CertMoE: Robustness Certification for Mixture-of-Experts LLMs via Routing-Aware Smoothing

CertMoE: Robustness Certification for Mixture-of-Experts LLMs via Routing-Aware Smoothing Qingyue Wang∗ , Yudong Gao∗ , Lixia Wang† , Ruixuan Huang∗ , Yuanyuan Yuan‡ , Yangqiu Song∗ , Shuai Wang∗

arXiv:2610.29395v1 [cs.CR] 21 Oct 2026

∗ The Hong Kong University of Science and Technology † Academy of Mathematics and Systems Science, Chinese Academy of Sciences ‡ Tsinghua University

Abstract—Provable robustness is a cornerstone of trustworthy machine learning, aiming to guarantee model predictions under adversarial perturbations. Existing certification frameworks, inspired by abstract interpretation or symbolic execution, typically assume a fixed computation graph, where input perturbations or variations affect only model outputs but not the underlying execution path. This assumption, however, is violated in Mixtureof-Experts (MoE) Large Language Models (LLMs), whose inputdependent routing induces discrete and dynamic execution paths. Crucially, this dynamic computation changes the certified object from a single fixed function to a composition of input-dependent sub-functions, leading to unreliable certification guarantees. This paper presents C ERT M O E, the first routing-aware robustness certification framework for MoE LLMs, which explicitly accounts for input-induced routing dynamics in certification. Specifically, we introduce a relaxed routing-containment criterion, which certifies that perturbed Top-K routing is contained within a larger certified expert pool. Based on this guarantee, C ERT M O E then constructs the corresponding induced subnetwork and certifies its prediction consistency. This hierarchical certification procedure yields a joint probabilistic guarantee over routing containment and sub-network robustness, providing sufficient conditions under which the original prediction remains invariant. Extensive experiments across recent MoE LLMs demonstrate that dynamic routing makes certificates issued by existing methods frequently violated, while C ERT M O E reduces the empirical violation rate with routing-aware guarantees, e.g., from more than 30% to 0, yielding certificates that more faithfully reflect the robustness of MoE models. Index Terms—Robustness Certification, Mixture-of-Experts

I. I NTRODUCTION Mixture-of-Experts (MoE) [1, 2] has become the key architecture for scaling large language models (LLMs) while keeping inference costs manageable. It has been adopted in the backbone of general-purpose systems such as Gemini [3], Deepseek [4], and Grok [5]. Additionally, recent work has introduced MoE models into software engineering tasks, such as vulnerability detection [6] and repair [7], where model errors can directly affect system security. As MoE LLMs are increasingly deployed in reliability- and security-sensitive Corresponding author: Yuanyuan Yuan (yyyuan@mail.tsinghua.edu.cn). Other authors’ emails: Qingyue Wang (qingyue.wang2018@gmail.com); Yudong Gao (ygaodj@connect.ust.hk); Lixia Wang (wanglixia@amss.ac.cn); Ruixuan Huang (rhuangbi@connect.ust.hk); Yangqiu Song (yqsong@cse.ust.hk); Shuai Wang (shuaiw@cse.ust.hk).

settings [8], it becomes pressing to establish robustness guarantees for MoE LLMs in a meaningful and reliable way. A principled way to establish such guarantees is through formal robustness certification [9, 10], which provides provable robustness guarantees by verifying prediction invariance within a specified input perturbation or variation region. Existing certification techniques, including deterministic methods that are based on interval bound propagation [11], abstract interpretation [12], symbolic execution [13], etc., and probabilistic methods like randomized smoothing [10, 14], typically rely on the assumption that the computation graph of the certified model is fixed. Thus, the model can be represented as a single, unchanged function throughout the certification procedure, enabling output behaviors to be bounded or probabilistically controlled over the specified input region. However, this assumption is violated by MoE LLMs, whose input-dependent routing decisions induce dynamic computation graphs (see Fig. 1a). In particular, inputs within the certified region can alter the activated expert set, causing the model to execute through different computation paths, and consequently leading to different underlying functions for the same certified input region. As illustrated in Fig. 1b, a minor perturbation can switch the activated experts from {E1 , E4 } to {E2 , E4 }, turning the certified model from f ′ to f ′′ . Consequently, although existing methods may still be applied without crashes, the issued certificate becomes arbitrary because the certified model has already changed. Empirically, on the SST2 dataset (see Sec. V-C), we find that > 30% of certificates issued by existing methods are invalid: standard attacks can frequently flip the model’s outputs within the input regions where the model is certified to be robust. Existing studies have begun to explore and understand the adversarial robustness of MoE models. Prior work shows that routing structure, expert similarity, and expert redundancy can substantially affect the robustness of sparse MoEs [15]. More recent work further studies robustness from the perspective of output sensitivity and robust training [16]. These studies provide valuable insights into the robustness behavior of MoE models and the architectural factors that influence it. However, they mainly focus on analyzing robustness factors or improving training-time robustness, while how to perform

Dense Model

MoE Model

MoE Layer

Dense Model

MoE Model

Certified Radius for 𝒇(𝒙)

Certified Radius for 𝒇! (𝒙) 𝒐𝒓 𝒇!! (𝒙) ?

𝒇!

𝑓 FFN

E1

E3

E2

𝒇!!

E4

Norm

Norm

Multi-head Attention

Multi-head Attention

𝒙

𝒙

(a) Architecture of Dense and MoE Models.

E1

FFN

Router

𝒙′

𝒙′′ 𝒙

E2

E3

E1

E4

E2

E3

Router

Router

𝒙′

𝒙′′

E4

𝒙

(b) Certification on Dense and MoE Models.

Fig. 1: Comparison between dense and MoE models. (a) Architecture: MoE replaces the FFN layer with routed experts. (b) Certification: In dense models, the model function f remains static under input perturbations (x′ , x′′ ). In MoE models, input perturbations trigger different routing paths, leading to functional instability (f ′ ̸= f ′′ ) that complicates the derivation of a consistent certified radius. Only a single MoE layer is shown for simplicity.

certification for the MoE model remains less clear. This paper points out that robustness certification for MoE models should explicitly account for perturbation-induced changes in model structure: a certificate is meaningful only if the model’s execution paths are covered w.r.t. the certified input region. To this end, we propose C ERT M O E, the first routing-aware robustness certification framework for MoE LLMs. C ERT M O E extends existing certification methods to MoE models by explicitly accounting for perturbation-induced computation graph changes. In this paper, we instantiate C ERT M O E with randomized smoothing, a certification framework that scales to modern LLMs. Specifically, C ERT M O E decomposes certification into a hierarchical procedure that certifies both routing containment and prediction stability. We first aggregate token-level expert selections into sequence-level routing and certify their ρ-relaxed robustness under bounded input perturbations, where ρ decides the size of the certified expert pool. This avoids overly conservative exact-routing requirements, while still covering the perturbation-induced execution paths. After that, we restrict the candidate experts to the certified routing pools to construct an induced sub-network, and certify the robustness of this sub-network’s output. Finally, a union bound combines the routing and output certificates into an end-to-end robustness guarantee. We develop C ERT M O E on top of two smoothing-based certification frameworks, RanMASK [17] and SelfDenoise [18], and conduct experiments on two classification tasks across three representative MoE LLMs. Both baselines and their C ERT M O E-enhanced variants are evaluated using violation rate (VR), which measures the fraction of issued certificates for which standard attacks find adversarial examples within the certified input regions. We find that certificates from existing methods are violated frequently, with VR exceeding 30% on SST-2. By incorporating routing-awareness, C ERT M O E substantially reduces such violations. Further ablations show that the certified expert-pool size of routing-containment is critical: a larger pool relaxes the routing-containment condition and

