Provable Adversarial Detection: Prime Quantization meets Gromov--Wasserstein

Manohar Kaul; Sadbhavana Babar; Aditya Ramesh; Aditya Saibewar; Fumiyoshi Kasahara; Maki Inui; Hiroaki Kurihara

cs.LGOct 19, 2026

Provable Adversarial Detection: Prime Quantization meets Gromov--Wasserstein

Authors: Manohar Kaul, Sadbhavana Babar, Aditya Ramesh, Aditya Saibewar, Fumiyoshi Kasahara, Maki Inui, Hiroaki Kurihara

Abstract

Adversarial vulnerability persists across modern vision architectures from CNNs to vision language models (VLMs), yet existing detection methods rely on heuristics without theoretical guarantees. We address the fundamental question of when adversarial perturbations can be provably detected from a geometric perspective. Our key insight is that adversarial perturbations cannot simultaneously preserve geometric structure across spaces with fundamentally different properties. Accordingly, we construct two such complementary metric spaces. First, we use a standard CNN embedding space $Z$ , where adversarial samples exhibit significant displacement patterns. Second, we build a novel prime-quantized space $P$ , that absorbs small perturbations through number-theoretic discretization, resulting in minimal displacement, while preserving discriminability. We then leverage the geometric discrepancies across spaces $Z$ and $P$ to detect adversarial samples. To the best of our knowledge, we establish the first rigorous separation theory for adversarial detection, proving that adversarial samples create unavoidable geometric inconsistencies across both spaces. Our framework provides theoretical guarantees including pixel-level absorption bounds, neighborhood diameter concentration, Gromov-Wasserstein (GW) separation theorems, and practical risk control. Extensive experiments validate our theoretical predictions and achieve consistently strong detection performance across a wide range of attack types and model families.

Figures & tables

Figure 1: Geometry in

Z

(clusters) vs.

P

(dispersed).

Panel of Figure 2 — Figure 2: Geometric inconsistency detection and gap theorem validation. 1st panel: clean neighborhoods; 2nd panel: adversarial separation ( $\gamma_{\mathcal{C}}=3.567$ ); 3rd panel: gap theorem across $\varepsilon\in\{2/255,4/255,6/255,8/255\}$ ; 4th panel: risk control thresholding (left:clean; right:adversarial).

Attack	Ours	MD	FS	MAD	MN
AA	97.9	68.9	82.7	52.0	74.1
CW	97.0	73.6	86.0	51.4	56.7
PT	98.0	86.4	67.8	50.7	57.3
PGD	97.8	91.3	74.4	51.1	81.0
SA	96.8	78.1	74.4	41.1	54.9
SQ	97.6	89.2	88.5	51.0	44.4

Table 1: Binary detection accuracy (%). Best results are in bold and second best are underlined .

Attack	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	0.97	0.91	0.71	0.25	0.78	0.96	0.70
PGD	ViT	0.95	0.65	0.75	0.57	0.01	0.95	0.80
SQ	ResNet-18	0.96	0.89	0.85	0.24	0.01	0.90	0.57
SQ	ViT	0.95	0.66	0.86	0.56	0.02	0.89	0.61
PT	ResNet-18	0.98	0.86	0.54	0.26	0.03	0.89	0.80
PT	ViT	0.95	0.66	0.67	0.54	0.01	0.89	0.81

Table 2: F1-score comparison on CIFAR-10 across multiple attacks using ResNet-18 and ViT. Best results are in bold , second best are underlined .

Table 3: Adaptive robustness and feature ablation. (a) Our method resists adaptive white-box attacks despite defense-aware optimization. (b) Combining local and global GW features yields the strongest detection across attacks.

Appendix figures & tables36 assets

Supplementary material from the paper’s appendix.

Appendix

Symbol	Meaning
Data & embeddings
$X=\{x_{i}\}_{i=1}^{N},\;x_{i}\in[0,1]^{d}$	Dataset of $N$ images (dimension $d$ ).
$Y=\{1,\dots,C\},\;y_{i}\in Y$	Label set and label of $x_{i}$ .
$h_{\theta}:[0,1]^{d}\!\to\!\mathbb{R}^{m}$	CNN feature extractor.
$z_{i}=h_{\theta}(x_{i})\in\mathbb{R}^{m}$	Embedding of $x_{i}$ .
$T_{k}^{(b)}$	Prime quantization map with key $b$ and resolution $k$ .

