ConjMask: Conjugate-Guided Robustness

• ConjMask is a training-time method within the Neural Uncertainty Principle framework that masks input components with high gradient coupling to reduce adversarial vulnerabilities.
• It employs a localized cosine similarity score between normalized input and gradient to dynamically select and mask vulnerable features during fine-tuning.
• By replacing critical input regions with Gaussian-smoothed noise, ConjMask forces models to learn more stable decision boundaries without resorting to multi-step adversarial training.

Searching arXiv for the ConjMask paper and closely related context. {"query":"(Zhang et al., 20 Mar 2026) ConjMask Neural Uncertainty Principle", "max_results": 5} {"query":"Neural Uncertainty Principle ConjMask adversarial fragility hallucination", "max_results": 10} ConjMask is a training-time robustness method introduced within the Neural Uncertainty Principle (NUP) framework as a way to mitigate adversarial fragility in vision models by masking input components that exhibit strong local coupling with the input-loss gradient (Zhang et al., 20 Mar 2026). In that framework, the input $x$ and the input-loss gradient $p(x)=\nabla_x \mathcal L_c(x)$ are treated as a conjugate pair, and adversarial vulnerability is associated with abnormally strong input–gradient coupling. ConjMask operationalizes this diagnosis by identifying the components that dominate that coupling and masking them during fine-tuning, so that the model is forced to rely less on brittle, high-stress components and to learn a less attack-sensitive decision boundary.

1. Theoretical setting in the Neural Uncertainty Principle

The NUP framework starts from a per-sample loss

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$

and defines the input-gradient field

$p(x):=\nabla_x \mathcal L_c(x).$

For a direction $u\in\mathbb R^d$, $\|u\|_2=1$, the projected input and projected gradient are

$$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$

The paper then introduces a loss-weighted “state”

$$\psi_c(x)=A_c(x)e^{i\alpha \mathcal L_c(x)}, \qquad A_c(x)=\frac{|\mathcal L_c(x)|}{\sqrt{\beta_c}}, \qquad \beta_c=\int_{\mathcal X}\mathcal L_c(x)^2\,dx,$$

with directional operators

$$(\hat x_u g)(x)=(u^\top x)g(x),\qquad (\hat p_u g)(x)=-i\partial_u g(x),$$

satisfying

$[\hat x_u,\hat p_u]=i\mathbb I.$

From this setup, the paper gives the Neural Uncertainty Relation

$p(x)=\nabla_x \mathcal L_c(x)$0

or equivalently

$p(x)=\nabla_x \mathcal L_c(x)$1

Here

$p(x)=\nabla_x \mathcal L_c(x)$2

The paper interprets

$p(x)=\nabla_x \mathcal L_c(x)$3

as an effective feasible conjugate volume, with hard constraint $p(x)=\nabla_x \mathcal L_c(x)$4, $p(x)=\nabla_x \mathcal L_c(x)$5, and slack ratio

$p(x)=\nabla_x \mathcal L_c(x)$6

Within this theory, large coupling $p(x)=\nabla_x \mathcal L_c(x)$7 shrinks the factor $p(x)=\nabla_x \mathcal L_c(x)$8, thereby shrinking $p(x)=\nabla_x \mathcal L_c(x)$9. The paper interprets this as a near-bound or boundary-stress regime in vision. ConjMask is the concrete intervention derived from that diagnosis: if vulnerability is driven by a few input components with large coupling scores, then masking those dominant components during training should improve robustness to standard gradient attacks without adversarial training (Zhang et al., 20 Mar 2026).

2. Coupling observables, CC-Probe, and the ConjMask score

A central step in the NUP paper is the reduction of the operator covariance to an ordinary scalar covariance: $\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$0 Here the loss-weighted scalar covariance is

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$1

The momentum dispersion also decomposes as

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$2

and the operator correlation satisfies

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$3

The paper therefore states that the coupling channel in the NUP bound is governed by ordinary input–gradient alignment, even if attenuated by amplitude variation.

This leads to the paper’s practical probe. With centered vectors

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$4

where

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$5

the centered per-sample CC-Probe is

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$6

For vision, the paper uses the simpler image-space version

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$7

The justification is the random-direction identity

$\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$8

with $\mathcal L_c(x):=\mathcal L(f_\theta(x),c),$9, $p(x):=\nabla_x \mathcal L_c(x).$0, $p(x):=\nabla_x \mathcal L_c(x).$1.

