Blending adversarial training and representation-conditional purification via aggregation improves adversarial robustness
Authors: Emanuele Ballarin
Alessio ansuini
Luca Bortolussi
Venue: Accepted by TMLR ()

Abstract: In this work, we propose a novel adversarial defence mechanism for image classification - CARSO - blending the paradigms of adversarial training and adversarial purification in a synergistic robustness-enhancing way. The method builds upon an adversarially-trained classifier, and learns to map its internal representation associated with a potentially perturbed input onto a distribution of tentative clean reconstructions. Multiple samples from such distribution are classified by the same adversarially-trained model, and a carefully chosen aggregation of its outputs finally constitutes the robust prediction of interest. Experimental evaluation by a well-established benchmark of strong adaptive attacks, across different image datasets, shows that CARSO is able to defend itself against adaptive end-to-end white-box attacks devised for stochastic defences. With a modest clean accuracy penalty, our method improves by a significant margin the state-of-the-art for Cifar-10, Cifar-100, and TinyImageNet-200 $\ell_\infty$ robust classification accuracy against AutoAttack.

Published in Transactions on Machine Learning Research (09/2025)
Blending adversarial training and representation-cooniitoaal purification via aggregation improves adversarial robustness
Emanuele Ballarin
emonwele@0allarin.cco
ATLAB
University of Triesle
Alessio Ansuini
alessio. www.uinneerraccccmmmpr.....ccc
Data Engineering Laboratory
AREA Science Park
Luca Bortoluss
[bortolussi@unstta
AlLAB
University of Trieste
Reviewed on OpenReview: https: // opw.reveew.eeeeeeeeeeee net/ forum? id- 40BXthYsck
Abstract
In this work, we propose novel adversarial defence mechanism for image classification CARSO blending the paradigms of adversarial training and adversariol purification in synergistic robustness-enhaneee
way. The method builds upon an adversarially-traine classifier, and learns to map its internal representation associated with potentially perturbed imput onto a distribution of tentative clean reconstructions. Multiple samples from such distribution are classified by the same adversarially- model, and a carefully chosen aggregation of its outputs finally constitutes the robust prediction of interest. Experimental evaluation by well-established benchmark of strong adaptive attacks, across different image datasets, shows that CARSO is able to defend itself against adaptive end-to-end white-boz attacks devised for stochastic defences. With a modest clean accuracy penalty, our method improves by significant margin the state-of tftte-rr- for CIFAR-10, CIFAR-100, and TINYIMAGENE:1-200 lo robust classification accuracy against AUTOATTACK.
1 Introduction
Vulnerability to adversarial attacks (Biggio et al. 2013 Szegedy et al. 2014) usually crafted on purpose, capable of catastrophically altering the behaviour of high-dimensional models (Bortolussi & Sanguinetti, (0188) constitutes a major hurdle towards ensuring the compliance of deep learning systems with the behaviour expected by modellers and users, and their adoption in safety-critical scenarios tiguatl-regullted environments. This is particularly true for addeessarially-perrrtra
i.e. the presence of inputs,
inputs, where
norm- constconntt perturbation often hardly detectable by human inspection (Qin et al. 2019 Ballet
ct al. 2019 is added to otherwise legitimate input, with the intention of cliciting an anomalous response Kurakin et al. 2018).
Given the widespread nature of the issue (Iyyas et al. 2019), and the serious concerns raised about the safety and reliability of modcls Icarnt from data in the lack of appropriate mitigations (Biggio & Roli 20188), adversarial attacks have been extensively studied. However, obtaining generally robust machine learning (ML) systems remains longstanding issue, and major open challenge.
Research in the field has been driven by two opposing yet complementary efforts. On the one hand, the study of failure modes in existing models and defences, with the goal of understanding their origin and
Joint supervision.

---

Published in Transactions on Machine Learning Research (09/2025)
developing stronger attacks with varying degrees of knowledge and control over the target system (Zegedy et al.
2014 Goodfellow et al. 2015 Moosavi-Dezlooli et al. 2016 Tramer et al.
2020). On the other hand,
the construction of increasingly capable defence mechanisms. Although alternatives have been explored
Cisse ct al.
2017 Tramèr ct al.)
2018 Carbone et al.) 2020 Zhang et al.) 2022]. most of the latter is
based on adequately leveraging adversurial training (Goodlelow et al. 2015 Madry et al. 2018 Tramer &
Bonch 2019 Robuffi et al.) 2021 Gowal ct al., 2021: Jia et al. 2022 Singh et al. 2023 Wang et al., 2023
Cui et al., 2023 Peng et al., 2023), Lee. training a ML model on a dataset composed of (or enriched with)
addversarially-peruubbee inputs associated with their correct, pre-peetuubation labels. In fact, adversarial
training has been the only technique capable of consistently providing acceptable level of defence Gowal
lt al.
2020 while still incrementally improving up to the current state-of-the-are (Cui et al.
2023
Peng
et al.
2023
Bartoldson et al. 2024).
Another defensive approach is that of adversarial purifieation SShi et al. generative model is usod - similarly to denoising - to recover a perturbation-fiee version of the imput before classification is performed. Nonetheless, such altempts have generally fallen short of expeclations due to inherent limitations of the generative models used in early attempts (Nie et al.] 2022). or due to decreases in
2021 Yoon et al., 2021 where a
robust accuracy D when attacked end-to-end |Gu & Rigazio. 2015 Lee & Kim 2024) resulting in subpar
2020). More recently, the rise of diffusion-based generative models (Hnang et al. 2021 and their use for purification have enabled more successful results of this kind (Nie et al. 2022 Chen et al. 2023 although at the cost of longer training
robustness if the defensive structure is known to the adversary (Tamerr et al.
and inference times, and a much brittler robustness evaluation (Chen et al. 2023 Lee & Kim 2024
In this work, we design novel adversarial defence for supervised image classification, dubbed CARSO "Counter-Adversariall Recall of Synthetic Observations). The approach relies on adversarially-trainee classifier (called hereinafter simply the classifier), endowed with a stochastic generative model (called hereinafter the purifier). Upon classification of a potentially-perturbeed imput, the latter learns to generate from the tensoi of (pre)activations registered at neuron level in the former - samples from a distribution of plausible, perturbation-ffee reconstructions At inference time, some of these samples are classified by the very same classifier, and the original input robustly labelled by aggregating its many outputs in the form of a normalised doubly-exponential logit product. This method to the best of our knowledge the first attempt to organically merge the adversarial training and purification paradigms avoids the vulnerability pitfalls typical of the mere stacking of a purifier and classifier (Gu & Rigazio| 2015 Lee & Kim 2024 )
while still being able to take advantage of independent incremental improvements to adversarial training or generative modelling.
An empirical assessment of the defence in the fox white-bor setting is provided, using a conditional (Sohn let al. 2015 Yan et al. 2016) variational autoencoder (Kingma Welling 2014 Rezende et al., 2014) as the purifier and existing stateoof-the-ar adversarially pre-trained models classifiers. Such choices give existing approaches and the adversary attacking our architecture end-to-end as part of the assessment the strongest advantage possible. Yet, in all scenarios considered, CARSO improves significantly the robustness of the pre-trained classifier even against attacks specifically devised to fool stochastic defences like ours. Remarkably, with a modest clean accuracy penalty, our method improves by a significant margin the current state- ofade-of-taa thet for CIFAR-10 (Krizhevsky 2009), CIFAR- 100 (Krizhevsky 2009), and TINYLMAGENET-200 [Chrabaszez et al. 2017) loo robust classification accuracy against AUTOATTACK (Croce & Hein 2020a).
meant to
In summary, the paper makes the following contributions:
The description of CARSO, a novel adversarial defence method synergistically blending adversarial training and adversarial purification, thanks to pppresentation-condittio purification and a dedicatod robust aggregalion stralegy;
The lest. sot accuracy of the weights trained classifier computed on a dataset entirely composed of aelversarially-peruuee
examples generated against that specific model.
Which we call infernal representation.
Implementation of the method and code for the experiments (based on PoTorch Passke et al. 2019 AdverTorch DDing et al.
2019). and ebtorch [Ballarin 2025)) can be found at: httpa://github. com/ con//maaallarinnCAaaa..
2

---

Published in Transactions on Machine Learning Research (09/2025)
A collection of relevant technical details fundamental to its successful training and use, originally developed for the purifier being a conditional varialional auloencoder but applicable to more general scenarios as well;
An experimental assessment of the method, against standardised benchmark adversarial attacks showing higher robust accuracy w.r.t. to existing state-of-the-ary adversarial training and purification approaches.
The rest. of the manuscripl struct as follows. In section we provide an overview of selected contributions in the fields of adversorial training and purification-buse based defences with focus on image classification. In section 3 an introduction is given to two integral parts of our experimental assossment: PGD adversarial training and conditional variational autoencoders. [Section 4 is devoted to the intuition behind CARSO, its architectural description, and the relevant technical details that allow it to work effectively. [Section 5 contains details about the experimental setup, results, comments, and limitations. Section 6 concludes the paper and outlines directions of future development.
2 Related work
Adversarial training as a defence The idea of training a model on biveesarially-geeeraate examples as a way to make it more robust can be traced back to the very beginning of research in the area. In their seminal work, Szegedy et al. (2014) propose to perform training on a mixed collection of clean and adversarial data, generated beforehand.
The introduction of FGSM (Goodfellow et al., 2015) enables the efficient generation of adversarial examples along the training, with single normalised gradient step. Its iterative generalisation PGD (Madry et al. 2018
discussed in ssectinn 3 significantly improves the effectiveness of the adversarial examples produced, making it still the de facto standard for the synthesis of adversarial training inputs (Gowal et al. 2020). Further incremental improvements have also been developed, some focused specifically on robustness assessment (c.g.
stepsize-adaptive variants, as by Croce & Hein (2020a)):
The most recent adversarial training protocols further rely on synthetic data to increase the numerosity of training datapoints (Gowal et al. 2021; Rebuffi et al., 2021 Wang et al. 2023 Cui et al., 2023 Peng et al. 2023 Bartoldson et al. 2024)) and adopt adjusted loss functions to balance robustness and accuracy (Zhang ct al. 2019a) or generally foster the learning process (Cui et al. 2023). The entire model architecture may also be tuned specifically for the sake of robustness enhancement (Peng el al. 2023). At least some of such ingredients are often required to reach the current state-of- ofite-of-thearrt in robust accuracy via adversarial training.
Purification as a defence Amougst the first attempls purification--aael adversarial defence, Gu & Rigazio (2015) investigate the use of denoising autoencoders (Vincent al.) 2008) to recover examples free from adversarial perturbations. Despite its effectiveness in the denoising task, the method may indeed increase the vulnerability of the system when attacks are generated against it end-to-end. The contextually proposed improvement adds smoothness penalty to the reconstruction loss, partially mitigating such downside (Gu & Rigazio 2015). Similar in spirit, Liao et al. (2018) tackle the issue by computing the reconstruction loss between the last-layers representations of the fright-weights attacked classifier, respectively receiving, as input, the clean and the tentatively denoised example.
In the work by (Samangouci et al. (2018), Generative Adversarial Networks (GANs) (Goodfellow et al. 2014 learnt on clean data are used at inference time to find a plausible synthetic example close to the perturbed input belonging to the unperturbed data manifold. Despite encouraging results, the delicate training process of GANs and the existence of known failure modes (Zhang et al. 2018) limit the applicability of the method. More recently, a similar approach (Hill et al. 2021 employing eneryy-based models (LeCun et al., 2006 suffered from poor sample quality (Nie et al. 2022).
Purification approaches based on (conditional) variational autoencoders include the works by Hwang et al. (219)) and Shi et al. (2021). Very recently, technique combining variational manifold learning with a test-time iterative purification procedure has also been proposed (Yang et al. 2024).
3