Appendix

Table 4: Notation summary used throughout the paper.

Attack Method	Parameter Values
AutoAttack (AA)	$\epsilon=\mathbf{4/225},8/225$
C&W (CW)	$\kappa=\mathbf{0.0}$
Patch Attack (PT)	$\mathrm{patch\_shape}=\mathbf{(3,8,8)},(3,16,16)$
PGD	$\epsilon=\mathbf{4/255},8/255$
Spatial Attack (SA)	max rotation: $\mathbf{30}^{\circ}$ , max translation: $\mathbf{10}\%$ of the image size
Square Attack (SQ)	$\epsilon=\mathbf{4/255},8/255$

Appendix

Table 5: Overview of adversarial attack methods and their parameter settings. Parameter value written with

\mathbf{bold}

represents the default value of the corresponding attack among its parameter configurations.

Figure 3: Comparison between Original and Perturbed Images using Gaussian blur attack. Left: Original Image with True Label car , Center: Adversarial Image with Predicted Label truck and Right: Perturbation

Figure 4: Comparison between Original and Perturbed Images using Gaussian blur attack. Left: Original Image with True Label plane , Center: Adversarial Image with Predicted Label bird and Right: Perturbation

Figure 5: Comparison between Original and Perturbed Images using Patch attack. Left: Original Image with True Label car , Center: Adversarial Image with Predicted Label truck and Right: Perturbation

Figure 6: Comparison between Original and Perturbed Images using Patch attack. Left: Original Image with True Label plane , Center: Adversarial Image with Predicted Label bird and Right: Perturbation

Figure 7: Comparison between Original and Perturbed Images using APGD attack. Left: Original Image with True Label Dolphin , Center: Adversarial Image with Predicted Label Camera and Right: Perturbation

Figure 8: Comparison between Original and Perturbed Images using APGD attack. Left: Original Image with True Label Trilobite , Center: Adversarial Image with Predicted Label Helicopter and Right: Perturbation

Detection Method	Parameters
Mahalanobis Detector	$\mathrm{train\_fpr}=0.15$
Feature Squeezing	distance metric: $L_{1}$ , squeezer: median smoothing (2 $\times$ 2), train_fpr=0.2
MetaDetect	num_support = 1, num_query = 15, arch = conv3
MagNet	$l_{1}$ norm reconstruction error, $\mathrm{train\_fpr}=0.15$

Appendix

Table 6: Parameters and configurations for different adversarial detection methods. Methods referenced: Mahalanobis ( Lee et al., 2018 ) , Feature Squeezing ( Xu et al., 2018 ) , MetaDetect ( Ma et al., 2019 ) , and MagNet ( Meng and Chen, 2017 ) .

Hyperparameter	Candidate Values	Optimal Value	Description
$k_{\text{local}}$	$\{8,10,12,15\}$	$8$	Local Gromov-Wasserstein features
$k_{\text{global}}$	$\{3,5,7\}$	$3$	Global Gromov-Wasserstein features
$\epsilon_{\text{gw}}$	$\{0.2,0.5,0.8\}$	$0.5$	Entropic regularization strength

Appendix

Table 7: Hyperparameter search for GW features: We performed a grid search over the candidate values of each hyperparameter and chose the values that achieved the best trade-off between robustness and model usability. Based on this search, we selected the optimal parameters as

k_{\text{local}}=8

k_{\text{global}}=3

, and

\epsilon_{\text{gw}}=0.5

Hyperparameter	Candidate Values	Optimal Value	Description
Kernel	{linear, rbf, poly}	rbf	Choice of kernel function
$C$	{0.1, 1, 10, 100}	1	Regularization parameter
$\gamma$	{scale, auto, 0.01, 0.001}	scale	Kernel Coeff. for RBF

Appendix

Table 8: Hyperparameter search for SVM: We performed a grid search over the candidate values of each hyperparameter and selected the optimal configuration based on validation accuracy. The chosen parameters are Kernel = rbf,

C=1

\gamma=

scale.

