Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness

TL;DR

The paper addresses adversarial vulnerability in CNNs and proposes architectural priors based on group equivariance to improve robustness without adversarial training. It develops a theoretical framework showing that $G$-equivariant convolutions contract hypothesis space, regularize gradients, and yield tighter CLEVER bounds, then validates these insights with two architectural designs (parallel and cascaded) utilizing rotation- and scale-equivariant layers. Empirically, symmetry-aware CNNs, particularly the parallel design with rotation and scale branches, achieve superior adversarial robustness on CIFAR-10, CIFAR-100, and CIFAR-10C under FGSM and PGD without AT, and fully equivariant networks demonstrate strong, depth-enhanced resilience. The findings highlight symmetry-enforcing architectures as efficient, principled alternatives to data augmentation- and adversarial-training-based defenses, with potential impact on robust vision systems in real-world settings.

Abstract

Adversarial examples reveal critical vulnerabilities in deep neural networks by exploiting their sensitivity to imperceptible input perturbations. While adversarial training remains the predominant defense strategy, it often incurs significant computational cost and may compromise clean-data accuracy. In this work, we investigate an architectural approach to adversarial robustness by embedding group-equivariant convolutions-specifically, rotation- and scale-equivariant layers-into standard convolutional neural networks (CNNs). These layers encode symmetry priors that align model behavior with structured transformations in the input space, promoting smoother decision boundaries and greater resilience to adversarial attacks. We propose and evaluate two symmetry-aware architectures: a parallel design that processes standard and equivariant features independently before fusion, and a cascaded design that applies equivariant operations sequentially. Theoretically, we demonstrate that such models reduce hypothesis space complexity, regularize gradients, and yield tighter certified robustness bounds under the CLEVER (Cross Lipschitz Extreme Value for nEtwork Robustness) framework. Empirically, our models consistently improve adversarial robustness and generalization across CIFAR-10, CIFAR-100, and CIFAR-10C under both FGSM and PGD attacks, without requiring adversarial training. These findings underscore the potential of symmetry-enforcing architectures as efficient and principled alternatives to data augmentation-based defenses.

Figures (6)

• Figure 1: Adversarial robustness comparison of five models using 4-layer architectures on CIFAR-10 and CIFAR-100. Shaded regions represent ±1 standard deviation over 5 random seeds.
• Figure 2: Adversarial robustness comparison of five models using 10-layer architectures on CIFAR-10 and CIFAR-100. Shaded regions represent ±1 standard deviation over 5 random seeds.
• Figure 3: Parallel design of the CNN architecture. Input is processed through standard, rotation-equivariant, and scale-equivariant branches independently. The resulting features are subsequently fused to form a unified representation.
• Figure 4: Cascaded design of the CNN architecture. Convolutional layers are applied sequentially: standard, then rotation-equivariant, followed by scale-equivariant.
• Figure 5: Visualization of perturbation tolerance for the Baseline CNN and the Parallel GCNN. The top row shows the original image (left), followed by the maximum perturbation ($\epsilon = 0.16$) for the Baseline CNN (middle), and the maximum perturbation ($\epsilon = 0.44$) for the Parallel GCNN (right). Similarly, the bottom row shows the original image (left), with the maximum perturbation ($\epsilon = 0.05$) for the Baseline CNN (middle), and the maximum perturbation ($\epsilon = 0.15$) for the Parallel GCNN (right).

Theorems & Definitions (23)

• Definition 1: Equivariant Function
• Definition 1: Equivariant Function
• Definition 2: Adversarial Robustness
• Definition 3: Margin Function
• Definition 4: Certified Robustness via Lipschitz Bound
• Definition 5: CLEVER Bound weng2018evaluating
• Definition 6: Input Space and Model
• Definition 7: Orbit and Quotient Space
• Definition 8: Jacobian and Lipschitz Constant
• Definition 9: Adversarial Perturbation