Randomized-Control Noising Overview

• Randomized-control noising is the deliberate introduction of structured noise into control systems to improve the conditioning of stabilization, estimation, or certification problems.
• It utilizes techniques like averaged feedback, controlled boundary perturbations, and adaptive randomized smoothing to cancel coherent errors and safeguard against disturbances.
• Applications range from control-affine system stabilization and adversarial robustness in neural networks to quantum control, though its success depends on proper alignment with system invariances.

Randomized-control noising denotes the deliberate use of stochastic or structured perturbations as a control primitive, calibration mechanism, or certification device, rather than treating noise solely as an exogenous disturbance. In explicit usage for control-affine systems, it means sampling admissible control functions from a distribution on $\mathcal U$, pushing that law through the trajectory map to obtain a noised state distribution $\mu_t=(S_t^\omega)_\#\gamma$, and recovering an averaged feedback $u(t,x)=\mathbb E[U_t\mid X_t=x]$ whose induced measure flow satisfies a continuity equation (Elamvazhuthi, 3 Oct 2025). In related literatures, the same design pattern appears as controlled boundary perturbation for shape analysis, adaptive or entity-selective randomized smoothing for certified robustness, randomized local controllers for distributed systems, and randomized ensembles of quantum controls that cancel coherent error (1608.00668, Scholten et al., 2023, Hong et al., 2022, Bušić et al., 2016, Kim et al., 12 Jul 2026). This breadth makes the term less a single algorithm than a recurring construction: inject or average over carefully chosen perturbations so that a downstream inference, stabilization, or certification problem becomes better conditioned.

1. Explicit formulation in control-affine stabilization

The most literal formulation appears in "Flow Matching for Measure Transport and Feedback Stabilization of Control-Affine Systems" (Elamvazhuthi, 3 Oct 2025). The controlled dynamics are

$\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$

with $x(t)\in \mathbb{R}^d$, $u(t)\in U\subseteq \mathbb{R}^m$, and admissible controls

$$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$

where $I=[0,T]$. The central move is to reinterpret stabilization as a denoising problem: first construct a forward noising process that spreads mass away from a target point $x^\star$ or target set $\Omega$, then time-reverse that process to obtain a candidate stabilizing mechanism.

In the randomized-control construction, the latent variable is the control itself. One samples a control $\mu_t=(S_t^\omega)_\#\gamma$0, where $\mu_t=(S_t^\omega)_\#\gamma$1, and uses a measurable map $\mu_t=(S_t^\omega)_\#\gamma$2 with $\mu_t=(S_t^\omega)_\#\gamma$3 and $\mu_t=(S_t^\omega)_\#\gamma$4. The noised state law is

$\mu_t=(S_t^\omega)_\#\gamma$5

Disintegrating the joint state-control law yields the averaged feedback

$\mu_t=(S_t^\omega)_\#\gamma$6

Because the system is control-affine,

$\mu_t=(S_t^\omega)_\#\gamma$7

so the induced measure flow solves exactly

$\mu_t=(S_t^\omega)_\#\gamma$8

Two features distinguish this construction from diffusion-based denoising. First, the noising uses regular, non-white-noise controls rather than state-space SDE forcing. Second, if controls are sampled in $\mu_t=(S_t^\omega)_\#\gamma$9 with values in $u(t,x)=\mathbb E[U_t\mid X_t=x]$0, the induced averaged feedback remains in $u(t,x)=\mathbb E[U_t\mid X_t=x]$1 when $u(t,x)=\mathbb E[U_t\mid X_t=x]$2 is convex compact. The paper therefore states that randomized-control noising "avoids the score blow-up seen in stochastic differential equation–based denoising methods" and "naturally accommodates control constraints" (Elamvazhuthi, 3 Oct 2025).

The same paper also gives a concrete law on control paths: Wiener measure on $u(t,x)=\mathbb E[U_t\mid X_t=x]$3, used as a distribution on continuous controls rather than as $u(t,x)=\mathbb E[U_t\mid X_t=x]$4 increments in an SDE. Under the stated assumptions, the resulting $u(t,x)=\mathbb E[U_t\mid X_t=x]$5 is absolutely continuous with respect to Lebesgue measure, and its support is the closure of a reachable set for the time-reversed controlled ODE. This places randomized-control noising squarely in deterministic-control measure transport: randomness is injected in the control selection layer, while conditional dynamics remain ordinary ODE trajectories.

