Pith. sign in

REVIEW 4 major objections 3 minor 51 references

Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability

T0 review · 4 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes the OPSA attack, which inflates conformal prediction set sizes without knowing the significance level, and the OPSA-AT defense, which keeps those sets small while preserving coverage.

desk verdict The central training loss in Eq. (8) is minimized, but the paper says Lclass should be maximized, so the defense as written would enlarge prediction sets rather than shrink them. read the letter →

arxiv 2506.07804 v1 pith:7S3COBFV submitted 2025-06-09 cs.LG cs.AIstat.ML

Jie Bao , Chuangyin Dang , Rui Luo , Hanwei Zhang , Zhixin Zhou This is my paper
classification cs.LGcs.AIstat.ML
keywords conformalpredictionadversarialattacktrainingsetsizeuncertaintyquantificationOPSArobustnesscoverageguarantee
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Conformal prediction offers distribution-free coverage guarantees, but adversarial perturbations can bloat its prediction sets until they are useless. This paper claims to fix both ends: an attack, OPSA, that maximizes the temperature-softened number of classes in the prediction set without needing the defender's significance level, and a defense, OPSA-AT, that trains so prediction sets stay small at the same coverage. On CIFAR-10, CIFAR-100, and mini-ImageNet, the authors report that OPSA produces larger prediction sets than baseline attacks across several defenses, and OPSA-AT produces smaller sets than baseline defenses at roughly 90% coverage. If correct, this would make calibrated uncertainty more reliable under imperceptible perturbations and give practitioners a concrete training recipe for robust, informative prediction sets.

What carries the argument

The machinery is a sigmoid-smoothed indicator of set membership: the soft set size $M_T(x; f, \tau) = \sum_{k} \sigma\big((f_k(x)-\tau)/T\big)$, whose low-temperature limit recovers the hard prediction-set size $|\Gamma(x; f, \tau)|$. The OPSA attack sets $\tau$ internally to the perturbed true-class logit $f_y(x+\epsilon)$, making the attack independent of any significance level, and performs projected gradient ascent with that surrogate; OPSA-AT minimizes a weighted sum of a classification loss (rewarding true-class inclusion and penalizing wrong-class inclusion) and the soft size loss, with thresholds computed from a calibration split of each batch. This soft-surrogate plus bi-objective split is what carries the argument from a non-differentiable set cardinality to an optimizable training signal.

What would settle it

Re-run OPSA-AT training with the loss exactly as written in Eq. (8) and check whether prediction-set size under the OPSA attack increases or decreases from the pre-trained model; the paper's central defense claim predicts a decrease, while the literal equation predicts an increase.

Watch

Extended reading notes

Core claim

The paper's central claim is that an adversary can attack conformal prediction at the level of uncertainty rather than accuracy by maximizing a differentiable surrogate of the prediction-set size, and that a defender can train against exactly this attack to produce smaller, still-valid prediction sets. The attack objective uses the perturbed true-class logit as an internal threshold, so it requires no knowledge of the defender's coverage level α or operational threshold τ; the defense splits each training mini-batch into a training subset (where OPSA perturbations are generated and the conformal loss is minimized) and a calibration subset (from which the quantile threshold is recomputed). The authors report that OPSA attains the largest prediction-set sizes among compared attacks on all examined defenses except its own, and that OPSA-AT attains the smallest sizes among compared defenses at coverage fluctuating near the 1−α level. The paper claims the framework provides theoretical guarantees for the conformal coverage property while improving robustness against multiple attack types.

Load-bearing premise

The classification-loss term in the published total loss, $L_{\text{total}} = L_{\text{class}} + \lambda M_{T_2}$, is written with a plus sign, so minimizing it pushes the true label below the threshold and wrong labels above it, the reverse of the defense goal; the reported results hold only if the released implementation actually minimizes $-L_{\text{class}}$ or the equation contains a sign typo.

