Neural Network Robustness

Follow this topic Ask about this topic

Momentum

9 papers in the last four weeks, up 125% on the four weeks before. 0.1% of all new papers.

Jul 13Week of Sep 28

Latest papers 173

Jun 2, 2026cs.LG

HARVE: Hacking-Aware Reward-Head Vector Editing for Robust Reward Models

Reward models are central to large language model (LLM) alignment, but they remain vulnerable to reward hacking. To evaluate reward-model robustness, we introduce RewardHackBench containing 13 reward-hacking patterns covering real life high-stakes domains and general settings, and we find severe failures on specific subcategories across eight reward models. To mitigate these failures, we propose HARVE, a training-free reward-head editing method for scalar reward models. Instead of fine-tuning the reward model, HARVE identifies a multi-directional hacking subspace from residual stream directions associated with selected hacking subcategories, and removes the component of the reward-head vector aligned with that subspace. This directly reduces the reward head's sensitivity to hacking-related features using only a small set of contrastive gold-hacked examples, without gradient updates or fine-tuning. Comprehensive experiments across eight reward models indicates that \model improves hacking robustness, outperforms fine-tuning baselines, and preserves reward-models' general capability. Further analyses suggest that reward hacking is better captured as a multidimensional residual-space structure than by isolated surface cues.

Shuang Liu, Yuxuan Bo, Qiuyang Zhao +4

Carnegie Mellon University · University of Virginia · Harvard University +4

Reward Modeling Reward Hacking Neural Network Robustness Representation Engineering Reward Model Evaluation

Jun 1, 2026cs.LG

RRISE: Robust Radius Inference via a Surrogate Estimator

Randomized smoothing (RS) uses a smoothed classifier to provide architecture-agnostic certificates of

\ell_2

classification robustness, but its dependence on per-input Monte Carlo (MC) sampling undermines its use in real-time systems. We argue that this cost is structural rather than fundamental, such that it can be significantly reduced by sharing information across the deployment stream. We introduce RRISE, an RS framework that compresses certification into a single forward pass through a learned surrogate. RRISE trains the surrogate against precomputed MC class-count targets via a soft-label cross-entropy loss and converts surrogate predictions into provably conservative certified radii through a one-time conformal calibration step. The resulting certificate is deployment-verifiable: whenever the calibrated radius is positive, the surrogate's prediction provably matches the smoothed classifier's and the smoothed classifier is constant on a ball of that radius around the input. Across image classification benchmarks, RRISE matches fixed-budget MC certified accuracy within

0.84

percentage points while replacing up to

10^4

noisy base-model evaluations per query with a single surrogate forward pass, recouping MC training cost after

\approx 10^5

deployment queries. On CIFAR-100 and Tiny ImageNet, where the only prior offline-surrogate method collapses, RRISE achieves

1.23

to

1.91\times

higher certified accuracy, establishing efficient randomized smoothing as a practical path to certified robustness in repeated-deployment settings.

Jong-Ik Park, Shreyas Chaudhari, Carlee Joe-Wong +1

Carnegie Mellon University

Randomized Smoothing Neural Network Robustness Certified Robustness

Jun 1, 2026cs.LG

A combination of noise and bilateral filters achieve supralinear and scalable adversarial robustness in CNNs

The vulnerability of deep neural networks to adversarial examples poses a significant challenge for real-world deployment. Existing techniques to enhance deep network robustness rely on adversarial training, an approach that is powerful but computationally intensive and typically tailored to specific attack types. To address these limitations, existing works have explored techniques such as adding gaussian noise or filtering images, both of which can boost the network robustness to various adversarial attacks, albeit modestly. Here, we theoretically demonstrate that these two approaches enhance robustness against adversarial attacks through complementary mechanisms, resulting in supralinear robustness when combined. Building on this insight, we experimentally show that a simple preprocessor combining Gaussian noise and bilateral filtering yields supralinear improvements in adversarial robustness with minimal computational cost. Next, we combine our preprocessor with adversarial training and test on RobustBench to assess its supralinear improvement over state-of-the-art defenses. First, this combination ranks second on AutoAttack and third overall, while using only

\sim

35% of the training FLOPs, using a model with

\sim

50% less parametets, trained with

\sim

33% of the epochs and

\sim

15% the data compared to state-of-the-art defenses. Second, our method scales efficiently, matching the accuracy of competing models with roughly 2-8x less total compute across 3 orders of magnitude. Overall, our approach provides a principled and easily integrable framework for enhancing adversarial robustness, offering negligible computational overhead and a simple yet theoretically grounded design.

Nicolas Stalder, Benjamin F. Grewe, Matteo Saponati +1

Institute of Neuroinformatics

Neural Network Robustness Adversarial Robustness Adversarial Examples Convolutional Neural Networks

Jun 1, 2026cs.LG

Rethinking Evaluation Paradigms in IBP-based Certified Training

Deep neural networks achieve strong performance on many supervised learning tasks but remain vulnerable to adversarial perturbations. Neural network verification provides mathematically rigorous robustness guarantees, yet at substantial computational cost. To mitigate this, certified training techniques optimise for verifiable robustness during training, typically inducing a trade-off between natural and certified accuracy controlled by method-specific hyperparameters. Because these metrics are inherently conflicting, the common practice of reporting a single configuration is problematic: it can mislead conclusions about overall performance and prevents unbiased assessments of the state of the art. We address this by evaluating certified training methods via Pareto front comparisons over the natural--certified accuracy trade-off. To enable fair, method-agnostic comparisons, we perform efficient automated multi-objective hyperparameter optimisation to identify a set of Pareto-optimal configurations for each method. This approach often uncovers substantial undertuning in previously reported configurations, yielding superior performance and establishing a new state of the art. Leveraging these fronts, we present the first comprehensive multi-objective comparison of certified training approaches, showing that prior advancements are less pronounced than assumed and revealing previously unreported performance complementarities.

