Position: Certified Robustness Does Not (Yet) Imply Model Security

TL;DR

Certified robustness in AI aims to defend against adversarial attacks but currently faces significant challenges, including gaps in evaluation, security risks, and misaligned perceptions, hindering real-world deployment.

Contribution

This paper highlights critical issues in certified robustness research and proposes concrete steps to improve evaluation, security, and practical applicability.

Findings

Identification of the paradox of detection without distinction

Lack of clear evaluation criteria for certification schemes

Potential security risks from misaligned robustness claims

Abstract

While certified robustness is widely promoted as a solution to adversarial examples in Artificial Intelligence systems, significant challenges remain before these techniques can be meaningfully deployed in real-world applications. We identify critical gaps in current research, including the paradox of detection without distinction, the lack of clear criteria for practitioners to evaluate certification schemes, and the potential security risks arising from users' expectations surrounding ``guaranteed" robustness claims. These create an alignment issue between how certifications are presented and perceived, relative to their actual capabilities. This position paper is a call to arms for the certification research community, proposing concrete steps to address these fundamental challenges and advance the field toward practical applicability.