TriQDef: Disrupting Semantic and Gradient Alignment to Prevent Adversarial Patch Transferability in Quantized Neural Networks
Authors: Amira Guesmi
Bassem ouni
Muhammad Shafique
Venue: ICLR 2026 Poster (2026)
Keywords: Patch-based attacks
adversarial transferability
model quantization
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Quantized Neural Networks (QNNs) are widely deployed in edge and resource-constrained environments for their efficiency in computation and memory. While quantization distorts gradient landscapes and weakens pixel-level attacks, it offers limited robustness against patch-based adversarial attacks—localized, high-saliency perturbations that remain highly transferable across bit-widths. Existing defenses either overfit to specific quantization settings or fail to address this cross-bit vulnerability.  
We propose \textbf{TriQDef}, a tri-level quantization-aware defense framework that disrupts the transferability of patch-based attacks across QNNs. TriQDef integrates: (1) a \emph{Feature Disalignment Penalty (FDP)} that enforces semantic inconsistency by penalizing perceptual similarity in intermediate features; (2) a \emph{Gradient Perceptual Dissonance Penalty (GPDP)} that misaligns input gradients across quantization levels using structural metrics such as Edge IoU and HOG Cosine; and (3) a \emph{Joint Quantization-Aware Training Protocol} that applies these penalties within a \emph{shared backbone} jointly optimized across multiple quantizers.  
Extensive experiments on CIFAR-10 and ImageNet show that TriQDef lowers Attack Success Rates (ASR) by over 40\% on unseen patch and quantization combinations while preserving high clean accuracy. These results highlight the importance of disrupting both semantic and perceptual gradient alignment to mitigate patch transferability in QNNs.

Published as a conference paper at ICLR 2026
TRIQDEF: DISRUPTING SEMANTIC AND GRADIENT ALIGNMENT TO PREVENT ADVERSARIAL PATCH TRANSFERABILITY IN QUANTIZED NEURAL
NETWORKS
Amira Guesmi
Bassem Ouni Khalifa University Abu Dhabi, UAE
Muhammad Shafique
eBrain Lab
eBrain Lab
Engineering Department
Engineering Department
New York University Abu Dhabi Abu Dhabi, UAE
New York University Abu Dhabi
Abu Dhabi, UAE
ABSTRACT
Quantized Neural Networks (QNNs) are widely deployed in edge and resource- constrained environments for their efficiency in computation and memory. While quantization distorts gradient landscapes and weakens pixel-level attacks, it of- fers limited robustness against patch-based adversarial attacks-locallzed, high- saliency perturbations that remain highly transferable across bit-widths. Existing defenses either overfit to specific quantization settings or fail address this cross- bit vulnerability. We propose TriQDef, a tri-level quantization-awan aware defense framework that disrupts the transferability of patch-based attacks across QNNs. TriQDef integrates: (1) Feature Disalignmen! Penalty (FDP) that enforces se- mantic inconsistency by penalizing perceptual similarity in intermediate features; (2) Gradient Perceptual Dissonance Penalty (GPDP) that misaligns input gra- dients across quantization levels using structural metrics such as Edge loU and HOG Cosine; and (3) Joint Quantization-Aware Training Protocol that applies these penalties within a shared backbone jointly optimized across multiple quan- tizers. Extensive experiments
CIFAR-I0 and ImageNet show that TriQDef lowers Attack Success Rates (ASR) by over 40% on unseen patch and quantiza- tion combinations while preserving high clean accuracy. These results highlight the importance of disrupting both semantic and perceptual gradient alignment to mitigate patch transferability in QNNs.
INTRODUCTION & RELATED WORK
Quantized Neural Networks (QNNs) offer compelling trade-off by significantly reducing memory and compute requirements while maintaining competitive accuracy (Liu et al.. 2021a] Katare et al., 2023 Zhang& Chung |021 Tonellotto et 2021 Hernández al. 2024). Prior studies have
shown that quantization can distort gradient landscapes, thereby weakening the effectiveness of traditional pixel-level adversarial attacks (Li et al. 2024 Yang et al., 2024). However, such gradient masking effects offer little protection against more structured threats.
Adversarial patch attacks (Karmon al., 2018 Brown al. [017 Chen et al. 2022 Guesmi al.) 2024) pose unique challenge by inserting localized, high-saliency patterns that hijack model pre- dictions. Unlike subtle pixel perturbations, these patches are robust to input variation and generalize across architectures and guantization levels Guesmi et al. (2023). Crucially, our analysis reveals that even under aggressive quantization (c.g.. 2-bit), adversarial patches crafted on full precision models maintain high success rates, highlighting critical blind spot in current quantization-awie defenses.
Existing defenses such as Projected Gradient Descent (PGD)- based adversarial training Madry et al. 2018) offer limited effectiveness against patch attacks, which exploit model attention rather than gradient sensitivity. Classical aaput-tranfformatio defenses including MagNet (Meng & Chen 2017), Feature Squeezing (Xu et al. 2017), and randomized input transformations explored by

---

Published as a conference paper at ICLR 2026
Tramer et al. (Tramer et al.) 2017a) provide robustness against pixel-level perturbations but substantially less effective against large, structured adversarial patches that bypass small-noise as- sumptions. Patch-Based Adversarial Training (PBAT) (Rao et al. (020) incorporates patch patterss during training and improves robustness on seen configurations, but often fails to generalize across novel patch types bit-widths. Other approaches, such Double- Quantization (DWQ) (Fu iet al. 2021), stochastic precision inference (Sen et al., (020). and feature-space smoothing (Song al. 2020), primarily target pixel-Ievel noise and do not directly tackle the structured, cross-bii bit nature of adversarial patches (Xiao et al. 2023). Input preprocessing- -ased defenses such as (Tar- choun al.) 2023] Nie et al. 2022) impose significant computational overhead, undermining the efficiency gains that quantization aims to provide.
In this work, we introduce TriQDef, a unified defense framework designed to explicitly disrupt the core enablers of patch-based adversarial transferability in QNNs. Our analysis reveals that quantized models (even under extreme bit-width reduction) exhibit surprisingly high vulnerability to transfer- able adversarial patches. This phenomenon arises from persistent alignment in both internal features and input gradient signals across bit-widths. TriQDef addresses this vulnerability through three syn- ergistic components that target semantic and optimization-leve consistency:
Feature Disalignment Penalty (FDP) enforces semantic divergence by penalizing perceptual simi- larity in feature maps across quantized variants. Using differentiable variants of Edge IoU and HOG Cosine similarity, FDP encourages each bit-width to develop unique feature representations, thus weakening patch generalization. Gradient Perceptual Dissonance Penalty (GPDP) misaligns the saliency landscape by penalizing structural and perceptual gradient similarity across bit-widths. It directly targets gradient-level alignment that facilitates adversarial transfer, extending beyond cosine similarity to include perceptual alignment in edge structures and gradient orientations. Bit- Width- Aware Curriculum Training (BACT) stabilizes optimization by staging the activation of quantizers on the same backbone 0: training begins at higher precision and progressively enables lower-bit Qs: losses are computed over the active set B, so that LEDP and LGPDP act across bit-widths.
Our main contributions are summarized as follows:
We conduct, to our knowledge, the first systematic study of patch-based transferability in QNNs, demonstrating that adversarial patches remain highly effective across quantization levels, including 2-bit regimes.
We propose TriQDef, a tri-component defense targeting both feature and gradient align- ment, explicitly designed to prevent cross-bit patch generalization.
We introduce perceptual alignment metrics (Edge IoU and HOG Cosine Similarity) as theo- retically justified tools to quantify and disrupt semantic and gradient- aligoment across bit-widths. These metries provide a principled alternative to cosine similarity by capturing structural and textural alignment that underlies patch transferability in QNNs.
Our approach reduces attack success rate (ASR) by over 40% on unseen patch and quan- tization configurations across CIFAR-10 and ImageNet, outperforming PBAT and DWQ with around 2% drop in clean accuracy.
Ablation studies validate the complementary role of each module and reveal that quanti- zation alone does not sufficiently alter the shared attack surface, highlighting the need for targeted perceptual and structural misalignment.
TriQDef challenges the assumption that quantization inherently enhances adversarial robustness. By explicitly dismantling shared vulnerabilities at both the representational and gradient levels, TriQDef provides principled and extensible framework for securing QNNs against patch-based threats.
MOTIVATION
Despite recent progress in adversarial training and quantization-awve aware techniques, we show that QNNs remain highly vulnerable to structured, localized adversarial attacks, particularly adversarial patches. This vulnerability stems from a critical oversight: existing defenses do not generalize across quantization levels, and thus fail prevent bitss-bit transferability of pateh- attacks.
2

---

Published as a conference paper at ICLR 2026
Our investigation reveals two key limitations that motivate the need for a principled, quantization- aware patch defense framework.
Adversarial Patches Transfer Effectively Across Bit-Widths. We begin by evaluating the transferability of adversarial patches crafted on full-precision (32-bit) models to quantized models trained using Quantization-Awe Aware Training (QAT). Table T reports the Attack Success Rates (ASR) of two state-of-the-art patch attacks (LAVAN (Karmon et al. 2018)) and GAP (Brown et al.] 2017) on various QNN architectures. Notably, the adversarial patches retain high effectiveness even under extreme quantization (e.g., over 73% ASR on 2-bit ResNet-56), confirming that quantization alone offers limited resilience against structured perturbations. This cross-bit vulnerability persists despite the reduced numerical precision and quantization noise introduced by QAT.
Standard and Patch-Based Adver- sarial Training Fail to Generalize Across Bit-Widths. We further an- alyze whether existing adversarial de- fense methods can mitigate this vulner- ability. In Table we compare standard adversarial training (AT) and Patch- Based Adversarial Training (PBAT) un- der different quantization paradigms:
Table 1: ASR (%) of LAVAN and GAP (6x6 patches)
transferred from full-precision models to QAT-trained
QNNs on CIFAR-10.
Attack Model
LAVAN
GAP
32bit
8bit
4bit
2bit
32bit
8bit
4bit
2bit
Res-56
86.43183.24
76.22
73.08
84.40
56.69
54.22
47.9T
Res-20
87.22
83.73
77.30
74.18
84.71
59.61
58.45
50.31
VGG-19
88.95
85.56
79.81
77.19
95.79
59.65
48.70
40.69
full-precision (FP), 8-bit Quantization-
VGG-16 87.17
84.73
78.29
76.67
95.71
64.24
52.04
48.90
Aware Training (QAT), and 8-bit Post- Training Quantization (PTQ). While
PBAT significantly reduces ASR for patch types seen during training, its robustness deteriorates sharply unseen patch der a different bit-width. For instance, ASR increases by more than 20% when evaluated on 2-bit patches not seen during training. These results reveal failure generalize across quantization shifts, underscoring the need for defenses that explicitly target bit-level adversarial generalization.
when the patch was generated or tested un-
To further support these observations, we present in Appendix [A] (1) cross- architecture transfer results including vision transformers; (2) analysis under dynamic and post-training quantization; (3) results using additional patch-based attacks (e.g.. DPR, PatchAttack); and (4) comprehensive ablations and visu- alizations. These collectively highlight the limitations of existing defenses and motivate the design of TriQDef-a tri- level framework that breaks patch trans- ferability via semantic, gradient, and curriculum- brased alignment disruption.
Table 2: ASR (%) of LAVAN attack across training paradigms and quantization levels. PBAT-trained mod- els fail to generalize to unseen patch bit-widths.
Standard
PBAT
Patch Type
FP
QAT
PTQ
FP
QAT
PTQ
8x8 (Seen)
88.17 81.56 85.24 40.39 40.56 45.44
10x 10 (Seen)
92.33 84.33 87.48 57.86
56.77 60.60
8x8 (Unseen, 4-bit)
89.92
83.40 86.78
62.10
71.42 75.16
10x (Unseen, 2-bit)
91.18
85.62
87.91
65.30
78.34 81.09
3 METHODOLOGY
3.1 OVERVIEW
We propose TriQDef, a framework that mitigates the transferability of tacks in QNNs. TriQDef integrates three complementary components into cohesive training strat- egy. The first component, Feature Disalignment Penalty (FDP), disrupts semantic consistency by encouraging divergence in internal feature representations across different quantization levels. The second component, Gradient Perceptual Dissonance Penalty (GPDP), penalizes perceptual align- ment in input gradients between bit-widths, targeting edge- and texture-level similarity that facili- tates cross-bit bit transferability. The third component, Bir- Width-Aware Curriculum Training (BACT), stabilizes training under extreme quantization by progressively enabling lower-bit quantizers on the same backbone, starting from higher precision and expanding the active bit-width set over time.
adversarial at-
3