2. Designed perturbations as control primitives

A closely related, but older, use of noising appears in "Global Vertices and the Noising Paradox" (1608.00668). There the setting is planar closed curves $u(t,x)=\mathbb E[U_t\mid X_t=x]$6, and the perturbation is not random corruption but a controlled geometric modification of the boundary. The paper defines the View Area Representation

$u(t,x)=\mathbb E[U_t\mid X_t=x]$7

and derives global-local relations such as

$u(t,x)=\mathbb E[U_t\mid X_t=x]$8

with

$u(t,x)=\mathbb E[U_t\mid X_t=x]$9

The paper’s paradox is that induced boundary perturbations—called noising—can improve localization of certain vertices when one uses these global descriptors rather than local curvature. Its discrete noising mechanism inserts a new point between consecutive boundary samples by a circle-intersection construction; original points are preserved, tangent directions are enriched, and absolute local curvature increases everywhere while global distance behavior is not significantly changed.

This controlled perturb-and-reveal logic reappears in nonsmooth optimal control. "Leveraging Randomized Smoothing for Optimal Control of Nonsmooth Dynamical Systems" (Lidec et al., 2022) replaces the original nonsmooth dynamics by a smoothed dynamics

$\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$0

where $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$1. Derivatives of $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$2 are then estimated by Monte Carlo and used inside randomized DDP (R-DDP). The point is not to execute a stochastic controller online, but to inject perturbations into the state-action arguments of the one-step dynamics so that DDP sees informative local geometry even when the original $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$3 is deterministic but nonsmooth.

Distributed power-systems control supplies a third variant. In "Distributed Randomized Control for Demand Dispatch" (Bušić et al., 2016), each load is a finite-state controlled Markov chain with a family of randomized transition matrices $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$4 driven by a broadcast signal $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$5. The controller is an exponential tilting of the nominal kernel,

$\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$6

with $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$7 a row normalizer. Randomization is thus the local control primitive: it prevents synchronization, yields smooth aggregate behavior, and supports mean-field dynamics $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$8. The paper’s Individual Perspective Design (IPD) and System Perspective Design (SPD) compute the resulting controller families via a single ODE in $\dot x(t)=f(x,u)=f_0(x)+\sum_{i=1}^m u_i(t)f_i(x),$9, rather than by solving a separate dynamic program for each operating point.

Taken together, these works establish a recurrent interpretation: noising helps when it amplifies a structure the estimator or controller needs—large local curvature, mode-crossing information, or smooth aggregate probabilistic response—while preserving the global quantity on which the downstream inference actually depends.

3. Certified robustness through adaptive and selective noising

In adversarial robustness, randomized-control noising appears as deliberate control of the smoothing distribution itself. "Certified Adversarial Robustness via Anisotropic Randomized Smoothing" (Hong et al., 2022) generalizes standard Gaussian smoothing to

$x(t)\in \mathbb{R}^d$0

with

$x(t)\in \mathbb{R}^d$1

A CNN-based Noise Generator predicts per-input mean and variance maps, while certification remains valid with radius

$x(t)\in \mathbb{R}^d$2

The method therefore controls both where the noisy samples are centered and how much each coordinate is randomized. On CIFAR10 and ImageNet, the paper reports consistent improvements over isotropic smoothing, including relative certified-accuracy gains up to $x(t)\in \mathbb{R}^d$3 and $x(t)\in \mathbb{R}^d$4, respectively (Hong et al., 2022).

"Hierarchical Randomized Smoothing" (Scholten et al., 2023) shifts control from per-coordinate variance to per-entity selection. An object is represented as $x(t)\in \mathbb{R}^d$5. First, an indicator vector $x(t)\in \mathbb{R}^d$6 is sampled with $x(t)\in \mathbb{R}^d$7. Second, lower-level noise is applied only to selected entities: $x(t)\in \mathbb{R}^d$8 The upper-level combinatorial penalty is

$x(t)\in \mathbb{R}^d$9

or $u(t)\in U\subseteq \mathbb{R}^m$0 for worst-case regional certification. This yields a certificate that factors into a subset-selection penalty and an ordinary lower-level smoothing certificate on the attacked entities only. The paper shows that this selective noising expands the Pareto front of certified accuracy versus clean accuracy for both CIFAR10 image classification and Cora-ML node classification (Scholten et al., 2023).

"Dual Randomized Smoothing: Beyond Global Noise Variance" (Sun et al., 1 Dec 2025) makes the variance itself an input-dependent control variable. Standard smoothing uses one global $u(t)\in U\subseteq \mathbb{R}^m$1, but the paper proves that certification remains valid with an input-dependent variance map $u(t)\in U\subseteq \mathbb{R}^m$2 provided $u(t)\in U\subseteq \mathbb{R}^m$3 is locally constant in the certified neighborhood. The practical architecture uses two smoothed models: a variance estimator $u(t)\in U\subseteq \mathbb{R}^m$4 that predicts $u(t)\in U\subseteq \mathbb{R}^m$5, and a classifier $u(t)\in U\subseteq \mathbb{R}^m$6 that uses this predicted variance. The final certified radius is

$u(t)\in U\subseteq \mathbb{R}^m$7

On CIFAR-10, the paper reports relative improvements of $u(t)\in U\subseteq \mathbb{R}^m$8, $u(t)\in U\subseteq \mathbb{R}^m$9, and $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$0 at radii $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$1, $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$2, and $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$3, respectively, and states that the method incurs only a $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$4 inference overhead relative to standard RS (Sun et al., 1 Dec 2025).

