Pest classifiers deployed on field-acquired images are exposed to adversarial perturbations that can flip a confident prediction while remaining visually inconspicuous to a human scout. The classifier is smoothed by adding isotropic Gaussian noise to the input and taking a majority vote over the induced distribution; the resulting certificate bounds the L2 radius within which no perturbation can change the predicted class. The analysis is a design and power study, not an observational one: the operating characteristics of the certification procedure are evaluated across a declared variance structure with between-cluster SD = 6.0, residual SD = 4.5 and intraclass correlation = 0.64, using 2000 replications per design cell over cluster counts of 8, 16, 24 and 32 and effect sizes of 3, 5 and 8 percentage points. The design attains 80% power at 5 percentage points with 52 clusters. The certified radius is a deployment parameter rather than a benchmark score, and that the intraclass correlation of field imagery governs how many independent field clusters a certification claim requires. The contribution is a formal certificate, a power-calibrated protocol for evaluating it, and a boundary condition: certification is informative only when the smoothing variance is matched to the perturbation budget the deployment actually faces.
No takes yet. Share an insight, caveat, or question.
Wanjiru et al. (2026) studied this question.