---

Published as a conference paper at ICLR 2026
Q22
Cea(fa2 ()
Clean x
Features f32
Lyop
Vxxer
clean
18g
(x)))(())))))
Shared Backbone 0
Qa
LOPDP
Les (cs(U()).3)
Q2
Features
Vxaau Ca
L adv
[Bg
Lcelfo (Xa(x)))))))
Patched Xadv
(cE(((().)))
Features f2
&Vxaa C2
GDPD: Gradient Perceptual
Dissonance Penalty
FDP: Feature disalignement
Liotal = feteum
Mendr AyopLyor + AgpDpLErDP
Penalty
Update shared and (Q,) (BACT scheduling)
Figure 1: TriQDef overview. single shared backbone 0 is paired with multiple quantizers {Qa} (e.g., 32/8/2-bit). Clean and adversarial inputs produce bit-specific views whose intermediate fea- tures (for LFDP) and input gradients (for LGPDP) are contrasted across bit-widths. Losses are aggregated into Lotal and used update and {Qa} under BACT schedule. Inference uses single forward pass with the deployed Q (no runtime overhead).
3.2 FEATURE DISALIGNMENT PENALTY (FDP)
As we show in Section 2 adversarial patches remain highly transferable across quantized neural network (QNN) variants, despite the reduced numerical precision. We argue that this transferabil- ity is facilitated by a phenomenon we call semantic alignment across bit-widths-when internal representations across quantized models remain perceptually similar even under adversarial attack.
To assess this, we quantify perceptual similarity using two established descriptors: (i) edge-based overlap, computed using the Sobel operator and Intersection-over-
(IoU) (Zhang et al., 2018). and (ii) textural similarity, captured using Histogram of Oriented Gradients (HOG) (Dalal Triggs 2005), robust descriptor widely used in computer vision and feature analysis. Figure illustrates this behavior. Using
ResNet model on ImageNet, we analyze feature maps from clean and patched inputs across dif- ferent bit-widths (full precision (fp), 5bit, 4bit, 2bit) and multiple layers. We compute pair-
Edge loll Clean
Edge lou Adv
0:16
0.26
0.29
0.79
0.7
0.67
9.56
0.90
0.90
0.73
0.73
0.68
0.55
0.90
0.93
wise Edge loU and HOG Cosine Similarity as
0.29
0.2
0.20
9.56
0.39
0.36
5
0.20
0.27
0.27
0.95
0.99
0.93
perceptual proxies. Results averaged over 100 samples reveal consistently high similarity, es- pecially between adjacent quantization levels (e.g.. 5bit ++ 4bit), indicating strong structural alignment that supports cross-bit patch gener- alization. To mitigate this, we introduce the Feature Disalignment Penalty (FDP), a regu- larizer inspired by perceptual similarity metrics and soft alignment losses (Zhang et al.) 2018). Unlike defenses that learn patch-specific filters. FDP explicitly discourages feature alignment across quantized variants by penalizing struc- tural and textural similarity at selected inter- mediate layers during training. Let _!') (xaax) denote the activation at layer C of model fo with bit-width b, given patched input Talv. FDP measures both structural and textural alignment between models b; * by using two
1--00
rp-ds
1-220
Sowil
So-Co 4bw2b clean
Iwize
Sbatto Stw2b 4b-2b
HOG Cosine
HOG Cosine
Adv
0.72
0.74
5:92
0.54
0.72
0.74
0.75
0.73
0.05
5.67
0.71
0.73
22
0.75
0.73
5.56
0.80
0.73
0.73
0
0.65
0.71
0.73
5
0.70
0.80
tweb fpoch 9pot tiit (bwob dhech
Dizz (Biit Stwith dbois
Figure Perceptual Alignment Across Bit- Widths. Heatmaps show pairwise Edge IoU and HOG Cosine Similarity across feature maps ex- tracted at four convolutional layers in (L0-L33 from ResNet variants (fp. 5bit, 4bit, 2bit). High similarity persists even under adversarial input, enabling patch transferability.
4

---

Published as a conference paper at ICLR 2026
perceptual metrics: Edge IoU: Intersection-
over-Union between binarized Sobel edge maps of ,, HOG Cosine Similarity: Cosine similarity between Histogram of Oriented Gradient (HOG) descriptors.
The FDP loss is defined as:
CADP Σ
Σ
a a-IoU(E(Sh) (( (Iaa))), E(S,) E() (Iai))) B cos (waw)) ( (2ar)))) (x
(
(I)
IEC
CB
b
Because traditional perceptual metrics (e.g., hard thresholded edges, non-differentiable HOG) not suitable for gradient- optimization, we adapt recent differentiable approximations such as SoftDice (Sudre et al. 2017) and smooth HOG descriptors (Kachouane et al. 2012) to create an end-to-end trainable loss.
LADP Σ
Σ EB
a SoftDice (s (E (Jo² (mwar)) (((E) (xxo)))
1E
bi
B cos (H (xaci) ((ani)))
where E(-) computes Sobel edge magnitudes over spatial dimensions, S(.) applies soft binarization
using a sigmoid with quantile- threshold: S(A; k) = a (k- (A (A-T) TT) T =quantile( [A, q), 2- A-B
with sharpness & 100, percentile 85. SoftDice B) ل S B+c" H(-) computes
normalized HOG descriptor with pixels per cell and x 2 cells per block. = 0.5, , = weighting hyperparameters.
The choice of hyperparameters is based on ablation studies on their sensitivity (see Appendix C Why Use HOG Cosine Similarity? HOG captures local edge orientation distributions and is robust to minor quantization noise and scale distortions. We observe high HOG similarity across bit-widths. indiiatinnninnnng preserved structure This makes HOG strong candidate for identifying transferable perceptual patterns. Why Use Edge-based SoftDice? Edge loU offers structural insight, but hard binarization is non-differentiable. SoftDice over softly binarized edges ensures smooth gradients while preserving interpretability. It captures shape-level alignment that HOG may overlook.
when raw cosine similarity or Edge IoU degrade.
Why Not LPIPS? LPIPS, while widely used for perceptual similarity, is less suitable in our setting for several reasons. optimized for high-level semantic similarity based on human visual per- ception, making less sensitive to the structural and directional patterns found in gradient maps carly-layer features that underlic patch transfer- ability in quantized models. Moreover, LPIPS re- quires three-channel, large-resolution inputs and" cannot be directly applied to single-channel low-resolution feature maps or gradients. In
Algorithm 1: Compact FDP Training with Soft Disalignment Input
Quantized models {fo]-
adversurial patch P', batch
(z, 9), target layers M
Hyperparameters
Arar. a
Tal 4- a a)) foreach BBIE
P
(9) + --11 (xtar)
(1)
CeDP c- foreach (be, bz),
+ Sobal( [1 (1)
contrast, Edge IoU and HOG Cosine Similarity offer lightweight, interpretable, and structurally grounded measures. They effectively capture 7 spatial alignment (edges) and texture/orientation similarity (HOG) in both features and gradients,
F; mobal( (1 (1))
H. + SoftOG(! (() ) H; - SOfHOGG()
Law + a SoftDico E.,, E,) B cos(H,, H,)
making them more appropriate for quantifying and disrupting perceptual alignment across bit-widths.
Why FDP Works? By introducing bit-level perceptual disalignment at key layers, FDP disrupts shared internal cues that adversarial patches exploit. This effectively breaks the cross-bit repre- sentational invariance that makes patches transferable. This perceptual disalignment strategy com- plements adversarial training by targeting a root enabler of transferability- causferability-shhred shared structure across models-whie remains underexplored in the literature quantized model robustness (Li et al.
5

