mlsanityData to 14 Oct 2026

TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networks

arXiv 2508.12132 ↗First posted 16 Aug 2025cs.CV cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Quantized Neural Networks (QNNs) are increasingly deployed in edge and resource-constrained environments due to their efficiency in computation and memory usage. While shown to distort the gradient landscape and weaken conventional pixel-level attacks, it provides limited robustness against patch-based adversarial attacks-localized, high-saliency perturbations that remain surprisingly transferable across bit-widths. Existing defenses either overfit to fixed quantization settings or fail to address this cross-bit generalization vulnerability. We introduce TriQDef, a tri-level quantization-aware defense framework designed to disrupt the transferability of patch-based adversarial attacks across QNNs. TriQDef consists of: (1) a Feature Disalignment Penalty (FDP) that enforces semantic inconsistency by penalizing perceptual similarity in intermediate representations; (2) a Gradient Perceptual Dissonance Penalty (GPDP) that explicitly misaligns input gradients across bit-widths by minimizing structural and directional agreement via Edge IoU and HOG Cosine metrics; and (3) a Joint Quantization-Aware Training Protocol that unifies these penalties within a shared-weight training scheme across multiple quantization levels. Extensive experiments on CIFAR-10 and ImageNet demonstrate that TriQDef reduces Attack Success Rates (ASR) by over 40% on unseen patch and quantization combinations, while preserving high clean accuracy. Our findings underscore the importance of disrupting both semantic and perceptual gradient alignment to mitigate patch transferability in QNNs.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 29 of its 38 references that are in the map. First posted on arXiv 16 Aug 2025.

Builds on

29 of 38 references.

References · 29

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  3. 2021Swin Transformer: Hierarchical Vision Transformer using Shifted Windowscited by 12,139
  4. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  5. 2016Densely Connected Convolutional Networkscited by 6,720
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  7. 2015Rethinking the Inception Architecture for Computer Visioncited by 5,475
  8. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  9. 2020Understanding Contrastive Representation Learning through Alignment and Uniformity on the Hyperspherecited by 1,405
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
  12. 2017Generalised Dice overlap as a deep learning loss function for highly unbalanced segmentationscited by 620
17 more
  1. 2018A Benchmark for Interpretability Methods in Deep Neural Networkscited by 476
  2. 2022Diffusion Models for Adversarial Purificationcited by 476
  3. 2019Deep Ensembles: A Loss Landscape Perspectivecited by 443
  4. 2017The Space of Transferable Adversarial Examplescited by 158
  5. 2019Additive Powers-of-Two Quantization: An Efficient Non-uniform Discretization for Neural Networkscited by 148
  6. 2018LaVAN: Localized and Visible Adversarial Noisecited by 113
  7. 2020PatchAttack: A Black-box Texture-based Attack with Reinforcement Learningcited by 67
  8. 2020Adversarial Training against Location-Optimized Adversarial Patchescited by 50
  9. 2015A Unified Gradient Regularization Family for Adversarial Examplescited by 43
  10. 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
  11. 2020EMPIR: Ensembles of Mixed Precision Deep Networks for Increased Robustness against Adversarial Attackscited by 28
  12. 2023RobustMQ: Benchmarking Robustness of Quantized Modelscited by 19
  13. 2023A Survey on Approximate Edge AI for Energy Efficient Autonomous Driving Servicescited by 14
  14. 2023Quantization Aware Attack: Enhancing Transferable Adversarial Attacks by Model Quantizationcited by 14
  15. 2020Improving Adversarial Robustness in Weight-quantized Neural Networkscited by 11
  16. 2024Investigating the Impact of Quantization on Adversarial Robustnesscited by 9
  17. 2015HOG based Fast Human Detectioncited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Breaking the Limits of Quantization-Aware Defenses: QADT-R for Robustness Against Patch-Based Adversarial Attacks in QNNs
  2. 2021A Layer-wise Adversarial-aware Quantization Optimization for Improving Robustness
  3. 2021Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes
  4. 2024David and Goliath: An Empirical Evaluation of Attacks and Defenses for QNNs at the Deep Edge
  5. 2025Q-MLLM: Vector Quantization for Robust Multimodal Large Language Model Security
  6. 2022ODG-Q: Robust Quantization via Online Domain Generalization
  7. 2026RAMP: Robust Adaptive Mixed-Precision Quantization for Edge CPU Vision Models
  8. 2023Improving the Robustness of Quantized Deep Neural Networks to White-Box Attacks using Stochastic Quantization and Information-Theoretic Ensemble Training