[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-501615-105":59,"doc-detail-501615-en":130},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":123,"head_meta":125,"extra_data":127,"updated_unix":129},105,"en","two-coupled-rejection-metrics-can-tell-adversarial-examples-apart-paper","Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart - Paper","","Correctly classifying adversarial examples is crucial yet difficult for safe deployment of machine learning models. Even state-of-the-art adversarially trained systems in RobustBench remain below 67% robust accuracy on CIFAR-10. The work studies rejection options that abstain on uncertain inputs, using confidence as a proxy. It introduces two coupled rejection metrics—rectified confidence (R-Con) paired with confidence—providing provable separation between wrongly and correctly classified samples, enabling effective rejection with minimal additional computation.",{"@graph":69,"@context":122},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/two-coupled-rejection-metrics-can-tell-adversarial-examples-apart-paper/501615/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/two-coupled-rejection-metrics-can-tell-adversarial-examples-apart-paper/501615.png","ImageObject",300,407,{"name":92,"@type":93},"Ezra","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-20","2026-10-03",true,{"@type":102,"interactionType":103,"userInteractionCount":44},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108,114,118],{"name":109,"@type":110,"acceptedAnswer":111},"What problem does the paper address about adversarial examples?","Question",{"text":112,"@type":113},"It addresses the difficulty of correctly classifying adversarial examples in a way suitable for safe real-world deployment, where even strong adversarial training methods fall short of practical robust accuracy.","Answer",{"name":115,"@type":110,"acceptedAnswer":116},"How does the proposed method use rejection to improve robustness?",{"text":117,"@type":113},"It adds a rejection option so the model can abstain on inputs deemed uncertain. The paper uses confidence-based certainty measures and then introduces coupled rejection metrics to better distinguish incorrect from correct predictions.",{"name":119,"@type":110,"acceptedAnswer":120},"What are the two coupled rejection metrics proposed in the paper?",{"text":121,"@type":113},"The paper couples a standard confidence metric with rectified confidence (R-Con). Together, they can provably separate wrongly classified inputs from correctly classified ones under training assumptions described in the paper.","https://schema.org",{"og:url":83,"og:type":124,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":126,"canonical":83},"index,follow",{"doc_id":128,"site_id":62},501615,1791301702,{"code":4,"msg":5,"data":131},{"doc_id":128,"user_id":132,"nickname":92,"user_avatar":133,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":134,"file_id":135,"file_url":136,"file_type":137,"file_size":138,"view_count":44,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":139,"language":140,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":141,"faqs":142,"seo_title":143,"seo_description":67,"update_tm":144,"read_time":145},1099514068035,"https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c","Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart  \nTianyu Pang 1 , Huishuai Zhang2 , Di He2 , Yinpeng Dong 1 , Hang Su 1 , Wei Chen3 , Jun Zhu 1􀀃, Tie-Yan Liu2  \n1Dept. of Comp. Sci. and Tech., Institute for AI, BNRist Center, THBI Lab, Tsinghua University 2MSRA 3ICT, CAS  \nfpty17, [dyp17](dyp17g@mails.tsinghua.edu.cn)[g](dyp17g@mails.tsinghua.edu.cn)[@mails.tsinghua.edu.cn](dyp17g@mails.tsinghua.edu.cn), fsuhangss, [dcszj](dcszjg@tsinghua.edu.cn)[g](dcszjg@tsinghua.edu.cn)[@tsinghua.edu.cn](dcszjg@tsinghua.edu.cn), fhuishuai.zhang, dihe, wche, [tyliu](tyliug@microsoft.com)[g](tyliug@microsoft.com)[@microsoft.com](tyliug@microsoft.com)  \nAbstract  \nCorrectly classifying adversarial examples is an essential but challenging requirement for safely deploying machine learning models. As reported in RobustBench, even the stateof-the-art adversarially trained models struggle to exceed 67% robust test accuracy on CIFAR-10, which is far from practical. A complementary