Provable detection finds adversarial attacks via geometric differences
Provable Adversarial Detection: Prime Quantization meets Gromov--Wasserstein
Machine Learning
Summary
Adversarial attacks trick computer vision systems by making tiny changes that humans barely notice, but which cause mistakes. The authors show that these tricky changes cannot keep certain geometric patterns the same across two very different spaces: one based on normal neural network features and one built using a special number system. Because adversarial examples disrupt geometry in one space but not the other, the authors can reliably spot them. They also provide mathematical proof that this detection method always works under defined conditions. Their experiments confirm the theory and detect attacks across many types of models.
What this means in practice
- •For security engineers: Detect adversarial image attacks by comparing geometric patterns across different feature spaces in vision systems to improve threat detection.
- •For machine learning engineers: Integrate mathematically guaranteed adversarial detection modules into vision models to reduce false positives and improve trust in automated decision-making.
Authors
Manohar Kaul, Sadbhavana Babar, Aditya Ramesh, Aditya Saibewar, Fumiyoshi Kasahara, Maki Inui, Hiroaki Kurihara
Abstract
Adversarial vulnerability persists across modern vision architectures from CNNs to vision language models (VLMs), yet existing detection methods rely on heuristics without theoretical guarantees. We address the fundamental question of when adversarial perturbations can be provably detected from a geometric perspective. Our key insight is that adversarial perturbations cannot simultaneously preserve geometric structure across spaces with fundamentally different properties. Accordingly, we construct two such complementary metric spaces. First, we use a standard CNN embedding space $Z$, where adversarial samples exhibit significant displacement patterns. Second, we build a novel prime-quantized space $P$, that absorbs small perturbations through number-theoretic discretization, resulting in minimal displacement, while preserving discriminability. We then leverage the geometric discrepancies across spaces $Z$ and $P$ to detect adversarial samples. To the best of our knowledge, we establish the first rigorous separation theory for adversarial detection, proving that adversarial samples create unavoidable geometric inconsistencies across both spaces. Our framework provides theoretical guarantees including pixel-level absorption bounds, neighborhood diameter concentration, Gromov-Wasserstein (GW) separation theorems, and practical risk control. Extensive experiments validate our theoretical predictions and achieve consistently strong detection performance across a wide range of attack types and model families.