---

Published as a conference paper at ICLR 2026
2024
We provide theoretical motivation for the FDP in Appendix B.1 grounding its design in principles of perceptual alignment, representation similarity, and adversanal vulnerability across quantized models.
Training with FDP. Algorithm [ outlines our training procedure with the Feature Disalignment Penalty. For each batch, apply an adversarial patch and extract intermediate features from mul- tiple quantized models at selected layers. We then compute pairwise perceptual similarity using SoftDice over edge maps and cosine similarity over differentiable HOG descriptors. The total loss combines the standard cross-entropy with the FDP regularizer, guiding the models to develop diver- gent internal representations and weaken cross- bit adversarial transferability.
3.3 GRADIENT PERCEPTUAL DISSONANCE PENALTY (GPDP)
As shown in Table g although gradient cosine similarity (CS) is low across quantized models, sug- gesting directional disagreement, we observe persistently high perceptual similarity in the gradient maps. In particular, gradients exhibit strong HOG Cosine Similarity and moderate Edge IoU, reveal- ing a hidden perceptual alignment that traditional CS fails to capture. We posit that this alignment facilitates the transferability of adversarial patches between bit-width variants by preserving texture and edge structure in gradient saliency.
To address this, we propose the Gradient Perceptual Dissonance Penalty (GPDP), perceptual reg- ularizer designed to break gra- dient alignment across quantized models. GPDP penalizes both structural (edge-based) and textural irientatiionbassed similarity in gra- dients, promoting gradient diversity that weakens the transferability of patch-based attacks. Let V be the input gradient from a model quantized to bit-width b. We define the GPDP loss as:
Table 3: Gradient similarity across bit-width models using different metrics. Despite low cosine similarity, perceptual metrics (HOG Cosine and Edge IoU) reveal strong structural alignment.
Metric
fpe+5b
fp<>4
fp<+2b
5b<>4b
5bc+2b
4b:+2b
Cosine Sim.
0.05
0.06
0.05
0.25
0.10
0.13
Edge ToU
0.14
0.15
0.14
0.20
0.15
0.15
HÓG CS
0.81
0.81
0.80
0.82
0.81
0.81
COPDP
a SoftDice Sobbl + B cos ). (3)
Here, Sobel(-) computes edge maps from the gradient, and SoftHOG(() is differentiable version of the Histogram of Oriented Gradients (HOG) descriptor. SoftDice measures structural overlap, while the cosine of SoftHOG descriptors captures perceptual similarity. Coefficients and 3 balance these two components, with values set to a = 0.5 and 3 1.0 our experiments.
Why GPDP Works? Prior work (Yang et al. 2024 Tramèr et al., 2018) has shown that adver- sarial transferability is tightly linked to gradient alignment. However, our findings indicate that even when gradients are directionally divergent (low cosine similarity), transfer persists due to structural similarity. GPDP directly penalizes this perceptual consensus, targeting especially early- + layer gradient representations where saliency is concentrated. By diversifying gradient structure, 6
Algorithm 2: Training with GPDP
Input
Quantized models (/JbEs. input batch (rr, adverserial version Jugy Ageop- 0,
Hyperparameters Carve +-
foreach (hi, (h,, e if do
3
Si +- V V=Lar(fo, (Zat),
9j V v.fee(fe, (ra)))
Sobel().).
Sobel(g,)
H. + SofHHGG(g.. H, + SoftHOG((,)
GPDP reduces shared adversarial vulnerabilities' across widths. We theoretically justify GPDP
Carse += SoftDico E,) +
Hy)
in Appendix B.2 showing that perceptual alignment in gradient structure (not just cosine similarity) enables patch transferability across bit-widths, and disrupting this alignment significantly weakens cross-bit attacks.
Training with GPDP. Algorithm 2 describes how the Gradient Perceptual Dissonance Penalty is integrated into the training loop. For each pair of quantized models, we compute the input gradients and apply perceptual similarity losses, based edge structure and HOG texture, to penalize align-

---

Published as a conference paper at ICLR 2026
ment. These losses are aggregated and added the clean classification loss for joint optimization, thereby enforcing perceptual dissonance in gradient signals across bit-widths. We apply GPDP only adversarial inputs to avoid impacting clean accuracy. It complements the Feature Disalignment Penalty (FDP) by targeting the gradient-level alignment that FDP cannot capture.
We train with both clean and adversarially patched inputs. For a mini-batch (ar, y), patched input is constructed as Tadv = x O (1 - M) + P @ M, where M is a binary patch mask and P is either drawn from diverse offline pool of adversarial patches (default in our experiments) or optimized on-the-fly (see Appendix). For the currently active bit-widths B, (scheduled by BACT), we define Letean
|8 Eles, CCv (x) y), and Ladv |8, EbEB, (ce(f (Zadv), y).
The total training loss then combines clean classification, adversarial classification, and the proposed perceptual regularizers: Liotal Lelean + Andv Ladv + \FDP LEDP + ACPDP LGPDP. Unless otherwise noted, we use Aadv = LFDP and LGPDP are evaluated on adversarial inputs to disrupt feature- and gradient-level alignment under attack, while Letean preserves natural accuracy. We adopt a clean/adv mix ratio = 0.5, i.. half of each batch is patched to prevent over-regularization while ensuring the perceptual penalties remain attack-focused.
3.4 BIT- WIDT-IITTH-AEE AWARE CURRICULUM TRAINING (BACT)
Directly optimizing ultra-low-bit quantizers from scratch destabilizes training. BACT therefore stages the activation of quantizers while keeping one shared 8. We start with higher precision (e.g., 32/8-bit) to learn stable features, then introduce lower-bit quantizers (5/4/2-bit) by: (i) initializing their observers from short calibration passes on a held-out subset (no weight copy), and (ii) enabling them in B, for joint fine-tuning with the already-actin quantizers. This avoids maintaining multiple backbones, reduces memory, and enforces cross-bit coupling through 0, which empirically improves robustness and stabilizes LFDP/LCPps optimization. At inference, a single forward under the deployed bit-width 6* is used, yielding no runtime overhead and preserving integer-only deployment.
Model parameterization (shared backhone with switchable quantizers). Unless otherwise stated, TriQDef uses a single shared backbone with parameters (e.g., a ResNet trunk), and a set of bit -iits-si-- quantization modules Q = {Qu b E B} inserted at standard quantization points (activations after nonlinearities / selected blocks and all weight tensors). During a forward pass under bit-width b, the same backbone weights 0 are evaluated through the quantizers Qs using QAT with STE. Thus, all bit-widths share 8, while observers/scalee/zrooppiii points and any quantizer-specific buffers are maintained per b.
4 RESULTS AND ANALYSIS
4.1 EXPERIMENTAL SETUP
Datasets. We evaluate our proposed methods on two widely used benchmark datasets: CIFAR-
10 (Krizhessky| 2009) and ImageNe([Krizhessk et al. (2017).
Model Architectures. Our experiments cover a broad spectrum of architectures: ResNet-56,
ResNet-34, Res-et- and ResNet-18 (He et al. 2016), VGG-16 and VGG-19 (Simonyan & Zis-
serman 2015). Al AeexNet (Krizhevsky et al. 2017). Inception-v3 (Szegedy et al.] 2016), DenseNet- 121 (Huang et al., 2017). Swin-S (Liu al. 2021b) and DeiT-B (Touvron al. 2021 (used only
to evaluate patch transferability.
Patch-Based Attacks. To assess vulnerability to structured adversarial perturbations, we evaluate against several state-of-the-art match-based attacks: LAVAN]Kaman et al. (2018), Adversarial Patch
(GAP) (Brown et al.] 2017]. Deformable Patch Representation (DPR) (Chen al. 2022). and the black-box PatchAttack (Yang et 2020).
Implementation Details. All experiments are conducted using Py on NVIDIA A100 GPUs. We use batch size of 128 and train models with SGD (momentum 0.9, weight decay 1 x 10-4). The learning rate is initialized to 0.1 and decayed by a factor of 10 at 50% and 75% of training. Models are trained for 200 epochs on CIFAR-10 10 and 120 epochs on ImageNet.
Patch generation strategy. Unless otherwise specified, TriQDef employs an offline pool of adver- sarial patches generated on the full-precision model. The pool contains diverse variations in patch
7

---

Published as a conference paper at ICLR 2026
size. position, and target class, and patch P is randomly sampled and applied to each mini-batch during training. This approach balances efficiency with robustness, and aligns with our focus on transferabilityy across quantiization levels.
For ablation studies and adaptive settings, we also consider an on-the-fly patch generation procedure. Here, P is updated for K inner steps using Expectation over Transformation (EOT) with random location and geometric jitter. At each step, a bit-width ~ B, is sampled, and gradients are backpropagated through the shared backbone and Qs: P + 1p P + sign Vp a Σx= LCE (for (218)), ) v) ) where 1p projects P into the valid patch domain. This prevents overfitting to a single bit-width and strengthens robustness under adaptive attacks.
Quantization Setup. We use fake-quantization QAT with straight-through estimation (STE) for integer-only deployment [Esser et al.] (2020). We apply uniform symmetric quantizers: per-channel for weights and per-tensor for activations; zero-points are fixed to O, and scales are estimated via moving-average observers. Target bit-widths are B = {32, 8, 5, 4, 2): Q32 is the identity. Lower-bit Qo are progressively enabled via BACT with brief calibration before joint optimization.
FDP and GPDP Hyperparameters. The regularization coefficients are set as follows: ÄFDP 0.8, and AGPDP = 0.5. The used hyperparameters were selected based on ablation studies on their sensi- tivity (see Appendix Cp. We also discuss compute and memory cost Appendix [
4.2 CLEAN ACCURACY UNDER TRIQDEF ACROSS BIT- WID-WSSTHS
A critical goal of TriQ is to improve robust- ness without sacrificing clean accuracy. Table shows the clean performance of models trained with TriQDef' compared to Standard QAT and PBAT across multiple bit-widths. While ad- versarial training introduces slight accuracy drop, TriQDef maintains competitive perfor- mance, closely matching QAT and outperform- ing PBAT across both CIFAR-10 and Ima- geNet. Notably, TriQDef avoids the overfit- ting and degradation seen in PBAT at lower bit- widths, demonstrating its effectiveness in preserving model expressiveness while enhancing robust- ness.
Table 4: Clean accuracy (%) of ResNet-56
(CIFAR-10) and ResNet-34 (ImageNet).
Defense
Dataset
32bit
Clean Accuracy (%)
Sbit
4bit
2bit
Standard QAT
CIFAR-10
85.1
80.5
78.2
PBAT
CIFAR-
88.2
81.6
77.8
75.5
TriQDef (Ours)
CIFAR- 10
89.4
83.3
78.2
75.8
Standard QAI
ImageNet
85.2
79.3
17.3
13.9
PBAT TriQDef (Ours)
ImageNet
84.1
77.3
74.2
71.8
ImageNet
78.1
75.1
4.3 EFFECT OF BIT-WIDTH ON ADVERSARIAL ROBUSTNESS
We evaluate TriQDef's robustness across multiple quantization levels (32bit, Sbit, 4bit, 2bit) using three representative patch-based attacks: LAVAN, GAP, and the more adaptive black-box PatchAt- tack. For each attack, results are reported on CIFAR-10 10 and ImageNet, and we compare against two strong baselines: PBAT and DWQ. In addition to the seen-patch setting, where patches drawn from the same distribution used during training, we also evaluate on unseen patches, defined as patch configurations (size, location, generation bit-width) that were not encountered during train- ing. This allows us to measure generalization and robustness against patch overfitting. The reported ASR values reflect an average across diverse variations in patch size, spatial placement, and attack generation settings. Across all attacks and quantization levels, TriQDef consistently achieves the lowest ASR. Even under aggressive 2-bit quantization, TriQDef reduces ASR by over 20% com- pared to PBAT and by more than 50% compared to DWQ. On unseen patches. TriQDef maintains strong generalization, with only a marginal increase in ASR (e.g., +2.1% on CIFAR- 10 under GAP), compared to PBAT's much larger degradation (often exceeding + +15).. Importantly, TriQDef also shows resilience against the more challenging PatchAttack, which dynamically adapts patches in a black-box manner. Here, TriQDef achieves up to a 40-50% reduction in ASR relative to PBAT and DWQ, confirming that our perceptual misalignment regularization prevents cross- cross-bitwide bitwidth patch transfer even when the attacker does not share access to the training pipeline. These results demon- strate that Tri is not only effective against standard patch generation methods (LAVAN, GAP), but also extends its robustness adaptive, transferable, and black-box patch attacks across extreme
8