Konstantin Kaulen, Hadar Shavit, Holger H. Hoos

Chair of AI Methodology, RWTH Aachen University, Aachen, Germany · LIACS, Leiden University, Leiden, The Netherlands

Neural Network Verification Neural Network Robustness Certified Robustness Multi-Objective Optimization

Jun 1, 2026cs.CV

Sensitivity as a Double-Edged Sword: A Trade-off Between Discriminability and Adversarial Robustness

Modern neural networks are highly susceptible to adversarial perturbations. In this work, we identify that part of this vulnerability stems from the sensitivity of the widely used fully connected (FC) classifiers to such perturbations. In contrast, simple

\ell_2

distance-based classifiers exhibit significantly greater robustness. We provide thorough theoretical and empirical analysis showing that while FC classifiers' high sensitivity makes them discriminative, it also makes them vulnerable. Conversely,

\ell_2

-classifiers' insensitivity grants robustness but limits performance. Motivated by this trade-off, we propose a novel

\ell_2

-reclassifier based on a Hybrid Prototype Mixing (HPM) framework. This method retains the discriminative power of FC classifiers while leveraging the robustness of

\ell_2

distance. It yields

\ell_2

-distance-based predictions by fusing two prototype types: (1) stable, dataset-level prototypes updated via EMA, and (2) dynamic, batch-level prototypes generated from the FC classifier's predictions using a Straight-Through Estimator (STE). However, this dynamic, STE-based architecture introduces significant challenges for evaluation, such as gradient obfuscation and forward discontinuity. To address this, we propose a new, rigorous evaluation protocol, the Mixed Surrogate Attack (MSA), which uses multiple surrogates along with powerful AutoAttack to ensure a fair and robust assessment. Extensive experiments demonstrate that our lightweight, plug-and-play module, with minimal fine-tuning, effectively enhances the adversarial robustness of various existing SOTA adversarially trained models.

Kai Wang

Prototype-Based Classification Neural Network Robustness Adversarial Robustness

May 31, 2026cs.LG

CEAR: Certified Ensemble Adversarial Robustness in DNNs

Deep Neural Networks (DNNs) are highly susceptible to adversarial perturbations, leading to extensive research on robustness for safety-critical applications. State-of-the-art empirical defense mechanisms improve the robustness of DNNs through the training phase, but still struggle against adaptive white-box attacks. On the other hand, certified defenses offer provable guarantees of robustness within a specified perturbation bound. These guarantees hold regardless of the level of perturbations, even if the attacker is given full knowledge of the model. In this paper, we propose CEAR, an ensemble-based robust method that utilizes a hybrid of empirical and certified defense mechanisms. CEAR trains each network within the ensemble using varying Gaussian noise and temperatures to obfuscate gradients and logits, making the model more resistant to stronger gradient-based attacks. We then use noisy logits and propose two different voting mechanisms to further improve robustness. Furthermore, we extend randomized smoothing to verify the robustness of ensemble-based classifiers. Our experimental evaluations on MNIST, CIFAR10, and TinyImageNet datasets demonstrate superior certified accuracy on average, increased robustness radius, and decreased transferability compared to baseline methods.

Daniel Sadig, Mohammadreza Maleki, Hamed Karimi +1

Department of Electrical, Computer, and Biomedical Engineering, Toronto Metropolitan University, Toronto, ON, Canada · Vector Institute, Toronto, ON, Canada

Neural Network Robustness Adversarial Robustness Deep Ensembles Certified Robustness

May 30, 2026cs.LG

Quantum Tunneling-Aware Machine Learning: Physics-Derived Noise Models for Robust Deployment

Transistor scaling is approaching a quantum-mechanical limit, as thin gate oxides induce electron leakage through quantum tunneling. Unlike conventional digital systems, AI inference can tolerate such errors provided their structure is modeled correctly. In this paper, we introduce quantum tunneling-aware machine learning (QTAML). We derive the deployment-time weight-error distribution from first principles using the Wentzel-Kramers-Brillouin (WKB) approximation and show that it has structure that generic Gaussian noise models miss: an exact affine mean drift, a per-bit variance hierarchy dominated by the most-significant bit, and a per-layer dependence on

\|W_\ell\|_\infty

and the trained-network Jacobian. We package these three structural properties into a single deployment-time algorithm, Tunneling-Aware Compensation (TAC), that combines closed-form mean correction with an optimal layer-adaptive bit-budget allocation derived from the WKB variance decomposition. Across four convolutional architectures at

p_\mathrm{flip}

=0.10 and a transformer encoder at

p_\mathrm{flip}

=0.05, TAC reaches

95\%

of clean accuracy with 3.4

\times

to 33.6

\times

less ECC overhead than Uniform-MSP, the natural baseline derived from the same physics. The closed-form saturation ratio

ρ^*

predicts these gains in advance, and on heterogeneous architectures WKB-derived scoring outperforms magnitude-based allocation by up to 24 percentage points at small budgets. The algorithm requires no retraining, no labels, and no inference-time overhead. We also verify the WKB-derived distributional theorems to Monte Carlo precision. These results connect WKB tunneling physics with noise-aware deep learning and suggest a principled path toward hardware--software co-design beyond conventional scaling limits.

