Robustness Claims Need an Explicit Threat Model Codex (AI) | Commissioned review v1 | 2026-10-22 Robustness is a quantified relationship between a predictor and an allowed set of interventions. This analytical review separates empirical attack resistance, robust training objectives, and mathematical certificates. Starting from dual norms, it derives a dimensional vulnerability example whose clean margin is held constant; it then contrasts that geometry with Gaussian smoothing certificates. A finite corner enumeration checks an exact linear worst case, while a stationary-gradient counterexample shows why unsuccessful optimization is not a proof. The accompanying curves are constructed calculations, not neural-network benchmark results. The proposed evaluation design requires explicit preprocessing, adaptive attacks, uncertainty accounting, and separate reporting of clean accuracy, attacked accuracy, and certified accuracy. 1. Specify the proposition before naming the defense A claim that a neural network is robust is incomplete until it specifies what may change, what must remain invariant, and over which inputs the statement applies. For a classifier, one possible proposition says that every allowed perturbation of a particular input preserves the predicted class. Another says that an attack program failed on a held-out sample. These propositions have different quantifiers: all perturbations in a set versus the perturbations visited by an algorithm. A clean prediction must also be correct before its local stability constitutes useful robust accuracy. The operational object should include decoding, normalization, resizing, the model, and postprocessing. An epsilon stated in raw pixel coordinates cannot be transferred unchanged to standardized coordinates. A coordinate divided by a small standard deviation amplifies its perturbation. Our analysis therefore treats the input representation as part of the threat model, with dimensionless coordinates unless an application supplies physical units. Changing that representation changes the claim being evaluated. 2. Why a small coordinate budget can accumulate Goodfellow, Shlens, and Szegedy introduced a linear explanation for adversarial examples and a fast signed-gradient construction. Their argument motivates a useful local calculation; it does not make every deep network globally linear or every signed step optimal. Consider a binary linear score with signed clean margin one. Choose a d-dimensional weight vector whose entries are all one divided by the square root of d, so its Euclidean norm remains one. An attacker allowed to move each coordinate by epsilon can reduce the margin by epsilon times the square root of d. Thus the same clean margin and weight Euclidean norm coexist with different infinity-norm robustness radii. With four coordinates the boundary is reached at epsilon one half; with sixty-four coordinates it is reached at one eighth. The first technical figure displays this construction. It changes dimension and the associated weight vector, not the dimension of a fixed trained network. The calculation is an exact geometric example, not an explanation of every observed vulnerability. References: dl-16-1 3. A norm ball is an application hypothesis An infinity-norm ball limits the largest coordinate change; a Euclidean ball limits their aggregate energy. Neither description automatically represents perceptual equivalence. A translation, a change in illumination, or a valid substitution in a token sequence may be small under one application metric and large under another. Conversely, a numerical perturbation can remain inside a chosen ball while violating a physical constraint. Adding an input-domain intersection, such as a pixel box, changes the feasible optimization problem and may invalidate an unconstrained closed form. An evaluator should declare whether attacks are targeted, whether the attacker knows model parameters, and whether queries are limited. These are separate axes. White-box access is information about the predictor; a perturbation radius is a constraint on its inputs. A randomized service introduces another choice: success against a single random draw or against its output distribution. The latter cannot be inferred from a favorable one-shot response. 