---

Published as a conference paper at ICLR 2026
quantization levels. Additional experiments alternative architectures and diverse attack variants are provided in Appendix C
Table 5: ASR (%) under LAVAN (6x6 patches on CIFAR-10, 10, 50x50 patches ImageNet), GAP, and PatchAttack across bit-widths and patch generalization settings. Lower is better.
Defense
Dataset
LAVAN
GAP
PatchAttack
32bit
5bit
4bit
2bit
32bit
5bit
Abit
2bit
32bit
5bit
4bil
2bit
PBAT
CIFAR-I0
51.4
46.7
43.2
39.7
48.7
43.5
40.1
37.9
61.2
57.5
53.1
49.7
DWQ
CIFAR-10
87.9
82.4
77.2
76.4
85.4
80.9
75.6
73.5
89.6
84.3
79.8
78.2
TriQDef
CIFAR-10
32.4
30,2
26.2
PBAT (Unseen)
CIFAR-I0
77.2
73.7
67.8
65.3
75.3
71.2
66.9
63.2
82.3
78.5
72.6
70.1
DWQ (Unseen)
CIFAR-10
87.8
82.6
77.9
76.3
86.1
80.3
75.2
72.3
79.2
77.3
TriQDef (Unseen)
CIFAR-10
35.6
33.3
29.1
27.3
32.5
30.8
27.3
25.5
46.1
28.2
25.7
23.5
PBAT
ImageNet
53.4
49.2
50.2
46.1
39.8
35.4
63.8
54.3
DWQ TriQDef PBAT (Unseen)
ImageNet
86.7
71.3
63.5
61.2
85.3
70.5
61.4
59.5
88.5
72.6
65.1
62.7
ImageNet
35.0
33.1
31.1
28.5
33.2
28.1
26.3
23.1
47.2
30.5
27.6
25.1
ImageNet
78.5
73.7
67.2
64.6
76.5
71.3
65.7
62.1
82.7
76.3
70.5
67.8
DWQ (Unseen)
ImageNet
86.9
72.3
62.4
60.2
84.3
61.7
58.2
87.
72.0
64.2
61.5
TriQDef (Unseen)
ImageNet
37.1
35.3
32.5
30.7
39.4
37.3
34,5
32.9
49.5
33.6
30.2
28.4
4.4 TRIQDEF Vs. INFERENCE- TIME PREPROCESSING DEFENSES
Existing inference-time preprocessing defenses, such Jedi (Tarchoun al., 2023), tailored for full-precision models and rely on high-resolution entropy maps and intermediate features to localize and inpaint adversarial patches. These methods face critical limitations in the quantized setting: reduced bit precision in QNNs severely degrades feature granularity and dynamic range, making entropy-based localization unreliable. Moreover, Jedi's inpainting modules (e.g., autoen- coders) introduce floating-pott dependencies and computational overhead incompatible with the low-latency, integer-only constraints of edge deployments. DiffPure (Nie et al.) (002)). a purification- based defense that leverages score-based diffusion models, performs even worse under patch-based attacks. Diffusion purification assumes pixel-level noise distributions and struggles with the large, structured perturbations introduced by adversarial patches, leading to weak robustness (Table 6
In addition, DiftPure is computationally prohibitive: it requires between 5.58 and 17.14 seconds per Im- ageNet image and over 7 GB of GPU memory dur- ing inference, making it unsuitable for real-time resource-constrained settings. In contrast, TriQDef monining-lime-onte defense with no inference-time overhead. It maintains full compatibility with quan- tized and resource-constrrr constraiee environments while de- livering consistently higher robust accuracy across all bit-widths.
Table 6: Robust Accuracy (%) under LA- VAN attack on ImageNet (ResNet-50) for different defenses across quantization lev-
els. Higher better.
Delense
Type
32bit
2bit
PBAT (2020)
Training
53.4
37.1
PRCAT (2025)
Training
57.8
41.2
DuffPure (2024)
Pre-proc
41.7
19.6
IEDI (2023)
Pre-pric
64.3
23.4
On ImageNet, TriQDef consistently outperforms all recent patch-based training and purification methods while maintaining no inference overhead, confirming its strong position among modern defenses.
TriQDef (Ours)
Training
78.3
65.8
4.5
IMPACT OF TRIQDEF COMPONENTS
We perform ablation study by removing each TriQDef component. Without FDP, ASR rises sharply (e.g., 55.9% on CIFAR-10 and 52. 1% on ImageNet at 2-bit), showing that cross-bit semantic alignment remains intact and enables strong patch transfer. Without GPDP, ASR increases by over 10% across settings, confirming that disrupting gradient alignment is critical for limiting cross- bit optimization. Full TriQDef achieves the lowest ASR both datasets and maintains generalization to unseen patches with only minor degradation, highlighting the complementary roles of FDP and GPDP in breaking semantic- and gradient-level transferability.
4.6 SEMANTIC INTEGRITY ANALYSIS OF FDP
To ensure that the proposed Feature Disalignment Penalty (FDP) does not negatively affect the model's semantic reasoning, conducted explicit semantic-integrity evaluation across floating-

---

Published as a conference paper at ICLR 2026
Table 7:
Ablation study: ASR (%) of LAVAN attack across bit-widths CIFAR-I0 (ResNNet-56)
and ImageNet (ResNet-34) under seen and unseen patch settings. Lower is better.
Config
Seen/Unseen
CIFAR-I0
ImageNet
32b
5b
4b
2b
32b
5b
46
2b
w/o FDP w/o GPDP
Seen
65.2
61.1
59.7
55.9
68.7
60.2
55.3
52.1
Seen
43.2
41.7
39.4
37.6
48.6
46.8
44.2
42.5
Full TriQDef
Scen
32.4
30.2
28.4
26.2
35.0
33,1
31.1
28.5
w/o FDP
Unseen
65.2
61.1
59.7
55.9
68.7
60.2
55.3
52.1
w/o GPDP
Unseen
48.8
46.9
43.7
41.8
42.6
40.8
37.5
35.6
Full TriQDef
Unseen
35.6
33.3
29.1
27.3
37.1
35.3
32.5
30.7
point and quantized variants. FDP is applied only early-mid layers (LI-L3), where features primarily encode structural cues (edges, textures), while higher-level semantic layers and the clas- sifier head remain unconstrained. This design prevents semantic drift during training by localiz- ing disalignment to structural channels. Furthermore, FDP is jointly optimized with the standard cross-entropy loss, which anchors llas-discrimmnnttie representations and preserves each model's intra-bit semantic alignment. Empirically, observe < 1% clean-accuracy deviation from stan- dard QAT, indicating that task-relevant semantics remain intact. To validate this visually, Grad-CAM maps for fp, int5, int4, and int2 models (Fig. 3) consistently highlight the same salient object regions (e.g.. fish body, shark contours), with no evidence attention fragmentation or background drift. These observations confirm that FDP successfully reduces cross-bit perceptual similarity- fac- tor enabling patch transferability while preserving stable and coherent semantic localization within each bit-width model.
Figure 3: Grad-CAM visualizations for the floating-point model and its 5-bit, 4-bit, and 2-bit quan- tized variants. Across all bit-widths, the models consistently attend to the same semantically relevant regions, confirming that FDP does not introduce semantic drift.
CONCLUSION
We presented TriQDef, a principled defense framework aimed at mitigating the transferability of patch-based adversarial attacks in QNNs. TriQDef combines three synergistic components (FDP, GPDP, and BACT) to explicitly dismantle semantic and gradient-level alignment across bit-widths. Unlike prior defenses that rely on adversarial patch augmentation, TriQDef targets the root cause of patch transferability by disrupting both feature- and gradient-level consensus among quantized models. Our experiments show that TriQDef' significantly reduces attack success rates across unseen patches and bit-width combinations, while preserving clean accuracy and avoiding inference-tine time overhead. These findings highlight the overlooked role of perceptual and structural alignment in enabling adversarial generalization across guantization levels. By addressing these vulnerabilities at training time, TriQDef sets new direction for robust QNN design.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work was supported in parts by the NYUAD Center for Cyber Security (CCS), funded by Tamkeen under the NYUAD Research Institute Award G1104.
REFERENCES
Tom B. Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch.
CoRR, abs/1712.006655, 2017. URL httth:tt:///// //tp://aaivvvvv..i org/ abs /atss//111.. 09665
Zhaoyu Chen, Bo Li, Shuang Wu, Jianghe Xu, Shouhong Ding, and Wenqiang Zhang. Shape mat- ters: deformable patch attack. European conference on computer vision, pp. 529-548. Springer, 2022.
N. Dalal and B. Triggs, Histograms of oriented gradients for human detection. In 2005 IEEE Com- puter Society Conference on Computer Vision and Pattern Recognition (C),R'0S), volume 1, pp- 886-88 893 vol. 1, 2005. doi: 10.1 1..11092....2205.177
Steven K. Esser, Jeffrey L.. McKinstry, Deepika Bablani, Rathinakumar Appuswamy, and Dhar- mendra S. Modha. Learned step size quantization. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020.
URL BKKLhttps://ppereeeaae
Stanislav Fort, Huiyi Hu, and Balaji Lakshminarayanan. Deep ensembles: A loss landscape per- spective. CoRR, abs/1912.02757/ 2019. URL http: / aas// 02757
Yonggan Fu, Qixuan Yu, Meng Li, Vikas Chandra, and Yingyan Lin. Double-win quant: Aggres- sively winning robustness of quantized deep neural networks via random precision training and inference. In International Conference on Machine Learning, pp. -992-3504. PMLR, 2021.
Amira Guesmi, Muhammad Abdullah Hanif, Bassem Ouni, and Muhammad Shafique. Physical adversarial attacks for camera-base based smart systems: Current trends, categorization, applications, research challenges, and future outlook. IEEE Access, 2023.
Amira Guesmi, Ruitian Ding, Muhammad Abdullah Hanif, Ihsen Alouani, and Muhammad Shafique. Dap: A dynamic adversarial patch for evading person detectors. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 24595-254445 24604, 2024.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In Proceedings of the IEEE conference computer vision and pattern recognition, pp- 770-778, 2016.
Nicolás Hernnndzz, Francisco Almeida, and Vicente Blanco. Optimizing convolutional neural net- works for iot devices: performance and energy efficiency of quantization techniques. The Journal of Supercomputing, pp. 1 1-20, 2024.
Sara Hooker, Dumitru Erhan, Pieter-Jan Kindermans, and Been Kim. benchmark for interpretabil- ity methods in deep neural networks. Advances in neural information processing systems, 32, 2019.
Gao Huang, Zhuang Liu, Laurens van der Maaten, and Kilian Q Weinberger. Densely connected convolutional networks. In 2017 IEEE Conference on Computer Vision and Pattern Recognition, CVPR 2017, Honolulu, HI. USA. July 21-26, 2017, pp. 2261 IEEE Computer Society, 2017. doi: 2.11099CCVR.2017..22 URL. httpt:tttss.. /oi wrg. 11099//111000///.. 2017. 243
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. Advances in neural information processing systems, 32, 2019.
M Kachouane, S Sahki, M Lakrouf, and N Ouadah. Hog based fast human detection. In 2012 24th International Conference Microelectronics (ICM), pp. 1-4. IEFF, 2012.
11

