Adversarial Acceptance Filter

• Adversarial acceptance filters are defense mechanisms that selectively transmit benign data while rejecting or transforming adversarial manipulations.
• They utilize decision-theoretic frameworks and techniques like DCT masking, Wiener filtering, and neural verification to ensure input integrity.
• Empirical results demonstrate significant reductions in attack success rates with minimal utility loss on benign inputs across various application domains.

An adversarial acceptance filter is a defense mechanism—often realized as an explicit, learnable module or algorithm—that mediates between untrusted or adversarially perturbed inputs and downstream automated systems. Its fundamental goal is to accept and transmit benign, utility-preserving input content, while systematically rejecting, removing, or transforming adversarial manipulations that would otherwise cause system failures, misjudgments, or violations of security and safety properties. This family of mechanisms spans a diverse array of technical domains, including LLMs, neural network-based perception pipelines, distributed decision-making systems, and image classification architectures.

1. Formal Principles and Definitions

The adversarial acceptance filter is grounded in a decision-theoretic paradigm, wherein the defender constructs a function or policy that maps an input (or input pair) to either a sanitized version of the input or a binary accept/reject verdict. The adversarial input space, denoted $A$, comprises all possible malicious manipulations—including imperceptible noise (for DNNs), surreptitious instruction overrides (for LLMs), or data submissions from strategic adversaries (in coding-theoretic settings).

Formally—as exemplified in the prompt-injection defense context—let $U$ be the trusted user instruction and $D$ the untrusted data; the filter seeks a function $\mathrm{Filter}$ such that

$D_{\mathrm{clean}} = \mathrm{Filter}(U, D),$

where all adversarial substrings $a \in A$ are removed from $D_{\mathrm{clean}}$ but every benign, instruction-consistent substring $b$ is preserved. For decision-theoretic defenses, the acceptance rule $\alpha_\eta$ is parameterized, e.g., by a threshold $\eta$, and is applied as $U$0 if $U$1, else $U$2 (Nodehi et al., 10 May 2026).

In safety-critical control with neural perception, the filter produces a set-valued estimate—e.g., a guaranteed safe subset of states—using neural network verification and inflates downstream safety margins accordingly (Rober et al., 5 Feb 2026).

2. Algorithmic Instantiations and Architectural Realizations

Adversarial acceptance filters are instantiated via domain-specific mechanisms:

• Prompt Injection Defenses: DataFilter is a fine-tuned LLM (Llama-3.1-8B-Instruct) placed in front of a target LLM. It takes a system prompt and concatenated trusted instruction and untrusted data, outputs a cleaned data fragment $U$3, and is trained by supervised fine-tuning on synthetic injections and benign examples. The model is conditioned on both the instruction and context during inference, and operates through greedy decoding to strip adversarial commands, with structured data support via recursive field-wise processing (Wang et al., 22 Oct 2025).
• Spectral Image Denoising: Feature-Filter applies a DCT-based mask to eliminate high-frequency ("recessive") coefficients, then compares top-1 model predictions before and after mutation. If the label changes, the input is flagged as adversarial. The full pseudocode for this label-only acceptance test is provided by the authors (Liu et al., 2021).
• Wiener Filtering for Semantic Segmentation: An empirically estimated frequency-domain transfer function suppresses adversarial frequency bands; filtering occurs via elementwise multiplication in the Fourier domain and works as a plug-in preprocessor before segmentation (Kapoor et al., 2020).
• Pixel-Wise Perturbation-Aware Filtering: AdvFilter employs a predictive encoder-decoder architecture with dual filtering heads and semantic- as well as image-level loss. An uncertainty-aware fusion network adaptively combines filter outputs per-pixel, achieving robust denoising across a broad attack amplitude range (Huang et al., 2021).
• Control in Game-Theoretic or Distributed Settings: Phase-based zooming policies learn acceptance thresholds online from accept/reject signals, maintaining sublinear cumulative regret and incentivizing strategic honesty (Nodehi et al., 10 May 2026).
• Safety Filtering with Neural Perception: GUARDIAN uses runtime neural network verification to bound the state estimate given adversarial measurement perturbations, synthesizing the safe action through Hamilton–Jacobi reachability margins inflated for estimator uncertainty (Rober et al., 5 Feb 2026).
• Implicit Robustification via Architectural Choices: Inclusion of large-kernel convolution and maxpool operations as the network front-end (ANF) acts as an implicit noisy acceptance filter, smoothing loss surfaces and suppressing high-frequency adversarial components (Suresh et al., 2024).

3. Training, Evaluation, and Benchmarking Methodologies

Adversarial acceptance filters are evaluated along security and utility axes.

