Sharpness-Aware Geometric Defense (SaGD)

• The paper introduces SaGD, a defense framework that smooths the adversarial loss landscape using Riemannian Sharpness-aware Minimization to enhance OOD detection.
• SaGD employs dual geometric projections—a hypersphere head with vMF-based classification and a hyperbolic head—for learning separable latent embeddings under attack.
• SaGD integrates Jitter-based adversarial training to keep perturbed ID samples near the manifold, yielding significant improvements in FPR95 and AUC on CIFAR benchmarks.

Sharpness-aware Geometric Defense (SaGD) is a training-time defense and geometry-aware scoring framework for robust out-of-distribution (OOD) detection in the setting where both in-distribution (ID) and OOD samples are subjected to adversarial perturbations. It was introduced to address a failure mode of contemporary geometry-projection OOD detectors: adversarially perturbed ID samples can be pushed far from their class prototype or neighborhood in latent space and are therefore incorrectly flagged as OOD. SaGD smooths the rugged loss landscape induced by adversarial training and learns multi-geometry latent embeddings whose projected structure remains separable for ID, including adversarial ID, versus OOD. Its central components are multi-geometry projection, Riemannian Sharpness-aware Minimization (RSAM), Jitter-based adversarial training, and a nearest-neighbor geometric OOD score in the learned embedding space (Li et al., 24 Aug 2025).

1. Problem setting and motivation

OOD detection is intended to ensure safe and reliable model deployment by distinguishing samples drawn from the training distribution from inputs lying outside it. In geometry-projection OOD detection, a sample is mapped into a latent geometry and scored by distance or density relative to the ID manifold. Under adversarial perturbations, however, an ID image $x$ can be pushed far from its class prototype or neighborhood in latent space, making its OOD score large. As a result, many geometry-based detectors misclassify adversarial ID as OOD, conflating “maliciously perturbed ID” with “unknown-class OOD” and thereby increasing false positives on adversarial ID (Li et al., 24 Aug 2025).

SaGD is designed for this underexplored but practically critical regime. The stated goal is to distinguish adversarial ID samples from OOD ones rather than treating both as a single rejected category. The motivation rests on the observation that adversarial training, while a strong defense for classification, often sharpens the loss landscape: the inner maximization introduces large gradient norms and increases curvature around local minima, which degrades convergence and stability. In a geometry-projection setting, this appears as unstable latent embeddings, poor prototype compactness, and reduced separability between ID and OOD embeddings, especially under attack (Li et al., 24 Aug 2025).

The framework therefore targets two coupled objectives. First, it seeks to smooth the adversarial loss landscape directly in geometry-projection learning. Second, it seeks to preserve ID compactness and inter-class disparity while maintaining large geometric margins to OOD so that adversarial ID remains near the ID manifold and OOD remains far from it. This suggests that SaGD should be understood not merely as an adversarially trained classifier with an auxiliary detector, but as a joint geometric representation-learning and robust OOD-detection procedure.

2. Multi-geometry latent representation

SaGD uses a backbone encoder and projection heads to learn two latent geometries simultaneously. Let $f_\theta$ denote the backbone encoder and heads collectively. Given an input $x$, the method extracts a penultimate embedding $z = f_\theta(x) \in \mathbb{R}^d$, which is $L_2$-normalized for scoring, and simultaneously learns two geometry projections (Li et al., 24 Aug 2025).

The first projection is a hypersphere head that produces $z_s$ on $S^{d-1}$ via a vMF-based classifier with class prototypes $\{\mu_k\}$. The class-conditional vMF score for unit $z_s$ is

$$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$

with classification probabilities

$f_\theta$0

Its compactness loss encourages $f_\theta$1 to align with the correct class prototype,

$f_\theta$2

and its disparity loss pushes prototypes apart,

$f_\theta$3

The hypersphere loss is

$f_\theta$4

The second projection is a hyperbolic head that produces $f_\theta$5 on a Poincaré ball $f_\theta$6 with curvature $f_\theta$7, corresponding to constant negative curvature $f_\theta$8. With Möbius operations $f_\theta$9 and geodesic distance

$x$0

the supervised hyperbolic contrastive loss on an augmented set $x$1 is

$x$2

The two geometry heads are combined with cross-entropy in a multi-geometry projection (MGP) objective,

$x$3

The stated purpose of this MGP design is to learn richer latent structure than a single geometry. In the formulation of SaGD, that richer structure is intended to improve ID characterization and preserve separability under attack (Li et al., 24 Aug 2025).