---

Published in Transactions on Machine Learning Research (09/2025)
Finally, already-mentioned techniques relying on score- (Yoon et al. 2021 and difffusion- based Nie et al. 2022: Chen et al. 2023) models have also been developed, with generally favourable results often balanced in practice by longer training and inference times, and much more fragile robustness assessment (Ceen
ct al. 2023
Lee & Kim 2024
3
Preliminaries
PGD adversarial training The task of finding model parameters robust to adversarial perturbations is framed by Madry et al. (2018) as a min-mar optimisation problem seeking to minimise adversarial risk. The inner optimisation (i.e., the generation of worst-case adversarial examples) is solved by an iterative algorithm Projected Gradient Descent interleaving gradient ascent steps in imput space with the eventual projection the shell of an e-ball centred around input datapoint, thus imposing perturbation strength constraint.
In this manuscript, we will use the shorthand notation 6p to denote Ep norm-bound perturbations of maximum magnitude e.
(Conditional) variational autoencoders Variational autoencoders (VAEs) (Kingma & Weeling 2014
Rezende et al. 2014) allow the learning from data of approximate generative latent-variable models of the form p( 2) = p( = x))(z), whose likelihood and posterior are approximately parametrised by deep artificial neural networks (ANNs). The problem is cast as the maximisation of a variational lower bound.
In practice, optimisation is performed iteratively data-reconstruction loss and empirical KL divergence w.r.t. chosen prior, computed on mini- batches of data.
loss function (CvAE) given by the linear mixture of
Conditional Variational Autoencoders (Sohn et al. 2015 Yan et al. 2016 extend VAEs by attaching a conditioning tensor c - expressing specific characteristics of each example to both x and z during training. This allows the learning of a decoder model capable conditional data generation.
4 Structure of CARSO
The core ideas informing the design of our method are driven more by first principles rather than arising from specific contingent requirements. This section discusses such ideas, the architectural details of CARSO, and a group of tochnical aspects fundamental
training and inference processes.
4.1 Architectural overview and principle of operation
From an architectural point of view, CARSO essentially composed of two ANN models - a classifier and a purifier operating close synergy. The former is trained on a given classification task, whose inputs might be adversarially corrupted at inference time. The latter learns to generate samples from distribution of potential input reconstructions, tentatively free from adversarial perturbations. Crucially, the purifier has only access to the internal representation of the classifier and not even directly to the perturbed input to perform ils task.
During inference, for each input, the internal representation of the classifier is used by the purifier to synthesise a collection of tentatively unperturbed input reconstructions. Those are classified by the same classifier, and the resulting outputs are aggregated into a final robust prediction.
There are no specific requirements for the classifier, whose training completely independent of the use of the model part of CARSO. However, training it adversarially significantly improves the robust accuracy of the overall system (see Appendix D), also allowing it to benefit from established adversarial training techniques.
The purifier is also independent of specific architectural choices, provided it is capable of stochastic conditional data generation at inference time, with the internal representation of the classifier used as conditioning.
In the rest of the paper, we employ a tfth-rr-- adversarially pro-trained WIDERESNET model the classifier, and a burposc-bult conditional variational autoencoder as the purifier, the latter operating decoder-only during inference. Such choice driven by the deliberate intention to assess the adversarial
4

---

Published in Transactions on Machine Learning Research (09/2025)
robustness of our method in its worst-case scenario against white-bor attacker, and with the least advantage compared to existing approaches based solely on adversarial training.
In fact, the decoder of a conditional VAE allows for exact algorithmic differentiability (Baydin et al.
2018
w.rtt. its conditioning set, thus averting the need for backward-pas pass approximation (Athalye et al. 2018a] in
generating end-to-end adversarial attacks against the entire system, and preventing (un)intentional robustiness inflation by gradient obfuscation (Athalye al., 2018a). The same cannot be said (Chen al. 2023) for
more capable and modern purification models, such those based e.g. diffusive processes, whose proper robustness assessment is still in the process of being thoroughly understood (Lee & Kim 2024
A downside of such choice is represented by the reduced effectiveness of the decoder in the synthesis of complex data, due to well-known model limitations. In fact, we experimentally observe a modest increase in reconstruction cost for non non-perturbed inputs, which in turn may limit the clean accuracy of the entire system. Nevertheless, we defend the need for a fair and transparent robustness evaluation, such as the one provided by the use of VAE-based purifier, in the evaluation of any novel
adversarial defence.
A diagram of the whole architecture is shown in Figure and its detailed principles of operation recapped below. Additionally, an ablation study investigating the need for cither the classifier or the purifier being trained on adversarially- inputs is provided in Appendix D
discard outpul
f(:0)
grob
aggregation
3
prediction
Poy (1)
2;
f(:0)
3
+ 8
Pog (1:: 0z))
Figure 1: Schematic representation of the CARSO architecture used in the experimental phase of this work. The subnetwork bordered by the red dashed line is used only during the training of the purifier. The subnetwork bordered by the blue dashed line is re-evaluated on different random samples z; and the resulting individual ÿ: are aggregated into grob. The classifier f(;; 0) is always kept frozen; the remaining network is trained on LvAE(æ, t). More procise details on the functioning of the networks are provided in subsection 4.1
Training At training time, adversarially--eeturbee examples are generated against, the classifier, and fed to it. The tensors containing the classifier (pre)activations across the network then extracted. Finally, the conditional VAE serving as the purifier is trained on perturbation-fre input reconstruction, conditional on the corresponding previously-extracted internal representations, and using pre-perturbation examples as targets.
Upon completion of the training process, the encoder network is discarded, as it will not be used for inference.
The example requiring classification is fed to the classifier. Its corresponding internal representa- tion is extracted and used condition the generative process described by the decoder of the VAE. Stochastic latent variables are repeatedly sampled from the original priors, which are given by an í. multivariate Standard Normal distribution. Each element in the resulting set of reconstructed inputs classified by the
Inference
5

---

Published in Transactions on Machine Learning Research (09/2025)
same classifier, and the individually predicted class logits are aggregated. The result of such aggregation constitutes the robust prediction of the input class.
Remarkably, the only link between the initial potentially-perrurbeed input and the resulting purified recon- structions (and thus the predicted class) happens through the internal representation the classifier, which serves as a featurisation of the original input. The whole process exactly differentiable end-to-ende and the only potential hurdle the generation of adversarial attacks against the entire system is the stochastic nature of the decoding which is casily tackled by Expectation over Transformation (Athalye et al. 2018b
4.2 A first-principles justification
If we consider a trained ANN classifier, subject to a successful adversarial atlack by means of a slightly perturbed example, we observe that both in terms of lp magnitude and human perception (Bartoldson et al, 2024) small variation on the input side of the network is amplified to significant amount the output side, thanks to the layerwise processing by the model. Given the deterministic nature of such processing at inference time, we speculate that the trace obtained by sequentially collecting the (pre)activation values within the network, along the forward pass, constitutes a richer characterisation of such an amplification process compared to the knowledge of the input alone. Indeed, as we do, it is possible to learn a direct mapping from such featurisation of the input, to a distribution of possible perturbation-Fres input reconstructions in a way that takes advantage of such characterisation.
4.3 Hierarchical input and internal representation encoding
Training a conditional VAE requires (Sohn et al. 2015) that the conditioning set c is concatenated to the input x before encoding occurs, and to the sample of latent. variables z right before decoding. The same is also true, with the suitable adjustments, for any conditional generative approach where the target and the conditioning set must be processed jointly.
In order to ensure the usability and scalability of CARSO across the widest range of inpul data and classifier models, we propose to perform such processing in hierarchical and partially disjoint fashion between the input and the conditioning set. In principle, the encoding of æ and e can be performed by two different and independent subnetworks, until some form of joint processing must occur. This allows to retain the overall architectural structure of the purifier, while having finer-grained control over the inductive biases (Mitchel] 1980) deemed the most suitable for the respective variables.
In the experimental phase of our work, we encode the two variables independently. The imput is compressed by multilayer convolutional neural network (CNN). The internal representation - which in our case is composed of differently sized multi-channel images is processed layer by layer by independent multilayer CNNs (responsible for encoding local information), whose flatlened outputs are finally concatenated and compressed by a fully-connected layer (modelling inter-layer correlations in the representation). The resulting compressed input and conditioning set are then further concatenated and jointly encoded by fully-connectod network (FCN).
In order to use the VAE decoder at inference time, the compression machinery for the conditioning set must be preserved after training, and used to encode the internal representations extracted. The input encoder may be discarded instead.
4.4 pattrsarially-balnccee batches
Training the purifier in perturbed examples generated against the classifier, and to the corresponding clean data. Specifically, we use as input a mixture of clean and adversarially perturbed examples, and the clean input as the target.
input reconstruction requires having access to adversarially-
Within each epoch, the training set of interest is shuffled (Robbins & Monro 1951 Bottou 1999), and only a fixed fraction of cach resulting batch is adversarially perturbed. Calling the maximum t, perturbation norm bound for the threat model against which the classifier was adversarially pre-trained, the portion of perturbed examples is generated by an even split of FGSM PGDys FGSM, and PCD, attacks.
6

