lesions, including "Melanocytic nevi"" (6705 samples), "Dermatofibroma" (1113 samples), "Be- nign keratosis-like lesions" (1099 samples), "Basal cell car- cinoma" (514 samples), "Actinic keratoses" (327 samples), "Vascular lesions" " (142 samples), and "Dermatofibroma" (115 samples). Among these types, "Dermatofibroma" and "Basal cell carcinoma" are malignant, while the others are benign, forming highly imbalanced distribution between malignant and benign samples, closely mirroring real-world conditions. This collection serves valuable resource for advancing research in dermatological image analysis and skin lesion classification.
min lee E D E8- Do CCE (fo( 5).9)
+ E E fce (f + 6),9) (14)
+ n EE LCE (fo( (o + +0), mix)
D.3. Hyperparameters
D.2. Datasets
For Gaussian-CS. SmoothAdv-CS and SmoothMix-CSS the parameter À is carefully tuned to ensure the best trade-off be-
CIFAR-10. The CIFAR-10 dataset? consists of 60,000
"htps:/wwww.cs.trrottto edu/ kriz/cifar.html
hhnp::/ghhhaa.comm/sssttaaggnnee
16

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
sitive seed classes for CIFAR-IO, while we choose "chain saw" (label 3) and "gas pump" (label 7) for Imagenette. For the "S-Pair" setting in CIFAR-10,
Table Performance metrics under different (A1, A2) settings.
A
X2
Acc t
Robes t
Robcost +
examine the misclas- sification of "cat" (label 3) to "dog" (label 5), a common and challenging confusion given their visual similarity. The cor- responding "M-Pair" setting addresses misclassifications of "cat" (label 3) to "bird" (label 2). "deer" (label 4), and "dog" (label 5), covering a broader range of potential errors across both similar and dissimilar classes. In Imagenette, the "S-Puir" setting focuses on the misclassification of "gas pump" (label 7) to "church" (label 2), highlighting a sce- nario where structural similarities can lead to errors. The "M MM-Pair" setting for Imagenette considers misclassification of "gas pump" (label 7) to "church" (label 2). "chain saw" (label 4), and "garbage truck" (label 6), addressing di- verse set of challenging misclassifications that involve both contextual and structural similarities.
1
1
0.69
0.22
5.15
2
2
0.68
0.45
3.62
3
3
0.67
0.51
3.41
4
4
0.63
0.73
1.60
5
5
0.60
0.76
1.37
6
6
0.58
0.81
1.05
tween overall accuracy and cost-sensitive robustness, where we enumerate all values from (1.0, serve nearly in all cases of cost matrices, setting À = 1.1 achieves the best result. For MACER, the parameter À (which corresponds to the ratio between cross-entropy loss and robustness loss in Zhai et al. (2020) is fixed at 4 by default. Similarly, in our Margin-CS method, we set A = 3 and A2 = according to observation from Table 7.
and ob-
D.5. Certification Results with Varying Noises.
We present the results of varying hyperparameters " and 72 in our Margin-CS method, evaluated across the main metrics: Ace, Robs and Robcost- Our goal is to im- prove cost-sensitive robustness without sacrificing overall accuracy, where "1 controls the margin for normal classes and 72 for sensitive classes. We report results on CIFAR-10 under the "S-Seed" setting, where "cat" is selected as the sensitive seed class and misclassifications to other classes incur equal cost. This choice serves illustrative purposes, as similar trends are observed across other cost matrices, consistent with the results in Tables 1 and 2. A grid search (Table 8) reveals that the combination (71, 72) = (4, 16) yields satisfactory results.
Results with Varying a. We test the performance of our method under fixed Eg perturbations with c 0.25 when the standard deviation parameter of the injected Gaussian noises is 0.25. We demonstrate the results in Tables 9 and 10. The results show that our method consistently outperforms several baseline randomized smoothing methods and their reweighting counterparts.
Results with Varying We test the performance of our method under various E2 perturbations with different val- ues and fix the standard deviation parameter of the injected Gaussian noise to r 0.5, same as in Section 6. The re- sults, shown in Figure 5 for both seedwise and pairwise cost matrices, demonstrate the superiority of our method com- pared to several baseline randomized smoothing methods and their reweighting counterparts.
D.4. Detailed Experimental Setup
In our experiments, we use fstd. Fer-group. Pair returned by Algorithms 1 and 2 as the empirical approximation of the true certified radius defined in Lemma 3.2 and Definition 4. For all cost-sensitive learning methods, we choose the hy- perparameters based on the following selection criteria: it should yield high Robes (or low Robess) while Acc should be comparable to that of the baseline randomized smoothing methods designed for maximizing overall robustness.
D.6. Scalability for Large Datasets
We additionally validate the scalability of our certification framework and training methods by applying them to the full ImageNet dataset, where most traditional certification techniques fall short. The results, presented in Table 11, cover three typical scenarios involving selected seed classes with equal costs assigned misclassification into all other classes. The "S-Seed" scenario focuses on class labels "919" and "920", representing "street sign" and "traffic light and signals", respectively. Additionally, the "M-Seeds" scenario includes class labels "44" and "48", corresponding to different types of giant lizards. Misclassifications in these ImageNet classes can have serious consequences, such as safety risks in autonomous driving or real-world dangers.
For CIFAR-10, 10, Imagenette, and HAM10K, each experiment is run on a single NVIDIA 1000 GPU with 40 GB of mem- ory within one day. For the ImageNet dataset, each exper- iment is conducted on four NVIDIA A100 GPUs with 40 GB of memory for 1-2 days.
For the experiments with Equal Costs for Selected Misclas- sifications (Tables and 2 in the main paper), we use third class "cat" (label 3) for CIFAR- 10 and "gas pump" (label 7) for Imagenette in the "S-Seed" case. For the "M-Seed" case, "bird" (label 2) and "deer" (label 4) are considered as the sen-
Table 11 shows that our methods effectively enhance cost- sensitive robustness by approximately 15%-20% in Rob
17

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Table Performance Margin across different combinations 71 and 72 on CIFAR- "S-See"").
