mlsanityData to 7 Oct 2026

Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifiers

arXiv 2406.18451 ↗First posted 26 Jun 2024cs.LG cs.AI cs.CVcited by 10

Not on the map. Why?

Abstract (arXiv)

Despite extensive research on adversarial training strategies to improve robustness, the decisions of even the most robust deep learning models can still be quite sensitive to imperceptible perturbations, creating serious risks when deploying them for high-stakes real-world applications. While detecting such cases may be critical, evaluating a model's vulnerability at a per-instance level using adversarial attacks is computationally too intensive and unsuitable for real-time deployment scenarios. The input space margin is the exact score to detect non-robust samples and is intractable for deep neural networks. This paper introduces the concept of margin consistency -- a property that links the input space margins and the logit margins in robust models -- for efficient detection of vulnerable samples. First, we establish that margin consistency is a necessary and sufficient condition to use a model's logit margin as a score for identifying non-robust samples. Next, through comprehensive empirical analysis of various robustly trained models on CIFAR10 and CIFAR100 datasets, we show that they indicate high margin consistency with a strong correlation between their input space margins and the logit margins. Then, we show that we can effectively and confidently use the logit margin to detect brittle decisions with such models. Finally, we address cases where the model is not sufficiently margin-consistent by learning a pseudo-margin from the feature representation. Our findings highlight the potential of leveraging deep representations to assess adversarial vulnerability in deployment scenarios efficiently.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Builds on 65 of its 83 references that are in the map. First posted on arXiv 26 Jun 2024.

Builds on

65 of 83 references.

References · 65

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  7. 2016A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networkscited by 2,362
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2017Selective Classification for Deep Neural Networkscited by 799
  12. 2021Generalized Out-of-Distribution Detection: A Surveycited by 796
38 more
  1. 2017Reluplex: An Efficient SMT Solver for Verifying Deep Neural Networkscited by 739
  2. 2020Prevalence of Neural Collapse during the terminal phase of deep learning trainingcited by 713
  3. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  4. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  5. 2017Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methodscited by 542
  6. 2020Overfitting in adversarially robust deep learningcited by 504
  7. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  8. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  9. 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
  10. 2018Lipschitz regularity of deep neural networks: analysis and efficient estimationcited by 413
  11. 2019Using Pre-Training Can Improve Model Robustness and Uncertaintycited by 373
  12. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  13. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 288
  14. 2016Safety Verification of Deep Neural Networkscited by 262
  15. 2018Adversarial Logit Pairingcited by 224
  16. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
  17. 2018To Trust Or Not To Trust A Classifiercited by 205
  18. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  19. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  20. 2019Addressing Failure Prediction by Learning Model Confidencecited by 183
  21. 2020Fast and Complete: Enabling Complete Neural Network Verification with Rapid and Massively Parallel Incomplete Verifierscited by 183
  22. 2018Evaluating the Robustness of Neural Networks: An Extreme Value Theory Approachcited by 181
  23. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  24. 2017An approach to reachability analysis for feed-forward ReLU neural networkscited by 126
  25. 2019A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networkscited by 124
  26. 2021Robust Learning Meets Generative Models: Can Proxy Distributions Improve Adversarial Robustness?cited by 113
  27. 2018Large Margin Deep Networks for Classificationcited by 110
  28. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  29. 2020Exactly Computing the Local Lipschitz Constant of ReLU Networkscited by 102
  30. 2017Maximum Resilience of Artificial Neural Networkscited by 97
  31. 2016Measuring Neural Net Robustness with Constraintscited by 90
  32. 2019Preventing Gradient Attenuation in Lipschitz Constrained Convolutional Networkscited by 86
  33. 2018Adversarial vulnerability for any classifiercited by 78
  34. 2022A Light Recipe to Train Robust Vision Transformerscited by 64
  35. 2023First Three Years of the International Verification of Neural Networks Competition (VNN-COMP)cited by 58
  36. 2023A Unified Algebraic Perspective on Lipschitz Neural Networkscited by 58
  37. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  38. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57

50 most cited of 65 All 65 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 3; 2026: 7.

10 papers.

  1. 2025CytoNet: A Foundation Model for the Human Cerebral Cortex at Cellular Resolutioncited by 2
  2. 2025A Validation Strategy for Deep Learning Models: Evaluating and Enhancing Robustnesscited by 1
  3. 2026Robust Continual Unlearning against Knowledge Erosion and Forgetting Reversalcited by 1
  4. 2025Robust Fine-Tuning from Non-Robust Pretrained Models: Mitigating Suboptimal Transfer With Epsilon-Schedulingcited by 0
  5. 2026Uncovering and Understanding FPR Manipulation Attack in Industrial IoT Networkscited by 0
  6. 2026Margin-Consistent Deep Subtyping of Invasive Lung Adenocarcinoma via Perturbation Fidelity in Whole-Slide Image Analysiscited by 0
  7. 2026FLaG: Fine-Grained Latent Grouping for Hallucination Detectioncited by 0
  8. 2026Revisiting Prototype Rehearsal for Exemplar-Free Continual Learning: Manifold-Aware Boundary Sampling with Adaptive Class-Balanced Losscited by 0
  9. 2026Upper Bounds on the Generalization Error of Deep Learning Models via Local Robustness and Stabilitycited by 0
  10. 2026Margin-Drop Coordinates for Cross-Budget Robustness Evaluationcited by 0