Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Rui Zhang; Xinle Cao; Huazhen Yu; Jian Liu; Youwen Zhu

cs.LGOct 11, 2026

Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Authors: Rui Zhang, Xinle Cao, Huazhen Yu, Jian Liu, Youwen Zhu

Organizations: Nanjing University of Aeronautics and Astronautics · The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Nanjing University of Information Science and Technology

Abstract

Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations. Certified $\ell_2$ defenses today face a costly trade-off: randomized smoothing (RS) requires hundreds of noisy queries per input, while Lipschitz networks (LN) constrain the architecture and sacrifice clean accuracy. We take a detection-oriented approach instead: rather than certifying that predictions are invariant inside an $\ell_2$ ball, we certify that adversarial inputs within an $\ell_2$ ball are detected --- a guarantee aligned with security-critical deployments where missing an attack is costlier than flagging a clean input. To realize this, we prove a Lipschitz-margin reduction from certified $\ell_2$ robustness to certified detection, which reduces the problem to handling a single Lipschitz constant $L$ . We introduce two detector families: $\mathbb{D}_{Adv}$ , which estimates $L$ from a single defender-side perturbed pair, and $\mathbb{D}_{lc}$ , which augments that pair with a local margin centroid to keep the estimate above what the certificate requires. Both deploy on any pretrained classifier without retraining. With a valid global bound, the detector is fully certified at that radius; with a local estimate $L'$ , certification is sample-wise and applies only when our certified condition holds. Across MNIST, CIFAR-10, and ImageNet-1k on four backbones (LeNet-5, VGG16, ResNet-50, ViT-B/16), our detectors match or outperform five baselines (CTT, SortNet, CRM, ContraNet, A $^2$ D). For CIFAR-10 with 1-Lipschitz SortNet, our reduction delivers $100\%$ certified detection at the lowest FPR among compared certified detectors; on the standard CIFAR-10 VGG16, our detectors reject all evaluated in-budget adversarial examples, with 62-82% both rejected and formally certified.

Figures & tables

Fig. 1 : Overview of certified adversarial detection. Taking a pre-trained classifier $f$ as-is (no retraining and no architectural change), we exploit the Lipschitz–margin principle: a clean input $\boldsymbol{x}$ exhibits a large margin $q(\boldsymbol{x})=f_{y}(\boldsymbol{x})-\max_{i\neq y}f_{i}(\boldsymbol{x})$ , whereas a successful adversarial example $\hat{\boldsymbol{x}}$ with bounded perturbation $\|\delta\|$ is forced close to the decision boundary, yielding a small margin upper-bounded by $q(\hat{\boldsymbol{x}})\leq cL\|\delta\|-q(\boldsymbol{x})$ (Lemma IV.1 ). Because the clean counterpart $\boldsymbol{x}$ is unobserved at inference time, we instantiate two approximated detectors — $\mathbb{D}_{Adv}$ (defender-side perturbation surrogate; Claim 1 ) and $\mathbb{D}_{lc}$ (local-centroid surrogate; Claim 2 ) — which flag adversarial inputs while accepting clean ones, and report TPR, FPR, and cert%, where cert% counts successful in-budget adversarial examples that are both rejected and formally certified.

$\epsilon$	SortNet [ zhang_rethinking_2022 ]		CRM [ fazlyab2023certified ]		Lem IV.1 , $L_{\text{glob}}$ (ours)		$\mathbb{D}_{Adv}$ (ours)			$\mathbb{D}_{lc}$ (ours)
	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	cert%	TPR	FPR	cert%
0.1	100.0	22.0	100.0	25.2	100.0	10.5	99.0	9.3	58.1	100.0	10.1	36.5
0.3	100.0	59.0	100.0	68.0	100.0	31.5	100.0	21.3	59.0	100.0	25.8	41.0
0.5	100.0	86.0	100.0	96.0	100.0	58.5	99.5	35.3	65.3	100.0	40.7	50.0
1.0	100.0	100.0	100.0	100.0	100.0	95.0	100.0	59.0	71.5	100.0	63.5	57.5

TABLE I : Fully certified detection on 1-Lipschitz SortNet (CIFAR-10). With

L_{\text{glob}}

exactly known, Lemma IV.1 (using

L=L_{\text{glob}}

) achieves

100\%

certified detection at FPR substantially below the baseline detectors built on SortNet’s and CRM’s certified radii. Our approximated detectors

\mathbb{D}_{Adv}

and

\mathbb{D}_{lc}

use the local estimator

L^{\prime}

and reduce FPR further; we report cert% as the fraction of all successful in-budget adversarial examples that are both rejected and formally certified.