3. Sharpness-aware optimization and adversarial example generation

A defining feature of SaGD is the use of Riemannian Sharpness-aware Minimization to regularize adversarial training on the manifold defined by the geometry heads. The framework defines manifold sharpness as

$x$4

where $x$5 lies on a manifold $x$6 with retraction $x$7 and metric tensor $x$8. Using a first-order approximation,

$x$9

the inner maximizer is the normalized Riemannian gradient,

$z = f_\theta(x) \in \mathbb{R}^d$0

The outer update performs Riemannian gradient descent on the perturbed loss,

$z = f_\theta(x) \in \mathbb{R}^d$1

In the method’s interpretation, RSAM flattens sharp minima across the multi-geometry heads, stabilizes latent embeddings, and improves ID/OOD separation under attack. The paper further frames this in gradient-Hessian terms: with adversarial samples $z = f_\theta(x) \in \mathbb{R}^d$2, the gradients $z = f_\theta(x) \in \mathbb{R}^d$3 and $z = f_\theta(x) \in \mathbb{R}^d$4 differ by $z = f_\theta(x) \in \mathbb{R}^d$5, and the curvature term $z = f_\theta(x) \in \mathbb{R}^d$6 appears in the change of feature gradients. Large $z = f_\theta(x) \in \mathbb{R}^d$7 and large $z = f_\theta(x) \in \mathbb{R}^d$8 increase sharpness and harm convergence during adversarial training (Li et al., 24 Aug 2025).

SaGD instantiates adversarial training with Jitter attack rather than standard PGD or FGSM. The standard min-max objective is written as

$z = f_\theta(x) \in \mathbb{R}^d$9

Adversarial examples are generated as $L_2$0 with $L_2$1, $L_2$2, step size $L_2$3, and $L_2$4 steps. Let $L_2$5 be logits, and define

$L_2$6

Jitter aims to maximize the distance to the one-hot ground-truth $L_2$7 with Gaussian jitter noise $L_2$8 injected into the softmax output:

$L_2$9

Its adaptive perturbation rule is

$z_s$0

where $z_s$1 reduces perturbation magnitude once the attack is effective. The stated reason is to keep adversarial examples close to the ID manifold and prevent distribution shift that could harm embedding learning. Empirically, Jitter-based adversarial training is reported to generalize better to unseen attacks than training based on standard PGD or FGSM (Li et al., 24 Aug 2025).

4. OOD scoring, training algorithm, and implementation choices

After training, SaGD constructs an ID embedding bank from penultimate-layer features and scores a test sample by nearest-neighbor geometric distance. With normalized embedding $z_s$2 from the penultimate layer, the OOD score is

$z_s$3

where $z_s$4 is the $z_s$5-th nearest neighbor among ID training embeddings. A threshold $z_s$6 determines OOD versus ID. In the main experiments, $z_s$7 is taken as the nearest neighbor. The method reports that this score is empirically robust, computationally simple, and more stable than alternatives adopted in some baselines, such as Mahalanobis variants (Li et al., 24 Aug 2025).

The training procedure comprises adversarial example generation, joint geometry learning, and RSAM optimization. For each minibatch, adversarial examples are first generated via Jitter with Gaussian softmax jitter and adaptive factor $z_s$8. Clean and adversarial inputs are then forwarded through the backbone and geometry heads to produce $z_s$9, $S^{d-1}$0, and penultimate $S^{d-1}$1. The multi-geometry loss is computed, followed by an RSAM inner step that computes the Riemannian gradient, perturbs parameters within a tangent-ball of radius $S^{d-1}$2, retracts to $S^{d-1}$3, and evaluates the worst-case loss. An RSAM outer step then updates the parameters via retraction-based gradient descent on that worst-case loss. At inference time, the ID embedding bank is built from L2-normalized penultimate features, and threshold calibration is performed on a held-out ID set, optionally with a small validation OOD set, to report FPR@95%TPR, AUROC, and AUPR (Li et al., 24 Aug 2025).