ConjMask itself does not use only the global cosine score. Its actual masking criterion is a componentwise local interaction map. For each selected image sample and channel $p(x):=\nabla_x \mathcal L_c(x).$2, with flattened channel vectors $p(x):=\nabla_x \mathcal L_c(x).$3, the code normalizes each channel: $p(x):=\nabla_x \mathcal L_c(x).$4 and assigns each spatial position $p(x):=\nabla_x \mathcal L_c(x).$5 the score

$p(x):=\nabla_x \mathcal L_c(x).$6

This $p(x):=\nabla_x \mathcal L_c(x).$7 is the exact quantity used to rank components for masking. The paper describes it as a localized decomposition of conjugate coupling: it is high when both the normalized input magnitude and normalized gradient magnitude are strong at the same component (Zhang et al., 20 Mar 2026).

A common misconception is to treat ConjMask as a generic masking augmentation. The paper states otherwise. ConjMask is specifically a conjugate-coupling-guided masking rule derived from the covariance and correlation channel in the NUP formulation.

3. Training procedure and masking operator

ConjMask requires normalized images $p(x):=\nabla_x \mathcal L_c(x).$8, labels $p(x):=\nabla_x \mathcal L_c(x).$9, the current model $u\in\mathbb R^d$0, and cross-entropy loss. For the current minibatch, it computes the clean loss and backpropagates to the input: $u\in\mathbb R^d$1 The paper refers to this as a single-backward probe. It is cheaper than adversarial training because it uses one backward pass with respect to the input rather than a multi-step PGD inner maximization.

Masking is not applied to all samples. Let $u\in\mathbb R^d$2 denote the prediction and

$u\in\mathbb R^d$3

A sample is selected if

$u\in\mathbb R^d$4

with

$u\in\mathbb R^d$5

The intervention therefore targets only misclassified samples or low-confidence correct samples.

For each selected sample and each channel $u\in\mathbb R^d$6, the method computes the local scores $u\in\mathbb R^d$7 and then determines a dynamic masking ratio. Let $u\in\mathbb R^d$8 be a hyperparameter and let

$u\in\mathbb R^d$9

be the fraction of selected samples in the batch. The effective masking ratio is

$\|u\|_2=1$0

The number of masked positions per channel is

$\|u\|_2=1$1

The top $\|u\|_2=1$2 positions with largest $\|u\|_2=1$3 are chosen, yielding a binary top-$\|u\|_2=1$4 mask. However, the paper emphasizes that the actual masking is not hard zero-masking. The binary mask is smoothed with a Gaussian kernel to obtain a soft mask

$\|u\|_2=1$5

A random replacement tensor $\|u\|_2=1$6 is then sampled independently by channel from a Gaussian with CIFAR-10 channel statistics,

$\|u\|_2=1$7

and the masked image is formed as

$\|u\|_2=1$8

In the masking-only setting reported as Exp. 3, the objective is

$\|u\|_2=1$9

The clean branch may still be computed for monitoring, but its loss is not optimized in Exp. 3. The paper characterizes the overall operator as training-time only, per-sample, dynamic, soft, and batch-adaptive; it is applied to the input image before the forward pass used for the masking loss (Zhang et al., 20 Mar 2026).

4. Relation to LogitReg and experimental protocol

The paper treats ConjMask and LogitReg as complementary rather than exclusive. Exp. 3 uses ConjMask only. Exp. 4 keeps the same masking stage and adds output-side regularizers: $$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$0

For ResNet-18, the logit-side term is

$$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$1

and the consistency term is

$$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$2

For ViT-Tiny and EfficientNet-B0, the paper instead defines centered-logit variance

$$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$3

and uses

$$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$4

The reported experimental protocol uses CIFAR-10 at $$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$5, with ResNet-18, ViT-Tiny, and EfficientNet-B0 initialized from clean checkpoints rather than trained from scratch. Optimization uses AdamW, warmup plus cosine learning-rate schedule, 201 epochs, and batch size 64. The reported learning rates and weight decay are $$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$6 and $$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$7 for ResNet-18 and EfficientNet-B0, and $$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$8 and $$x_u=u^\top x,\qquad p_u(x)=u^\top p(x)=\partial_u \mathcal L_c(x).$$9 for ViT-Tiny. Standard CIFAR-10 random crop and horizontal flip are used as data augmentation. During training, checkpoints are evaluated every 20 epochs on Clean, PGD-20, APGD-CE-20, and APGD-DLR-20; at the final epoch, CW-20, Square-100, and FAB-T-20 are additionally used (Zhang et al., 20 Mar 2026).