makes C ERT M O E more likely to assign certificates to inputs, but overly permissive pools weaken the routing-containment constraint and may lead to more certificate violations. Beyond final certificates, C ERT M O E can decompose certification outcomes into routing-containment and sub-network components, enabling failure attribution. As an on-demand certification procedure, it incurs roughly 2× runtime only when a certificate is requested, while leaving standard MoE inference unchanged. Our contributions are summarized as follows: • We identify a fundamental mismatch between existing robustness certification and MoE LLMs: existing certifiers assume a fixed computation graph inside the model, whereas MoE routing turns the certified model into different input-dependent functions, resulting in arbitrary certificates that are frequently violated in practice. • We propose C ERT M O E, a framework that enables robustness certification for MoE LLMs by instantiating existing certifiers with routing-aware guarantees. C ERT M O E decomposes certification into relaxed routing containment and output stability, and combines their certificates via a union bound to provide end-to-end robustness guarantees. • Our empirical results show that C ERT M O E substantially reduces certificate violations. Further ablations analyze the trade-off induced by certified expert-pool size and demonstrate that C ERT M O E enables failure attribution with moderate on-demand certification overhead. II. BACKGROUND AND R ELATED W ORK Mixture-of-Experts LLMs. MoE architectures have been widely adopted to scale large language models efficiently, as demonstrated by systems such as Switch Transformer [19] and Deepseek-V2 [20]. In Transformer-based MoE models, the standard feed-forward network (FFN) in a transformer block is typically replaced by an MoE layer, which consists of a router and multiple experts, where each expert is itself an independent FFN, as illustrated in Fig. 1a. Formally, at layer l, let E = {E1 , E2 , . . . , EN } denote the pool of N

B(x, d) = {x′ ∈ X | ||x − x′ ||0 ≤ d}. (1) P n ′ where ||x − x′ ||0 = i=1 I{xi ̸= xi } is the Hamming distance and I(·) is the indicator function. The classifier f is considered certifiably robust at input x within radius d if : ∀x′ ∈ B(x, d), f (x′ ) = y. The certified radius d quantifies the model’s tolerance to perturbations. Generally, the certification objective is to design a method that, given an arbitrary input x, certifies a radius d within which the prediction is guaranteed to remain correct. Randomized Smoothing on Text. Robustness certification has been widely studied for neural networks, including exact verification and relaxation-based methods [9, 11, 23, 24]. However, these methods often face scalability challenges on modern deep models. Recently, randomized smoothing has emerged as a scalable alternative by certifying a smoothed classifier through repeated noisy inference [10, 17, 25]. In the text domain, this is commonly instantiated by randomly masking or perturbing tokens and aggregating predictions over the resulting noisy inputs [17, 18]. We adopt this paradigm because it is compatible with discrete token perturbations and applicable to LLM-scale models. Consider a text classification task with input x = {x1 , . . . , xn } and label y ∈ Y. Let f : X → Y denote a base LLM classifier. Consistent with prior work [17], we adopt a masking-based randomized smoothing strategy: given a perturbation ratio m ∈ [0, 1], we randomly select s = ⌊(1 − m) · n⌋ positions of x to keep, and then replace the remaining tokens with the special [MASK] token. Let M(x, H) denote this masking operation, where H ⊆ {1, . . . , n} is the set of kept (unmasked) indices, e.g., for x = “A B C D E” and H = {1, 3, 5}, M(x, H) =“A [MASK] C [MASK] E”. The smoothed classifier is defined as
g(x) = arg max PH∼Un,s f (M(x, H)) = c , (2) c∈Y

where Un,s denotes the uniform distribution over all ns possible selections of s positions from n positions, and predictions are aggregated over multiple sampled masks. This allows us

Top-K Flip Rate (%)

experts. Given an input sequence x = {x1 , x2 , . . . , xn }, let ht ∈ RD denote the hidden representation of the t-th token. The router computes a gating distribution over experts as pt = Softmax(Wr ht ), where Wr ∈ RN ×D are the learnable routing parameters. Finally, the active experts are selected as Kt = Top-K(pt ), i.e., the top-K experts ranked by pt [21]. Overall, an MoE layer performs conditional computation: different inputs may activate different expert subsets and therefore induce different computation paths. Robustness Guarantee. Unlike heuristic defenses that can be broken by adaptive attacks [22], certified robustness provides provable guarantees against adversarial perturbations. Following existing work on text robustness [10], we consider tokenlevel perturbations defined by Hamming distance. Formally, consider an input sequence x ∈ X and a text classifier f : X → Y. Let f (x) = y and B(x, d) represents a perturbation ball centered at x with radius d ∈ N:

mask, m=0.2 mask, m=0.4 denoise, m=0.2 denoise, m=0.4 DeepSeek-V2-Lite (n=64, top-6) Qwen1.5-MoE-A2.7B (n=60, top-4) 100 100 75

75

50

50

25

1 5 9 13 17 21 25 MoE Layer

25

0

4

8 12 16 20 MoE Layer

Fig. 2: Layer-wise Top-K routing flip rates on SST-2, measured as the percentage of tokens whose selected Top-K expert set differs from that of the clean input at each MoE layer.

to derive a certified radius d for the prediction g(x), ensuring that the model prediction remains invariant. III. M OTIVATION AND A PPLICATION S COPE Key Insight. The fundamental limitation of applying existing certification techniques to MoE models lies in the routinginduced dynamics of the computation graph. Existing certification methods, such as randomized smoothing [10], implicitly assume the underlying model is a fixed, deterministic function of the input. However, in MoE LLMs, the Top-K routing is inherently discrete and highly sensitive to input variations. As a result, perturbing the input does not merely perturb the output; it can also change which function (i.e., which subset of experts) is being certified. Fig. 2 shows a layer-wise analysis on DeepSeek-V2-Lite and Qwen1.5-MoE-A2.7B, where a majority of tokens (over 50%) undergo Top-K routing flips due to input perturbations. confirming that input perturbations can substantially alter expert selection and introducing discontinuities in the predictive function. Consequently, the randomness involved in the certification process reflects not only output uncertainty but also routing instability. This leads to unreliable certified radii that do not faithfully characterize the true robustness of the model. Based on this analysis, we point out that robustness guarantees in MoE models should not be conducted in an endto-end way, and that meaningful certification instead requires a decoupled hierarchical approach. Positioning & Application Scope. Following the standard robustness certification setting [10, 12], C ERT M O E is an ondemand certification tool: it is invoked only when a certificate is required for a given input, while the MoE model otherwise performs standard inference. Table I highlights this positioning: C ERT M O E extends verification-style certification from fixed computation graphs to LLM-scale MoE models with input-dependent execution paths. We evaluate C ERT M O E on text-only MoE LLMs because they provide a representative and practically important setting where input-dependent routing directly affects certification. Since most text robustness certification methods focus on classification-style outputs, we formulate robustness as label invariance. Nevertheless, the framework is not tied to this setting and may be extended to other tasks and modalities, as discussed in Sec. VI.