Attack	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	97.8	91.7	74.4	46.3	81.9	97.5	69.5
PGD	ViT	95.7	49.8	70.3	57.5	49.4	93.2	77.5
SQ	ResNet-18	97.6	89.1	88.5	45.8	91.9	91.9	59.5
SQ	ViT	96.2	51.0	87.3	56.3	49.7	90.5	62.5
PT	ResNet-18	98.0	86.4	67.3	46.5	50.1	90.1	78.0
PT	ViT	95.4	51.3	71.2	54.9	49.3	89.5	78.5

Appendix

Table 9: Detection accuracy (%) on CIFAR-10 for a range of classical and low-magnitude attacks, evaluated using ResNet-18 and ViT. Best results are in bold; second best are underlined.

Attack	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	0.99	0.81	0.69	0.49	0.51	0.99	0.72
PGD	ViT	0.99	0.72	0.72	0.57	0.49	0.96	0.89
SQ	ResNet-18	0.99	0.55	0.87	0.48	0.49	0.95	0.54
SQ	ViT	0.99	0.40	0.88	0.56	0.50	0.95	0.60
PT	ResNet-18	0.99	0.93	0.52	0.50	0.54	0.95	0.89
PT	ViT	0.99	0.47	0.63	0.54	0.52	0.94	0.90

Appendix

Table 10: AUROC comparison on CIFAR-10 for various attacks generated using ResNet-18 and ViT. Best results are in bold; second best are underlined.

Attacks	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	0.97/0.98	0.89/0.95	0.71/0.72	0.17/0.54	0.97/0.65	0.98/0.95	0.67/0.74
PGD	ViT	1.00/0.90	0.49/0.95	0.73/0.78	0.57/0.57	0.25/0.01	0.98/0.93	0.72/0.90
SQ	ResNet-18	0.96/0.97	0.88/0.89	0.83/0.88	0.16/0.52	0.22/0.01	0.89/0.92	0.60/0.54
SQ	ViT	0.95/0.94	0.50/0.98	0.93/0.80	0.56/0.57	0.40/0.01	0.88/0.90	0.63/0.60
PT	ResNet-18	0.97/0.98	0.87/0.84	0.62/0.49	0.17/0.57	0.55/0.01	0.91/0.88	0.72/0.91
PT	ViT	0.99/0.93	0.50/0.98	0.75/0.61	0.53/0.56	0.25/0.01	0.89/0.87	0.72/0.92

Appendix

Table 11: Precision / Recall comparison of adversarial detection on CIFAR-10 under various attacks generated using ResNet-18 and ViT, with best results in bold and second best underlined.

Figure 9: PR curves for our method on attacks generated via ResNet-18 model on CIFAR10 dataset. The small inset box displays a zoomed-in view of the upper-right corner of the PR curves.

	Ours	MD	FS	MAD	MN
AA	94.9	67.2	82.0	48.3	71.6
CW	93.8	72.1	85.3	48.9	54.2
PT	94.4	84.9	67.1	49.5	54.8
PGD	94.8	90.0	73.7	49.0	78.5
SA	93.4	76.7	73.7	39.2	52.5
SQ	93.4	87.7	87.8	48.5	41.9

Appendix

Table 12: End-to-end accuracy (%). Best results are in bold and second best are underlined.

Attacks	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	95.6	50.00	68.9	45.8	91.00	94.9	–
SQ	ResNet-18	96.7	50.00	84.2	45.5	49.00	89.6	–
PT	ResNet-18	96.2	50.00	73.7	45.0	50.50	88.2	–
AAD	ResNet-18	97.6	50.00	55.9	49.6	59.38	95.4	–
PGN	ResNet-18	96.3	50.00	63.2	46.3	49.06	93.2	–
BSR	ResNet-18	97.8	50.00	59.4	46.35	50.31	93.6	–

Appendix

Table 13: Detection accuracy (%) comparison on ImageNet + ResNet-18 with best (bold) and second best (underlined).

Attacks	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	0.98	0.53	0.73	0.503	0.68	0.98	–
SQ	ResNet-18	0.97	0.55	0.79	0.489	0.49	0.94	–
PT	ResNet-18	0.99	0.52	0.71	0.45	0.50	0.95	–
AAD	ResNet-18	0.99	0.49	0.55	0.495	0.45	0.96	–
PGN	ResNet-18	0.98	0.50	0.66	0.488	0.44	0.95	–
BSR	ResNet-18	0.99	0.50	0.62	0.488	0.43	0.95	–

Appendix

Table 14: AUC comparison on ImageNet with best (bold) and second best (underlined).

