Adaptive Randomized Smoothing: Certifying Multi-Step Defences against Adversarial Examples
We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of test-time models against adversarial examples. ARS extends the analysis of randomized smoothing using f-Differential Privacy to certify the adaptive composition of multiple steps.