TABLE I: Positioning of C ERT M O E relative to representative AI/ML certification and MoE robustness analysis. D1: Formal or probabilistic guarantee; D2: Applicable to LLM-scale models; D3: Handles Dynamic Computation Graphs. Category

Representative Methods

D1

D2

D3

IBP / Linear Relaxation

Tight Linear Approx [26] (ASE ’22), SharedCert [27] (CAV ’22)

✓

✗

✗

Abstract Interpretation / Convex Abstraction

PRIMA [28] (POPL ’22), Abstraction-Refinement [29] (TOSEM ’24), PreBoxes [30] (ISSTA ’24), FairQuant [31] (ICSE ’25)

✓

✗

✗

Solver-based Verification

QVIP [32] (ASE ’22), Fairify [33] (ICSE ’23), VeriStable [34] (FSE ’24)

✓

✗

✗

Randomized Smoothing

DiffSmooth [25] (USENIX Security ’23), RanMASK [17] (ACL ’23), SelfDenoise [18] (NAACL ’24)

✓

✓

✗

MoE Robustness Analysis

AdvMoE [35] (ICCV ’23), JTDMoE [16] (ICML ’25), RobMoE [15] (NeurIPS ’22)

✗

✓

✓

Routing-aware Certification

C ERT M O E (Ours)

✓

✓

✓

IV. C ERT M O E: ROUTING -AWARE M O E C ERTIFICATION Overview. C ERT M O E decomposes MoE robustness certification into two stages: Routing-Containment Certification first certifies that perturbed Top-K routing remain within certified expert pools; Induced Sub-Network Certification then constructs the induced sub-network from these pools and applies an output-level certifier to verify prediction invariance. This modular design separates MoE-specific routing certification from prediction certification, allowing the latter to be instantiated with existing output-level certifiers. An overview of our method is shown in Fig. 3. A. Routing Containment Certification This section defines smoothed routing for MoE layers and establishes a relaxed routing robustness guarantee. Routing Aggregation and Smoothed Routing. Certifying token-level routing decisions is often impractical and overly restrictive: the certification space grows with sequence length and model depth, while routing changes for individual tokens may not affect the effective computation path or final prediction. Inspired by prior routing studies [36, 37], we aggregate token-level routing to a sentence-level routing decision. Formally, we denote the routing decision function that maps an input sequence x to a set of top-K activated experts as: ! n X R(x) = Top-K I(e ∈ Top-K(pt )) . (3)

where R(·) denotes the Top-K expert selection. The smoothed routing decision is to select the top-K experts according to these probabilities: TK (x) := Top-K (qe (x)).

(5)

Intuitively, qe (x) measures how likely expert e is to be selected when the router observes randomly masked versions of the input. This
expert-level characterization avoids reasoning over N the K possible Top-K expert subsets, making it more scalable for large MoE models. These probabilities provide the basis for identifying consistently selected experts and constructing the certified expert pool. Relaxed Routing Containment. A straightforward notion of routing robustness is exact Top-K stability, where the selected experts remain unchanged under input perturbations. However, this requirement is often too restrictive for MoE LLMs. First, experts may provide redundant or complementary functions [38], so partial changes within the Top-K set may still lead to comparable model behavior. Second, token-level routing is inherently input-dependent: tokens with different semantic roles may activate different expert subsets, and enforcing exact Top-K invariance can unnecessarily restrict the model’s computation. To balance routing stability and model expressiveness, we introduce ρ-relaxed routing containment, which relaxes exact Top-K matching by requiring the Top-K experts selected under perturbation to remain within a larger certified expert pool.

t=1

where I(·) denotes the indicator function, e ∈ E is the selected expert, and pt represents the routing probability for the tth token. This counting-based representation avoids certifying each token-level routing decision separately and provides a tractable object for randomized smoothing. Then, we smooth the routing decision by introducing randomness into the router’s input. Given an input sequence x of length n, we randomly keep sr = ⌊(1 − mr ) · n⌋ tokens and mask the remaining positions. We denote the resulting masked input by M(x, Hr ), where Hr ∼ Un,sr is sampled uniformly from all subsets of sr token indices. For each expert e ∈ E, we define its smoothed routing probability as qe (x) = PHr ∼Un,sr (e ∈ R(M(x, Hr ))) ,

(4)

Definition 1 (ρ-Relaxed: Certified Routing Containment). Let TK (x) denote the top-K selected experts for input x. For a given ρ ∈ (0, 1), define Z = ⌈ρN ⌉, where N is the total number of experts and Z ≥ K. We say that the routing at x satisfies dr -robust ρ-relaxed containment if, for any x′ satisfying ∥x′ − x∥0 ≤ dr , we have TK (x′ ) ⊆ TZ (x).

(6)

Here, TZ (x) = Top-Z(qe (x)) denotes the certified expert pool formed by selecting the Z experts with the largest smoothed routing probabilities. The parameter ρ is a certification-time hyperparameter, similar to the smoothing parameters used in randomized smoothing, such as the masking ratio or noise variance. Such

2 Routing-Containment Certification Top-Z Experts

Router

𝑥! , [MASK], 𝑥# , … , 𝑥$

4

Expert Counts

E1

1 Input Perturbation

E2 E3 E4

𝐸! 𝐸" 𝐸# 𝐸$

𝑙-th Layer

𝑥! , 𝑥" , [MASK], … , 𝑥$ ……

Original Input

[MASK], 𝑥" , 𝑥# , … , 𝑥$

min(%) Operator

3 Induced Sub-Network Certification 𝑙-th Layer

Major Vote on Prediction E2

Router

Certified Radius 𝒅𝑴𝑶𝑬

E1 Label Counts

𝑥! , 𝑥" , 𝑥# , … , 𝑥$

Final Certification

Routing Containment Radius 𝒅𝒍𝒓

E3 E4

Sub−Network Radius 𝒅𝒔𝒖𝒃 A

B

C

D

Classes

Fig. 3: Overview of the C ERT M O E framework. C ERT M O E generates masked perturbations, certifies a Top-Z routingcontainment pool, certifies the induced sub-network restricted to this pool, and combines the two radii to obtain the final certified radius. The figure illustrates one MoE layer with K = 2 and Z = 3.

hyperparameters must be fixed before certifying test samples [25] or calibration procedures [39]. In practice, we select ρ on a small held-out validation set, allowing it to adapt to each model and dataset without tuning on the certified test set. Once selected, ρ is fixed for all test samples in the corresponding dataset. The following theorem gives a sufficient condition for certifying the ρ-relaxed routing containment. Theorem 1 (Certification Condition for ρ-Relaxed Routing Containment). Let qe (x) and qe (x′ ) denote the smoothed routing probabilities of expert e for inputs x and x′ , respectively. Let TK (x) and TZ (x) be the set of top-K and top-Z expert sets at x, respectively. For text x, x′ , ∥x′ − x∥0 ≤ dr , if the following condition holds: min q (x) − max q j (x) > 2β ∆r ,

e∈TK (x) e

j ∈T / Z (x)

(7)

with the proof deferred to the supplementary material (Sec. VIII). We then use this result to derive the main argument. For the input x′ , we have: ∀e ∈ TK (x), ∀j ∈ / TZ (x),

qe (x′ ) ≥ q e (x) − β∆r , ′

qj (x ) ≤ q j (x) + β∆r .

(11) (12)

By the condition in Eq. 7, it follows that min qe (x′ ) > max qj (x′ ).

e∈TK (x)

j ∈T / Z (x)

(13)

Thus, under x′ , the K experts in TK (x) still have higher routing probabilities than any expert outside TZ (x). Since TK (x) ⊆ TZ (x), these K experts are all inside the certified pool, and no outside expert can enter the Top-K set under x′ . Therefore, TK (x′ ) ⊆ TZ (x). B. Induced Sub-Network Certification

where 

   n − dr n ∆r = 1 − / sr sr

(8)

and n   β := max P e ∈ R(M(x, Hr )) Hr ∩ I ̸= ∅ ,  o P e ∈ R(M(x′ , Hr )) Hr ∩ I ̸= ∅ .