The implementation details reported for the main experiments are specific. CIFAR-10 uses ResNet-18, and CIFAR-100 uses ResNet-34. Optimization uses SGD with momentum $S^{d-1}$4, weight decay $S^{d-1}$5, initial learning rate $S^{d-1}$6, and RSAM regularization. Training lasts $S^{d-1}$7 epochs with batch size $S^{d-1}$8, penultimate dimension $S^{d-1}$9, and hyperbolic curvature $\{\mu_k\}$0. Feature clipping of the form $\{\mu_k\}$1 is applied to stabilize training near the ball boundary. Attacks considered in training and evaluation include PGD, FGSM, FAB, Jitter, and CW via TorchAttacks, all with $\{\mu_k\}$2, step size $\{\mu_k\}$3, and $\{\mu_k\}$4 steps; additional evaluation includes APGD-100, APGD-1000, and AutoAttack (Li et al., 24 Aug 2025).

The paper also provides practical tuning guidance. It recommends Jitter-based adversarial training for robustness to unseen attacks; small RSAM radii, exemplified by $\{\mu_k\}$5 relative to gradient norms; curvature $\{\mu_k\}$6 for stability; temperatures $\{\mu_k\}$7 for vMF and contrastive losses; and small $\{\mu_k\}$8 in k-NN, with $\{\mu_k\}$9 in the main scoring. RSAM is reported to roughly double the per-iteration cost compared to vanilla SGD, since it requires one extra forward/backward pass at $z_s$0 plus retraction, while Jitter adversarial generation adds $z_s$1 inner steps per batch (Li et al., 24 Aug 2025).

5. Empirical evaluation

The experimental setup uses CIFAR-10 and CIFAR-100 as ID datasets and six OOD datasets: Tiny-ImageNet, Places365, LSUN, LSUN-Resize, iSUN, and Textures. For ATD and ATOM, which are exposure-based baselines, Food-101 is used for auxiliary outlier training and SVHN for validation, following their protocols. The primary metrics are FPR@95%TPR (FPR95) and AUROC, with additional reporting of Inlier AUC and Outlier AUC (Li et al., 24 Aug 2025).

The main reported quantitative results are averages over the six OOD datasets. For CIFAR-10 ID, without adversarial training, MGP-Mahalanobis achieves FPR95 $z_s$2 and AUC $z_s$3, and KNN+, ASH, ODIN, and GODIN are reported to degrade significantly under attacks. With adversarial training, ATOM obtains FPR95 $z_s$4 and AUC $z_s$5, ATD obtains FPR95 $z_s$6 and AUC $z_s$7, and SaGD obtains FPR95 $z_s$8 and AUC $z_s$9. The gains over ATD are reported as $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$0 FPR95 and $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$1 AUC. Per-condition results for SaGD on CIFAR-10 are: Clean $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$2, PGD $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$3, Jitter $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$4, FAB $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$5, FGSM $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$6, and CW $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$7 (Li et al., 24 Aug 2025).

For CIFAR-100 ID, without adversarial training, CIDER-Maha reports FPR95 $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$8 and AUC $$p_d(\mathbf{z}_s;\boldsymbol{\mu}_k) = \tau\,\exp\Big(\frac{\boldsymbol{\mu}_k^\top\mathbf{z}_s}{\tau}\Big),$$9, while MGP-KNN reports FPR95 $f_\theta$00 and AUC $f_\theta$01. With adversarial training, ATOM reports FPR95 $f_\theta$02 and AUC $f_\theta$03, ATD reports FPR95 $f_\theta$04 and AUC $f_\theta$05, and SaGD reports FPR95 $f_\theta$06 and AUC $f_\theta$07. The gains over ATD are $f_\theta$08 FPR95 and $f_\theta$09 AUC, and the gains over ATOM are $f_\theta$10 FPR95 and $f_\theta$11 AUC (Li et al., 24 Aug 2025).