---

Published as a conference paper at ICLR 2026
Danny Karmon, Daniel Zoran, and Yoav Goldberg. Lavan: Localized and visible adversarial noise. In International conference on machine learning, pp. 2507-2515, PMLR, 2018
Dewant Katare, Diego Perino, Jari Nurmi, Martijn Warnier, Marijn Janssen, and Aaron Yi Ding. A survey on approximate edge ai for energy efficient autonomous driving services. IEEE Commu- nications Surveys & Tutorials, 2023.
Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, 2009.
Alex Krizhevsky, llya Sutskever, and Geoffrey E Hinton. Imagenet classification with deep convo- lutional neural networks. Communications of the ACM, 60(6):84-90, 2017.
Qun Li. Yuan Meng, Chen Tang, Jiacheng Jiang, and Zhi Wang. Investigating the impact of quantiza- tion on adversarial robustness. CoRR, abs/2404 05639, 2024. doi: 10.48550/ARXXV.244..055
URL https: /ttp:::::////o.o//////////////
(0555//axxi:0 2404. 05639
Hantao Liu, Ying He, F Richard Yu, and Jeremy James. Flexi-compression: a flexible model com- pression method for autonomous driving. In Proceedings of the 11th ACM Symposium Design and Analysis of Intelligent Vehicular Networks and Applications, pp. 19-26, 2021a.
Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang. Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 10012-10022, 2021b.
Chunchuan Lyu, Kaizhu Huang, and Hai-Ning Liang. A unified gradient regularization family for adversarial examples. In 2015 IEEE international conference on data mining, pp. 301-309. IEEE, 2015.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In 6th International Conference on Learning Representations, ICLR 20/8, Vancouver, BC, Camada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL htt.tttss//pppeeeeeeeee
Forum?id=rJzI31
Dongyu Meng and Hao Chen. Magnet: a two-pronged defense against adversarial examples. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp. 135-147, 2017.
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning (ICML), 2022.
Sukrut Rao, David Stutz, and Bernt Schiele. Adversarial training against doccation-opimiinn adver- sarial patches. In European conference on computer vision, pp. 429- Springer, 2020.
Sanchari Sen, Balaraman Ravindran, and Anand Raghunathan. EMPIR: ensembles of mixed pre- cision deep networks for increased robustness against adversarial attacks. In 8th International Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. OpenReview.net, 2020. URL
net./ ftettffooe forum? wtt.orummmdeeeee3333
Karen Simonyan and Andrew Zisserman. Very deep convolutional networks for large-scale image recognition. In Yoshua Bengio and Yann LeCun (eds.), 3rd International Conference Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceed- ings, 2015. URL
http://wwwxww.oo/abb/////a// /1aaaa/s/499.. 1556
Chang Song, Elias Fallon, and Hai Li. Improving adversarial robustness in weight-quantized neural networks. arXiv preprint arXiv:2012. /4965, 2020.
Carole H. Sudre, Wenqi Li. Tom Vercauteren, Sébastien Ourselin, and M. Jorge Cardoso. Gener- alised dice overlap as a deep learning loss function for highly unbalanced segmentations. CoRR, abs/1707.03233 2017. URL.tttp //t::///xxxvi wwwpwiiooorggas.. www./rs///////ooooro.ooo//aaaeee 707. 03237
12

---

Published as a conference paper at ICLR 2026
Christian Szegedy, Vincent Vanhoucke, Sergey loffe, Jon Shlens, and Zbigniew Wojna. Rethink- ing the inception architecture for computer vision. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.
2016.
Bilel Tarchoun, Anouar Ben Khalifa, Mohamed Ali Mahjoub, Nael Abu-Ghazaleh, and Ihsen Alouani. Jedi: Entropy-based localization and removal of adversarial patches. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 4087-4095, 2023.
Nicola Tonellotto, Alberto Gotta, Franco Maria Nardini, Daniele Gadler, and Fabrizio Silvestri. Neural network quantization in federated learning at the edge. Information Sciences, 575:417-
436, 2021.
Hugo Touvron, Matthieu Cord, Matthijs Douze, Francisco Massa, Alexandre Sablayrolles, and Hervé Jégou. Training data-efficient image transformers & distillation through attention, 2021.
URL
12877
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick Mc- Daniel. Ensemble adversarial training: Attacks and defenses. arXiv preprint arXiv:
2017a.
Florian Tramèr, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. The space of transferable adversarial examples. arXiv preprint
2017b.
Florian Tramèr, Alexey Kurakin, Nicolas Papernot, Ian J. Goodfellow, Dan Boneh, and Patrick D. McDaniel. Ensemble adversarial training: Attacks and defenses. In 6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 May 3, 2018, Conference Track Proceedings. OpenReview.net, 2018. URL attpps://opentevier..n
Tongzhou Wang and Phillip Isola. Understanding contrastive representation learning through align- ment and uniformity on the hypersphere. In International conference on machine learning, pp. 9929-9939. PMLR, 2020.
Yisong Xiao, Aishan Liu, Tianyuan Zhang, Haotong Qin, Jinyang Guo, and Xianglong Liu. Ro- bustmq: benchmarking robustness of quantized models. Visual Intelligence, 1(1):30, 2023.
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint N.t::1704.01155. 2017.
Chenglin Yang, Adam Kortylewski, Cihang Xie, Yinzhi Cao, and Alan Yuille. Patchattack: black- box texture-based attack with reinforcement learning. In European Conference Computer Vision, pp. 681-698. Springer, 2020.
Yulong Yang, Chenhao Lin, Qian Li, Zhengyu Zhao, Haoran Fan, Dawei Zhou, Nannan Wang, Tongliang Liu, and Chao Shen. Quantization aware attack: Enhancing transferable adversarial attacks by model quantization. IEEE Transactions on Information Forensics and Security, 2024.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586-595, 2018.
Rongzhao Zhang and Albert CS Chung. Medq: Lossless ultra-low-bin neural network quantization for medical image segmentation. Medical Image Analysis, 73:102200, 2021.
13

---

Published as a conference paper at ICLR 2026
APPENDIX
A EXTENDED PATCH TRANSFERABILITY RESULTS
A.1 CROSS-ARCIITECTURE TRANSFER EVALUATION
Patch-based adversarial attacks not only persist across different quantization bit-widths but also hibit strong cross-architecture transferabilitty making them a severe security threat in real-world black-box settings. To evaluate this phenomenon, we generate adversarial patches on base archi- tecture (e.g., ResNet-20 at 32-bit precision) and transfer them to models with different architectures (e.g., ResNet-56, VGG-16, and VGG-19) trained with QAT at various bit-widths (8-bit, 5-bit, 4-bit, combination to assess
and 2-bit). The Attack Success Rate is recorded for each architecture-bittee the transferability of adversarial patches across both architectural and quantization changes.
Table 8: ASR (%) transfer across different QNNs with various bit-widths and architectures on CIFAR-10.
Target: ResNet56
Target: VGG-19
Source
32bit
8bit
4bit
2bit
32bit
8bit
4bit
2bit
ResNet20
84.17
79.62
77.66
75.21
78.82
74.53
72.15
70.21
Target: ResNet20
Target:
VGG-19
Source
32bit
8bit
4bit
2bit
32bit
8bit
4bit
2bit
ResNet55
84.11
77.67
75.33 71.76
77.43
75.09
73.82
71.22
Target:
ResNet20
Target: VGG-16
Source
32bit
8bit
4bit
2bit
32bit
8bit
4bit
2bit
VGG-19
83.23
80.87
78.11
75.32
85.32
80.42
78.23 76.44
Target:
VGG-19
Target: ResNet56
Source
32bit
8bit
4bit
2bit
32bit
Shit
4bit
2bit
VGG-16
83.29
78.48
76.65
74.39
80.55
78.93
75.34
73.87
As presented in Table 8 a patch generated on ResNet--20 achieves 84.17% attack success rate on 32-bit ResNet-56 and 78.82% on 32-bit VGG-19, Patches created on VGG-19 and VGG-16 maintain high success rates when tested on ResNet architectures, confirming their strong architeccee transferability. Even at low-bit settings (e.g., 2-bit), patches retain attack success rates above 70%, highlighting their resilience under quantization-indue transformations.
A.2 PATCH TRANSFERABILITY UNDER POST- TRAINING QUANTIZATION (PTQ)
We next evaluate patch transfer PTQ models on ImageNet using ResNet-18 and ResNet-34. Ta- ble 9 shows that even at 2-bit precision, patches maintain over 50% ASR. These findings confirm even that dit- reduction even without adversarial training does not inherently block patch effec- tiveness.
Table ASR (%) of LAVAN patches under PTQ on ImageNet ResNet models.
ResNet-34
ResNet-18
NP
32bit
5bit
4bit
2bit
32bit
5bit
4bit
2bit
0.10
99.31
66.32
63.36
56.31
99.98
72.63
67.89
65.76
0.08
98.08
64.91
59.97
52.25
99.93
66.37
61.11
55.42
0.06
97.12
64.79
57.31
50.43
96.01
58.20
53.59
51.84
A.3
TRANSFORMER ARCHITECTURES ARE EQUALLY SUSCEPTIBLE
Table 10 presents the vulnerability of transformer- based models (specifically Swin-S and DeiT-B) quantized using post-training quantization (PTQ) techniques. We evaluate both MinMax and Per- centile calibration methods under two patch-based attacks: LAVAN and GAP. Despite being struc-
14

