# Adversarial Robustness Guarantees for Classification with Gaussian Processes

arXiv: https://arxiv.org/abs/1905.11876 · HTML: https://mlsanity.com/paper/1905.11876/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 May 2019.

## Built on by (most cited first, 11 of 11)

- [Recipes for when Physics Fails: Recovering Robust Learning of Physics Informed Neural Networks](https://mlsanity.com/paper/2110.13330/) (2021)
- [Evolution of Neural Tangent Kernels under Benign and Adversarial Training](https://mlsanity.com/paper/2210.12030/) (2022)
- [Certification of Iterative Predictions in Bayesian Neural Networks](https://mlsanity.com/paper/2105.10134/) (2021)
- [Adversarial Robustness Guarantees for Gaussian Processes](https://mlsanity.com/paper/2104.03180/) (2021)
- [Formal Verification of Unknown Dynamical Systems via Gaussian Process Regression](https://mlsanity.com/paper/2201.00655/) (2021)
- [Probabilistic Reach-Avoid for Bayesian Neural Networks](https://mlsanity.com/paper/2310.01951/) (2023)
- [Explanatory Pluralism in Explainable AI](https://mlsanity.com/paper/2106.13976/) (2021)
- [The Effect of Prior Lipschitz Continuity on the Adversarial Robustness of Bayesian Neural Networks](https://mlsanity.com/paper/2101.02689/) (2021)
- [Fast Falsification of Neural Networks using Property Directed Testing](https://mlsanity.com/paper/2104.12418/) (2021)
- [Robustness bounds on the successful adversarial examples in probabilistic models: Implications from Gaussian processes](https://mlsanity.com/paper/2403.01896/) (2024)
- [Simplex-to-Euclidean Bijection for Conjugate and Calibrated Multiclass Gaussian Process Classification](https://mlsanity.com/paper/2603.16621/) (2026)

## Abstract (arXiv)

We investigate adversarial robustness of Gaussian Process Classification (GPC) models. Given a compact subset of the input space Tsubseteq ℝd enclosing a test point x^* and a GPC trained on a dataset D, we aim to compute the minimum and the maximum classification probability for the GPC over all the points in T. In order to do so, we show how functions lower- and upper-bounding the GPC output in T can be derived, and implement those in a branch and bound optimisation algorithm. For any error threshold ε > 0 selected a priori, we show that our algorithm is guaranteed to reach values ε-close to the actual values in finitely many iterations. We apply our method to investigate the robustness of GPC models on a 2D synthetic dataset, the SPAM dataset and a subset of the MNIST dataset, providing comparisons of different GPC training techniques, and show how our method can be used for interpretability analysis. Our empirical analysis suggests that GPC robustness increases with more accurate posterior estimation.