A critical qualification comes from "Understanding Noise-Augmented Training for Randomized Smoothing" (Pal et al., 2023). In a binary setting, the paper proves both negative and positive existence results for noisy training. There exist distributions with large interference distance for which

$$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$5

so noise augmentation always hurts. There also exist low-interference distributions for which some $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$6 improves the final smoothed classifier. The practical implication is that no general theorem supports the common heuristic $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$7; whether noisy training helps depends on the geometry of class regions under convolution (Pal et al., 2023).

4. Defensive randomization, query corruption, and calibration actuators

Another branch of the literature uses noising as a defensive or deployment-time actuator. "Theoretical evidence for adversarial robustness through randomization" (Pinot et al., 2019) studies inference-time additive noise injected at arbitrary network layers,

$$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$8

and shows that for Exponential-family noise, including a separate Gaussian specialization, the randomized network becomes $$\mathcal{U} = \{ u \in L^p(I;\mathbb{R}^m) \,;\, u(t) \in U \text{ for a.e. } t \in I \},$$9-robust with an explicit $I=[0,T]$0 determined by network sensitivity and noise parameters. The paper also proves an upper bound on the adversarial generalization gap,

$I=[0,T]$1

making the robustness–accuracy trade-off explicit: increasing noise improves distributional stability but raises output entropy (Pinot et al., 2019).

"Random Noise Defense Against Query-Based Black-Box Attacks" (Qin et al., 2021) moves the perturbation to the attacker’s feedback channel. Every submitted query $I=[0,T]$2 is evaluated as $I=[0,T]$3 with $I=[0,T]$4. The central control parameter is the defender-to-attacker magnitude ratio $I=[0,T]$5, where $I=[0,T]$6 is the attacker’s local probing scale. The paper shows theoretically that a large $I=[0,T]$7 slows zeroth-order convergence and increases sign errors in search-based attacks, while Gaussian augmentation fine-tuning (RND-GF) allows larger $I=[0,T]$8 without destroying clean accuracy. It also reports that combining RND with adversarial training improves robust accuracy against Square attack by up to $I=[0,T]$9 on CIFAR-10 and $x^\star$0 on ImageNet (Qin et al., 2021).

The same defensive intuition can fail under adaptive interaction. "Noise as a Double-Edged Sword: Reinforcement Learning Exploits Randomized Defenses in Neural Networks" (Bakos et al., 2024) studies output noising that preserves the top confidence and redistributes the remaining mass across non-top classes using a Dirichlet law. Against an adaptive PPO attacker, this randomization can become an exploitable stochastic observation channel. The paper reports that the noise-based defense scenario is the best scenario for the attacker in four MobileNetV2 classes and, for class 39, improves attacker success by about $x^\star$1–$x^\star$2 over other informed-output settings and by up to $x^\star$3 over black-box. This directly challenges the assumption that randomness uniformly helps defense (Bakos et al., 2024).

A more recent deployment-oriented variant appears in "Taming Variability: Randomized and Bootstrapped Conformal Risk Control for LLMs" (Pang et al., 27 Sep 2025). Here the LLM is wrapped by an API-level actuator with loss

$x^\star$4

where $x^\star$5 is a label-free online score and $x^\star$6 is an offline calibration-only risk flag. The randomized method, RBWA-CRC, samples simplex weights $x^\star$7 and forms batch losses

$x^\star$8

The resulting threshold $x^\star$9 satisfies

$\Omega$0

The paper proves unbiasedness, a variance dial $\Omega$1, and an anti-concentration property showing that $\Omega$2 has no atoms when the within-batch losses are not constant. In this setting, randomization smooths the calibration functional rather than the model input, but the objective is the same: stabilize a decision boundary under noisy black-box variability (Pang et al., 27 Sep 2025).

5. Quantum information: randomized sequences, noisy certification, and randomized control ensembles

Quantum-information settings supply both direct and indirect uses of randomized-control noising. "Randomized Benchmarking with Confidence" (Wallman et al., 2014) analyzes randomized benchmarking (RB) as characterization under randomly chosen control sequences. For arbitrary Markovian noise, the variance over random sequences is provably small. The paper gives bounds such as

$\Omega$3

for qudits and

$\Omega$4

for qubits, and turns these into finite-sampling guarantees. It also shows that time-dependent Markovian noise yields

$\Omega$5

so RB can characterize time-local drift rather than only a static average (Wallman et al., 2014).