$\epsilon$	$\mathbb{D}_{Adv}$ (ours)			$\mathbb{D}_{lc}$ (ours)			RS (Cohen)
	TPR	FPR	cert%	TPR	FPR	cert%	TPR	FPR
0.1	100.0	0.5	92.0	100.0	1.0	90.0	44.5	4.0
0.5	100.0	8.0	94.0	100.0	8.5	86.0	100.0	22.0
1.0	100.0	17.0	97.0	100.0	17.5	80.0	100.0	98.0
2.0	100.0	47.0	98.0	100.0	47.5	75.0	100.0	98.0

TABLE II: MNIST (LeNet-5): detection at representative

\ell_{2}

budgets. TPR on BIM; FPR on clean inputs; cert% is the fraction of all successful in-budget adversarial examples that are both rejected and formally certified (

L^{\prime}\geq L^{*}

). RS (Cohen) reported at

\sigma{=}0.25

. Full per-attack and per-

\sigma

results in Appendix -D , Tables XII – XIII .

$\epsilon$	$\mathbb{D}_{Adv}$ (ours)			$\mathbb{D}_{lc}$ (ours)			RS (Cohen)		RS (Conservative)		ContraNet
	TPR	FPR	cert%	TPR	FPR	cert%	TPR	FPR	TPR	FPR	TPR	FPR
0.05	100.0	15.3	63.2	100.0	15.6	62.4	38.5	46.0	93.5	93.2	87.0	9.0
0.1	100.0	29.5	76.4	100.0	29.9	75.0	53.0	60.2	95.0	93.8	87.8	9.0
0.3	100.0	74.8	83.4	100.0	75.8	80.4	95.8	96.0	99.6	99.2	74.6	9.0
0.5	100.0	92.7	82.6	100.0	93.6	78.8	100.0	100.0	100.0	100.0	85.0	9.0

TABLE III : CIFAR-10: detection at representative

\ell_{2}

budgets on VGG16. TPR on BIM attacks (averaged over

\sim

500 successful adversarials per

\epsilon

); FPR on the full CIFAR-10 test set; cert% is the fraction of all successful in-budget adversarial examples that are both rejected and formally certified (

L^{\prime}\geq L^{*}

). RS (Conservative) is the strengthened RS variant that combines smoothed-classifier mismatch with the certified radius (Section V ). Full per-attack results in Appendix -D .

TABLE IV : Detection on ImageNet-1k (500 images) with PyTorch pretrained models. TPR on

\ell_{2}

BIM attacks; FPR on clean samples; cert% is the fraction of all successful in-budget adversarial examples that are both rejected and formally certified (

L^{\prime}\geq L^{*}

). The full

\epsilon\in[0.1,1.0]

breakdown for ResNet-50 is in Appendix -D , Table XVII .

Method	MNIST	CIFAR-10	ImageNet-1k
$\mathbb{D}_{Adv}$ (base)	0.020 $\pm$ 0.002	0.071 $\pm$ 0.023	0.190 $\pm$ 0.073
$\mathbb{D}_{Adv}$ (strong $L^{\prime}$ )	0.048 $\pm$ 0.002	0.183 $\pm$ 0.017	0.451 $\pm$ 0.084
$\mathbb{D}_{lc}$ (base)	0.063 $\pm$ 0.006	0.151 $\pm$ 0.026	0.421 $\pm$ 0.074
$\mathbb{D}_{lc}$ (strong $L^{\prime}$ )	0.155 $\pm$ 0.008	0.341 $\pm$ 0.036	0.765 $\pm$ 0.087
RS (Cohen)	0.335 $\pm$ 0.003	0.437 $\pm$ 0.132	3.757 $\pm$ 0.502

TABLE V : Average per-sample detection time (seconds, mean

\pm

std over

n{=}500

inputs). Experiments are conducted on a single NVIDIA V100 GPU.

