Randomized Smoothing (RS) is currently a scalable certified defense method
providing robustness certification against adversarial examples. Although
significant progress has been achieved in providing defenses against $\ell_p$
adversaries, the interaction between the smoothing distribution and the
robustness certification still remains vague. In this work, we comprehensively
study the effect of two families of distributions, named Exponential Standard
Gaussian (ESG) and Exponential General Gaussian (EGG) distributions, on
Randomized Smoothing and Double Sampling Randomized Smoothing (DSRS). We derive
an analytic formula for ESG's certified radius, which converges to the origin
formula of RS as the dimension $d$ increases. Additionally, we prove that EGG
can provide tighter constant factors than DSRS in providing $\Omega(\sqrt{d})$
lower bounds of $\ell_2$ certified radius, and thus further addresses the curse
of dimensionality in RS. Our experiments on real-world datasets confirm our
theoretical analysis of the ESG distributions, that they provide almost the
same certification under different exponents $\eta$ for both RS and DSRS. In
addition, EGG

随机平滑是一种可扩展的认证防御方法，提供对抗样本的稳健认证。研究重点在于探讨指数标准高斯分布和指数通用高斯分布对随机平滑和双抽样随机平滑的影响，以解决维度诅咒问题。实验结果验证了指数标准高斯分布在不同指数下对随机平滑和双抽样随机平滑的相同认证效果。

指数高斯分布对（双抽样）随机平滑的影响

Effects of Exponential Gaussian Distribution on (Double Sampling)  Randomized Smoothing

Model attribution is a popular tool to explain the rationales behind model
predictions. However, recent work suggests that the attributions are vulnerable
to minute perturbations, which can be added to input samples to fool the
attributions while maintaining the prediction outputs. Although empirical
studies have shown positive performance via adversarial training, an effective
certified defense method is eminently needed to understand the robustness of
attributions. In this work, we propose to use uniform smoothing technique that
augments the vanilla attributions by noises uniformly sampled from a certain
space. It is proved that, for all perturbations within the attack region, the
cosine similarity between uniformly smoothed attribution of perturbed sample
and the unperturbed sample is guaranteed to be lower bounded. We also derive
alternative formulations of the certification that is equivalent to the
original one and provides the maximum size of perturbation or the minimum
smoothing radius such that the attribution can not be perturbed. We evaluate
the proposed method on three datasets and show that the proposed method can
effectively protect the attributions from attacks, regardless of the
architecture of networks, training schemes and the size of the datasets.

提出了一种使用均匀平滑技术的认证方法，通过在一定空间内均匀采样的噪音增加基础归因结果，确保在攻击区域内所有扰动的样本均匀平滑归因与未扰动样本之间的余弦相似度被保证为下界，从而防止归因受到攻击。