(9)

then, with probability at least 1 − α, TK (x′ ) ⊆ TZ (x). Here, β quantifies the worst-case routing probability under the event that the sampled mask intersects with perturbed positions; and ∆r represents the probability that at least one perturbed token position is included in the randomly masking set Hr . Proof. Given text x, x′ , for any expert e ∈ E, we have: |qe (x) − qe (x′ )| ≤ β∆r ,

(10)

Given the certified expert pools, C ERT M O E constructs the induced sub-network and applies a base smoothing certifier to verify its prediction invariance. Definition 2 (Induced Sub-Network under Certified Expert Pools). Let f be a MoE LLM with top-K routing, and let (l) {TZ (x)}l∈L denote the certified expert pools obtained at input x. The induced sub-network fsub is defined by restricting, at each MoE layer l, the candidate experts to the certified (l) pool TZ (x), while the router still recomputes routing scores on the given input and performs top-K selection among these restricted candidates. For any valid perturbed input x′ ∈ X around x,
(l) fsub (x′ ) := f x′ ; {TZ (x)}l∈L . (14) Here, L = {1, 2, . . . , L} denotes the set of MoE layers. Concretely, the induced sub-network keeps the original router unchanged but restricts its candidate expert set to the certified pool at each MoE layer. That is, the router logits (l) are computed normally, logits of experts outside TZ (x) are

masked out, and the model applies its original top-K routing rule within the remaining candidates. When the routingcontainment event holds for every layer, this restriction does not alter the original MoE forward computation: the experts selected by the original router already lie within the certified pools, and therefore the original MoE and the induced subnetwork produce identical outputs. Then, we define the smoothed classification probability of class c ∈ Y as
πc (x) = PHo ∼Un,so fsub (M(x, Ho )) = c , (15) where Ho refers to the set of indices of tokens where so = ⌊(1 − mo ) · n⌋ positions of x are kept (not masked). The prediction of the smoothed sub-network is then gsub (x) = arg maxc∈Y πc (x). We next establish a robustness condition guaranteeing classification stability under input perturbations. Theorem 2 (Induced Sub-Network Robustness Condition). Let gsub (x) = y be its predicted class. For any input x′ such that ∥x′ − x∥0 ≤ dsub , if πy (x) − max πj (x) > 2γ∆sub , j̸=y

(16)

n
sub where ∆sub = 1 − n−d / so and γ denotes the condiso tional probability that the classifier predicts class c when the sampled mask retains at least one perturbed word. Then, with probability at least (1 − δ), we have gsub (x′ ) = y.

Algorithm 1 Routing-Aware MoE Certification (CertMoE) Require: x, y ∗ , MoE f with routers {R(l) }l∈L , sr , so , Nr , Nr′ , No , No′ , K, Z, α, δ Ensure: Certified radius dMoE 1: function C ERTIFY ROUT(x, R(l) , sr , Nr , Nr′ , K, Z, α) r 2: Sample {Hi }N i=1 ∼ U(n, sr ) and compute routing counts Cr [e] (l) (l) 3: TK ← Top-K(Cr ), TZ ← Top-Z(Cr ) ′ ′ Nr 4: Sample {Hi }i=1 ∼ U(n, sr ) and compute Cr′ [e] (l) (l) 5: Derive q e (e ∈ TK ), q j (j ∈ / TZ ) from Cr′ at confidence 1−α (l) (l) (l) 6: return (dr , TZ ) where dr = max{d : Eq. 7} 7: end function 8: function C ERTIFY S UB(x, y ∗ , fsub , so , No , No′ , δ) o 9: SampleP {Hi }N ∼ U(n, so ) and compute ŷ = i=1 arg maxc i I[fsub (M(x, Hi )) = c] 10: return N/A if ŷ ̸= y ∗ ▷ Abstain if prediction is incorrect No′ 11: Sample {Hi′ }i=1 ∼ U(n, so ) and compute class counts Co [c] 12: Derive π y , π j from Co at confidence 1 − δ 13: return max{d : Eq. 16} 14: end function 15: function C ERT M O E(x, y ∗ , f, {R(l) }l∈L ) (l) (l) ∈ L via 16: Compute (dr , TZ ) for all l (l) C ERTIFY ROUT(x, R , sr , Nr , Nr′ , K, Z, α) (l) 17: Construct fsub restricting layer l’s routing to TZ (x) ∗ ′ 18: dsub ← C ERTIFY S UB(x, y , fsub , so , No , No , δ) 19: return N/A if dsub = N/A ▷ Abstain if prediction is incorrect
(l) 20: return min minl∈L dr , dsub 21: end function

Proof. The proof also follows from Eq. (10); see Section 1.2 of the supplementary material (Sec. VIII) for details. C. MoE Robustness Certification We combine the two certification stages to derive the final robustness guarantee for MoE LLMs. Corollary 1 (Probabilistic Robustness Certification for MoE (l) (l) Models). Let Eroute := {TK (x′ ) ⊆ TZ (x), ∀l ∈ L} and (l) Esub := {gsub (x′ ) = y}. For each layer l ∈ L, let dr be the certified ρ-relaxed routing radius with confidence level 1 − α. Let dsub be the certified robustness radius of the induced subnetwork fsub with confidence level 1 − δ. Define   dMoE = min min d(l) , d (17) sub . r l∈L

′

Then for any x ∈ X satisfying ∥x′ − x∥0 ≤ dMoE , P(Eroute ∩ Esub ) ≥ 1 − Lα − δ.

(18)

Consequently, the activated experts of the original MoE model are contained in the certified expert pools. Since the induced sub-network agrees with the original MoE model whenever the routing-containment condition holds, we have fMoE (x′ ) = gsub (x′ ) = y. Proof. By the definition of dMoE , the layer-wise ρ-relaxed routing-containment certificates and the sub-network certificate all apply within this radius. A union bound over the L routing certification failures and the sub-network certification failure gives failure probability at most Lα + δ. Under routing

containment, the original MoE execution is covered by fsub ; hence sub-network invariance implies prediction invariance of the original MoE model. Remarks. CertMoE does not require exact Top-K invariance; perturbed inputs may activate different experts as long as their Top-K experts remain contained in the certified expert pool. Routing variation within this pool is handled by the induced sub-network certification: if the prediction remains invariant within the induced sub-network, CertMoE certifies the input; otherwise, it abstains to preserve soundness. Practical Algorithm. The complete C ERT M O E procedure is summarized in Algorithm 1. We implement both routing and sub-network certification using Monte Carlo sampling and Clopper-Pearson confidence bounds [40] for the smoothed routing and class probabilities. The resulting bounds are used to verify the robustness conditions and compute the final certified radius. Following prior randomized smoothing work [17], the constants β and γ are estimated from the corresponding Monte Carlo probabilities, with details deferred to the supplementary material (Sec. VIII). V. E VALUATION Our evaluation answers fours research questions (RQs): • RQ1: Can CertMoE enable existing certification methods to provide more reliable certificates for MoE LLMs? • RQ2: How sensitive is CertMoE to certification-time parameters such as expert-pool size and masking ratio?

TABLE II: Representative MoE LLMs. “#Act./Total” denotes activated/total parameters. For DeepSeek-V2-Lite, 64 + 2 denotes 64 routed experts plus 2 shared experts. Model

#Layers (L)

Top-K

24 27 32

4 6 2

Qwen1.5-MoE-A2.7B DeepSeek-V2-Lite Phi-3.5-MoE-Instruct

#Experts (N)

#Act./ Total

60 64+2 16

2.7B / 14.3B 2.4B / 16.0B 6.6B / 42.0B

RQ3: What does CertMoE reveal about the sources of certification failures in MoE LLMs? • RQ4: What is the computational overhead of CertMoE? •

