Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Key points

• Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations.1
• We take a detection-oriented approach instead: rather than certifying that predictions are invariant inside an $\ell2$ ball, we certify that adversarial inputs within an $\ell2$ ball are detected --- a guarantee aligned with security-critical deployments where missing an attack is costlier than flagging a clean input.1
• To realize this, we prove a Lipschitz-margin reduction from certified $\ell2$ robustness to certified detection, which reduces the problem to handling a single Lipschitz constant $L$.1
• We introduce two detector families: $\mathbb{D}{Adv}$, which estimates $L$ from a single defender-side perturbed pair, and $\mathbb{D}{lc}$, which augments that pair with a local margin centroid to keep the estimate above what the certificate requires.1

Sources (1)

• [1]Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification
  arXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 11, 05:33 AM

  Certified $\ell_2$ defenses today face a costly trade-off: randomized smoothing (RS) requires hundreds of noisy queries per input, while Lipschitz networks (LN) constrain the architecture and sacrifice clean accuracy.

  Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations.

Extractive summary: sentences quoted from the sources.