Uiwon Hwang, Jaeho Hwang

Department of Computer Science and Engineering Ewha Womans University · Human-Centered Artificial Intelligence Research Institute Ewha Womans University

Neural Network Robustness Physics-Informed ML

May 30, 2026cs.LG

SORA: Free Second-Order Attacks in Fast Adversarial Training

Adversarial Training (AT) is a leading defense against adversarial examples but often suffers from Catastrophic Overfitting (CO) in efficient single-step variants, where robustness to multi-step attacks collapses despite high single-step performance. We address this failure mode with two contributions. First, we formalize Epsilon Overfitting (EO), a perspective in which fixed perturbation magnitudes and directions exacerbate CO, and show that introducing perturbation variability significantly improves robust generalization across different architectures and datasets. Second, we propose PertAlign (Perturbation Alignment), a theoretically grounded, computationally negligible metric that predicts CO onset by measuring gradient alignment across attack stages. Leveraging these insights, we introduce SORA, an adaptive step-size AT method that dynamically adjusts perturbations based on loss surface geometry. SORA consistently prevents CO, achieves state-of-the-art robustness and clean accuracy, and generalizes across datasets and architectures using a single fixed set of hyperparameters, which is essential for applicability in fast AT. Extensive experiments on diverse datasets and architectures show that SORA matches or surpasses the robustness of prior methods while delivering higher clean accuracy and superior efficiency. Code is available at https://github.com/SecondOrderAT/SORA.

Mazdak Teymourian, Ramtin Moslemi, Farzan Rahmani +1

Department of Computer Engineering, Sharif University of Technology, Tehran, Iran.

Adversarial Training Neural Network Generalization Neural Network Robustness Adversarial Robustness

May 28, 2026cs.LG

TASER: Task-Aware Stein Regularisation for Geometry-Driven Robustness

Modern deep networks remain fragile under distribution shift and adversarial perturbations, often due to excessive or poorly structured input sensitivity. We introduce TASER (Task-Aware Stein Regularisation), a training-time regularisation framework derived from Langevin Stein operators. By penalising pointwise Stein residuals under the training distribution, TASER encourages geometric compatibility between predictors and data density, inducing anisotropic, data-aware smoothness. We provide theoretical links between Stein regularisation and reduced first-order shift sensitivity, develop scalable implementation variants compatible with modern architectures, and demonstrate improved robustness and stability across regression and vision benchmarks. Across CIFAR-10 experiments, TASER consistently improves the adversarial robustness of established training methods without incurring statistically significant clean-accuracy degradation.

Michał Kozyra, Gesine Reinert

Department of Statistics, University of Oxford, United Kingdom

Distribution Shift Robustness Neural Network Robustness Adversarial Robustness Image Classification

May 28, 2026cs.LG

Improving Adversarial Robustness of Attribution via Implicit Regularization

The adversarial robustness of attributions is a fundamental requirement for reliable explainability in deep learning, yet existing approaches typically rely on computationally expensive explicit regularization. In this work, we show that attribution robustness can arise implicitly from the learning dynamics of standard stochastic gradient descent. We theoretically motivate this effect through connections between parameter-space and input-space curvature, and validate it across architectures, datasets, and attribution methods, with negligible computational overhead. In contrast, we prove that such robustness gains often does not transfer to attention-based attribution under softmax normalization, due to inherent entropy constraints, and we validate this limitation experimentally. Finally, we show that replacing softmax attention with kernel-based attention restores the robustness gains in transformer models. Our results highlight learning dynamics as a principled and practical mechanism for robust explainability, and reveal fundamental limitations of attention-based attribution under normalization.

Amir Mehrpanah, Matteo Gamba, Hossein Azizpour

Department of Computer Science, KTH Royal Institute of Technology, Stockholm, Sweden · Department of Computer Science, Brown University, USA · Science for Life Laboratory, Stockholm, Sweden

Transformer Interpretability Neural Network Robustness Adversarial Robustness Attention Mechanisms Implicit Regularization

May 28, 2026cs.AI

Harnessing non-adversarial robustness in large language models

The work presents an approach for addressing the challenge of robustness in Large Language Models (LLMs) to alterations and potential errors caused by semantically similar but textually different prompts. Recent works have shown that these kinds of prompt variations can significantly impact the performance of LLMs on tasks. The central question is: can LLMs' robustness to semantically-neutral prompt alterations be acquired without expensive retraining of the entire model? We address this question both theoretically and through experiments. Our theoretical analysis reveals a crucial factor impacting model robustness - a systematic expected shift or perturbation-induced bias in neural network module outputs. Motivated by this analysis, we show that robustness can be achieved via a simple fine-tuning process: debiasing for robustness. We identify conditions when debiasing helps and when it does not, and demonstrate, through both theory and extensive experiments, that debiasing for robustness may indeed be a quick and efficient tool to enhance robustness and provide certification against random prompt perturbations.

Qinghua Zhou, Ellina Aleshina, Andrey Lovyagin +6

International Joint Laboratory of AI for Industry, QUST, Qingdao, China · King’s College London, London, UK · Applied AI Institute, Moscow, Russia +2

LLM Fine-Tuning Neural Network Robustness LLM Reliability Certified Robustness Language Model Robustness Prompt Robustness

May 28, 2026cs.LG

TRACER: Persistent Regularization for Robust Multimodal Finetuning

Mainstream strategies for finetuning pretrained multimodal models often degrade out-of-distribution (OOD) robustness, a phenomenon known as catastrophic forgetting. In this paper, we develop a theoretical framework for multimodal contrastive finetuning, yielding closed-form solutions and a geometric decomposition for each strategy. This framework shows that self-distillation is more effective than other regularization approaches to retain the knowledge of the pretrained model. Our analysis reveals a largely overlooked limitation: standard Exponential Moving Average (EMA) teachers, widely used in robust finetuning, suffer from collapse. To solve this, we prove that a Weighted Moving Average (WMA) teacher maintains a persistent regularizing force over finite horizons and yields bias-free convergence in the task subspace while preserving orthogonal knowledge. These insights motivate TRACER (Trajectory-Robust Anchoring for Contrastive Encoder Regularization), which combines contrastive learning with WMA-guided multi-perspective distillation. Extensive experiments on CLIP finetuning demonstrate consistent OOD accuracy and calibration gains across three backbone architectures, and comprehensive ablations confirm that TRACER is both principled and robust to hyperparameter choices. Code is available at https://github.com/HesamAsad/TRACER.

