Lion Cipher Lab
Certify a model's adversarial robustness with randomized smoothing (a guarantee, not a survival record)
- AI Security
- Advanced
- ~80 min
- Free · no account required
Why it matters
Every empirical robustness number you can produce — including the worst-case-across-AutoAttack figure from the sibling lab — carries an asterisk you can never remove: it means 'no attack I TRIED changed the label,' and a stronger attack invented next year can only DRIVE THAT NUMBER DOWN. That is fine for most systems, but there are settings where 'we couldn't break it' is not good enough and you need 'it CANNOT be broken': a perception stack that steers a car, a malware classifier whose bypass is a breach, a medical model whose flip is a misdiagnosis. A CERTIFIED defense answers that stronger…
What you'll learn
- the empirical-vs-certified distinction made concrete: why 'survived every attack I ran' is an UPPER bound that a future attack can only lower, while a certificate is a LOWER bound that no attack can ever beat
- the randomized-smoothing construction: turning a base classifier f into a smoothed classifier g(x) = the class f returns most often when x is perturbed by Gaussian noise N(0, sigma^2 I)
- why the base model MUST be trained on Gaussian-noise-augmented inputs — and watching smoothed accuracy collapse when it isn't
- implementing Cohen et al.'s Monte-Carlo predict: sample n0 noisy copies, take the majority class, and ABSTAIN when the top class isn't a statistically clear winner
- implementing certify: sample a larger n, count votes for the top class, and get a one-sided Clopper-Pearson LOWER confidence bound p_A on its true probability (statsmodels proportion_confint / scipy beta.ppf)
- the certified-radius formula R = sigma * Phi^{-1}(p_A_lowerbound) and reading it as an L2 guarantee: no perturbation of L2 size <= R can flip this prediction
- producing the standard certified-accuracy-vs-L2-radius CURVE for several sigmas, and reading the robustness/accuracy trade-off straight off it
- the abstention behavior as a FEATURE — a smoothed classifier that says 'I don't know' rather than guess when the vote is close
- naming the limits out loud: L2-only (not Linf directly), the thousands-of-forward-passes compute cost per certified point, and that certified radii on real images are still small
- the judgment of WHEN a certificate earns its cost (high-assurance settings) versus when empirical robustness is enough
Steps in this lab
- Empirical vs certified: why a certificate is a different KIND of claim
- Set up: train a NOISE-AUGMENTED base classifier (and see why the noise is mandatory)
- Build the smoothed classifier g and implement Monte-Carlo predict (with abstain)
- Certify one input: the Clopper-Pearson lower bound and R = sigma * Phi^{-1}(p_A)
- The payoff: certified-accuracy-vs-L2-radius CURVE for several sigmas
- The judgment: what the certificate is worth, its limits, and when NOT to reach for it