Research map / Adversarial robustness and security / Certified and empirical robustness
Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes lip-rcp, which uses 1-Lipschitz networks to compute fast, tight conservative/restrictive conformal scores for robust CP sets and for auditing vanilla CP coverage under attack, with valid bounds across all attack budgets.
Problem
Robust conformal prediction sets under adversarial perturbations are either too large or too computationally expensive (randomized smoothing, formal verification) to scale to large datasets like ImageNet; vanilla CP coverage under attack is also unbounded.
Approach
Use the global Lipschitz constant of Lipschitz-by-design networks (1-Lipschitz feature extractor plus 1-Lipschitz head) and a sigmoid-based LAC score to get closed-form lower/upper bounds on conformal scores under l2 attacks, giving constant-time robust calibration and inference; also derive simultaneous-over-epsilon coverage bounds for vanilla CP under attack via a held-out evaluation set.
Key results
- On ImageNet at epsilon=0.02, alpha=0.1, lip-rcp gives mean robust set size 111.0 with 97.4% coverage and 0.012 s per sample versus CAS's 1000.0 size and 7.92 s per sample.
- lip-rcp outperforms existing robust CP approaches (RSCP, RSCP+, CAS, VRCP) on CIFAR-10, CIFAR-100 and Tiny ImageNet in set size at near 1-alpha coverage.
- Lipschitz-based coverage bounds for vanilla CP under attack are less pessimistic than CROWN-based bounds on CIFAR-10 and are computed for ImageNet.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use lip-rcp instead of CAS | Robust conformal prediction on ImageNet · ImageNet, ε=0.02, α=0.1 | set size: 1000.0 -> 111.0 | Helped |
| Use lip-rcp instead of CAS | Robust conformal prediction on ImageNet · ImageNet, ε=0.02, α=0.1 | coverage (%): 100.0 -> 97.4 | Hurt |
| Use lip-rcp instead of CAS | Robust conformal prediction on ImageNet · ImageNet, ε=0.02, α=0.1 | time per sample (s): 7.920 -> 0.012 | Helped |
Surprising findings
- The paper argues that a previously published lower bound on vanilla CP coverage under attack (Theorem 2 of a prior work) has a mathematical flaw related to overfitting to the calibration set.
Limitations
- Guarantees only for l2 perturbations; does not generalize to l1 or l-infinity norms.
- Restricted to Lipschitz-by-design architectures, so not fully model-agnostic; tight Lipschitz estimation for generic networks is missing.
- Evaluated only on image classification; extension to regression and larger epsilon is left open.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny ImageNet ImageNet
Benchmarks: CIFAR-10 CIFAR-100 Tiny ImageNet ImageNet
Metrics: robust CP set size empirical coverage runtime per sample worst-case coverage bounds
Baselines: RSCP RSCP+ (PTT) CAS VRCP-I VRCP-C CROWN
Builds on: VRCP RSCP CAS Lipschitz-by-design networks (Anil et al. / Prach & Lampert style 1-Lipschitz la
Closest papers by meaning
- Robust Yet Efficient Conformal Prediction Sets (ICML 2024 · similarity 0.91)
- A Recipe for Improved Certifiable Robustness (ICLR 2024 · similarity 0.91)
- Verifiably Robust Conformal Prediction (NeurIPS 2024 · similarity 0.90)
- Robust Conformal Prediction with a Single Binary Certificate (ICLR 2025 · similarity 0.90)
- Provably Robust Conformal Prediction with Improved Efficiency (ICLR 2024 · similarity 0.90)
- ECLipsE: Efficient Compositional Lipschitz Constant Estimation for Deep Neural Networks (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.