Editorial extensions

If this is right

  • An attacker who can perturb inputs by $\epsilon = 8/255$ under the $\ell_\infty$ norm can, without knowing the deployed confidence level, push conformal prediction sets to be markedly larger, undermining the informativeness of calibrated uncertainty in high-stakes settings.
  • A defender who trains with OPSA-AT can expect smaller average prediction sets than with FGSM, PGD, TRADES, MART, or BETA adversarial training, at coverage near the $1-\alpha$ target, across CIFAR-10, CIFAR-100, and mini-ImageNet.
  • Because the attack is formulated through logit differences rather than a fixed threshold, the same attack recipe transfers to any differentiable nonconformity score, not just the THR score used in the paper.
  • The bi-objective split of each batch into training and calibration subsets preserves exchangeability between the calibration and test stages, so the finite-sample coverage guarantee survives the adversarial training procedure.
  • OPSA-AT shows lower prediction-set sizes also under other attack families (FGSM, PGD, AutoAttack, Square, APGD, BETA), indicating the defense is not overfit to the attack used in training.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's internal-threshold idea—using the true-class score as a stand-in for the unknown calibration threshold—is a general recipe: the same soft-set-size surrogate could attack or defend any differentiable nonconformity score, and the authors note the framework is not limited to the THR score.
  • A direct extension the paper does not pursue is conformal regression, where the attack would maximize prediction-interval width rather than set cardinality, using the same temperature-scaled surrogate.
  • The reported gains at a 10% significance level leave open whether the attack's uncertainty inflation and the defense's efficiency hold at other $\alpha$ values, which are straightforward to test with the released code.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes OPSA (OPtimal Size Attack), an adversarial attack designed to enlarge the soft conformal prediction set size, and OPSA-AT (OPSA Adversarial Training), a defense that trains a classifier to keep conformal prediction sets small at fixed coverage. The authors evaluate both methods on CIFAR-10, CIFAR-100, and mini-ImageNet, reporting that OPSA increases uncertainty relative to baseline attacks and that OPSA-AT yields smaller prediction sets than baseline defenses under multiple attacks.

Significance. If established, the framework would address a useful gap: attacks that specifically target conformal prediction efficiency, and a training-time defense against such attacks. The paper includes code, multi-dataset experiments, and comparisons with standard attacks and defenses, which are commendable. However, the central training objective as written has a sign inconsistency that reverses the defense, the advertised theoretical guarantees are not present, and parts of the attack evaluation are circular or selectively reported. These issues prevent the current manuscript from supporting its main claims.

major comments (4)
  1. [Section 3.4, Eq. (8), Algorithm 2] Equation (8) defines Ltotal = Lclass + λ·MT2, and Algorithm 2 minimizes this total loss. Section 3.4 states that maximizing Lclass encourages inclusion of the true label and exclusion of wrong labels. Since minimizing Ltotal minimizes Lclass, the training update as written lowers the true-class logit relative to τ and raises wrong-class logits, which enlarges the prediction set—the opposite of the claimed defense. The reported OPSA-AT results can only be consistent with a different objective, such as minimizing −Lclass + λ·MT2, but the paper never states this. The algorithm as printed is internally inconsistent and does not specify a coherent defense.
  2. [Section 1 contribution bullet and Section 3.5] The contribution list advertises a 'CP defense model leveraging adversarial attacks with theoretical guarantees,' and the abstract promises 'guaranteed model reliability.' No theorem, proposition, or formal guarantee for OPSA-AT appears anywhere in the manuscript. Section 3.5 only restates the standard exchangeability-based marginal coverage property of conformal prediction, which applies to any classifier and is not specific to this method. The claimed theoretical support is therefore absent.
  3. [Section 4, Tables 1 and 2] The attack comparison is partially circular and selectively reported. OPSA-AT and OPSA-ST are themselves trained with OPSA perturbations, so the finding that OPSA-AT is robust to OPSA is at least partly by construction. Additionally, the claim that OPSA 'consistently achieves the largest size' is made only after excluding OPSA-trained defenses and BETA-AT; in Table 1's BETA-AT column, OPSA10 produces size 7.34 while Auto and APGD100 produce 7.71 and 7.66, so the consistency does not hold in the full reported table. The paper should either report full comparisons or substantiate the claim without selective exclusion.
  4. [Algorithms 1 and 2] The pseudocode contains unexplained negative operations that conflict with the surrounding text. For example, Algorithm 1 line 6 updates ϵ ← −ϵ + η∇ϵMT1(...), line 7 sets ϵ ← −Π..., and Algorithm 2 line 9 writes ϵ∗ ← −OPSA(...) and line 12 writes τ ← −as the ... largest ...; these operations are not consistent with the described gradient-ascent or quantile computations. The algorithms as printed cannot be followed to reproduce the reported results.
minor comments (3)
  1. [Section 4] There is a typo: 'experimentatal' should be 'experimental.'
  2. [Figures 2 and 3] Figure 2 caption labels a panel as (c) OPSA-ST but the accompanying text refers to BETA-ST; Figure 3 similarly uses BETA-ST, while Tables 1, 2, and 6 list BETA-AT. The labels should be made consistent.
  3. [Appendix A] The notation in the illustrative example is confusing: the true label y is a scalar class index, yet expressions such as 'f1(x+ϵ)−y' and the table headings mix the label y with logit values. The example would be clearer if f_y(x+ϵ) were written explicitly.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: OPSA and OPSA-AT are validated against external baselines and transfer attacks; self-citations are not load-bearing. The Eq. (8) sign issue and unsupported 'theoretical guarantees' are correctness problems, not circularity.

