4arXiv cs.LG (Machine Learning)·
Certified Training for Convolutional Perturbations achieves 80%+ robust accuracy against motion blur on CIFAR10
A new arXiv preprint introduces a certified training method that encodes convolutional perturbations (e.g., motion blur) to train vision models with formal robustness guarantees. The approach outperforms adversarial training, achieving over 80% robust accuracy against motion blur on CIFAR10 while preserving standard accuracy. The work targets safety-critical deployment scenarios where empirical robustness methods like data augmentation are insufficient due to lack of formal guarantees.
Related guides (2)
Related events (8)
OCR-Robust benchmark evaluates VLM robustness to visual perturbations on OCR-reasoning tasks
Researchers introduce OCR-Robust, a benchmark of 812 samples designed to evaluate how vision-language models handle OCR-reasoning tasks under controlled visual degradation. The benchmark covers documents, scene text, charts, geometry, and tables, applying 5 perturbation types at 3 severity levels each, and evaluates 18 models using metrics including Relative Corruption Retention and a composite Corruption Robustness Index. Key findings show that higher clean accuracy does not guarantee robustness, and that chart and table inputs are substantially more fragile under perturbation than document-like inputs.
Transfer of Adversarial Robustness Between Perturbation Types
OpenAI published research examining whether adversarial robustness trained against one type of perturbation (e.g., L-infinity) transfers to other perturbation types (e.g., L2, L1). The work investigates the generalization properties of adversarial training across different threat models. This is an early safety and robustness research contribution from OpenAI predating the modern LLM era.
Training-free mechanistic defense against typographic attacks on CLIP-based vision encoders
Researchers propose a training-free method to defend CLIP-based vision encoders against typographic attacks, where irrelevant text embedded in images biases visual representations toward lexical rather than semantic meaning. The approach uses sampling-based mechanistic interpretability to identify specific Vision Transformer attention heads responsible for encoding lexical information, then applies targeted circuit-level interventions to suppress this behavior. Without any retraining, the method outperforms both supervised and training-free baselines on object classification and improves Visual Question Answering accuracy under typographic attack conditions on RIO-Bench across several state-of-the-art LVLMs.
The Matching Principle: A Geometric Theory Unifying Robustness, Domain Adaptation, and Alignment via Nuisance Covariance
This paper proposes the 'matching principle': a unified geometric framework arguing that robustness methods (CORAL, IRM, adversarial training, augmentation, metric learning, Jacobian penalties, alignment constraints) are all estimators of the same object—the covariance of label-preserving deployment nuisance—and that regularizing the encoder Jacobian along this covariance's range is the core statistical problem. The authors prove closed-form optimality results in a linear-Gaussian model, introduce the Trajectory Deviation Index (TDI) as a label-free embedding sensitivity probe, and validate predictions across 13 pre-registered experimental blocks including Qwen2.5-7B. At 7B scale, matched style-PMH improves selective honesty while standard DPO degrades Style TDI, connecting the theory to alignment safety.
MixFrag: Fragility-guided mixed-precision post-training quantization for Vision Transformers
MixFrag is a new post-training quantization (PTQ) framework for Vision Transformers that assigns mixed bit-widths per layer based on quantization fragility, measured via KL divergence between full-precision and quantized output distributions. Bit allocation is formulated as a Multiple-Choice Knapsack Problem to optimize precision under a target bit budget. Evaluated on ImageNet-1K classification and COCO detection/segmentation, MixFrag claims state-of-the-art among mixed-precision PTQ methods, improving the prior best by up to 9.6 AP on a challenging low-bit setting.
Domain-generalized framework for pixel-level image tampering detection in VLM-generated content
Researchers propose a training framework for detecting pixel-level image tampering in content generated by modern vision-language models such as ChatGPT, Gemini, and Qwen-Image. The approach combines balanced minibatch sampling and a late-injection strategy to improve out-of-distribution robustness without overfitting to limited new-domain data. The framework outperforms the prior state-of-the-art PIXAR method by 26.1% and 26.8% relative improvement in gIoU and cIoU respectively, evaluated on OOD VLMs including GPT-Images-2.0, Gemini-3.1, FLUX.2, and Seedream 4.5. The work is directly motivated by the growing difficulty of detecting AI-generated image manipulations as generation quality improves.
Computational limitations in robust classification and win-win results
OpenAI published research examining computational limitations in robust classification, exploring theoretical bounds on adversarially robust machine learning. The work investigates so-called 'win-win' results where both standard and robust accuracy can be achieved simultaneously. This is a foundational safety and robustness research contribution from 2019, addressing hardness results in adversarial ML.
CoRP: Gradient-Free Consolidation of Rewarded Perturbations for LLM Post-Training
CoRP (Consolidating Rewarded Perturbations) is a gradient-free post-training operator that folds an ensemble of reward-weighted weight-space perturbations into a single deployable model, eliminating the inference-time cost of ensemble methods like RandOpt. A split-half analysis across 25 model-task pairs reveals reproducible low-rank structure in the rewarded perturbation population, which CoRP exploits via reward-weighted aggregation, compatibility-aware reweighting, and a held-out validation gate. Evaluated on five models (0.5B–8B) across math, code, and creative writing, CoRP improves the base model by 8.1 points on average, exceeds single-inference RandOpt by 6.5 points using one-tenth the perturbation budget, and recovers more than half the gain of a 50-pass majority-vote ensemble at one forward pass per test example.