• Prompt-Injection Filtering (DataFilter): Trained via supervised fine-tuning with systematic injection variants—wrapping, truncation, and placement. The evaluation measures Attack Success Rate (ASR), defined as the fraction of prompts where the attack flips model behavior, and utility preservation as win rate on benign tasks (e.g., agentic tool-calling, instruction-following) (Wang et al., 22 Oct 2025). Key results for DataFilter include reducing ASR from up to 42.5% to 1.2% (AgentDojo, gpt-4o), with a benign utility drop of only 2.0 percentage points.
• Spectral Filtering (Feature-Filter): Benchmarking uses CIFAR-10 and ImageNet, reporting true/false positive rates, ROC-AUC, and detection latency. At α=0.90 (CIFAR-10), TPR/TNR is 98.2%/97.0%, and AUC ≈ 96.2%. For ImageNet at α=0.70, TPR=100%, TNR ≈ 98% (Liu et al., 2021).
• Wiener Filtering for Segmentation: Mean Intersection-over-Union (mIoU), SSIM, and MSE are tracked on Cityscapes for multiple attacks. Wiener filtering recovers ~56% mIoU under PGD/FGSM attacks on ICNet, significantly surpassing JPEG, median, and nonlocal means filters, with mIoU clean degradation only 0.5% (Kapoor et al., 2020).
• Pixel-Wise Filtering (AdvFilter): Reports accuracy under various PGD attack strengths (e.g., ResNet-50 at ε=1e−3: No defense 26.8%, AdvFilter 76.8%), as well as PSNR/SSIM (Huang et al., 2021).
• Game-of-Coding Acceptance Rules: Cumulative regret and estimation MSE are measured in online learning, with phase-based zooming achieving cumulative regret ≈8.9×10^3 over 1e5 rounds (Nodehi et al., 10 May 2026).
• Safety Guarantee Validation: GUARDIAN's AAF guarantees are theoretically proven, and computational complexity remains feasible for real-time control (<20 ms per step for neural verification) (Rober et al., 5 Feb 2026).
• First-Layer Adversarial Noise Filters: Experiments report major improvements in adversarial accuracy (e.g., ResNet20: baseline PGD acc. 27.0%, ANF 59.98%). Additional metrics include spectral attenuation (>70% reduction in high-freq power), mPSNR, and decision region margin increases of 20–30% (Suresh et al., 2024).

4. Theoretical Justification, Assumptions, and Limitations

Each filter paradigm relies upon explicit or implicit structural assumptions:

• Prompt and Data Filtering: Assumes adversarial content can be identified as semantically extraneous to the core user instruction, and that a well-supervised generator can learn to excise it while preserving benign content (Wang et al., 22 Oct 2025).
• Spectral Filtering: Leverages the empirical observation that adversarial perturbations are disproportionately encoded in high-frequency (recessive) features, as shown by Ilyas et al., and that DCT or DFT masking removes these with minimal utility loss except against sophisticated adaptive attacks (Liu et al., 2021, Kapoor et al., 2020).
• Online Threshold Optimization: Acceptance rules rely on stable acceptance–error curves and Lipschitz continuity, making them amenable to bandit algorithms with sublinear regret, though adaptation to strategic manipulations may create trade-offs between rejection risk and adversarial degradation (Nodehi et al., 10 May 2026).
• Safety Filtering: The formal guarantees require the neural estimator's verification bounds to be correct, process noise to be known, and the system dynamics to admit effective reachability analysis. Violations may occur with model mismatch or under unverified estimator errors (Rober et al., 5 Feb 2026).
• Adaptive Attacks: All approaches may be challenged by attackers explicitly optimizing to survive filtering steps—e.g., generating perturbations that evade DCT-based detection or injecting content that mimics benign context. Label-only Feature-Filter is more robust to black-box queries, but spectral boundaries are not perfectly sharp (Liu et al., 2021).

5. Comparative Efficacy and Deployment Considerations

Adversarial acceptance filters offer critical deployment advantages and trade-offs:

• Plug-and-Play Deployment: Models such as DataFilter, AdvFilter, and spectral filtering modules operate as drop-in preprocessors, requiring minimal (or no) changes to downstream decision systems (Wang et al., 22 Oct 2025, Huang et al., 2021).
• Low Utility Loss: Generative or filtering approaches (e.g., DataFilter, AdvFilter, Wiener, DCT) consistently achieve high adversarial reduction while maintaining >98% utility for benign inputs, far outperforming binary detectors that over-reject benign content (Wang et al., 22 Oct 2025, Huang et al., 2021, Kapoor et al., 2020).
• Computational Overhead: Modern implementations are efficient: DataFilter adds ~100 ms latency per call on A100/H100 hardware; AdvFilter processes 224×224 images at ~29 ms per image on V100; Feature-Filter adds 0.0028 s per 32×32 sample, and GUARDIAN's verification is <20 ms per control step (Wang et al., 22 Oct 2025, Huang et al., 2021, Liu et al., 2021, Rober et al., 5 Feb 2026).
• Scalability: Filters scale across architectures (ResNet, VGG, EfficientNet), and parametric spectral/wiener filters support batch inference (Suresh et al., 2024, Kapoor et al., 2020).
• Limitations and Trade-offs: Filtering can introduce small accuracy drops for benign data (e.g., 2% for DataFilter, 8–10% for ANF on CIFAR-10). Some defenses are vulnerable to adaptive, learned, or context-mimicking attacks. Safety filtering assumes correct state bound propagation for guarantees to hold (Wang et al., 22 Oct 2025, Suresh et al., 2024, Rober et al., 5 Feb 2026).

6. Cross-Domain Impact and Future Directions

Adversarial acceptance filters have become integral to multiple AI subfields:

• In LLM security, DataFilter reframes prompt-injection defense as adversarial acceptance, achieving near-optimal trade-offs in security and utility for both open- and closed-weight models (Wang et al., 22 Oct 2025).
• Spectral and pixel-wise filter families demonstrate substantial resilience under strong image attacks and require minimal retraining or system reengineering (Liu et al., 2021, Huang et al., 2021, Kapoor et al., 2020).
• Bandit-based threshold learning and Hamilton–Jacobi–verified safety filtering formalize acceptance in strategic and safety-critical settings (Nodehi et al., 10 May 2026, Rober et al., 5 Feb 2026).
• Native architectural changes (ANF) deliver implicit acceptance performance boosts without explicit adversarial training, suggesting a new orthogonal defense layer (Suresh et al., 2024).

A plausible implication is the emergence of hybridized defenses that combine these filtering approaches with system-level monitoring, adversarial training, and online adaptation. Open problems include rigorous defense against fully adaptive adversaries and generalization to multi-modal and multi-agent system settings.