Dual Randomized Smoothing: Beyond Global Noise Variance

arXiv:2512.01782 · cs.LG, cs.AI · Submitted 2025-12-01 · Read on arXiv

Listen

Radio episode about this paper

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Next we'll be talking about the paper "Dual Randomized Smoothing: Beyond Global Noise Variance".

Jane: The paper was written by Chenhao Sun, Yuhao Mao and Martin Vechev from ETH Zürich.

Tom: Stay tuned as we take you through the paper and discuss its implications.

Title: Tom: We're starting with a heavy hitter from ETH Zürich titled "Dual Randomized Smoothing: Beyond Global Noise Variance." The authors, Chenhao Sun, Yuhao Mao, and Martin Vechev, are really digging into the cracks of current AI security.

Jane: You mean because they're looking at how models handle adversarial changes?

Tom: Exactly, Jane, because right now we use one single noise level for everything.

Jane: And that creates a massive problem where you have to choose between accuracy and safety.

Lu: That's why current models feel so fragile when they encounter something slightly unexpected. If we could let the model choose its own defense based on what it's looking at, we'd be in a completely different league of intelligence.

Meng: I wonder if that flexibility comes with a heavy cost for the hardware running these things. If every single image requires a custom calculation for noise, my servers might struggle to keep up with the demand.

Lalam: It's that exact tension between speed and safety that determines whether people actually trust these systems in their daily lives. Moving toward adaptive defenses makes technology feel less like a rigid tool and more like a reliable partner.

Tom: And that's where the "dual" part of the name comes into play to solve that tension.

Paper discussion segment 2: Tom: Jane, how do they actually implement this "dual" approach to fix that trade-off?

Jane: They use two different models working in tandem, Tom. One model acts as a variance estimator to predict the best noise level for a specific input, and then a second model does the actual classification using that specific value.

Tom: So it's like having one part of the system decide how much protection is needed before the main task even starts?

Jane: That's exactly right.

Lu: And they actually proved that this works as long as that noise level stays roughly the same in a small area around the input. This mathematical guarantee of "local constancy" is what makes this more than just a clever trick.

Meng: I noticed they mention about a sixty percent increase in computational overhead for this setup. For a production environment, that's quite a jump from standard methods.

Lalam: But look at the results on ImageNet and CIFAR-ten where they see massive improvements in certified accuracy. When an AI can be both highly accurate and provably safe, it opens doors to using these models in much more sensitive areas of society.

Tom: They didn't just stop at the architecture, though; they also had to rethink how to train these two pieces together.

Paper discussion segment 3: Tom: The training process sounds pretty intense since they have to optimize both the estimator and the classifier iteratively.

Jane: They even use something called soft labels to make the training smoother, Tom. Instead of forcing the estimator to pick one perfect noise level, it learns that being close to the optimal value is still very helpful for safety.

Tom: That sounds like it makes the whole system much more resilient to small errors during training.

Jane: It really does, and they combine that with consistency regularization to keep everything stable.

Lu: I was also really drawn to their routing concept where the estimator acts as a controller for different specialized models. You could have a whole collection of expert models, each great at a specific noise level, and the system just picks the best one for the job.

Meng: That approach is actually quite smart from an engineering standpoint because it lets us use off-the-shelf experts instead of training one massive model from scratch. I'll be curious to see if this routing scales as we move toward even larger datasets.

Lalam: This kind of modularity allows for a much more sophisticated ecosystem of intelligence. It moves us closer to a world where AI can adapt its own cognitive strategies based on the context it faces.

Tom: We've definitely covered a lot of ground today on this paper.

Conclusion: Tom: We're wrapping up our look at "Dual Randomized Smoothing: Beyond Global Noise Variance." It feels like we're moving from static defenses to something much more dynamic and intelligent.

Jane: I agree, Tom, especially since the mathematical foundation provided by the ETH team gives us a real sense of security.

Lu: This research is a huge step toward making machine intelligence truly robust in an unpredictable world.

Meng: I'll be keeping an eye on how these iterative training strategies perform when they hit high-pressure, real-world production environments.

Lalam: And I see this as a vital building block for technology that can finally meet the complexity of human culture with true reliability.

Jane: That's a perfect note to end on.

Tom: Thanks to everyone for joining us, and we'll see you next time!

ETH Zürich

cs.LG, cs.AI

Submitted: 2025-12-01

Updated: 2026-09-15

Comments: ICLR'26

Code: https://github.com/eth-sri/Dual-Randomized-Smoothing

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 80/100

The gist: This paper introduces Dual Randomized Smoothing (Dual RS), a framework designed to overcome the "fundamental limitation" of standard Randomized Smoothing (RS).

Key concepts

Dual Randomized Smoothing
Instead of using one fixed noise level for all inputs, this approach uses two models working in tandem. One model predicts the best noise level for a specific input, while a second model performs classification using that value, improving both accuracy and safety.
Variance Estimator
This component acts as a controller within the dual system. It analyzes an input to determine the optimal amount of noise required for protection before the main classification task begins, allowing for more adaptive and intelligent defenses.
Local Constancy
This is a mathematical guarantee that ensures the dual approach remains effective. It requires that the predicted noise level stays roughly consistent within a small area around the input, making the system's safety improvements more than just a clever trick.

Terminology

Summary

This paper introduces Dual Randomized Smoothing (Dual RS), a framework designed to overcome the fundamental limitation of standard Randomized Smoothing (RS). While traditional RS relies on a global noise variance that forces a trade-off between accuracy at small and large radii, Dual RS enables input-dependent noise variances. This allows for a more flexible and effective approach to certifying the robustness of neural networks against 2-norm adversarial perturbations.

