The paper introduces Fast Preemptive Robustification (FPR), a lightweight defense that enhances the robustness of deep neural networks against transferable adversarial attacks. By sharpening Laplacian responses through a single 3×3 channel‑wise convolution, FPR eliminates the need for surrogate models, iterative optimization, or specialized training. Experiments show that FPR lowers untargeted attack success rates by 12.7% and reduces targeted attack success from 10.7% to 4.1%.
By Jiaming Liang, Chi-Man Pun
arXiv:2606. 20292v1 Announce Type: new Abstract: The use of neural networks (NNs) is rapidly increasing, including in safety- and security-critical domains.
By Philipp Kern, L\'aszl\'o Antal, Erika \'Abr\'aham, Carsten Sinz
The paper investigates how the choice of the π parameter in λπ norm-constrained adversarial attacks influences the sparsity and smoothness of the perturbations. By applying two established sparsity metrics and introducing three new smoothness measures—including one based on first-order Taylor approximations—the authors perform extensive experiments on real-world image datasets and various neural network architectures. Their results indicate that λρ norms with π values between 1.3 and 1.5 consistently provide the best balance between sparsity and smoothness, challenging the common use of λ1 or λ2 norms.
By Christof Duhme, Florian Eilers, Xiaoyi Jiang
arXiv:2607. 19855v1 Announce Type: new Abstract: Adversarial robustness is commonly evaluated with predefined attack ensembles, such as AutoAttack, at a single perturbation budget $\varepsilon$ and on a selective choice of perturbation norms.
By Luca Scionis, Luca Melis, Maura Pintor, Fabio Brau, Ambra Demontis, Giorgio Fumera, Fabio Roli, Battista Biggio
The paper proposes a distributionally robust regularization technique for mixed‑integer sparse programming models used in explainable machine learning. It extends recent DRO advances, traditionally applied to convex formulations, to mixed‑integer settings, offering statistical guarantees linked to a sparsity parameter. The method is demonstrated on binary classification models built from feature‑value rule sets.
By Sanjeeb Dash, Soumyadip Ghosh, Joao Goncalves, Mark S. Squillante
The paper introduces a new framework for creating frequency‑based adversarial attacks that are grounded in an explicit optimization problem. By defining a perturbation constraint set linked to structured, non‑orthogonal transforms, the authors show that attacks can be generated as weighted σ‒projections onto this set, providing a clear geometric characterization. Experiments on standard datasets demonstrate that these attacks are highly effective across both pretrained and robust models, even on unseen architectures.
By Vicky Kouni, Stelios Perrakis, Francis Bach, Pascal Frossard, Yann Chevaleyre
PANDA is a scalable system that uses zero‑knowledge proofs to certify the robustness and fairness of neural networks without revealing their private parameters. Built on the CROWN robustness framework, PANDA introduces a novel algorithm for proving linear relaxation bounds on non‑linear activation layers, producing lightweight proofs. The system can generate proofs for networks with over 2.9 million parameters in just five minutes and verify them in ten seconds, scaling polynomially with network size and enabling verification of models four orders of magnitude larger than prior ZKP‑based approaches.
By Youwei Zhong, Ben Merbaum, Timos Antonopoulos, Ning Luo, Charalampos Papamanthou, Katerina Sotiraki, Ruzica Piskac
arXiv:2606. 01437v1 Announce Type: cross Abstract: Deep Neural Networks (DNNs) are highly susceptible to adversarial perturbations, leading to extensive research on robustness for safety-critical applications.
By Daniel Sadig, Mohammadreza Maleki, Hamed Karimi, Reza Samavi
arXiv:2502.07977v3 Announce Type: replace
Abstract: Empirical risk minimization (ERM) is a cornerstone of modern machine learning. This paper focuses on the man-in-the-middle (MITM) attack, wherein a...
By Cheng Fang, Rishabh Dixit, Waheed U. Bajwa, Mert G\"urb\"uzbalaban
Model merging composes specialized capabilities into a single LLM by aggregating task vectors sourced from unverified public platforms, exposing a critical supply-chain attack surface: Because any malicious behavior can be encoded into a task vector, and merging grants third-party vectors direct write access to model weights, an attacker-provided task vector can enable or amplify diverse downstream threats. Prior work studies only backdoor attacks against model merging for classifiers using static arithmetic heuristics, which fail to effectively handle diverse attacks on generative LLMs for three reasons.
arXiv:2608.21488v1 Announce Type: cross
Abstract: While machine learning models have demonstrated strong performance in many domains, these models have shown profound vulnerabilities when they are ex...
By Mohammad Meymani, Roozbeh Razavi-Far
arXiv:2608.24743v1 Announce Type: new
Abstract: Existing linear program (LP) and semidefinite program (SDP) relaxations for rectified linear unit (ReLU) neural network (NN) verification yield overly-...
By Hanna Jiamei Zhang, Alan Papalia, Michael Everett, David M. Rosen