Dataset	$\epsilon$	$\mathbb{D}_{Adv}$			$\mathbb{D}_{lc}$
Dataset	$\epsilon$	$\Delta$ TPR	$\Delta$ FPR	cert% base $\rightarrow$ strong	$\Delta$ TPR	$\Delta$ FPR	cert% base $\rightarrow$ strong
MNIST	0.50	+0.0	+0.9	92.0 $\rightarrow$ 100.0	+0.0	+1.5	94.0 $\rightarrow$ 100.0
MNIST	1.00	+0.0	+2.3	97.0 $\rightarrow$ 99.5	+0.0	+2.5	98.0 $\rightarrow$ 100.0
CIFAR-10	0.05	+0.0	+0.4	63.2 $\rightarrow$ 98.0	+0.0	+1.0	62.4 $\rightarrow$ 87.0
	0.10	+0.0	+2.0	76.4 $\rightarrow$ 93.5	+0.0	+2.0	75.0 $\rightarrow$ 89.5
	0.30	+0.0	+5.8	83.4 $\rightarrow$ 98.0	+0.0	+7.3	80.4 $\rightarrow$ 97.0

TABLE VI : Stronger

L^{\prime}

estimation improves certified coverage. Only the local estimate is replaced by a multi-probe

L^{\prime}_{\mathrm{strong}}

(

K{=}1,T{=}6

unless stated), trading cert% gains for FPR/runtime.

Dataset	$\epsilon$	BIM ASR	Adp. ASR	$\mathbb{D}_{Adv}$			$\mathbb{D}_{lc}$
Dataset	$\epsilon$	BIM ASR	Adp. ASR	TPR	ASR joint	cert% base $\rightarrow$ strong	TPR	ASR joint	cert% base $\rightarrow$ strong
CIFAR-10	0.05	8.9	11.4	100.0	0.0	3.0 $\rightarrow$ 96.5	100.0	0.0	5.0 $\rightarrow$ 67.5
	0.10	20.3	26.1	100.0	0.0	9.0 $\rightarrow$ 98.0	100.0	0.0	8.5 $\rightarrow$ 77.5
	0.30	61.0	80.7	100.0	0.0	16.5 $\rightarrow$ 97.5	100.0	0.0	17.0 $\rightarrow$ 97.0
	0.50	78.5	98.5	100.0	0.0	24.0 $\rightarrow$ 99.5	100.0	0.0	30.5 $\rightarrow$ 99.0
ImageNet	0.10	4.7	14.1	87.4	1.8	2.8 $\rightarrow$ 89.1	99.0	0.1	11.6 $\rightarrow$ 92.6

TABLE VII : Detector-aware adaptive attack evaluation. ASR

{}_{\mathrm{joint}}=\mathrm{ASR}_{\mathrm{cls}}\cdot(1-\mathrm{TPR})

is end-to-end evasion after detection; cert% is shown before/after stronger

L^{\prime}

	Adv-trained ( $\ell_{2}$ PGD, $r{=}0.5$ )				Gaussian aug ( $\sigma{=}0.25$ )
	$\mathbb{D}_{Adv}$ (AT)		$\mathbb{D}_{lc}$ (AT)		$\mathbb{D}_{Adv}$		$\mathbb{D}_{lc}$		RS (Cohen)		RS (Conservative)
$\epsilon$	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR
0.05	92.0	4.0	99.0	4.0	99.1	5.8	99.5	7.2	38.4	17.0	91.5	27.2
0.1	94.9	7.0	99.2	7.6	99.6	11.2	100.0	13.8	47.6	21.4	93.8	30.8
0.3	97.0	18.0	99.0	20.0	99.8	29.5	100.0	35.4	80.8	43.8	98.6	46.4
0.5	98.4	29.8	99.6	32.2	100.0	43.9	100.0	51.5	95.8	65.0	100.0	65.8

TABLE VIII : Robust training boosts our detection on CIFAR-10 (VGG16). TPR (%) on

\ell_{2}

PGD attacks; FPR (%) on clean inputs. Two robust-training primitives applied to the same VGG16 base model:

\ell_{2}

PGD adversarial training (radius

0.5

, AT columns) and Gaussian augmentation (

\sigma{=}0.25

). RS baselines do not apply to PGD-adversarial-trained models.