The limitation of global variance

Standard RS is constrained by an inherent accuracy-robustness trade-off because it applies a single noise variance shared across all inputs. As the paper illustrates, achieving high accuracy at small radii requires a small noise variance, while achieving high accuracy at large radii requires a large noise variance. Consequently, there exists no global noise variance that simultaneously achieves strong performance at both small and large radii. Existing attempts to adapt noise per input have been limited by test-time memorization, restricted adaptivity, or the tendency to systematically over-estimate the optimal variance.

How it works

The authors prove that RS certification remains valid as long as the noise variance is locally constant within the certified region. Building on this, the Dual RS framework consists of two primary components:

  1. A variance estimator that first predicts an optimal noise variance for each input.

  2. A standard RS classifier that uses this estimated variance for inference.

To ensure validity, the variance estimator is independently smoothed via RS to ensure local constancy. The final certified radius is then guaranteed by R final = (R sigma, R c), where R sigma is the certified radius for the estimation of sigma c(x) and R c is the certified radius for the classification.

Training and routing perspectives

The framework utilizes efficient training strategies to iteratively optimize the two components. This involves an alternating training scheme where the variance estimator is trained using soft labels and consistency regularization, followed by finetuning the classifier under the estimated noise variances.

Furthermore, the paper introduces a routing perspective for certified robustness, where the variance estimator acts as a router that selects an appropriate off-the-shelf expert RS model from a pool of specialized models. This allows the framework to leverage specialized models that excel in specific noise regimes, improving the accuracy-robustness trade-off without requiring a single model to perform well across all noise levels.

Experimental results

Extensive evaluations on CIFAR-10 and ImageNet demonstrate that Dual RS provides strong performance for both small and large radii—unattainable with global noise variance. On CIFAR-10, the method achieved relative improvements of 15.6%, 20.0%, and 15.7% at radii 0.5, 0.75, and 1.0, respectively. On ImageNet, it delivered performance advantages of 8.6%, 17.1%, and 9.1% at radii 0.5, 1.0, and 1.5. Notably, these gains are achieved while incurring only a 60% computational overhead at inference compared to standard RS.

Improvements for AI systems

1. Implementation of Dual-Stage Adaptive Smoothing Architecture

Replace monolithic global-variance Randomized Smoothing (RS) with a two-stage framework consisting of a lightweight, smoothed variance estimator (g e) and an input-dependent classifier (g c).

  • What the improved system can do: It breaks the fundamental accuracy-robustness trade-off. The system can simultaneously provide high certified accuracy for subtle adversarial perturbations (small 2 radii) and large adversarial perturbations (large 2 radii) by dynamically selecting the optimal noise variance sigma(x) for every individual input.

2. Certified Mixture-of-Experts (MoE) Routing

Deploy a library of specialized Expert RS Models, where each expert is pre-trained to excel at a specific noise regime (e.g., one expert for sigma=0.25, another for sigma=1.0), and utilize the variance estimator as a certified router.

  • What the improved system can do: It allows the system to leverage highly specialized, high-performance models without needing to train a single, massive universal model. It can route any input to its most robust expert, maximizing certified accuracy across all possible perturbation magnitudes.

3. Locally Constant Variance Enforcement via Consistency Regularization

Integrate consistency regularization and soft-label training (where labels are weighted by the certified radius R c) into the variance estimator's training objective.

  • What the improved system can do: It ensures that the predicted noise variance is mathematically guaranteed to be locally constant within the certified region. This prevents adversarial attacks that attempt to exploit fluctuations in sigma(x) to invalidate the certification, providing a rigorous probabilistic guarantee of stability.

4. High-Efficiency Robustness Training Pipeline

Adopt a training strategy using low-budget sampling (N=100) for constructing the variance estimator's training dataset and utilizing lightweight architectures (e.g., ResNet-110) for the estimator component.

  • What the improved system can do: It enables the deployment of provably robust AI in production environments with minimal overhead, achieving significant certified accuracy gains with only a 60% increase in inference latency, making real-time certified defense computationally feasible.

Abstract

Randomized Smoothing (RS) is a prominent technique for certifying the robustness of neural networks against adversarial perturbations. With RS, achieving high accuracy at small radii requires a small noise variance, while achieving high accuracy at large radii requires a large noise variance. However, the global noise variance used in the standard RS formulation leads to a fundamental limitation: there exists no global noise variance that simultaneously achieves strong performance at both small and large radii. To break through the global variance limitation, we propose a dual RS framework which enables input-dependent noise variances. To achieve that, we first prove that RS remains valid with input-dependent noise variances, provided the variance is locally constant around each input. Building on this result, we introduce two components: (i) a variance estimator predicts an optimal noise variance for each input, (ii) this estimated variance is then used by a standard RS classifier. The variance estimator is independently smoothed via RS to ensure local constancy, enabling flexible design. We also introduce training strategies to iteratively optimize the two components. Experiments on CIFAR-10 demonstrate that our dual RS method provides strong performance for both small and large radii-unattainable with global noise variance-while incurring only a 60% computational overhead at inference. Moreover, it outperforms prior input-dependent noise approaches across most radii, with gains at radii 0.5, 0.75, and 1.0 of 15.6%, 20.0%, and 15.7%. On ImageNet, dual RS remains effective across all radii, with advantages of 8.6%, 17.1%, and 9.1% at radii 0.5, 1.0, and 1.5. Additionally, the dual RS framework provides a routing perspective for certified robustness, improving the accuracy-robustness trade-off with off-the-shelf expert RS models.

Sources

Related papers