  We extend randomized smoothing to cover parameterized transformations (e.g.,
rotations, translations) and certify robustness in the parameter space (e.g.,
rotation angle). This is particularly challenging as interpolation and rounding
effects mean that image transformations do not compose, in turn preventing
direct certification of the perturbed image (unlike certification with $\ell^p$
norms). We address this challenge by introducing three different kinds of
defenses, each with a different guarantee (heuristic, distributional and
individual) stemming from the method used to bound the interpolation error.
Importantly, we show how individual certificates can be obtained via either
statistical error bounds or efficient online inverse computation of the image
transformation. We provide an implementation of all methods at
https://github.com/eth-sri/transformation-smoothing.