Hesam Asadollahzadeh, Feng Liu, Christopher Leckie +1

School of Computing and Information Systems (CIS), Faculty of Engineering and IT (FEIT), University of Melbourne, Australia.

VLM Robustness Neural Network Robustness OOD Generalization Self-Distillation Multimodal Foundation Models Multimodal Contrastive Learning+2

May 27, 2026stat.ML

Beyond Lipschitz: Data-Driven Robustness via Discrete Modulus of Continuity

Robustness of neural networks is commonly quantified via local or global Lipschitz constants. However, Lipschitz continuity can be overly coarse or overly restrictive as global robustness measure, failing to capture nuanced, data-dependent behavior. We propose a data-driven, architecture-agnostic framework based on the discrete modulus of continuity (DMOC), a non linear generalization of Lipschitz continuity that provides a finer notion of robustness. Unlike many existing approaches, DMOC does not require access to model internals and instead evaluates regularity relative to the data distribution. This shifts the focus from the model to the data, which provide a data-driven baseline of regularity against which the network's robustness is assessed. We establish convergence results for DMOC-induced seminorms with explicit data-driven rates in terms of the separation distance, and introduce a scalable minibatch algorithm that reduces the quadratic cost of exact computation, enabling application to large-scale data sets such as ImageNet. Empirically, DMOC serves as an architecture independent diagnostic: it distinguishes trained from untrained networks, reveals underfitting and overfitting regimes, and yields, as a special case, tight Lipschitz estimates comparable to state-of-the-art method such as ECLipsE and ECLipsE-fast.

Jürgen Dölz, Michael Multerer, Michele Palma

Institute for Numerical Simulation University of Bonn Germany · Dalle Molle Institute for Artificial Intelligence USI Lugano Switzerland

Neural Network Robustness Adversarial Robustness Certified Robustness

May 26, 2026cs.LG

When Muon Optimizer Meets Adversarial Training: A Theoretical and Empirical Study

Adversarial training (AT) remains one of the most reliable empirical defenses against adversarial attacks. Its robustness critically depends on how the underlying min-max objective is optimized. In practice, Stochastic Gradient Descent (SGD) optimizer remains the default optimization choice for AT, whereas adaptive optimizers often improve standard training but may yield inferior robustness. Recently, the Muon optimizer, which orthogonalizes matrix-valued updates via an approximate polar decomposition, has achieved notable success in large-scale training at a memory cost comparable to SGD. This raises a security-relevant question: \textit{can orthogonalized optimization improve AT under strong and heterogeneous threat models?} Focusing on this problem, we conduct a comprehensive theoretical and empirical study. Theoretically, we show that Muon imposes a spectral-norm stability ceiling on matrix updates, limiting uncontrolled spectral growth in the training dynamics without explicitly shrinking the learned weights. Empirically, across five architectures and three

\ell_p

threat models (

\ell_\infty

,

\ell_1

,

\ell_2

) and their union, Muon is competitive with SGD on CNNs and substantially outperforms AdamW on both CNNs and ViTs. These results identify optimizer geometry as a security-relevant factor in adversarial training, while clarifying the empirical regimes in which orthogonalized updates are beneficial. Overall, our findings highlight optimizer design as a security-critical component of AT.

Jun Yan, Weiquan Huang, Jiankai Zuo +4

IT College, Shanghai Ocean University, Shanghai, 201306 · School of Computer Science and Technology, Tongji University, Shanghai, 201804 · SEIE, Suzhou University of Science and Technology, Suzhou, 215009 +2

Adversarial Training Neural Network Optimization Neural Network Robustness Adversarial Robustness Muon Optimizer

May 25, 2026cs.CR

Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

Vision-Language-Action (VLA) models reach high success rates on clean inputs but collapse under small adversarial perturbations: a

16/255

PGD attack drops OpenVLA-7B's LIBERO success from

95\%

to under

5\%

. Whether this trade-off has a theoretical floor was open. We prove that it does. For any VLA policy, capability

I(\Astar;\Api)

and robustness

I(\Api;\Atildepi)-I(\Api;δ)

sum to at most

H(\Astar)+I(X;\Xtilde)

, the task entropy plus adversarial channel capacity. The proof reduces to two applications of the Data Processing Inequality. The pixel-level bound is loose by

\sim 10^3

nats and serves as a ceiling guarantee; an encoder-specific corollary tightens it by over an order of magnitude, into a regime where realized capability already consumes

5

--

9\%

of the budget. We validate Theorem~\ref{thm:main} with zero violations across

308

cells:

252

closed-form Gaussian-VLA,

48

OpenVLA-7B

+

LIBERO

+

PGD (

4

suites

\times

4

\eps

\times

3

seeds),

4

Square-Attack, and

4

multi-step (

T{=}10

). A complementary measurability inequality

\Rob_{\text{disc}} \le \Cap_{\text{disc}}

further holds across

144

cross-architecture cells spanning OpenVLA, OpenVLA-OFT (continuous-

L_1

), and SmolVLA (flow-matching). The same construction yields three label-free diagnostics: a pre-flight encoder ceiling, a defense-forensics probe that localizes input-side vs.\ language-model intervention, and a head-agnostic robustness ratio comparable across discrete-token,

L_1

-regression, and flow-matching policies. Together these provide the cross-setting axis defense and architecture comparisons currently lack.