---

Published as a conference paper at ICLR 2026
turally distinct from convolutional architectures, these models remain highly susceptible to adver- sarial patches, with attack success rates (ASR) exceeding 60% even in their 8-bit quantized forms. These results underscore the generality of patch-based threats across architectural paradigms. The persistence of high ASR across different calibration methods and both attacks suggests that trans- former quantization does not inherently mitigate adversarial vulnerability, reinforcing the necessity of robust, architecture-agnosii defenses such as TriQDef.
Table 10: ASR (%) of LAVAN and GAP (50x50 patches) on PTQ Swin-S and DeiT-B evaluated on ImageNet. Results are shown for MinMax and Percentile calibration methods.
Attack
LAVAN
GAP
Model
Calibration
32bit
8hit
32bit
8hit
Swin-S
MinMax
91.80
62.11
85.32
59.84
Swin-S
Percentile
93.10
63.72
87.19
61.23
DeïT-B
MinMax
93.63
64.76
88.03
62.44
DeiT-B
Percentile
90.12
61.51
84.37
58.73
A.4 PATCH TRANSFERABILITY UNDER DYNAMIC QUANTIZATION (DQ)
To evaluate the effectiveness adversarial patches under more flexible deployment settings, we as- sess attack success rates (ASR) on dynamically quantized (DQ) 8- bit models. Unlike static quantiza- tion, DQ applies quantization to weights at runtime, commonly used for latency-efficient inference on general-purpose CPUs.
Table TTblee[I]pa presents ASR results for LAVAN and GAP attacks on various CIFAR-10 10 models, compar- ing full-precision (32-bit) and dynamically quantized 8-bit versions. The results demonstrate that patch-based attacks retain high transferability and effectiveness, even under dynamic quantization schemes. Notably, models like ResNet-20 and VGG variants still suffer from ASR values exceed- ing 70% in many cases, with minimal degradation compared to their 32-bit counterparts. These findings emphasize that dynamic quantization alone is insufficient to mitigate the threat of physical adversarial patches. Thus, defenses like TriQDef remain essential even in low-bit dynamic settings.
Table 11: ASR (%) of LAVAN and GAP attacks (6x6 patches) across dynamically quantized 8-bit models on CIFAR-10. Despite runtime quantization, adversarial patches maintain high transferabil- ity.
Model
ResNet-56
ResNet-20
VGG-19
VGG-16
Bit
32bit
8bit
32bit
Sbit
32bit
Sbit
32bit
Shit
LAVAN
86,43
84.03
87.22
83.29
88.95
76.33
87.17
71.58
GAP
84.40
82.40
84.71
53.76
95.71
54.12
95.79
41.78
B THEORETICAL JUSTIFICATION
In this section, we provide a theoretical justification for FDP and GPDP.
B. THEORETICAL JUSTIFICATION FOR FEATURE DISALIGNMENT PENALTY (FDP)
FDP is grounded in theoretical principles from adversarial robustness, representation learning, and gradient alignment. It is designed to break a key enabler of patch-based attack transferability: the semantic alignment of internal representations across quantized models.
Transferability via Representation Alignment. Let fo denote a model quantized to bit-width b B, and let f(() (x) denote its activation at layer 1. Let Tady be an adversarially patched input crafted fool a surrogate model fo.. The patch transfers successfully to a target model f6, if:
(1) (10 (Fadr) 163 (Fadr)
Sbg (Iant) Sog (Madd))
15

---

Published as a conference paper at ICLR 2026
Le., shared internal features lead to similar high-level decisions. Thus, representational alignment is a sufficient condition for adversarial patch transfer. FDP aims to break this alignment by minimizing:
FFD x
Σ
Σ
Sim(f (Fadd, (Radv), S. (Fadv)),
bigbly
which encourages divergence of internal features across bit-widths, especially for adversarial inputs.
Representation Learning Perspective. From the perspective of representation learning, FDP functions similarly contrastive loss. By penalizing similarity between features of different mod- els on the same input, promotes feature decorrelation across quantized variants. This aligns with findings from contrastive learning Wang Isola (2020) and ensemble robustness Fort et (2019) where diversity in intermediate representations improves generalization and robustness.
Gradient- Based Justification. FDP also implicitly induces gradient disalignment. Since input gradients are function of intermediate features (via backpropagation) dissimilarity internal ac- tivations leads to divergence in V=L(fo(x), y). This weakens the ability of patch optimized on fo. to be effective on fozi
(!l) (Iavt) o6 fby (Fadv)
v,C(fo,) x V
thus reducing gradient-base based attack transferability.
Saliency and Interpretability Alignment. Prior work Zhang et al. (2018); Hooker et al. (2019)
suggests that robust models exhibit unique and spatially localized saliency patterns. By minimizing perceptual similarity across feature maps (c.g., via HOG and edge-based metrics), FDP reduces the spatial overlap of vulnerable regions across quantized models. This discourages universal patch activation across the bit spectrum.
In summary, FDP is theoretically justified because it:
Breaks the sufficient condition of cross-model feature alignment.
Encourages bit-specific feature specialization via contrastive-like loss.
Induces input gradient divergence across bit-widths.
Prevents shared saliency patterns, lowering cross-bit bit patch vulnerability.
These principles collectively reduce adversarial patch transferability across quantized neural net- works.
B.2 THEORETICAL JUSTIFICATION OF GPDP
The effectiveness of adversarial examples is largely attributed to the alignment gradient directions across models Tramer al. (017b)) Lyu al. (015).. In the of quantized neural networks (QNNs), despite differences in numerical precision, adversarial perturbations often transfer between bit-widths because the input gradients of different QNNs remain structurally and perceptually sim- ilar-even when their cosine similarity low (see Table 3}. This perceptual alignment enables an adversarial patch optimized on one quantized model activate similar vulnerable patterns in another.
Let bb denote the gradient of quantized model with bit-width 6, with respect input x, and let Auay (x) = x + 8 denote an adversarial transformation computed using gradient ascent:
I = e sign( ( L(fo,
The success of on a different model fa, depends on the local alignment between bb. and V Ilyas et al. (209)). While cosine similarity measures vector alignment, it fails capture local structural and textural similarities that are critical for patch-based attacks, which rely on spatially localized perturbations.
16

---

Published as a conference paper at ICLR 2026
We define the following perceptual similarity maasea decomposition of transferability:
T(b; - by) cos
V
directional
EdgeloU
spatial
cos (HOG(V?) HOG(
textural simmilarit
This shows that transferability arises not only from vector similarity but also from perceptual con- sensus gradient maps. Thus, reduce cross-bit adversarial success, we must disrupt both the directional and perceptual agreement in gradients.
The Gradient Perceptual Dissonance Penalty (GPDP) does precisely this by penalizing:
Structural similarity via differentiable Edge loU between edge maps of Vb. and V
Textural similarity via cosine similarity between soft HOG descriptors of gradients.
By introducing gradient-level dissonance across QNNs, GPDP increases the difficulty of crafting perturbations that remain effective across models, thus mitigating cross-bit transferability. This aligns with theoretical findings Tramer et al. (2017b); Ilyas et al. (2019) that successful transfer- ability relies shared gradient-based decision boundaries.
Therefore, GPDP principled regularizer that enforces gradient-space fragmentation, comple- menting FDP's feature-space disalignment to build more comprehensive defense.
C ADDITIONAL ABLATION STUDIES
C.I HARD VS. SOFT PERCEPTUAL METRICS
To validate choice of perceptual alignment losses used in FDP and GPDP, compare the behavior of hard metrics monndiifeerentialle) such as Edge Intersection-over Union (Edge IoU) and HOG Cosine Similarity with their soft, differentiable counterparts: SoftDice and SoftHOG Cosine. The goal to measure structural similarity between feature maps and gradients across models quan- tized to different bit-widths.
Hard Metrics. As shown in Table 12 Edge loU and HOG Cosine reveal significant perceptual alignment between bit-width variants, especially for nearby pairs such as 5bit 4bit. For instance, in layer L3. convl. all intra-quantized model pairs yield an Edge IoU of 1.0 (indicating perfect edge alignment) while HOG similarities frequently exceed 0.8. However, such saturation diminishes their utility for gradient-base optimization and weakens their discriminative power, particularly in deeper layers.
Soft Metrics. In contrast, SoftDice and SoftHOG produce smoother, more nuanced similarity landscape across both shallow and deep layers. For example, in Lo convl, SoftDice similarity be- tween int5 <>> 4bit is 0.86, while the cross-bit pair fp 2bit yields significantly lower score of 0.50. This dynamic range allows us to effectively penalize both low-free fow-frequency and high-frequency struc- tural similarities in the loss function. Moreover, unlike hard metrics, soft variants avoid saturation and remain responsive throughout training, making them highly suitable for alignment regulariza- tion.
Justification for Loss Design. These results support our design choice to adopt SoftDice and Soft- HOG in both FDP and GPDP. They provide differentiable approximations of perceptual similarity while capturing critical edge and texture-level redundancies across quantized models, precisely the structural alignments that enable patch transferability.
17