Myy 8
10
2/
12
Acc 1
Rob
Robeast
Ace
Rob
Robcot
Acc
Rob..
Robest 4
Acc
Roba,
Robeast :
65.4
63.3
2.62
63.4
68.7
2.49
63.7
69.1
2.48
63.0
70.5
2.51
71
67.0
50.7
3.56
65.3
59.7
65.9
57.6
3.44
66.1
3.04
71
67.3
66.0
49.3
65.5
54.4
64.9
55.2
3.23
66.0
33.8
65.0
13.2
61.1
17.4
61.5
46.3
3.77
Table 9. Certification results CIFAR-I0 for selected misclassifications with equal (a 0.25).
S-Seed
M-Seed
S-Pair
M-Pair
Method
Acc
Robs
Robou
Acc
Roba
Robas +
Acc
Rob,
Robad
Acc
Roba
Robest 1
Gaussian
79.3
40.7
3.79
79.3
58.8
2.96
79.3
67.4
79.3
51.5
1.27
SmoothMix
73.0
32.6
3.99
73.0
46.4
3.63
73.0
72.0
73.0
56.3
1.16
SmoothAdy
77.9
42.8
3.66
77.9
52.5
2.89
77.9
73.8
0.32
77.9
56.0
1,07
MACER
80.8
47.5
3.30
80.8
65.3
2,72
80.8
70.9
0.34
80.8
58.2
1.06
Gaussian- CS
77.8
58.3
2.39
78.4
63.5
2.61
77.8
81.1
0.39
77.8
68.5
1.18
SmoothMix-CC CS
72.2
60.2
2.99
72.1
47.3
2,85
72.2
75.7
0.26
72.2
73.8
0.70
Smoothhdvv-G CS
78.7
62.5
2.47
78.4
56.6
2.68
78.7
77.4
78.1
66.3
1.03
Margin
0.24
Table 10. Certification results on Imagenette for selected misclassifications with equal costs (a = 0.25).
S-Seed
M-Seed
S-Pair Rob,
M-Pair
Method
Acc
Rub,1
Rub
Acc
Rob,1
Rob
Acci
Robon
Acc
Rob,
Robout
Gaussian
80.3
65.6
3.41
80.3
61.2
3.21
80.3
88.0
0.22
80.3
73.0
1.20
SmoothMix
81.4
61.9
3.06
81.4
$9.2
2.82
81.4
83.3
0.25
81.4
78.5
1.71
SmoothAdv
77.8
66.6
3.30
77.8
59.3
3.08
77.8
90.9
0.20
77.8
80.4
MACER
79.6
70.1
2.78
79.6
66.2
3.13
79.6
83.7
0.21
79.6
78.0
Chussiaa CS
75.8
77..
2.64
76.4
66.66
76.4
"62
6.17
76..4
81.7
T.07
SmoothMix-CS
78.1
71.4
2.81
79.2
70.7
2.76
78.1
84.8
0.11
78.1
81.8
1.69
SmoothAdv-CC
77.7
70.6
2.91
77.7
60.5
2.74
77.7
91.8
0.08
77.6
82.0
1.06
Margin CS
83.6
75.6
2.34
81.9
73.2
2.52
83.6
94.2
0.04
82.6
88.0
0.84
1.0
Cost Sensitive Robustness
Dumbe Snockids
Cost- Cost-Sensitive Robustness
Guatin Decunbdy
Cost Senaitive Robustness
0.8
0.8
0.8
0.6
0.4
0.4
0.4
0.2
0.2
0.2
0.0
0.0
0.0
0.5
1.0
0.5
1.0
0.5
1.0
6
6
(a) CIFAR10, M-Seed (2,4)
(b) CIFAR10, S-Pair (3-> 5)
(c) Imagenette, M-Seed (3,7)
1.0
1.0
1.0
Sens-ivee Robustness
Cost-Sensitvve Robustness
Cost Sensitvee Robustness
teveldes
0.8
0.6
0.6
0.6
Magi-SS
0.4
0.4
0.2
0.2
0.2
0.0
0.0
0.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
0.5
1.0
1.5
2.0
(d) Imagenette, S-Pair (7-+2 2)
(e) ImageNet, M-Seed (44,48)
(f) ImageNet, S-Seed (920)
Figure 5. Certified accuracy for varying for different datasets and various matrix settings.
18

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
Margin-CS method is generally concentrated larger val- ues, which aligns with the quantitative results in Tables I and 2, demonstrating that Margin-CS generally achieves best certifiable robustness among all methods. Moreover, the improvement in certified radius is less pronounced for normal (i.e., non-sensitive) samples compared to sensitive samples, aligning with our primary goal of cost-sensitive learning, which prioritizes the accurate classification of "sen-
Table 11. Results (in %h) across various cost matrices ImageNet.
Method
M-Seed (44, 48)
S-Seed (919)
S-Seed (920)
Acc 1
Robs
Acc 1
Robs
Robg 1
15.0)
58.4
58.4
32,0
SmoothMix
51.4
41.4
64.4
52.0
G141
51.0
SmoothAdy
57.1
38.0
57.1
70.0
57.1
67.0
MACER
58.5
40.0
58.5
66.0
58.5
62.0
Gaussian-CS
18.6
53.0
62.4
78.0
51.0
62.0
SmoothMix-CS
48.6
47.0
51.6
70.0
51.2
58.0
SmoothhAdy CS
50.4
41.0
50.6
76.0
52.4
78.0
Margin CS
53.4
53.6
76.0
sitive" samples with high practical value.
compared to their standard counterparts across various cost- matrix settings, while largely preserving utility. Margin- CS consistently achieves the best cost-sensitive robustness, which aligns with our observations on other standard bench- mark datasets presented in the aforementioned sections.
