In this paper, we analyze and improve the adversarial robustness of a convolutional neural network (CNN) that assists crystal-collimator alignment at CERN's Large Hadron Collider (LHC) by classifying a beam-loss monitor (BLM) time series during crystal rotation. We formalize a local robustness property for this classifier under an adversarial threat model based on real-world plausibility. Building on established parameterized input-transformation patterns used for transformation- and semantic-perturbation robustness, we instantiate a preprocessing-aware wrapper for our deployed time-series pipeline: we encode time-series normalization, padding constraints, and structured perturbations as a lightweight differentiable wrapper in front of the CNN, so that existing gradient-based robustness frameworks can operate on the deployed pipeline. For formal verification, data-dependent preprocessing such as per-window z-normalization introduces nonlinear operators that require verifier-specific abstractions. We therefore focus on attack-based robustness estimates and pipeline-checked validity by benchmarking robustness with the frameworks Foolbox and ART. Adversarial fine-tuning of the resulting CNN improves robust accuracy by up to 18.6 % without degrading clean accuracy. Finally, we extend robustness on time-series data beyond single windows to sequence-level robustness for sliding-window classification, introduce adversarial sequences as counterexamples to a temporal robustness requirement over full scans, and observe attack-induced misclassifications that persist across adjacent windows.
Figures & tables
Figure 1: The principle behind the crystal collimation scheme (visualized for betatron cleaning insertion), showing how the halo particles of the circulating beam are channeled onto the absorber upon correct crystal orientation [ 29 ] .
Figure 2: On-the-fly classification during a crystal rotation. At time instant i , the classifier takes the last W samples (up to i ) of the highlighted window at the right. Top: crystal BLM (dark blue) and secondary BLM (light blue) as a function of time and radiation dose detection; Bottom: predicted class probabilities per window.
Figure 3: Conceptual overview of the deployed classification pipeline [Section 2.2 ] and the robustness problem studied in this paper [Section 2.3 , Section 3 ]. The local robustness property is defined over structured signal-space perturbations δ∈Δ(X) of the input X . Adversarial analysis can target either the signal space (sound but requiring preprocessing to be considered [Section 4 ]) or the normalized input space (where naive attacks may violate the threat model).
Figure 4: Infeasible adversarial example Z^i in the normalized space.
Configuration
Foolbox
ART
Baseline
0.794→0.794
0.838→0.838
No-normalization
0.733→0.831
0.777→0.868
No-padding
0.669→0.899
0.716→0.919
Naive (mask+renorm)
0.669→0.669
0.713→0.713
Naive (no mask/renorm)
0.095→0.767
0.152→0.818
Table 2: Robust accuracy (RA) on the same test split (B=296) under different configurations. Each cell shows RAtool→RApipe , i.e., tool-reported robustness in the optimization space followed by pipeline-checked robustness under C and Δ(⋅) .
Table 3: Comparison of clean accuracy and three RA configurations under the baseline model and an adversarially trained model. The configurations use the following channel budgets: [email protected](εcom,εind)=(0.05,0.01) ; [email protected](εcom,εind)=(0.1,0.02) ; [email protected](εcom,εind)=(0.2,0.04) .
Figure 5: Proof-of-concept adversarial sequence attack. Top: BLM Crystal and Secondary signals (dashed) and their perturbed counterparts (solid). Bottom: class probabilities as the sliding window advances. The perturbation smoothly flips classifications from channeling to partial well in the targeted region [190, 205].
Vision models have been found to be susceptible to perturbations such as motion blur induced at runtime by a shaking camera. This impedes their deployment in critical applications since phenomena such as slightly blurred vision might lead to failures, for example an object detector missing objects. While methods such as data augmentation or Adversarial Training can improve empirical robustness, they lack formal safety guarantees, making it difficult to identify and mitigate hidden vulnerabilities. We introduce a novel Certified Training approach that leverages an efficient encoding of convolutional perturbations to train provably robust models. Our method significantly outperforms Adversarial Training, achieving, for example, over 80% robust accuracy against motion blur of reasonable intensity on CIFAR10 while maintaining comparable standard accuracy.
Adversarial Training (AT) is one of the most effective methods for developing robust deep neural networks (DNNs). However, AT faces a trade-off problem between clean accuracy and adversarial robustness. In this work, we reveal a surprising phenomenon for the first time: Varying input perturbation intensities for training samples near decision boundaries in AT have minimal impact on model robustness. This finding directly exposes the inconsistency between accuracy and robustness score fluctuations, leading us to identify the misalignment between input and latent spaces as a critical driver of the robustness-accuracy trade-off. To mitigate this misalignment for harmonizing accuracy and robustness, we define Robust Alignment as a new AT target, encouraging the model perception to change with input perturbations provided the final label prediction remains unchanged, which can be achieved via two novel ideas. First, we suggest a reduced and fixed perturbation intensity for those boundary samples, which facilitates the model to utilize the perturbations as learnable patterns, instead of noises that complicate decision boundaries meaninglessly. Second, we propose a Domain Interpolation Consistency Adversarial Regularization (DICAR), based on rigorous theoretical derivations, which explicitly introduces semantic alignment between input and latent spaces into AT. Based on these two ideas, we end up with a new Robust Alignment Adversarial Training (RAAT) method, effectively harmonizing accuracy and robustness. Extensive experiments on CIFAR-10, CIFAR-100, and Tiny-ImageNet with ResNet-18, PreActResNet-18, and WideResNet-28-10 demonstrate the effectiveness of RAAT in improving the trade-off beyond four common baselines and a total of 14 related state-of-the-art (SOTA) works.
Nowadays, pretrained models are increasingly used as general-purpose backbones and adapted at test-time to downstream environments where target data are scarce and unlabeled. While this paradigm has proven effective for improving clean accuracy on the target domain, adversarial robustness has received far less attention, especially when the original pretrained model is not explicitly designed to be robust. This raises a practical question: can a pretrained, non-robust model be adapted at test-time to improve adversarial robustness on a target distribution? To face this question, this work studies how adversarial training strategies behave when integrated into adaptation schemes for the unsupervised test-time setting, where only a small set of unlabeled target samples is available. It first analyzes how classical adversarial training formulations can be extended to this scenario, showing that straightforward distillation-based adaptations remain unstable and highly sensitive to hyperparameter tuning, particularly when the teacher itself is non-robust. To address these limitations, the work proposes a label-free framework that uses the predictions of a non-robust teacher model as a semantic anchor for both the clean and adversarial objectives during adaptation. We further provide theoretical insights showing that our formulation yields a more stable alternative to the self-consistency-based regularization commonly used in classical adversarial training. Experiments evaluate the proposed approach on CIFAR-10 and ImageNet under induced photometric transformations. The results support the theoretical insights by showing that the proposed approach achieves improved optimization stability, lower sensitivity to parameter choices, and a better robustness-accuracy trade-off than existing baselines in this post-deployment test-time setting.
Stefano Bianchettin, Giulio Rossolini, Giorgio Buttazzo
Department of Excellence in Robotics and AI, Sant’Anna School of Advanced Study, Via Moruzzi, 1, Pisa, 56124, Tuscany, Italy