Attacks	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	1/0.93	0.50/1.00	0.65/0.82	0.05/0.55	0.92/1.00	0.98/0.97	–
SQ	ResNet-18	0.98/0.96	0.50/1.00	0.84/0.76	0.05/0.52	0.42/0.06	0.89/0.91	–
PT	ResNet-18	0.96/0.95	0.50/1.00	0.82/0.65	0.04/0.45	0.52/0.09	0.87/0.89	–
AAD	ResNet-18	0.99/0.96	0.50/1.00	0.51/0.55	0.49/0.54	0.87/0.21	0.93/0.96	–
PGN	ResNet-18	0.94/0.97	0.50/1.00	0.61/0.68	0.16/0.52	0.28/0.01	0.95/0.92	–
BSR	ResNet-18	0.97/0.96	0.50/1.00	0.50/0.73	0.16/0.52	0.54/0.03	0.96/0.91	–

Appendix

Table 15: Precision / Recall comparison on ImageNet under various attacks, with best values in bold and second best underlined.

Attacks	Model	Ours	MD	FS	MAD	MN	EA	BY
PGD	ResNet-18	0.96	0.66	0.72	0.10	0.96	0.97	-
SQ	ResNet-18	0.96	0.66	0.79	0.09	0.10	0.90	-
PT	ResNet-18	0.95	0.66	0.72	0.08	0.15	0.88	-
AAD	ResNet-18	0.97	0.66	0.52	0.51	0.35	0.95	-
PGN	ResNet-18	0.95	0.66	0.64	0.24	0.02	0.93	-
BSR	ResNet-18	0.96	0.66	0.59	0.24	0.07	0.93	-

Appendix

Table 16: F1 score comparison on ImageNet under various adversarial attacks. Best results are shown in bold, second best underlined.

Panel of Figure 10 — Figure 10: Sensitivity of the detector to the prime-resolution parameter $k$ .

Quantization	Seed					Mean $\pm$ Std
Quantization	1	3	5	21	42	Mean $\pm$ Std
Ours	0.94	0.92	0.95	0.94	0.96	0.94 $\pm$ 0.01
Fibonacci	0.62	0.61	0.55	0.60	0.68	0.61 $\pm$ 0.04
Logarithmic	0.70	0.61	0.61	0.56	0.58	0.62 $\pm$ 0.05
Uniform	0.65	0.65	0.60	0.56	0.65	0.62 $\pm$ 0.03

Appendix

Table 17: Detection accuracy of different quantization schemes across five random seeds. Values reported using a ResNet backbone and CIFAR-10 under mixed attacks (PGD, FGSM, APGD).

k_{\text{local}}

Accuracy 8 97.90 10 86.15 12 92.57 15 93.24

k_{\text{global}}

Accuracy 3 97.90 5 95.60 7 83.45 10 85.35

Appendix

Table 18: Detection accuracy as a function of the local neighborhood size

k_{\text{local}}

(left) and the global neighborhood size

k_{\text{global}}

(right).

Corruption Type	Detection Accuracy	AUROC	Precision / Recall / F1
Gaussian Noise	96.43%	0.99	0.97 / 0.96 / 0.96

Appendix

Table 19: Performance of our detector under Gaussian noise (CIFAR-C).

Method	Runtime (s)	CPU (GB)	GPU (GB)
BY	0.152	2.00	0.60
EA	0.115	0.20	11.80
MD	0.141	0.68	0.10
FS	0.005	0.25	0.17
MAD	0.105	3.30	0.00
MN	0.012	0.78	0.10

Appendix

Table 20: Runtime and memory usage of different adversarial detection methods on CIFAR-10. Best values in bold, second-best underlined.

Panel of Figure 11 — Figure 11: Reliability via TPR/FPR heatmaps. X-axis: attack types with perturbation levels, Y-axis: defenses. Thresholds are calibrated only on clean samples, so baselines yield constant FPR across attacks.