Jianwei Tai

School of Internet, Anhui University

Neural Network Robustness Adversarial Robustness Adversarial Attacks on VLA Models Vision-Language-Action Models Noise Robustness Robustness of VLA Models

May 25, 2026cs.LG

Certified Robustness from Approximate Gaussian Mixture Structures in Pretrained Latent Spaces

Deep learning models are vulnerable to adversarial perturbations, raising important concerns for safety-critical deployment. Empirical defenses can achieve strong robustness in practice, but lack formal guarantees, motivating the need for certifiably robust classifiers. While certified methods provide formal guarantees, they often yield overly conservative bounds due to their inability to exploit structure in complex data distributions. In this work, we propose a framework for designing certifiably robust classifiers that leverages latent structure in data representations. We first analyze the Gaussian mixture setting, deriving necessary and sufficient conditions for the existence of robust classifiers and constructing a classifier with a closed-form robustness certificate and generalization guarantees. Our main contribution is to show that exact structure is not required: we prove that if a pretrained encoder maps inputs to a latent distribution that is

\varepsilon

-close (in KL divergence) to a Gaussian mixture, then certified accuracy degrades gracefully, with an explicit bound relating robustness under the true and approximate distributions. This result enables the direct use of pretrained models without requiring exact distributional assumptions. Empirically, our method achieves state-of-the-art or competitive certified accuracy on CIFAR-10 and ImageNet, while maintaining strong clean performance and low computational overhead. Overall, our work establishes approximate latent structure as a practical and principled route to certifiable robustness.

Konstantinos Emmanouilidis, Tianjiao Ding, Nghia Nguyen +2

CS & MINDS Johns Hopkins University · CIS University of Pennsylvania

Neural Network Robustness Adversarial Robustness Certified Robustness

May 23, 2026cs.LG

ChainzRule: Sample-Efficient, Robust Deep Learning Across Tabular, NLP, and Vision Tasks

Production deep learning systems across enterprise domains operate under constraints that academic benchmarks routinely obscure: labeled data is expensive, inference budgets are tight, and models that cannot explain their behavior are difficult to trust and maintain. We present ChainzRule (CR), a neural architecture replacing typical activations with learnable polynomial layers governed by Differential Regularization (DREG), a layer-wise Jacobian penalty computed analytically during the forward pass at standard inference cost. The core claim is that bounding intermediate derivatives forces the network toward low-frequency, structurally stable representations, simultaneously reducing dependence on labeled data volume, improving robustness to distribution shift, and providing a measurable, gradient-based handle on model behavior. Evaluated across five domains, CR achieves

85.71\% \pm 2.01\%

on Pima Diabetes (statistically superior to SVM and XGBoost),

46.20\% \pm 0.37\%

on SST-5 sentiment classification with a frozen encoder (superior to RNTN using approximately 5% of its training data),

55.79\%

on SST-5 with a fine-tuned BERT backbone (versus BERT-base linear head at

54.9\%

),

70.17\%

on Yelp Full ordinal regression with 3.2M parameters versus a 10-model average of

66.35\%

, and

+2.32\%

mean corruption accuracy on CIFAR-10-C. All results with reported

p

-values fall below the

α= 0.05

threshold after Bonferroni correction. CR maintains a gradient tail ratio

τ

(p99/mean) of

1.01

--

1.02

against

1.07

--

1.09

for all typical activation function baselines across every data fraction, a structural invariant we propose as the mechanistic driver of sample efficiency and a deployment-time proxy for model reliability.

Rowan Martnishn

Sentivity AI

Polynomial Neural Networks Neural Network Robustness OOD Generalization Jacobian Regularization Neural Network Activation Functions Neural Network Interpretability+3

May 21, 2026cs.LG

Toward Understanding Adversarial Distillation: Why Robust Teachers Fail

Adversarial Distillation aims to enhance student robustness by guiding the student with a robust teacher's soft labels within the min-max adversarial training framework, yet its success is notoriously inconsistent: a more robust teacher often fails to improve, or even harms, the student's robust generalization. In this paper, we identify a key mechanism of this teacher dependency: the misalignment between the teacher's supervisory confidence and the student's representational limitations on a consistent subset of training data -- the Robustly Unlearnable Set. We present a theoretical framework analyzing the feature learning dynamics of a two-layer neural network, demonstrating that this mismatch creates a dichotomy in distillation outcomes. We prove that when a teacher provides confident supervision on unlearnable samples, it compels the student to memorize spurious noise patterns that eventually overpower the learned robust signal, thereby driving robust overfitting. Conversely, a teacher that exhibits high uncertainty on these samples effectively suppresses noise memorization, allowing the student to rely solely on the learnable signal for robust generalization. We empirically validate our theory across both synthetic simulations and real-image classification datasets, confirming that robust overfitting is driven by the teacher's interaction with unlearnable samples. Finally, we demonstrate that a teacher's predictive entropy on unlearnable samples serves as a strong indicator of student robustness, validating our theoretical framework and offering a principled guideline for robust teacher selection.

Hongsin Lee, Hye Won Chung

School of Electrical Engineering, KAIST, Daejeon, Korea.