---

Published in Transactions on Machine Learning Research (09/2025)
Any smaller subset of attack types and strengths, detailedly unbalanced batch composition, experimentally results in a worse-performing purification model. More details justifying such choice are provided in Appendix A
4.5 Robust aggregation strategy
At inference time, many different input reconstructions are classified by the classifier, and the respoctive outputs concur to the settlement. of robust prediction.
Calling 4 the output logit associated with class i E {I....,cy CJ in the prediction by the classifier sample a E Ny, we adopt the following aggregation strategy:
P.
with P. being the aggregated probability of membership in class i, Z normalisation constant such that P = 1, and Euler's number.
Such choice produces robust prediction much harder to overtake in the event that an adversary selectively largets a specific input reconstruction. A heuristic analysis of this property (subsection B.1), logether with an experimental justification for using such aggregation function within CARSO (subsection B.2), are given in
Appendix
5 Experimental assessment
Experimental evaluation of our method is carried out in lerms of robust and clewn image classification accuracy within three different scenarios (a, 6, and c), determined by different classification tasks. The white-bor threat model with a fixed 6oo norm bound is assumed throughout, as it generally constitutes the most demanding setup for adversarial defences.
5.1 Setup
dataset used in scenario (a), the CIFAR-100 (Kizhevsky 2009 dataset is used in scenario (b), whereas the TINYIMAGENET-200 (Chrabaszzz et al. 2017 dataset is used in scenario (c).
Data The CIFAR-10 (Krizhevsky 2009
Architectures A WIDERESNeT-2S-11 model is used as the classifier, adversarially pre-trained on the respective dataset the only difference between scenarios being the size of the inputs, and the number of output logits: 10 in scenario (a), 100 in scenario (b), and 200 in scenario (c).
The purifier composed of conditional VAE, processing inputs and internal representations in a partially disjoint. fashion, as explained in subsection 4.3 The input compressed by a two-layer CNN; the internal representation is instead processed layerwise by independent CNNs (three-layered in scenarios (a) and (b), four-layered in scenario (c)) whose outputs are then concatenated and compressed by fully-connected layer. A final two-layer FCN jointly encodes the compressed input and conditioning set, after the concatenation of the two. A lixel deconvolutional network is used as the decoder.
More precise details on all architectures are given in Appendix C
Outer minimisation In scenarios (a) and (b), the classifier is trained according to Cui et al. (2023); in scenario (c), according to Wang et al. 2023). Classifiers were always acquired as pre-trained models, using publicly available weights provided by the respective authors.
The purifier is trained on the VAE loss, using summed pirel-wise channel- wise binary cross-entropy as the reconstruction cost. Optimisation is performed by RADAM+LLOOKAHANN [Liu et al. 2020 Zhang al.

---

Published in Transactions on Machine Learning Research (09/2025)
2019b with learning rate schedule that presents linear warm-up, plateau phase, and a linear annealing (Smith 2017p. To promote the learning of meaningful reconstructions during the initial phases of training, the KL divergence term in the VAE loss is suppressed for an initial number of epochs, Afterwards, it is linearly modulated up to its actual value, along a fixed number of epochs (3 increase) (Higgins et al. 2017]. The initial and final epochs of such modulation are reported in Table 16
Additional scenario-specific details are provided in Appendix C
Inner minimisation 60o = $/253 is set as the perturbation norm bound.
Adversarial examples against the purifier are obtained, as explained in subsection 4.4 by FGSMe/2 PGD4/25 FGSM,, and PGD,, in a class-untargeted fashion on the cross-entropy loss. In the case PGD, gradient ascent. with a step size of 0.01 used.
The complete details and hyperparameters of the attacks described in Appendix C
Evaluation In each scenario, we report the clean and robust test-set accuracy the latter by means of AUTOATTACK (Croce & Hein 2020a of the classifier alone, and that of the corresponding CARSO architecture.
For the classifier alone, the slandard version of AUTOATTACK (AA) is used: i.e., the worst-case accuracy on mixture of AUTOPGD on the cross-cntropy loss CCroce & Hein 2020a) with 100 steps, AUTOPGD on the difference of logils ratio loss {Croce & Hein 2020a) with 100 steps, FAB (Croce & Hein 2020bb with 100 steps, and the black-box boz SQUARE attack (Andriushchenko et al. 2020 with 5000 queries.
In the evaluation of the CARSO architecture, the number of reconstructed samples per input is set 8, the logits are aggregated as explained in Isubsection 4.5, and the output class is finally selected as the arg max of the aggregation. Due to the stochastic nature of the purifier, robust accuracy is assessed by version of AUTOAATTAK suitable for stochastic defences (randAA) composed of AUTOPGD on the cross-cntropy and difference of logits ratio losses, across 20 Expectation over Transformation (EoT) (Athalye et al.) 2018b) iterations with 100 gradient ascent steps each. In the specific case of scenario (a), we also assess our method by the PCD+EOT pipeline proposed by Lee Kim (022)), as explained subsection 5.2
Computational infrastructure All experiments were performed on an NVIDIA DGX A100 system. Training in scenarios (a) and (c) was run on 8 NVIDIA A100 GPUs with 40 GB of dedicated memory each; in scenario (b) 4 of such devices were used. Flapsed training time for the purifier in all scenarios is reported
in Table
Table 1: Elapsed running time training the purifier the different scenarios considered.
Scenario
(a)
(b)
(c)
Elopsed training time
159 min
138 min
213 min
5.2 Results and discussion
An analysis of the experimental results is provided in the subsection that follows, whereas their systematic exposition is given [Table 2 Results obtained by using deliberately worse-performing pretrained classifiers, as well as broader comparison with existing adversarial defences from literature, are provided in Appendix E
Scenario (a) Comparing the robust accuracy of the classifier model used in scenario (a) CCui et al. 2023 with that resulting from the inclusion the same model in the CARSO architecture, we observe a +8.4% increase. This counterbalanced by a -5.6% clean accuracy decrease. The same version of CARSO further provides a +2.42 robustness increase w.r.f. the current best AT-trained model (Bartoldson et al. 2024 that employs a ~ 4x larger WIDEResNer-96--1 model.
8

---

Published in Transactions on Machine Learning Research (09/2025)
Table 2: Clean (results in italic) and adversarial (results upright) accuracy for the different models and datasets used in the respective scenarios. The following abbreviations are used: Scen: scenario considered; AT/CI: clean accuracy for adversarially-pretrainn model used as the classifier, when considered alone; C/C1: clean accuracy for the CARSO architecture; AT/AA: robust accuracy (by the means of AUTOATTACK) for the addvrsariially used as classifier, when considered alone; C/randAA: robust accuracy for the CAnSO architecture, when attacked end-to-end by AUTOATTACK for randomised defences; Best AT/AA: best robust accuracy result for the respective dataset (by the means of AUTOATTACK), obtained by adversarial training alone (any model); Best P/AА: best robust accuracy result for the respective dataset (by the means of AUTOATTACK), obtained by adversarial purification (any model). Robust accuracies in round brackets are obtained using the PGD-Eoll (Lee & Kim (024) pipeline, developed for diffisiion-based purifiers. The best clean and robust accuracies per dataset shown in bold. The clean accuracies for the models referred to in the Beat columns are shown in Table 19 (in Appendix
model
C/randAA (PGD+EOT)
Best P/AA (PcD+EoT)
Scen.
Dataset
AT/CI
C/CI
AT/AA
Best AT/AA
0.7613
0.7812
(a)
CIFAR-10
0.9216
0.8686
0.6773
0.7371
(0.7689)
(0.6641)
(b)
CIFAR-100 0.7385
0.6806
0.3918
0.6665
0.4267
0.4609
(c)
TIN7
0.6519 9
0.5632
0.3130
0.5356
0.3130
In addition, our method provides remarkable +9.72% increase in robust accuracy W.r.t. to the best adversarial purification approach (Lin et al.) 2024), a diffusion- purifier. However, the comparison is not as straightforward. In fact, the original paper (Lin et al.) 2024) reports a robust accuracy of 78.12% using AUTOATTACK on the gradients obtained via the adjoint method (Nie et al. 2022). As noted in Lee & Kim (2024); such evaluation (which uses the version of AUTOATTACK that is unsuitable for stochastic defences) leads to large overestination of the robustness of diffusive purifiers. As suggested in Lee & Kim (2024), the authors of Lin et al.] (2024) re-evaluate the robust. accuracy according to more suitable pipeline (PGD+EoT, whose hyperparameters
shown in Table 14), obtaining a much lower robust accuracy of 66.41%. Consequently, we repeat the same evaluation for CARSO and compare the worst-case robustness amongst the two. In line with typical AT methods, and unlike diffusive purification, the robustness of CARSO assessed by means of randAA A remains lower w.r.l. that achieved by PGD+FOT.
Scenario (b) Moving scenario (b), CARSO achieves robust accuracy increase of +27.47% w.r.t. the classifier alone CCui et al. 2023). balanced by a -5.79% decrease in clean accuracy. Our approach also improves upon the robust accuracy of the best AT-trained model (Wang et al. 2023 (WIDERESNET-700 16) by +23.98%. In the absence of reliable robustness evaluation by means of PCD+EOT for the best purification based method (Lin et al.) 2024), we still obtain a +20.25% increase in robust accuracy upon its (largely overestimated) AA result.
Scenario (c) In scenario (c), CARSO improves upon the classifier alone (Wang et al. 2023) (which is also the best AT-baaed approach for TINYIMAGENET-2000 by +22.26%. A significant clean accuracy toll is imposed by the relative complexity of the datasct, i.e. -8.87%. In this sctting, lack any additional murification-based methods.
Assessing the impact of gradient obfuscation Although the architecture of CARSO is algorithmically differentiable end-to-end and the integrated diagnostics of the randAA routines identified no pitfalls during the assessment - we additionally guard against the eventual gradient obfuscation (Athalye et al.) 2018aa induced by our method by repcating the evaluation at 6 0.95, verifying that the resulting robust accuracy stays below random chance (Carlini al. 2019). Results are shown in Table 3
5.3 Limitations and open problems
In line with recent research aiming at the development of robust defences against multiple perturbations (Dolatabadi al. 2022 Laidlaw al. 2021 1 our method produces decrease in clean accuracy w.r.l. the
9

