Certifying robustness when language model routes change

A robustness certificate is meant to say that a prediction will hold across allowed text changes. But in a mixture-of-experts model, those changes can alter which experts run, raising a concrete question: does a certificate still describe the model’s computation when its route changes?

CertMoE certifies both which experts perturbed inputs may use and whether predictions stay stable within that certified pool.

A robustness certificate is useful only if it covers the computation a model actually runs. In mixture-of-experts language models, a changed input can select different experts, so can a certifier account for those changing routes and still check whether predictions remain stable?

CertMoE first certifies that perturbed inputs stay within a larger expert pool, then certifies prediction stability in a model restricted to that pool. On one model’s sentiment-classification test, adding it to RanMASK lowered the share of certified inputs with attack-found prediction changes from 32.98% to 6.25%.

This supports more selective certificates in that setting, while the attacks searched only part of each certified region.

These attack results are evidence from searches of only part of each certified region, not exhaustive proof that every certificate holds or fails. The evaluation covers text classification on three representative MoE models; results for other architectures and generation tasks remain untested.