Norm-agnostic robustness and architectural requirements of adversarially retrained adversarial detectors (RADAR)

The 2024 paper "Fortify the Guardian, Not the Treasure: Resilient Adversarial Detectors" introduced RADAR (Robust Adversarial Detection via Adversarial Retraining), which adversarially retrains a separate adversarial-example detector against adaptive attacks that jointly fool a frozen classifier and the detector, achieving robust detection under $\ell_\infty$-bounded adaptive attacks with no cost to clean accuracy. The published paper's own conclusions state that the approach is norm-specific, that its effectiveness depends on the detector architecture in a poorly understood way, that extending the adversarial training to a wider range of attack norms and developing norm-agnostic detection mechanisms are future research directions, and that scalability to larger and more complex datasets and applicability to other neural network architectures "remain an open question for now". It remains open whether and how detector-side adversarial training generalizes beyond the $\ell_\infty$ threat model to $\ell_2$ and $\ell_1$ adversaries and to norm-agnostic detectors, and which detector architectural properties are necessary or sufficient for resilient detection under adaptive, full-knowledge attacks, while the classifier's clean accuracy is preserved.

Background

Deep neural image classifiers are vulnerable to adversarial examples: inputs created by adding a small, humanly imperceptible perturbation — conventionally bounded in a norm such as $\ell_\infty$ (the maximum absolute change per input coordinate) — that causes misclassification. The dominant defense is adversarial training, in which the model is trained on attacked inputs regenerated during training; it improves robustness but typically trades away clean-data accuracy. A complementary strategy is adversarial detection: a separate network (the detector) receives the same input as the classifier and labels it benign or adversarial, so the classifier can be left untouched. Carlini and Wagner (2017) showed that ten proposed detectors could all be bypassed once the attacker optimizes explicitly against the detector, and Tramer, Carlini, Brendel, and Madry (2020) systematized this lesson into methodology for evaluating defenses under adaptive attacks, in which the attacker has full knowledge of the defense. Bryniarski, Hingun, Pachuca, Wang, and Carlini (2021) introduced particularly strong adaptive attacks of this kind: Orthogonal Projected Gradient Descent (OPGD), whose updates are orthogonalized to stay within the classifier's decision-boundary geometry while fooling both classifier and detector, and Selective Projected Gradient Descent (SPGD), which at each step optimizes whichever of the two objectives — fooling the classifier or fooling the detector — is not yet satisfied. He, Yang, Chen, Xu, and Ho (2022) proposed neighborhood-based detection built on self-supervised learning, reporting robustness under adaptive attacks at the cost of multiple model inferences over augmented neighborhood images.

RADAR (Lapid, Dubin, and Sipper, 2024) pursues a paradigm shift the authors summarize as "instead of defending the classifier, strengthen the adversarial detector": the classifier is frozen ("the treasure") and only the detector ("the guardian") is adversarially trained. The detector is first trained normally and then fine-tuned on adaptive adversarial examples generated on the fly by attacks that jointly optimize the classifier's misclassification and the detector's mislabeling of the input as benign. On three standard image-classification benchmarks (CIFAR-10, SVHN, and a 50-class ImageNet subset), with six standard convolutional detector architectures (VGG-11/13/16 and ResNet-18/34/50) and $\ell_\infty$ perturbations of size $\epsilon=16/255$, RADAR-trained detectors retained high detection rates under adaptive OPGD/SPGD attacks where detectors trained non-adaptively collapsed, measured by per-attack detection ROC-AUC (area under the receiver operating characteristic curve) and by SR@5, the attack success rate when the detector's false-positive rate is fixed at 5%; because the classifier is never modified, there is no clean-accuracy trade-off.

Two strands of adjacent work frame what remains open. First, for classifier adversarial training it is established that robustness does not transfer across norms: Tramèr and Boneh (2019) and Li, Chen, Wang, and Carin (2019) showed that models trained under $\ell_\infty$ attacks remain vulnerable to $\ell_2$ and other norms, and that training for multiple perturbation types simultaneously is markedly harder. Whether the same holds for detector-side training — where the learning target is attack signatures relative to a frozen classifier rather than a robust decision boundary — has not been tested. Second, RADAR's own results exhibit architecture dependence, which the authors attribute to detectors with limited expressive capacity failing to provide adequate gradient signal during adversarial training; no characterization of which architectural properties are necessary or sufficient exists. In the conclusions of the published version, the authors pose extending the training to a wider range of attack norms and developing norm-agnostic detection mechanisms as future research directions, and state that the feasibility of scaling the approach to larger and more complex datasets, and its applicability to other neural network architectures, "remains an open question for now".

Problem Statement

Determine whether adversarial retraining of adversarial detectors in the RADAR setting — a frozen classifier whose clean accuracy must be preserved, and a detector fine-tuned on adaptive adversarial examples that jointly fool the classifier and the detector — yields detection robustness beyond the $\ell_\infty$ threat model in which it was demonstrated, and establish on which detector architectures it works.

