Adaptive Robustness Radius Overview

• Adaptive robustness radius is a data-dependent measure that adapts certification margins per input, replacing a fixed global margin with context-sensitive evaluations.
• It is implemented through methods like point-wise randomized smoothing, dynamic partitioning, and adaptive sample budgeting to balance noise effects and confidence.
• The concept extends into training objectives and diverse domains, enabling improved model performance and practical robustness guarantees across applications.

Adaptive robustness radius denotes a family of robustness quantities that are not fixed globally but vary with the input, the certification procedure, or the training objective. In the cited literature, the phrase covers several related constructions: the point-wise certified $L_2$ radius of a randomized-smoothed classifier; the per-example certified radius used inside certified training; empirical instance-specific perturbation budgets in adversarial training; difficulty-aware robustness scores that normalize radius by sample hardness; and domain-specific variants such as maximal safe radius in text classification, stability radius in linear systems, and robustness radius for regression specifications (Goli et al., 2024, Nurlanov et al., 2023, Giraudon et al., 2020, Malfa et al., 2020, Rai et al., 2024, Prallon, 22 Feb 2026). What unifies these formulations is the replacement of a single global margin by a data-dependent robustness region.

1. Point-wise certification in randomized smoothing

In randomized smoothing, a base classifier $f$ is converted into a smoothed classifier by adding Gaussian noise and taking the most probable class under the noisy distribution. One standard form is

$$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$

and the resulting certificate is point-wise: for each input $x$, the method returns a radius within which the prediction of the smoothed classifier cannot change (Seferis et al., 2024). In the formulation restated from Cohen et al., if $c_A$ is the smoothed prediction, $p_A(\mathbf{x})$ its probability under Gaussian noise, and $p_B(\mathbf{x})$ the largest competing probability, then the confidence score is

$$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$

and the certified radius is

$R(\mathbf{x})=\sigma C(\mathbf{x}).$

If $\|\boldsymbol{\delta}\|_2 \le \sigma C(\mathbf{x})$, then the smoothed classifier is constant on $f$0 (Goli et al., 2024).

A simplified and widely used one-sided variant replaces explicit estimation of $f$1 by a lower confidence bound on the top-class probability. In that case,

$f$2

or, under Monte Carlo certification, $f$3 when $f$4 is a one-sided Clopper–Pearson lower bound (Seferis et al., 2024). This establishes the most basic meaning of adaptivity: the radius is not a property of the classifier alone, but of the classifier evaluated at a specific input under a specified noise level and confidence requirement.

The same point-wise structure motivates input-specific certification over an operational design domain. One paper explicitly states that in safety-critical systems it is mandatory to sample data points within the operational design domain, acquire the point-wise certificate regarding robustness radius, and compare it with pre-defined acceptance criteria (Seferis et al., 2024). In this sense, adaptive robustness radius is already implicit in standard randomized smoothing: each input receives its own certificate, and the certificate depends on its local noisy class probabilities.

2. Structural adaptation of the radius: partitions and input-specific smoothing scales

A central limitation of plain Gaussian smoothing is the trade-off between increasing $f$5 and preserving classifier confidence. In high-dimensional image data, larger $f$6 can theoretically enlarge the potential radius, but moderate or large Gaussian noise severely degrades visibility, reduces $f$7, increases $f$8, and may shrink the certified radius instead of enlarging it (Goli et al., 2024). Several works make the radius more adaptive by changing the geometry in which smoothing is performed.

Pixel Partitioning-based Randomized Smoothing (PPRS) introduces a partition transformation that averages pixel intensities within superpixel groups. For an image $f$9, the pixels are partitioned into groups $$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$0, and the partition averaging matrix $$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$1 replaces each pixel by the mean intensity of its group. The resulting PPRS classifier is

$$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$2

and under Gaussian noise the effective noise standard deviation on a superpixel mean becomes

$$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$3

This keeps the nominal smoothing level $$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$4 while reducing the effective variance seen by the classifier inside each partition, thereby increasing signal-to-noise ratio and often boosting the confidence score (Goli et al., 2024).

