AdVAR-DNN: Dual Perspectives in Adversarial DNNs

• AdVAR-DNN is a term that covers both a defense strategy using fixed, non-differentiable transformations and a black-box attack on split collaborative DNN inference.
• The defense formulation prepends a non-parametric data transformation (e.g., LLE) to standard DNNs, enhancing robustness without relying on obscurity.
• The attack formulation uses latent-space interpolation via a variational autoencoder to manipulate intermediate activations, causing misclassification in IoT-edge systems.

AdVAR-DNN is a term used in two distinct arXiv contexts. In one usage, it denotes the adversary-resistant deep neural network construction summarized from “Learning Adversary-Resistant Deep Neural Networks,” where a fixed, non-parametric, non-differentiable data-transformation module is prepended to a standard DNN in order to increase resistance to adversarial samples (Wang et al., 2016). In a later and separate usage, it denotes “AdVAR-DNN: Adversarial Misclassification Attack on Collaborative DNN Inference,” a black-box attack on split inference in IoT-edge systems that combines a lightweight model-information detector with a variational autoencoder operating on intercepted intermediate activations (Yousefi et al., 1 Aug 2025). The term therefore spans both a defense-oriented architecture and an attack-oriented workflow, and the distinction is technically substantive rather than merely terminological.

1. Terminological scope and disambiguation

A common source of confusion is that the same label is associated with two different adversarial-learning problems. The earlier line of work is centered on adversarial robustness for classifiers under perturbed inputs, whereas the later one targets the integrity of collaborative inference when intermediate representations and partition metadata are exposed in transit (Wang et al., 2016, Yousefi et al., 1 Aug 2025).

Usage of the term	Core setting	Primary aim
Adversary-resistant DNN / LLE-DNN	Standard classification with adversarial samples	Increase resistance via a fixed data transformation
AdVAR-DNN attack	Split or collaborative inference in IoT-edge systems	Cause misclassification by manipulating intercepted activations

The first usage is explicitly described as integrating a data transformation module with a DNN so that robustness does not depend on hiding the learning algorithm. The second usage is explicitly framed as an end-to-end black-box attack that leverages the sensitive information exchange vulnerability of collaborative DNN inference. This suggests that the shared name should not be treated as evidence of a common method family.

2. Defense-oriented formulation: fixed transformation plus DNN

In the adversary-resistant formulation, the core idea is to prepend a fixed, non-parametric, non-differentiable data-transformation module $T$ to a standard DNN $f(\cdot;\theta)$ (Wang et al., 2016). At inference and training time, the pipeline is

$$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$

The specific instantiation summarized in the source material uses LLE as the transformation. The data-transformation function is

$T:\mathbb{R}^m\to\mathbb{R}^{m_n},$

with LLE defined by first solving

$$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$

and then finding $Y=\{y_i\}$ by minimizing

$\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$

with centering and unit-variance constraints. The downstream classifier is

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$

trained with the usual softmax-cross-entropy loss

$$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$

The summarized formulation also presents an optional joint objective

$$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$

while stating that in the concrete realization $f(\cdot;\theta)$0 is fixed offline and has no parameters $f(\cdot;\theta)$1, so the actual objective becomes

$f(\cdot;\theta)$2

The associated adversarial threat model is the standard search for an $f(\cdot;\theta)$3 near $f(\cdot;\theta)$4 that induces misclassification after the transform:

$f(\cdot;\theta)$5

The summary explicitly lists FGSM for $f(\cdot;\theta)$6, PGD, L-BFGS or Newton-style methods for $f(\cdot;\theta)$7, saliency-map or greedy search for $f(\cdot;\theta)$8, and transfer-based black-box attacks crafted on a surrogate model.

A central claim of this construction is that prior defenses amount to “security through obscurity,” whereas the proposed architecture seeks robustness even if the underlying learning algorithm is revealed. By design, $f(\cdot;\theta)$9 is characterized as non-differentiable, with no analytic $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$0, so an attacker cannot directly back-propagate through $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$1 to compute $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$2. The summary further states that inversion of $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$3 is NP-hard because recovering $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$4 from $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$5 can be reduced to solving a non-positive-semidefinite QCQP under simple linear constraints. In the intended argument, white-box knowledge of $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$6 and the exact $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$7 therefore does not immediately yield an efficient gradient-based attack.

3. Training protocol, hyperparameters, and empirical profile of LLE-DNN

Because $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$8 is fixed, the summarized training algorithm learns only $$x \in \mathbb{R}^m \;\xrightarrow{\,T\,}\; z=T(x)\in\mathbb{R}^{m_n} \;\xrightarrow{\,f(\cdot;\theta)\,}\; \hat y.$$9 (Wang et al., 2016). The procedure is: precompute $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$0 for all training samples, initialize $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$1 randomly, and optimize the minibatch loss on transformed inputs using standard backpropagation with respect to $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$2 only. The summary notes that, if one wished to perform adversarial training, one could replace transformed batches by $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$3 with $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$4 and add the corresponding losses, but that extension is not the core training procedure described for the fixed-transform case.