"Randomized benchmarking in the presence of time-correlated dephasing noise" (Qi et al., 2020) sharpens this by solving RB exactly for temporally correlated dephasing. In the classical case,

$\Omega$6

while in the quantum spin-boson case an additional phase-memory term $\Omega$7 appears. The paper shows that time correlations do not automatically destroy near-exponential decay: broad-spectrum or short-memory noise often still looks approximately exponential, whereas long-memory or quasistatic noise can produce strongly non-exponential behavior, including

$\Omega$8

in a DC-noise regime (Qi et al., 2020).

The most direct quantum analogue of randomized-control noising appears in "Randomized Quantum Optimal Control" (Kim et al., 12 Jul 2026). Standard quantum optimal control searches for a single waveform $\Omega$9; randomized QOC instead optimizes an ensemble $\mu_t=(S_t^\omega)_\#\gamma$00 with probabilities $\mu_t=(S_t^\omega)_\#\gamma$01, implementing the mixed-unitary channel

$\mu_t=(S_t^\omega)_\#\gamma$02

The optimization target is

$\mu_t=(S_t^\omega)_\#\gamma$03

The paper proves that randomized QOC can reach a target accuracy faster than deterministic control under the same resource constraints, and in an exactly solvable single-qubit model obtains

$\mu_t=(S_t^\omega)_\#\gamma$04

The mechanism is coherent-error cancellation: if different branches implement symmetry-related error generators $\mu_t=(S_t^\omega)_\#\gamma$05 whose average vanishes, first-order coherent error disappears and only second-order terms remain. The same logic underlies randomized GRAPE and randomized boundary-pulse constructions for coherent-noise robustness (Kim et al., 12 Jul 2026).

A nearby but distinct case is "More randomness from noisy sources" (Bancal et al., 2014). That paper explicitly states that it is not about injecting noise deliberately as a control signal. Instead, it studies Bell experiments with characterized source noise and shows that randomness certification can be improved by optimizing the Bell expression to the actual noisy correlation point and by using the trusted-provider adversarial model. Its relevance is therefore conceptual rather than terminological: it exemplifies noise-aware certification, not deliberate randomized-control noising (Bancal et al., 2014).

6. Common mechanisms, limitations, and conceptual boundaries

Across these literatures, randomized-control noising is consistently beneficial only when the perturbation is aligned with a downstream invariance or decision mechanism. In shape analysis, noising helps mainly for points already close to being global extrema, and it does not help points that are poorly positioned globally (1608.00668). In randomized smoothing, certification with input-dependent variance is valid only when the variance assignment is locally constant around the input (Sun et al., 1 Dec 2025). In query defense, the benefit of per-query Gaussian corruption is controlled by the ratio $\mu_t=(S_t^\omega)_\#\gamma$06, so a small defender noise can fail if the attacker adapts $\mu_t=(S_t^\omega)_\#\gamma$07 upward (Qin et al., 2021). In quantum optimal control, quadratic suppression depends on symmetry relations that map a deterministic control into branches with canceling coherent errors (Kim et al., 12 Jul 2026).

The same comparison also shows that randomization is not automatically protective. Noisy training for randomized smoothing is not universally helpful; without stronger distributional assumptions, the best provable upper bound on excess benign risk worsens monotonically with both training noise $\mu_t=(S_t^\omega)_\#\gamma$08 and smoothing noise $\mu_t=(S_t^\omega)_\#\gamma$09 (Pal et al., 2023). Output randomization can create an adversarial training loop favorable to an RL attacker, rather than an information barrier (Bakos et al., 2024). In control-affine stabilization, randomized-control noising can still generate meaningful reverse policies in systems with abnormal extremals, but exact stabilization may fail; the Martinet example is reported to converge to a one-dimensional curve rather than exactly to the origin (Elamvazhuthi, 3 Oct 2025).

This suggests that randomized-control noising is best understood as a design pattern with three recurrent ingredients. First, the perturbation is structured rather than arbitrary: circle-intersection boundary refinement, Bernoulli entity selection, Dirichlet batch weights, admissible control-path sampling, or symmetry-generated control ensembles. Second, a stable object is preserved: global distance integrals, a continuity equation, a certified locally constant variance map, a conformal risk bound, or a target quantum channel in expectation. Third, the perturbation is useful only when it changes the conditioning of the estimation or control problem more than it damages the object being preserved.

A final conceptual boundary is therefore necessary. Some papers in the broader noise literature optimize certification under known source noise, characterize noise with randomized sequences, or study robustness of randomized defenses, but they do not all instantiate randomized-control noising in the narrow sense of deliberately injecting or selecting perturbations as the actuator itself. The literature surveyed here supports a narrower definition: randomized-control noising is the deliberate, often parameterized, introduction of stochastic or pseudo-stochastic variation at the control, perturbation, or calibration layer so that averaging, disintegration, or geometric support yields a better-conditioned and sometimes certifiable decision rule.