Attack	Ours	MD	FS	MAD	MN
CW	$\mathbf{97.5/100/95}$	$71/51/86$	$90/90/90$	$49.5/69/46.6$	$60/45/63$
SQ	$93.5/98/89$	$88/85/91$	$\mathbf{94.5/99/90.8}$	$48.5/63/47$	$45/15/46$
SP	$\mathbf{95.5/99/92}$	$86/80/90$	$92.5/95/90.5$	$49/67/49$	$48/21/46$
PT	$\mathbf{95/100/90}$	$91/90/91$	$89.5/89/89.9$	$49/67/49$	$45/15/37$

Appendix

Table 21: Cross-Attack Generalization. Accuracy / Recall

{}_{\text{adv}}

/ Precision

{}_{\text{adv}}

(%).

Attack	Ours	MD	FS	MAD	MN
CW	$\mathbf{95/97/94}$	$54/17/68$	$73.5/91/67.4$	$50/69/50$	$50/25/52$
SQ	$\mathbf{87/93/83}$	$51/10/55$	$77.0/98/69.0$	$49/67/49$	$52/29/54$
SP	$\mathbf{94/93/95}$	$64/37/82$	$74/92/67.6$	$49/67/49$	$53/31/56$
PT	$\mathbf{96/95/97}$	$57/22/73$	$72.5/89/66.9$	$47/64/48$	$49/22/47$
FG	$\mathbf{93/99/89}$	$55/18/69$	$70.0/84/65.6$	$46/61/47$	$50/25/50$
PGD	$\mathbf{98/99/99}$	$56/21/72$	$74.5/93/67.9$	$50/69/50$	$50/26/52$

Appendix

Table 22: Cross-Model Generalization. Accuracy / Recall

{}_{\text{adv}}

/ Precision

{}_{\text{adv}}

(%).

Attack / Method	Ours	MD	FS	MAD	MN
AA	$\mathbf{97.40\pm 1.07}$	$50.60\pm 1.99$	$\underline{86.50\pm 1.24}$	$57.96\pm 3.10$	$74.09\pm 1.26$
CW	$\mathbf{96.33\pm 0.57}$	$59.90\pm 0.65$	$\underline{93.20\pm 0.14}$	$56.82\pm 1.52$	$39.30\pm 1.60$
PT	$\mathbf{97.73\pm 0.34}$	$85.50\pm 0.85$	$56.70\pm 2.49$	$55.33\pm 3.92$	$40.50\pm 1.66$
PGD	$\mathbf{97.20\pm 1.07}$	$95.30\pm 0.62$	$69.90\pm 2.68$	$56.22\pm 1.18$	$87.90\pm 0.29$
SA	$\mathbf{96.67\pm 0.23}$	$69.00\pm 1.91$	$69.90\pm 0.17$	$36.20\pm 0.62$	$35.80\pm 2.86$
SQ	$96.67\pm 0.90$	$91.20\pm 0.77$	$\mathbf{98.20\pm 1.12}$	$55.90\pm 3.34$	$14.80\pm 1.12$

Appendix

Table 23: True positive rate (%) on adversarial samples: This table shows the results of TPR measured on adversarial samples.

Attack	Ours	MD	MN
AA $4$	$\mathbf{97.60\pm 0.22}$	$\underline{50.00\pm 0.56}$	$49.90\pm 1.59$
AA $8$	$\mathbf{96.43\pm 0.59}$	$\underline{50.40\pm 0.86}$	$50.10\pm 1.75$
CW	$\mathbf{96.10\pm 1.63}$	$51.60\pm 0.67$	$\underline{54.05\pm 1.43}$
PT $7$	$\mathbf{98.63\pm 0.17}$	$89.45\pm 0.45$	$\underline{90.20\pm 0.32}$
PT $14$	$\mathbf{94.10\pm 0.49}$	$\underline{90.20\pm 0.43}$	$90.09\pm 0.32$
PGD	$\mathbf{97.63\pm 0.53}$	$\underline{49.80\pm 0.67}$	$49.90\pm 1.80$