Inputs and perturbations
Symbol	Meaning
$\boldsymbol{x}$	Clean input.
$y$	True class of $\boldsymbol{x}$ .
$\delta$	Adversarial perturbation.
$\epsilon$	Perturbation budget.
$\hat{\boldsymbol{x}}$	Adversarial example, $\boldsymbol{x}{+}\delta$ .

TABLE IX: Notation summary.

$\epsilon$	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$
0.3	0.31 (74%)	0.20 (16%)
0.5	0.51 (72%)	0.29 (19%)
1.0	1.02 (63%)	0.85 (44%)

TABLE X: Empirical tightness of

\Delta_{T}

on SortNet. Median actual

\Delta_{T}

and its share of the per-sample theoretical envelope from ( 9 ), computed on detected adversarials with

L^{\prime}\leq L_{\text{glob}}

. The remaining samples satisfy

L^{\prime}\geq L_{\text{glob}}\geq L^{*}

and are trivially certified.

Dataset	Attack	$\epsilon$	$\mathbb{D}_{Adv}$ (Ours)		$\mathbb{D}_{lc}$ (Ours)		CTT-loose		CTT-strict
Dataset	Attack	$\epsilon$	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR
MNIST	FGSM	0.1	100.0	0.5	100.0	1.0	100.0	1.6	100.0	1.1
	FGSM	0.2	100.0	1.5	100.0	3.0	100.0	1.6	100.0	1.1
	PGD	0.1	100.0	0.5	100.0	1.0	100.0	1.6	100.0	1.1
	PGD	0.2	100.0	1.5	100.0	3.0	100.0	1.6	100.0	1.1
CIFAR-10	FGSM	0.02	95.0	2.5	100.0	6.0	95.7	6.4	96.5	3.0

TABLE XI : Comparison of our approximated detectors with CTT [ shumailov2020towards ] on MNIST and CIFAR-10. We report true positive rate (TPR, %) and false positive rate (FPR, %) under different attacks and perturbation levels. CTT-loose and CTT-strict correspond to two thresholding variants in [ shumailov2020towards ] .

Dataset	$\epsilon$	$\mathbb{D}_{Adv}$				$\mathbb{D}_{lc}$				Cohen
Dataset	$\epsilon$	FGSM	PGD	BIM	CW	FGSM	PGD	BIM	CW	$\sigma=0.125$	$\sigma=0.25$
MNIST	0.05	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	60.0	33.0
	0.10	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	66.7	44.5
	0.30	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	63.9
	0.50	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0
	1.00	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0

TABLE XII : TPR (%) of different attacks under varying

\ell_{2}

budgets

\epsilon

. For the Cohen detector [ cohen2019certified ] , we report certified TPR against BIM under two noise levels.

Dataset	$\epsilon$	Ours		Cohen
Dataset	$\epsilon$	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$	$\sigma{=}0.125$	$\sigma{=}0.25$
MNIST	0.05	0.0	0.0	0.5	2.5
	0.10	0.5	1.0	1.5	4.0
	0.30	5.0	5.5	100.0	8.5
	0.50	8.0	8.5	100.0	22.0
	1.00	17.0	17.5	100.0	98.0

TABLE XIII: Clean FPR (%) of our detectors vs. RS (Cohen) across perturbation budgets. Lower is better.