---

Published in Transactions on Machine Learning Research (09/2025)
Table 3: Robust classification accuracy against AUTOATTACK, for too 0.95, way assess the (lack of) impact of gradient obfuscation on robust accuracy evaluation.
Seenario
(a)
(b)
(c)
6oc 0.95 acc.
<0.047
<0.010
=00.0
original model on which is built upon especially in scenario (c) as the complexity of the classification task increases. This phenomenon is partially dependent the choice of VAE the generative purification model, a requirement for the fairest evaluation possible in terms of robustness.
Yet, the issue remains open: is it possible to devise CARSO-like architecture capable of the same if not better - robust behaviour, which also competitively accurate on clean inputs? Potential avenues for future research may involve the development of CARSo-like architectures which representatioo- generation obtained by means of diffusion or score-based models. Alternatively, incremental developments aimed improving the cross-talk between the purifier and the final classifier may be pursued.
data
Additionally, the scalability of CARSO could be strongly improved by determining whether the internal representation used in conditional data generation may be restricted to smaller subset of layers, while still maintaining the general robustness of the method.
Finally, a thorough investigation of the normalised coubly-erponention logit product aggregation strategy needs be undertaken in order shed some light on the specific mechanisms that lead to the much improved defensive capabilities of the system.
6 Conclusion
In this work, we presented a novel adversarial defence mechanism tightly intograting input purification, and classification by adversarially-traince model in the form of representation-condiiona data purification, followed by specific logit aggregation. Our method is able improve upon the current state-of-the-ort in CIFAR-10, CIFAR-100, and TINYIMAGENET too robust classification, w.r.t. both adversarial training and purification approaches alone.
Such results suggest a new synergistic strategy to achieve adversarial robustness in visual tasks and motivate future research on the application of the same design principles to different models and types of data.
Broader Impact Statement
In this work, we investigate the use of novel technique for the improvement of adversarial robustness in image classification models. Our method does not carry the potential for additional risks or implications in sensitive areas, comparison to the original models used. Indeed, the goal our technique instead ultimately improve and enhance the robustness of classification models to make them more trustworthy, predictable, and resistant to tampering.
Acknowledgements
The Authors acknowledge AREA Science Park for the computational resources provided. This work was partially supported by funding from the European Union Nezt- Generation EU programme (Piano Nazionale di Ripresa Resilienza Missione & Componente 2, Investimento 1.5 D. D. 1058 33/06/2022, ECS ECS_00000043) part of the Interconnecled Nord-Est Innovation Ecosystem (iNEST).
10

---

Published in Transactions on Machine Learning Research (09/2025)
References
Sajjad Amini, Mohammadreza 'eymoorianfard, Shiqing Ma, and Amir Houmansadr. MeanSparse: Post-training robustness enhancement through mean-centered feature sparsification, 2024.
Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. In 16th European Conference on Computer Vision, 2020.
Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In Proceedings of the International Conference Machine Learning. 2018a.
Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. In Proceedings of the International Conference Machine Learning, 2018b.
Yatong Bai, Brendon G. Anderson, Aerin Kim, and Somayeh Sojoudi. Improving the accuracy-robustnes trade-off of classifiers via adaptive smoothing. In S1AM Journal on Mothemalics of Data Science, 2024a.
Yatong Bai, Mo Zhou, Vishal M. Patel, and Somayeh Sojoudi. MixedNUTS: Training-fres accuracy-robusiuess balance via nonlinearly mixed classifiers. In Transactions Machine Learning Research, 2024b.
Emanuele Ballarin. ebtorch: Collection of PyTorch additions, extensions, utilities, uses and abuses, 2025. URL httpp:///gsttuu...m/mmmmaaaaaall cww.://eaaballlarraaattooorlldl
Vincent Ballet, Xavier Renard, Jonathan Aigrain, Thibault Laugel, Pascal Frossard, and Marcin Detyniecki. Imper- ceptible adversarial attacks tabular data. In Thirty-thard Conference Newral Information Processing Systems, Workshop on Robust Al in Financial Services: Doto, Fairness, Exploinability, Trustworthiness, and Privacy (Robust Al in FS), 2019.
Brian R. Bartoldson, James Diffenderfer, Konstantinos Parasyris, and Bhavya Kailkhura. Adversarial robustness limits via scaling-law and human-aligumest studies. In Proceedings of the International Conference Machine Learning, 2024.
Atilim Gunes Baydin, Barak A. Pearlmutter, Alexey Andreyevich Radul, and Jeffrey Mark Siskind. Automatic differentiation in machine learning: a survey. The Journal of Machine Learning Research, 18(153):1-43, 2018.
Battista Biggio and Fabio Roli. Wild patterns: Ten years after the rise of adversarial machine learning. Pattern Recognition, 84:317-331 2018.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Srudić, Pavel Laskov, Giorgio Giacinto, and Fabio Roli. Evasion attacks against machine learning at test time. In Proceedings of the 2013th European Conference Machine Learning and Knowledge Discovery in Databases Volume Part ITI, 2013.
Luca Bortolussi and Guido Sanguinetti. Intrinsic geometric vulnerability high-dimensional artificial intelligence, 2018.
Léon Bottou. On-Line Algoritimms and Stochastic Approzimations, chapter 2. Cambridge University Press, 1999.
Ginevra Carbone, Matthew Wicker, Luca Laurenti, Andrea Patanè, Luca Bortolussi, and Guido Sanguinetti. Robustness of Bayesian neural networks to gradient-base attacks. In Advances in Nevral Information Processing Systems, 2020.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Tan Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness, 2019.
Huanran Chen, Yinpeng Dong, Zhengyi Wang, Xiao Yang, Chengqi Duan, Hang Su, and Jun Zhu. Robust classification via single diffusion model, 2023.
Patryk Chrabaszez, Ilya Loshchilov, and Frank Hulter. downsampled variant of ImageNet as an alteruative the CIFAR datasets, 2017.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yaun Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In Proceedings of the International Conference on Machine Learning, 2017.
11

---

Published in Transactions on Machine Learning Research (09/2025)
Francesco Croce and Matthias Hein. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-Iree allacks. In Proceedings of the International Conference on Machine Learning, 2020a.
Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack, 2020b.
Francesco Croce, Maksym Andriushchenko, Vikash Sehwag, Edoardo Debenedetti, Nicolas Flammarion, Mung Chiang, Prateek Mittal, and Matthias Hein. RobustBench: standardized adversarial robustness benchmark. In Thirby-fith Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021.
Jiequan Cui, Zhuotao Tian, Zhisheng Zhong, Xiaojuan Qi, Bei Yu, and Hanwang Zhang. Decoupled Kullback-Leible divergence loss, 2023.
Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. AdverTorch v0.1: An adversarial robustness toolbox based on Py'Trrch, 2019.
Hadi M. Dolatabadi, Sarah Erfani, and Christopher Leckie. rob-sstsssssss and beyond: Unleashing efficient adversarial training. In 18th Europeon Conference on Computer Vision, 2022.
lan Goodfellow, Jean Ponget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial nets. In Advences in Neural Information Processing Systems, 2014.
Ian Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and hamesssing adversarial examples. In International Conference on Learning Representations; 2015.
Sven Gowal, Chongli Qin, Jonathan Uesato, Timothy Mann, and Pushmeet Kohli. Uncovering the limits of adversarial training against worn-bounded adversarial examples, 2020.
Sven Gowal, Sylvestre-ANve Alvise Rebuffi, Olivia Wiles, Florian Stimberg, Dan Andrei Calian, and Timothy A Mann. Improving robustness using generated data. In Advances in Neural Information Processing Systems, 2021.
Shixiang Gu and Luca Rigazio. Towards deep neural network architectures robust to adversarial examples. Workshop Track of the International Conference on Learning Representations, 2015.
Trina Higgins, Loic Matthey, Arka Pal, Christopher Burgess, Xavier Glorot, Matthew Botvinick, Shakir Mohamed, and Alexander Lerchner. beta-VAR Learning basic visual concepts with a constrained variational framework. In International Conference on Learning Representations, 2017.
Mitch Hill, Jonathan Mitchell, and Song-Chun 7hu. Stochastic security: Adversarial defense using long-run dynamics of energy-based models. In International Conference on Learning Representations, 2021.
Chin-Wei Huang, Jae Hyun Tim, and Aaron Courville. A variational perspective on diffusion-based generative models and score matching. In Advonces in Neurol Information Processing Systems, 2021.
Uiwon Hwang, Jaewoo Park, Hyemi Jang, Sungroh Yoon, and Nam Ik Cho. PuVAE: A variational autoencoder to purify adversarial examples. In JEEE Access, 2019.
Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry, Adversarial examples are not bugs, they are features. In Advances in Neural Information Processing Systems, 2019.
Xiaojun Jia, Yong Zhang, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. LAS- AT: Adversarial training with learnable atlack strategy. In Proceedings of the IEEE/CVI Conference on Computer Vision and Pallern Recognation, 2022.
Diederik P. Kingmaa and Max Welling. Auto-encoding variational Bayes. In International Conference on Learning Representations, 2014.
Alex Krizhevsky. Learning multiple layers of features from tiny images, 2009.
Alexey Kurakin, lan J. Goodfellow, and Samy Bengio. Adversarial examples in the physical world. Artificial Intelligence Safety and Security, 2018.
Cassidy Laidlaw, Sahil Singla, and Soheil Feizi. Perceptual adversarial robustness: Defense against unseen threat models. In International Conference on Learning Representations, 2021.
12

---

Published in Transactions on Machine Learning Research (09/2025)
Yamn LeCun and Corimna Cortes. The MNIST handwritten digit database, 2010.
Yann LeCun, Sumit Chopra, Raia Hadsell, Mare Aurelio Ranzato, and Fu Jie Huang. A Iutorial on mnergy-based learning, chapter 1, MIT Press, 2006.
Minjong Lee and Dongwoo Kim. Robust evaluation of diffusion-based adversarial purification. In International Conference on Computer Vision, 2024.
Fangzhou Liao, Ming Liang, Yimpeng Dong, Tianyu Pang, Xiaolin Hu, and Jun Zhu. Defense against adversarial attacks using high-level representation guided denoiser. In IEEE Conference on Computer Vision and Pettern Recognition, 2018.
Guang Lin, Zerui Tao, Jianhai Zhang, Toshihisa Tanaka, and Qibin Zhao. Robust diffusion models for adversarial purification, 2024.
Liyuan Lin, Haoming Jiang, Pengcheng He, Weizhu Chen, Xiaodong Liu, Jianfeng Gao, and Jiawei Han. On the variance of the adaptive learning rate and beyond. In International Conference on Learning Represenlations, 2020.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidtt Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In International Conference on Learning Representations, 2018.
Tom M. Mitchell. The need for biases learning generalizations. Technical report, Rutgers University, New Brunswick, NJ, 1980.
Moyeen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. DeepFool: simple and accurate method to fool deep neural networks. In IEEE Conference Computer Vision and Pattern Recognition, 2016.
Welli Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In Proceedings of the International Conference on Machine Learning, 2022.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, Alban Desmaison, Andreas Kopf, Edward Yang, Zachary DeVito, Martin Raison, Alykhan Tejani, Sasank Chilamkurthy, Benoit Steiner, Lu Fang, Junjie Bai, and Soumith Chintala. PyTorch: An imperative style, high-performance deep learning library. In Advances in Neural Information Processing Systems, 2019.
ShengYun Peng, Weilin Xu, Cory Cornelius, Matthew Hull, Kevin Li, Rahul Duggal, Mansi Phute, Jason Martin, and Duen Horng Chau. Robust principles: Architectural design principles for adversarially robust CNNs, 2023.
Yao Qin, Nicholas Carlini, Tan Goodfellow, Garrison Cottrell, and Colin Raffel. Imperceptible, robust, and targeted adversarial examples for automatic speech recognition. In Proceedings of the International Conference on Machine Learning, 2019.
Sylvestre-Alvise Rebuffi, Sven Gowal, Dan Andrei Calian, Florian Stimberg, Olivia Wiles, and Timothy Mann. Data augmentation can improve robustness. In Advances in Neural Information Processing Systems, 2021.
Danilo Jimenez Rezende, Shakir Mohamed, and Daan Wierstra. Stochastic backpropagation and approximate inference in deep generative models. In Proceedings of the International Conference on Machine Learning, 2014
Herbert Robbins and Sutton Monro. A stochastic approximation method. The Annals of Mathemationl Statistics, 22 (3):400 - 407, 1951.
Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial
attacks using generative models. In International Conference on Learning Representations, 2018.
Changhao Shi, Chester Holtz, and Gal Mishne. Online adversarial purification based on self-supervised learning. In International Conference on Learning Representations, 2021.
Naman D Singh, Francesco Croce, and Matthias Hein. Revisiting adversarial training for ImageNet: Architectures, training and generalization across threat models, 2023.
Leslie N. Smith Cyclical learning rates for training neural networks. In IEEE Winter Conference on Applications of Computer Vision, 2017.
13

---

Published in Transactions on Machine Learning Research (09/2025)
Kihyuk Solm, Honglak Lee, and Xinchen Yan. Learning struclured output representation using deep conditional generative models. In Advances in Neural Information Processing Systems, 2015.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. International Conference on Learning Representations, 2014.
Florian Tramer and Dan Boneh, Adversarial training and robustness for multiple perturbations. Advances in Neural Information Processing Systems, 2019.
Florian Tramer, Alexey Kurakin, Nicolas Papernot, lan Goodfellow, Dan Boneh, and Patrick McDaniel Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018.
Florian Tramer, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Advances Newral Information Processing Systems, 2020.
Pascal Vincent, Larochelle, Yoshua Bengio, and Pierre-Autoine Manzagol. Extracting and composing robust. features with denoising autoenocders. In International Conference on Machine Learning, 2008.
Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training, 2023.
Han Xiao, Kashif Rasul, and Roland Vollgraf. Fashion-MNIST: novel image dataset for benchmarking machine learning algorithms, 2017.
Xinchen Yan, Jimei Yang, Kihyuk Sohn, and Honglak Lee, Attribute2lmage: Conditional image generation from visual attributes. In Proceedings of the European Conference on Computer Vision, 2016.
Zhaoyuan Yang, Zhiwei Xu, Jing Zhang, Richard Hartley, and Peter Tu. Adversarial purification with the manifold hypothesis. In AAAI Conference on Artificial Intelligence, 2024.
Jongmin Yoon, Sung Ju Hwang, and Juho Lee. Adversarial purification with score-based generative models. In Proceedings of the International Conference Machine Learning, 2021.
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent Ghaoui, and Michael 1. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the International Conference on Machine Learning, 2019a.
Finn. MEMO: Test time robustness via adaptation and angmentation. In Advances in Neural Information Processing Systems, 2022.
Zhang, Levine,
Michael Zhang, James Lucas, Jimmyy Ba, and Geoffrey Hinton. Lookahead optimizer: steps forward, 1 step back. In Advances in Neural Information Processing Systems, 2019b.
Zhaoyu Zhang, Mengyan Li, and Jun Yu. On the convergence and mode collapse of GAN. In SIGGRAPH Asio 2018 Technicaa Briefs, 2018
14

---

Published in Transactions on Machine Learning Research (09/2025)
A Justification of Adversarialyy-balncee batches
During the incipient phases of experinentation, preliminary tests were performed with the MNIST (LeCun & Cortes 2010) and Fashion-MNIST (Xiao et al. 2017) datasets using a conditional VAE as the purifter, and small FCNs or convolutional ANNs as the classifiers. Adversarial examples were generated against the adversarially tra-trained classifier, and tentatively denoised by the purifier with one sample only. The resulting recovered inputs were classified by the classifier and the overall accuracy was recorded.
Importantly; such tests were not meant. to assess the end-to-end adversarial robustness of the whole architecture, but only to tune the training protocol of the purifier.
Generating adversarial training examples by means of PGD is considered the gold standard (Gowal et al, 2020) and was first attempted as a natural choice to train the purifier. However, in this case, the following phenomena were observed:
Unsatisfactory clean accuracy was reached upon convergence, speculatively a consequence of the VA E having never been trained on clean-to-clean example reconstruction;
Persistent vulnerability same norm-bound FGSM perturbations was noticed;
Persistent vulncrability to smaller norm-bound FGSM and PGD perturbations was noticed.
In attempt to mitigate such issucs, the composition of adversarial examples was adjusted to specifically counteract each of the issues uncovered. The adoption of any smaller subset of attack types or strength, compared to that described in subsoction 4.4, resulted in unsatisfactory mitigation.
At that point, another problem emerged: if such an adversarial training protocol was carried out in homogeneous batches, each containing the same type and strength of attack (or none at all), the resulting robust accuracy was still partially compromisod due the homogencous ordering of attack types and strengths across batches.
Such observations lead to the final formulation of the training protocol, detailed in subsection 4.4 which mitigates to the best the issues described so far.
B Justification of the robust aggregation strategy
The rationale leading to the choice of the specific robust aggregation strategy described in |subsection 4.5 was attempt to answer the following question: 'How is it possible to aggregate the results of an ensemble of classifiers in a way such that it is hard to tilt the balance of the ensemble by attacking only a few of its members?: The same reasoning can be extended to the reciprocal problem we are trying to solve here, where different input reconstructions obtained from the same potentially perturbed input are classified by the same model (the classéfier).
B.1 Heuristic analysis
Far from providing satisfactory answer, we can analyse the behaviour of our aggregation strategy as the logit associated with a given model and class varies across its domain, under the effect of adversarial intervention. Comparison with existing (and more popular) probability averaging and logit averaging aggregation strategies should provide heuristic justification of our choice.
We recall our aggregation strategy:
N
P: = Z
a=1
Additionally, we recall logit averginn aggregation
15

---

Published in Transactions on Machine Learning Research (09/2025)
N
N
1
P; =
Z
7
and probability averaging aggregation
N
N
Pr
6
Qa
a=l
j=1
a=
where Q = -Es=1ed. E'.
Finally, since 18 E IR, VlS. lim et = 0 and e² = 1, can observe that ex > 0 and eel? 1, 1.
Now, we consider a given class i* and the classifier prediction on a given input reconstruction a", and study the potential effect of an adversary acting on E This adversarial intervention can be framed two complementary scenarios: either the class i is correct and the adversary aims to decrease its membership probability, or the class i* is incorrect and the adversary aims increase its membership probability. In any case, the adversary should comply with the bo-boundessess of its perturbation the imput.
Logit averaging In the former scenario, the product of ele terms can be arbitrarily deflated (up to zero) by lowering the 13¹ logit only. In the latter scenario, the logit can be arbitrarily inflated, and such effect is only partially suppressed by normalisation by Z (a sum of j/n-exponentiated terms, N 2 1).
Probability averaging In the former scenario, although the effect of the deflation of a single logit is bounded by e!t > 0, two attack strategics possible: either decrcasing the value of 13. or increasing the value of Q",, giving rise to complex combined effects. In the latter scenario, the reciprocal is possible, í.e. either inflating 1o. or deflating Q" Normalisation has no effect in both cases.
Ours In the former scenario, the effect of logit deflation on a single product term is bounded by e0L > 1, thus exerting only a minimal collateral effect on the product, through a decrease of Z. This effectively prevents aggregation takeover by logit deflation. Similarly logit averaging, the latter scenario, the logit can be arbitrarily inflated. However, in this case, the effect of normalisation by Z much stronger, given its increased magnitude (addends not //w-exponentiated, N 2 1).
From such a comparison, our aggregation strategy is the only one that strongly prevents adversarial takeover by logit deflation, while still defending well against perturbations targeting logil inflation.
B.2 Experimental analysis
To further corroborate the choice of the specific aggregation function described in subsection 4.5) repeat. the assessment of CARSO under the same conditions described in section 5] the only difference being the use of the alternative aggregation functions analysed in suusecctin B.1 (i.e. logit and probability averaging aggregation). Results, in terms of both clean and robust accuracy, are shown in Table 4
In Table 5. we additionally provide the same clean and robust accuracy asscssment for the naive and non alggoillmiially-dfffeeee//l
majority voling aggregation strategy. In such regard, it is important to remark that the non-differentiabiliy of majority voting results in the vast portion (> 99%) of gradient samples used by AUTOATTACK being either zero or not-a-namber. Thus, the result of robustness assessment has to be considered unreliable and not the mark of exceptional robustness as almost exclusively the effect of gradient obfuscation.
As we can see, the use of alternative aggregation stratogics leads to minimal variations in the clean accuracy attained, whereas the corresponding robust accuracy sharply decreases in the case of CIFAR-10 even below random chance the attacks become increasingly effective (or unreliable, as it is the case for majorily
16

---

Published in Transactions on Machine Learning Research (09/2025)
Table 4: Clean (results in italic) and adversarial (results in upright) accuracy for alternative aggregation strategies used within CARSO. The following abbreviations are used: Scen: scenario considered; C/C1 (L.A.): : clean accuracy of CARSO with logit average aggregation; C/randAA (L.A.): robust accuracy of CARSO with logit average aggregation, assessed by means of AUTOATTACK for stochastic defences; C/C1 (P.A.): clean accuracy of CARSO with probability average aggregation; C/randAA (P.A.): robust accuracy of CARSO with prabability average aggregation, assessed by means of AUTOATTACK for stochastic defences; c/Cl: clean accuracy of CARSO with proposed aggregation; C/randAA: robust accuracy of CARSO with our proposed aggregation, assessed by means of AUTOÅTTACK for stochastic defences. Results from the last two columms mirror those of Table 2
Scen.
Dataset
C/CI (L.A.)
C/randAA (L.A.)
C/CI (P.A.)
C/randAA (P.A.)
C/C1
C/randAA
(a) CIFAR-10
0.8688
0.0086
0.8688
0.0092
0.8686
0.7613
(b) CIFAR-100
0. 0868
0.0436
0. 086807
0.0439
0.6806
0.6665
Table 5: Clean (results in itaicc and adversarial (results in upright) accuracy resulting from the use of the majority vote aggregation strategy within CARSO. The following abbreviations used: Scen: scenario considered; C/C1 (M. clean accuracy of CAnSO with majority vote aggregation; C/randAA (M.V.): robust accuracy of CAnSO with majority vote aggregation, assessed by means of AUTOATTACK for stochastic defences. Almost the entirety of gradient samples computed by AUTOATTACK has been deemed unreliable by integrated diagnostics, and the robust accuracy results must be considered untrustworthy.
Scen. Dataset
C/C1 (M.V.)
C/randAA (M.V.)
(a) CIPAR-10
0.8691
0.8602
(b) CIPAR-100
0.6805
0.6698
voting). Such results strongly corroborate the use of the normalised doubly-erponential logit product proposed as the aggregation strategy in ssubsection 4.5 and prove its central role in the overall adversarial robustness and reliability of the method.
C Architectural details and hyperparameters
In the following section, we provide more precise details about the architectures subsection C.1 and hyperparameters (subeection C.2) used in the experimental phase of our work.
C.1 Architectures
In the following subsection, describe the specific structure of the individual parts composing the purifier in the three scenarios considered. As far as the classifier architectures are concerned, we redirect the reader to the original articles introducing those models (i.e., those by Cui et al. (2023) for scenarios (a) and (b), Wang et al. 2023 for scenario (c)).
During training, before being processed by the purifier encoder, input examples are standardised according to the statistics of the respective training dataset.
Afterwards, they are fed to the disjoint input encoder (see subsection 4.3). whose architecture is shown in
Table 6 The same architecture is used in all scenarios considered.
The original input is also fed to the classifier. The corresponding internal representation extracted, preserving its layered structure. In order to improve the scalability of the method, only a subset of classifier layers is used instcad of the whole internal representation. Specifically, for each block of the WITERESNET architecture, only the first layers have been considered; two skip connections have also been added for good measure. The exact list of those layers is reported in Table 7
17

---

Published in Transactions on Machine Learning Research (09/2025)
Table 6: Architecture for the disjoint input encoder of the purífier. The same architecture is used in all scenarios considered. The architecture is represented layer by layer, from input to output, in PyTorch-like syntax. The following abbreviations used: Conv2D: 2-dimensional convolutional layer; ch_ in: number of imput channels; ch_ out: number of output channels; ks: kernel size; s: stride; p: padding; b: presence a learnable bias term; BatchNorm2D: 2-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; slope: slope for the activation function in the negative semi-domain.
Disjoint Ingut Encoder (all scenarios)
Conv2D(ch_inggg in=3, ch_out=6, ks=3, s=2, p=1, b-False) Bacchloomm20aaffin--rruu LeakyReLUU(slop=00.2
Conv2D (ch, in=6, ch_ out=222 ks=3, s=2, p=1, b=False) Batchllorm2((fffieeTTTru LeakyReLU(slope-0)
Table 7: Classifier model (WIDERESNET-P) 10) layer names used as (a subset of) the internal representation fed to the layerwise convolutional encoder of the purifier. The reflect those used in the model implementation.
All scenarios
layer block. convv___
layer www.kkbblookkoo. convv
layer wlw.kk.bb..............ooo...... conv._
1ayer.0.bler. b.w.................ooo.k.. conv_
layer w.w.k..................o..kk..k. 2. conv__
0.yrr.0.block.. 2. 2tl.bll...c.o.........
0.ler.0.block3.comm
layer.0.bloce 0oyer.0.blockk3.com
1.lockk
layer 1ayer.
1.yer.1.block..coom
layer.1.block.3.co
layer www.kk.bl..k.oooo
layer www.kk.bblok...oooooooo
layer blo..ll......rrtt......
layer 2.block.l.kk wlock..1.conv.
layer b.bockk1.comm
layer 2.llckk2.ccot
layer 2.block.2.com
layer b.block.3.. conv__
layer 3l.ck...
18

---

Published in Transactions on Machine Learning Research (09/2025)
Each extracted layerwise (pre)activation tensor has the shape of multi-channel image, which is processed independently for each layer by a different CNN whose individual architecture is shown in Table scenarios (a) and (b)) and Table (scenario (c)).
Table 8: Architecture for the layerwise internal representation encoder of the purifier. The architecture shown in this table is used in scenarios (a) and (b). The architecture is represented layer by layer, from input to output, in a Porch-lklkke syntax. The following abbreviations are used: Conv2D: 2-dimensional convolutional layer; ch in: number of imput channels; ch_out: number of output channels; ks: kernel size; stride; p: padding; b: presence of learnable bias term; BatchNorm2D: 2-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; alope: slope for the activation function in the negative semi-domain. The abbreviation [ci] indicates the number of imput channels for the (pre)activation tensor of each extracted layer. The abbreviation ceil indicates the ceiling integer rounding function.
Layerwise Internal Representation Encoder (scenarios (a) and (b))
Conv2D(ch Batchhlorm22(affiieeeTru.
[cw]2DDcc_in[[i]]] [ci], ch_ out)ceel((cci)/)),) ke=3, s=1, p=0, b=False)
LeakyReLU(sloppe0022
ch_out=ceil ch_o0t=coel((cc))44)) ks=3, s-1, p-0, b-False)
Bacchllomm)D(afffeeeeTTrer))
LeakkyReUU(slope=0022
Conv2D
[onrDD(chhinrrcci(((ce)) /4), th_out=ceil ( ks=3, s=1, p=0, b=False)
Ratchllorm200affiineerrae
LeakyReeUU@algpe=0..2
Table 9: Archilecture for the layerwise internal representation encoder of the purifier: The architecture shown in this table used scenerio (c). The architecture is represented layer by layer, from imput output, a PyTorch-like syntax. The following abbreviations are used: Conv2D: 2-dimensional convolutional layer, ch in: number of input channels; ch ch_out: out: number output channels; ks: kernel size; s: stride; p. padding: b: presence of a learnable bias term; BatchNorm2D: 2-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; slope: slope for the activation function in the negative semi-domain. The abbreviation [ci] indicates the number of input channels for the (pre)activation tensor of each extracted layer. The abbreviation ceil indicates the ceiling integer rounding function.
Layerwise Internal Representation Encoder (scenario (c))
Conv2D(ch_ in=[ci],
(((iott)))ll(()))2)) ks=3, s-1, p-0, b-False)
Batchloor22D Trre
LeakyReLU(sloppeD..I
Conv2D (n=ceii((cc]] /2), ch_ (ut=ceil((ci)1)6 ks=3, s=1, p=0, b=False)
Batchhlorrm20aafffiee-TTuu
LeakyRelUU@11ope000.22
Conv2D (n=ceil([ci]/4]
(hLou)=ceil((c)))88) ks=3, s=1, p=0, b=False)
(atchllrmm2Dafffieerrru
LeatyRel
Conv2D in=ceil(((c]]]
ch_o0t=cail((ci1110))) ks=3, s=1, p=0, b=False)
Datchllom22D(affinettt LeakyRelU(slopp=0.22
The resulting tensors (still having the shape of multi-channel images) are then jointly processed by fully- connected subnetwort whose architecture is shown in Table 10 considered is shown in Table 15
The value of fcrepr for the different scenarios
The compressed input and compressed internal representation so obtained are finally jointly encoded by an additional fully-connected subnetwork whose architecture is shown Table 11 The output is a tuple of means and standard deviations to be used to sample the stochastic latent code
19

---

Published in Transactions on Machine Learning Research (09/202))
Table 10: Architecture for the fully- connecteee representation encoder of the purifier. The architecture shown in this table is used in all scenarios considered. The architecture represented layer by layer, from imput output, Py PyTorch-like synlax. The following abbreviations are used: Concatenate: layer concatenating its imput features; features: flatten_feature: whether the input features are be flattened before concatenation; feats, in, feats_ott out: number of imput and output features of a linear layer; b: presence of a learnable bias term; BatchhorriD: 1-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; slope: slope the activation function in the negative semi-domain. The abbreviation [computed] indicates that the number of features is computed according to the shape of the concatenated imput tensors. The value of fcrepr for the different scenarios considered is shown in Tabll 15
Colly-ooneected Representation Encoder (all scenarios)
Concatemate (aatteffffeeteettaeaeeeeeeeeeeee
Linear (feats (aaaaaaffaatannnaaaaaaaa [compute) feats_ outefrree,,,, b=False)
BatchloraaDD(afflne-Tru LeakyReLJU<slppe0.22
Table 11: Architecture for the collecccmeeectedd joint encoder of the purifter. The architecture shown this table is used in all scenarios considered. The architecture is represented layer by layer, from imput to output, in a PyTorch-llkee syntax. The following abbreviations are used: Concatenate: layer concatenating input features; flatten flatten_features whether the input features are to be flattened before concatenation; feats_ in, feats_out out: number of input and output features a linear layer; b: presence of a learnable bias term; BatchNormiD: 1-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; slope: slope for the activation function in the negative semi-domain. The abbreviation [computed] indicates that the number of features is computed according to the shape of the coucatenated input tensors. The value of fjoint for the different scenarios considered is shown in Table 15 The last layer of the network returns tuple of 2 tensors, each independently processed from the output of the previous layer by the comma-separated sub-layers.
features:
Pully-Conmedte Joint Encoder (all scenarios)
Concatenate
Linear (feats [ccoppuueed[[ccooteeeeeceee BatchlorraD(aaffiieeeTre LeakyReLJU(slope=00.22
feats_out out=fooint b=False)
Linear (feats, (eteatssii=fooittt feats, feats_out jotts_,, b=True),
Linear Linear(feats in-fjoint, feats, caattss_u=ffooit, b=True)
20

---

Published in Transactions on Machine Learning Research (09/2025)
The sampler used for the generation of such latent variables 2, during the training of the purifier, is reparameterised (Kingma & Welling 2014) Normal sampler ~ (u, During inference, z is sampled by reparameterisation from the i.i.d Standard Normal distribution x ~ (0, (i.e. from its original prior).
The architectures for the decoder of the purifier are shown in Table 12 (scenarios (a) and (b)) and Table 13 (scenario (c))-
Table 12: Architecture for the decoder the purifier. The architecture shown this table is used in scenorios (a) and (6). The architecture is represented layer by layer, from input to output, in a PyTorrchllike syntax. The following abbreviations are used: Concatenate: layer concalenating its imput features; flatten, features: whether the imput features are to be flattened before concatenation; feats_im, feats_oute number of input and output features of a linear layer; b: presence of a learnable bias term; ConvTranspose2D: 2-dimensional transposed convolutional layer; ch_in: number of input channels; ch_ out: number of output channels; ks: kernel size; stride; p: padding; op: Py'Torch parameter 'output padding', used to disambiguate the number of spatial dimensions of the resulting output; b: presence of learnable bias term; BatchNorm2D: 2-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; slope: slope for the activation function in the negative semi-domain. The values of fjoint and fcrepr for the different scenarios considered shown in Table 15
flatten_featuress
Decoder (scenarios (a) and (b))
Concatenate fellaatten_fatuurrs-Tuue
Linear(feats, (fteeettssssinfffoottttttooooeo
geats_out-2504, b-True)
LeatyRelUUsslop==0.22
Unflatten (256, 3,
ConrTraanspee2D(chhhhh-2225
2h_out-256, ks=3, s=2, p=1, op=0, b-False)
RatchhoormmD((fffine=+Trrr)))
LeskkyRelU(@slop==0022)
Con/Traasspas22(chhinrr2223
ch_ott=1 ks=3, s=2, p=1, op=0, b=False)
Batchhlocm22(afffieeerrrre)
LeadkyRelU(sslpp==022)
ConrTrranspss22((ctiin==1123 ch ch_out=64 ks=3, s=2, p=1, op=0, b=False)
BatchMoormm20Gfffinee=Teee))
LeaiyyhelD(sslge==022)))
Con/Traansosse2(chhhiin6664 ch_out=32, ks=3, 8-2, p=1, op=0, b=False)
Batchloomm/D(affineeTTTrr)))
LeadyyReJU(slope=0022)
ConvTranspose2DCch_ho in=32, ch ch_out=3, ks=2, s=1, p=1, op=0, b=True) Sigmoid()
C.2 Hyperparameters
In the following section, we provide the hyperparameters used for adversarial example generation and optimisation during the training of the purifier, and those related to the purifier model architectures. We also provide the hyperparameters for the PED+FOT attack, which is used complementary tool for the evaluation of adversarial robustness.
Attacks The hyperparameters used for the adversarial attacks described in subsecttin 4.4 are shown in Table 14 The value of 6x is fixed to 6xe = 8/2ss. With the only exception of 6so, AUTO is to be considered huperparameter-free adversarial example generator.
Table 15 contains the hyperparameters that define the model architectures used as part of the puriffier, in the different scenarios considcrod.
Architectures
Training Table 16 collects the hyperparameters governing the training of the purifier in the different scenarios considered.
21

---

Published in Transactions on Machine Learning Research (09/2025)
Table 13: Archilecture for the decoder of the purifier. The architecture shown in this table is used in scenario (c). The architecture is represented layer by layer, from input to output, in a Py PyTocch-like syntax. The following abbreviations used: Concatenate: layer concatenating its input features; flatten_ ceattenfeetuurrs whether the input features are to be flattened before concatenation; feats_in, feats_ _oot: number imput and output features of a linear layer; b: presence of learnable bias term; ConyTranspose2D: 2-dimensional transposed convolutional layer; ch_in: number of input channels; ch_out: number of output channels; ka: kernel size; s: stride; p. padding; PyTorch parameter 'output padding', used to disambiguate the number of spatial dimensions of the resulting output; b: presence of learnable bias term; BatchNorm2D: 2-dimensional batch normalisation layer; affine: presence of learnable affine transform coefficients; slope: slope for the activation function in the negative semi-domain. The values of fjoint and fcrepr for the different scenarios considered are shown in Table 15
Decoder (scenario (c))
(ffattnn features=True)
teats_out=4096, b-True)
LeakyhelUUsslope-0.2)
Unflatten 4, 4)
par/Traanspose2Dcch_iii in=256, ch ch_oot=256, ks=3, s=2, p=1, op=1, b=False)
Batchllorm/D(fffinneeTrr))
LeakyRelUUsslope=0.22
Con/Thanagpss22(chhhi---2222 ch_out=128, ks=3, s=2, p=1, op=1, b=False)
LeakyhelUU(slgpe=0.22)
Conr/Transpose22(cch_iiiii ch out=64 ks=3, s=2, p=1, op=1, b=False)
Batchllorm/D(afffiee=TTrrr))))))
LeadkyRe:U(slopp=00.22)
Conr7Tranepoee2DCchhinnee..
ch_out=32, ke=3, s=2, p=1, op=1, b-False)
Batchhoormm2((affin==TTrr)))
Leaktyle@U(slope=0022)
ConvTransposeeD in-32, ch out=3, ks=3, s=1, p=1, op=0, b-True) Sigmoid()
Table 14: Hyperparameters for the attacks used for training and testing the purifier The FGSM and PDG attacks refer to the training phase (see Subbectiii 4.4), whereas the PGD+EEoT attack (Lee & Kim] 2024) refers to the robustness assessment pipeline. The entry CCE denotes the Categorical CrossEntropy loss function. The foc threat model is assumed, and all inputs are linearly rescaled within [0.0, 1.0] before the attack.
FGSM
PGD
PGD+EOT
Input clipping
[0.0, 1.0]
[0.0, 1.0]
[0.0, 1.0]
# of steps
1
40
200
Step size
6,c
0.01
0.007
Loss function
CCE 1
CCE
CCE
# EoT iterations Optimiser
20
SGD
SGD
Table 15: Scenario-specific architectural hyperparameters for the purifier, as referred to in Table 10
Table 11
Table 12 and Table 13
Scenario (a)
Scenario (b)
Scenario (c)
fcrepr fjoint
512
512
768
128
128
192
22

---

Published in Transactions on Machine Learning Research (09/2025)
Table 16: Hyperparameters used for training the purifter; grouped by scenario. The entry CCE denotes the Categorical CrossEntropy loss function. The LR scheduler is stepped after each epoch.
All scenarios
Sc. (a)
Sc. (b)
Sc. (c)
Optimiser
RADAM+LOOKAHEAD
RADAM $1
0.9
RADAM B3
0.999
RADAM
10
RADAM Weight Decay
None
LOOKAHEAD overaging decng
0.8
LOOKAHEAD steps
6
Initial LR
10-9
Loss function
CCE
Sampled reconstructions per inpul
Epochs
200
200
250
LR warm-up epochs
25
25
31
LA plateau epochs
25
25
31
LR annealing epochs
150
150
188
Platean LR
0.064
0.064
0.0128
Final LR
4.346 x 10-4
1.346
10-4
1.378 x 10
3 increase initial epoch increase final epoch Batch size
25
25
32
34
34
5120
2560
1024
Adversarial batch fraction
0.5
0.15
Ablation study on the need for adversarial training
In order determine whether is necessary to train on adversarial examples each of the constituent parts of CARSO, ablation study is performed. The architecture of CARSO provided in section 5.1 compared in terms of clean and robust accuracy with those ablated as follows. A WIDERESNET-28 10 model is always used as the classifier.
Both the initial instance of the classifier (that used to extract the internal representation) and the final (that used to actually perform classification) trained clean examples only.
The final classifier is trained clean examples only, whereas the former is adversarially-trained..
The initial classifier is trained on clean examples only, whereas the latter is adversarially-trained
Results of such comparison are shown in Table 17
As is possible see, only the clean/A7 ablation provides clean and adversarial accuracies comparable that of the original CARSO architocture and indeed, it even determines an improvement on the CIFAR-10 and CIFAR-100 datasets. On the other hand, adversarial training of the former instance of the classifier is necessary to achieve the best robustness results TINYIMAGENET-200
Keeping in mind that the TINYMMAGRNET-200 datasct is the closest representative considered for larger-scale datasets, and that empirical robust accuracy results only constitute an upper bound of maximally attainable robust accuracy, we support the original CARSO architecture as the most effective for the achievement of adversarial robustness on generic image classification datasets even if at the cost of slight clean accuracy penalty. Since an adversarially-trainn classifier would be used nonetheless as the latter, this does incur in increased training-time computational intensity.
23

---

Published in Transactions on Machine Learning Research (09/2025)
Table 17:
Results the ablation study on the architecture CARSO. The Clean Acc. column shows the test-set accuracy on uncorrupted inputs for the specifie ablated model; the randAA Acc. column shows the accuracy of the same model on test-set inputs perturbed by means of version AUTOATTACK suitable stochastic defences. the Type of ablation column, any entry different from None (original architecture) indicates the type of training used for the first (before solidus) and the second (after the solidus) classifier following input-to-output flow, within the ablated CARSO architecture.
Dataset
Type ablation
Clean Acc.
randAA Acc.
clean/ /clean
0. 0.1314
0.7070
AT clean
0.6743
< 0.7070
CIFAR-10
clean/A /AT
0.8892
0.7975
None
0.8686
0.7613
clean/clear
0.4395
0.4032
AT AT/clean
0.4379
< 0.4032
C1PAR-100
cleon/Af AT
0.6876
0.6716
None
0.6806
0.6665
clean/AT AT
0.5677
0.5281
TINYIMAGENNT-2000
None
0.5632
0.5356
E Further results and comparisons
The following section contains additional results and comparisons, in the form of tabular data, that may be of interest the reader.
In particular, Table 19 compares the clean and robust accuracy of CARSO with those of the top-5 adversarial training defences according to the ROBUST BENCH Croce et al. 2021 leaderboard and the top-5 (if available)
purification-baan defences according to Lee & Kim (2024), for CIFAR-10/ CIFAR-I0/CIFAR-L000
On shared columns, Table 2 can be considered a subset of Table 19. As discussed in subseccton 5.2 CARSO tops the comparison in terms of adversarial accuracy, while maintaining a clean accuracy comparable with that of some purification- models.
Table 18 instead, investigates the same comparison across CARSO and its classifier model, for adversarially- pretrained networks different from those described in (section 5.1 in particular, worse- persooeerfo.ing... As it is possible to see, the increase in end-to-end adversarial accuracy determined by CARSO does not depend in absolute terms on the quality of the original classifier model employed.
Table 18: Clean (results in italic) and adversarial (results in upright) accuracy for additional models to those described in subsection 5.2 The following abbreviations are used: AT/C1: clean accuracy for the adversarially-pretranne model used as the classifier, when considered alone; C/Cl: clean accuracy for the CARSO architecture; AT/AA: robust accuracy (by the means of AUTOATTACK) for the Aiversarially-preraaaii model used as the classifier, when considered alone; C/randAA: robust accuracy for the CARSO architecture, when attacked end-to-end by AUTOATTACK for randomised defences.
Dalaset
Classification model
AT/CI
AT/AA
C/C1
C/randAA
Rebuffi et al.
2021
0.8733
0.6075
0.8152
0.7070
CIFAR-10
Gowal et al.
20200
0.8948
0.6280
0.8361
0.7335
CIFAR-100
Rebuffi et al.
2021
0.624
0.3206
0.5723
0.5580
the time of paper review, Gir SHA hash:
24

---

Published in Transactions on Machine Learning Research (09/202))
Table 19:
Clean (results stalic) and adversarial (results upright) accuracy for state-of-the-art adversarial defences, compared to CARSO. The Robust Acc. column shows the best (i.e. lowest practically achieved) accuracy test-sel adversarial imputs, as obtained by either original publication introducing the method, evaluation by AUTOATTACK shown on the ROBUSTBENCh leaderboard, evaluation of bespoke adaptive attacks as shown the RObuSTBENCH leaderboard, or (for purification methods) evaluation by PCD+FETT from Lee Kim (2024). The Def. Type column indicates whether the defence is based adversarial training (AT), purification (P), both (AT+P), Results for CARSO are the same as for Table
Dataset
Model
Architecture
Clean Acc.
Robust Acc.
Def. type
Bartoldson al.
2024
WineResNee-94-16
0.9368
0.7371
AT
Amini et al. 2024
MeanSparse
WIDEReSNNT-99-166
0.9568
0.7310
AT
Peng et
RAWIDERESNNN--0U
0.9311
0.7107
AT
Wang et a
2023
WIDERESNET-70-16
0,9325
0.7069
AT
et
202.1b
RESNET-152 + WIDERESNNET-0-116
0.9519
0.6971
AT
CIFAR-10
Lin et al. 2024
Diffusion--bsed
0.9082
0.6641
P
Lee & Kim
[2024]
Diffusion-basel
0.9053
0.5688
P
Nie et al. (2022
Diffusion-based
0.9043
0.5113
P
et al.
2021
Energy-based
0.8412
0.5490
Yoon et
(2021
Diffusion-basse
0.8612
0.3711
P
Ours
CARSO (WIDERESNEEn22--1))
0.8686
0.7613
AT+P
Wang et al. 2023
WIDERESNET-70-10
0,7522
0.4266
AT
Amini
2024
MEANSPARSE WIDeResNer-70-16
0.7513
0.4225
AT
Bai et al
2024b
RESNET-152 + WIDERESNEE-70-11
0,8308
0.4180
AT
CIFAR-100
Cui et
2023
WIDERusNEr-2S-100
0. 738385
0.3918
AT
Bai el al
2024a
RESNET-152 + WIDEResNEr-70-116 MIXING NET
0.8521
0.3872
AT
Lin et al.
2024
Diffusion-based
0.6973
0.4609
P
Ours
CARSO (WiDeResNNen-88-10)
0.6806
0.6665
AT+P
25


Reviews:
[{"review_id": "V3rkxLGgcO", "reviewer": "Reviewer_xTRE", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths\n---\n\n1. This framework, which significantly improves robust accuracy simply by adding a VAE-based purifier that can be trained quickly compared to the diffusion-based purifier, is practical and easy to incorporate with existing classifiers. \n\n2. The evaluation employs attack methods that assume non-deterministic defenses, and the results have a certain level of reliability. \n\n3. The authors describe the limitations of the proposed framework, providing readers with useful information to understand the applicability of CARSO.\n\n\nWeaknesses\n---\n\n1. It is understandable that using a VAE trained with model features as conditions to purify images results in greater robustness, but I do not understand the necessity of using features from an adversarial training model. Please provide experimental or theoretical evidence to explain why it is necessary to train a VAE based on features from an adversarial training model.\n\n2. The proposed method consists of three important components: adversarial training, purification, and aggregation. However, experiments to evaluate the contribution of each component are not sufficient. While evaluation experiments on the aggregation method are conducted in Appendix D, settings without adversarial training or with the purifier simply connected in series have not been evaluated, making it difficult to understand the role of each component.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This study proposes a framework called CARSO that effectively integrates adversarial training, adversarial purification, and randomization, which are existing powerful defense techniques against adversarial attacks. CARSO trains a Variational Auto Encoder (VAE)-based purifier while freezing an adversarially trained image classifier. During inference, it aggregates the predictions of multiple purified images to introduce randomness.\nCARSO is evaluated through numerical experiments using three major datasets, including CIFAR10, CIFAR100, and Tiny ImageNet. Robustness evaluation is conducted using AutoAttack for randomized defenses and PGD+EOT because CARSO incorporates randomness. The proposed framework demonstrates higher robust accuracy compared to the robust accuracy of AT models after AutoAttack.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please see weaknesses above.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "m0vxPeXkRi", "reviewer": "Reviewer_Hjaq", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n- The proposed appears to improve the robustness of the pretrained robust classifiers. \n\n\n## Weakness \nThe article is sparse on hard theoretical facts or justifications. At present, it reads as a specific combination of ideas that already exist in literature. \n- If this article is accepted its because the experiments show improved adversarial robustness due to the proposed defense. However, there is no mechanistic interpretation or understanding of why there is an improvement, in particular, it is unclear for what learning tasks the proposed method can be expected to work.  \n- The authors employ an unorthodox choice of robust aggregation using double exponentials. While the appendix has a heuristic justification, I would like to understand a simple setting where the proposed aggregation mechanism is the clear correct choice. Further, how does this choice compare to an alternate naive choice - predicting the majority label over the reconstructed inputs $x_i$ ?\n\n\n#### Minor Issues\n- The authors frequently employ \\emdash and hyphens to interleave context in the middle of sentences. This reviewer found some sentences hard to parse. \n- The discussion of adversarial training/PGD attack schemes are unnecessary (given they are exact instantiations of established procedures)", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors propose a adversarial defense strategy to strengthen the robustness of a fixed classifier $f$. At inference time, for a corrupted test input $x$, the predicted label is computed by aggregating predictions of the classifier $f$ on reconstructed samples $x_{1}, \\ldots , x_{N}$. The reconstructed samples $x_i$ are generated using a stochastic conditional generative model (in this case conditional-VAEs) that utilize intermediate layer representations of the classifier $f$ on input $x$. To summarize, the authors propose a defense based on random reconstructions much like _purification_ strategies based on diffusion models [1].\n\nThe key insight of this article is that the intermediate neural representations of a pretrained classifier $f$ on a corrupted input $x$ provide valuable information to reconstruct clean inputs $\\tilde{x}$ on the data manifold. This insight on its own is not novel (see [2]). Evidently if the classifier $f$ is poor a fit for the data or non-robust, then the representations at a perturbed input are unstable and less informative. Hence this procedure hinges on the quality of the classifier $f$. In this article, the authors use an off-the-shelf SOTA adversarially robust classifier $f$.  \n\nAs per my understanding, the contribution of the article is -\n(1) A specific architectural choice of a conditional-VAE for the stochastic generative model\n(2) Experimental setups for training the conditional-VAE  \n\nThis reviewer finds the framing \"_blending adversarial training and adversarial purification strategies_\" an overly complicated perspective of the work since the pretrained classifier is untouched - so no active interaction with adversarial training strategies. \n\n\n\n\n \nReferences \n1. Nie, W., Guo, B., Huang, Y., Xiao, C., Vahdat, A., & Anandkumar, A. Diffusion Models for Adversarial Purification. \n2. Pouya Samangouei, Maya Kabkab, and Rama Chellappa. Defense-GAN: Protecting classifiers against adversarial\nattacks using generative models.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. __Experimental results on Imagenet.__ \nSuch a result would strengthen the paper since scalability is a critical concern for adversarial purification strategies. If computational resources are a concern, the authors could demonstrate results on subsets of Imagenet (for eg. with 100 classes).  However I don't think this alone is sufficient to reject this article. \n\n2. __Experiments on diverse pretrained classifiers.__\nI believe the experiments are run for a fixed pretrained WideResNet-28-10 from Cui et al. (2023) and  Wang et al. (2023). The authors can bolster their message by running it on multiple SOTA robust classifiers from the RobustBench leaderboard.", "broader_impact_concerns": "This paper does not raise any specific broader concern.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "FDWJlonUVm", "reviewer": "Reviewer_jAY5", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### Strengths\n1. To the best of my knowledge, the proposed method and architecture seem novel.\n2. The paper contains many discussions justifying the design choices.\n3. The experiment demonstrated remarkable improvements from the baseline.\n\n### Weaknesses\n1. This paper mainly proposes and evaluates a new defense method. I expect more various and extensive experimental studies for this type of paper, e.g., ablation study or hyperparameter search.\n2. The paper reports robust accuracy against only one attack, AutoAttack. However, the proposed method should be challenged against other attacks, at least FGSM and PGD used in the training. \n3. The paper claims that the method blends adversarial training and adversarial purification. However, the role of adversarial training seems unclear, and it might not be an essential component. If the purifier exploited the pattern in the activations, it should be able to use the activation patterns from a vanilla classifier.\n4. It is unclear whether the purifier actually *purifies* the adversarial perturbation or it is just another sample that is convenient for the specific adversarially-trained classifier. To claim that it effectively removes adversarial perturbation, its accuracy on other classifiers could be tested.\n5. The experiment should compare the improvement against the existing methods. To explain, the proposed method uses a specific variation of adversarial training, such as adversarially balanced batches. The resulting classifier could be significantly different from the robust classifier trained from existing adversarially-trained methods. While Table 2 shows the improvement of the accuracies, we cannot conclude that the proposed method achieves better robustness compared to existing defense methods.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper proposes a new defense method against adversarial examples. Specifically, the paper suggests blending two popular approaches for adversarial defenses, i.e., *adversarial training* and *adversarial purification*. The method starts with training an adversarially-trained robust classifier, then a purifier is trained to generate a purified image from the adversarial example and the robust classifier’s internal representation (i.e., the activations from the adversarial input). The robust classifier makes the final classification on the purified image. With experiments, the paper demonstrates the improvement from using both adversarial training and adversarial purification.", "claims_and_evidence_yn": "No", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Add more experiments. Particularly, the paper should be clear about why both adversarial training and purification are essential for improvement.\n2. Test the defense against more attack methods.\n3. There are many existing adversarial training and purification-based defense methods. Choose a few representative baseline methods and compare the robust accuracies against them.\n4. I don’t see enough justification about why adversarial training is needed for the proposed method. It would be worth experimenting with non-robust classifiers (in internal representation extraction, final classification, or both).", "broader_impact_concerns": "I don’t see a particular broader impact concern regarding this paper.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)