A. Experimental Setup Dataset and models. Following previous works on text robustness certification [18, 41], we evaluate our method on SST2 [42] and AGNews [43], two widely adopted benchmarks for certifying text classifiers. SST-2 is a binary sentiment classification dataset, while AGNews is a four-class topic classification dataset. For target models, we consider three popular MoE-based LLMs: Qwen1.5-MoE-A2.7B [44], DeepSeek-v2Lite [20] and Phi-3.5-MoE-instruct [45]. As shown in Table II, these models span different depths, top-K settings, and expert capacities, enabling a comprehensive evaluation across heterogeneous MoE architectures. Baselines. We focus on text-domain smoothing methods whose perturbation space is defined over discrete tokens. Vision-domain smoothing methods [25], are not included because their theoretical guarantees are developed for continuous visual perturbation spaces. Therefore, we compare against two representative open-source methods in this category: (1) RanMASK [17] is a standard text-domain randomized smoothing method that generates masked copies by randomly replacing words with [MASK] tokens and constructs a smoothed classifier via majority voting. (2) SelfDenoise [18] leverages the multitasking nature of LLMs to first denoise the noisy inputs and then to make predictions based on these denoised versions. Configurations. We conducted all experiments on NVIDIA H800 GPUs with 80GB memory. Following prior work [18], we evaluate certified robustness on a randomly selected subset of 100 test samples per dataset, due to the high computational cost of randomized smoothing-based certification. For fairness, all methods are evaluated on the same sampled subset, and we use the same prediction and certification sample sizes for each certification stage. For all methods, each smoothed prediction is estimated with 100 randomly perturbed samples, and each certification bound is computed with 500 samples. For C ERT M O E, this sampling configuration is applied to both routing certification and sub-network certification. We set the input mask ratio to 0.2 for all methods, including both routing and sub-network certification in C ERT M O E. To implement SelfDenoise, we employ an open-source LLM Qwen3-8B [46] to improve computational effectiveness, which denoises the noisy inputs. The overall failure probability is set to 0.10, corresponding to a confidence level of 0.90; for C ERT M O E, we allocate the failure budget by setting Lα = 0.05 and δ = 0.05. We select the certified expert

ratio ρ on a held-out validation set. For SST-2, ρ is set to 0.2 for Qwen and DeepSeek models and 0.4 for Phi; for AGNews, ρ is set to 0.6 for all models. More experiments on ρ are provided in ablation studies (Sec. V-D). To assess the reliability of the certification, we evaluate the certified samples under three attacks, TextBugger (TB) [47], DeepWordBug (DB) [48] and TextFooler (TF) [49], using the default settings of the TextAttack toolkit [50]. We explain their usage in the evaluation metrics. B. Evaluation Metrics Standard metrics such as average certified radius and certified accuracy [17] presuppose a static routing structure, under which certificates are mathematically valid. In MoE settings, however, routing can shift under perturbation, violating this assumption and rendering such metrics ill-suited. In this paper, we therefore evaluate from two complementary perspectives: coverage, measured by certified ratio, and reliability, measured by violation rate and p-value. c Certified Ratio (CR). Given a test set {xi , yi }N i=1 , we define the certified ratio as the fraction of inputs for P which the method Nc I(di > 0), returns a non-trivial certificate: CR = N1c i=1 where di is the certified radius for xi and is set to 0 when certification fails. CR measures how often the certification method issues certificates over the evaluated inputs. Violation Rate (VR). Let f¯ denote the smoothed prediction function used by a given certification method, and let yi = f¯(xi ) be the certified label of input xi . Let C = {i : di > 0} denote the set of certified inputs. VR measures the fraction of certified inputs for which a counterexample exists within the certified region:
1 X VR = I ∃ x′ ∈ B(xi , di ) : f¯(x′ ) ̸= yi . (19) |C| i∈C

Since exhaustive search over B(xi , di ) is intractable, we approximate VR via three attack strategies atk ∈ {TB, DB, TF}, each generating T adversarial candidates:
1 X max I f¯(Aatk (xi , di , j)) ̸= yi . VR(atk) = |C| j∈{1,...,T } i∈C (20) We aggregate the counterexamples found by all attacks and report the attack-observed violation rate: X
d= 1 VR max max I f¯(Aatk (xi , di , j)) ̸= yi . atk j∈{1,...,T } |C| i∈C (21) Since these attacks only explore a subset of the certified d should be interpreted as the empirical violation region, VR rate observed by our attacks. All attacks share the same budget of di word modifications, matching the ℓ0 metric used in certification; for character-level attacks (DB, TB), each perturbed word counts as one unit regardless of the number of character-level edits. Statistical Significance (p-value). To complement VR, we employ a one-sided exact binomial test under the null hypothesis H0 : p ≤ 0.1, where p denotes the true violation

TABLE III: Certified robustness on SST-2 and AGNews datasets under different MoE models and certified methods. CR denotes the certified ratio, i.e., the fraction of inputs receiving a non-zero certificate, and should not be used as a standalone indicator of robustness. VR denotes the violation rate and is reported as a percentage. Models

SST2

Method

AGNews

CR

VR(DB) ↓

VR(TF) ↓

VR(TB) ↓

d V R↓

p-value

CR

VR(DB) ↓

VR(TF) ↓

VR(TB) ↓

d V R↓

Qwen1.5MoE-A2.7B

RanMASK + C ERT M O E SelfDenoise + C ERT M O E

0.94 0.64 0.96 0.42

7.45 3.12 4.17 0.00

30.85 6.25 37.05 9.52

7.45 0.00 10.42 9.52

32.98 6.25 38.54 11.90

1.11 × 10−9 0.894 1.25 × 10−13 0.412

0.89 0.78 0.84 0.81

3.37 1.28 4.76 4.94

8.99 5.13 16.67 12.35

4.49 3.85 8.33 6.17

10.11 6.41 17.86 17.28

0.537 0.901 0.0189 0.0295

DeepSeekv2-Lite

RanMASK + C ERT M O E SelfDenoise + C ERT M O E

0.89 0.44 0.86 0.22

13.48 2.27 5.43 0.00

37.08 9.09 32.61 0.00

15.73 6.82 17.39 0.00

39.33 9.09 39.13 0.00

2.80 × 10−13 0.653 5.08 × 10−13 1.00

0.72 0.31 0.65 0.36

17.81 0.00 3.08 0.00

27.39 6.45 13.85 11.11

23.29 6.45 6.15 0.00

30.13 6.45 13.85 11.11

1.21 × 10−6 0.830 0.199 0.491

Phi-3.5-MoE -Instruct

RanMASK + C ERT M O E SelfDenoise + C ERT M O E

0.94 0.38 0.90 0.31

12.77 0.00 4.40 0.00

31.91 0.00 34.44 0.00

18.09 0.00 14.44 0.00

36.17 0.00 35.56 0.00

9.80 × 10−12 1.00 6.61 × 10−11 1.00

0.89 0.27 0.89 0.26

1.12 0.00 6.74 0.00

7.87 0.00 16.85 0.00

2.25 0.00 6.74 0.00

7.87 0.00 20.22 0.00

0.798 1.00 0.002 85 1.00

RanMASK SelfDenoise

DeepSeek-V2-Lite

Violation Rate (%)

probability among certified inputs. The test assesses whether d the observed V R provides statistically significant evidence that the violation rate exceeds the 10% threshold. A larger p-value indicates insufficient evidence to reject this hypothesis.

p-value

RanMASK + CertMoE SelfDenoise + CertMoE

SST-2

Qwen1.5-MoE-A2.7B

SST-2

60 40

C. Certification Reliability (RQ1) Overall Certification Reliability. We report the certified robustness results on three MoE models in Table III. Across all three models, standard certification methods, including RanMASK and SelfDenoise, often achieve relatively high certification rates (CR), but their certificates suffer from substantial violation rates (VR), especially on SST-2 where VR frequently exceeds 30%. This indicates that the high CRs of baseline methods overstate their effective certification reliability on MoE LLMs, as many issued certificates can still be violated in practice. The extremely low p-values of these baselines further suggest that the observed violations are unlikely to be caused by random fluctuation, but instead reflect a systematic mismatch between existing certification and dynamic MoE routing. In contrast, augmenting these certification methods with C ERT M O E leads to a more reliability-aware certification outcome. Rather than issuing potentially unreliable certificates, C ERT M O E provides a certificate only when its hierarchical certification conditions can be established, leading to fewer CR but empirically more reliable certificates. We further observe that most methods exhibit lower VRs on AGNews than on SST-2. One possible reason is that AGNews contains four relatively distinct topic categories, making its labels harder to change within a small certified radius, whereas SST-2 sentiment labels can be affected by subtle word substitutions. Besides, a few challenging cases where residual violations remain statistically significant after applying C ERT M O E, especially for SelfDenoise on some model– dataset pairs. This may be because SelfDenoise reconstructs masked inputs before classification and can introduce new words or local expression changes, adding extra variation beyond routing dynamics. These cases suggest that routing containment substantially mitigates routing-induced unreliability, while denoising-based certifiers require additional treatment.

