A noise-sampling certificate says no attacker inside a small radius flips the answer - of which classifier?

## Two different functions, one name Ask somebody which model a certificate covers and the reflex answer is "the model". On the sampling-based family that answer is wrong, and the error is not pedantic — it changes what you are allowed to write down. The base network is the thing you trained. The **smoothed classifier** is a function built on top of it: to classify an input, you take many copies of that input with independent random noise added, push each through the base network, and return whichever label wins the vote. That vote-taking function is a different mathematical object with different behaviour, and it is the one the certificate is a statement about. The intuition for why it is certifiable at all: adding noise averages the base network's behaviour over a neighbourhood. Shifting the input a little shifts that neighbourhood a little, so the vote proportions can only move by a bounded amount. If one class won the vote by a large enough margin, no shift of the input within a computable radius can overturn it. The margin does the work — a wide margin certifies far, a thin one certifies barely or not at all. ## What this means at serving time The guarantee is a property of the vote, so it only applies if you actually run the vote in production. If the deployment path is "one forward pass through the trained network", the certificate covers a function that never executes. There is nothing subtle about the failure mode: the base network can behave differently from the smoothed one on the very input in question, and no amount of certifying the smoothed function constrains it. This has an ordinary product consequence too. The smoothed function is not just a robustness wrapper — it is your classifier now. Its clean accuracy differs from the base network's, usually lower, and the gap grows with the noise magnitude. Which brings up the dial. ## The noise magnitude is a dial with two ends The amount of noise used to build the smoothed function sets the scale of the radii you can certify. More noise buys larger certifiable radii; it also degrades the smoothed function's clean accuracy, because more of the vote is drawn from further away. Less noise keeps accuracy but caps the radius near zero, and a certificate at a radius near zero is a true statement about almost nothing. There is no setting that gives both, and the setting is chosen before evaluation, not read off it. It also matters that the base network is usually trained with that noise in mind; a network that has never seen noised inputs makes a poor member of the vote. ## Finite sampling makes it probabilistic You cannot evaluate the true vote — that would require averaging over the whole noise distribution. You estimate it from a finite number of draws. So the certificate is issued at a **confidence level**: with probability at least 1 minus some small alpha over the sampling, the returned answer and radius are correct. With the remaining probability, they are not. That is a different kind of uncertainty from anything in the exact-verification family, and it must be reported alongside the radius, because a radius stated at a weak confidence and one stated at a strong confidence are not the same result. The procedure also has a third outcome. When the estimated margin is too thin to support any positive radius at the required confidence, the correct behaviour is to **abstain** rather than to answer, because answering would be an uncertified answer dressed as a certified one. Abstention is the mechanism keeping the guarantee honest, and it has to go somewhere in the product. ## Reading a claim Put together, the minimum readable form of a sampling-based certificate is five things: the **function** (the smoothed one), the **norm**, the **radius**, the **confidence level**, and the **abstention rate** — plus the number of forward passes per prediction, since that is what was paid for it. A claim missing the function tells you nothing about what runs; missing the confidence, nothing about how often the statement itself may be wrong; missing the abstention rate, nothing about how much of the traffic actually received an answer. ## The wrong answer to avoid "Certified robustness means the model cannot be fooled." Two elisions are packed into that. The claim bounds a small ball only, with nothing asserted outside it; and on the sampling-based family it is a high-probability statement about the smoothed function, which is not the function you trained. Say both out loud and the rest of the discussion — cost, abstentions, whether the radius is operationally meaningful — follows naturally.