Certified vs. Empirical Adversarial Robust-ness via Hybrid Convolutions with Attention Stochasticity
Not on the map. Why?
Abstract (arXiv)
We introduce Hybrid Convolutions with Attention Stochasticity (HyCAS), an adversarial defense that narrows the long-standing gap between provable robustness under L2 certificates and empirical robustness against strong L attacks, while preserving strong generalization across diverse imaging benchmarks. HyCAS unifies deterministic and randomized principles by coupling 1-Lipschitz, spectrally normalized convolutions with two stochastic components, spectral normalized random, projection filters and a randomized attention-noise mechanism, to realize a randomized defense. Injecting smoothing randomness inside the architecture yields an overall <= 2-Lipschitz network with formal certificates. Exten-sive experiments on diverse imaging benchmarks, including CIFAR-10/100, ImageNet-1k, NIH Chest X-ray, HAM10000, show that HyCAS surpasses prior leading certified and empirical defenses, boosting certified accuracy by up to 7.3% (on NIH Chest X-ray) and empirical robustness by up to 3.1% (on HAM10000), without sacrificing clean accuracy. These results show that a randomized Lipschitz constrained architecture can simultaneously improve both certified L2 and empirical L adversarial robustness, thereby supporting safer deployment of deep models in high-stakes applications. Code: https://github.com/misti1203/HyCAS
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Builds on 46 of its 58 references that are in the map. First posted on arXiv 2 May 2026.
Builds on
46 of 58 references.
References · 46
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2014Deep Learning Face Attributes in the Wildcited by 3,679
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2018Spectral Normalization for Generative Adversarial Networkscited by 1,618
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Natural Adversarial Examplescited by 1,401
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
- 2017ChestX-ray8: Hospital-scale Chest X-ray Database and Benchmarks on Weakly-Supervised Classification and Localization of Common Thorax Diseasescited by 969
- 2019Adversarial Training for Free!cited by 638
34 more
- 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
- 2020On Adaptive Attacks to Adversarial Example Defensescited by 547
- 2020Overfitting in adversarially robust deep learningcited by 504
- 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
- 2019Provably Robust Deep Learning via Adversarially Trained Smoothed Classifierscited by 328
- 2018Regularisation of Neural Networks by Enforcing Lipschitz Continuitycited by 311
- 2018Certified Defenses against Adversarial Examplescited by 305
- 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
- 2022(Certified!!) Adversarial Robustness for Free!cited by 130
- 2018Parametric Noise Injection: Trainable Randomness to Improve Deep Neural Network Robustness against Adversarial Attackcited by 123
- 2021Invisible for both Camera and LiDAR: Security of Multi-Sensor Fusion based Perception in Autonomous Driving Under Physical-World Attackscited by 101
- 2018The Singular Values of Convolutional Layerscited by 95
- 2020Consistency Regularization for Certified Robustness of Smoothed Classifierscited by 73
- 2022Evaluating the Adversarial Robustness of Adaptive Test-time Defensescited by 64
- 2023A Unified Algebraic Perspective on Lipschitz Neural Networkscited by 58
- 2021Meta Gradient Adversarial Attackcited by 55
- 2021AdvDrop: Adversarial Attack to DNNs by Dropping Informationcited by 55
- 2021PointGuard: Provably Robust 3D Point Cloud Classificationcited by 49
- 2021On the Certified Robustness for Ensemble Models and Beyondcited by 40
- 2020Data-Dependent Randomized Smoothingcited by 37
- 2022LOT: Layer-wise Orthogonal Training on Improving ℓ2 Certified Robustnesscited by 32
- 2023Making Substitute Models More Bayesian Can Enhance Transferability of Adversarial Examplescited by 32
- 2020Learn2Perturb: an End-to-end Feature Perturbation Learning to Improve Adversarial Robustnesscited by 27
- 2021Combating Adversaries with Anti-Adversariescited by 27
- 2021Intriguing Properties of Input-dependent Randomized Smoothingcited by 24
- 2022GSmooth: Certified Robustness against Semantic Transformations via Generalized Randomized Smoothingcited by 23
- 2023Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attackscited by 17
- 2024Mitigating the Curse of Dimensionality for Certified Robustness via Dual Randomized Smoothingcited by 15
- 2023Incremental Randomized Smoothing Certificationcited by 12
- 2023Certified Robust Neural Networks: Generalization and Corruption Resistancecited by 11
- 2022UniCR: Universally Approximated Certified Robustness via Randomized Smoothingcited by 10
- 2024Adaptive Randomized Smoothing: Certified Adversarial Robustness for Multi-Step Defencescited by 9
- 2022Toward Robust Diagnosis: A Contour Attention Preserving Adversarial Defense for COVID-19 Detectioncited by 3
- 2026Effective and Robust Multimodal Medical Image Analysiscited by 2
Built on by
Citing papers per year: 2026: 1.
1 paper.