[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-608436-105":59,"doc-detail-608436-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","detecting-brittle-decisions-for-free-leveraging-margin-consistency-in-deep-robust-classifiers","Detecting Brittle Decisions for Free - Leveraging Margin Consistency in Deep Robust Classifiers","","Despite extensive research on adversarial training strategies to improve robustness, even the strongest deep learning models can react sensitively to imperceptible perturbations, posing risks in high-stakes real-world deployment. Per-instance vulnerability assessment with adversarial attacks is too computationally expensive for real-time use, and input space margin is intractable for deep neural networks. This work introduces margin consistency to enable efficient detection of vulnerable samples using logit margin and extends to cases via a pseudo-margin when consistency is insufficient.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/detecting-brittle-decisions-for-free-leveraging-margin-consistency-in-deep-robust-classifiers/608436/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/detecting-brittle-decisions-for-free-leveraging-margin-consistency-in-deep-robust-classifiers/608436.png","ImageObject",300,407,{"name":92,"@type":93},"Patrick","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-29","2026-10-17",true,{"@type":102,"interactionType":103,"userInteractionCount":81},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"Why is per-instance adversarial vulnerability evaluation difficult for deep robust models?","Question",{"text":112,"@type":113},"Evaluating vulnerability for each instance using adversarial attacks is computationally too intensive and not suitable for real-time deployment. Input space margin is also intractable for deep neural networks.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"What is margin consistency and how is it used for detection?",{"text":117,"@type":113},"Margin consistency links the input space margins and logit margins in robust models. The paper shows it is a necessary and sufficient condition for using logit margin as a score to identify non-robust samples.",{"name":119,"@type":110,"acceptedAnswer":120},"How do the experiments validate the proposed approach?",{"text":121,"@type":113},"Empirical analysis on CIFAR10 and CIFAR100 shows robust models exhibit high margin consistency, with a strong correlation between input space margins and logit margins.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},608436,1792622442,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":81,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":26},549758146520,"https://ap-avatar.wpscdn.com/avatar/80002397d8c0411e94?_k=1775819394049821470","Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifiers  \nJonas Ngnawé  \nIID-Université Laval and Mila [jonas.ngnawe.1@ulaval.ca](jonas.ngnawe.1@ulaval.ca)  \nYann Pequignot  \nIID-Université Laval  \n[yann.pequignot@iid.ulaval.ca](yann.pequignot@iid.ulaval.ca)  \nSabyasachi Sahoo  \nIID-Université Laval and Mila  \n[sabyasachi.sahoo.1@ulaval.ca](sabyasachi.sahoo.1@ulaval.ca)  \nFrédéric Precioso  \nUniversité Côte d’Azur, CNRS, INRIA, I3S, Maasai  \nfrederic .precioso@univ-cotedazur .fr  \nChristian Gagné  \nIID-Université Laval, Mila and Canada CIFAR AI Chair  \n[christian.gagne@gel.ulaval.ca](christian.gagne@gel.ulaval.ca)  \nAbstract  \nDespite extensive research on adversarial training strategies to improve robustness, the decisions of even the most robust deep learning models can still be quite sensitive to imperceptible perturbations, creating serious risks when deploying them for high-stakes real-world applications. While detecting such cases may be critical, evaluating a model’s vulnerability at a per-instance level using adversarial attacks is computationally too intensive and unsuitable for real-time deployment scenarios. The input space margin is the exact score to detect non-robust samples and is intractable for deep neural networks. This paper introduces the concept of margin consistency – a property that links the input space margins and the logit margins in robust models – for efficient detection of vulnerable samples. First, we establish that margin consistency is a necessary and sufficient condition to use a model’s logit margin as a score for identifying non-robust samples. Next, through comprehensive empirical analysis of various robustly trained modelson CIFAR10 and CIFAR100 datasets, we show that they indicate high margin consistency with a strong correlation between their input space margins and the logit margins. Then, we show that we can effectively and confidently use the logit margin to detect brittle decisions with such models. Finally, we address cases where the model is not sufficiently margin-consistent by learning a pseudo-margin from the feature representation. Our findings highlight the potential of leveraging deep representations to assess adversarial vulnerability in deployment scenarios efficiently.  \n1 Introduction  \nDeep neural networks are known to be vulnerable to adversarial perturbations, visually insignificant changes in the input resulting in the so-called adversarial examples that alter the model’s prediction (Biggio et al., 2013; Goodfellow et al., 2015) . They constitute actual threats in real-world scenarios (Evtimov et al., 2017; Gnanasambandam et al., 2021), jeopardizing their deployment in sensitive and safety-critical systems such as autonomous driving, aeronautics, and health care. Research in the field has been intense and produced various adversarial training strategies to defend against the vulnerability to adversarial perturbations with bounded ℓp norm (e.g., p = 2, p = ∞) through  \n38th Conference on Neural Information Processing Systems (NeurIPS 2024) .  \naugmentation, regularization, and detection (Xu et al., 2017; Madry et al., 2018; Zhang et al., 2019; Carmon et al., 2019; Wang et al., 2020; Wu et al., 2020; Rice et al., 2020), to cite a few. The empirical robustness (adversarial accuracy) of these adversarially trained models is still far behind their high performance in terms of accuracy. It is typically estimated by assessing the vulnerability of samples of a given test set using adversarial attacks (Carlini & Wagner, 2016; Madry et al., 2018) or an ensemble of attacks such as the standard AutoAttack (Croce & Hein, 2020b) . The objective of that evaluation is to determine if, for a given normal sample, an adversarial instance exists within a given ϵ-ball around it. Yet, this robustness evaluation over a specific test set provides a global property of the model but not a local property specific to a single instance (Seshia et al., 2018; D","cbCaifvJzs2tFlqr","https://ap.wps.com/l/cbCaifvJzs2tFlqr","pdf",870582,24,"English","# Abstract\n# 1 Introduction","[{\"question\":\"Why is per-instance adversarial vulnerability evaluation difficult for deep robust models?\",\"answer\":\"Evaluating vulnerability for each instance using adversarial attacks is computationally too intensive and not suitable for real-time deployment. Input space margin is also intractable for deep neural networks.\"},{\"question\":\"What is margin consistency and how is it used for detection?\",\"answer\":\"Margin consistency links the input space margins and logit margins in robust models. The paper shows it is a necessary and sufficient condition for using logit margin as a score to identify non-robust samples.\"},{\"question\":\"How do the experiments validate the proposed approach?\",\"answer\":\"Empirical analysis on CIFAR10 and CIFAR100 shows robust models exhibit high margin consistency, with a strong correlation between input space margins and logit margins.\"}]","Detecting Brittle Decisions for Free - Leveraging Margin Consistency in Deep Robust Classifiers | PDF",1792255970]