full rationale

The paper's derivations do not reduce to their inputs. OPSA is defined in Eq. (7) as the maximizer of the soft set size MT(x+ε; f, fy(x+ε)), and Eq. (6) shows that MT tends to the hard set size |Γ| as T→0. The CIFAR-10/CIFAR-100/mini-ImageNet 'Size' tables therefore partly validate OPSA on the very quantity it was built to maximize. This is a design-validation property rather than a circular prediction, because the attack is compared against external baselines (FGSM, PGD10/40, BETA, Square, APGD, AutoAttack) rather than being fitted to the test outcome, and the OPSA-AT defense is also evaluated on attacks not used in its training. Algorithm 2 does generate perturbations with OPSA and then updates θ on x_i+ε_i, and Table 1 and Table 2 report OPSA-AT under OPSA10, but this is standard adversarial-training practice; the headline robustness claim is independently supported by the transfer rows. Self-citations (Luo & Zhou 2024/2025; Luo et al. 2024; Zhang et al. 2025) appear in related work and score-function remarks and are not load-bearing for the main derivation. Two non-circular defects should be noted: the contribution bullet 'theoretical guarantees' is unsupported by any theorem in the text, and Eq. (8) with Algorithm 2's minimization of Ltotal = Lclass + λMT2 drives the true-class term down rather than up, contradicting Section 3.4's stated intent; both are correctness or omission problems, not equivalence-by-construction. No step meets the evidentiary bar for circularity.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claims rest on standard conformal prediction exchangeability, the sigmoid approximation to hard set membership, and a batch-level calibration split assumed to approximate the true quantile. No new entities are postulated. The free parameter lambda is never assigned a value in the paper, and the adversarial training duration is not specified, which are gaps for replication.

