mlsanityData to 7 Oct 2026

On the Adversarial Robustness of Learning-based Conformal Novelty Detection

arXiv 2510.00463 ↗First posted 1 Oct 2025stat.ML cs.LG eess.SPcited by 0

Not on the map. Why?

Abstract (arXiv)

This paper studies the adversarial robustness of conformal novelty detection. In particular, we focus on two powerful learning-based frameworks that come with finite-sample false discovery rate (FDR) control: one is AdaDetect (by Marandon et al., 2024) that is based on the positive-unlabeled classifier, and the other is a one-class classifier-based approach (by Bates et al., 2023). While they provide rigorous statistical guarantees under benign conditions, their behavior under adversarial perturbations remains underexplored. We first formulate an oracle attack setup, under the AdaDetect formulation, that quantifies the worst-case degradation of FDR, deriving an upper bound that characterizes the statistical cost of attacks. This idealized formulation directly motivates a practical and effective attack scheme that only requires query access to the output labels of both frameworks. Coupling these formulations with two popular and complementary black-box adversarial algorithms, we systematically evaluate the vulnerability of both frameworks on synthetic and real-world datasets. Our results show that adversarial perturbations can significantly increase the FDR while maintaining high detection power, exposing fundamental limitations of current error-controlled novelty detection methods and motivating the development of more robust alternatives.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 39 of its 58 references that are in the map. First posted on arXiv 1 Oct 2025.

Builds on

39 of 58 references.

References · 39

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  4. 2016Adversarial examples in the physical worldcited by 1,762
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  8. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
  9. 2016Universal adversarial perturbationscited by 774
  10. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  11. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  12. 2017One pixel attack for fooling deep neural networkscited by 579
27 more
  1. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  2. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  3. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  4. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 459
  5. 2019Deep Learning for Anomaly Detection: A Surveycited by 357
  6. 2019HopSkipJumpAttack: A Query-Efficient Decision-Based Attackcited by 328
  7. 2018Spatially Transformed Adversarial Examplescited by 195
  8. 2021Testing for Outliers with Conformal p-valuescited by 133
  9. 2019Sign-OPT: A Query-Efficient Hard-label Adversarial Attackcited by 118
  10. 2013One-Class Classification: Taxonomy of Study and Review of Techniquescited by 68
  11. 2017Adversarial Transformation Networks: Learning to Generate Adversarial Examplescited by 60
  12. 2020Real-time Out-of-distribution Detection in Learning-Enabled Cyber-Physical Systemscited by 46
  13. 2019Prediction and outlier detection in classification problemscited by 44
  14. 2021Adversarially Robust One-class Novelty Detectioncited by 24
  15. 2023BlackboxBench: A Comprehensive Benchmark of Black-box Adversarial Attackscited by 21
  16. 2022Integrative conformal p-values for powerful out-of-distribution testing with labeled outlierscited by 19
  17. 2023Attacks in Adversarial Machine Learning: A Systematic Survey from the Life-cycle Perspectivecited by 19
  18. 2023Derandomized Novelty Detection with FDR Control via Conformal E-valuescited by 15
  19. 2022Adaptive novelty detection with false discovery rate guaranteecited by 14
  20. 2017Conformal k-NN Anomaly Detector for Univariate Data Streamscited by 13
  21. 2021Online false discovery rate control for anomaly detection in time seriescited by 13
  22. 2021Semi-supervised multiple testingcited by 7
  23. 2025Beyond Vulnerabilities: A Survey of Adversarial Attacks as Both Threats and Defenses in Computer Vision Systemscited by 4
  24. 2021BONuS: Multiple multivariate testing with a data-adaptivetest statisticcited by 2
  25. 2022Sample-and-Forward: Communication-Efficient Control of the False Discovery Rate in Networkscited by 2
  26. 2025Distributed Multiple Testing with False Discovery Rate Control in the Presence of Byzantinescited by 2
  27. 2025On the Adversarial Robustness of Benjamini Hochbergcited by 1

Built on by

Not cited yet.