# Manifold Regularization for Locally Stable Deep Neural Networks

arXiv: https://arxiv.org/abs/2003.04286 · HTML: https://mlsanity.com/paper/2003.04286/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 9 Mar 2020.

## Built on by (most cited first, 8 of 8)

- [Model-Based Domain Generalization](https://mlsanity.com/paper/2102.11436/) (2021)
- [Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack](https://mlsanity.com/paper/2203.05154/) (2022)
- [Exploring Misclassifications of Robust Neural Networks to Enhance Adversarial Attacks](https://mlsanity.com/paper/2105.10304/) (2021)
- [Deep Repulsive Prototypes for Adversarial Robustness](https://mlsanity.com/paper/2105.12427/) (2021)
- [IRAD: Implicit Representation-driven Image Resampling against Adversarial Attacks](https://mlsanity.com/paper/2310.11890/) (2023)
- [CE-based white-box adversarial attacks will not work using super-fitting](https://mlsanity.com/paper/2205.02741/) (2022)
- [Rethinking Classifier and Adversarial Attack](https://mlsanity.com/paper/2205.02743/) (2022)
- [A Multi-objective Memetic Algorithm for Auto Adversarial Attack Optimization Design](https://mlsanity.com/paper/2208.06984/) (2022)

## Abstract (arXiv)

We apply concepts from manifold regularization to develop new regularization techniques for training locally stable deep neural networks. Our regularizers are based on a sparsification of the graph Laplacian which holds with high probability when the data is sparse in high dimensions, as is common in deep learning. Empirically, our networks exhibit stability in a diverse set of perturbation models, including ℓ2, ℓ_∞, and Wasserstein-based perturbations; in particular, we achieve 40% adversarial accuracy on CIFAR-10 against an adaptive PGD attack using ℓ_∞ perturbations of size ε = 8/255, and state-of-the-art verified accuracy of 21% in the same perturbation model. Furthermore, our techniques are efficient, incurring overhead on par with two additional parallel forward passes through the network.