free parameters (4)
  • T1 = 1 (swept in Appendix E)
    Temperature for the attack's soft set size; controls the sharpness of the sigmoid approximation to hard set membership.
  • T2 = 1
    Temperature for the defense's classification and size losses; set to 1 following Stutz et al.
  • lambda = not reported
    Weight balancing Lclass and size loss in Eq. (8); the paper never states its value, which is a reproducibility gap.
  • perturbation budget r = 8/255
    Standard L-infinity budget on CIFAR and mini-ImageNet; it is a choice that affects all results.
assumptions (4)
  • domain assumption Exchangeability between calibration and test data, possibly after applying the same perturbation mechanism
    Standard conformal prediction requirement, invoked in Section 3.5 to justify the coverage guarantee; the paper extends it to adversarially transformed data.
  • standard math The sigmoid soft-set-size converges to the hard prediction set size as T approaches 0
    Eq. (5)-(6) in Section 3.3; used to justify that the attack maximizes the actual prediction set size.
  • domain assumption The mini-batch calibration subset provides a valid quantile during training
    Section 3.4 and Remark 2 state that each batch is split into Bcal and Btrain to compute tau; this assumes within-batch exchangeability approximates full calibration.
  • domain assumption The pre-trained clean model and the training setup are sufficient to reach the reported accuracies
    The paper pre-trains for 5 epochs on CIFAR and 10 on mini-ImageNet, but does not specify the number of adversarial training epochs, making the strong accuracy numbers hard to assess.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability." pith.science (2026). https://pith.science/paper/7S3COBFV

@misc{pith2026250607804,
  author       = {Pith},
  title        = {Pith review of: Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/7S3COBFV}},
  note         = {Machine review of arXiv:2506.07804}
}
read the original abstract

As deep learning models are increasingly deployed in high-risk applications, robust defenses against adversarial attacks and reliable performance guarantees become paramount. Moreover, accuracy alone does not provide sufficient assurance or reliable uncertainty estimates for these models. This study advances adversarial training by leveraging principles from Conformal Prediction. Specifically, we develop an adversarial attack method, termed OPSA (OPtimal Size Attack), designed to reduce the efficiency of conformal prediction at any significance level by maximizing model uncertainty without requiring coverage guarantees. Correspondingly, we introduce OPSA-AT (Adversarial Training), a defense strategy that integrates OPSA within a novel conformal training paradigm. Experimental evaluations demonstrate that our OPSA attack method induces greater uncertainty compared to baseline approaches for various defenses. Conversely, our OPSA-AT defensive model significantly enhances robustness not only against OPSA but also other adversarial attacks, and maintains reliable prediction. Our findings highlight the effectiveness of this integrated approach for developing trustworthy and resilient deep learning models for safety-critical domains. Our code is available at https://github.com/bjbbbb/Enhancing-Adversarial-Robustness-with-Conformal-Prediction.

Figures

Figures reproduced from arXiv: 2506.07804 by the authors.

Figure 1
Figure 1. Box-violin plots of CIFAR-10 results under FGSM, PGD, and TRADES defense models testing. The trade-off parameter for TRADES and MART is set to 5, in alignment with their original implementa￾tions. To initialize our models, We conduct pre-training on clean data for 5 epochs on the CIFAR−10 and CIFAR−100 datasets, while for the mini-ImageNet dataset, we perform 10 epochs of pre-training on clean data. Subsequently, on… view at source ↗
Figure 2
Figure 2. Box-violin plots of CIFAR-10 results under MART, BETA-ST, OPSA-ST, and OPSA-AT defense models this range better approximates the idealized exchangeability conditions required for robust conformal prediction. Remark 2 (mini-Batch). In Section 3.4, we emphasized the critical importance of partitioning datasets into training (Btrain) and calibration (Bcal) subsets during model training. To effectively approximate the T… view at source ↗
Figure 3
Figure 3. Box-violin plots of mini-ImageNet results under FGSM, PGD, TRADES, MART, BETA-ST, and OPSA-AT defense models 19 [PITH_FULL_IMAGE:figures/full_fig_p019_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Box-violin plots of CIFAR100 results under FGSM, PGD, TRADES, MART, BETA-ST, and OPSA-AT defense models 20 [PITH_FULL_IMAGE:figures/full_fig_p020_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

51 extracted references · 38 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Square attack: a query-efficient black-box adversarial attack via random search

    Andriushchenko, M., Croce, F., Flammarion, N., and Hein, M. Square attack: a query-efficient black-box adversarial attack via random search. In European conference on computer vision, pp.\ 484--501. Springer, 2020

    work page 2020

  3. [3]

