Research map / Adversarial robustness and security / Certified and empirical robustness

Adversarial Purification with the Manifold Hypothesis

AAAI 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Robustness-accuracy trade-off analysis · 7 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes a manifold-hypothesis-based adversarial purification framework that trains a VAE-classifier with ELBO plus classification loss and purifies inputs at test time by optimizing the ELBO under an l_inf budget.

Problem

Adversarial robustness for non-adversarially trained classifiers, especially against defense-aware adaptive attacks (multi-objective and BPDA), where existing purification methods degrade and lack theoretical grounding.

Approach

Provides sufficient conditions for robustness via manifold hypothesis and semantic consistency between the on-manifold classifier and decoder, then approximates the purifier with test-time ELBO optimization in a VAE-based classifier trained jointly with a classification head.

Key results

• On CIFAR-10 with ResNet-50, VAE-CLF with test-time ELBO purification raises BPDA robust accuracy to 57.15% and AutoAttack-l_inf accuracy to 63.16% (vs 0.04% without purification).
• On SVHN with a tiny ResNet, TTP (ELBO) reaches 72.72% PGD and 64.70% AdapA accuracy, competitive with adversarially trained models.
• Clean accuracy drops under purification (e.g., CIFAR-10 tiny ResNet 91.82% to 77.97%), a trade-off the authors acknowledge.

Measured effects reported in the paper

Surprising findings

• Standard-AE classifiers without semantic consistency are almost completely broken by attacks, while the VAE-classifier with ELBO purification retains substantial robustness even under BPDA.
• Clean accuracy drops notably after purification, which the authors attribute partly to the purifier not being Lipschitz-constrained.

Limitations

• Clean accuracy drops substantially after purification (e.g., ResNet-50 94.82% to 85.12%).
• Performance is limited on datasets with many classes such as CIFAR-100 due to sparse per-class density estimation.
• Test-time optimization is computationally expensive (about 102x inference time).

Experimental setup

Datasets: MNIST Fashion-MNIST SVHN CIFAR-10 CIFAR-100 CelebA

Benchmarks: MNIST Fashion-MNIST SVHN CIFAR-10 CIFAR-100 CelebA

Metrics: classification accuracy (clean) robust accuracy

Baselines: Standard-AE-Classifier PuVAE diffusion-based purification adversarial training methods

Builds on: variational autoencoder certified robustness BPDA PixelDefend Defense-GAN

Closest papers by meaning

• Enhancing the Adversarial Robustness via Manifold Projection (AAAI 2025 · similarity 0.90)
• Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.88)
• Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.87)
• Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.86)
• Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM (CVPR 2024 · similarity 0.86)
• Explaining the role of Intrinsic Dimensionality in Adversarial Training (ICML 2025 · similarity 0.86)