Appendix

Table 24: The results of binary accuracy on FMNIST using ResNet

18

Attack	Ours	MD	MN
AA	$\mathbf{97.33\pm 0.33}$	$\underline{50.10\pm 1.91}$	$50.00\pm 1.00$
AA $8$	$\mathbf{98.08\pm 0.26}$	$\underline{50.30\pm 1.84}$	$50.00\pm 0.98$
PT $7$	$\mathbf{96.87\pm 0.35}$	$53.35\pm 0.86$	$\underline{75.8\pm 0.72}$
PT $14$	$\mathbf{97.63\pm 0.46}$	$52.20\pm 0.31$	$\underline{86.27\pm 0.27}$
PGD	$\mathbf{98.10\pm 0.45}$	$\underline{50.95\pm 1.72}$	$49.45\pm 0.68$
PGD $8$	$\mathbf{98.60\pm 0.36}$	$\underline{51.80\pm 1.47}$	$49.25\pm 0.69$

Appendix

Table 25: The results of binary accuracy on KMNIST using ResNet

18

Attack	Dataset	Detection Accuracy / AUC		Precision / Recall / F1
Attack	Dataset	LLaVA-1.5	Qwen-2.7B-VL	LLaVA-1.5	Qwen-2.7B-VL
APGD	CalTech-101	89.50 / 0.99	89.63 / 0.99	0.89 / 0.89 / 0.89	0.89 / 0.89 / 0.89
	Food-101	90.44 / 0.99	87.72 / 0.99	0.90 / 0.90 / 0.90	0.87 / 0.87 / 0.87
	CalTech-256	88.60 / 0.95	87.83 / 0.99	0.88 / 0.88 / 0.88	0.87 / 0.87 / 0.87
PGD	CalTech-101	89.50 / 0.99	87.13 / 0.99	0.89 / 0.89 / 0.89	0.87 / 0.87 / 0.86
	Food-101	87.13 / 0.99	88.42 / 0.99	0.87 / 0.87 / 0.87	0.88 / 0.88 / 0.88

Appendix

Table 26: Zero-shot adversarial detection performance on LLaVA-1.5 and Qwen-2.7B-VL across multiple datasets and attacks.

Attack / Metric	Ours	MD	FS	MAD	MN
AA $8$	$\mathbf{97.73\pm 0.47}$	$\underline{90.40\pm 1.4}$	$79.35\pm 0.84$	$50.85\pm 0.20$	$79.04\pm 1.03$
CW	$\mathbf{96.97\pm 0.61}$	$73.55\pm 2.13$	$\underline{86.00\pm 0.56}$	$51.43\pm 2.16$	$56.65\pm 1.71$
PT $8$	$\mathbf{97.30\pm 0.22}$	$\underline{52.80\pm 1.91}$	$52.00\pm 0.55$	$43.43\pm 2.32$	$51.09\pm 0.95$
PGD	$\mathbf{97.57\pm 0.54}$	$71.25\pm 1.60$	$\underline{81.10\pm 1.07}$	$48.91\pm 1.33$	$76.05\pm 0.83$
SQ	$\mathbf{97.30\pm 0.65}$	$\underline{86.85\pm 1.81}$	$84.70\pm 1.23$	$49.11\pm 1.32$	$44.45\pm 1.48$
UP	$\mathbf{97.83\pm 0.50}$	$\underline{66.40\pm 2.40}$	$53.65\pm 1.23$	$50.92\pm 1.86$	$47.85\pm 1.83$

Appendix

Table 27: Comparison of detection performance (%) under different adversarial attacks: Bold values indicate the best performance, and underlined values denote the second-best.

Attack / Metric	Ours	MD	FS	MAD	MN
AA $8$	$\mathbf{96.60\pm 0.86}$	$\underline{93.56\pm 1.51}$	$79.90\pm 1.72$	$55.67\pm 2.49$	$84.10\pm 1.03$
CW	$\mathbf{96.33\pm 0.57}$	$59.90\pm 0.65$	$\underline{93.20\pm 0.14}$	$56.82\pm 1.52$	$39.30\pm 1.60$
PT $8$	$\mathbf{96.07\pm 0.5}$	$18.40\pm 1.80$	$25.20\pm 0.39$	$\underline{40.83\pm 1.90}$	$28.20\pm 1.03$
PGD	$\mathbf{97.07\pm 1.34}$	$55.30\pm 1.12$	$\underline{83.40\pm 2.22}$	$51.79\pm 1.78$	$78.10\pm 0.30$
SQ	$\mathbf{96.00\pm 0.75}$	$86.50\pm 2.76$	$\underline{90.60\pm 1.48}$	$52.19\pm 1.56$	$14.90\pm 1.23$
UP	$\mathbf{97.00\pm 1.14}$	$45.60\pm 3.06$	$28.50\pm 2.52$	$\underline{55.80\pm 2.12}$	$21.70\pm 1.17$

Appendix

Table 28: The results of TPR measured on 1k adversarial samples. TPR := (the number of adv correctly detected) / (the number of adv)

\times 100

(%). The best results are written in bold , and the second-best results are written with underlines .