---

Published as a conference paper at ICLR 2026
Table 12:
Comparison of Hard (Edge IoU, HOG Cosine) Soft (SoftDice, SoftHOG) metrics
between bit-width variants in early layers. Shown: similarity scores for selected pairs in convl.
Metric
Pair
L0.conv1
L1.couv1
L2.conv1
Edge IoU
32bit <+ 5bit
0.2464
0.7367
0.2802
SoftDice
32bit <+> Sbit
0,4492
0.2697
0.6214
HOG Cosine
32bit 4+ Sbit
0.7177
0.7536
0.6900
SoftHOG
32bit Sbit
0.7214
0.7614
0.7116
Edge IoU
5bit 6- 4bit
0,8094
0.9576
0.9872
SoftDice
5bit 4bit
0.8638
0.7776
0.8634
HOG Cosine
5bit 4bit
0.9145
0.8664
0.8004
SoftHOG
5bit ++ 4bit
0.9163
0.8709
0.7931
C.2 SENSITIVITY TO LOSS HYPERPARAMETERS
To evaluate the sensitivity of TriQDef to its loss hyperparameters, we conduct an ablation study by varying the weights associated with its two main components: Feature Disalignment Penalty (FDP) and the Gradient Perceptual Dissonance Penalty (GPDP). Specifically, we analyze the impact of scaling coefficients (a, 3) for bit-aware patch training and (ArDe, ΛGPDP) for perceptual alignment disruption across multiple quantization levels.
We report the clean accuracy and adversarial robustness (ASR %) under the LAVAN attack (6x6 patches) CIFAR- 10 across 32-bit, 5-bit, 4-bit, and 2-bit models. The setting Clean refers to clean input evaluation, while Ady denotes adversarial inputs.
Table 13: Average Model accuracy (%) under clean and adversarial settings (LAVAN 6x6 patch) on CIFAR-10 across bit-widths, varying alignment and patch generation loss coefficients. Higher is better.
Param.
Values
Setting
32bit
5bit
4bit
2bit
(a.3)
(1.0,1.0)
Clean
82.1
75.4
71.2
68.3
(a,9)
(1,0,100
Adv
53.8
51.4
50.6
49.1
(a.9)
(0.5,1.0)
Clean
84.2
80.3
79.9
77.8
(a.9)
(0.5,1.0)
Adv
50.0
47.5
45.2
42.1
(a,9)
(1.0,0.5)
Clean
85.2
78.1
75.1
72.5
(a,9)
(1.0,0.5)
Adv
54.86
52.0
53.2
52.7
(AuDeAGree))
(1.0, 1.0)
Clean
80.7
69.3
64.8
61.5
(ApDP.AaroP)
(1.0, 1.0)
Adv
42.1
40.2
40.1
39.0
(Aupe.Arue)
(0.5.0.8) 0.8)
Clean
87.6
80.5
76.1
73.4
(AFDE.AAPDe)
(0.5, 0.8)
Adv
50.8
43.7
41.3
40.2
(CpDD)
(0.8 0.5)
Clean
85.2
78.1
75.1
72.5
(AspeeAcrpe))
(0.8 0.5)
Adv
54.86
52.0
53.2
52.7
Table 13 presents a detailed ablation study analyzing the impact of the patch generation losses (a, 3)) and the alignment regularization weights (AFDP, AGPDP) on clean and adversarial accuracy across different quantization levels on CIFAR-10.
Patch Loss Weights (a, 8): The configuration (1-0, 1.0) offers moderate clean accuracy but exhibits reduced robustness under attack (3.8%% at 32-bit). Lowering 0.5 as in (1.0, 0.5)-improves both clean and adversarial accuracy across bit-widths. This sug- gests that deemphasizing -it-wicth- loss during patch generation helps create per- turbations that generalize better across quantized models. Conversely, the setting (0.5, 1.0) yields the highest clean accuracy (up to 79. 99.9% at b-t),, but the cost of significant robust- ness degradation, indicating trade-off between clean accuracy and adversarial resistance.
Disalignment Loss Weights (AEde. >GrDr): Strong penalties (e.g.. (1.0, 1.0)) reduce both clean and adversarial performance, likely due to training instability or over-regularization. Moderate weights such as (0.5, 0.8) enhance clean accuracy and slightly improve robust- ness. The configuration (0.8, 0.5) emerges as the most balanced setting, offering strong
18

---

Published as a conference paper at ICLR 2026
clean accuracy and the lowest adversarial degradation (e.g.. 54.86% 32-bit, 52.0% 5-bit), supporting its selection as the default configuration TriQDef.
Consistency Across Bit-Widths: The observed trends are consistent from 32-bit 2-bit, demonstrating that TriQDef maintains its effectiveness even in extreme low-bit settings. This validates the bit-aware robustness and generalization capabilities of our framework.
C.3 RESULTS ON ADDITIONAL ARCHITECTURES
To demonstrate the generality of TriQDef, evaluate its effectiveness across multiple network chitectures on both CIFAR-I0 and ImageNet. We report attack success rates (ASR %) under the LAVAN patch-based attack across different quantization levels (32-bit to 2-bit). The results consis- tently show that TriQDef significantly reduces ASR, confirming its robustness across architectures and datasets (See Tables 14 and 15
Table 14: ASR (%) of LAVAN attack (6x6 patch) CIFAR-10 10 across multiple architectures and quantization levels.
Model
Setting
32bit
5bit
4bit
2bit
VGG-16
defense
87.17
81.45
78.29
76.67
VGG-16
TriQDef
29.34
27.10
26.43
21.20
VGG-19
No defense
88.95
82.28
79.81
77.19
VGG-19
TriQDef
28.70
25.20
22.30
20.90
ResNet-20
No defense
87.22
80.65
77.30
74.18
ResNet-20
TriQDef
30.24
27.30
26.90
22.60
AlexNet
No defense
89.01
83.44
81.56
79.20
AlexNet
TriQDef
28.77
25.43
22.12
19.6
Table 15: ASR (%) of LAVAN attack with 50x50 patch on ImageNet across architectures and quan- tization levels.
Model
Setting
32bit
5bit
4bit
2bit
ResNet-18
No defense
99.93
66.37
61.11
55.42
ResNet-18
TriQDef
33.50
31.30
29.60
27.40
Inception v3
No detense
89.10
57.21
55.32
50.66
Inception v3
TriQDef
35.60
32.10
30.40
27.30
MobileNetV2
No defense
88.35
59.43
54.97
49.25
MobileNetV2
TriQDef
29.53
27.80
25.10
23.50
DenseNet-
No defense
87.24
60.31
56.42
50.78
DenseNett-
TriQDef
30.11
28.45
25.22
21.39
C.4
RESULTS FOR OTHER ATTACKS
Results under DRP Attack.
The DRP attack (Chen al. 2022 introduces shape-deformable adversarial patches that adaptively alter their structure and appearance to exploit neural network vulnerabilities. Unlike traditional pixel-level perturbations, DRP leverages geometric transformations to improve both robustness and transferability, making it particularly effective in black-box and cross-model scenarios.
We evaluate the robustness of TriQDef against DRP on both CIFAR-10 and ImageNet across mul- tiple quantization levels. As shown in Table 16 TriQDef consistently outperforms prior defenses, including PBAT and DWQ, under both standard and unseen patch settings. Notably, TriQDef main- tains a significant ASR reduction, even under the unseen patch regime where generalization is criti- cal.
D COMPUTE & MEMORY COST
We quantify training and inference costs relative to vanilla quantization-awar training (QAT) on single Chared-backborg model with multiple quantizers. We report images/sec (higher is better), it-
19

---

Published as a conference paper at ICLR 2026
Table 16: ASR (%) under DRP attack (6x6 patches CIFAR-10 and 50x50 patches ImageNet)
across bit-widths and generalization settings. Lower is better.
Defense
Dataset
32bit
Sbit
4bit
2bit
PBAT
CIFAR 10
56,6
48.3
46.5
43,2
DWQ
CIFAR- 10
87.9
82.4
77.2
76.4
TriQDef
CIFAR-10 10
35.4
31.7
30.1
28.8
PBAT (Unseen)
CIFAR-I0
81.4
75.4
71.8
68.4
DWQ (Unseen)
CIFAR-10 10
90.2
84.3
80.6
78.3
TriQDef (Unscen)
CIFAR-10 10
42.7
35,5
31.2
29.6
PBAT
ImageNet
60.4
53.7
50.8
48.5
DWQ TriQDef
ImageNet
88.6
80.4
75.3
71.6
ImageNet
45,6
40.7
38.1
35.3
PBAT (Unseen)
ImageNet
81.1
75.2
71.2
67.9
DWQ (Unseen)
ImageNet
91.9
80.3
75.4
70.2
TriQDef (Unseen)
ImageNet
48.1
45.7
38.5
35.2
Table 17: Training cost vs. baselines (mean over epoch end).
Relative columns are w.r.t vanilla
QAT (same backbone). Lower is better for time/memory, higher is better for images/sec.
Images/sec
Tter (ms) 1
Peak Mem (GB)
Time x 1 Mem x 4
Method
Dataset/Model
(absolute)
(vs. QAT)
QAT
CIFAR- 107 RN-56
[200
116
4.2
1.00
1.00)
DWQ
CIFAR-10 RN-56
[2090]
[122]
[4.3]
1.05
1.02
PBAT
CIFAR-10 RN-56
[150]]
[176]
[6.1
1.52
1.45
TriQDef
CIFAR- RN-56
[1490]
1170
[4.9]
1.47
1.17
QAT
ImageNet/ RN-34
1980
262
9.1
1.00
1.00
DWO
ImageNet/ RN-34
1935
275
[9.3]
1.05
1.02
PBAT
ImageNet RN-34
[640]
[402]
[13.3]
1.53
1.46
TriQDet
ImageNet RN-34
[610]
[418]
[11.2]
1.60
1.23
eration time (ms; lower is better), and peak GPU memory (GB; lower is better). Measurements were averaged over the last 1 epoch with fixed batch size and mixed precision on the same hardware
Summary. TriQDef introduces moderate training overhead relative vanilla QAT due to multi- bit passes and perceptual penalties (FDP/GPDP): ~1.47-1.60x wall-time and ~1.11711.25 1.23x peak memory in setup. PBAT is costlier (extra adversarial training with patches), while DWQ is near-QAT. Importantly, TriQDef adds no inference-tine cost, unlike preprocessing defenses.
Implementation notes. We compute bit-specific losses sequentially and accumulate into Lioaa to bound memory; feature taps used by LFDP are kept at reduced precision and released immediately. HOG/Edge maps are computed on low-resolution proxies feature/gradient tensors (downsampled by 2), adding < 5% time in our profiling. These choices keep TriQDef's peak memory close to QAT and time cost well below PBAT.
Scaling with #idthsidths. With [B, active bit-widths at given BACT stage, iteration time scales approximately linearly:
Ther TOAT + [B.] + TEDPIGeDe, with TedPiGpPP Trwdfhack-
'Setup: NVIDIA A100 40GB, CUDA 12.2, PyTorch 2.3, batch 256 for CIFAR-10 (ResNet-56), batch 256 for ImageNet (ResNct-34)..
Table 18: Inference-time time overhead (per ImageNet image, ResNet-50). TriQDef adds no deploy-time cost; Jedi and DiffPure run preprocessing. DiftPure numbers reported by Nie al. 2022
Method
Latency / iing
Peak Mem J
TriQDef (ours)
(single forward with Q+)
extra over model
Jedi Tarchoun al. 2023)
[12-25 ms] (entropy map inpaint)
+0.5-1100 GB]
DuffPure Nie et al. 2022)
5.58-17.14
>7
20

---

Published as a conference paper at ICLR 2026
Because BACT stages quantizers, the early training phases wear-QAT cost; the maximal stage (all bits active) occurs only in later epochs.
21