4. Robust optimization and its numerical surrogate Madry and colleagues formulate adversarial training as a minimization over parameters of a worst-case perturbation loss. They study projected gradient attacks as a practical first-order adversary. The inner numerical maximization remains distinct from an exact solution of the formal inner problem. That distinction creates two error channels. A weak inner optimizer can supply easy training examples, while a weak evaluation optimizer can conceal the resulting vulnerability. Reusing one attack configuration in both stages makes their failures correlated. For a differentiable loss, projected ascent takes a step in a loss-increasing direction and then restores feasibility; step size, initialization, projection, and restart budget influence what it finds. A useful audit retains the strongest feasible adversarial example found for each input across all attempted configurations. Its estimated robust accuracy should never increase merely because an additional valid attack is added. If it does, the aggregation code or denominator deserves investigation. References: dl-16-2 5. A zero gradient is not a local certificate The executable example includes a one-dimensional loss L(delta) equal to delta squared on the interval from minus one to one. Gradient ascent initialized at zero remains there for every step, although both endpoints have loss one. This elementary construction is not a claim that a particular defense has this loss. It isolates the logical failure of interpreting an unsuccessful gradient search as a universal statement over the feasible set. Restarts repair this particular example, but finite restarts do not establish global completeness on arbitrary nonlinear losses. Numerical precision and nondifferentiable preprocessing can create additional discrepancies between the implemented forward pass and the gradient used by an attack. An adaptive evaluation must target the actual prediction pipeline and explain any gradient approximation. It should also retain transfer or gradient-free checks when appropriate to the declared access budget. These checks strengthen empirical evidence; they still do not silently become formal certificates. 6. What randomized smoothing certifies Cohen, Rosenfeld, and Kolter establish a Gaussian smoothing certificate for a classifier defined by the most probable base prediction under Gaussian noise. Given valid lower and upper bounds on the leading and runner-up class probabilities, their radius depends on the difference of two standard-normal quantiles. The guarantee concerns the smoothed classifier and Euclidean perturbations, not every base-model prediction. For a binary illustrative case with complementary probabilities, the formula reduces to sigma times the normal quantile of the leading probability. Our second figure sweeps supplied probabilities and noise scales. These probabilities are parameters, not estimates from a network. Increasing sigma at fixed class probability enlarges the displayed radius, but a trained classifier's class probability generally changes with sigma. Holding it fixed is a sensitivity calculation, not evidence that arbitrarily large noise improves a deployed defense. At probability one half, the radius is zero; class identity also requires a tie convention. References: dl-16-3 7. Confidence accounting belongs inside certification A practical smoother observes finitely many noisy predictions. Replacing unknown probabilities with empirical frequencies without confidence bounds removes the stated statistical protection. The estimation routine must declare its failure probability, sample count, class-selection procedure, and abstention rule. Selecting a class on one sample and estimating its probability on another can make the accounting easier to audit. If the same observations are reused, the validity of the procedure needs a corresponding argument. Dataset reporting adds a second layer. A certificate's per-input failure probability and uncertainty in the population fraction of certifiable inputs are different quantities. A table should report the sample size, certified-correct count, radius convention, and both relevant uncertainty statements. One should not average radii over only the successful cases and present that average as representative of all inputs. Abstentions and clean errors remain visible in the denominator. 8. Reproduce the finite model and challenge its assumptions Our corner enumeration examines all sixteen sign corners of a four-dimensional infinity-norm box for several radii. It compares the minimum signed score against the dual-norm expression and verifies that the score decreases monotonically as the budget grows. Because a linear function on a box attains an extremum at a corner, this finite computation checks the constructed instance exactly, up to floating-point arithmetic. It does not enumerate the perturbation space of a nonlinear neural model. A second check explicitly runs the zero-initialized gradient sequence on the quadratic counterexample and compares its loss with the endpoint. The smoothing panel has a separate reference point: at leading probability Phi(1), its complementary binary certificate equals sigma. Those independent checks connect the text, formulas, and plotted data. They are deliberately small enough to inspect without hidden training data, accelerators, or stochastic benchmark infrastructure. 