Research map / Adversarial robustness and security / Certified and empirical robustness
Understanding and Improving Adversarial Robustness of Neural Probabilistic Circuits
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Analyzes adversarial robustness of Neural Probabilistic Circuits (NPCs) and proposes RNPC, which uses class-wise neighborhood integration at inference to achieve provably and empirically higher robustness to attribute-level adversarial attacks while keeping benign accuracy.
Problem
Attribute recognition networks in concept bottleneck models such as Neural Probabilistic Circuits (NPCs) are vulnerable to adversarial perturbations, which can corrupt attribute predictions and downstream class predictions.
Approach
Show NPC robustness depends only on the attribute recognition model, then replace node-wise integration with class-wise integration that sums attribute probability over each class's neighborhood (Hamming radius r) times the class's conditional contribution, so that attribute shifts within a class neighborhood barely change predictions.
Key results
- On MNIST-Add5 at infinity-norm bound 0.11, NPC adversarial accuracy drops below 40% while RNPC maintains above 80% when attacking a single attribute.
- Benign accuracy of RNPC is comparable to NPC across four datasets (e.g., 99.37% vs 99.32% on MNIST-Add3, 99.95% on CelebA-Syn).
- RNPC achieves up to 45% higher adversarial accuracy than the best baseline on MNIST-Add3 when one attribute is attacked.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use class-wise instead of node-wise integration | NPC, producing RNPC · MNIST-Add5, ∞-norm PGD at norm bound 0.11 | adversarial accuracy: NPC's adversarial accuracy drops below 40%; RNPC maintains an adversarial accuracy above 80% | Helped |
| Use class-wise instead of node-wise integration | NPC, producing RNPC · CelebA-Syn, ∞-norm PGD | adversarial accuracy | No clear effect |
| Use class-wise instead of node-wise integration | NPC, producing RNPC · MNIST-Add3 and MNIST-Add5 | benign accuracy: 99.32 -> 99.37; 99.40 -> 99.51 | Helped |
| Use class-wise instead of node-wise integration | NPC, producing RNPC · GTSRB-Sub | benign accuracy: 99.57 -> 99.49 | Hurt |
| Increase the number of attacked attributes (ablation) | RNPC and baselines · MNIST-Add3 and MNIST-Add5, ∞-norm PGD at norm bound 0.11 | adversarial accuracy | Hurt |
| Attack up to the intrinsic radius rather than exceeding it (ablation) | RNPC · MNIST-Add3, one attacked attribute; MNIST-Add5, two attacked attributes | adversarial accuracy vs. best baseline: up to 45% higher; 37% higher | Helped |
| Set RNPC radius r below or above intrinsic radius r* (ablation) | RNPC · MNIST-Add5, ∞-norm PGD at norm bound 0.11 | adversarial accuracy | Hurt |
| Set radius r to 5, spanning the full attribute space (ablation) | RNPC · MNIST-Add5 | benign accuracy: 29.9% | Hurt |
| Set radius r to 5, spanning the full attribute space (ablation) | RNPC · MNIST-Add5, ∞-norm PGD at norm bound 0.11 | adversarial accuracy: 29.9% | Hurt |
| Use adversarially trained attribute recognition models (ablation) | NPC and RNPC · GTSRB-Sub, attacks targeting one attribute | accuracy on other attributes | Helped |
| Use adversarially trained attribute recognition models (ablation) | NPC and RNPC · GTSRB-Sub, ∞-norm PGD | adversarial accuracy | Helped |
| Attack one attribute in the presence of spurious correlations (ablation) | NPC and RNPC attribute recognition models · GTSRB-Sub, ∞-norm PGD at norm bound 0.11 | accuracy on other attributes | Hurt |
Surprising findings
- Adding a probabilistic circuit on top of attribute recognition does not change the robustness bound, unlike linear predictors in CBMs whose robustness is harmed.
- Attacking one attribute propagates to other attributes on GTSRB-Sub due to spurious correlations, reducing RNPC's advantage.
Limitations
- Robustness depends on dataset radius; datasets with small radius (e.g., GTSRB radius 0) limit RNPC's advantage.
- Attack propagation from spurious correlations between attributes can exceed the radius and compromise RNPC.
- Requires concept/attribute annotations and assumes complete information and sufficient attributes; scalability to many attributes is exponential in worst case.
Experimental setup
Datasets: MNIST CelebA GTSRB StarGAN-synthesized CelebA
Benchmarks: MNIST-Add3 MNIST-Add5 CelebA-Syn GTSRB-Sub
Metrics: benign accuracy adversarial accuracy
Baselines: NPC CBM DCR
Builds on: Neural Probabilistic Circuits concept bottleneck models LearnSPN CCCP PGD
Closest papers by meaning
- Towards the first adversarially robust neural network model on MNIST (ICLR 2019 · similarity 0.87)
- PROVEN: Verifying Robustness of Neural Networks with a Probabilistic Approach (ICML 2019 · similarity 0.87)
- Probably Approximately Global Robustness Certification (ICML 2025 · similarity 0.87)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.86)
- Robust Models are less Over-Confident (NeurIPS 2022 · similarity 0.86)
- Interpreting Robustness Proofs of Deep Neural Networks (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.