Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Rui Zhang; Xinle Cao; Huazhen Yu; Jian Liu; Youwen Zhu

cs.LGOct 11, 2026

Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Authors: Rui Zhang, Xinle Cao, Huazhen Yu, Jian Liu, Youwen Zhu

Organizations: Nanjing University of Aeronautics and Astronautics · The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Nanjing University of Information Science and Technology

Abstract

Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations. Certified $\ell_2$ defenses today face a costly trade-off: randomized smoothing (RS) requires hundreds of noisy queries per input, while Lipschitz networks (LN) constrain the architecture and sacrifice clean accuracy. We take a detection-oriented approach instead: rather than certifying that predictions are invariant inside an $\ell_2$ ball, we certify that adversarial inputs within an $\ell_2$ ball are detected --- a guarantee aligned with security-critical deployments where missing an attack is costlier than flagging a clean input. To realize this, we prove a Lipschitz-margin reduction from certified $\ell_2$ robustness to certified detection, which reduces the problem to handling a single Lipschitz constant $L$ . We introduce two detector families: $\mathbb{D}_{Adv}$ , which estimates $L$ from a single defender-side perturbed pair, and $\mathbb{D}_{lc}$ , which augments that pair with a local margin centroid to keep the estimate above what the certificate requires. Both deploy on any pretrained classifier without retraining. With a valid global bound, the detector is fully certified at that radius; with a local estimate $L'$ , certification is sample-wise and applies only when our certified condition holds. Across MNIST, CIFAR-10, and ImageNet-1k on four backbones (LeNet-5, VGG16, ResNet-50, ViT-B/16), our detectors match or outperform five baselines (CTT, SortNet, CRM, ContraNet, A $^2$ D). For CIFAR-10 with 1-Lipschitz SortNet, our reduction delivers $100\%$ certified detection at the lowest FPR among compared certified detectors; on the standard CIFAR-10 VGG16, our detectors reject all evaluated in-budget adversarial examples, with 62-82% both rejected and formally certified.

Figures & tables

Fig. 1 : Overview of certified adversarial detection. Taking a pre-trained classifier $f$ as-is (no retraining and no architectural change), we exploit the Lipschitz–margin principle: a clean input $\boldsymbol{x}$ exhibits a large margin $q(\boldsymbol{x})=f_{y}(\boldsymbol{x})-\max_{i\neq y}f_{i}(\boldsymbol{x})$ , whereas a successful adversarial example $\hat{\boldsymbol{x}}$ with bounded perturbation $\|\delta\|$ is forced close to the decision boundary, yielding a small margin upper-bounded by $q(\hat{\boldsymbol{x}})\leq cL\|\delta\|-q(\boldsymbol{x})$ (Lemma IV.1 ). Because the clean counterpart $\boldsymbol{x}$ is unobserved at inference time, we instantiate two approximated detectors — $\mathbb{D}_{Adv}$ (defender-side perturbation surrogate; Claim 1 ) and $\mathbb{D}_{lc}$ (local-centroid surrogate; Claim 2 ) — which flag adversarial inputs while accepting clean ones, and report TPR, FPR, and cert%, where cert% counts successful in-budget adversarial examples that are both rejected and formally certified.

$\epsilon$	SortNet [ zhang_rethinking_2022 ]		CRM [ fazlyab2023certified ]		Lem IV.1 , $L_{\text{glob}}$ (ours)		$\mathbb{D}_{Adv}$ (ours)			$\mathbb{D}_{lc}$ (ours)
	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	cert%	TPR	FPR	cert%
0.1	100.0	22.0	100.0	25.2	100.0	10.5	99.0	9.3	58.1	100.0	10.1	36.5
0.3	100.0	59.0	100.0	68.0	100.0	31.5	100.0	21.3	59.0	100.0	25.8	41.0
0.5	100.0	86.0	100.0	96.0	100.0	58.5	99.5	35.3	65.3	100.0	40.7	50.0
1.0	100.0	100.0	100.0	100.0	100.0	95.0	100.0	59.0	71.5	100.0	63.5	57.5

TABLE I : Fully certified detection on 1-Lipschitz SortNet (CIFAR-10). With

L_{\text{glob}}

exactly known, Lemma IV.1 (using

L=L_{\text{glob}}

) achieves

100\%

certified detection at FPR substantially below the baseline detectors built on SortNet’s and CRM’s certified radii. Our approximated detectors

\mathbb{D}_{Adv}

and

\mathbb{D}_{lc}

use the local estimator

L^{\prime}

and reduce FPR further; we report cert% as the fraction of all successful in-budget adversarial examples that are both rejected and formally certified.