9. Report tradeoffs on a common input population A defense may change clean accuracy, latency, confidence calibration, and the rate of abstention simultaneously. A fair comparison fixes the input population and presents these quantities together. If a preprocessing filter discards difficult cases, its retained-set accuracy must be accompanied by coverage. If a smoother requires many model evaluations, wall-clock and computational costs should include the estimation procedure, not merely a single base forward pass. Class-level summaries matter because a strong average can conceal a weak category or rare acquisition condition. The evaluator should distinguish examples lost through ordinary prediction error from those lost through attack success or certification failure. Robust training may improve some of these quantities and worsen others; the direction is an empirical question. In particular, failure to certify is not proof that an adversarial example exists. The unverified region includes both genuinely vulnerable cases and cases for which the chosen certificate is too loose. 10. A defensible robustness claim is a bounded contract The most useful deliverable is a reproducible claim with named boundaries: pipeline version, input scale, allowed set, success definition, attacker access, test population, and numerical procedure. A subsequent change in resizing or decoding should trigger review because it can change the geometry seen by both attacker and certificate. A change in label taxonomy can alter correctness even if numerical stability remains unchanged. The analysis here supports three precise conclusions. Dual-norm geometry can make coordinatewise vulnerability grow while a clean margin stays fixed. Failure of finite optimization does not prove absence of an adversarial point. A valid certificate establishes a local property of a specified predictor under explicit assumptions. None is a blanket claim of security against poisoning, model extraction, malicious documents, or distribution shift. Those are separate threat models requiring separate evidence. The proposed protocol below is a design for future neural-model evaluation; this article has executed only the disclosed finite constructions. Executed finite checks Linear corner extrema, stationary-gradient counterexample, and smoothing quantile 127 assertions passed. All 16 corners of a 4D linear box at 51 radii; 20 ascent iterations on delta^2; supplied Gaussian probabilities. No trained network or attack benchmark. { "dimensions": 4, "corners": 16, "epsilon_values": 51, "margin_at_epsilon_point25": 0.5, "gradient_steps": 20, "stationary_loss": 0.0, "endpoint_loss": 1.0, "p_A_at_normal_quantile_1": 0.8413447460685428 } Code: analysis/examples.py with models.py and part_a.py through part_d.py; results: analysis/example-results.json Equations (1) \min_{\|\delta\|_p\leq\epsilon}y\bigl(w^\top(x+\delta)+b\bigr)=m(x,y)-\epsilon\|w\|_q,\qquad p^{-1}+q^{-1}=1 Exact for a linear binary score, labels y in {-1,1}, positive clean signed margin m, and an unconstrained norm ball; additional domain constraints may change the minimum. (2) \min_\theta\ \mathbb E_{(x,y)}\left[\max_{\delta\in\Delta(x)}\ell(f_\theta(x+\delta),y)\right] Robust optimization objective discussed by Madry et al.; numerical attack maximization is a surrogate and does not automatically attain the inner maximum. (3) R=\frac{\sigma}{2}\left[\Phi^{-1}(\underline p_A)-\Phi^{-1}(\overline p_B)\right] Gaussian smoothing radius from Cohen et al. for a leading class with valid probability bounds and a positive gap; perturbations must have Euclidean norm strictly below R. (4) \delta_{t+1}=\Pi_{\Delta(x)}\!\left(\delta_t+\alpha\,\operatorname{sign}\nabla_\delta\ell(f_\theta(x+\delta_t),y)\right) One infinity-norm projected ascent choice with step size alpha; nondifferentiable operations need explicit treatment and this finite iteration is not a certificate. Analytical figures Figure 1. Coordinate budgets accumulate with dimension Constructed unit-Euclidean-norm weights, clean signed margin 1, and no input-domain clipping. Negative margins cross the linear decision boundary; these are different finite-dimensional models, not measurements of neural networks. figures/adversarial-robustness-bounds-1.csv Figure 2. Smoothing radius at supplied class probabilities Analytical binary Gaussian-smoothing formula R = sigma Phi^{-1}(p_A), with p_B = 1-p_A. Probabilities are supplied parameters, not finite-sample estimates; changing sigma need not preserve a real classifier probability. figures/adversarial-robustness-bounds-2.csv Comparison Evidence | Establishes | Does not establish Clean accuracy | Correctness on sampled unperturbed inputs | Stability under allowed perturbations Best-of-attacks accuracy | Resistance to the evaluated attack suite | A universal worst-case lower bound Certified accuracy | Certified correct fraction at a stated radius | Robustness outside the certificate's threat model Abstention coverage | Fraction on which a decision is made | Accuracy of omitted cases Proposed validation protocol 1. Freeze model, preprocessing, input coordinates, and label taxonomy before selecting attack budgets. 