For masking ratios, the released commands use $$\psi_c(x)=A_c(x)e^{i\alpha \mathcal L_c(x)}, \qquad A_c(x)=\frac{|\mathcal L_c(x)|}{\sqrt{\beta_c}}, \qquad \beta_c=\int_{\mathcal X}\mathcal L_c(x)^2\,dx,$$0 for ResNet-18 and EfficientNet-B0 and $$\psi_c(x)=A_c(x)e^{i\alpha \mathcal L_c(x)}, \qquad A_c(x)=\frac{|\mathcal L_c(x)|}{\sqrt{\beta_c}}, \qquad \beta_c=\int_{\mathcal X}\mathcal L_c(x)^2\,dx,$$1 for ViT-Tiny. The paper’s protocol table explicitly distinguishes masking only from masking plus logit-side stabilization.

5. Mechanistic interpretation and common misconceptions

The paper’s interpretation of ConjMask is that high local coupling contributes to the sample’s global coupling score and to the directional covariance channel in the NUP inequality. If only a few components dominate that coupling, then the model may be relying on a sparse brittle set of high-stress features. Masking those contributors during training should force a redistribution of predictive reliance and reduce over-concentration of sensitivity on the easiest first-order attack directions (Zhang et al., 20 Mar 2026).

Several misconceptions are addressed directly by the method’s design. First, ConjMask is not adversarial training. It does not construct adversarial examples and does not solve a multi-step inner maximization problem. Second, it is not an inference-time preprocessing defense. At test time, the model receives the original clean input directly: no masking, no randomization, and no preprocessing defense are applied. Third, it is not label-free. In the reported vision setup, the probe is

$$\psi_c(x)=A_c(x)e^{i\alpha \mathcal L_c(x)}, \qquad A_c(x)=\frac{|\mathcal L_c(x)|}{\sqrt{\beta_c}}, \qquad \beta_c=\int_{\mathcal X}\mathcal L_c(x)^2\,dx,$$2

so labels are required during training. Fourth, the probe is a loss gradient with respect to the input, not logits or parameters.

The paper also makes clear that ConjMask is aimed mainly at the CE-gradient channel. Its stated motivation is that it should improve robustness to standard CE-gradient attacks such as PGD and APGD-CE. The addition of LogitReg is motivated by stronger loss-optimized attacks such as APGD-DLR. This suggests that ConjMask alone and ConjMask plus LogitReg occupy different roles within the paper’s robustness program.

An implementation detail noted in the supplement is unusually important: the released code performs the probing step in eval() mode and does not restore train() mode before the later forward passes in that batch. The authors note that restoring train mode empirically weakened the effect. This is not a theoretical claim about NUP, but it is part of the reported implementation behavior.

6. Limitations, assumptions, and significance

The supplied text does not include exact robustness tables for ConjMask or ConjMask plus LogitReg, even though it provides detailed protocols. The paper therefore supports the qualitative claim that ConjMask improves resistance to gradient-based attacks without adversarial training, but the exact numerical robustness gains and clean-accuracy tradeoffs for ConjMask itself are not present in the supplied supplement text (Zhang et al., 20 Mar 2026). By contrast, a separate appendix-only experiment, LCR, is reported with explicit numbers, but those numbers are not ConjMask results.

The paper also states several limitations or implies them through the setup. ConjMask is supervised and representation-dependent, since the cosine probe and local score are tied to the chosen pixel-gradient geometry. The broader NUP discussion suggests a robustness–accuracy tradeoff, although the ConjMask-specific tradeoff is not numerically tabulated in the supplied text. The implemented score

$$\psi_c(x)=A_c(x)e^{i\alpha \mathcal L_c(x)}, \qquad A_c(x)=\frac{|\mathcal L_c(x)|}{\sqrt{\beta_c}}, \qquad \beta_c=\int_{\mathcal X}\mathcal L_c(x)^2\,dx,$$3

is presented as a practical heuristic inspired by the theory rather than as the uniquely derived optimal masking rule. The method offers no inference-time fallback defense, so any robustness gain must be encoded in the learned geometry alone.

The significance of ConjMask lies in the fact that it translates a geometric uncertainty principle into a concrete fine-tuning operator. The theory says that input and input-loss gradient form a conjugate pair whose coupling modulates the feasible conjugate volume. The method then localizes that coupling, selects hard samples, masks the highest-scoring components with a Gaussian-smoothed soft mask, and trains on the stochastically replaced image. In the paper’s terminology, this is a way of suppressing the most gradient-aligned input components in hard samples so that the decision boundary becomes less sensitive to first-order adversarial directions. The name “ConjMask” is accordingly short for conjugation-guided masking or conjugate masking (Zhang et al., 20 Mar 2026).