    N., Bates, S., Jordan, M., and Malik, J

    Angelopoulos, A. N., Bates, S., Jordan, M., and Malik, J. Uncertainty sets for image classifiers using conformal prediction. In International Conference on Learning Representations, 2021

    work page 2021

  4. [4]

    Cauchois, M., Gupta, S., Ali, A., and Duchi, J. C. Robust validation: Confident predictions even when distributions shift. Journal of the American Statistical Association, pp.\ 1--66, 2024

    work page 2024

  5. [5]

    and Hein, M

    Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on machine learning, pp.\ 2206--2216. PMLR, 2020

    work page 2020

  6. [6]

    Robustbench: a standardized adversarial robustness benchmark

    Croce, F., Andriushchenko, M., Sehwag, V., Debenedetti, E., Flammarion, N., Chiang, M., Mittal, P., and Hein, M. Robustbench: a standardized adversarial robustness benchmark. In Thirty-fifth Conference on Neural Information Processing Systems Datasets and Benchmarks Track (Round 2), 2021

    work page 2021

  7. [7]

    Imagenet: A large-scale hierarchical image database

    Deng, J., Dong, W., Socher, R., Li, L.-J., Li, K., and Fei-Fei, L. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pp.\ 248--255. Ieee, 2009

    2009

  8. [8]

    Doula, A., M \"u hlh \"a user, M., and Guinea, A. S. Ar-cp: Uncertainty-aware perception in adverse conditions with conformal prediction and augmented reality for assisted driving. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 216--226, 2024

    work page 2024

Show all 51 references
  1. [9]

    N., Gendler, A., and Romano, Y

    Einbinder, B.-S., Bates, S., Angelopoulos, A. N., Gendler, A., and Romano, Y. Conformal prediction is robust to label noise. arXiv preprint arXiv:2209.14295, 2, 2022

    2022 arXiv

  2. [10]

    Adversarially robust conformal prediction

    Gendler, A., Weng, T.-W., Daniel, L., and Romano, Y. Adversarially robust conformal prediction. In International Conference on Learning Representations, 2021

    2021

  3. [11]

    Probabilistically robust conformal prediction

    Ghosh, S., Shi, Y., Belkhouja, T., Yan, Y., Doppa, J., and Jones, B. Probabilistically robust conformal prediction. In Uncertainty in Artificial Intelligence, pp.\ 681--690. PMLR, 2023

    2023

  4. [12]

    J., Shlens, J., and Szegedy, C

    Goodfellow, I. J., Shlens, J., and Szegedy, C. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014

    2014 arXiv

  5. [13]

    and Verma, S

    Gupta, K. and Verma, S. Shrink & cert: Bi-level optimization for certified robustness. In New Frontiers in Adversarial Machine Learning, ICML, 2023 a

    2023

  6. [14]

    and Verma, S

    Gupta, K. and Verma, S. Certvit: Certified robustness of pre-trained vision transformers. In The Second Workshop on New Frontiers in Adversarial Machine Learning, 2023 b

    2023

  7. [15]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp.\ 770--778, 2016 a

    2016

  8. [16]

    Identity mappings in deep residual networks

    He, K., Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks. In Computer Vision--ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11--14, 2016, Proceedings, Part IV 14, pp.\ 630--645. Springer, 2016 b

    2016

  9. [17]

    Verifiably robust conformal prediction

    Jeary, L., Kuipers, T., Hosseini, M., and Paoletti, N. Verifiably robust conformal prediction. arXiv preprint arXiv:2405.18942, 2024

    2024 arXiv

  10. [18]

    Learning multiple layers of features from tiny images

    Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009

    2009

  11. [19]

    Evaluating conformal prediction techniques in adversarial environments: A comparative study

    Kumar, B., Kumar, T., and Patel, H. Evaluating conformal prediction techniques in adversarial environments: A comparative study. International Journal of Engineering Research & Technology, 2024

    2024

  12. [20]

    Adversarial machine learning at scale

    Kurakin, A., Goodfellow, I., and Bengio, S. Adversarial machine learning at scale. arXiv preprint arXiv:1611.01236, 2016