The datasets explicitly listed are MNIST, large-scale malware, and IMDB reviews. Hyperparameters summarized from Table 4 include the following representative configurations:

• For a standard DNN on MNIST: 784–500–300–100, Sigmoid, Adam with learning rate 1e–3, batch size 100, and 70 epochs.
• For distillation with T=20: smaller networks, SGD with learning rate 0.1, and dropout 0.2–0.25.
• For adversarial training: 784–100–100–100–10, Tanh, SGD/Adam, learning rate 0.1/1e–3, and dropout 0.2–0.25.
• For LLE-DNN on MNIST: 200–200–100–10, ReLU, Adam with learning rate 1e–3, dropout 0.5, batch size 100, and 50 epochs.

The empirical results summarized for clean-test accuracy indicate the trade-off between nominal accuracy and robustness. On MNIST, the listed accuracies are 98.45% for the standard DNN, 98.46% for distillation, 98.77% for adversarial training, and 98.19% for LLE-DNN. On the malware dataset, LLE-DNN is reported as best at 93.56%, compared with 92.97% for the standard DNN, 92.45% for distillation, and 91.48% for adversarial training. On IMDB, the summary states that all methods are around 87–88%.

For robustness, the summary reports strong black-box performance for LLE-DNN. On MNIST under FGSM $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$5, the stated accuracies are 6.9% for the standard DNN, 87.1% for distillation, 89.1% for adversarial training, and 95.3% for LLE-DNN. Under white-box attacks, distillation and adversarial training are said to collapse, with MNIST $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$6 accuracy given as 34%/34%, while LLE-DNN retains approximately 97% on MNIST. Even when the attacker approximates $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$7 with a parametric net, the summary states that LLE-DNN still holds approximately 87–97% accuracy. The reduced dimension $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$8 is reported to exhibit a rise-then-fall accuracy profile, with the recommendation to choose the peak.

The practical recommendations attached to this usage are explicit. One may reveal both $T:\mathbb{R}^m\to\mathbb{R}^{m_n},$9 and $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$0, and security is not supposed to rely on obscurity. The transformation should be non-differentiable and approximately non-invertible; LLE is presented as one candidate, and t-SNE and Sammon are named as alternatives provided that sufficient information is preserved and the output dimension is reasonably high. The summary also states that the transform eliminates many adversarial outliers by living in a manifold that respects the original data’s local geometry. A plausible implication is that this approach treats robustness as a property of representation geometry rather than solely of classifier optimization.

4. Attack-oriented AdVAR-DNN: collaborative inference and threat model

In the later usage, AdVAR-DNN is a black-box attack on collaborative inference in IoT-edge systems (Yousefi et al., 1 Aug 2025). The underlying deployment model statically partitions a large pre-trained classifier $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$1 at run-time into a head $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$2 consisting of the first $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$3 layers on the IoT device and a tail $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$4 consisting of the remaining layers on an edge or cloud server. For an input image $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$5, the device computes

$$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$6

then transmits this intermediate activation, together with a small metadata packet encoding which model $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$7 is in use and at which layer $$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$8 the split occurred. The server completes inference as

$$\arg\min_W \sum_i \left\|x_i-\sum_j w_{ij}x_j\right\|^2 \quad \text{s.t.} \quad \sum_j w_{ij}=1,$$9

and returns a top-1 label $Y=\{y_i\}$0 and confidence $Y=\{y_i\}$1.

The attack exploits this exchange. The adversary is assumed to observe only the stream of intermediate vectors $Y=\{y_i\}$2 and the small metadata header. Without touching the device or knowing $Y=\{y_i\}$3, its original parameters, or the exact internal details of $Y=\{y_i\}$4 and $Y=\{y_i\}$5 beyond the length of $Y=\{y_i\}$6, the attacker first uses a lightweight classifier to identify which model and cut-layer are present, then feeds $Y=\{y_i\}$7 into a tailored VAE pretrained on eaves-dropped activations from that same split point, and finally perturbs $Y=\{y_i\}$8 in latent space to produce a manipulated activation $Y=\{y_i\}$9. The manipulated $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$0 is then re-injected into the edge server’s input port for $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$1, causing the server to continue inference on a realistic but adversarial activation.

The black-box assumptions are restrictive in a way that is central to the claim. The adversary has no access to the input image $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$2, no access to the parameters of $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$3 or $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$4, and no prior access to the internal architecture of $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$5 beyond what can be inferred through the detector. The attacker only sees intercepted features $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$6 and may observe the final top-1 confidence $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$7 if desired, for example by a single extra query. The summary explicitly states that the attack never requires white-box gradients, weight extraction, or oracle-query flooding; latent-space perturbation is performed offline via the VAE, followed by a single re-injection of $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$8 into $\sum_i \left\|y_i-\sum_j w_{ij}y_j\right\|^2$9.

This usage differs sharply from classical input-space adversarial examples. The manipulated object is not the original image but the communicated hidden representation. A plausible implication is that defenses designed only for endpoint image classification may not address the integrity risks introduced by split execution and cleartext transmission.

