Feature-Space Smoothing: Certified Robustness of Deep Representations

Song Xia; Meiwen Ding; Chenqi Kong; Wenhan Yang; Xudong Jiang

cs.LGJan 22, 2026

Feature-Space Smoothing: Certified Robustness of Deep Representations

Authors: Song Xia, Meiwen Ding, Chenqi Kong, Wenhan Yang, Xudong Jiang

Organizations: Rapid-Rich Object Search Lab, School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore · Pengcheng Laboratory, Shenzhen, China

Abstract

Modern deep learning models exhibit strong capabilities across diverse applications, yet remain vulnerable to malicious inputs that induce erroneous predictions via feature-space distortion. To address that, we propose Feature-Space Smoothing (FS), a representation-level certification framework built upon Gaussian randomized smoothing. We show that FS converts a given feature encoder into a smoothed variant that is guaranteed to maintain a certified lower bound on the cosine similarity between clean and adversarial features under l_2-bounded perturbations. We then establish that this Feature Cosine Similarity Bound (FCSB) can be extended to the prediction-wise certification under the cosine similarity measure, and the value of FCSB is determined by the encoder intrinsic Gaussian robustness score. Building on those insights, we introduce the Gaussian Smoothness Booster (GSB), a plug-and-play module to improve the encoder Gaussian robustness score. Specifically, the GSB module is plugged to enhance the feature-space consistency and maintain the feature utility for downstream tasks under Gaussian perturbations. This design enables seamless integration of FS on the protected model, e.g., Multimodal Large Language Models (MLLMs), without additional model retraining or alignment, improving its robustness while preserving the performance for downstream task-oriented decoding. Extensive experiments demonstrate that integrating FS consistently provides non-trivial certified robustness and significantly improves task-oriented performance under strong white-box adversarial attacks across diverse models and applications.

Figures & tables

Figure 1: Illustration of the FS framework with GSB, which guarantees that the cosine similarity of the adversarial and clean features extracted by the MLLM’s encoder is larger than FCSB for robust predictions.

Figure 2: The training framework of the GSB. The denoiser performs pre-processing, and the smoothness mapper refines post-extracted features to enhance the Gaussian robustness. Parameters of MLLMs are frozen, and the denoiser and mapper are optimized with $\mathcal{L}_{\mathcal{P}}$ and $\mathcal{L}_{\mathcal{M}}$ . For evaluation, ${\bm{x}}$ is replaced with adversarial input ${\bm{x}}^{\prime}$ , and the forward calculation marked in the blue line will be removed.

$\sigma$	Encoder	GSB	Certified PSR (%) at adversarial bound $\epsilon$						Avg. $\mathcal{R}$
$\sigma$	Encoder	GSB	0.125	0.25	0.375	0.50	0.625	0.75	Avg. $\mathcal{R}$
0.25	CLIP	w/o	41.0	0.1	0.0	0.0	0.0	0.0	0.118
	CLIP	w/	99.0	63.0	2.0	0.0	0.0	0.0	0.267
	SigLIP 2	w/o	59.2	2.0	0.0	0.0	0.0	0.0	0.130
	SigLIP 2	w/	99.7	81.6	10.4	0.0	0.0	0.0	0.304
	EVA-CLIP	w/o	16.2	0.0	0.0	0.0	0.0	0.0	0.068

Table 1: Feature-wise certified protection success rate under different adversarial attack bounds

\epsilon

and the average certified radius

\mathcal{R}

for

\mathrm{FCSB}\geq 0.5

Figure 6: Visualization of adversarial images on ImageNet validation set that were generated by white-box feature-space attack on EVA-CLIP with different attack bounds $\epsilon$ .

Method	GSB	Certified Acc. (%) at $\epsilon$				Avg. $\mathcal{R}$
Method	GSB	0.25	0.50	0.75	1.00	Avg. $\mathcal{R}$
FS	None	45.3	37.0	25.3	6.6	0.34
	$\mathcal{M}$	52.1	42.9	34.2	29.8	0.62
	$\mathcal{P}$	70.1	61.5	52.1	46.7	0.73
	$\mathcal{P}+\mathcal{M}$	79.0	72.6	63.6	50.0	0.82

Table 6: Ablation study of FS on certified robustness using CLIP-L/14 with

\sigma=0.50

Method	W/O Attack		M-Attack			FOA			AttackVLM
Method	Cln. ACC $\uparrow$	Gau. ACC $\uparrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
LLaVA-1.5-7B
Org.	92% (0.75)	69% (0.56)	0.385	1% (0.06)	93% (0.54)	0.388	1% (0.05)	94% (0.58)	0.430	3% (0.09)	88% (0.49)
Smoothed org.	92% (0.74)	72% (0.57)	0.588	63% (0.52)	3% (0.03)	0.587	65% (0.52)	6% (0.03)	0.598	71% (0.56)	4% (0.03)
FARE	85% (0.70)	62% (0.49)	0.588	44% (0.41)	24% (0.10)	0.504	19% (0.20)	51% (0.22)	0.499	18% (0.19)	44% (0.22)
Smoothed FARE	85% (0.68)	73% (0.61)	0.687	64% (0.54)	10% (0.05)	0.634	43% (0.39)	14% (0.07)	0.653	52% (0.44)	7% (0.05)

Table 7: Experimental results on adversarial robustness of different defense methods and MLLMs on image captioning tasks. Values in parentheses denote the average textual similarity measured by GPTScore. The overall best results are shown in bold , and the best results without smoothing are underlined , highlighting the significant performance gain introduced by our proposed FS.

