Randomized smoothing and IBP are two entry points into a much larger family. Other approaches include:

Lipschitz continuity-based methods: bound how much the output can change relative to a bounded change in input by constraining the network's Lipschitz constant.
Convex relaxation-based certification: replace non-convex components like ReLU with convex outer approximations to make the verification problem tractable.
Certifiably robust training: train the model against the certification bounds directly, rather than certifying a model trained without that objective.
CROWN-IBP (CROWN – Interval Bound Propagation): combines a linear-relaxation bound (CROWN) with IBP to tighten certified bounds while keeping training efficient.
Duality-based certification (e.g., SDP): use semidefinite programming or other convex duality formulations to compute certified bounds.
Neural verification-based approaches: formally verify network properties, often via SMT or branch-and-bound solvers, to prove no adversarial example exists in a region.
Polyhedral and zonotope methods: propagate more expressive geometric shapes than intervals through the network for tighter bounds.
Layer-wise certification (e.g., DeepZ, DeepPoly): apply abstract interpretation layer by layer, choosing relaxations tuned to each layer's structure.
Mixed integer linear programming (MILP): encode the network exactly and solve for worst-case outputs, trading scalability for tightness.
Adversarial training with certified bounds: combine empirical adversarial training with a certified bound as part of the loss.
Stochastic Polyak-Łojasiewicz certification: use optimization-landscape conditions to certify robustness properties of the training process.
Certifiable robustness via input transformations: certify robustness for a model composed with a preprocessing transform, such as randomized smoothing's noise step or other input mappings.

Adversarial Defenses