Stress certificates and a conditional trade-off

Margin-based robustness arguments are standard Tsuzuku. Gaussian randomized smoothing also has a rigorous literature Cohen. The observable here is different: $S_{\theta }(\sigma )$ is ordinary accuracy averaged over hidden perturbations, not the certified adversarial accuracy of a smoothed classifier.