    2016 arXiv

  13. [21]

    Data poisoning attacks against conformal prediction

    Li, Y., Chen, A., Qian, W., Zhao, C., Lidder, D., and Huai, M. Data poisoning attacks against conformal prediction. In Forty-first International Conference on Machine Learning, 2024

    2024

  14. [22]

    Liu, Z., Cui, Y., Yan, Y., Xu, Y., Ji, X., Liu, X., and Chan, A. B. The pitfalls and promise of conformal inference under adversarial attacks. arXiv preprint arXiv:2405.08886, 2024

    2024 arXiv

  15. [23]

    and Colombo, N

    Luo, R. and Colombo, N. Entropy reweighted conformal classification. In The 13th Symposium on Conformal and Probabilistic Prediction with Applications, pp.\ 264--276. PMLR, 2024

    2024

  16. [24]

    and Colombo, N

    Luo, R. and Colombo, N. Conformal load prediction with transductive graph autoencoders. Machine Learning, 114 0 (3): 0 1--22, 2025

    2025

  17. [25]

    and Zhou, Z

    Luo, R. and Zhou, Z. Trustworthy classification through rank-based conformal prediction sets. arXiv preprint arXiv:2407.04407, 2024

    2024 arXiv

  18. [26]

    and Zhou, Z

    Luo, R. and Zhou, Z. Conformal thresholded intervals for efficient regression. Proceedings of the AAAI Conference on Artificial Intelligence, 39 0 (18): 0 19216--19223, 2025 a

    2025

  19. [27]

    and Zhou, Z

    Luo, R. and Zhou, Z. Conformity score averaging for classification. In Proceedings of the Forty-second International Conference on Machine Learning (ICML), 2025 b . to appear

    2025

  20. [28]

    and Zhou, Z

    Luo, R. and Zhou, Z. Conditional conformal risk adaptation. arXiv preprint arXiv:2504.07611, 2025 c

    2025 arXiv

  21. [29]

    and Zhou, Z

    Luo, R. and Zhou, Z. Conformalized interval arithmetic with symmetric calibration. Proceedings of the AAAI Conference on Artificial Intelligence, 39 0 (18): 0 19207--19215, 2025 d

    2025

  22. [30]

    and Zhou, Z

    Luo, R. and Zhou, Z. Conformal thresholded intervals for efficient regression. Proceedings of the AAAI Conference on Artificial Intelligence, 39 0 (18): 0 19216--19223, 2025 e

    2025

  23. [31]

    and Zhou, Z

    Luo, R. and Zhou, Z. Volume-sorted prediction set: Efficient conformal prediction for multi-target regression. arXiv preprint arXiv:2503.02205, 2025 f

    2025 arXiv

  24. [32]

    Anomalous edge detection in edge exchangeable social network models

    Luo, R., Nettasinghe, B., and Krishnamurthy, V. Anomalous edge detection in edge exchangeable social network models. In Conformal and probabilistic prediction with applications, pp.\ 287--310. PMLR, 2023

    2023

  25. [33]

    Game-theoretic defenses for robust conformal prediction against adversarial attacks in medical imaging

    Luo, R., Bao, J., Zhou, Z., and Dang, C. Game-theoretic defenses for robust conformal prediction against adversarial attacks in medical imaging. arXiv preprint arXiv:2411.04376, 2024

    2024 arXiv

  26. [34]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. stat, 1050 0 (9), 2017

    2017

  27. [35]

    D., and Razaviyayn, M

    Nouiehed, M., Sanjabi, M., Huang, T., Lee, J. D., and Razaviyayn, M. Solving a class of non-convex min-max games using iterative first order methods. Advances in Neural Information Processing Systems, 32, 2019

    2019

  28. [36]

    J., Hassani, H., and Cevher, V

    Robey, A., Latorre, F., Pappas, G. J., Hassani, H., and Cevher, V. Adversarial training should be cast as a non-zero-sum game. The Twelfth International Conference on Learning Representations, 2024. URL https://openreview.net/forum?id=XJ9vjEAqbx

    2024

  29. [37]

    Classification with valid and adaptive coverage

    Romano, Y., Sesia, M., and Candes, E. Classification with valid and adaptive coverage. Advances in Neural Information Processing Systems, 33: 0 3581--3591, 2020

    2020

  30. [38]

    Least ambiguous set-valued classifiers with bounded error levels

    Sadinle, M., Lei, J., and Wasserman, L. Least ambiguous set-valued classifiers with bounded error levels. Journal of the American Statistical Association, 114 0 (525): 0 223--234, 2019

    2019

  31. [39]

    T., Doucet, A., et al

    Stutz, D., Cemgil, A. T., Doucet, A., et al. Learning optimal conformal classifiers. arXiv preprint arXiv:2110.09192, 2021

    2021 arXiv

  32. [40]

    Adaptive conformal inference by particle filtering under hidden markov models

    Su, X., Zhou, Z., and Luo, R. Adaptive conformal inference by particle filtering under hidden markov models. arXiv preprint arXiv:2411.01558, 2024

    2024 arXiv

  33. [41]

    Enhanced route planning with calibrated uncertainty set

    Tang, L., Luo, R., Zhou, Z., and Colombo, N. Enhanced route planning with calibrated uncertainty set. Machine Learning, 114 0 (5): 0 1--16, 2025

    2025

  34. [42]

    Matching networks for one shot learning

    Vinyals, O., Blundell, C., Lillicrap, T., Wierstra, D., et al. Matching networks for one shot learning. Advances in neural information processing systems, 29, 2016

    2016

  35. [43]

    Algorithmic learning in a random world, volume 29

    Vovk, V., Gammerman, A., and Shafer, G. Algorithmic learning in a random world, volume 29. Springer, 2005

    2005

  36. [44]

    Enhancing trustworthiness of graph neural networks with rank-based conformal training

    Wang, T., Zhou, Z., and Luo, R. Enhancing trustworthiness of graph neural networks with rank-based conformal training. Proceedings of the AAAI Conference on Artificial Intelligence, 39 0 (20): 0 21261--21268, 2025

    2025

  37. [45]

    Improving adversarial robustness requires revisiting misclassified examples

    Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Improving adversarial robustness requires revisiting misclassified examples. In International conference on learning representations, 2019

    2019

  38. [46]

    Provably robust conformal prediction with improved efficiency

    Yan, G., Romano, Y., and Weng, T.-W. Provably robust conformal prediction with improved efficiency. arXiv preprint arXiv:2404.19651, 2024

    2024 arXiv

  39. [47]

    H., Akhondzadeh, M

    Zargarbashi, S. H., Akhondzadeh, M. S., and Bojchevski, A. Robust yet efficient conformal prediction sets. arXiv preprint arXiv:2407.09165, 2024

    2024 arXiv

  40. [48]

    Theoretically principled trade-off between robustness and accuracy

    Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pp.\ 7472--7482. PMLR, 2019

    2019

  41. [49]

    Deep neural network attacks and defense: The case of image classification

    Zhang, H., Furon, T., Amsaleg, L., and Avrithis, Y. Deep neural network attacks and defense: The case of image classification. Multimedia Security, 1: 0 41--75, 2022

    2022

  42. [50]

    Attacks which do not kill training make adversarial learning stronger

    Zhang, J., Xu, X., Han, B., Niu, G., Cui, L., Sugiyama, M., and Kankanhalli, M. Attacks which do not kill training make adversarial learning stronger. In International conference on machine learning, pp.\ 11278--11287. PMLR, 2020

    2020

  43. [51]

    Residual reweighted conformal prediction for graph neural networks

    Zhang, Z., Bao, J., Zhou, Z., Colombo, N., Cheng, L., and Luo, R. Residual reweighted conformal prediction for graph neural networks. In Proceedings of the 41st Conference on Uncertainty in Artificial Intelligence (UAI), 2025. to appear

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.