Task	Method	W/O Attack		M-Attack			FOA			AttackVLM
Task	Method	Cln. ACC $\uparrow$	Gau. ACC $\uparrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
LLaVA-1.5-7B
Image Classification	Org.	92.4%	80.4%	0.427	8.2%	78.2%	0.437	3.8%	81.0%	0.458	6.0%	78.4%
	Smoothed org.	92.4%	89.8%	0.590	84.8%	0.2%	0.600	87.2%	0.2%	0.605	87.0%	0.2%
	FARE	93.4%	72.8%	0.574	55.4%	14.6%	0.521	24.8%	39.8%	0.508	25.8%	45.0%
	Smoothed FARE	93.4%	91.8%	0.695	75.6%	5.2%	0.681	66.2%	1.0%	0.671	68.0%	1.0%

Table 8: Experimental results on adversarial robustness of different defense methods and MLLMs on image classification and VQA tasks. The overall best results are shown in bold , and the best results without smoothing are underlined .

Model	Method	FOA
Model	Method	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
LLaVA- 1.5-7B	Org.	0.37	3.6%	78.6%
	Smoothed org.	0.512	35.2%	24.2%
	FARE	0.408	10.4%	64.2%
	Smoothed FARE	0.605	48.4%	19.2%
	TeCoA	0.454	12.0%	29.6%

Table 9: Experimental results on adversarial robustness of different defense methods on image classification tasks with attack bound

\epsilon=32/255

Smoothing	Denoiser	Mapper	M-Attack			FOA			AttackVLM
Smoothing	Denoiser	Mapper	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$	FCS $\uparrow$	ACC $\uparrow$	ASR $\downarrow$
w/o	✗	✗	0.427	8.2%	78.2%	0.437	3.8%	81.0%	0.458	6.0%	78.4%
FS	✗	✗	0.527	66.2%	0.8%	0.535	70.4%	0.6%	0.534	69.4%	1.0%
	✓	✗	0.549	70.6%	1.0%	0.561	76.2%	0.8%	0.561	75.2%	0.4%
	✗	✓	0.554	70.4%	1.2%	0.560	74.2%	0.2%	0.561	74.2%	0.8%
	✓	✓	0.590	84.8%	0.2%	0.600	87.2%	0.2%	0.605	87.0%	0.2%

Table 10: Ablation study of GSB components on LLaVA-1.5-7B for image classification under different adversarial attacks. All smoothed variants use Gaussian smoothing with

\sigma=0.25

Figure 7: Visualization of the adversarial examples under different attack methods and bounds. The adversarial target is the shark class.

Model	$n_{0}$	Avg. infer time (s)	FCS
LLaVA-1.5 7B	1	0.53	0.450
	4	0.64	0.562
	8	0.89	0.590
	64	4.04	0.609

Table 11: The analysis of efficiency.

Adversarial Robustness

Adversarial robustness studies how well AI systems withstand deliberately crafted inputs, training-data corruption, and other attacks.

See all 479 papers

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces
May 25, 2026Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen +2Neural Network Robustness Adversarial Robustness
CS & MINDS Johns Hopkins University · CIS University of Pennsylvania
Laplace-Bridged Randomized Smoothing for Fast Certified Robustness
Apr 27, 2026Miao Lin, MD Saifur Rahman Mazumder, Feng Yu +2Randomized Smoothing Neural Network Robustness
Department of Computer Science, Old Dominion University, Norfolk, VA, USA · Department of Mathematical Sciences, University of Texas at El Paso, El Paso, TX, USA · School of Cybersecurity, Old Dominion University, Norfolk, VA, USA
CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothing
Dec 1, 2025Zixia Wang, Gaojie Jin, Jia Hu +1Randomized Smoothing Semantic Clustering
University of Exeter

May 25, 2026J/K move · Enter open · S save

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces

Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen, Nicolas Loizou+1

CS & MINDS Johns Hopkins University · CIS University of Pennsylvania

Neural Network Robustness Adversarial Robustness Certified Robustness

Open paper AskPDF arXiv

Deep learning models are vulnerable to adversarial perturbations, raising important concerns for safety-critical deployment. Empirical defenses can achieve strong robustness in practice, but lack formal guarantees, motivating the need for certifiably robust classifiers. While certified methods provide formal guarantees, they often yield overly conservative bounds due to their inability to exploit structure in complex data distributions. In this work, we propose a framework for designing certifiably robust classifiers that leverages latent structure in data representations. We first analyze the Gaussian mixture setting, deriving necessary and sufficient conditions for the existence of robust classifiers and constructing a classifier with a closed-form robustness certificate and generalization guarantees. Our main contribution is to show that exact structure is not required: we prove that if a pretrained encoder maps inputs to a latent distribution that is

\varepsilon

-close (in KL divergence) to a Gaussian mixture, then certified accuracy degrades gracefully, with an explicit bound relating robustness under the true and approximate distributions. This result enables the direct use of pretrained models without requiring exact distributional assumptions. Empirically, our method achieves state-of-the-art or competitive certified accuracy on CIFAR-10 and ImageNet, while maintaining strong clean performance and low computational overhead. Overall, our work establishes approximate latent structure as a practical and principled route to certifiable robustness.

Abstract

Adversarial Robustness

Explore similar work

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces

Laplace-Bridged Randomized Smoothing for Fast Certified Robustness

CluCERT: Certifying LLM Robustness via Clustering-Guided Denoising Smoothing