Provably Safeguarding a Classifier from OOD and Adversarial Samples: an Extreme Value Theory Approach

2025-01-17

AI Summary

To address the insufficient robustness of machine vision systems against out-of-distribution (OOD) data and adversarial examples, this paper proposes an extremal-value-theory-based reject-option classification framework. Methodologically, it introduces Generalized Extreme Value (GEV) distribution modeling into the latent space for theoretically grounded tail-density estimation of the training distribution, enabling a unified rejection mechanism. With only mild assumptions, the framework simultaneously ensures reliable detection of both OOD inputs and adversarial perturbations. It is architecture-agnostic—compatible with ResNet, VGG, ViT, and other mainstream backbones—and achieves significant improvements over state-of-the-art methods on CIFAR-10/100 and ImageNet. The approach delivers high in-distribution classification accuracy, strong decision stability under distributional shift and attack, and low computational overhead.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Game Theory and Economic Paradigms: Adversarial Learning

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Responsible Web: Machine-in-the-loop, human agency and autonomy
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

This paper introduces a novel method, Sample-efficient Probabilistic Detection using Extreme Value Theory (SPADE), which transforms a classifier into an abstaining classifier, offering provable protection against out-of-distribution and adversarial samples. The approach is based on a Generalized Extreme Value (GEV) model of the training distribution in the classifier's latent space, enabling the formal characterization of OOD samples. Interestingly, under mild assumptions, the GEV model also allows for formally characterizing adversarial samples. The abstaining classifier, which rejects samples based on their assessment by the GEV model, provably avoids OOD and adversarial samples. The empirical validation of the approach, conducted on various neural architectures (ResNet, VGG, and Vision Transformer) and medium and large-sized datasets (CIFAR-10, CIFAR-100, and ImageNet), demonstrates its frugality, stability, and efficiency compared to the state of the art.

Problem

• Robustness
• Machine Vision
• Anomaly Detection

Innovation

• SPADE
• Anomaly Detection
• Robust Classification