Dataset	Backbone	$\epsilon$	TPR	FPR		cert%
Dataset	Backbone	$\epsilon$	TPR	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$
CIFAR-10	ResNet-18	0.05	100.0	12.2	12.2	70.0	71.3
		0.10	100.0	29.7	29.7	86.0	85.3
		0.30	100.0	74.9	75.1	78.7	77.0
		0.50	100.0	90.5	91.0	71.7	67.7
MNIST	VGG-style CNN	0.50	100.0	2.4	3.6	95.0	100.0

TABLE XIV : Architecture variation on CIFAR-10 and MNIST. BIM attacks with

n_{\mathrm{adv}}{=}500

and

n_{\mathrm{clean}}{=}1000

. We evaluate CIFAR-10 on ResNet-18 and MNIST on a VGG-style CNN to check that the detection profile is not tied to the primary classifiers.

Panel of Figure 16 — Fig. 2 : Summary curves: TPR on adversarial inputs and FPR on clean inputs across $\ell_{2}$ perturbation magnitudes $\epsilon$ , for $\mathbb{D}_{Adv}$ (top row) and $\mathbb{D}_{lc}$ (bottom row). Columns sweep MNIST (LeNet-5), CIFAR-10 (VGG16), and ImageNet-1k (ResNet-50).

Fig. 3 : Distribution of

(\mathrm{RHS}-d_{z})

values under different attacks. Negative values (

\mathrm{RHS}<d_{z}

) indicate samples flagged as adversarial.

Estimator	cert%	ms/sample
Baseline	76.4	22
$K{=}1,T{=}3$	91.6	108
$K{=}1,T{=}6$	93.5	201
$K{=}1,T{=}9$	93.7	293
$K{=}1,T{=}12$	93.7	383
$K{=}2,T{=}12$	95.4	563

TABLE XV: Cost–tightness sweep for the stronger estimator. CIFAR-10 VGG16,

\mathbb{D}_{Adv}

\epsilon{=}0.1

$\mathbb{D}_{Adv}$
$\epsilon$	cert%	$L^{\prime}/L^{*}$ mean $\pm$ std	Median	Viol. %	Viol. mean $\pm$ std
0.05	62.6	$1.037\pm 0.20$	1.007	37.4	$0.949\pm 0.082$
0.10	76.6	$1.067\pm 0.24$	1.034	23.4	$0.908\pm 0.107$
0.30	83.0	$1.153\pm 0.29$	1.118	17.0	$0.855\pm 0.133$
0.50	82.4	$1.194\pm 0.30$	1.162	17.6	$0.861\pm 0.130$
$\mathbb{D}_{lc}$

TABLE XVI : Empirical distribution of

L^{\prime}/L^{*}

. CIFAR-10 VGG16, BIM,

n{=}500

. Violations are samples with

L^{\prime}/L^{*}<1

; the last column reports their ratio distribution.

\mathbb{D}_{lc}

has a right-skewed tail at

\epsilon{=}0.10,0.50

from a few samples with tiny

L^{*}

; its median remains near

1

$\epsilon$	$\mathbb{D}_{Adv}$ (%)		$\mathbb{D}_{lc}$ (%)		RS (Cohen) (%)
	TPR $\uparrow$	FPR $\downarrow$	TPR $\uparrow$	FPR $\downarrow$	TPR $\uparrow$	FPR $\downarrow$
0.1	99.5	9.0	99.7	9.4	34.0	17.0
0.2	99.6	18.0	99.6	17.2	53.0	30.0
0.3	99.8	24.6	99.6	23.7	62.5	36.0
0.4	99.9	30.3	99.2	29.0	82.0	68.0
0.5	99.6	34.4	99.3	32.8	85.5	51.0

TABLE XVII : Full ImageNet-1k results (PyTorch pretrained ResNet-50) at step

\epsilon=0.1

. TPR on

\ell_{2}

BIM attacks; FPR on clean samples.

Adversarial Example Detection

Adversarial example detection identifies inputs crafted to exploit machine-learning models before they cause unreliable predictions.

