Certified defenses are provably robust to a specific class of adversarial perturbation, and can guarantee that for any input x, the classifier's prediction is constant within a neighborhood of x. These are typically based on certification methods which are either exact (a.k.a "complete") or conservative (a.k.a "sound but incomplete"). Exact methods, usually based on Satisfiability Modulo Theories solvers [18,11] or mixed integer linear programming [34,24,12], are guaranteed to find an adversarial example around a datapoint if it exists. Unfortunately, they are computationally inefficient and difficult to scale up to large neural networks. Conservative methods are also guaranteed to detect an adversarial example if exists, but they might mistakenly flag a safe **data** point as vulnerable to adversarial examples. On the bright side, these methods are more scalable and efficient which makes some of them useful for building certified defenses [39, 36, 37, 27, 28, 40, 10,9,7,30,13,26,31,15,38,41]. However, none of them have yet been shown to scale to practical networks that are large and expressive enough to perform well on ImageNet, for example. To scale up to practical networks, randomized smoothing has been proposed as a probabilistically certified defense.