For static partitions, the certificate is transferred to the transformed space: $$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$5 For dynamic, image-dependent partitions satisfying

$$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$6

the guarantee becomes

$$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$7

The paper explicitly notes that it does not introduce a new formal definition called “adaptive robustness radius,” but that the induced radius is more adaptively data-dependent through both per-input confidence and per-input partitions (Goli et al., 2024).

A complementary route is to adapt the smoothing scale itself. In quasiconcavity-based randomized smoothing, the certified radius is treated as a function of $$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$8,

$$g_{\sigma}(\mathbf{x}) = \underset{y}{\arg\max}\;\mathbb{P}[f(\mathbf{x}+\mathbf{z})=y], \quad \mathbf{z}\sim\mathcal{N}(0,\sigma^2 I),$$9

and optimized separately for each input. The key observation is that although concavity rarely holds, the radius–$x$0 curve is almost always quasiconcave: on CIFAR-10, quasiconcavity holds for 97–98% of data points, and on ImageNet for more than 90%, whereas concavity holds for only 0–16% on CIFAR-10 (Kung et al., 2023). This permits a per-input search for

$x$1

implemented by QCRS, a binary-search-like algorithm guided by finite-difference gradient signs. The result is an explicitly input-specific radius that never performs worse than the baseline global $x$2, since the final choice is $x$3 (Kung et al., 2023).

These methods alter different objects—one changes the representation through partition averaging, the other changes the smoothing parameter $x$4—but both embody the same principle: the certified radius can be enlarged when the certification mechanism is aligned with the local structure of the input rather than held globally fixed.

3. Statistical and computational adaptation: sample budgets, input-specific certification, and surrogate inference

Another line of work makes the robustness radius adaptive by changing how it is estimated rather than by changing the underlying classifier. In randomized smoothing, the radius depends on a confidence bound for $x$5, so finite-sample effects directly shrink certification. One analysis formalizes the expected finite-sample radius as

$x$6

and shows that the average radius ratio satisfies

$x$7

Empirically, cutting the sample size by $x$8 tends to reduce the average radius by about 15–20%, whereas cutting by $x$9 reduces it by about 50% (Seferis et al., 2024). The same paper emphasizes a dual interpretation: if the predicted gain from increasing $c_A$0 is small, the result can be used as an early stopping criterion.

Input-Specific Sampling (ISS) makes this adaptivity explicit. Standard Input-Agnostic Sampling uses the same Monte Carlo sample size $c_A$1 for every test input, which yields a poor ACR-runtime trade-off (Chen et al., 2021). ISS first obtains a rough confidence interval $c_A$2 for the top-class probability using a small initial sample size $c_A$3, then chooses an input-specific sample size

$c_A$4

from a precomputed map $c_A$5 so that a desired absolute or relative decline in certified radius is universally controlled (Chen et al., 2021). The paper reports that ISS can speed up certification by more than three times at a limited cost of 0.05 certified radius, and on ImageNet with $c_A$6 it achieves $c_A$7 in 250 minutes, compared to $c_A$8 by IAS under the same condition (Chen et al., 2021).

RRISE replaces per-input Monte Carlo altogether at deployment time. It trains a surrogate $c_A$9 to predict smoothed class probabilities from precomputed Monte Carlo soft labels and then applies a one-time conformal calibration step. The calibrated lower bound is

$p_A(\mathbf{x})$0

and the certified radius is

$p_A(\mathbf{x})$1

Whenever $p_A(\mathbf{x})$2, the surrogate prediction provably matches the smoothed classifier’s and the smoothed classifier is constant on a ball of that radius (Park et al., 1 Jun 2026). Across image classification benchmarks, the paper reports that RRISE matches fixed-budget Monte Carlo certified accuracy within $p_A(\mathbf{x})$3 percentage points while replacing up to $p_A(\mathbf{x})$4 noisy base-model evaluations per query with a single surrogate forward pass (Park et al., 1 Jun 2026).

These approaches reveal a second meaning of adaptive robustness radius. The radius is still point-wise, but its certified value becomes a function of sample budget, confidence level, or deployment-time approximation strategy. This suggests that adaptivity can operate at the statistical layer of certification, not only at the geometric layer of the classifier.