20 0

1 2 3 4 5 6 7 8 9 10

perturbation strength (%)

1 2 3 4 5 6 7 8 9 10

perturbation strength (%)

Fig. 4: Violation Rate of different certification methods, plotted as a function of perturbation intensity.

Violation Rate across Perturbation Strengths. We further examine empirical violation rates under varying perturbation strengths, measured as the fraction of perturbed tokens relative to sentence length, on representative SST-2 settings. As shown in Fig. 4, baseline certification methods, both RanMASK and SelfDenoise, exhibit consistently high violation rates across different perturbation budgets, whereas incorporating C ERTM O E substantially reduces violations on both DeepSeek-V2Lite and Qwen1.5-MoE-A2.7B. This indicates that C ERT M O E maintains low violation rates not only in the overall results but also at each individual perturbation strength, suggesting stable empirical reliability under different attack budgets. D. Parameter Sensitivity (RQ2) Impact of Certified Expert-Pool Ratio. We study the impact of ρ, which determines the size Z = ⌈ρN ⌉ of the certified expert pool used for routing containment. Table IV reports a sensitivity analysis over different ρ values on SST-2 with Qwen1.5-MoE-A2.7B under RanMASK. As shown, the strict setting with Z = K in the first row certifies no inputs, showing that exact routing containment is too restrictive. Increasing ρ enlarges the certified expert pool and makes the routingcontainment condition easier to satisfy, so C ERT M O E assigns certificates to more inputs. However, this does not imply better reliability. Larger pools exhibit much higher violation rates than ρ = 0.2. This is because an overly permissive

TABLE IV: Impact of certified expert ratio ρ on certified rate (CR) and violation rate (VR). #CP

CR

VR(DB)

VR(TF)

VR(TB)

d V R

6 12 24 36 48

0 0.64 0.69 0.84 0.93

N/A 3.12 23.19 12.05 15.05

N/A 6.25 39.13 43.28 36.56

N/A 0 26.08 20.48 15.05

N/A 6.25 44.93 48.19 40.86

N/K 0.2 0.4 0.6 0.8

Fraction of samples (%)

ρ

Certified

mo

mr

RanMASK

0.2

N/A

+ C ERT M O E

0.2

0.2 0.4 0.6

RanMASK

0.4

N/A

0.4

0.2 0.4 0.6

+ C ERT M O E

CR

VR(DB)

VR(TF)

VR(TB)

0.94

7.45

30.85

7.45

0.64 0.64 0.61

3.12 4.69 0.00

6.25 6.25 3.27

0.00 10.93 11.47

0.91

9.89

34.07

9.89

0.61 0.61 0.61

0.00 1.63 0.00

3.27 1.63 0.00

6.67 1.63 0.00

pool weakens the constraint on perturbation-induced routing changes and requires the induced sub-network to account for a broader set of possible expert selections. These results indicate that ρ controls a trade-off between the permissiveness of routing-containment certification and the reliability of the resulting certificates. Impact of Mask Ratio on Smoothing. To examine whether the reliability improvement of C ERT M O E depends on a specific mask-ratio choice, we conduct an ablation study on Qwen1.5-MoE-A2.7B using SST-2 by varying the output mask ratio mo and routing mask ratio mr . We compare RanMASK with its C ERT M O E-augmented counterpart in terms of certification coverage and empirical violation ratio. The results in Table V show a trend consistent with the main results in Table III. Changing the mask ratio alone does not resolve the reliability issue of existing smoothing methods: RanMASK tends to certify a large fraction of inputs under different mo settings (i.e., 0.2 and 0.4), but the resulting certificates still exhibit substantial violation rates, especially under TextFooler. In contrast, adding C ERT M O E leads to more selective certification outcomes across different (mo , mr ) settings and substantially reduces VRs in practics. These results further confirm that C ERT M O E remains effective across different mask-ratio configurations, and proper mask-ratio adjustment may further improve the certificates’ reliability. E. Failure Attribution (RQ3) Abstention Analysis. We analyze the sources of abstention on SST-2 across three MoE LLMs using RanMASK and SelfDenoise with ρ = 0.2. Each sample is assigned to one of three mutually exclusive outcomes, i.e., certified, subnetwork abstain, or routing-containment abstain, where routing containment is checked first and only passing samples proceed to sub-network certification. The results in Fig. 5 reveal two consistent patterns. First, routing-containment abstention rises

SelfDenoise+CertMoE

80 60 40 20 0

n

Method

Routing-Containment Abstain

RanMASK+CertMoE

100

Qwe

TABLE V: Impact of mask settings on the robustness of RanMASK and ours across against three attacks.

Sub-Network Abstain

ek

pSe

Dee

Phi

n

Qwe

pSe

Dee

ek

Phi

Fig. 5: Certification outcome decomposition of CertMoE outcomes on SST-2 under RanMASK and SelfDenoise across MoE models. Model names are abbreviated by their prefixes.

monotonically with model size, reflecting that larger MoE models operate over a more fine-grained expert space and exhibit greater structural variability in routing decisions. Second, this effect is amplified under SelfDenoise, where input rewrites alter surface form and syntax, shifting hidden representations enough to produce inconsistent expert selections across perturbation samples. In both cases, C ERT M O E withholds certification in response to routing variability, reflecting its intended conservative behavior. These results underscore that routing certification is a necessary and earlier checkpoint than prediction certification in MoE models. Case Studies. Table VI provides a fine-grained analysis of how C ERT M O E refines certification outcomes compared with baseline methods on Qwen1.5-MoE-A2.7B. As shown, the baseline method, RanMASK, assigns certificates to all five examples. However, each baseline certificate can be falsified by a successful adversarial substitution generated within its certified radius, indicating that these certificates may overestimate the true robustness in practice. By contrast, C ERT M O E raises abstain when certifying the first three examples, and further attributes each uncertified outcome to routing-containment or induced sub-network. Besides, for the last two examples, C ERT M O E preserves certification when both routing and subnetwork conditions are genuinely satisfied, and no adversarial substitutions can falsify its certified predictions. Overall, these cases demonstrate that C ERT M O E yields both reliable and interpretable certificates: it issues certificates only when jointly verified by both routing and sub-network components, while component-level attribution further points to actionable directions for improving model robustness. F. Computation Cost (RQ4) Runtime Cost. We further analyze the per-sample computation cost of C ERT M O E. The runtime is measured on SST-2 and AGNews under three MoE LLMs. For each model, we show two bars: the left bar reports the base prediction and certification costs of RanMASK alone, and the right bar shows the total cost of C ERT M O E augmented on top of RanMASK, further decomposed into the routing-containment (RC) and sub-network (SN) prediction (Pred) and certification (Cert) costs. As shown in Fig. 6, C ERT M O E roughly doubles the total runtime compared to RanMASK alone across most settings.

TABLE VI: Certification case study on SST-2. Bold words indicate the substitution target in the original text and the corresponding adversarial replacement. Each adversarial example (AE) is generated within the certified robust bound. Sample ID

Attack Method

Original Text

Adversarial Example (AE)

RanMASK

RanMASK+CertMoE (Ours)

1

TextFooler

is this progress?

is this breakthrough?

Violated

Abstain (Sub-Network)

2

DeepWordBug

for me, this opera is n’t a favorite, so it is a long time before the fat lady sings.

for me, this opera is i’t a favorite, so it is a long time before the fat lady sings.