D.7. Heatmap Analysis
To further analyze the trade-offs between our Margin- CS method and its non-cost-sensitive counterpart MACER, we present heatmaps illustrating clean and robust test errors in Figure 6. Compared to MACER, our Margin-CS method tends to focus more on the sensitive seed class "cat", sig- nificantly reducing misclassifications to other classes. This results in a lower overall clean test error for our method compared to MACER. Specifically, for the sensitive seed class "cat", the clean test error decreases from 40. % to 11.1%, demonstrating the effectiveness of our cost-sensitive training approach.
Among the normal classes, the most notable impact of our method is on the "dog" class, where misclassification rates to "cat" increase from 13.6% to 44.3%, while misclassifi- cation rates to other classes decrease from 17.4% to 9.2%. In our S-Seed cost-matrix settings, this increase in misclas- sification for the "dog" class is acceptable, long the overall misclassification rates are controlled. A similar trend is observed in the robust test enror map, where the robust test error for the "cat" class decreases, while that for the "dog" class increases. Along this line, an interesting direction for future work would to develop more balanced and robust training methods.
D.8. Visualization of Radius Distributions
We plot the distributions of certified radius provided by different robust training methods on the sensitive testing ex- amples (D,) in Figure the overall dataset (D) in Figure 8, and the normal subset (D,,) in Figure 9, respectively. As shown by comparing the two rows of subplots, all our cost- sensitive adaptive robust training methods shift the radius distributions towards larger values, indicating higher cost- sensitive robustness compared to their non-cost-sensitive counterparts. Additionally, the distribution produced by our
19

---

truck Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
target class
target class
plane car
bird
Cat
dog
frog
horse ship
truck
plane
car
birg
Cat
dee d
frog
horse
shi
truck
plane
2.7
plane
0.5
1.9
3.6
1.4
0.0
0.4
7.2
2.3
car- 0.4
0.3
0.6
0.3
044
0.4
0.0
2.6
5.9
car
bird
pair-wise error rate
bird
3.6
0.1
181
6.7
1.3
377
14
0.7
0.6
33%
pair-wise error rate
seed class
cat
0.9
2.8
15.7
9.8
2.5
seed class
cat-
0.9
0.3
1.5
1.4
2.3
299
0.9
0.3
0.6
deer
18
0.0
9.6
4.1
1.8
11.2
5.7
1.7
0.8
88%
deer-10
3.9
0.3
4.5
0.4
24%
dog
dog
frog
0.4
2.4
frog 0.3 0.4
1.7
14.4
1.9
0.5
0.2
0.3
0.3
horse
0.7
0.3
1.7
2.7
2.8
35
1.6
0.4
1.9
horse 0.7
1.7
0.2
0.3
0.9
ship
ship
8%
truck 14
6.6
0.2
1.3
0.1
0.3
0.6
0.8
3.0
truck
12
3.7
0.3
3.6
0.2
0.0
0.0
0.5
2.7
0%
0%
(a) MACER: Clean Error
(b) Margin- Clean Error
target class
target class
plane
Car
bird
cat
deer
dog
fr horse s ship
truck
plane
car
bird
deer
dog
frog
horse
ship
plane
40%
plane
19.5
72%
car 5.9
4.1
4.5
3.6
3.4
4.8
3.7
10.1
20.8
car 5.0
1.0
9.0
4.0
1.0
4.0
3.0
8.0
19.0
64%
bird
16.6
4.8
20.7
28.3
38.3
27.
15.7
7.0
5.5
parr-ii error rate
bird
17.6
4.6
44.4
29
34.8
30.6
13.9
11.1
4.6
56%
BSMM-JED
class
cat
P1.2
41.7
seed class
cat
8.4
48%
deer
11.9
20.0
17.8
52.4
25.7
5.3
24%
deer
8.4
29.5
22.1
2.1
40%
dog
6.9
3.5
20.4
33.2
16.2
10.2
17.5
5.2
5.7
dog
4.2
2.1
15.8
73.7
15.0
9.5
11.6
4.2
3.2
32%
frog
4.8
36.3
7.8
16%
frog
5.0
horse
12.8
horse
7.8
5.9
16%
ship-
13.4
9.7
5.3
4.9
6.3
4.0
4.1
4.1
9.2
ship
21.6
12.7
1.0
13.7
6.9
2.0
5.9
5.9
15.7
truck
7.1
8.6
4.4
5.5
7.7
truck
4.0
13.5
21.2
58
3.0
7.7
(c) MACER: Robust Error
(d) Margin-CSS Robust Error
Figure Figures (a) and (b): Heatmaps of clean test error on CIFAR-10 between MACER and Margin-CS, Figures (c) and (d): Heatmaps of robust test error on CIFAR-10 between MACER and Margin-CS. The cost matrix is set to be the "S-Seed" case.
20

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
0.04
0.04
0.44
0.04
0.03
0.33
0.03
Frequancy
Frequency
Frequency
Frequency
0.01
0.01
081
0.01
1.0
0.00
1,0 Radius
1.0
2.0
Radus
Radius
Radius
(a) Gaussian
(b) SmoothMix
(c) SmoothAdv
(d) MACER
0.04
0.04
0.04
0.04
Treqgencc
0.03
Friquency
0.03
Froquency
0.03
Frequency
0.03
0.01
0.1
0.01
0.01
0.00
0.00
0.00
Radius
Rodius
Radius
Radius
(c) Gaussian-CS
(f) SmoothMix-CS
g
SmoothAdv-cr
(h) Margin-Cr
Figure Distribution of Fougroup on testing samples D, under "S-Seed" setting on CIFAR-I0 10. x-axes are uniformly scaled across all plots, and the y-axes are truncated frequency of 0.04 for clarity in visualization.