4. Training with adaptive radii

Several methods place the adaptive radius directly inside the training objective. In certified training with IBP, the central object is the certified robust radius

$p_A(\mathbf{x})$5

where $p_A(\mathbf{x})$6 is an IBP upper bound on the robust margin (Nurlanov et al., 2023). Under continuity and monotonicity, $p_A(\mathbf{x})$7 is the unique root of $p_A(\mathbf{x})$8. ACERT uses this per-sample radius in the robust loss,

$p_A(\mathbf{x})$9

rather than using a global fixed $p_B(\mathbf{x})$0 for all samples (Nurlanov et al., 2023). The method is motivated by the claim that training with adaptive certified radii improves both accuracy and robustness; on CIFAR-10 and TinyImageNet, it yields models with up to two times higher robustness, measured as average certified radius of a test set, at the same levels of standard accuracy (Nurlanov et al., 2023).

A related objective appears in covariance-propagation-based certified radius maximization. There, the smoothed logit vector is approximated as Gaussian, $p_B(\mathbf{x})$1, and the top-class probability estimate is obtained analytically from the mean gap and covariance of the top two logits. The resulting robustness loss is a hinge on the certified radius,

$p_B(\mathbf{x})$2

so minimizing the loss is equivalent to maximizing the per-example certified radius (Zhen et al., 2021). This replaces Monte Carlo inside training by deterministic moment propagation.

Instance Adaptive Adversarial Training (IAAT) is an empirical counterpart rather than a certified one. It replaces a uniform $p_B(\mathbf{x})$3 perturbation radius $p_B(\mathbf{x})$4 by per-sample radii $p_B(\mathbf{x})$5 in the adversarial training objective,

$p_B(\mathbf{x})$6

The $p_B(\mathbf{x})$7 are updated heuristically by checking whether PGD succeeds at $p_B(\mathbf{x})$8, $p_B(\mathbf{x})$9, or $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$0, followed by exponential smoothing (Balaji et al., 2019). The paper explicitly treats $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$1 as an instance-specific perturbation margin profile, and reports improved clean accuracy with a marginal drop in robustness on CIFAR-10, CIFAR-100, and ImageNet (Balaji et al., 2019). The important distinction is that this radius is attack-dependent and not a formal certificate.

In reinforcement learning, CAMP turns robustness radius into a trainable object for randomized policy smoothing. The global soft certified radius for target return $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$2 is

$$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$3

and the local certified radius at step $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$4 depends on the gap between smoothed Q-values of the top-1 and runner-up actions (Wang et al., 29 Jan 2025). CAMP optimizes a surrogate hinge loss on that Q-gap and introduces policy imitation to stabilize training. The paper reports up to twice the certified expected return compared to baselines (Wang et al., 29 Jan 2025).

Across these training methods, adaptive robustness radius means more than test-time certification. It becomes a control variable in optimization: a quantity computed per sample or per state, inserted into the loss, and enlarged directly during training.

5. Alternative formulations beyond standard image certification

Not all adaptive robustness radii are randomized-smoothing certificates. One strand asks whether average radius itself is the right robustness summary. In a difficulty-aware approach, the per-sample radius $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$5 is normalized by a function of the cross-entropy loss,

$$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$6

For binomial logistic regression, the paper shows

$$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$7

and therefore $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$8, linking the adaptive score directly to accuracy and margin (Giraudon et al., 2020). Here the “adaptive” aspect lies in weighting radius by sample difficulty rather than in certifying a ball under noise.

In text classification, the central object is the maximal safe radius: the largest $$C(\mathbf{x})=\frac{1}{2}\bigl(\Phi^{-1}(p_A(\mathbf{x}))-\Phi^{-1}(p_B(\mathbf{x}))\bigr),$$9 such that all embedded texts within an $R(\mathbf{x})=\sigma C(\mathbf{x}).$0-ball around a given input keep the same label. Since exact computation is not feasible, lower bounds are obtained by adapted CNN-Cert or POPQORN, while upper bounds are obtained by Monte Carlo Tree Search over word substitutions (Malfa et al., 2020). The radius is inherently per input because it depends on the actual word sequence, the embedding geometry, and the subset of word positions allowed to vary.