$\epsilon$	$\mathbb{D}_{Adv}$ (ours)			$\mathbb{D}_{lc}$ (ours)			RS (Cohen)
	TPR	FPR	cert%	TPR	FPR	cert%	TPR	FPR
0.1	100.0	0.5	92.0	100.0	1.0	90.0	44.5	4.0
0.5	100.0	8.0	94.0	100.0	8.5	86.0	100.0	22.0
1.0	100.0	17.0	97.0	100.0	17.5	80.0	100.0	98.0
2.0	100.0	47.0	98.0	100.0	47.5	75.0	100.0	98.0

TABLE II: MNIST (LeNet-5): detection at representative

\ell_{2}

budgets. TPR on BIM; FPR on clean inputs; cert% is the fraction of all successful in-budget adversarial examples that are both rejected and formally certified (

L^{\prime}\geq L^{*}

). RS (Cohen) reported at

\sigma{=}0.25

. Full per-attack and per-

\sigma

results in Appendix -D , Tables XII – XIII .

$\epsilon$	$\mathbb{D}_{Adv}$ (ours)			$\mathbb{D}_{lc}$ (ours)			RS (Cohen)		RS (Conservative)		ContraNet
	TPR	FPR	cert%	TPR	FPR	cert%	TPR	FPR	TPR	FPR	TPR	FPR
0.05	100.0	15.3	63.2	100.0	15.6	62.4	38.5	46.0	93.5	93.2	87.0	9.0
0.1	100.0	29.5	76.4	100.0	29.9	75.0	53.0	60.2	95.0	93.8	87.8	9.0
0.3	100.0	74.8	83.4	100.0	75.8	80.4	95.8	96.0	99.6	99.2	74.6	9.0
0.5	100.0	92.7	82.6	100.0	93.6	78.8	100.0	100.0	100.0	100.0	85.0	9.0

TABLE III : CIFAR-10: detection at representative

\ell_{2}

budgets on VGG16. TPR on BIM attacks (averaged over

\sim

500 successful adversarials per

\epsilon

); FPR on the full CIFAR-10 test set; cert% is the fraction of all successful in-budget adversarial examples that are both rejected and formally certified (

L^{\prime}\geq L^{*}

). RS (Conservative) is the strengthened RS variant that combines smoothed-classifier mismatch with the certified radius (Section V ). Full per-attack results in Appendix -D .

TABLE IV : Detection on ImageNet-1k (500 images) with PyTorch pretrained models. TPR on

\ell_{2}

BIM attacks; FPR on clean samples; cert% is the fraction of all successful in-budget adversarial examples that are both rejected and formally certified (

L^{\prime}\geq L^{*}

). The full

\epsilon\in[0.1,1.0]

breakdown for ResNet-50 is in Appendix -D , Table XVII .

Method	MNIST	CIFAR-10	ImageNet-1k
$\mathbb{D}_{Adv}$ (base)	0.020 $\pm$ 0.002	0.071 $\pm$ 0.023	0.190 $\pm$ 0.073
$\mathbb{D}_{Adv}$ (strong $L^{\prime}$ )	0.048 $\pm$ 0.002	0.183 $\pm$ 0.017	0.451 $\pm$ 0.084
$\mathbb{D}_{lc}$ (base)	0.063 $\pm$ 0.006	0.151 $\pm$ 0.026	0.421 $\pm$ 0.074
$\mathbb{D}_{lc}$ (strong $L^{\prime}$ )	0.155 $\pm$ 0.008	0.341 $\pm$ 0.036	0.765 $\pm$ 0.087
RS (Cohen)	0.335 $\pm$ 0.003	0.437 $\pm$ 0.132	3.757 $\pm$ 0.502

TABLE V : Average per-sample detection time (seconds, mean

\pm

std over

n{=}500

inputs). Experiments are conducted on a single NVIDIA V100 GPU.