0.04
0.04
0.04
0.04
Frequency
0.08
Frequency
0.33
Frequency
0.03
Frequency
0.09
0.01
0.01
0.1
0.01
000
0.00
2.0
Radius
Radius
Radius
Radius
(a) Gaussian
(b) SmoothMix
(c) SmoothAdv
(d) MACER
0.04
0.04
0.04
0.04
Frequancy
0.03
Frequency
0.03
Tequency
0.03
Frequency
0.09
0.01
0.01
0.01
0.01
0.00
0.0
1.0
2.0
0.00
1.0
1.5
2.0
Radius
Radius
Radius
Radius
(c) Gaussian-CS
(f) SmoothMix-CS
g
SmoothAdv-CS
(h) Margin-CS
Figure Distribution of goop on testing samples from under "S-Seed" setting on CIFARIO. The x-axes are uniformly scaled across all plots, and the y-axes are truncated at frequency of 0.04 for clarity in visualization.
21

---

Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing
0.04
0.04
0.6
0.04
Frequency
0.00
Frequency
0.03
Frequency
0.03
Frequency
0.01
0.11
0.1
0.01
0.00
2.0
2.0
Redius
Rediue
Radius
Radius
(a) Gaussian
(b) SmoothMix
(c) SmoothAdv
(d) MACER
0.04
0.04
0.04
0.04
Frequancy.
0.03
Frequency
0.03
Frsqunncy
0.03
Frequency
0.00
0.01
0.1
0.01
0.01
1.5
0.0
1.0
2.0
1.0
1.5
2.0
Radiue
Radiue
Radius
Radius
(c) Gaussian-CS
(1) SmoothMix-CS
(g) SmoothAdv
(h) Margin-CS
Figure Distribution of fougroup on testing samples from D., under "S-Seed" setting on CIFARIO. x-axes are uniformly scaled across all plots, and the y-axes are truncated at frequency of 0.04 for clarity in visualization.
22


Reviews:
[{"review_id": "I3TEtrJEZr", "reviewer": "Reviewer_789m", "summary": "The paper introduces a novel framework for adversarial robustness that incorporates cost-sensitive learning using randomized smoothing. Unlike existing defenses that assume uniform misclassification costs, this method optimizes robustness with a cost matrix that accounts for real-world risk variations (e.g., misclassifying malignant tumors as benign is costlier than the reverse). The main contributions include:\n\n- Cost-Sensitive Certified Radius: A new metric extending the standard certified radius to account for cost-sensitive adversarial robustness.\n- Certification Algorithm: A Monte Carlo-based method to estimate cost-sensitive robustness, ensuring statistically rigorous bounds.\n- Robust Training Method: A margin-based loss function that maximizes cost-sensitive certified robustness while maintaining accuracy.\n- Experimental Validation: The approach outperforms baselines such as standard randomized smoothing, SmoothAdv, and MACER on CIFAR-10, Imagenette, ImageNet, and the medical HAM10k dataset.\n\nThe results indicate that the method significantly enhances robustness, particularly in cost-sensitive scenarios, making it relevant for safety-critical applications.", "questions": "", "limitations": "", "rating": 5, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**1. Theorem 4.4 (Certified robustness estimate is statistically valid). The logic appears correct, but empirical verification (e.g., checking Monte Carlo estimates converge) would strengthen confidence.**  \n\nWe conduct the certification process using varying numbers of Monte Carlo samples, where N denotes the number of samples and r represents the certified radius returned by Algorithm 1. The results for the S-Seed setting are shown in the table below. We observe that as N increases, the certified radius gradually converges. Specifically, once N exceeds 50,000, the certified radius stabilizes and exhibits minimal fluctuation.  \n| N      | 100   | 500   | 1000  | 10000 | 50000 | 60000 | 70000 | 80000 | 90000 | 100000 |\n|--------|-------|-------|-------|-------|--------|--------|--------|--------|--------|---------|\n| r   0.4378| 0.6869| 0.7663| 0.9550| 1.0612 | 1.052  | 1.059  | 1.065  | 1.069  | 1.072   |\n\n\n**2. No Adaptive Attack Evaluation: The method is only tested under L2 norm perturbations.**  \n\nAs defined, randomized smoothing provides certified robustness against all attacks—including adaptive ones—within the certified radius. For this reason, prior works on randomized smoothing (and most certification-based methods in general) do not evaluate against adaptive attacks. While we agree that exploring the gap between certified robustness and empirical robustness (i.e., performance under actual attacks) is an interesting direction, it falls outside the scope of this submission.  \n\nAlthough randomized smoothing is formally defined for L2 norm perturbations, prior work has shown that it can be effectively extended to other norms [1,2]. As this generalization is well-established and independent of our main contributions, we do not focus on it here, but we are happy to provide relevant results upon request.\n\n[1] Yang, Greg, et al., \"Randomized Smoothing of All Shapes and Sizes\", ICML 2020\n[2] Vorácek, V., & Hein, M.,  \"Improving L1-Certified Robustness via Randomized Smoothing by Leveraging\nBox Constraints\", ICML 2023\n\n**3. Limited Discussion on Real-World Deployment: Practical constraints (e.g., computational cost, real-time processing) are not discussed.**  \n\nAs suggested, we report the training and inference time evaluated on a single A100 GPU (40 GB Memory). During training, we employ a margin-based loss to optimize the cost-sensitive certified radius, which necessitates a substantial amount of Gaussian sampling (e.g. 16) for accurate radius estimation, as well as sufficient epochs to ensure convergence. This results in a slight increase in the training time. During inference, they all share the same certification procedure, so their certification time is nearly identical.\n\n| Method| Gaussian | SmoothAdv | SmoothMix | MACER | Gaussian-CS | SmoothAdv-CS | SmoothMix-CS | Margin-CS |\n|----------------|----------|-----------|-----------|-------|-------------|---------------|--------------|-----------|\n| Training Time  |0.2h |11.53h| 2.68h|13.5h|0.2h|11.53h| 2.69h|13.4h |\n| Inference Time | 2.38s |2.27s| 2.28s | 2.25s | 2.39s | 2.27s | 2.28s        | 2.28s|\n\n\n**4. What is the computational overhead of certification? How does Monte Carlo certification time scale with input dimensions and the number of classes? Can the method be extended to other robustness frameworks?