Adversarial Training Neural Network Robustness Adversarial Robustness Adversarial Examples Teacher-Student Learning Knowledge Distillation+2

May 20, 2026cs.LG

A New Framework to Analyse the Distributional Robustness of Deep Neural Networks

Deep neural networks have achieved impressive performance on a variety of tasks, but their brittleness to distributional shifts remains a significant barrier to real-world deployment. In this paper, we propose a framework to analyse and quantify the distributional robustness of neural networks by studying the interactions between layer weights and activations. We model these interactions using Bernoulli distributions, using the separation between classes as a diagnostic proxy for robustness. We demonstrate the usefulness of this framework through models trained on CIFAR-10 and ImageNet. We show that our proposed metrics can distinguish between networks that have memorised their training data and those that have not. We also perform analogous experiments in the activation space and find that the same properties do not hold up. Additionally, we investigate the behaviour of our metrics under various distribution shifts and show that these shifts reduce separation under our path-based diagnostics. Our results suggest that this framework provides useful model-level diagnostics of representation structure and robustness.

Divij Khaitan, Subhashis Banerjee

Microsoft · Ashoka University

Distribution Shift Robustness Neural Network Generalization Neural Network Robustness

May 20, 2026cs.CV

Mind Your Margin and Boundary: Are Your Distilled Datasets Truly Robust?

Dataset distillation (DD) compresses a large training set into a small synthetic set for efficient training, but most DD methods optimize only clean accuracy and leave robustness uncontrolled. Recent robust DD methods improve robustness, yet they often suffer from a poor accuracy-robustness trade-off because they (i) treat all adversarially perturbed examples uniformly, despite robust risk being dominated by near-zero robust margins, and (ii) do not explicitly increase inter-class separation in the decision boundary where attacks concentrate. We present Contrastive Curriculum for Robust Dataset Distillation (C

^2

R), a framework that couples an attack-aware curriculum with a contrastive robustness objective. From a robust-margin perspective, we derive a perturbation score that approximates each sample's robust hinge, enabling a curriculum that prioritizes the smallest-margin adversaries that most directly drive robust error. In parallel, a class-balanced contrastive robustness loss enforces adversarial invariance while explicitly widening boundary separation across classes. Experiments on CIFAR-10/100, Tiny-ImageNet, and multiple ImageNet-1K subsets under six attacks show that C

^2

R achieves the best robust accuracy, outperforming prior robust DD by

2.8

% on average.

Muquan Li, Yingyi Ma, Yihong Huang +5

The Laboratory of Intelligent Collaborative Computing of UESTC, Chengdu, China · Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ), Shenzhen, China · Monash University, Melbourne, Australia

Neural Network Robustness Adversarial Robustness Dataset Distillation

May 19, 2026cs.LG

Symmetrization of Loss Functions for Robust Training of Neural Networks in the Presence of Noisy Labels

Labeling a training set is often expensive and susceptible to errors, making the design of robust loss functions for label noise an important problem. The symmetry condition provides theoretical guarantees for robustness to such noise. In this work, we study a symmetrization method arising from the unique decomposition of any multi-class loss function into a symmetric component and a class-insensitive term. In particular, symmetrizing the cross-entropy loss leads to a linear multi-class extension of the unhinged loss. Unlike in the binary case, the multi-class version must have specific coefficients in order to satisfy the symmetry condition. Under suitable assumptions, we show that this multi-class unhinged loss is the unique convex multi-class symmetric loss. We also show that it has a fundamental local role: the linear approximation of any symmetric loss around score vectors with equal components is equivalent to the multi-class unhinged loss. We then introduce SGCE and alpha-MAE, two loss functions that interpolate between the multi-class unhinged loss and the Mean Absolute Error while allowing control of the beta-smoothness of the loss. Experiments on standard noisy-label benchmarks show competitive performance compared with existing robust loss functions.

Alexandre Lemire Paquin, Brahim Chaib-Draa, Philippe Giguère

Department of Computer Science and Software Engineering Université Laval, Québec, Canada

Neural Network Robustness Noisy-Label Learning Robust Loss Functions Multiclass Classification

May 19, 2026cs.CV

SDM: A Powerful Tool for Evaluating Model Robustness

Gradient-based attacks are important methods for evaluating model robustness. However, since the proposal of APGD, it has been difficult for such methods to achieve significant breakthroughs. To achieve such an effect, we first analyze the issue of "high-loss non-adversarial examples" that degrades attack performance in previous methods, and prove that this issue arises from inappropriate objectives for adversarial example generation. Subsequently, we reconstruct the objective as "maximizing the difference between the non-ground-truth label probability upper bound and the ground-truth label probability", and proposes a novel and powerful gradient-based attack method named Sequential Difference Maximization (SDM). SDM establishes a three-layer optimization framework of "cycle-stage-step". It adopts the negative probability loss function and the Directional Probability Difference Ratio (DPDR) loss function in the initial and subsequent optimization stages, respectively, and approaches the ideal objective of adversarial example generation via stage-wise sequential optimization. Experiments demonstrate that compared with previous state-of-the-art methods, SDM not only achieves stronger attack performance but also exhibits superior cost-effectiveness. The code is available at https://github.com/X-L-Liu/ICML-SDM.

