Research map / Adversarial robustness and security / Certified and empirical robustness
Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Embeds rotation- and scale-equivariant group convolutions into standard CNNs (parallel and cascaded designs) and reports improved FGSM/PGD robustness on CIFAR-10/100 and CIFAR-10C without adversarial training.
Problem
Adversarial vulnerability of CNNs, where adversarial training is costly and can hurt clean accuracy; the question is whether architectural symmetry priors (equivariance) alone can improve adversarial robustness.
Approach
Add P4 rotation-equivariant and scale-equivariant convolution branches in parallel (concatenated fusion) with standard convolutions, and argue theoretically via CLEVER that orbit-invariant margin gradients yield tighter certified bounds, without adversarial training.
Key results
- On CIFAR-10 with a 10-layer fully equivariant model (no adversarial training), accuracy is 73.01% FGSM and 64.96% PGD at epsilon=0.01, versus 74.5% FGSM and 67.0% PGD for a CNN with PGD adversarial training.
- On CIFAR-10C, Parallel GCNN achieves a mean accuracy of 13.59% at epsilon_1 versus 7.28% for the baseline CNN, but the rotation+scale parallel variant does worse than baseline under corruptions.
- On CIFAR-100 ablation under PGD at epsilon=0.01, the parallel rotation+scale model reaches 29.62% versus 2.49% for the baseline CNN.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add parallel standard and rotation-equivariant branches | Baseline CNN · CIFAR-10C, ε1 (0.01) | accuracy (%): 7.28 -> 13.59 | Helped |
| Add rotation- and scale-equivariant branches to the parallel design (ablation) | Parallel GCNN · CIFAR-100, ε=0.01, PGD | accuracy (%): 24.72 -> 29.62 | Helped |
| Add rotation- and scale-equivariant branches to the parallel design (ablation) | Parallel GCNN · CIFAR-100, ε=0.01, PGD | accuracy (%): 21.34 -> 29.62 | Helped |
| Increase fully equivariant model depth from 4 to 10 layers (ablation) | Fully Equivariant · CIFAR-10, ε=0.01, PGD | accuracy (%): 52.20 -> 64.96 | Helped |
| Increase fully equivariant model depth from 4 to 10 layers (ablation) | Fully Equivariant · CIFAR-100, ε=0.01, FGSM | accuracy (%): 38.40 -> 50.60 | Helped |
| Replace concatenation with weighted fusion (ablation) | Parallel GCNN (R & S) · CIFAR-10 and CIFAR-100, adversarial attacks | accuracy | Hurt |
| Use a cascaded rather than parallel design (ablation) | Symmetry-aware CNN · CIFAR-10 and CIFAR-100, clean and adversarial settings | accuracy | Hurt |
| Add rotation- and scale-equivariant branches instead of using the standard CNN | CIFAR10C model · CIFAR-10C, corruption robustness | accuracy | Hurt |
| Use a fully equivariant G-CNN without adversarial training instead of CNN with PGD adversarial training | CIFAR-10 classifier · CIFAR-10, ε=0.01, FGSM | accuracy (%): 74.5 -> 73.01 | Hurt |
| Use a fully equivariant G-CNN without adversarial training instead of CNN with PGD adversarial training | CIFAR-10 classifier · CIFAR-10, ε=0.03, FGSM | accuracy (%): 66.1 -> 67.09 | Helped |
Surprising findings
- The rotation- and scale-equivariant parallel GCNN performs worse than the baseline CNN on CIFAR-10C corruptions, contrary to its adversarial gains.
- The scale-equivariant branch is implemented via resizing and aggregation rather than norm-preserving group convolution, so the paper's certified-bound theory does not formally cover it.
Limitations
- Theory covers only local Lipschitz/CLEVER bounds and relies on orthogonal, norm-preserving assumptions that the scale branch violates.
- Experiments are limited to small-scale datasets (CIFAR) and common l_p attacks.
- Computational trade-offs of group convolutions are not quantified.
Experimental setup
Datasets: CIFAR-10 CIFAR-100
Benchmarks: CIFAR-10 CIFAR-100 CIFAR-10C
Metrics: adversarial accuracy FGSM accuracy PGD accuracy mean corruption accuracy
Baselines: Baseline CNN Cascaded GCNN Weighted Parallel GCNN CNN with PGD adversarial training
Builds on: G-CNN CLEVER FGSM PGD
Closest papers by meaning
- Probing Equivariance and Symmetry Breaking in Convolutional Networks (NeurIPS 2025 · similarity 0.89)
- A Tale of Two Symmetries: Exploring the Loss Landscape of Equivariant Models (NeurIPS 2025 · similarity 0.89)
- On Making $SE(2)$-Invariant Networks Optimal (NeurIPS 2026 · similarity 0.89)
- Learning (Approximately) Equivariant Networks via Constrained Optimization (NeurIPS 2025 · similarity 0.88)
- A Probabilistic Approach to Learning the Degree of Equivariance in Steerable CNNs (ICML 2024 · similarity 0.87)
- Improving Equivariant Networks with Probabilistic Symmetry Breaking (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.