**\n\nThe overall certification cost is $O(N\\times T_{fwd})+O(C)$, where $N$ is the Gaussian sampling number and $T_{fwd}$ is the cost per forward pass (depends on model size and input dim), $C$ is the number of classes. \n$O(C)$ is due to post-processing steps after the Monte Carlo sampling. This includes operations like finding the top classes, computing confidence bounds, and estimating per-class certified radii. While this cost is small compared to the sampling phase, it scales linearly with the number of classes \n$C$. Our certification algorithm is compatible with any robustness framework. It is independent of the training procedure and can also be integrated into diffusion-based certification methods (as shown in the reponse to **Reviewer KFXn**), The values in parentheses correspond to our method.\n\n| Setting| Overall Acc| $Rob_{cs}$|$Rob_{cost}$|\n|--|--|---|----|\n| S-seed| 67.12 (**67.5**) | 28.04 (**46.8**) | 4.357 (**3.04**) |\n| M-seed| 67.12 (**67.5**) | 36.45 (**54.8**) | 4.49 (**3.07**)  |\n| S-Pair| 67.12 (**67.5**) | 61.68 (**92.4**) | 0.43 (**0.05**)  |\n| M-Pair| 67.12 (**67.5**) | 33.64 (**80.4**) | 1.636 (**0.35**) |\n\n**5. Ablation Study & Sensitivity Analysis: Adding a hyperparameter sensitivity analysis would improve the practical usability of the method.**\n\nPlease refer to our **Response 2 to Reviewer AS48** for the hyperparameter sensitivity analysis. The experimental results show that the parameter $\\lambda$, $\\gamma$ controls the trade-off between overall accuracy and cost-sensitive performance. We will include more details on the ablation study and sensitivity analysis in the Appendix of the revised manuscript.", "claims_and_evidence": "The paper's main claims are:\n\n1. Cost-sensitive certified radius provides better robustness guarantees (Theorem 4.2).  Supported by theoretical proof showing it generalizes the standard certified radius.\n2. Monte Carlo-based certification is statistically valid (Theorem 4.4). Proof provided using a union bound argument.\n3. Proposed training method (Margin-CS) improves cost-sensitive robustness without degrading accuracy. Extensive experimental results demonstrate a ~20% improvement over baseline methods.\n4. Scalability to high-dimensional models (e.g., ImageNet). Empirical evidence shows that the approach works on large datasets where previous methods struggle.\n\nAll claims are well-supported, with both theoretical and empirical validation.", "methods_and_evaluation_criteria": "- The benchmark datasets (CIFAR-10, Imagenette, ImageNet, HAM10k) are appropriate, covering both general vision tasks and real-world cost-sensitive applications (e.g., medical imaging).\n- The metrics used (Certified Robust Cost, Certified Cost-Sensitive Robustness, Certified Accuracy) effectively measure both overall robustness and cost-sensitive robustness.\n- The comparison to baselines is thorough, including standard randomized smoothing and adversarial training methods.", "theoretical_claims": "I checked the following theoretical claims:\n\n- Theorem 4.2 (Cost-sensitive certified radius is always greater than or equal to the standard certified radius). Proof follows from standard randomized smoothing principles and the monotonicity of $\\phi^{-1}$. Mathematically sound and intuitive.\n\n- Theorem 4.4 (Certified robustness estimate is statistically valid). Proof relies on union bounds and confidence interval estimation. The logic appears correct, but empirical verification (e.g., checking Monte Carlo estimates converge) would strengthen confidence.", "experimental_designs_or_analyses": "- Certifications for cost-sensitive robustness are evaluated on diverse datasets and settings.\n- Robustness is tested across multiple perturbation budgets ($\\epsilon$-values).\n- Results on HAM10k confirm the method's relevance to medical AI.\n\nWeakness\n- No ablation study on the effectiveness of different training components (e.g., margin-based loss vs. alternative approaches).\n- Robustness to $l2$ perturbations (e.g., adversarial patches, feature space attacks) is not explored.", "relation_to_broader_scientific_literature": "The paper is highly relevant to ongoing research in:\n\n- Certified Adversarial Robustness: Extends works like Cohen et al. (2019) on randomized smoothing.\n- Cost-Sensitive Learning: Builds on prior methods like Zhang & Evans (2019) but improves scalability and certification guarantees.\n- Medical AI and Risk-Aware ML: Addresses real-world concerns in safety-critical AI (e.g., healthcare, autonomous systems).\n\nThe work bridges the gap between adversarial robustness and cost-sensitive classification, making it an important contribution.", "essential_references_not_discussed": "NA", "other_strengths_and_weaknesses": "Strengths\n- Strong Theoretical Guarantees: Provides mathematical proofs for all major claims.\n- Scalable to Large Models: Works on ImageNet and HAM10k, where previous cost-sensitive methods struggled.\n- Real-World Applicability: Demonstrates importance in medical AI.\n- General Framework: Extends randomized smoothing to cost-sensitive settings in a principled manner.\n\nWeaknesses\n- No Adaptive Attack Evaluation: The method is only tested under $l2$-norm perturbations.\n- Lack of Hyperparameter Sensitivity Analysis: Does not explore robustness to different $\\sigma$, $\\delta$ values.\n- Limited Discussion on Real-World Deployment: Practical constraints (e.g., computational cost, real-time processing) are not discussed.", "other_comments_or_suggestions": "- Sensitivity Analysis: Adding a hyperparameter sensitivity analysis ($\\sigma$, $\\delta$, $\\gamma$) would improve the practical usability of the method.\n- Adaptive Adversarial Attacks: Evaluating the approach against adaptive attacks (e.g., AutoAttack, patch-based attacks) would strengthen the robustness claims.\n- Ablation Studies: Analyzing the contributions of individual training components (margin-based loss vs. standard cost-sensitive learning) would clarify which aspects drive performance gains.", "questions_for_authors": "1. How does the method perform under adaptive attacks? Randomized smoothing is not foolproof against strong adaptive attacks (e.g., query-based attacks). Have you tested against adaptive adversarial strategies, and if so, how does the method hold up?