Feature-Space Smoothing: Certified Robustness of Deep Representations

Song Xia; Meiwen Ding; Chenqi Kong; Wenhan Yang; Xudong Jiang

cs.LGJan 22, 2026

Feature-Space Smoothing: Certified Robustness of Deep Representations

Authors: Song Xia, Meiwen Ding, Chenqi Kong, Wenhan Yang, Xudong Jiang

Organizations: Rapid-Rich Object Search Lab, School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore · Pengcheng Laboratory, Shenzhen, China

Abstract

Modern deep learning models exhibit strong capabilities across diverse applications, yet remain vulnerable to malicious inputs that induce erroneous predictions via feature-space distortion. To address that, we propose Feature-Space Smoothing (FS), a representation-level certification framework built upon Gaussian randomized smoothing. We show that FS converts a given feature encoder into a smoothed variant that is guaranteed to maintain a certified lower bound on the cosine similarity between clean and adversarial features under l_2-bounded perturbations. We then establish that this Feature Cosine Similarity Bound (FCSB) can be extended to the prediction-wise certification under the cosine similarity measure, and the value of FCSB is determined by the encoder intrinsic Gaussian robustness score. Building on those insights, we introduce the Gaussian Smoothness Booster (GSB), a plug-and-play module to improve the encoder Gaussian robustness score. Specifically, the GSB module is plugged to enhance the feature-space consistency and maintain the feature utility for downstream tasks under Gaussian perturbations. This design enables seamless integration of FS on the protected model, e.g., Multimodal Large Language Models (MLLMs), without additional model retraining or alignment, improving its robustness while preserving the performance for downstream task-oriented decoding. Extensive experiments demonstrate that integrating FS consistently provides non-trivial certified robustness and significantly improves task-oriented performance under strong white-box adversarial attacks across diverse models and applications.

Figures & tables

Figure 1: Illustration of the FS framework with GSB, which guarantees that the cosine similarity of the adversarial and clean features extracted by the MLLM’s encoder is larger than FCSB for robust predictions.

Figure 2: The training framework of the GSB. The denoiser performs pre-processing, and the smoothness mapper refines post-extracted features to enhance the Gaussian robustness. Parameters of MLLMs are frozen, and the denoiser and mapper are optimized with $\mathcal{L}_{\mathcal{P}}$ and $\mathcal{L}_{\mathcal{M}}$ . For evaluation, ${\bm{x}}$ is replaced with adversarial input ${\bm{x}}^{\prime}$ , and the forward calculation marked in the blue line will be removed.

$\sigma$	Encoder	GSB	Certified PSR (%) at adversarial bound $\epsilon$						Avg. $\mathcal{R}$
$\sigma$	Encoder	GSB	0.125	0.25	0.375	0.50	0.625	0.75	Avg. $\mathcal{R}$
0.25	CLIP	w/o	41.0	0.1	0.0	0.0	0.0	0.0	0.118
	CLIP	w/	99.0	63.0	2.0	0.0	0.0	0.0	0.267
	SigLIP 2	w/o	59.2	2.0	0.0	0.0	0.0	0.0	0.130
	SigLIP 2	w/	99.7	81.6	10.4	0.0	0.0	0.0	0.304
	EVA-CLIP	w/o	16.2	0.0	0.0	0.0	0.0	0.0	0.068

Table 1: Feature-wise certified protection success rate under different adversarial attack bounds

\epsilon

and the average certified radius

\mathcal{R}

for

\mathrm{FCSB}\geq 0.5

Figure 6: Visualization of adversarial images on ImageNet validation set that were generated by white-box feature-space attack on EVA-CLIP with different attack bounds $\epsilon$ .

Method	GSB	Certified Acc. (%) at $\epsilon$				Avg. $\mathcal{R}$
Method	GSB	0.25	0.50	0.75	1.00	Avg. $\mathcal{R}$
FS	None	45.3	37.0	25.3	6.6	0.34
	$\mathcal{M}$	52.1	42.9	34.2	29.8	0.62
	$\mathcal{P}$	70.1	61.5	52.1	46.7	0.73
	$\mathcal{P}+\mathcal{M}$	79.0	72.6	63.6	50.0	0.82

