ICML 2026 — Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothing

Independent reproduction audit of Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothing.

Paper: arXiv:2605.12876 · OpenReview: nf7JT1jCSy · ICML 2026 downloads
Authors: Blaise Delattre, Hengyu Wu, Paul Caillon, Wei Yang Bryan Lim, and Yang Cao
Repository: icml26-hybrid-randomized-smoothing · owner: MachineLearning-Nerd

Current verdict

Overall status: OFFICIAL HIGH-QUALITY 4/4 — VERIFIED CLAIMS WITH EXPLICIT SCOPE.

The historical reproduction-challenge result is preserved at the immutable Hugging Face Space, SHA 8a9b8651925507234e25f310cd5f35cab4e81b60, judged on 2026-07-19. The original 3/4 result marked C1 as toy; the exactly-ten-route repair below addresses that gap with an actual multimodal model and real data.

No new judge score, author endorsement, or claim that every paper experiment has been rerun is made here. The score above is the historical official challenge record, while the claim verdicts are tied to the persisted evidence and its independent verifier.

What the paper does

The paper develops randomized-smoothing certificates for multimodal inputs with both discrete text and continuous image perturbations. It factorizes the joint noise into a discrete channel and a Gaussian channel, then solves the worst-case Neyman–Pearson problem by a one-dimensional likelihood-ratio threshold. The resulting closed form is intended to recover ordinary Gaussian image smoothing and discrete text smoothing as limiting cases while remaining model-agnostic: the certificate consumes a smoothed class probability rather than model internals.

The official code includes the paper's broader multimodal safety pipeline. This repository adds a clean-room NumPy/SciPy implementation, an actual CLIP experiment, an independent artifact verifier, and a durable audit trail for the ten-route C1 repair.

Claim-to-evidence map

C1 — actual-model repair with exactly ten routes

repro/src/run_claim1_exactly10.py is the sole producer. It verifies the hashes of the pinned Flickr30k and CIFAR-10 parquet files, uses the pinned CLIP revision through actual_multimodal.py, persists a route checkpoint, and fail-closes unless route numbers 1..10 appear exactly once and route 11 is rejected.

The independent verify_claim1_evidence.py does not import the production certificate module or runner. It recomputes Clopper–Pearson bounds, radii, route aggregates, official parity, attack constraints, and artifact hashes from the persisted CSV/JSON/NPZ evidence. It verifies 430 evidence rows, zero recomputed radius error, and official parity within 4.25e-12.

C2 — closed-form limits and negative controls

repro/src/run_c2.py exercises five checks over the clean-room hybrid_rs_cr.py implementation:

1. γ=1 recovers Cohen's Gaussian certificate to the recorded tolerances.
2. As σ→∞, the discrete channel converges to its likelihood-ratio staircase.
3. A Monte-Carlo Neyman–Pearson calculation agrees with the closed form.
4. A nontrivial hybrid channel yields a positive radius strictly below the pure-Gaussian radius.
5. The invalid separable/Gaussian-only control disagrees with the joint bound.

The five results are stored in outputs/c2_summary.json and explained in CLAIM_EVIDENCE.md.

Reproduce or verify

The full actual-model route is resource-intensive and requires the pinned parquet files, model downloads, and a CUDA-capable environment. The historical run took about 90 minutes on a GTX 1050. Do not launch it without those inputs.

uv sync
PYTHONPATH=repro/src python repro/src/run_claim1_exactly10.py \
  --flickr-parquet /path/to/flickr30k-test-0000.parquet \
  --cifar-parquet /path/to/cifar10-test-0000.parquet
python repro/src/verify_claim1_evidence.py

The smaller mathematical checks and focused tests are:

PYTHONPATH=repro/src python repro/src/run_c1.py
PYTHONPATH=repro/src python repro/src/run_c2.py
python -m pytest -q

The publication checks are lightweight and never launch model inference:

python repro/src/verify_publication.py
python repro/src/publication_gate.py --skip-producers

Pinned provenance

The upstream/ directory is a copied snapshot of the official implementation, not a submodule. Its source pin is recorded in SOURCE_MANIFEST.md.

Repository layout

• repro/src/hybrid_rs_cr.py — clean-room NumPy/SciPy certificate formulas.
• repro/src/run_c1.py and run_c2.py — mathematical claim producers.
• repro/src/actual_multimodal.py — pinned CLIP black-box adapter and kernels.
• repro/src/run_claim1_exactly10.py — ten-route actual-model producer.
• repro/src/verify_claim1_evidence.py — independent evidence verifier.
• outputs/claim1_exactly10/ — route ledger, raw evidence, hashes, and verdict.
• upstream/ — official implementation snapshot at the pinned commit.
• STATUS.md — current verdict and reproduction boundary.
• CLAIM_EVIDENCE.md — claim-to-code-to-output production paths.
• BRANCH_AUDIT.md — old-to-new branch mapping.
• SOURCE_MANIFEST.md and sources.json — source provenance, citation, and thanks.
• evidence/claim_summary.json — durable promotion boundary.
• repro/src/verify_publication.py and publication_gate.py — publication hygiene checks.

Clean branch map

The original repository had only master. It becomes the reader-facing publication branch main; there are no retained experiment branches to classify.

Citation

@inproceedings{delattre2026hybrid,
  title={Certified Robustness under Heterogeneous Perturbations via Hybrid Randomized Smoothing},
  author={Delattre, Blaise and Wu, Hengyu and Caillon, Paul and Lim, Wei Yang Bryan and Cao, Yang},
  booktitle={Proceedings of the International Conference on Machine Learning},
  year={2026},
  url={https://arxiv.org/abs/2605.12876}
}

Thank you

Thank you to Blaise Delattre, Hengyu Wu, Paul Caillon, Wei Yang Bryan Lim, and Yang Cao for the paper, the official implementation, and the opportunity to study hybrid randomized-smoothing certificates on mixed discrete–continuous inputs. This repository is an independent reproduction audit; it does not represent the authors' implementation, approval, or endorsement.

Related files

• Current status
• Claim evidence production paths
• Branch audit
• Source manifest