\nWhat is the computational overhead of certification?\n\n2. Monte Carlo-based certification can be computationally expensive. How does the certification time scale with input dimensions and the number of classes? Can the method be extended to other robustness frameworks?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "mk1Ag9HPtV", "reviewer": "Reviewer_AS48", "summary": "This paper considers certified robustness when the cost between the correct label and the incorrect one is non-uniform. Specificially, author proposed a certification method via randomized smoothing and the corresponding provable training algoriothm in this context.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**1. The authors should report the performance variance**\n\nWe conduct three independent runs of the Imagenette S-Seed setting and report the corresponding standard deviations. The experimental procedure comprises two distinct stages: the training phase and the certification (evaluation) phase. The majority of variance arises during training, while variance during certification is negligible due to extensive Monte Carlo sampling and majority voting, which together ensure stable and consistent results. As shown, running all the baselines and our method multiple times does not affect the claims nor findings. We will include performance variance details to further strengthen the manuscript.\n\n| Methods       | $Acc$ (± std)   | $Rob_{cs}$ (± std)   | $Rob_{cost}$ (± std)   |\n|---------------|---------------|---------------|----------------|\n| Gaussian      | 80.3 (0.22)    | 64.6 (0.32)    | 3.67 (0.006)   |\n| SmoothAdv     | 80.2 (0.17)    | 64.3 (0.25)    | 3.91 (0.007)   |\n| SmoothMix     | 80.6 (0.19)    | 59.5 (0.50)    | 2.93 (0.032)   |\n| MACER         | 78.2 (0.10)    | 63.8 (0.16)    | 2.46 (0.004)   |\n| Gaussian-CS   | 74.6 (0.09)    | 73.3 (0.24)    | 1.67 (0.009)   |\n| SmoothAdv-CS  | 77.6 (0.14)    | 66.6 (0.31)    | 3.82 (0.016)   |\n| SmoothMix-CS  | 76.1 (0.09)    | 68.9 (0.48)    | 2.24 (0.042)   |\n| Margin-CS     | 79.6 (0.01)    | 81.1 (0.15)    | 1.35 (0.008)   |\n\n**2. Ablation study on hyper-parameters**\n\nThere are two stages in the hyperparameter tuning process. In the first stage, $\\lambda_1$ and $\\lambda_2$ control the overall trade-off between certified accuracy and cost-sensitive robustness. As expected, increasing $\\lambda_1$ and $\\lambda_2$ leads to a decrease in overall accuracy but an improvement in cost-sensitive robustness. We set $\\lambda_1 = \\lambda_2 = 3$ to achieve a favorable balance between the two objectives.\n\nIn the second stage, we fix $\\lambda_1$ and $\\lambda_2$ and tune $\\gamma_1$ and $\\gamma_2$. Here, $\\gamma_1$ determines the margin threshold for selecting normal samples, while $\\gamma_2$ controls the threshold for sensitive samples. We observe that increasing $\\gamma_2$ enhances cost-sensitive performance, whereas increasing $\\gamma_1$ improves overall accuracy, but will decrease cost-sensitive performance. A grid search reveals that the combination $(\\gamma_1, \\gamma_2) = (4, 16)$ yields satisfactory results.\n\nWe will include these details in the revised manuscript's Appendix.\n\n| $\\lambda_1$ |$\\lambda_2$|$Acc$| $Rob_{cs}$|$Rob_{cost}$|\n|-|-|-|-|-|\n| 1 | 1 | 0.690 | 0.22| 5.150 |\n| 2 | 2 | 0.682| 0.435  | 3.619 |\n| 3 | 3 | 0.667 | 0.510|3.407 |\n| 4| 4 | 0.631| 0.732 | 1.597|\n| 5 | 5 | 0.603 | 0.762 | 1.367|\n| 6 | 6 | 0.578 | 0.811| 1.046|\n\n| γ1  |$Acc$(γ2=8) | $Rob_{cs}$(γ2=8) | $Rob_{cost}$ (γ2=8) | $Acc$ (γ2=10) | $Rob_{cs}$ (γ2=10) |$Rob_{cost}$ (γ2=10) | $Acc$(γ2=12) | $Rob_{cs}$(γ2=12)|$Rob_{cost}$(γ2=12) | Acc (γ2=16) |$Rob_{cs}$(γ2=16) | $Rob_{cost}$(γ2=16)|\n|-----|-- |-- |-- |-- |-- |--|--|--|--|--|-|--|\n|  2| 65.4| 63.3| 2.617| 63.4 | 68.7| 2.488| 63.7| 69.1| 2.484|63.0|70.5   | 2.505|\n|  4| 68.2| 49.7| 3.558| 67.9| 52.6| 3.477| 67.7| 54.3| 3.444| 67.5 | 54.8| 3.040|\n|  6| 67.3| 39.6| 3.878| 66.0| 49.3| 3.546|65.5|54.4| 3.362 | 64.9 | 55.2 | 3.231 | \n| 8 | 66.0 | 33.8  |4.390 | 65.0 | 43.2 | 4.137| 64.1 | 47.4 | 3.921 | 64.5 | 46.3 |3.768 |", "claims_and_evidence": "The claims in this paper are convincing and supported by clear evidence.", "methods_and_evaluation_criteria": "The methods and evaluation criteria are mostly convincing. One concern is that the authors should report the performance variance by running the algorithm multiple times given a relatively narrow gap between the proposed method and the baselines, like some cases in Table 3.", "theoretical_claims": "The theoretical claims are convincing, while the proof technique is based on Cohen et al 2019.", "experimental_designs_or_analyses": "The experiments are consistent with the theoretical setup and are convincing. However, I suggest the author conduct an ablation study on hyper-parameters $\\lambda_1$, $\\lambda_2$, $\\gamma_1$, and $\\gamma_2$, showing how sensitive the performance is to these hyper-parameters and how these hyper-parameters affect the overall performance.", "relation_to_broader_scientific_literature": "The provable robustness is a crucial problem in situations where the tolerance of mistakes is very low. The motivation and the applicable situations of the method make sense. I believe this paper can contribute and raise some interest in the adversarial machine learning community.", "essential_references_not_discussed": "N.A.", "other_strengths_and_weaknesses": "The strengths and weaknesses are demonstrated in the sections above. Overall, I think it is a good paper. I welcome the authors to address my concerns in the rebuttal and will re-evaluate the manuscript during the discussion period.", "other_comments_or_suggestions": "N.A.", "questions_for_authors": "The questions are summarized as follows:\n\n1. The authors should report the performance variance by running the algorithm multiple times given a relatively narrow gap between the proposed method and the baselines, like some cases in Table 3.\n\n2. I suggest the author conduct an ablation study on hyper-parameters $\\lambda_1$, $\\lambda_2$, $\\gamma_1$, and $\\gamma_2$, showing how sensitive the performance is to these hyper-parameters and how these hyper-parameters affect the overall performance.