Dataset	$\epsilon$	$\mathbb{D}_{Adv}$			$\mathbb{D}_{lc}$
Dataset	$\epsilon$	$\Delta$ TPR	$\Delta$ FPR	cert% base $\rightarrow$ strong	$\Delta$ TPR	$\Delta$ FPR	cert% base $\rightarrow$ strong
MNIST	0.50	+0.0	+0.9	92.0 $\rightarrow$ 100.0	+0.0	+1.5	94.0 $\rightarrow$ 100.0
MNIST	1.00	+0.0	+2.3	97.0 $\rightarrow$ 99.5	+0.0	+2.5	98.0 $\rightarrow$ 100.0
CIFAR-10	0.05	+0.0	+0.4	63.2 $\rightarrow$ 98.0	+0.0	+1.0	62.4 $\rightarrow$ 87.0
	0.10	+0.0	+2.0	76.4 $\rightarrow$ 93.5	+0.0	+2.0	75.0 $\rightarrow$ 89.5
	0.30	+0.0	+5.8	83.4 $\rightarrow$ 98.0	+0.0	+7.3	80.4 $\rightarrow$ 97.0

TABLE VI : Stronger

L^{\prime}

estimation improves certified coverage. Only the local estimate is replaced by a multi-probe

L^{\prime}_{\mathrm{strong}}

(

K{=}1,T{=}6

unless stated), trading cert% gains for FPR/runtime.

Dataset	$\epsilon$	BIM ASR	Adp. ASR	$\mathbb{D}_{Adv}$			$\mathbb{D}_{lc}$
Dataset	$\epsilon$	BIM ASR	Adp. ASR	TPR	ASR joint	cert% base $\rightarrow$ strong	TPR	ASR joint	cert% base $\rightarrow$ strong
CIFAR-10	0.05	8.9	11.4	100.0	0.0	3.0 $\rightarrow$ 96.5	100.0	0.0	5.0 $\rightarrow$ 67.5
	0.10	20.3	26.1	100.0	0.0	9.0 $\rightarrow$ 98.0	100.0	0.0	8.5 $\rightarrow$ 77.5
	0.30	61.0	80.7	100.0	0.0	16.5 $\rightarrow$ 97.5	100.0	0.0	17.0 $\rightarrow$ 97.0
	0.50	78.5	98.5	100.0	0.0	24.0 $\rightarrow$ 99.5	100.0	0.0	30.5 $\rightarrow$ 99.0
ImageNet	0.10	4.7	14.1	87.4	1.8	2.8 $\rightarrow$ 89.1	99.0	0.1	11.6 $\rightarrow$ 92.6

TABLE VII : Detector-aware adaptive attack evaluation. ASR

{}_{\mathrm{joint}}=\mathrm{ASR}_{\mathrm{cls}}\cdot(1-\mathrm{TPR})

is end-to-end evasion after detection; cert% is shown before/after stronger

L^{\prime}

	Adv-trained ( $\ell_{2}$ PGD, $r{=}0.5$ )				Gaussian aug ( $\sigma{=}0.25$ )
	$\mathbb{D}_{Adv}$ (AT)		$\mathbb{D}_{lc}$ (AT)		$\mathbb{D}_{Adv}$		$\mathbb{D}_{lc}$		RS (Cohen)		RS (Conservative)
$\epsilon$	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR
0.05	92.0	4.0	99.0	4.0	99.1	5.8	99.5	7.2	38.4	17.0	91.5	27.2
0.1	94.9	7.0	99.2	7.6	99.6	11.2	100.0	13.8	47.6	21.4	93.8	30.8
0.3	97.0	18.0	99.0	20.0	99.8	29.5	100.0	35.4	80.8	43.8	98.6	46.4
0.5	98.4	29.8	99.6	32.2	100.0	43.9	100.0	51.5	95.8	65.0	100.0	65.8

TABLE VIII : Robust training boosts our detection on CIFAR-10 (VGG16). TPR (%) on

\ell_{2}

PGD attacks; FPR (%) on clean inputs. Two robust-training primitives applied to the same VGG16 base model:

\ell_{2}

PGD adversarial training (radius

0.5

, AT columns) and Gaussian augmentation (

\sigma{=}0.25

). RS baselines do not apply to PGD-adversarial-trained models.

Inputs and perturbations
Symbol	Meaning
$\boldsymbol{x}$	Clean input.
$y$	True class of $\boldsymbol{x}$ .
$\delta$	Adversarial perturbation.
$\epsilon$	Perturbation budget.
$\hat{\boldsymbol{x}}$	Adversarial example, $\boldsymbol{x}{+}\delta$ .

TABLE IX: Notation summary.

$\epsilon$	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$
0.3	0.31 (74%)	0.20 (16%)
0.5	0.51 (72%)	0.29 (19%)
1.0	1.02 (63%)	0.85 (44%)

TABLE X: Empirical tightness of

\Delta_{T}

on SortNet. Median actual

\Delta_{T}

and its share of the per-sample theoretical envelope from ( 9 ), computed on detected adversarials with

L^{\prime}\leq L_{\text{glob}}

. The remaining samples satisfy

L^{\prime}\geq L_{\text{glob}}\geq L^{*}

and are trivially certified.

