Skip to content
Original

Adversarial Detection for Pretrained Classifiers via Lipschitz Boundary Analysis and Certification

Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

arXiv: Adversarial Attacks, Backdoors & Poisoning· arXiv:2610.15359· Rui Zhang, Youwen Zhu, Xinle Cao, Huazhen Yu, Jian LiuNanjing University of Aeronautics and Astronautics; The State Key Laboratory of Blockchain and Data Security, Zhejiang University; Nanjing University of Information Science and TechnologyIndexed by this site · 29 days ago· Originally publishedDefenses

Translation in progress — untranslated text is omitted.

Quick read

Defenses

Based on the paper PDF (AI-generated); refer to the original

AI summaryAn arXiv paper proposes an adversarial detection method based on Lipschitz boundary analysis, reducing ℓ2 certified robustness to certifiable detection, deployable on any pretrained classifier without retraining. On CIFAR-10 with a 1-Lipschitz SortNet, the method achieves 100% certified detection rate with the lowest FPR; on standard CIFAR-10 VGG16, it rejects all evaluated in-budget adversarial examples, with 62-82% also rejected and certified.

Questions
Safety-critical visual classifiers can be flipped by small ℓ2 adversarial perturbations. The authors state that RS requires many queries, and Lipschitz networks require architecture changes and lose clean accuracy. The goal is to keep the pretrained classifier unchanged and certify that adversarial inputs within budget are rejected.
Methods
The authors use Lipschitz continuity to relate the adversarial margin upper bound to the clean margin and perturbation budget, reducing certified ℓ2 robustness to certified detection. When a global L is unavailable, DAdv estimates a local constant using defender-side perturbations, and Dlc additionally incorporates the local centroid of the margin function.
Experiments and results
ViT-B/16 at ε=0.1: Dlc TPR 100%, FPR 3.6% (Table IVb). SortNet on Lemma IV.1: TPR 100% (Table I). ResNet-50: Dlc cert% 63.8% at ε=0.1 (Table IV).
Limitations and future work
The authors leave tightening the ℓ∞ certificate and extending to detection, segmentation, and multimodality for future work. FPR is constrained by the clean margin distribution and radius ε. Experiments include MNIST, CIFAR-10, ImageNet-1k (Table IV uses 500 images). The paper does not report human evaluation.

Related events and news

1 events · 0 news mentions

Related papers

Both use: ImageNet-1k
Show 3 more papers
Both use: ImageNet-1k
Read originalarxiv.org