Reviews:
[{"review_id": "b8hpF8Kzfc", "reviewer": "Reviewer_6fkT", "summary": "This paper proposes a defense framework called TriQDef, aiming to address the vulnerability of Quantized Neural Networks (QNNs) to transferable patch attacks. TriQDef consists of three main mechanisms: feature displacement penalty (FDP), gradient-aware dissonance penalty (GPDP), and bit-width-aware curriculum training (BACT). Experimental results show that TriQDef can reduce the attack success rates of unseen patch and quantization combinations without sacrificing clean accuracy.", "questions": "1. The TriQDef framework relies on numerous heuristic hyperparameters ($\\alpha$, $\\beta$, $\\lambda_{FDP}$, $\\lambda_{GPDP}$, $k$, $q$, etc.). How to prove the tuning of these hyperparameters can ensure the generalizability of TriQDef across different model architectures and datasets.\n2. In the face of real-time generated adversarial patches or video stream attacks, how stable is the defense mechanism of TriQDef? Does it require the design of an incremental training module?\n3. The FDP utilizes hand-crafted descriptors (Edge IoU and HOG) that primarily capture low-level features. Will this reliance limit its robustness against novel attacks targeting mid-level semantic representations?\n4. How is the scalability of TriQDef on larger models? Will it experience a decline in defense effectiveness under extreme quantization (such as 2-bit)? Is there a specific size threshold that leads to the failure of defense?\n5. How is the spatial robustness of TriQDef (e.g., center vs. corner patches) under larger, unseen patch sizes?\n6. The training procedure of TriQDef introduces additional complexity due to the simultaneous maintenance of multiple quantizers. Will this design impact training stability and convergence?\n7. The experimental setup described on line 360 includes AlexNet and DenseNet-121. Why are the corresponding results of these models not reported in the main text or appendices?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. This paper addresses the critical and understudied problem of adversarial patch transferability in quantized neural networks.\n2. The proposed tri-level defense is comprehensive.\n3. The experiments covering various quantization bit widths, attack methods, and model architectures reflect the generalization ability of TriQDef in certain settings.", "weaknesses": "1. Lack of rigorous mathematical modeling or theoretical boundary analysis on the generalizability of the proposed defense (Q1).\n2. Incomplete analysis of FDP's side-effects on semantic integrity. It reports a minor accuracy drop but fails to investigate how this disalignment affects fundamental recognition capabilities (Q2-Q3).\n3. Evaluation and scalability concerns (Q4-Q7).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "vAXo578ybI", "reviewer": "Reviewer_t43x", "summary": "The paper looks at a specific gap: even when you quantize a model to very low bit-widths, patch attacks crafted on the full-precision model can still transfer and succeed. To fix this, the paper proposes TriQDef, a training-time defense with three parts: (i) make features from different bit-widths less aligned, (ii) make input gradients from different bit-widths less aligned, and (iii) use a bit-aware curriculum so multi-bit training doesn’t collapse. Experiments on CIFAR-10 and ImageNet with several patch attacks show lower attack success while keeping accuracy close to normal QAT.", "questions": "a) You show feature/gradient perceptual similarity is the real issue, not cosine. Do you know which layer range (early vs. mid vs. late) contributes the most, and could TriQDef be applied only there to save cost?\n﻿\nb) The bit-aware curriculum turns on lower-bit models gradually. How stable is this if we add even more bit-widths (e.g., 3-bit, 6-bit)?\n﻿\nc) if a vendor tool later re-quantizes/fuses ops, do you expect the disalignment effect to survive, or is it tied to the exact QAT pipeline you trained with?", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "a) The problem is well-motivated: “quantization ≠ free robustness” is a message that’s worth saying explicitly for patch attacks. \n\nb) The defense is mechanism-driven, not just “train on more patched images”: it tries to break cross-bit semantic/gradient alignment, which is a reasonable explanation for transfer. \n\nc) The idea of using perceptual cues (edge IoU, HOG-like descriptors) on features and gradients is a nice twist on older adversarial detection/defense lines that only used feature distances.\n\nd) Everything happens at training time and keeps inference clean, which is nice for edge/QNN scenarios.", "weaknesses": "a) Parts of the idea are close in spirit to earlier “detect / separate / de-align” or “make internal representations less exploitable” work, but the paper doesn’t cite that line clearly. For example: MagNet (Meng & Chen, CCS’17), feature squeezing (Xu et al., NDSS’18), and transferability analyses (Tramèr et al., 2017/2018) all talk about representation/gradient similarity as a transfer channel. \n﻿\nb) The method is engineered around patch attacks. It’s not metioned how much of TriQDef would still help for non-local, non-patch adversaries on quantized models (e.g. query-efficient, non-sparse perturbations). \n﻿\nc) Enforcing pairwise disalignment across many bit-widths on a shared backbone can get expensive. It’d be good to spell out the cost vs. vanilla QAT.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ywqLg6nSu6", "reviewer": "Reviewer_Kvka", "summary": "This paper investigates the transferability of adversarial patches across QNNs with different bitwidths and concludes that QNNs are vulnerable to transfer attacks. To address this, the paper proposes TriQDef, an adversarial training (AT)-based defense by combining different bitwidth backbones and mitigating attack transferability in intermediate features during AT. Experimental results show that TriQDef improves robustness compared to three baselines: full-precision patch-based adversarial training (PBAT), quantized pixel-based adversarial training (DWQ), and full-precision pixel-based adversarial purification (DiffPure).", "questions": "Was the text font size intentionally adjusted to be smaller after Equation 2?", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "- Adversarial transferability across QNNs is an important topic. \n\n- This paper thoroughly investigates the current research frontier and proposes two novel techniques (FDP and GPDP) to address the problem.\n\n- The technical novelty of the proposed defense is sufficient.", "weaknesses": "The text font size seems to noticeably decrease after Equation 2. The reviewer is not sure if this violates the ICLR policy.\nThere are major problems in the motivation experiments and baseline comparisons. \n\n1. Table 1 is somewhat confusing:\n(1) Which model architecture is used for the surrogate model? \n(2) Which quantization method is used?\n(3) The results seem not to fully support the conclusion that \"Adversarial Patches Transfer Effectively Across Bit-Widths.\" The ASR gradually decreases as the quantization bitwidth of the target model decreases, indicating that larger divergence between the surrogate (32-bit) and target model bitwidths reduces attack transferability. Although the ASR remains high for 2-bit QNNs (70%+), this only suggests that adversarial patches are generally difficult to defend against across all CNN models. It is better to reframe the paper to focus on \"leveraging the low attack transferability of QNNs for improved defense\" rather than \"addressing QNN vulnerability to transfer attacks.\"\n(4) If the authors still want to emphasize \"Adversarial Patches Transfer Effectively Across Bit-Widths,\" it is necessary to evaluate attack transferability using surrogate models with different bitwidths rather than only the 32-bit model, and the highest attack success rate across different surrogate bitwidths should be reported as the \"aggregated ASR.\" For example, if attacking a 2-bit target model with 32-bit, 8-bit, 4-bit, and 2-bit surrogate models yields ASRs of 70%, 75%, 80%, and 90%, respectively, the aggregated ASR for the 2-bit target model would be 90%. This setting is much more realistic because defenders cannot anticipate the adversary's quantization bitwidth. In this setting, if the 2-bit model exhibits the highest aggregated ASR, it would support the conclusion that lower-bitwidth QNNs are more vulnerable to transfer attacks, justifying the need for the proposed defense. The authors should also control the surrogate (or target) model when adjusting the other. \n\n2. Table 2 has similar issues:\n(1) Specify the model architecture as well as the quantization method and bitwidth for QAT and PTQ. In particular, was PyTorch Quantization used? Why is the quantization method inconsistent between Table 1 and Table 2? The authors should report results for (32, 8, 4, 2-bit) target models using the same quantization method combined with adversarial training.\n(3) What do \"8×8 (Unseen, 4-bit)\" and \"10×10 (Unseen, 2-bit)\" mean? Are these adversarial patches crafted using 4-bit and 2-bit surrogate models, respectively?\n(4) More comprehensive experiments involving adversarial training, as described above.\n\n3. The design of Bit-Width-Aware Curriculum Training (BACT) resembles Double-Win-Quant (DWQ). If BACT does not offer significant novel contributions compared to DWQ, the authors should reduce the content about BACT.\n\n4. The idea of training a robust model from the perspective of structural and textural features is novel. It would be better to emphasize FDP and GPDP as the core contributions and reduce descriptions of previous techniques, particularly in the Methodology section.\n\n5. For patch-based adversarial training, this paper only compares with PBAT from 2020, which is outdated. More recent patch-based adversarial training papers should be included as baselines, for example:\n\nLi X, Zhu Y, Huang Y, et al. PBCAT: Patch-based composite adversarial training against physically realizable attacks on object detection. arXiv preprint arXiv:2506.23581, 2025.\n\nMetzen J H, Finnie N, Hutmacher R. Meta adversarial training against universal patches. arXiv preprint arXiv:2101.11453, 2021.\n\n6. The paper should compare with patch-based preprocessing defenses rather than the pixel-based defense DiffPure. DiffPure is designed for pixel-based Lp adversarial attacks and does not address adversarial patches. Comparing with DiffPure is unfair. Instead, please include the following patch-based preprocessing defenses. In general, it makes more sense to see if the proposed (training-based) defense can be integrated with patch-based adversarial purification for better performance.\n\nKang C, Dong Y, Wang Z, et al. Diffender: Diffusion-based adversarial defense against patch attacks. European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2024: 130-147.\n\nJing L, Wang R, Ren W, et al. PAD: Patch-agnostic defense against adversarial patch attacks. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 24472-24481.\n\nLiu L, Guo Y, Zhang Y, et al. Understanding and defending patched-based adversarial attacks for vision transformer. 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "LydEBUR3S3", "reviewer": "Reviewer_V6ix", "summary": "The paper introduces TriQDef, a tri-level quantization-aware defense framework designed to improve the robustness of Quantized Neural Networks (QNNs) against patch-based adversarial attacks. While quantization naturally distorts gradients and reduces vulnerability to pixel-level attacks, it remains weak against localized, transferable patch attacks across different bit-widths.\n\nTriQDef mitigates this by integrating three components:\n1. Feature Disalignment Penalty (FDP): penalizes perceptual similarity in intermediate features to enforce semantic inconsistency;\n2. Gradient Perceptual Dissonance Penalty (GPDP): misaligns input gradients across quantization levels using structural metrics like Edge IoU and HOG cosine similarity;\n3. Joint Quantization-Aware Training: optimizes these penalties jointly across multiple quantizers in a shared backbone.\n\nExperiments on CIFAR-10 and ImageNet show that TriQDef reduces attack success rates by over 40% on unseen patch–quantization combinations while maintaining strong clean accuracy, demonstrating that disrupting both semantic and perceptual gradient alignment is key to improving QNN robustness.", "questions": "1. Do the proposed components also reduce ASR numbers significantly across distinct bit-widths?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The paper motivates the proposed components through quantitative analysis across different patch-based adversarial attack methods, QNN architectures, and numbers of quantized bits. With the quantitative results, the proposed components are easily convincing.\n\n2. The proposed FDP and GPDP components are effectively breaking semantic alignment among bit-widths and perceptual similarities in the gradient maps through penalizing feature disalignment and gradient perceptual dissonance. Particularly, the proposed components utilize softDice and smooth HOG features to measure structural and textural alignments in feature and gradient space. Due to this, the proposed components are effective to be used for defending against patch-based adversarial attack methods.\n\n3. The paper demonstrates the strength of the proposed components by comprehensive experiments. In the experiments, the prposed components reduce ASR numbers significantly.", "weaknesses": "1. In experiments, the paper only shows quantitative results on ResNet-56 and ResNet-34. It would be great if the paper included more results for different network architectures.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)