Dataset	Attack	$\epsilon$	$\mathbb{D}_{Adv}$ (Ours)		$\mathbb{D}_{lc}$ (Ours)		CTT-loose		CTT-strict
Dataset	Attack	$\epsilon$	TPR	FPR	TPR	FPR	TPR	FPR	TPR	FPR
MNIST	FGSM	0.1	100.0	0.5	100.0	1.0	100.0	1.6	100.0	1.1
	FGSM	0.2	100.0	1.5	100.0	3.0	100.0	1.6	100.0	1.1
	PGD	0.1	100.0	0.5	100.0	1.0	100.0	1.6	100.0	1.1
	PGD	0.2	100.0	1.5	100.0	3.0	100.0	1.6	100.0	1.1
CIFAR-10	FGSM	0.02	95.0	2.5	100.0	6.0	95.7	6.4	96.5	3.0

TABLE XI : Comparison of our approximated detectors with CTT [ shumailov2020towards ] on MNIST and CIFAR-10. We report true positive rate (TPR, %) and false positive rate (FPR, %) under different attacks and perturbation levels. CTT-loose and CTT-strict correspond to two thresholding variants in [ shumailov2020towards ] .

Dataset	$\epsilon$	$\mathbb{D}_{Adv}$				$\mathbb{D}_{lc}$				Cohen
Dataset	$\epsilon$	FGSM	PGD	BIM	CW	FGSM	PGD	BIM	CW	$\sigma=0.125$	$\sigma=0.25$
MNIST	0.05	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	60.0	33.0
	0.10	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	66.7	44.5
	0.30	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	63.9
	0.50	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0
	1.00	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0	100.0

TABLE XII : TPR (%) of different attacks under varying

\ell_{2}

budgets

\epsilon

. For the Cohen detector [ cohen2019certified ] , we report certified TPR against BIM under two noise levels.

Dataset	$\epsilon$	Ours		Cohen
Dataset	$\epsilon$	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$	$\sigma{=}0.125$	$\sigma{=}0.25$
MNIST	0.05	0.0	0.0	0.5	2.5
	0.10	0.5	1.0	1.5	4.0
	0.30	5.0	5.5	100.0	8.5
	0.50	8.0	8.5	100.0	22.0
	1.00	17.0	17.5	100.0	98.0

TABLE XIII: Clean FPR (%) of our detectors vs. RS (Cohen) across perturbation budgets. Lower is better.

Dataset	Backbone	$\epsilon$	TPR	FPR		cert%
Dataset	Backbone	$\epsilon$	TPR	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$	$\mathbb{D}_{Adv}$	$\mathbb{D}_{lc}$
CIFAR-10	ResNet-18	0.05	100.0	12.2	12.2	70.0	71.3
		0.10	100.0	29.7	29.7	86.0	85.3
		0.30	100.0	74.9	75.1	78.7	77.0
		0.50	100.0	90.5	91.0	71.7	67.7
MNIST	VGG-style CNN	0.50	100.0	2.4	3.6	95.0	100.0

TABLE XIV : Architecture variation on CIFAR-10 and MNIST. BIM attacks with

n_{\mathrm{adv}}{=}500

and

n_{\mathrm{clean}}{=}1000

. We evaluate CIFAR-10 on ResNet-18 and MNIST on a VGG-style CNN to check that the detection profile is not tied to the primary classifiers.

Panel of Figure 16 — Fig. 2 : Summary curves: TPR on adversarial inputs and FPR on clean inputs across $\ell_{2}$ perturbation magnitudes $\epsilon$ , for $\mathbb{D}_{Adv}$ (top row) and $\mathbb{D}_{lc}$ (bottom row). Columns sweep MNIST (LeNet-5), CIFAR-10 (VGG16), and ImageNet-1k (ResNet-50).

Fig. 3 : Distribution of

(\mathrm{RHS}-d_{z})

values under different attacks. Negative values (

\mathrm{RHS}<d_{z}

) indicate samples flagged as adversarial.