See all 49 papers

Jul 6, 2026

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

Object detectors have many applications in safety-critical systems, but they are known to be sensitive to worst-case perturbations such as adversarial attacks, which limits their applicability in real-world scenarios. Compared with classification, adversarial robustness for object detection has received less attention, and existing methods are often tied to adversarial training, whose performance may not transfer across attacks, perturbation budgets, or architectures. In this work, we introduce Lipschitz-constrained variants of object detection architectures as robust-by-design alternatives to standard detectors. We validate this approach with LipSSD, a Lipschitz-constrained Single Shot MultiBox Detector (SSD), and provide a comprehensive study of its adversarial robustness using multiple white-box adversarial attacks and datasets. We first analyze the accuracyrobustness trade-off induced by Lipschitz constraints and show that it can be controlled through a single training hyperparameter. We then demonstrate that Lipschitzconstrained detectors are complementary to adversarial training: under the same training setup on the Pascal VOC dataset, adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical adversarially trained SSD. Finally, we use more specific safety-critical datasets such as LARD and KITTI, and show that Lipschitz-constrained detectors can improve robustness while largely preserving clean performance. These results suggest that architectural Lipschitz control is a practical and attack-agnostic direction for improving the robustness of object detectors.

Vincent Lébé, Yannick Prudent, Corentin Friedrich +3

IRIT, DTIPG - SNCF, UT3 · IRT Saint-Exup´ery · Alstom +2

Adversarial Robustness Object Detection Lipschitz Neural Networks Adversarial Attacks on Object Detectors

Ask PDF

May 19, 2025

A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detection

Deep neural networks (DNNs) are highly susceptible to adversarial examples---small, malicious perturbations that can cause incorrect predictions. We introduce a lightweight, plug-in detector that uses internal layer-wise inconsistencies within the target model and requires only benign data for fitting and calibration. The approach is motivated by the A Few Large Shifts Assumption, an empirical hypothesis that adversarial perturbations often produce large, localized growth in representation changes across a small number of consecutive layers, connecting adversarial behavior to layer-wise Lipschitz continuity. We develop two complementary scores---Recovery Testing (RT) for intermediate-layer inconsistency and Logit-layer Testing (LT) for augmentation-induced output instability---and fuse them through RLT. Across CIFAR-10, CIFAR-100, and ImageNet, RLT achieves strong detection performance under standard attacks with substantially lower overhead than detector families requiring external encoders or reference-set retrieval. We further study its behavior under adaptive attacks, at low false-positive operating points, and under benign distribution shifts. The code is available here: https://github.com/c0510gy/AFLS-AED.

Sanggeon Yun, Ryozo Masukawa, Hyunwoo Oh +2

Department of Computer Science University of California, Irvine · Whiting School of Engineering Johns Hopkins University

Adversarial Attacks Adversarial Examples Adversarial Example Detection

Ask PDF

May 25, 2026

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces

Deep learning models are vulnerable to adversarial perturbations, raising important concerns for safety-critical deployment. Empirical defenses can achieve strong robustness in practice, but lack formal guarantees, motivating the need for certifiably robust classifiers. While certified methods provide formal guarantees, they often yield overly conservative bounds due to their inability to exploit structure in complex data distributions. In this work, we propose a framework for designing certifiably robust classifiers that leverages latent structure in data representations. We first analyze the Gaussian mixture setting, deriving necessary and sufficient conditions for the existence of robust classifiers and constructing a classifier with a closed-form robustness certificate and generalization guarantees. Our main contribution is to show that exact structure is not required: we prove that if a pretrained encoder maps inputs to a latent distribution that is

\varepsilon

-close (in KL divergence) to a Gaussian mixture, then certified accuracy degrades gracefully, with an explicit bound relating robustness under the true and approximate distributions. This result enables the direct use of pretrained models without requiring exact distributional assumptions. Empirically, our method achieves state-of-the-art or competitive certified accuracy on CIFAR-10 and ImageNet, while maintaining strong clean performance and low computational overhead. Overall, our work establishes approximate latent structure as a practical and principled route to certifiable robustness.

Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen +2

CS & MINDS Johns Hopkins University · CIS University of Pennsylvania

Neural Network Robustness Adversarial Robustness Certified Robustness

Ask PDF

Abstract

Adversarial Example Detection

Explore similar work

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detection

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces