Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces a novel, theoretically grounded approach to adversarial detection by leveraging geometric discrepancies between two complementary metric spaces: a standard CNN embedding space ($Z$) and a prime-quantized space ($P$). The core insight is that adversarial perturbations create unavoidable geometric inconsistencies across these spaces, which are designed to absorb perturbations differently. The authors establish the first rigorous separation theory for adversarial detection, providing provable guarantees and demonstrating strong empirical performance across various attacks and models.
Adversarial attacks create provable geometric inconsistencies across prime-quantized and CNN embedding spaces, enabling theoretically guaranteed detection.
Adversarial vulnerability persists across modern vision architectures from CNNs to vision language models (VLMs), yet existing detection methods rely on heuristics without theoretical guarantees. We address the fundamental question of when adversarial perturbations can be provably detected from a geometric perspective. Our key insight is that adversarial perturbations cannot simultaneously preserve geometric structure across spaces with fundamentally different properties. Accordingly, we construct two such complementary metric spaces. First, we use a standard CNN embedding space $Z$, where adversarial samples exhibit significant displacement patterns. Second, we build a novel prime-quantized space $P$, that absorbs small perturbations through number-theoretic discretization, resulting in minimal displacement, while preserving discriminability. We then leverage the geometric discrepancies across spaces $Z$ and $P$ to detect adversarial samples. To the best of our knowledge, we establish the first rigorous separation theory for adversarial detection, proving that adversarial samples create unavoidable geometric inconsistencies across both spaces. Our framework provides theoretical guarantees including pixel-level absorption bounds, neighborhood diameter concentration, Gromov-Wasserstein (GW) separation theorems, and practical risk control. Extensive experiments validate our theoretical predictions and achieve consistently strong detection performance across a wide range of attack types and model families.