Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Robustness in Two-Stage Learning-to-Defer: Algorithms and Guarantees
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies adversarial robustness of two-stage Learning-to-Defer, proposes untargeted/targeted attacks on the rejector and SARD, a smooth convex adversarial deferral surrogate with Bayes- and (R,G)-consistency guarantees.
Problem
Two-stage Learning-to-Defer routers can be manipulated by adversarial input perturbations that misroute queries or overload experts, and existing L2D methods assume clean inputs.
Approach
Introduces untargeted and targeted attacks on the L2D rejector, and a smooth convex adversarial margin surrogate (cross-entropy family) for the adversarial deferral loss, shown to be Bayes- and (R,G)-consistent and optimized as regularized ERM (SARD).
Key results
- On CIFAR-100, SARD keeps 49.8% accuracy under untargeted attack vs 17.2% for the baseline (clean: 67.0% vs 72.8%).
- On California Housing, SARD holds RMSE 0.18 across attacks while the baseline rises to 0.29 (untargeted) and 0.41 (targeted at M3).
- On Pascal VOC, SARD achieves 39.0 mAP under untargeted attack vs 9.7 for the baseline (clean: 43.9 vs 44.4).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace the L2D baseline with SARD | Two-stage L2D with ResNet-4 · CIFAR-100 validation, clean | accuracy: 72.8\pm 0.4 -> 67.0\pm 0.4 | Hurt |
| replace the L2D baseline with SARD | Two-stage L2D with ResNet-4 · CIFAR-100 validation, untargeted attack | accuracy: 17.2\pm0.2 -> 49.8\pm0.3 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with ResNet-4 · CIFAR-100 validation, targeted attack M1 | accuracy: 54.4\pm 0.1 -> 62.4\pm0.3 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with ResNet-4 · CIFAR-100 validation, targeted attack M2 | accuracy: 45.4\pm 0.1 -> 62.1\pm0.2 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with ResNet-4 · CIFAR-100 validation, targeted attack M3 | accuracy: 13.4\pm 0.1 -> 64.8\pm0.3 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with MLP · California Housing, clean | RMSE: 0.17 \pm 0.01 -> 0.17\pm0.01 | No clear effect |
| replace the L2D baseline with SARD | Two-stage L2D with MLP · California Housing, untargeted attack | RMSE: 0.29\pm0.3 -> 0.17 \pm 0.01 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with MLP · California Housing, targeted attack M1 | RMSE: 0.40 \pm 0.02 -> 0.18 \pm 0.01 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with MLP · California Housing, targeted attack M2 | RMSE: 0.21 \pm 0.01 -> 0.18\pm 0.01 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with MLP · California Housing, targeted attack M3 | RMSE: 0.41\pm 0.05 -> 0.18 \pm 0.01 | Helped |
| replace the L2D baseline with SARD | Two-stage L2D with Faster R-CNN · Pascal VOC, clean | mAP: 44.4\pm0.4 -> 43.9\pm 0.4 | Hurt |
| replace the L2D baseline with SARD | Two-stage L2D with Faster R-CNN · Pascal VOC, untargeted attack | mAP: 9.7 \pm 0.1 -> 39.0\pm0.3 | Helped |
Surprising findings
- The baseline has higher clean accuracy than SARD in all three tasks, reflecting a robustness-clean accuracy trade-off.
Limitations
- Clean accuracy is lower than the non-robust baseline on all tasks.
- Epoch cost overhead scales linearly with number of experts and PGD steps.
- Consistency analysis requires assumptions such as symmetric and locally rho-consistent rejector class; the surrogate is not differentiable everywhere so classical classification-calibration theorem does not directly apply.
Experimental setup
Datasets: CIFAR-100 California Housing Pascal VOC
Benchmarks: CIFAR-100 California Housing Pascal VOC
Metrics: accuracy RMSE mAP
Baselines: two-stage L2D baseline (Narasimhan et al. style post-hoc deferral) two-stage L2D regression baseline two-stage L2D multi-task baseline
Builds on: two-stage learning-to-defer comp-sum loss family H-consistency bounds adversarial margin surrogate
Closest papers by meaning
- Adversarially Robust Decision Transformer (NeurIPS 2024 · similarity 0.87)
- Adversarial Training Should Be Cast as a Non-Zero-Sum Game (ICLR 2024 · similarity 0.87)
- Expressive Losses for Verified Robustness via Convex Combinations (ICLR 2024 · similarity 0.86)
- Beyond Worst-case Attacks: Robust RL with Adaptive Defense via Non-dominated Policies (ICLR 2024 · similarity 0.86)
- Rethinking the Adversarial Robustness of Multi-Exit Neural Networks in an Attack-Defense Game (CVPR 2025 · similarity 0.86)
- Rethinking Adversarial Policies: A Generalized Attack Formulation and Provable Defense in RL (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.