On CIFAR-10 under adaptive attacks, the average adversarial results over five attacks are ATD: FPR95 $f_\theta$12, AUC $f_\theta$13, AUCIn $f_\theta$14, AUCOut $f_\theta$15; and SaGD: FPR95 $f_\theta$16, AUC $f_\theta$17, AUCIn $f_\theta$18, AUCOut $f_\theta$19. Under APGD-100, ATD reports $f_\theta$20 versus SaGD $f_\theta$21; under APGD-1000, ATD reports $f_\theta$22 versus SaGD $f_\theta$23; and under AutoAttack, ATD reports $f_\theta$24 versus SaGD $f_\theta$25 (Li et al., 24 Aug 2025).

Setting	Comparator	SaGD
CIFAR-10 average over six OOD datasets	ATD: 42.59 / 87.36	27.68 / 94.83
CIFAR-100 average over six OOD datasets	ATD: 67.58 / 77.41	49.87 / 87.59
CIFAR-10 AutoAttack	ATD: 47.95 / 83.86	32.18 / 93.01

The table entries are FPR95 / AUC. The reported pattern is that SaGD improves both false-positive behavior and ranking quality across clean, standard adversarial, and adaptive attack settings. A plausible implication is that the method improves both separability and score calibration in robust OOD detection, although the paper itself states this more directly in terms of reduced FPR and increased AUC (Li et al., 24 Aug 2025).

6. Ablations, interpretation, and limitations

The ablation study on CIFAR-10 isolates the contributions of RSAM and Jitter. MGP + Jitter without RSAM achieves average FPR95 $f_\theta$26 and AUC $f_\theta$27. MGP + RSAM without Jitter achieves average FPR95 $f_\theta$28 and AUC $f_\theta$29, which the paper interprets as evidence that sharpness reduction alone without adversarial training is insufficient. CIDER + RSAM + Jitter achieves average FPR95 $f_\theta$30 and AUC $f_\theta$31, indicating that both RSAM and Jitter help even with single-geometry heads. SaGD, combining MGP + RSAM + Jitter, achieves the best result: average FPR95 $f_\theta$32 and AUC $f_\theta$33 (Li et al., 24 Aug 2025).

A separate ablation shows that the choice of adversarial training attack matters. RSAM+PGD training yields average FPR95 $f_\theta$34 and AUC $f_\theta$35 but is very strong on FGSM, with FPR95 $f_\theta$36 and AUC $f_\theta$37, indicating overfitting to attack type. RSAM+FAB yields average FPR95 $f_\theta$38 and AUC $f_\theta$39; RSAM+FGSM yields average FPR95 $f_\theta$40 and AUC $f_\theta$41; and RSAM+CW yields average FPR95 $f_\theta$42 and AUC $f_\theta$43. The reported conclusion is that Jitter-based adversarial training generalizes better across attack families than these alternatives (Li et al., 24 Aug 2025).

The paper also studies attack intensity sensitivity under PGD on CIFAR-10. Increasing $f_\theta$44 from $f_\theta$45 to $f_\theta$46 is reported to double FPR95 and reduce AUC by approximately $f_\theta$47. SaGD is described as remaining relatively stable in AUROC while FPR95 is more sensitive, which the authors use to reinforce the importance of reporting FPR@95%TPR in robust OOD detection (Li et al., 24 Aug 2025).

Visualization results further support the method’s interpretation. Histograms of $f_\theta$48 for ID versus OOD under clean and adversarial settings, specifically FGSM and FAB, show that SaGD maintains clear separation, while MGP without defense and CIDER-RSAM-Jitter collapse under FGSM and FAB. RSAM+PGD yields distinct peaks only against PGD but fails on FAB, again illustrating overfitting of standard adversarial training to the seen attack (Li et al., 24 Aug 2025).

The limitations and deployment guidance are stated with similar specificity. FGSM remains a relatively challenging case because of its single-step, large-direction perturbations, although SaGD still improves AUROC and maintains separability. Stronger attacks with larger $f_\theta$49 increase FPR, so both FPR95 and AUROC should be reported. The framework is recommended for systems in which adversarial ID must be kept as ID while OOD rejection is also required, such as safety-critical gating or triage. It is also presented as advantageous when outlier exposure is impractical, because it avoids dependence on large auxiliary OOD datasets while outperforming exposure-based baselines ATD and ATOM in the reported experiments (Li et al., 24 Aug 2025).