Estimator	cert%	ms/sample
Baseline	76.4	22
$K{=}1,T{=}3$	91.6	108
$K{=}1,T{=}6$	93.5	201
$K{=}1,T{=}9$	93.7	293
$K{=}1,T{=}12$	93.7	383
$K{=}2,T{=}12$	95.4	563

TABLE XV: Cost–tightness sweep for the stronger estimator. CIFAR-10 VGG16,

\mathbb{D}_{Adv}

\epsilon{=}0.1

$\mathbb{D}_{Adv}$
$\epsilon$	cert%	$L^{\prime}/L^{*}$ mean $\pm$ std	Median	Viol. %	Viol. mean $\pm$ std
0.05	62.6	$1.037\pm 0.20$	1.007	37.4	$0.949\pm 0.082$
0.10	76.6	$1.067\pm 0.24$	1.034	23.4	$0.908\pm 0.107$
0.30	83.0	$1.153\pm 0.29$	1.118	17.0	$0.855\pm 0.133$
0.50	82.4	$1.194\pm 0.30$	1.162	17.6	$0.861\pm 0.130$
$\mathbb{D}_{lc}$

TABLE XVI : Empirical distribution of

L^{\prime}/L^{*}

. CIFAR-10 VGG16, BIM,

n{=}500

. Violations are samples with

L^{\prime}/L^{*}<1

; the last column reports their ratio distribution.

\mathbb{D}_{lc}

has a right-skewed tail at

\epsilon{=}0.10,0.50

from a few samples with tiny

L^{*}

; its median remains near

1

$\epsilon$	$\mathbb{D}_{Adv}$ (%)		$\mathbb{D}_{lc}$ (%)		RS (Cohen) (%)
	TPR $\uparrow$	FPR $\downarrow$	TPR $\uparrow$	FPR $\downarrow$	TPR $\uparrow$	FPR $\downarrow$
0.1	99.5	9.0	99.7	9.4	34.0	17.0
0.2	99.6	18.0	99.6	17.2	53.0	30.0
0.3	99.8	24.6	99.6	23.7	62.5	36.0
0.4	99.9	30.3	99.2	29.0	82.0	68.0
0.5	99.6	34.4	99.3	32.8	85.5	51.0

TABLE XVII : Full ImageNet-1k results (PyTorch pretrained ResNet-50) at step

\epsilon=0.1

. TPR on

\ell_{2}

BIM attacks; FPR on clean samples.

Adversarial Example Detection

Adversarial example detection identifies inputs crafted to exploit machine-learning models before they cause unreliable predictions.

See all 49 papers

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection
Jul 6, 2026Vincent Lébé, Yannick Prudent, Corentin Friedrich +3Adversarial Robustness Object Detection
IRIT, DTIPG - SNCF, UT3 · IRT Saint-Exup´ery · Alstom +2
A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detection
May 19, 2025Sanggeon Yun, Ryozo Masukawa, Hyunwoo Oh +2Adversarial Attacks Adversarial Examples
Department of Computer Science University of California, Irvine · Whiting School of Engineering Johns Hopkins University
Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces
May 25, 2026Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen +2Neural Network Robustness Adversarial Robustness
CS & MINDS Johns Hopkins University · CIS University of Pennsylvania

Jul 6, 2026J/K move · Enter open · S save

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

Vincent Lébé, Yannick Prudent, Corentin Friedrich, Thomas Massena+2

IRIT, DTIPG - SNCF, UT3 · IRT Saint-Exup´ery · Alstom+2

Adversarial Robustness Object Detection Lipschitz Neural Networks Adversarial Attacks on Object Detectors

Open paper AskPDF arXiv

Object detectors have many applications in safety-critical systems, but they are known to be sensitive to worst-case perturbations such as adversarial attacks, which limits their applicability in real-world scenarios. Compared with classification, adversarial robustness for object detection has received less attention, and existing methods are often tied to adversarial training, whose performance may not transfer across attacks, perturbation budgets, or architectures. In this work, we introduce Lipschitz-constrained variants of object detection architectures as robust-by-design alternatives to standard detectors. We validate this approach with LipSSD, a Lipschitz-constrained Single Shot MultiBox Detector (SSD), and provide a comprehensive study of its adversarial robustness using multiple white-box adversarial attacks and datasets. We first analyze the accuracyrobustness trade-off induced by Lipschitz constraints and show that it can be controlled through a single training hyperparameter. We then demonstrate that Lipschitzconstrained detectors are complementary to adversarial training: under the same training setup on the Pascal VOC dataset, adversarially trained LipSSD improves mAP@50 on unseen attacks by up to 15 points over classical adversarially trained SSD. Finally, we use more specific safety-critical datasets such as LARD and KITTI, and show that Lipschitz-constrained detectors can improve robustness while largely preserving clean performance. These results suggest that architectural Lipschitz control is a practical and attack-agnostic direction for improving the robustness of object detectors.

Abstract

Adversarial Example Detection

Explore similar work

LipSSD: Lipschitz-Constrained Single-Shot Detection for Adversarially Robust Object Detection

A Few Large Shifts: Layer-Inconsistency Based Minimal Overhead Adversarial Example Detection

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces