Provable Adversarial Detection: Prime Quantization meets Gromov--Wasserstein

Summary

The authors ask when adversarial perturbations on vision models can be provably detected, using a geometric approach. They compare a standard CNN embedding space with a novel prime-quantized space, where small perturbations are absorbed by number-theoretic discretization, and use the geometric discrepancies between the two spaces to flag adversarial samples. They report theoretical guarantees, including Gromov-Wasserstein separation, and state that experiments show strong detection across many attack types and model families.

Related items

• InfoTraining AIs to Solve CAPTCHAsSimilar attack · Schneier on Security
• InfoAuditor-Assisted Summary-Channel Verification for Hosted LLM Identity SubstitutionSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoPeer Pressure: Execution-Verified Co-Evolution of Attacker and Defender Populations for Code SecuritySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoScrewtape: Adversarial Transcript Editing for Monitor Red-TeamingSimilar attack · Redwood Research Blog
• InfoEnhancing Visual Task-Redirection Attacks on Vision-Language-Action Models via Closed-Loop OptimizationSimilar attack · Arxiv (cs.RO + cs.CV security)