way towards robustness is to introduce a rejection option, allowing the model to not return predictions on uncertain inputs, where confidence is a commonly used certainty proxy. Along with this routine, we find that confidence and a rectified confidence (R-Con) can form two coupled rejection metrics, which could provably distinguish wrongly classified inputs from correctly classified ones. This intriguing property sheds light on using coupling strategies to better detect and reject adversarial examples. We evaluate our rectified rejection (RR) module on CIFAR-10, CIFAR-10-C, and CIFAR-100 under several attacks including adaptive ones, and demonstrate that the RR module is compatible with different adversarial training frameworkson improving robustness, with little extra computation.  \n1. Introduction  \nThe adversarial vulnerability of machine learning models has been widely studied because of its counter-intuitive behavior and the potential effect on safety-critical tasks [2, 17, 43] . Towards this end, many defenses have been proposed, but most of them can be evaded by adaptive attacks [1, 45] . Among the previous defenses, adversarial training (AT) is recognized as an effective defending approach [30, 53] . Nonetheless, as reported in RobustBench [10], the stateof-the-art AT methods still struggle to exceed 67% robust test accuracy on CIFAR-10, even after exploiting extra data [18, 35, 39, 47], which is far from practical.  \nAn improvement can be achieved by incorporating a rejection or detection module along with the adversarially trained classifier, which enables the model to refuse to make predictions for abnormal inputs [7, 23, 25, 42] . Although previous rejectors trained via margin-based objectives or confidence calibration can capture some aspects of prediction certainty,  \n􀀃 Corresponding author.  \n1  \n0.9  \n0.8  \n0.7  \n0.6  \n0.5  \n0.4  \n0.3  \nR-Con  \n\n|  |  |  |  |  |  |  |  |  |  |\n| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |\n|  |  |  |  |  |  |  |  |  |  |\n|  |  |  |  |  |  |  |  |  |  |\n|  |  |  |  |  |  |  |  |  |  |\n|  |  |  |  |  |  |  |  |  |  |\n|  |  |  |  |  |  |  |  |  |  |\n|  |  |  |  |  |  Co | rrectly cla | ssified |  |  |\n|  |  |  |  |  Wr |  | ongly clas | sified |  |  |\n\n0 0.1 0.2 0.3 0.4 0.5 0.6  \n-error  \nFigure 1 . PGD-10 examples crafted against an adversarially trained ResNet-18 on the CIFAR-10 test set. As described in Theorem 1, these adversarial examples are first filtered by the confidence value at 2􀀘 for each 􀀘 . Namely, they pass if the predicted confidence is larger than 2􀀘 ; otherwise rejected. Then among the remaining examples, the R-Con metric can provably separate correctly and wrongly classified inputs. In Fig. 3 we show that tuning the logits temperature 􀀜 can increase the number of remaining examples.  \nthey may overestimate the certainty, especially on wrongly classified samples. Furthermore,[44] argues that learning a robust rejector could suffer from a similar accuracy bottleneck as learning robust classifi","cbCairDg2Rh2Fw9E","https://ap.wps.com/l/cbCairDg2Rh2Fw9E","pdf",6086044,11,"English","# Abstract\n# Introduction\n# Methods and Objective\n## Training the RR module","[{\"question\":\"What problem does the paper address about adversarial examples?\",\"answer\":\"It addresses the difficulty of correctly classifying adversarial examples in a way suitable for safe real-world deployment, where even strong adversarial training methods fall short of practical robust accuracy.\"},{\"question\":\"How does the proposed method use rejection to improve robustness?\",\"answer\":\"It adds a rejection option so the model can abstain on inputs deemed uncertain. The paper uses confidence-based certainty measures and then introduces coupled rejection metrics to better distinguish incorrect from correct predictions.\"},{\"question\":\"What are the two coupled rejection metrics proposed in the paper?\",\"answer\":\"The paper couples a standard confidence metric with rectified confidence (R-Con). Together, they can provably separate wrongly classified inputs from correctly classified ones under training assumptions described in the paper.\"}]","Two Coupled Rejection Metrics Can Tell Adversarial Examples Apart - Paper | PDF",1791021475,28]