Violated

Abstain (Sub-Network)

3

TextFooler

it is one of the most honest films ever made about hollywood.

it is one of the most franco films ever made about hollywood.

Violated

Abstain (Routing-Containment)

4

TextFooler

it is like a poem.

it is like a anthology.

Violated

Certified & No AE found on the smoothed function

5

TextBugger

the movie has a soft, percolating magic, a deadpan suspense.

the movie has a soft, percolating magic, a deadpan suspense.

Violated

Certified & No AE found on the smoothed function

Base Pred Base Cert

RC Pred RC Cert

caching their intermediate activations. Therefore, CertMoE does not materially increase peak GPU memory beyond the standard batched MoE forward pass.

SN Pred SN Cert

SST-2

AGNews

Time (s)

80

VI. D ISCUSSION

60 40 20 0

Qwen

Deepseek

Phi

Qwen

Deepseek

Phi

Fig. 6: Per-sample computation cost breakdown w.r.t. LLMs.

Specifically, RC certification and SN certification together constitute the primary cost, with their relative proportions varying across models and datasets. In most settings, RC Cert accounts for the larger share; however, on AGNews with Qwen, SN Cert becomes the dominant cost, as more samples pass the RC stage and proceed to sub-network certification. In contrast, Phi exhibits relatively low SN cost because a larger fraction of samples are rejected at the RC stage and thus never enter sub-network certification, highlighting the role of RC certification as an effective pre-filter that controls the overall computational overhead. We note that this overhead is a onetime cost incurred only when a certificate is requested for a certain input, and does not affect standard inference. Memory Overhead. C ERT M O E uses the same underlying MoE model as the randomized smoothing baseline and does not instantiate additional model copies or expert networks. Beyond the standard memory required for model parameters and forward-pass activations, CertMoE only maintains lightweight certification statistics. For a model with L MoE layers, N experts per layer, and certified expert-pool size Z, the persistent additional memory consists mainly of expert count vectors and certified expert pools, with complexity O(LN + LZ). Since Z ≤ N , this reduces to O(LN ), which is negligible compared with the memory footprint of model parameters and activations. In our implementation, these routing statistics are stored as small CPU-side arrays or dictionaries, and Monte Carlo samples are processed without

Threats to Validity. Several threats may affect our study. Implementation errors and stochastic certifiers may influence the results; we mitigate this by using the same perturbation space, base certifiers, and evaluation protocol for baselines and C ERT M O E. Our metrics are tied to the considered perturbation model and should not be interpreted as robustness against arbitrary text attacks. The evaluation focuses on text classification and representative MoE LLMs, so generalization to other architectures or generation tasks requires further study. Finally, runtime is hardware- and implementation-dependent and is used mainly for relative cost comparison. Extension to Generation Tasks. Certified robustness for sequence generation remains less developed than classificationstyle certification. We note that text generation can be viewed as a sequential classification task, suggesting that classification-based certification can, in principle, be applied at each generation step. Furthermore, existing certification approaches for generative models typically constrain distances in the output vector space, providing a complementary foundation for generation-time guarantees. Since C ERT M O E is a plug-in framework compatible with existing base certifiers, we view its extension to sequence generation as a promising direction for future work. Extension to Other Modalities. C ERT M O E can also apply to MoE architectures in other modalities, as long as the underlying perturbation and base certification techniques are adapted to the modality. For example, text masking can be replaced by patch- or pixel-level perturbations for vision-domain MoE models. This suggests that the main extension challenge lies in matching the certification backbone to modality-specific perturbation spaces. Certified Training for MoE. The theory of C ERT M O E can also inform future certified training for MoE models. Since certifiable robustness depends on both routing containment and prediction stability, training objectives could explicitly promote stable routing under perturbations and robust predic-

tions within the induced sub-network. We leave the design of routing-aware certified training methods to future work. VII. C ONCLUSION This paper identifies a fundamental mismatch between existing certification methods and MoE LLMs: existing certifiers assume a fixed computation graph, whereas MoE routing makes the certified model input-dependent. To close this gap, we propose C ERT M O E, a routing-aware certification framework that explicitly accounts for routing uncertainty and its impact on robustness guarantees. Experiments on state-of-theart MoE LLMs and benchmark datasets show that C ERT M O E consistently produces more reliable certificates. VIII. DATA AVAILABILITY The code, data, and supplementary material for this paper are available at https://anonymous.4open.science/r/ CertMoE-69CB. R EFERENCES [1] R. A. Jacobs, M. I. Jordan, S. J. Nowlan, and G. E. Hinton, “Adaptive mixtures of local experts,” Neural computation, 1991. [2] N. Shazeer, A. Mirhoseini, K. Maziarz, A. Davis, Q. Le, G. Hinton, and J. Dean, “Outrageously large neural networks: The sparsely-gated mixture-of-experts layer,” arXiv preprint arXiv:1701.06538, 2017. [3] G. Team, R. Anil, S. Borgeaud, J.-B. Alayrac, J. Yu, R. Soricut, J. Schalkwyk, A. M. Dai, A. Hauth, K. Millican et al., “Gemini: a family of highly capable multimodal models,” arXiv preprint arXiv:2312.11805, 2023. [4] D. Dai, C. Deng, C. Zhao, R. Xu, H. Gao, D. Chen, J. Li, W. Zeng, X. Yu, Y. Wu et al., “Deepseekmoe: Towards ultimate expert specialization in mixture-ofexperts language models,” in Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2024. [5] xAI, “Grok 4.1 model card,” https://data.x.ai/ 2025-11-17-grok-4-1-model-card.pdf, November 2025. [6] X. Yang, S. Wang, J. Zhou, and W. Zhu, “One-forall does not work! enhancing vulnerability detection by mixture-of-experts (moe),” Proceedings of the ACM on Software Engineering, no. FSE, 2025. [7] H. Yuan, X. Hou, L. Yu, L. Yang, J. Tang, J. Xu, Y. Liu, F. Zhang, and C. Zuo, “Leveraging mixture-of-experts framework for smart contract vulnerability repair with large language model,” in 2025 40th IEEE/ACM International Conference on Automated Software Engineering (ASE), 2025. [8] S. Amershi, A. Begel, C. Bird, R. DeLine, H. Gall, E. Kamar, N. Nagappan, B. Nushi, and T. Zimmermann, “Software engineering for machine learning: A case study,” in 2019 IEEE/ACM 41st International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP). IEEE, 2019.

