Research map / Adversarial robustness and security / Attacks on text and graphs
Disentangling Safe and Unsafe Image Corruptions via Anisotropy and Locality
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Projected Displacement (PD), an anisotropic, local threat model that measures perturbation threat by alignment with data-derived unsafe directions, separating safe common corruptions from label-changing ones on ImageNet.
Problem
Standard isotropic, global threat models such as l_p norms cannot distinguish safe common corruptions (blur, noise, compression, occlusion) that preserve the label from unsafe perturbations that change it, making robustness specifications misspecified.
Approach
Define threat as the maximal scaled projection of a perturbation onto unsafe directions, where unsafe directions are estimated locally per input from training samples of other classes (via k-center representatives); the resulting sublevel sets are convex and enable projected attacks, and can be extended with segmentation masks and class-hierarchy weights.
Key results
- PD threat assigns low threat to safe corruptions (blur, noise) with high l_inf norm, placing them in quadrant I, while unsafe corruptions get high PD threat.
- Under the (d_inf AND PD, 16/255) threat model, robust accuracy of RobustBench models improves over l_inf alone, e.g. ConvNeXt-L from 0.25 to 0.32 and XCiT-L12 from 0.04 to 0.17.
- PD threat is competitive with DreamSim for distinguishing safe and unsafe corruptions while not requiring pretrained large vision models or finetuning.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Evaluate with the PD threat instead of the d∞ threat | ImageNet-1k benchmark classifiers · ImageNet-1k classification, ε = 16/255 | robust accuracy: 0.25 -> 0.32; 0.12 -> 0.21; 0.1 -> 0.19; 0.09 -> 0.19; 0.05 -> 0.13; 0.04 -> 0.17 | Helped |
| Use segmentation-aware PD-S threat instead of PD threat | ImageNet-1k benchmark classifiers · ImageNet-1k classification, ε = 16/255 | robust accuracy: 0.32 -> 0.31; 0.21 -> 0.20; 0.19 -> 0.18; 0.19 -> 0.19; 0.13 -> 0.12; 0.17 -> 0.18 | No clear effect |
| Use concept-aware PD-W threat instead of PD threat | ImageNet-1k benchmark classifiers · ImageNet-1k classification, ε = 16/255 | robust accuracy: 0.32 -> 0.31; 0.21 -> 0.21; 0.19 -> 0.18; 0.19 -> 0.19; 0.13 -> 0.12; 0.17 -> 0.18 | No clear effect |
Surprising findings
- Robust accuracies under PD, PD-S and PD-W are nearly indistinguishable, suggesting models fail to separate distant classes and that attacks align with foreground masks.
Limitations
- Binary quadrant thresholds for safe/unsafe classification are coarse.
- Unsafe directions are approximated from a subset of training data (k=50 representatives) with heuristic normalization (beta=1/2).
Experimental setup
Datasets: ImageNet-1k ImageNet-C Imagenet-bar-C
Benchmarks: ImageNet-1k ImageNet-C Imagenet-bar-C RobustBench
Metrics: average threat robust accuracy
Baselines: l_inf threat model l_2 threat model DreamSim perceptual threat
Builds on: AutoAttack DreamSim ImageNet-C Imagenet-bar-C SAM
Closest papers by meaning
- Improving robustness against common corruptions by covariate shift adaptation (NeurIPS 2020 · similarity 0.85)
- Suppress and Diversify: Refining Robust Pathways for Corruption Robustness (ICML 2026 · similarity 0.85)
- Perceptual Adversarial Robustness: Defense Against Unseen Threat Models (ICLR 2021 · similarity 0.84)
- Learning perturbation sets for robust machine learning (ICLR 2021 · similarity 0.84)
- Rethinking Robustness of Model Attributions (AAAI 2024 · similarity 0.83)
- FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models (NeurIPS 2026 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.