Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

arXiv:2610.15359v1 Announce Type: new Abstract: Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations. Certified ell_2 defenses today face a costly trade-off: randomized smoothing (RS) requires hundreds of noisy queries per input, while Lipschitz networks (LN) constrain the architecture and sacrifice clean accuracy. We take a detection-oriented approach instead: rather than certifying that predictions are invariant inside an ell_2 ball, we certify that adversarial inputs within an ell_2 ball are detected --- a guarantee aligned with security-critical deployments where missing an attack is costlier than flagging a clean input. To realize this, we prove a Lipschitz-margin reduction from certified ell_2 robustness to certified detection, which reduces the problem to handling a single Lipschitz constant L. We introduce two detector families: D_{Adv}, which estimates L from a single defender-side perturbed pair, and D_{lc}, which augments that pair with a local margin centroid to keep the estimate above what the certificate requires. Both deploy on any pretrained classifier without retraining. With a valid global bound, the detector is fully certified at that radius; with a local estimate L', certification is sample-wise and applies only when our certified condition holds. Across MNIST, CIFAR-10, and ImageNet-1k on four backbones (LeNet-5, VGG16, ResNet-50, ViT-B/16), our detectors match or outperform five baselines (CTT, SortNet, CRM, ContraNet, A^2D). For CIFAR-10 with 1-Lipschitz SortNet, our reduction delivers 100% certified detection at the lowest FPR among compared certified detectors; on the standard CIFAR-10 VGG16, our detectors reject all evaluated in-budget adversarial examples, with 62-82% both rejected and formally certified.

Source: arXiv cs.LG | 2026-10-14

Related