Research map / Adversarial robustness and security / Certified and empirical robustness

Adversarial Robustness via Deformable Convolution with Stochasticity

ICML 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Attack evaluation and defense critique

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Deformable Convolution with Stochasticity (DCS), which replaces DCN offsets with random masks to inject data-independent randomness into CNN structure, plus gradient-selective adversarial training (GSAT), for adversarial robustness on CIFAR-10/100 and ImageNet.

Problem

Random defenses against adversarial attacks inject additive noise into data, making performance sensitive to noise hyperparameters that do not generalize across datasets, and the robustness-natural accuracy trade-off is rarely analyzed.

Approach

Move randomness from the data input into the network structure: a deformable convolution whose offsets are replaced by randomly sampled masks, so the only randomness hyperparameter (receptive field n) has data-independent bounds derived from gradient cosine similarity and output inconsistency; AT then removes points on the attacked path (GSAT).

Key results

• On CIFAR-10 with ResNet18, DCS reaches 89.11% natural accuracy and 72.10% PGD20 / 73.41% AutoAttack robust accuracy versus 81.17% / 51.16% / 47.34% for standard convolution.
• On CIFAR-100 with WRN34, DCS reaches 66.69% natural and 48.05% PGD20 accuracy, improving over standard convolution by about 6.6 and 16.1 points.
• On ImageNet, DCS obtains 52.38% PGD and 66.79% AA robust accuracy, as reported in the comparison table against SOTA random defenses.

Measured effects reported in the paper

Surprising findings

• Canceling the points in the unselected set Xu at test time still leaves the best robustness above the baseline, with only a minor drop, suggesting the cosine-similarity analysis holds even when pu=0.
• Larger receptive field n made GSAT training less stable, and performance was non-monotonic in n on CIFAR-10 (best at n=2).

Limitations

• Robustness drops as perturbation strength grows, so the approach cannot reduce adversarial transferability to zero.
• Large kernel sizes (e.g., ViT's 16x16 patch embedding) raise the lower bound on n, so DCS needs decomposition into 3x3 convolutions to apply.
• Partial robustness against black-box attacks is attributed to gradient masking, which is hard to analyze theoretically.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 ImageNet

Benchmarks: CIFAR-10 CIFAR-100 ImageNet

Metrics: natural accuracy robust accuracy cosine similarity

Baselines: Overfit DWQ RobustWRN WRN+DCN+AT DiffAT Additive Noise Random AdvWRN DF MeanSparse Cert-RA LWTA SAF

Builds on: deformable convolution networks PGD adversarial training random defense

Closest papers by meaning

• Theoretical evidence for adversarial robustness through randomization (NeurIPS 2019 · similarity 0.93)
• Adversarial Robustness through Random Weight Sampling (NeurIPS 2023 · similarity 0.93)
• Barrage of Random Transforms for Adversarially Robust Defense (CVPR 2019 · similarity 0.91)
• On the Limitations of Stochastic Pre-processing Defenses (NeurIPS 2022 · similarity 0.90)
• Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.90)
• Treatment of Statistical Estimation Problems in Randomized Smoothing for Adversarial Robustness (NeurIPS 2024 · similarity 0.90)