Research map / Adversarial robustness and security / Certified and empirical robustness
Verifiably Robust Conformal Prediction
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes VRCP, a conformal prediction framework that uses neural network verification bounds (CROWN, α-CROWN) to produce prediction sets with coverage guarantees under arbitrary ℓp adversarial perturbations for classification and regression.
Problem
Conformal prediction coverage guarantees fail under adversarial perturbations of test inputs; prior robust CP methods rely on randomised smoothing, which is limited to ℓ2 norms and classification and yields overly conservative sets.
Approach
Use neural network verifier output bounds to either lower-bound test scores at inference (VRCP-I) or upper-bound calibration scores (VRCP-C), inflating CP sets to recover marginal coverage for any ℓp-bounded perturbation, without smoothing, holdout sets, or score transformations.
Key results
- On CIFAR10 with l2 eps=0.03, VRCP-I achieves 0.986 coverage with average set size 4.451 versus RSCP+ (PTT) at 0.983 coverage and 8.357 size, and RSCP+ at size 10.000.
- On CIFAR100 (eps=0.02), VRCP-I reaches 0.971 coverage with set size 22.530 versus RSCP+ (PTT) 0.925 coverage and 26.375 size.
- On MPE regression at eps=0.02 l-inf, VRCP-I maintains coverage of 0.951 (adversary) while vanilla CP fails, with vanilla coverage 0.834 at that perturbation.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use VRCP-I instead of RSCP+ (PTT) | CIFAR10 under ℓ2 ε=0.03 · CIFAR10 | average set size: 8.357±0.780 -> 4.451±0.011 | Helped |
| Use VRCP-I instead of RSCP+ (PTT) | CIFAR100 under ℓ2 ε=0.02 · CIFAR100 | average set size: 26.375±9.675 -> 22.530±0.107 | Helped |
| Use VRCP-I instead of RSCP+ (PTT) | TinyImageNet under ℓ2 ε=0.02 · TinyImageNet | average set size: 90.644±20.063 -> 72.486±0.311 | Helped |
| Use VRCP-I instead of VRCP-C | classification benchmarks · CIFAR10, CIFAR100, TinyImageNet | average set size | Helped |
| Use RSCP+ instead of VRCP-I | classification benchmarks · CIFAR10, CIFAR100, TinyImageNet | average set size: 10.000±0.000 vs 4.451±0.011; 100.000±0.000 vs 22.530±0.107; 200.000±0.000 vs 72.486±0.311 | Hurt |
| Add PTT to RSCP+ | RSCP+ · CIFAR10, CIFAR100, TinyImageNet | average set size: 10.000±0.000 -> 8.357±0.780; 100.000±0.000 -> 26.375±9.675; 200.000±0.000 -> 90.644±20.063 | Mixed |
| Use VRCP-I instead of vanilla CP | regression models · Adversary, Spread, Push (ℓ∞ ε=0.02) | coverage: 0.834±0.007 -> 0.951±0.003; 0.834±0.005 -> 0.958±0.003; 0.875±0.007 -> 0.934±0.005 | Helped |
| Use VRCP-C instead of vanilla CP | regression models · Adversary, Spread, Push (ℓ∞ ε=0.02) | coverage: 0.834±0.007 -> 0.923±0.005; 0.834±0.005 -> 0.935±0.004; 0.875±0.007 -> 0.910±0.005 | Helped |
Surprising findings
- Vanilla CP coverage drops below nominal under adversarial attack, and RSCP+ produces trivial sets (size equal to number of classes) in all classification settings.
Limitations
- Scalability depends on the underlying neural network verifier; evaluated only on small to medium networks.
- Incomplete verifiers such as CROWN may give loose bounds for large networks.
- Guarantees are marginal coverage; VRCP-C requires recalibration if epsilon changes.
Experimental setup
Datasets: CIFAR10 CIFAR100 TinyImageNet PettingZoo MPE (adversary, spread, push)
Benchmarks: CIFAR10 CIFAR100 TinyImageNet PettingZoo MPE adversary PettingZoo MPE spread PettingZoo MPE push
Metrics: marginal coverage average prediction set size average interval length
Baselines: Vanilla CP RSCP+ RSCP+ (PTT)
Builds on: conformal prediction randomised smoothing RSCP+ conformalized quantile regression CROWN
Closest papers by meaning
- Provably Robust Conformal Prediction with Improved Efficiency (ICLR 2024 · similarity 0.93)
- Robust Yet Efficient Conformal Prediction Sets (ICML 2024 · similarity 0.92)
- Robust Conformal Prediction with a Single Binary Certificate (ICLR 2025 · similarity 0.92)
- Efficient Robust Conformal Prediction via Lipschitz-Bounded Networks (ICML 2025 · similarity 0.90)
- One Sample is Enough to Make Conformal Prediction Robust (NeurIPS 2025 · similarity 0.90)
- Reliable Uncertainty Quantification in Machine Learning via Conformal Prediction (AAAI 2025 · similarity 0.90)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.