Table 6: Ablation study of FS on certified robustness using CLIP-L/14 with

\sigma=0.50

Method	W/O Attack		M-Attack			FOA			AttackVLM
Method	Cln. ACC $\uparrow$	Gau. ACC $\uparrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
LLaVA-1.5-7B
Org.	92% (0.75)	69% (0.56)	0.385	1% (0.06)	93% (0.54)	0.388	1% (0.05)	94% (0.58)	0.430	3% (0.09)	88% (0.49)
Smoothed org.	92% (0.74)	72% (0.57)	0.588	63% (0.52)	3% (0.03)	0.587	65% (0.52)	6% (0.03)	0.598	71% (0.56)	4% (0.03)
FARE	85% (0.70)	62% (0.49)	0.588	44% (0.41)	24% (0.10)	0.504	19% (0.20)	51% (0.22)	0.499	18% (0.19)	44% (0.22)
Smoothed FARE	85% (0.68)	73% (0.61)	0.687	64% (0.54)	10% (0.05)	0.634	43% (0.39)	14% (0.07)	0.653	52% (0.44)	7% (0.05)

Table 7: Experimental results on adversarial robustness of different defense methods and MLLMs on image captioning tasks. Values in parentheses denote the average textual similarity measured by GPTScore. The overall best results are shown in bold , and the best results without smoothing are underlined , highlighting the significant performance gain introduced by our proposed FS.

Task	Method	W/O Attack		M-Attack			FOA			AttackVLM
Task	Method	Cln. ACC $\uparrow$	Gau. ACC $\uparrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
LLaVA-1.5-7B
Image Classification	Org.	92.4%	80.4%	0.427	8.2%	78.2%	0.437	3.8%	81.0%	0.458	6.0%	78.4%
	Smoothed org.	92.4%	89.8%	0.590	84.8%	0.2%	0.600	87.2%	0.2%	0.605	87.0%	0.2%
	FARE	93.4%	72.8%	0.574	55.4%	14.6%	0.521	24.8%	39.8%	0.508	25.8%	45.0%
	Smoothed FARE	93.4%	91.8%	0.695	75.6%	5.2%	0.681	66.2%	1.0%	0.671	68.0%	1.0%

Table 8: Experimental results on adversarial robustness of different defense methods and MLLMs on image classification and VQA tasks. The overall best results are shown in bold , and the best results without smoothing are underlined .

Model	Method	FOA
Model	Method	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
LLaVA- 1.5-7B	Org.	0.37	3.6%	78.6%
	Smoothed org.	0.512	35.2%	24.2%
	FARE	0.408	10.4%	64.2%
	Smoothed FARE	0.605	48.4%	19.2%
	TeCoA	0.454	12.0%	29.6%

Table 9: Experimental results on adversarial robustness of different defense methods on image classification tasks with attack bound

\epsilon=32/255

Smoothing	Denoiser	Mapper	M-Attack			FOA			AttackVLM
Smoothing	Denoiser	Mapper	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
w/o	✗	✗	0.427	8.2%	78.2%	0.437	3.8%	81.0%	0.458	6.0%	78.4%
FS	✗	✗	0.527	66.2%	0.8%	0.535	70.4%	0.6%	0.534	69.4%	1.0%
	✓	✗	0.549	70.6%	1.0%	0.561	76.2%	0.8%	0.561	75.2%	0.4%
	✗	✓	0.554	70.4%	1.2%	0.560	74.2%	0.2%	0.561	74.2%	0.8%
	✓	✓	0.590	84.8%	0.2%	0.600	87.2%	0.2%	0.605	87.0%	0.2%

Table 10: Ablation study of GSB components on LLaVA-1.5-7B for image classification under different adversarial attacks. All smoothed variants use Gaussian smoothing with

\sigma=0.25

Figure 7: Visualization of the adversarial examples under different attack methods and bounds. The adversarial target is the shark class.