Attack / Metric	Ours	MD	FS	MAD	MN
AA $8$	$\mathbf{94.1}$	$\underline{89.0}$	$78.64$	$49.18$	$76.60$
CW	$\mathbf{94.8}$	$72.0$	$\underline{85.30}$	$48.92$	$54.20$
PT $8$	$\mathbf{94.4}$	$51.0$	$\underline{51.30}$	$42.03$	$48.65$
PGD	$\mathbf{94.4}$	$70.0$	$\underline{80.40}$	$48.72$	$73.60$
SQ	$\mathbf{93.9}$	$\underline{86.0}$	$84.00$	$47.99$	$42.00$
UP	$\mathbf{94.4}$	$\underline{65.0}$	$52.94$	$48.99$	$45.40$

Appendix

Table 29: The results of end-to-end accuracy:

((\text{the number of correctly detected adversarial samples by the detector})+(\text{the number of correctly detected clean samples and correctly classified samples}))/(1000+1000)

Fraction of known	Detection rate (CIFAR-10)
0%	86.7%
25%	81.23%
50%	76.22%
75%	65.31%
100%	55.17%

Appendix

Table 30: Comparison of detection rates on CIFAR-10 as the fraction of known information varies from 0% to 100%.

Adversarial Example Detection

Adversarial example detection identifies inputs crafted to exploit machine-learning models before they cause unreliable predictions.

See all 49 papers

GeoDetect: Geometric Adversarial Detection for VLPs
Jul 16, 2026Afsaneh Hasanebrahimi, Hanxun Huang, Christopher Leckie +2VLM Robustness Adversarial Attacks on VLMs
The University of Melbourne, Melbourne, Australia · Monash University, Melbourne, Australia
Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification
Oct 11, 2026Rui Zhang, Xinle Cao, Huazhen Yu +2Adversarial Example Detection Adversarial Robustness
Nanjing University of Aeronautics and Astronautics · The State Key Laboratory of Blockchain and Data Security, Zhejiang University · Nanjing University of Information Science and Technology
Detecting Adversarial Data via Provable Adversarial Noise Amplification
May 4, 2026Furkan Mumcu, Yasin YilmazSpectral Regularization Adversarial Robustness
University of South Florida

Jul 16, 2026J/K move · Enter open · S save

GeoDetect: Geometric Adversarial Detection for VLPs

Afsaneh Hasanebrahimi, Hanxun Huang, Christopher Leckie, James Bailey+1

The University of Melbourne, Melbourne, Australia · Monash University, Melbourne, Australia

VLM Robustness Adversarial Attacks on VLMs Vision-Language Models Adversarial Example Detection

Open paper AskPDF arXiv

Vision-language pre-trained models (VLPs) are widely used in real-world applications. However, they remain vulnerable to adversarial attacks. Although adversarial detection methods have demonstrated success in single-modality settings (either vision or language), their effectiveness and reliability in multimodal models such as VLPs remain largely unexplored. In this work, we study the geometry of VLP embedding spaces and observe structured anisotropy that differs from unimodal vision models. Our theoretical analysis shows that under this anisotropic structure, adversarial attacks increase the expected geometric separation between clean and adversarial examples (AEs). Specifically, we demonstrate that AEs consistently exhibit greater expected distances to randomly sampled points than their clean counterparts, indicating that AEs tend to push representations out of manifold regions. Building on these insights, we propose GeoDetect, which leverages these off-manifold deviations via geometric scores to identify AEs. Through comprehensive evaluations, we show that our approach reliably detects AEs across diverse VLP architectures and threat settings, covering unimodal and multimodal attacks as well as adaptive attacks, thereby providing a robust and practical approach to improving the safety and reliability of these models.

Abstract

Adversarial Example Detection

Explore similar work

GeoDetect: Geometric Adversarial Detection for VLPs

Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Detecting Adversarial Data via Provable Adversarial Noise Amplification