2. Define the perturbation set, domain intersection, attacker knowledge, target rule, and randomness policy. 3. Evaluate clean correctness and preserve the same denominator for attacks and certificates. 4. Run adaptive attack configurations with restarts and monotonically aggregate per-input successes. 5. Implement certificate confidence bounds and abstentions with recorded random seeds and failure budgets. 6. Publish class-level accuracy, coverage, computation cost, uncertainty, and all threat-model exclusions. Limitations 1. The executed linear and quadratic cases contain no trained deep network or image benchmark. 2. Norm-bounded perturbations are numerical hypotheses and may not match application semantics. 3. The smoothing curves condition on supplied probabilities; they do not estimate a trained classifier's response to changing sigma. 4. Finite attack searches and finite test populations cannot establish universal robustness outside their declared scope. Research questions 1. How should a perturbation set be validated against application-specific invariances without using the test labels to tune it? 2. Which certificate loosening dominates after the full decoding and preprocessing pipeline is included? 3. Can attack selection be made reproducible while preserving adaptive evaluation against newly discovered weaknesses? Source evidence dl-16-1: Introduces a signed-gradient attack motivated by local linear sensitivity. Boundary: This does not imply global linearity or complete attack optimization. Locator: Sections 3–4. dl-16-2: Frames robust learning as an outer minimization and inner adversarial maximization. Boundary: Practical first-order searches do not certify an exact worst case. Locator: Section 2 and Section 3. dl-16-3: Derives a Gaussian-smoothed classifier's Euclidean robustness radius from class-probability bounds. Boundary: The certificate applies to the smoothed classifier with valid bounds. Locator: Section 2, robustness theorem and certification procedure. References dl-16-1. Ian J. Goodfellow, Jonathon Shlens, Christian Szegedy. Explaining and Harnessing Adversarial Examples. arXiv:1412.6572 (2014). https://arxiv.org/abs/1412.6572 dl-16-2. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, Adrian Vladu. Towards Deep Learning Models Resistant to Adversarial Attacks. International Conference on Learning Representations (2018). https://openreview.net/pdf?id=rJzIBfZAb dl-16-3. Jeremy Cohen, Elan Rosenfeld, J. Zico Kolter. Certified Adversarial Robustness via Randomized Smoothing. Proceedings of the 36th International Conference on Machine Learning (2019). https://proceedings.mlr.press/v97/cohen19c.html dl-16-1 access: Primary record and selected accessible full-text sections inspected; no exhaustive supplementary-material audit. Version note: Initial preprint 2014; inspected HTML version 3 revised 20 March 2015. Cited here as the preprint record. dl-16-2 access: Primary record and selected accessible full-text sections inspected; no exhaustive supplementary-material audit. Version note: Conference year verified on primary OpenReview PDF; selected text also inspected in arXiv:1706.06083. dl-16-3 access: Primary record and selected accessible full-text sections inspected; no exhaustive supplementary-material audit. Provenance A focused analytical review of three selected foundational primary sources, with original worked examples. This is not an exhaustive or systematic survey of the literature through 2026. Source access and version notes are recorded with the bibliography. Written and technically self-reviewed by Codex (AI). References identify the original researchers; the analytical constructions and proposed evaluation designs are attributed to this article. Covers are conceptual ImageGen illustrations. Technical figures are computed from declared models or finite examples, with Python and CSV supplied. They are not measurements of deployed products or reproduced performance benchmarks. This local draft has no independent peer-review or journal-acceptance record. Bounded executable examples check the stated small models; they are not formal verification of the cited systems.