[9] S. Gowal, K. Dvijotham, R. Stanforth, R. Bunel, C. Qin, J. Uesato, R. Arandjelovic, T. Mann, and P. Kohli, “On the effectiveness of interval bound propagation for training verifiably robust models,” arXiv preprint arXiv:1810.12715, 2018. [10] J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial robustness via randomized smoothing,” in international conference on machine learning. PMLR, 2019, pp. 1310–1320. [11] Y. Mao, M. N. Müller, M. Fischer, and M. Vechev, “Understanding certified training with interval bound propagation,” in ICLR, 2024. [12] T. Gehr, M. Mirman, D. Drachsler-Cohen, P. Tsankov, S. Chaudhuri, and M. T. Vechev, “Ai2: Safety and robustness certification of neural networks with abstract interpretation,” in 2018 IEEE Symposium on Security and Privacy (SP), 2018. [13] S. Wang, K. Pei, J. Whitehouse, J. Yang, and S. Jana, “Formal security analysis of neural networks using symbolic intervals,” in Proceedings of the 27th USENIX Conference on Security Symposium, 2018. [14] R. Mangal, A. V. Nori, and A. Orso, “Robustness of neural networks: A probabilistic and practical approach,” in 2019 IEEE/ACM 41st international conference on software engineering: new ideas and emerging results (ICSE-NIER), 2019. [15] J. Puigcerver, R. Jenatton, C. Riquelme, P. Awasthi, and S. Bhojanapalli, “On the adversarial robustness of mixture of experts,” Advances in neural information processing systems, vol. 35, pp. 9660–9671, 2022. [16] X. Zhang, K. Xu, Z. Hu, and R. Wang, “Optimizing robustness and accuracy in mixture of experts: A dualmodel approach,” in Forty-second International Conference on Machine Learning, 2025. [17] J. Zeng, J. Xu, X. Zheng, and X. Huang, “Certified robustness to text adversarial attacks by randomized [mask],” Computational Linguistics, vol. 49, no. 2, pp. 395–427, 2023. [18] J. Ji, B. Hou, Z. Zhang, G. Zhang, W. Fan, Q. Li, Y. Zhang, G. Liu, S. Liu, and S. Chang, “Advancing the robustness of large language models through selfdenoised smoothing,” in NAACL, 2024. [19] W. Fedus, B. Zoph, and N. Shazeer, “Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity,” Journal of Machine Learning Research, vol. 23, no. 120, pp. 1–39, 2022. [20] DeepSeek-AI, “Deepseek-v2: A strong, economical, and efficient mixture-of-experts language model,” 2024. [21] A. Q. Jiang, A. Sablayrolles, A. Roux, A. Mensch, B. Savary, C. Bamford, D. S. Chaplot, D. d. l. Casas, E. B. Hanna, F. Bressand et al., “Mixtral of experts,” arXiv preprint arXiv:2401.04088, 2024. [22] F. Croce and M. Hein, “Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks,” in International conference on machine learning. PMLR, 2020.

[23] G. Singh, T. Gehr, M. Püschel, and M. Vechev, “An abstract domain for certifying neural networks,” Proceedings of the ACM on Programming Languages, no. POPL, 2019. [24] M. N. Müller, G. Makarchuk, G. Singh, M. Püschel, and M. Vechev, “Prima: general and precise neural network certification via scalable convex hull approximations,” Proceedings of the ACM on Programming Languages, 2022. [25] J. Zhang, Z. Chen, H. Zhang, C. Xiao, and B. Li, “{DiffSmooth}: Certifiably robust learning via diffusion models and local smoothing,” in 32nd USENIX Security Symposium (USENIX Security 23), 2023. [26] Z. Zhang, Y. Wu, S. Liu, J. Liu, and M. Zhang, “Provably tightest linear approximation for robustness verification of sigmoid-like neural networks,” in Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering. Association for Computing Machinery, 2023. [27] M. Fischer, C. Sprecher, D. I. Dimitrov, G. Singh, and M. Vechev, “Shared certificates for neural network verification,” in Computer Aided Verification, S. Shoham and Y. Vizel, Eds., 2022. [28] M. N. Müller, G. Makarchuk, G. Singh, M. Püschel, and M. Vechev, “Prima: general and precise neural network certification via scalable convex hull approximations,” Proc. ACM Program. Lang., no. POPL, 2022. [29] Z. Zuo, X. Niu, S. Zhang, L. Fang, S. C. Khoo, S. Lu, C. Sun, and G. H. Xu, “Toward more efficient statistical debugging with abstraction refinement,” ACM Trans. Softw. Eng. Methodol., 2023. [30] Z. Liu, L. Chen, W. Liu, and J. Wang, “Synthesizing boxes preconditions for deep neural networks,” in Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, ser. ISSTA 2024, 2024. [31] B. H. Kim, J. Wang, and C. Wang, “Fairquant: Certifying and quantifying fairness of deep neural networks,” in Proceedings of the IEEE/ACM 47th International Conference on Software Engineering, 2025. [32] Y. Zhang, Z. Zhao, G. Chen, F. Song, M. Zhang, T. Chen, and J. Sun, “Qvip: An ilp-based formal verification approach for quantized neural networks,” in Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering, 2023. [33] S. Biswas and H. Rajan, “Fairify: Fairness verification of neural networks,” in Proceedings of the 45th International Conference on Software Engineering, ser. ICSE ’23, 2023. [34] H. Duong, D. Xu, T. Nguyen, and M. B. Dwyer, “Harnessing neuron stability to improve dnn verification,” Proc. ACM Softw. Eng., no. FSE, 2024. [35] Y. Zhang, R. Cai, T. Chen, G. Zhang, H. Zhang, P.-Y. Chen, S. Chang, Z. Wang, and S. Liu, “Robust mixtureof-expert training for convolutional neural networks,” in Proceedings of the IEEE/CVF International Conference

on Computer Vision, 2023, pp. 90–101. [36] L. Wu, S. Behrouzi, M. Rostami, S. Picek, and A.-R. Sadeghi, “Gatebreaker: Gate-guided attacks on mixtureof-expert llms,” 2026. [37] Z. Lai, M. Liao, B. Wu, D. Xu, Z. Zhao, Z. Yuan, C. Fan, and J. Li, “Safex: Analyzing vulnerabilities of moe-based llms via stable safety-critical expert identification,” in The Thirty-ninth Annual Conference on Neural Information Processing Systems, 2025. [38] W. Huang, Y. Liao, J. Liu, R. He, H. Tan, S. Zhang, H. Li, S. Liu, and X. Qi, “Mixture compressor for mixture-ofexperts llms gains more,” in ICLR, p. 2025. [39] C. Sun, Y. Mao, and M. Vechev, “Dual randomized smoothing: Beyond global noise variance,” in ICLR, 2026. [40] C. J. Clopper and E. S. Pearson, “The use of confidence or fiducial limits illustrated in the case of the binomial,” Biometrika, 1934. [41] Z. Wang, G. Jin, J. Hu, and R. Mu, “Clucert: Certifying llm robustness via clustering-guided denoising smoothing,” in AAAI, 2026. [42] R. Socher, A. Perelygin, J. Wu, J. Chuang, C. D. Manning, A. Y. Ng, and C. Potts, “Recursive deep models for semantic compositionality over a sentiment treebank,” in Proceedings of the 2013 conference on empirical methods in natural language processing, 2013. [43] X. Zhang, J. Zhao, and Y. LeCun, “Character-level convolutional networks for text classification,” Advances in neural information processing systems, 2015. [44] Q. Team, “Qwen1.5-moe: Matching 7b model performance with 1/3 activated parameters”,” 2024. [45] M. Abdin, J. Aneja, H. Behl, S. Bubeck, R. Eldan, S. Gunasekar, M. Harrison, R. J. Hewett, M. Javaheripi, P. Kauffmann et al., “Phi-3 technical report: A highly capable language model locally on your phone,” arXiv preprint arXiv:2412.08905, 2024. [46] Q. Team, “Qwen3 technical report,” 2025. [47] J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” in NDSS, 2019. [48] J. Gao, J. Lanchantin, M. L. Soffa, and Y. Qi, “Black-box generation of adversarial text sequences to evade deep learning classifiers,” in 2018 IEEE Security and Privacy Workshops (SPW). IEEE, 2018. [49] D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is bert really robust? a strong baseline for natural language attack on text classification and entailment,” in Proceedings of the AAAI conference on artificial intelligence, 2020. [50] J. Morris, E. Lifland, J. Y. Yoo, J. Grigsby, D. Jin, and Y. Qi, “Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp,” in Proceedings of the 2020 conference on empirical methods in natural language processing: System demonstrations, 2020, pp. 119–126.

Related documents

• CertMoE: Robustness Certification for Mixture-of-Experts LLMs via Routing-Aware Smoothing#1414000
• Neither Adversarial Training Nor Purification: Emergent Adversarial Robustness from Oscillatory Predictive Learning#986014
• MRCert: Towards Post-deployment Patch Robustness Certification for Adversarially Patched Samples via Type-specific Masking#1247544
• A Counterfactual Account of Algorithmic Robustness#81072
• Sustainability of Open-Source Machine Learning Robustness Assessment Tools: A Repository Mining Study#792404