In linear systems, the analogous quantity is the real structured stability radius

$R(\mathbf{x})=\sigma C(\mathbf{x}).$1

the minimal structured perturbation that drives a stable matrix to the boundary of instability (Rai et al., 2024). The paper derives closed-form approximations $R(\mathbf{x})=\sigma C(\mathbf{x}).$2 and $R(\mathbf{x})=\sigma C(\mathbf{x}).$3, then uses them in redesign problems that increase the radius. This is not an input-specific radius, but it is a robustness margin against structured perturbations.

In econometrics, robustness radius is defined for a main regression estimand and a finite set of robustness-check estimands. The null

$R(\mathbf{x})=\sigma C(\mathbf{x}).$4

is tested using moment inequalities, and the robustness radius is

$R(\mathbf{x})=\sigma C(\mathbf{x}).$5

the lower endpoint of a one-sided $R(\mathbf{x})=\sigma C(\mathbf{x}).$6 confidence interval for the maximum estimand deviation (Prallon, 22 Feb 2026). The paper emphasizes that this radius adapts to sampling uncertainty and correlation across regressions. This is far from adversarial robustness in the usual ML sense, but it preserves the same core geometry: radius as distance to a failure of robustness.

These variants show that adaptive robustness radius is not a single formal object shared across all fields. It is a general design pattern in which robustness is quantified by a data-dependent distance to a task-specific boundary: a decision boundary, an instability boundary, or a set of specification deviations.

6. Interpretation, misconceptions, and unresolved issues

The literature repeatedly warns against treating adaptive robustness radius as a uniform concept. In PPRS, the authors explicitly state that the paper does not introduce a new formal definition called “adaptive robustness radius,” even though the induced radius is more adaptively data-dependent than standard smoothing (Goli et al., 2024). In IAAT, the learned $R(\mathbf{x})=\sigma C(\mathbf{x}).$7 behave like instance-specific margins but are not certified, because they are based on PGD success or failure rather than a proof over all perturbations in the ball (Balaji et al., 2019). In econometrics, the radius measures plausible deviations between estimands rather than adversarial perturbations of inputs (Prallon, 22 Feb 2026). A common misconception is therefore to assume that all adaptive radii are directly comparable.

A second recurring issue is dependence on strong structural assumptions. Randomized smoothing formulas are tied to Gaussian noise and $R(\mathbf{x})=\sigma C(\mathbf{x}).$8 certification (Seferis et al., 2024). QCRS depends on quasiconcavity of the radius–$R(\mathbf{x})=\sigma C(\mathbf{x}).$9 curve, which is empirically strong but not universal (Kung et al., 2023). RRISE requires exchangeability between calibration and deployment data, and its guarantees may degrade under distribution shift (Park et al., 1 Jun 2026). ACERT relies on continuity and monotonicity of the IBP-certified margin, while covariance-propagation methods accumulate looseness as depth grows because covariance upper bounds become conservative (Nurlanov et al., 2023, Zhen et al., 2021).

A third issue is what kind of adaptivity is being optimized. Some methods adapt the certified region to the input structure, as in PPRS. Others adapt the smoothing parameter $\|\boldsymbol{\delta}\|_2 \le \sigma C(\mathbf{x})$0, the Monte Carlo sample size, or the certification surrogate. Still others adapt the training radius used inside the objective. This suggests that “adaptive robustness radius” is best understood as a family of mechanisms for replacing a single worst-case budget by a context-sensitive robustness quantity.

The open directions stated across these works are correspondingly heterogeneous: learning or tuning partition sizes and shapes per input in PPRS; extending adaptive certified radius training to other certification frameworks beyond IBP; generalizing QCRS to other norms and smoothing distributions; using sample-efficiency formulas for early stopping and per-point allocation; and leveraging surrogate-based certification in repeated-deployment settings (Goli et al., 2024, Nurlanov et al., 2023, Kung et al., 2023, Seferis et al., 2024, Park et al., 1 Jun 2026). Taken together, these directions indicate that adaptive robustness radius is evolving from a descriptive notion into a design principle: robustness should be measured and optimized where the instance, the model, and the certification procedure actually interact.