5. VAE core, model-information detector, and latent-space interpolation

For each choice of victim model $f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$0 and split layer $f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$1, the attacker collects a dataset of intermediate activations

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$2

by passive eavesdropping (Yousefi et al., 1 Aug 2025). A small VAE is then trained for that specific split. The encoder

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$3

maps

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$4

samples

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$5

and the decoder

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$6

reconstructs

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$7

The VAE objective is the composite loss

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$8

Here

$f(z;\theta):\mathbb{R}^{m_n}\to\Delta^{C-1},$9

and the closed-form KL term is

$$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$0

The summary is explicit that the original AdVAR-DNN does not add a differentiable misclassification term during VAE training. Instead, it relies on post-training latent-space interpolation to steer the fully trained decoder toward adversarial regions. An optional white-box augmentation is written as

$$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$1

with

$$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$2

but the source text states that this extension is not needed in the black-box setting.

Model and cut-layer identification is handled by a small supervised detector

$$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$3

trained on eaves-dropped tuples $$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$4, where $$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$5 denotes the model and $$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$6 the cut point. In practice, a 2-head MLP of two or three fully connected layers is described as sufficient, trained with

$$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$7

At attack time, each intercepted $$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$8 is passed through $$L(f(z;\theta),y)=-\sum_{c=1}^C y_c \log [f(z;\theta)]_c.$$9, the attacker selects the corresponding pretrained VAE, and latent interpolation is performed.

The interpolation step is defined as follows. Given a new intercepted activation $$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$0, the attacker encodes it to $$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$1, samples

$$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$2

selects a “far-away” latent code $$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$3 from the training pool, for example by maximizing

$$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$4

and forms

$$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$5

The adversarial activation is then

$$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$6

The summary states that $$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$7 near $$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$8 yields a strong but possibly detectable perturbation, whereas intermediate $$\min_{\theta,\phi}\; \frac{1}{n}\sum_{i=1}^n L(f(T_\phi(x_i);\theta),y_i)+\lambda R(\phi,\theta),$$9 retains stealth. This directly encodes the attack’s trade-off between perturbation intensity and detectability.

6. Experimental evidence, detectability, and broader significance

The experimental evaluation for the attack-oriented AdVAR-DNN uses CIFAR-100 with 50 000 train, 10 000 test, and 100 classes, together with three transfer-learned victim classifiers: AlexNet with baseline 77.97 %, VGG19 with baseline 82.20 %, and MobileNet with baseline 69.40 % (Yousefi et al., 1 Aug 2025). Four cut-layers are listed per model. For AlexNet, the listed activations are layer 3 with 27×27×192, layer 6 with 13×13×384, layer 8 with 13×13×256, and layer 10 with 13×13×256. For VGG19, the listed cut points are 12 with 28×28×512, and 16, 18, and 20 each with 14×14×512. For MobileNet, the listed cut points are 20 with 56×56×128, and 40, 50, and 63 each with 14×14×512. A separate VAE with latent dimension k=32 is trained via ADAM on up to 5 000 intercepted activations.

The quantitative results are strong. For AlexNet at layer 8, the reported accuracy changes from baseline 77.97 % to 36 % for pure VAE reconstruction $f(\cdot;\theta)$00 and to 0 % for adversarial interpolation $f(\cdot;\theta)$01\alpha=0.6$f(\cdot;\theta)$02p(\hat y\mid x)>0.9$f(\cdot;\theta)$03\alpha$$, making simple low-confidence outlier checks ineffective. It also reports a data-budget effect: VAE quality and adversarial confidence rise sharply as the number of collected features grows to approximately <code>2 000</code>, after which returns diminish, so only <strong>a few thousand</strong> eaves-dropped activations are needed for a very high-confidence, low-detectability attack.</p> <p>Placed side by side, the two usages of AdVAR-DNN reveal a notable conceptual contrast. The defense-oriented construction argues that one can reveal both the transform$$f(\cdot;\theta)$04 and the classifier $f(\cdot;\theta)$05 because security should not rely on obscurity (Wang et al., 2016). The attack-oriented construction shows that when split inference exposes $f(\cdot;\theta)$06 in clear, a lightweight adversary can turn that exchanged representation into confidently wrong downstream predictions without learning model secrets or accessing white-box gradients (Yousefi et al., 1 Aug 2025). This suggests that adversarial robustness and collaborative-inference integrity are not interchangeable security objectives: robustness to perturbations at the input level does not by itself resolve vulnerabilities created by the transmission of intermediate features and metadata.

A second misconception is that black-box attacks must depend on heavy query budgets. The 2025 formulation explicitly states the opposite: no query flood, no weight extraction, and no prior knowledge of exact weights are required. Conversely, the 2016 defense summary emphasizes non-differentiability and non-invertibility as barriers to efficient white-box optimization. Taken together, these two lines of work show that the meaning of “adversarial” in deep learning depends materially on what is exposed, what is manipulated, and where in the computational graph the attacker gains leverage.