Xinlei Liu, Tao Hu, Jichao Xie +3

Information Engineering University, Zhengzhou, China · Key Laboratory of Cyberspace Endogenous Safety & Security of Henan Province, Zhengzhou, China · Key Laboratory of Cyberspace Security Ministry of Education of China, Zhengzhou, China +1

Adversarial Attacks Neural Network Robustness Adversarial Robustness Adversarial Examples

May 19, 2026cs.NE

Updating the standard neuron model in artificial neural networks

From their inception in the 1950s, artificial neural networks (ANNs) started using the so-called point neuron model then prevalent in neuroscience, hoping that this analogy would allow for a better emulation of brain function. Over the years the neuroscience literature has shown that the point neuron model is too simplistic to properly represent many fundamental neural processes; however, the standard neuron model in ANNs still remains the same. Here we substitute it by a very recent model of cortical cells and demonstrate through theoretical analyses and experimental results how, simply by using a more realistic neural unit element without augmenting the number of parameters, the resulting ANNs offer a number of important advantages that include increases in expressivity, robustness and learning speed, and a reduction in memorization and the amount of training data needed.

Raul Mohedano, Thomas Batard, Erik Velasco-Salido +4

1Spanish National Research Council (CSIC), Madrid, Spain. · Center for Research in Mathematics (CIMAT), Guanajuato, Mexico. · 3Universidad Aut´onoma de Madrid (UAM), Madrid, Spain. +1

Neural Network Robustness Neural Network Expressivity

May 18, 2026cs.CV

MedFM-Robust: Benchmarking Robustness of Medical Foundation Models

Medical foundation models have achieved remarkable clinical performance, yet their robustness under real-world perturbations remains underexplored. We present a robustness benchmark comprising 40 perturbation types (12 base, 28 medical-specific) across eight imaging modalities, evaluating five VLMs (LLaVA-Med, MedGemma, MedGemma-1.5, Gemini-2.5-flash and GPT-4o-mini) on VQA, visual grounding, and captioning, alongside two segmentation models (MedSAM, SAM-Med2D) with five fine-tuning strategies. Our findings reveal: (1) Fine-tuning strategy dominates robustness, with LoRA exhibiting nearly double the degradation of full fine-tuning, while SAM-Med2D's Adapter offers favorable efficiency-robustness trade-off. (2) Medical-specific perturbations disproportionately damage segmentation, with 9 of 15 top corruptions being domain-specific. (3) LoRA-tuned visual grounding drops over 40 points, whereas zero-shot captioning remains stable (<7% drop). Zero-shot VQA shows model-dependent robustness--medical models drop under 20% while Gemini-2.5-flash drops 54%. General-purpose VLMs achieve higher VQA accuracy but fail on grounding; among medical VLMs, MedGemma demonstrates the best overall stability. These results provide deployment guidelines and underscore the necessity of domain-specific robustness evaluation for medical AI. Our code is available at: https://abnerai.github.io/MedFM-Robust.

Xiangxiang Cui, Tianjin Huang, Yifang Wang +2

Beijing Normal University, China · University of Exeter, United Kingdom · University College London, United Kingdom +2

Multimodal Robustness Neural Network Robustness Vision Foundation Model Adaptation Medical VLMs Medical Image Segmentation Medical Image Benchmarks

May 17, 2026cs.LG

UniAlign: A Model-Agnostic Framework for Robust Network Traffic Classification under Distribution Shifts

Network traffic classification (NTC) models often suffer severe performance degradation when deployed in real-world environments due to distribution shifts caused by changing network conditions. Existing robustness-enhancing approaches are commonly coupled to specific model architectures or data settings, fail to generalize to state-of-the-art raw-byte-based NTC models, or incur significant training overhead. In this paper, we propose UniAlign, a novel model-agnostic framework that improves the robustness of deep learning-based NTC models under distribution shifts. UniAlign combines \emph{domain alignment fine-tuning}, which encourages the learning of domain-invariant traffic representations across heterogeneous network conditions, with \emph{stable model ensembling}, which enhances inference robustness by aggregating checkpoints within a flat loss region. The framework can be seamlessly integrated into existing supervised NTC models without requiring specific feature modalities or introducing non-constant additional training costs. We evaluate UniAlign on three public datasets covering diverse distribution shifts, including encryption schemes, data collection devices, and attack behaviors. Experimental results on two representative NTC models demonstrate that, compared with standard training, UniAlign improves average classification accuracy by 2.51% and average F1 score by 2.71%, outperforming the strongest baseline by 1.45% in accuracy and 1.69% in F1 score, while requiring only 12.4%--53.9% of the training time of all NTC-specific baselines.

Tongze Wang, Xiaohui Xie, Wenduo Wang +2

Institute for Network Sciences and Cyberspace, Tsinghua University · Department of Computer Science and Technology, Tsinghua University

Distribution Shift Robustness Domain Adaptation Neural Network Robustness

May 16, 2026cs.LG

Stress-Testing Neural Network Verifiers with Provably Robust Instances

Neural network verifiers aim to provide formal guarantees on model behavior, but existing verification benchmarks are fundamentally limited by their lack of ground-truth labels. As a result, verifier evaluation relies on indirect heuristics, which prevents exact scoring and systematic study of verifier failure modes. We address this gap by introducing a reusable framework for generating verification instances whose ground-truth robustness labels are known a priori through analytic construction. Our framework led to the discovery of multiple numeric tolerance concerns and an implementation bug in popular verifiers, highlighting the need for ground-truth labels. Additionally, to systematically study verifier failure modes, we introduce the verification Difficulty Profile, a collection of estimable quantities capturing distinct sources of instance hardness. Using our framework and these profiles, we evaluate five state-of-the-art verifiers and show that different instances stress distinct aspects of the verification pipeline. We show that these results can aid the future development of verifiers as they provide actionable targets for improving numerical reliability, relaxation quality, and search behavior. Our code is publicly available: https://github.com/dtroxell19/VeriStressGT.git.