Specifically:

1. Norm generalization and norm-agnostic detection. Establish whether RADAR-trained detectors remain robust when the attacker's perturbation is bounded in $\ell_2$ (Euclidean norm of the perturbation) or $\ell_1$ (sum of absolute per-coordinate changes) instead of $\ell_\infty$ (maximum absolute per-coordinate change) — comparing the three norms at budgets matched to RADAR's $\ell_\infty$ baseline ($\epsilon=16/255$) under a stated norm-matching rule, and reporting the norm-generalization verdict as a function of the matched budget; and either demonstrate a training procedure that produces a single detector robust at test time when the adversary may choose among $\ell_\infty$, $\ell_2$, and $\ell_1$ perturbations (norm-agnostic detection), or establish that detector-side robustness is norm-bound in the way classifier adversarial training is known to be.

2. Architectural requirements. Characterize which properties of the detector architecture — for example expressive capacity, or the quality of the gradient signal the detector provides during adversarial retraining — are necessary or sufficient for the detector to attain and retain robust detection under adaptive, full-knowledge attacks, where establishing necessary conditions, sufficient conditions, or both over at least the detector architectures studied constitutes a characterization.

These two questions serve one objective: establishing when adversarial retraining makes an adversarial detector resilient under adaptive attack, as a function of the threat model's norm and the detector's architecture. The paper's third stated limitation — the computational overhead of generating adaptive adversarial examples during training and the scalability of the method to larger datasets and resource-constrained settings — is an acknowledged engineering constraint, not an independently posed question.

Robust detection is assessed under genuinely adaptive attacks in which the attacker has full white-box knowledge (access to model internals and gradients) of both the frozen classifier and the detector and optimizes jointly against both, and is measured by detection ROC-AUC and attack success rate at fixed detector false-positive rate (the SR@5 convention), with RADAR's published $\ell_\infty$ results as the baseline.

References

1. Raz Lapid, Almog Dubin, Moshe Sipper (2024), "Fortify the Guardian, Not the Treasure: Resilient Adversarial Detectors", Mathematics 12(22):3451, DOI 10.3390/math12223451, https://www.mdpi.com/2227-7390/12/22/3451 (preprint: arXiv:2404.12120, https://arxiv.org/abs/2404.12120)
2. Oliver Bryniarski, Nabeel Hingun, Pedro Pachuca, Vincent Wang, Nicholas Carlini (2021), "Evading Adversarial Example Detection Defenses with Orthogonal Projected Gradient Descent", arXiv:2106.15023, https://arxiv.org/abs/2106.15023
3. Nicholas Carlini, David Wagner (2017), "Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods", arXiv:1705.07263, https://arxiv.org/abs/1705.07263
4. Florian Tramer, Nicholas Carlini, Wieland Brendel, Aleksander Madry (2020), "On Adaptive Attacks to Adversarial Example Defenses", arXiv:2002.08347, https://arxiv.org/abs/2002.08347
5. Florian Tramèr, Dan Boneh (2019), "Adversarial Training and Robustness for Multiple Perturbations", arXiv:1904.13000, https://arxiv.org/abs/1904.13000
6. Bai Li, Changyou Chen, Wenlin Wang, Lawrence Carin (2019), "On Norm-Agnostic Robustness of Adversarial Training", arXiv:1905.06455, https://arxiv.org/abs/1905.06455
7. Zhiyuan He, Yijun Yang, Pin-Yu Chen, Qiang Xu, Tsung-Yi Ho (2022), "Be Your Own Neighborhood: Detecting Adversarial Example by the Neighborhood Relations Built on Self-Supervised Learning", arXiv:2209.00005, https://arxiv.org/abs/2209.00005
8. Eylon Mizrahi, Raz Lapid, Moshe Sipper (2025), "Pulling Back the Curtain: Unsupervised Adversarial Detection via Contrastive Auxiliary Networks", ICCV Workshops 2025, DOI 10.1109/ICCVW69036.2025.00242, arXiv:2502.09110, https://arxiv.org/abs/2502.09110
9. Hossein Mirzaei, Mohammad Jafari, Hamid Reza Dehbashi, Ali Ansari, Sepehr Ghobadi, Masoud Hadi, Arshia Soltani Moakhar, Mohammad Azizmalayeri, Mahdieh Soleymani Baghshah, Mohammad Hossein Rohban (2025), "RODEO: Robust Outlier Detection via Exposing Adaptive Out-of-Distribution Samples", arXiv:2501.16971, https://arxiv.org/abs/2501.16971
10. Roie Kazoom, Raz Lapid, Moshe Sipper, Ofer Hadar (2025), "Don't Lag, RAG: Training-Free Adversarial Detection Using RAG", arXiv:2504.04858, https://arxiv.org/abs/2504.04858
11. Abdulatif Alabdulatif (2025), "GuardianAI: Privacy-preserving federated anomaly detection with differential privacy", Array 26:100381, DOI 10.1016/j.array.2025.100381, https://doi.org/10.1016/j.array.2025.100381