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {"ethical_review_concerns": "N.A."}}, {"review_id": "hTWjyr86u1", "reviewer": "Reviewer_KFXn", "summary": "This paper introduces an adversarial training algorithm aimed at enhancing cost-sensitive robustness. The writing is clear, and the methodology appears sound within the context of the paper. However, I have concerns regarding the motivation, and the evaluation lacks several critical experiments.\n\n## Update after Rebuttal\nThe two-round rebuttal did not address my concerns, so I maintain my recommendation: 1. Reject.\n\nThere have been prior works on certified adversarial defense via random smoothing, as well as on cost-sensitive learning. My understanding of this work, after reading the rebuttal, is that it applies certified adversarial defense via random smoothing to cost-sensitive learning. This leads to my first and main concern: why this particular combination? Why not apply adversarial training or other defenses to cost-sensitive learning? Which method is more effective in this context?\n\nThe authors explain why randomized smoothing cannot be used for adversarial training, but that was not my question. What I asked is for a comparison between \"adversarial training\" and \"certified adversarial defense via random smoothing\" when applied to cost-sensitive learning. This key question remains unaddressed.\n\nThe reason I ask for a comparison (including results using standard classification metrics) is because the authors claim this work as an adversarial defense. A defense method must be evaluated under realistic threat models, considering the knowledge available to both attackers and defenders. However, the authors also acknowledge that certified defenses struggle against unseen attacks. On the other hand, although they claim that adversarial training generalizes poorly to unseen attacks, latest adversarial training was specifically designed to address this challenge and has evolved with many strategies to improve robustness (as shown in recent works listed in RobustBench). To support the claim that this method is practical and effective, the authors must provide comprehensive evaluations.\n\nEven if we narrow the scope to the context of this study (applying certified adversarial defense via random smoothing to cost-sensitive learning), I still do not see references to or use of the latest methods in either area, even after the rebuttal. It is unclear whether the authors mean that there is no recent work on certified adversarial defense via random smoothing or cost-sensitive learning individually, or that there is no recent work combining the two.\n\nMy suggestion to the authors: If this work aims to bridge the gap between certified adversarial defense and cost-sensitive learning, then the narrative should not center on defense. Instead, the focus should be on understanding and addressing the gap between cost-sensitive and cost-insensitive learning when applying certified defenses. It is also important to discuss how different cost-sensitive learning algorithms and certified defense techniques may affect the effectiveness of bridging this gap.", "questions": "", "limitations": "", "rating": 1, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**1. It is essential to report the robust accuracy of both cost-sensitive and non-sensitive adversarial examples separately.**  \n\n|Method|$Rob_{cs}$|$Rob_{normal}$|\n| -------- | -------- | -------- \n|Gaussian |22.9|49.8| \n|SmoothAdv|26.3 |52.5| \n|SmoothMix |16.8|52.7| \n|MACER|27.4|54.3| \n|Gaussian-CS|50.9|43.7| \n|SmoothAdv-CS|53.6 |48.8| \n|SmoothMix-CS|26.4|50.7| \n|Margin-CS|54.8|48.3| \n\n\nThanks for the suggestion. We report the cost-sensitive robustness for both sensitive and non-sensitive examples under the CIFAR-10 S-Seed setting. As expected, there exists a trade-off in certified robustness performance between these two types of samples, which aligns with our training objective: a smaller margin threshold $\\gamma_1$ is used for normal examples, while a larger margin threshold $\\gamma_2$ is applied to sensitive examples. \n \n**2. The details of the attacks used in the experiments are not disclosed**  \nAs defined, randomized smoothing provides certified robustness against all attacks within the certified radius. For this reason, prior works on randomized smoothing—and most certification-based methods in general—do not explicitly specify a threat model or evaluate against empirical (adaptive) attacks. Following this convention, neither do we. \n\n**3. The paper does not compare its approach with the most relevant work, such as Zhang et al. (2023), nor does it include comparisons with other regular adversarial training methods.**\n\nWe report the performance comparison between our method and DiffSmooth, as proposed by Zhang et al. (2023). Our Margin-CS results are presented in parentheses for direct comparison with DiffSmooth. As shown in the table, our method consistently outperforms DiffSmooth across all cost-matrix settings by a significant margin. Furthermore, our method achieves an inference time of 2.28 seconds per image, whereas DiffSmooth requires 89 seconds per image (~40 times slower), highlighting the efficiency and practicality of our approach for real-world deployment. \n\n| Method | $Acc$| $Rob_{cs}$|$Rob_{cost}$|\n|--|--|---|----|\n| S-seed| 67.12 (**67.5**) | 28.04 (**46.8**) | 4.357 (**3.04**) |\n| M-seed| 67.12 (**67.5**) | 36.45 (**54.8**) | 4.49 (**3.07**)  |\n| S-Pair| 67.12 (**67.5**) | 61.68 (**92.4**) | 0.43 (**0.05**)  |\n| M-Pair| 67.12 (**67.5**) | 33.64 (**80.4**) | 1.636 (**0.35**) |\n\n**4. The novelty of the proposed method in comparison to Zhang et al. (2023)**    \nZhang et al. 2023 enhances randomized smoothing for *general robustness* by using a diffusion model as a denoiser before passing the noisy input to the target model. In contrast, our work improves randomized smoothing for *cost-sensitive robustness* (which existing approaches cannot achieve) through a novel training paradigm. As these approaches are algorithmically distinct and directionally orthogonal, we do not see a particularly strong connection between them—beyond both falling under the broader category of randomized smoothing. \n\n**5. Specifically, the overall accuracy presented in Table 1 and Table 11 is noticeably lower than that of state-of-the-art (SOTA) adversarial training methods (refer to RobustBench).