Research map / Adversarial robustness and security / Certified and empirical robustness

Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifiers

NeurIPS 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Robustness-accuracy trade-off analysis · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Introduces margin consistency between input-space margins and logit margins of robust classifiers, proves it is necessary and sufficient for logit-margin detection of non-robust samples, and learns a pseudo-margin from features for weakly consistent models.

Problem

Efficiently detecting per-instance vulnerability (non-robust samples) of adversarially robust deep classifiers without rerunning costly adversarial attacks, since the exact input-space margin is intractable to compute for deep networks.

Approach

Define margin consistency as a monotonic relationship between input-space margin and feature/logit margin; prove it is necessary and sufficient for a logit-margin threshold to perfectly separate non-robust from robust samples; when consistency is weak, learn a pseudo-margin MLP from penultimate features via pointwise regression on FAB-estimated input margins.

Key results

• Logit margin reaches Kendall tau up to 0.85 and AUROC up to 98.01 with input margins for most l_inf robust models on CIFAR100 (RA11), with a strong correlation of up to 0.86 reported.
• Weakly margin-consistent models DI0 (tau 0.28, AUROC 67.49) and XU80 (tau 0.43, AUROC 83.30) improve to tau 0.57 and 0.62 with the learned pseudo-margin.
• Using 500 random test samples with logit-margin thresholds, robust accuracy estimates are accurate for strongly margin-consistent models (mean absolute difference below about 2 points from 300 samples).

Measured effects reported in the paper

Surprising findings

• Margin consistency and detection quality are not tied to robust accuracy: the strength of the correlation does not depend on robust accuracy.
• The exact feature margin and the logit margin give nearly identical detection results, so the cheap logit margin approximation loses negligible performance.

Limitations

• Scope limited to l_p robustness measured by minimum-distortion input margin, not full local robustness neighborhoods.
• Input margin estimation depends on attack-based (FAB) estimation; may need combining with CW attack; neural collapse in terminal training phase may break margin consistency.
• Analysis done on the training distribution only; adaptive attacks and out-of-distribution inputs not studied.

Experimental setup

Datasets: CIFAR10 CIFAR100 ImageNet

Benchmarks: CIFAR10 CIFAR100 ImageNet

Metrics: Kendall tau AUROC AUPR FPR@95

Baselines: AutoAttack FAB

Builds on: FAB attack AutoAttack RobustBench TRADES neural collapse

Closest papers by meaning

• MMA Training: Direct Input Space Margin Maximization through Adversarial Training (ICLR 2020 · similarity 0.89)
• Mind Your Margin and Boundary: Are Your Distilled Datasets Truly Robust? (ICML 2026 · similarity 0.89)
• Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness (ICLR 2023 · similarity 0.88)
• Reducing Excessive Margin to Achieve a Better Accuracy vs. Robustness Trade-off (ICLR 2022 · similarity 0.88)
• Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.87)
• Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.86)