  We propose Adaptive Randomized Smoothing (ARS) to certify the predictions of
our test-time adaptive models against adversarial examples. ARS extends the
analysis of randomized smoothing using f-Differential Privacy to certify the
adaptive composition of multiple steps. For the first time, our theory covers
the sound adaptive composition of general and high-dimensional functions of
noisy input. We instantiate ARS on deep image classification to certify
predictions against adversarial examples of bounded $L_{\infty}$ norm. In the
$L_{\infty}$ threat model, our flexibility enables adaptation through
high-dimensional input-dependent masking. We design adaptivity benchmarks,
based on CIFAR-10 and CelebA, and show that ARS improves accuracy by $2$ to
$5\%$ points. On ImageNet, ARS improves accuracy by $1$ to $3\%$ points over
standard RS without adaptivity.