**  \n\nAs briefly mentioned in the above **response 2**, there is an inevitable gap between empirical robustness (i.e., potentially effective against *specific* attacks, such as adversarial training) and certified robustness (i.e., provably effective against *all* possible attacks within a bounded perturbation, e.g., randomized smoothing). Simply speaking, the noise scale incorporated in randomized smoothing framework is much larger than that in adversarial training, since empirical attacks focus on imperceptible perturbations, whereas rigorous certification requires a reliable computation of the certified radius. This difference is then reflected in the model's clean accuracy. While a deeper investigation into the gap between these two fields would be an interesting direction, it falls outside the scope of this submission. \n\n**6. The proposed method should be compared with regular adversarial training methods, as these are designed to generalize across all adversarial scenarios.**  \n\nAs mentioned above, the training noise used in randomized smoothing baselines is significantly larger than that used in adversarial training methods. To illustrate this discrepancy, we evaluated the certified robustness of the top two methods on RobustBench—MeanSparse and adversarial training enhanced by diffusion models—and found that their certified performance is close to zero. This highlights the fundamental mismatch between the goals of empirical adversarial training and certification-based approaches: the former aims to improve empirical robustness under small, often imperceptible perturbations, while the latter focuses on providing formal robustness guarantees under much larger perturbation regimes.", "claims_and_evidence": "* I do not agree with the motivation that defending against cost-sensitive adversaries is fundamentally different from regular adversarial training. The paper lacks both theoretical justification and empirical demonstrations to support this distinction.\n* The paper does not report clean accuracy, despite the fact that maintaining clean accuracy in adversarial training is a well-known challenge. The authors claim in 033 that their method mitigates this issue, yet no supporting evidence is provided.\n* It is essential to report the robust accuracy of both cost-sensitive and non-sensitive adversarial examples separately. The drop in robust accuracy for non-sensitive adversarial examples, similar to clean accuracy, should be carefully examined.\n* The paper provides limited background on cost-sensitive robustness in introduction (only 050), which is crucial for distinguishing it from standard adversarial robustness. Readers must refer to Section 4 for further details.", "methods_and_evaluation_criteria": "* The proposed methodology appears to be derived from Zhang et al. (2023), although their work was not specifically designed for cost-sensitive robustness. Could the authors clarify the differences in the algorithm, aside from the application/scenario context?", "theoretical_claims": "The authors provide sufficient mathematical proofs in the appendix.", "experimental_designs_or_analyses": "* The details of the attacks used in the experiments are not disclosed,\n* The paper does not compare its approach with the most relevant work, such as Zhang et al. (2023), nor does it include comparisons with other regular adversarial training methods. Specifically, the overall accuracy presented in Table 1 and Table 11 is noticeably lower than that of state-of-the-art (SOTA) adversarial training methods (refer to RobustBenck).\n* Given the lack of disclosure regarding attack details, it remains unclear whether the defense has been evaluated against unseen or adaptive attacks, which are crucial for assessing defenses.", "relation_to_broader_scientific_literature": "No comment.", "essential_references_not_discussed": "The references are outdated, with no publications from 2023-2024 cited. Furthermore, the authors should include comparisons with regular adversarial training methods featured in RobustBench (https://github.com/RobustBench/robustbench).", "other_strengths_and_weaknesses": "No comment.", "other_comments_or_suggestions": "No comment.", "questions_for_authors": "My current assessment falls between scores 1 and 2 due to several concerns. However, if these concerns are adequately addressed, I would be open to revising my score and potentially raising it above 2.\n1. The proposed method should be compared with regular adversarial training methods, as these are designed to generalize across all adversarial scenarios. It would represent a good contribution if the proposed method demonstrates superior performance, even if only in the context of cost-sensitive robustness.\n2. Clean accuracy, as well as robust accuracy for both cost-sensitive and non-sensitive adversarial examples, must be reported separately for a more comprehensive evaluation.\n3. The novelty of the proposed method in comparison to Zhang et al. (2023) should be clearly articulated, beyond just the application domain.\n4. The details of the attacks used in the experiments must be disclosed to ensure transparency and reproducibility.\n5. A literature review that includes relevant works from 2024 is expected. If there are no significant new contributions, this should be explicitly stated for the readers.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper introduces a framework for adversarial robustness that integrates cost-sensitive learning with randomized smoothing. Some reviewers noted that the method significantly improves robustness, particularly in cost-sensitive settings, making it relevant for safety critical applications. There were suggestions to include ablation studies to further support the results. Several comments pointed out the need for a stronger discussion of related work and a clearer comparison with prior approaches.
Decision: Accept (poster)