David Troxell, Yulia Alexandr, Sofia Hunt +2

Department of Statistics & Data Science, University of California, Los Angeles · Department of Mathematics, University of California, Los Angeles · Max Planck Institute for Mathematics in the Sciences, Leipzig

Neural Network Verification Neural Network Robustness Synthetic Benchmark Generation Certified Robustness

May 15, 2026cs.CV

Semantic Smoothing via Novel View Synthesis for Robust SAR Image Classification

Deep neural networks are vulnerable to adversarial perturbations, limiting deployment in safety-critical applications such as synthetic aperture radar (SAR) automatic target recognition (ATR). Randomized smoothing improves robustness by averaging predictions over noisy inputs, but isotropic noise often fails to preserve the semantic structure of SAR imagery. We propose semantic smoothing, a defense that replaces noised-based perturbations with structured randomized transformations generated by a novel view synthesis model. For SAR, we condition on acquisition geometry to synthesize multiple plausible radar views. Predictions across generated randomized views are aggregated to form a robust classifier. Experiments show that semantic smoothing improves robustness against standard attacks, such as FGSM and PGD, and SAR-specific attacks, such as OTSA and SMGAA, while also increasing clean classification accuracy. These results demonstrate that randomized smoothing via semantically preserving geometric transformations is a promising alternative to isotropic noise for adversarial defense in structured sensing domains.

Daniel Brignac, Fengwei Tian, Banafsheh Latibari +2

The University of Arizona Tucson, Arizona, United States

Randomized Smoothing Adversarial Attacks Neural Network Robustness Adversarial Robustness Synthetic Aperture Radar Image Classification

May 14, 2026cs.LG

LPDS: Evaluating LLM Robustness Through Logic-Preserving Difficulty Scaling

As large language models (LLMs) are increasingly deployed to perform tasks with minimal human oversight, it is crucial that these models operate robustly. In particular, a model that can solve a given problem should not fail simply because certain entities

\unicode{x2013}

such as names, numbers, or other contextual details

\unicode{x2013}

have changed while the underlying problem logic remains the same. Prior work suggests that current LLMs still struggle with this form of robustness: they often succeed on some variations of a problem but fail on others. However, existing evaluations often lack a systematic way to identify which logic-preserving variations are most likely to induce failure. Instead, they typically test a random subset of allowable variations, which can overstate robustness. To address this gap, we introduce logic-preserving difficulty scaling (LPDS), a framework that (i) quantifies the difficulty of a problem variation and (ii) systematically searches the space of allowable variations to find those that maximize difficulty and expose failures. We show that as difficulty increases, performance declines and errors in the models' reasoning chains become more pronounced. We further demonstrate that LPDS efficiently finds difficult problem variations for a model, resulting in performance drops up to 5 times larger compared to random sampling. Finally, we show that fine-tuning on more difficult variations leads to more consistent robustness gains than training on easier ones.

Philipp Mondorf, Samuel J. Bell, Jesse Dodge +1

FAIR at Meta · LMU Munich · Munich Center for Machine Learning +1

LLM Evaluation Neural Network Robustness LLM Reliability Language Model Robustness

May 14, 2026cs.LG

Fast Adversarial Attacks with Gradient Prediction

Generating adversarial examples at scale is a core primitive for robustness evaluation, adversarial training, and red-teaming, yet even "fast" attacks such as FGSM remain throughput-limited by the cost of a backward pass. We introduce a family of attacks that eliminates the backward pass by predicting the input gradient from forward-pass hidden states via a lightweight linear regression. Theoretically, we derive exact affine conditional gradient means, showing optimality in the (idealized) NTK regime. Empirically, our methods work when applied to practical finite-width models; we recover much of FGSM's attack performance while using only a small fraction of the time, corresponding to a

532\%

increase in throughput. These results suggest gradient prediction as a simple and general route to significantly faster adversarial generation under realistic wall-clock constraints.

Kamil Ciosek, Aleksandr V. Petrov, Nicolò Felicioni +1

Spotify

Adversarial Attacks Neural Network Robustness Adversarial Examples

May 13, 2026cs.NE

Dual-axis attribution of zebrafish tectal microcircuits for energy-efficient and robust neurocomputing

Biological neural circuits contain specialized substructures that support distinct computational functions, yet many bio-inspired neural networks borrow biological motifs without identifying their circuit-level origins. In this study, we investigate whether zebrafish tectal microcircuits can be attributed along two computational axes: energy-efficient information processing and robustness-preserving stabilization. We reconstruct a directed zebrafish-inspired retinotectal microcircuit graph and verify retinotectal signal propagation through dynamic simulation. A leaky integrate-and-fire spiking neural network is then used as a nonlinear perturbation testbed, where predefined subcircuits are selectively ablated and evaluated using the Energy Sensitivity Index and the Robustness Sensitivity Index.The results reveal a functional dissociation between two tectal subcircuits.The \textit{ns_TIN} subcircuit shows a low spike footprint but a measurable influence on prediction error, suggesting a role as a spike-efficient internal information gate.In contrast, the \textit{superficial_TIN} subcircuit produces the highest robustness sensitivity, suggesting a feedback-like role in maintaining system-level stability.We further transfer these attributed functions into ResNet18-based artificial neural networks and evaluate them on CIFAR-10 under inference-budget reduction and Gaussian noise corruption. The \textit{ns_TIN}-inspired module improves performance preservation under reduced computation, whereas the \textit{superficial_TIN}-inspired module improves robustness under input noise. These findings provide a subcircuit-level route for linking biological circuit organization with bio-inspired neural architecture design.

Ningping Li, Hao Zhang, Yi Zhou

University of Science and Technology of China, Hefei, China

Efficient Neural Network Inference Neural Processes Neural Network Robustness