Model	$n_{0}$	Avg. infer time (s)	FCS
LLaVA-1.5 7B	1	0.53	0.450
	4	0.64	0.562
	8	0.89	0.590
	64	4.04	0.609

Table 11: The analysis of efficiency.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

May 25, 2026

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces

Deep learning models are vulnerable to adversarial perturbations, raising important concerns for safety-critical deployment. Empirical defenses can achieve strong robustness in practice, but lack formal guarantees, motivating the need for certifiably robust classifiers. While certified methods provide formal guarantees, they often yield overly conservative bounds due to their inability to exploit structure in complex data distributions. In this work, we propose a framework for designing certifiably robust classifiers that leverages latent structure in data representations. We first analyze the Gaussian mixture setting, deriving necessary and sufficient conditions for the existence of robust classifiers and constructing a classifier with a closed-form robustness certificate and generalization guarantees. Our main contribution is to show that exact structure is not required: we prove that if a pretrained encoder maps inputs to a latent distribution that is

\varepsilon

-close (in KL divergence) to a Gaussian mixture, then certified accuracy degrades gracefully, with an explicit bound relating robustness under the true and approximate distributions. This result enables the direct use of pretrained models without requiring exact distributional assumptions. Empirically, our method achieves state-of-the-art or competitive certified accuracy on CIFAR-10 and ImageNet, while maintaining strong clean performance and low computational overhead. Overall, our work establishes approximate latent structure as a practical and principled route to certifiable robustness.

Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen +2

CS & MINDS Johns Hopkins University · CIS University of Pennsylvania

Neural Network Robustness Adversarial Robustness Certified Robustness

Ask PDF

Apr 27, 2026

Laplace-Bridged Randomized Smoothing for Fast Certified Robustness

Randomized Smoothing (RS) offers formal

\ell_2

guarantees for arbitrary base classifiers but faces two key practical bottlenecks: (i) it often relies on noise-augmented training to achieve nontrivial certificates, which increases training cost, can reduce clean accuracy, and weakens RS as a genuinely post-hoc defense; and (ii) certification is computationally expensive, typically requiring tens of thousands of noisy forward passes per input, which hinders deployment, especially on resource-constrained edge devices. To address both limitations, we propose Laplace-Bridged Smoothing (LBS), an analytic reformulation of RS that replaces high-dimensional input-space Monte Carlo (MC) sampling with efficient computations in a low-dimensional probability space. LBS preserves formal robustness guarantees without requiring noise-augmented training while substantially reducing certification burden. On CIFAR-10 and ImageNet, LBS attains stronger certified robustness than RS and reduces per-sample certification cost by nearly an order of magnitude. Notably, on NVIDIA Jetson Orin Nano and Raspberry Pi 4, LBS achieves speedups of up to

494\times

, enabling practical certified deployment on real-world edge devices. Finally, we provide theoretical justification for the analytic formulation and certificate validity of LBS.

Miao Lin, MD Saifur Rahman Mazumder, Feng Yu +2

Department of Computer Science, Old Dominion University, Norfolk, VA, USA · Department of Mathematical Sciences, University of Texas at El Paso, El Paso, TX, USA · School of Cybersecurity, Old Dominion University, Norfolk, VA, USA

Randomized Smoothing Neural Network Robustness Certified Robustness Noise Robustness

Ask PDF

Dec 1, 2025

CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothing

Recent advancements in Large Language Models (LLMs) have led to their widespread adoption in daily applications. Despite their impressive capabilities, they remain vulnerable to adversarial attacks, as even minor meaning-preserving changes such as synonym substitutions can lead to incorrect predictions. As a result, certifying the robustness of LLMs against such adversarial prompts is of vital importance. Existing approaches focused on word deletion or simple denoising strategies to achieve robustness certification. However, these methods face two critical limitations: (1) they yield loose robustness bounds due to the lack of semantic validation for perturbed outputs and (2) they suffer from high computational costs due to repeated sampling. To address these limitations, we propose CluCERT, a novel framework for certifying LLM robustness via clustering-guided denoising smoothing. Specifically, to achieve tighter certified bounds, we introduce a semantic clustering filter that reduces noisy samples and retains meaningful perturbations, supported by theoretical analysis. Furthermore, we enhance computational efficiency through two mechanisms: a refine module that extracts core semantics, and a fast synonym substitution strategy that accelerates the denoising process. Finally, we conduct extensive experiments on various downstream tasks and jailbreak defense scenarios. Experimental results demonstrate that our method outperforms existing certified approaches in both robustness bounds and computational efficiency.

Zixia Wang, Gaojie Jin, Jia Hu +1

University of Exeter

Randomized Smoothing Semantic Clustering Adversarial Robustness of Language Models Certified Robustness

Ask PDF

Abstract

Adversarial Robustness

Explore similar work

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces

Laplace-Bridged Randomized Smoothing for Fast Certified Robustness

CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothing