[{"corr_author":"1","publication_status":"published","author":[{"full_name":"Prach, Bernd","id":"2D561D42-C427-11E9-89B4-9C1AE6697425","first_name":"Bernd","last_name":"Prach"}],"abstract":[{"text":"Despite generating remarkable results in various computer vision tasks, deep learning comes\r\nwith some surprising shortcomings. For example, tiny perturbations, often imperceptible to\r\nthe human eye, can completely change the predictions of image classifiers. Despite a decade\r\nof research, the field has made limited progress in developing image classifiers that are both\r\naccurate and robust. This thesis aims to address this gap.\r\nAs our first contribution, we aim to simplify the process of training certifiably robust image\r\nclassifiers. We do this by designing a convolutional layer that does not require executing an\r\niterative procedure in every forward pass, but relies on an explicit bound instead. We also\r\npropose a loss function that allows optimizing for a particular margin more precisely.\r\nNext, we provide an overview and comparison of various methods that create robust image\r\nclassifiers by constraining the Lipschitz constant. This is important since generally longer\r\ntraining times and more parameters improve the performance of robust classifiers, making it\r\nchallenging to determine the most practical and effective methods from existing literature.\r\nIn 1-Lipschitz classification, the performance of current methods is still much worse than what\r\nwe expect on the simple tasks we consider. Therefore, we next investigate potential causes of\r\nthis shortcoming. We first consider the role of the activation function. We prove a theoretical\r\nshortcoming of the commonly used activation function, and provide an alternative without it.\r\nHowever this theoretical improvement does barely translate to the empirical performance of\r\nrobust classifiers, suggesting a different bottleneck.\r\nTherefore, in the final chapter, we study how the performance depends on the amount of\r\ntraining data. We prove that in the worst case, we might require far more data to train a\r\nrobust classifier compared to a normal one. We furthermore find that the amount of training\r\ndata is a key determinant of the performance current methods achieve on popular datasets.\r\nAdditionally, we show that linear subspaces exist with tiny data variance, and yet we can\r\nstill train very accurate classifiers after projecting into those subspaces. This shows that on\r\nthe datasets considered, enforcing robustness in classification makes the task strictly more\r\nchallenging.\r\n\r\n-----------------“In reference to IEEE copyrighted material which is used with permission in this thesis, the IEEE does not endorse any of [name of university or educational entity]’s products or services. Internal or personal use of this material is permitted. If interested in reprinting/republishing IEEE copyrighted material for advertising or promotional purposes or for creating new collective works for resale or redistribution, please go to http://www.ieee.org/publications_standards/publications/rights/rights_link.html to learn how to obtain a License from RightsLink. If applicable, University Microfilms and/or ProQuest Library, or the Archives of Canada may supply single copies of the dissertation.”\r\n","lang":"eng"}],"month":"05","file_date_updated":"2025-06-10T18:14:03Z","date_published":"2025-05-30T00:00:00Z","year":"2025","date_created":"2025-05-28T16:20:48Z","oa":1,"language":[{"iso":"eng"}],"type":"dissertation","article_processing_charge":"No","degree_awarded":"PhD","ddc":["000"],"user_id":"ba8df636-2132-11f1-aed0-ed93e2281fdd","oa_version":"Published Version","related_material":{"record":[{"status":"public","id":"15039","relation":"part_of_dissertation"},{"relation":"part_of_dissertation","id":"18874","status":"public"},{"status":"public","id":"17426","relation":"part_of_dissertation"},{"status":"public","id":"11839","relation":"part_of_dissertation"}]},"page":"84","publication_identifier":{"issn":["2663-337X"]},"doi":"10.15479/10.15479/at-ista-19759","status":"public","day":"30","alternative_title":["ISTA Thesis"],"date_updated":"2026-04-07T11:49:52Z","supervisor":[{"id":"40C20FD2-F248-11E8-B48F-1D18A9856A87","full_name":"Lampert, Christoph","orcid":"0000-0001-8622-7887","last_name":"Lampert","first_name":"Christoph"}],"OA_place":"publisher","title":"Robust image classification with 1-Lipschitz networks","_id":"19759","has_accepted_license":"1","citation":{"ama":"Prach B. Robust image classification with 1-Lipschitz networks. 2025. doi:<a href=\"https://doi.org/10.15479/10.15479/at-ista-19759\">10.15479/10.15479/at-ista-19759</a>","ieee":"B. Prach, “Robust image classification with 1-Lipschitz networks,” Institute of Science and Technology Austria, 2025.","apa":"Prach, B. (2025). <i>Robust image classification with 1-Lipschitz networks</i>. Institute of Science and Technology Austria. <a href=\"https://doi.org/10.15479/10.15479/at-ista-19759\">https://doi.org/10.15479/10.15479/at-ista-19759</a>","mla":"Prach, Bernd. <i>Robust Image Classification with 1-Lipschitz Networks</i>. Institute of Science and Technology Austria, 2025, doi:<a href=\"https://doi.org/10.15479/10.15479/at-ista-19759\">10.15479/10.15479/at-ista-19759</a>.","short":"B. Prach, Robust Image Classification with 1-Lipschitz Networks, Institute of Science and Technology Austria, 2025.","chicago":"Prach, Bernd. “Robust Image Classification with 1-Lipschitz Networks.” Institute of Science and Technology Austria, 2025. <a href=\"https://doi.org/10.15479/10.15479/at-ista-19759\">https://doi.org/10.15479/10.15479/at-ista-19759</a>.","ista":"Prach B. 2025. Robust image classification with 1-Lipschitz networks. Institute of Science and Technology Austria."},"file":[{"creator":"bprach","file_size":3578077,"content_type":"application/pdf","date_created":"2025-06-10T18:11:05Z","relation":"main_file","access_level":"open_access","file_name":"ThesisFinal.pdf","date_updated":"2025-06-10T18:11:05Z","checksum":"e5108e759014e2a9020c973c778fafc9","file_id":"19829"},{"date_created":"2025-06-10T18:14:03Z","relation":"source_file","access_level":"closed","creator":"bprach","file_size":74894357,"content_type":"application/x-zip-compressed","file_id":"19830","checksum":"51bf6c11fb6d8a9f8010b458c600a83f","file_name":"ThesisFinal.zip","date_updated":"2025-06-10T18:14:03Z"}],"department":[{"_id":"GradSch"},{"_id":"ChLa"}],"publisher":"Institute of Science and Technology Austria"},{"_id":"20455","title":"Intriguing properties of robust classification","OA_place":"repository","publisher":"IEEE","department":[{"_id":"ChLa"}],"main_file_link":[{"url":"https://doi.org/10.48550/arXiv.2412.04245","open_access":"1"}],"citation":{"short":"B. Prach, C. Lampert, in:, 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops, IEEE, 2025, pp. 660–669.","chicago":"Prach, Bernd, and Christoph Lampert. “Intriguing Properties of Robust Classification.” In <i>2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops</i>, 660–69. IEEE, 2025. <a href=\"https://doi.org/10.1109/CVPRW67362.2025.00071\">https://doi.org/10.1109/CVPRW67362.2025.00071</a>.","ista":"Prach B, Lampert C. 2025. Intriguing properties of robust classification. 2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. CVPR: Conference on Computer Vision and Pattern Recognition, 660–669.","ama":"Prach B, Lampert C. Intriguing properties of robust classification. In: <i>2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops</i>. IEEE; 2025:660-669. doi:<a href=\"https://doi.org/10.1109/CVPRW67362.2025.00071\">10.1109/CVPRW67362.2025.00071</a>","ieee":"B. Prach and C. Lampert, “Intriguing properties of robust classification,” in <i>2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops</i>, Nashville, TN, United States, 2025, pp. 660–669.","apa":"Prach, B., &#38; Lampert, C. (2025). Intriguing properties of robust classification. In <i>2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops</i> (pp. 660–669). Nashville, TN, United States: IEEE. <a href=\"https://doi.org/10.1109/CVPRW67362.2025.00071\">https://doi.org/10.1109/CVPRW67362.2025.00071</a>","mla":"Prach, Bernd, and Christoph Lampert. “Intriguing Properties of Robust Classification.” <i>2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops</i>, IEEE, 2025, pp. 660–69, doi:<a href=\"https://doi.org/10.1109/CVPRW67362.2025.00071\">10.1109/CVPRW67362.2025.00071</a>."},"publication":"2025 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops","day":"15","OA_type":"green","date_updated":"2025-10-13T07:18:26Z","conference":{"start_date":"2025-06-11","name":"CVPR: Conference on Computer Vision and Pattern Recognition","location":"Nashville, TN, United States","end_date":"2025-06-12"},"related_material":{"record":[{"id":"18874","relation":"earlier_version","status":"public"}]},"page":"660-669","scopus_import":"1","user_id":"2DF688A6-F248-11E8-B48F-1D18A9856A87","oa_version":"Preprint","status":"public","quality_controlled":"1","doi":"10.1109/CVPRW67362.2025.00071","publication_identifier":{"eissn":["2160-7516"],"isbn":["9798331599942"],"issn":["2160-7508"]},"arxiv":1,"article_processing_charge":"No","type":"conference","date_created":"2025-10-12T22:01:26Z","year":"2025","date_published":"2025-06-15T00:00:00Z","oa":1,"language":[{"iso":"eng"}],"month":"06","abstract":[{"text":"Despite extensive research since the community learned about adversarial examples 10 years ago, we still do not know how to train high-accuracy classifiers that are guaranteed to be robust to small perturbations of their inputs. Previous works often argued that this might be because no classifier exists that is robust and accurate at the same time. However, in computer vision this assumption does not match reality where humans are usually accurate and robust on most tasks of interest. We offer an alternative explanation and show that in certain settings robust generalization is only possible with unrealistically large amounts of data. Specifically, we find a setting where a robust classifier exists, it is easy to learn an accurate classifier, yet it requires an exponential amount of data to learn a robust classifier. Based on this theoretical result, we evaluate the influence of the amount of training data on datasets such as CIFAR10. Our findings indicate that the the amount of training data is the main factor determining the robust performance. Furthermore we show that that there are low magnitude directions in the data which are useful for non-robust generalization but are not available for robust classifiers. This implies that robust classification is a strictly harder tasks than normal classification, thereby providing an explanation why robust classification requires more data.","lang":"eng"}],"publication_status":"published","corr_author":"1","external_id":{"arxiv":["2412.04245"]},"author":[{"full_name":"Prach, Bernd","id":"2D561D42-C427-11E9-89B4-9C1AE6697425","first_name":"Bernd","last_name":"Prach"},{"orcid":"0000-0001-8622-7887","full_name":"Lampert, Christoph","id":"40C20FD2-F248-11E8-B48F-1D18A9856A87","first_name":"Christoph","last_name":"Lampert"}]},{"related_material":{"record":[{"status":"public","id":"20455","relation":"later_version"},{"status":"public","relation":"dissertation_contains","id":"19759"}]},"user_id":"8b945eb4-e2f2-11eb-945a-df72226e66a9","oa_version":"Preprint","doi":"10.48550/arXiv.2412.04245","status":"public","corr_author":"1","type":"preprint","external_id":{"arxiv":["2412.04245"]},"arxiv":1,"article_number":"2412.04245","article_processing_charge":"No","publication_status":"draft","author":[{"first_name":"Bernd","last_name":"Prach","full_name":"Prach, Bernd","id":"2D561D42-C427-11E9-89B4-9C1AE6697425"},{"id":"40C20FD2-F248-11E8-B48F-1D18A9856A87","full_name":"Lampert, Christoph","orcid":"0000-0001-8622-7887","last_name":"Lampert","first_name":"Christoph"}],"year":"2024","OA_place":"repository","date_published":"2024-12-05T00:00:00Z","_id":"18874","title":"Intriguing properties of robust classification","date_created":"2025-01-24T16:57:29Z","oa":1,"citation":{"ieee":"B. Prach and C. Lampert, “Intriguing properties of robust classification,” <i>arXiv</i>. .","mla":"Prach, Bernd, and Christoph Lampert. “Intriguing Properties of Robust Classification.” <i>ArXiv</i>, 2412.04245, doi:<a href=\"https://doi.org/10.48550/arXiv.2412.04245\">10.48550/arXiv.2412.04245</a>.","apa":"Prach, B., &#38; Lampert, C. (n.d.). Intriguing properties of robust classification. <i>arXiv</i>. <a href=\"https://doi.org/10.48550/arXiv.2412.04245\">https://doi.org/10.48550/arXiv.2412.04245</a>","ama":"Prach B, Lampert C. Intriguing properties of robust classification. <i>arXiv</i>. doi:<a href=\"https://doi.org/10.48550/arXiv.2412.04245\">10.48550/arXiv.2412.04245</a>","chicago":"Prach, Bernd, and Christoph Lampert. “Intriguing Properties of Robust Classification.” <i>ArXiv</i>, n.d. <a href=\"https://doi.org/10.48550/arXiv.2412.04245\">https://doi.org/10.48550/arXiv.2412.04245</a>.","ista":"Prach B, Lampert C. Intriguing properties of robust classification. arXiv, 2412.04245.","short":"B. Prach, C. Lampert, ArXiv (n.d.)."},"language":[{"iso":"eng"}],"publication":"arXiv","department":[{"_id":"GradSch"},{"_id":"ChLa"}],"main_file_link":[{"open_access":"1","url":"https://doi.org/10.48550/arXiv.2412.04245"}],"abstract":[{"text":"Despite extensive research since the community learned about adversarial\r\nexamples 10 years ago, we still do not know how to train high-accuracy\r\nclassifiers that are guaranteed to be robust to small perturbations of their\r\ninputs. Previous works often argued that this might be because no classifier\r\nexists that is robust and accurate at the same time. However, in computer\r\nvision this assumption does not match reality where humans are usually accurate\r\nand robust on most tasks of interest. We offer an alternative explanation and\r\nshow that in certain settings robust generalization is only possible with\r\nunrealistically large amounts of data. More precisely we find a setting where a\r\nrobust classifier exists, it is easy to learn an accurate classifier, yet it\r\nrequires an exponential amount of data to learn a robust classifier. Based on\r\nthis theoretical result, we explore how well robust classifiers generalize on\r\ndatasets such as CIFAR-10. We come to the conclusion that on this datasets, the\r\nlimitation of current robust models also lies in the generalization, and that\r\nthey require a lot of data to do well on the test set. We also show that the\r\nproblem is not in the expressiveness or generalization capabilities of current\r\narchitectures, and that there are low magnitude features in the data which are\r\nuseful for non-robust generalization but are not available for robust\r\nclassifiers.","lang":"eng"}],"month":"12","day":"05","date_updated":"2026-04-07T11:49:51Z"},{"article_processing_charge":"No","arxiv":1,"type":"conference","status":"public","doi":"10.1109/CVPR52733.2024.02320","quality_controlled":"1","conference":{"end_date":"2024-06-22","name":"CVPR: Conference on Computer Vision and Pattern Recognition","start_date":"2024-06-16","location":"Seattle, WA, United States"},"user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","oa_version":"Preprint","page":"24574-24583","related_material":{"record":[{"id":"19759","relation":"dissertation_contains","status":"public"}],"link":[{"relation":"software","url":"https://github.com/berndprach/1LipschitzLayersCompared"}]},"OA_type":"green","date_updated":"2026-04-07T11:49:51Z","day":"01","main_file_link":[{"url":"https://doi.org/10.48550/arXiv.2311.16833","open_access":"1"}],"publisher":"Computer Vision Foundation","department":[{"_id":"GradSch"},{"_id":"ChLa"}],"has_accepted_license":"1","publication":"Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition","citation":{"short":"B. Prach, F. Brau, G. Buttazzo, C. Lampert, in:, Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, Computer Vision Foundation, 2024, pp. 24574–24583.","chicago":"Prach, Bernd, Fabio Brau, Giorgio Buttazzo, and Christoph Lampert. “1-Lipschitz Layers Compared: Memory, Speed, and Certifiable Robustness.” In <i>Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition</i>, 24574–83. Computer Vision Foundation, 2024. <a href=\"https://doi.org/10.1109/CVPR52733.2024.02320\">https://doi.org/10.1109/CVPR52733.2024.02320</a>.","ista":"Prach B, Brau F, Buttazzo G, Lampert C. 2024. 1-Lipschitz layers compared: Memory, speed, and certifiable robustness. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. CVPR: Conference on Computer Vision and Pattern Recognition, 24574–24583.","ama":"Prach B, Brau F, Buttazzo G, Lampert C. 1-Lipschitz layers compared: Memory, speed, and certifiable robustness. In: <i>Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition</i>. Computer Vision Foundation; 2024:24574-24583. doi:<a href=\"https://doi.org/10.1109/CVPR52733.2024.02320\">10.1109/CVPR52733.2024.02320</a>","ieee":"B. Prach, F. Brau, G. Buttazzo, and C. Lampert, “1-Lipschitz layers compared: Memory, speed, and certifiable robustness,” in <i>Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition</i>, Seattle, WA, United States, 2024, pp. 24574–24583.","apa":"Prach, B., Brau, F., Buttazzo, G., &#38; Lampert, C. (2024). 1-Lipschitz layers compared: Memory, speed, and certifiable robustness. In <i>Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition</i> (pp. 24574–24583). Seattle, WA, United States: Computer Vision Foundation. <a href=\"https://doi.org/10.1109/CVPR52733.2024.02320\">https://doi.org/10.1109/CVPR52733.2024.02320</a>","mla":"Prach, Bernd, et al. “1-Lipschitz Layers Compared: Memory, Speed, and Certifiable Robustness.” <i>Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition</i>, Computer Vision Foundation, 2024, pp. 24574–83, doi:<a href=\"https://doi.org/10.1109/CVPR52733.2024.02320\">10.1109/CVPR52733.2024.02320</a>."},"title":"1-Lipschitz layers compared: Memory, speed, and certifiable robustness","_id":"17426","OA_place":"repository","author":[{"last_name":"Prach","first_name":"Bernd","id":"2D561D42-C427-11E9-89B4-9C1AE6697425","full_name":"Prach, Bernd"},{"full_name":"Brau, Fabio","last_name":"Brau","first_name":"Fabio"},{"full_name":"Buttazzo, Giorgio","last_name":"Buttazzo","first_name":"Giorgio"},{"first_name":"Christoph","last_name":"Lampert","orcid":"0000-0001-8622-7887","full_name":"Lampert, Christoph","id":"40C20FD2-F248-11E8-B48F-1D18A9856A87"}],"publication_status":"published","external_id":{"arxiv":["2311.16833"],"isi":["001344387500055"]},"corr_author":"1","month":"06","abstract":[{"lang":"eng","text":"The robustness of neural networks against input perturbations with bounded\r\nmagnitude represents a serious concern in the deployment of deep learning\r\nmodels in safety-critical systems. Recently, the scientific community has\r\nfocused on enhancing certifiable robustness guarantees by crafting 1-Lipschitz\r\nneural networks that leverage Lipschitz bounded dense and convolutional layers.\r\nAlthough different methods have been proposed in the literature to achieve this\r\ngoal, understanding the performance of such methods is not straightforward,\r\nsince different metrics can be relevant (e.g., training time, memory usage,\r\naccuracy, certifiable robustness) for different applications. For this reason,\r\nthis work provides a thorough theoretical and empirical comparison between\r\nmethods by evaluating them in terms of memory usage, speed, and certifiable\r\nrobust accuracy. The paper also provides some guidelines and recommendations to\r\nsupport the user in selecting the methods that work best depending on the\r\navailable resources. We provide code at\r\nhttps://github.com/berndprach/1LipschitzLayersCompared."}],"acknowledgement":"This work was partially supported by project SERICS (PE00000014) under the MUR National Recovery and Resilience Plan funded by the European Union - NextGenerationEU.\r\n","language":[{"iso":"eng"}],"oa":1,"isi":1,"date_created":"2024-08-14T08:42:32Z","date_published":"2024-06-01T00:00:00Z","year":"2024"},{"department":[{"_id":"GradSch"},{"_id":"ChLa"}],"main_file_link":[{"open_access":"1","url":"https://doi.org/10.48550/arXiv.2311.06103"}],"oa":1,"citation":{"ieee":"B. Prach and C. Lampert, “1-Lipschitz neural networks are more expressive with N-activations,” <i>arXiv</i>. .","apa":"Prach, B., &#38; Lampert, C. (n.d.). 1-Lipschitz neural networks are more expressive with N-activations. <i>arXiv</i>. <a href=\"https://doi.org/10.48550/ARXIV.2311.06103\">https://doi.org/10.48550/ARXIV.2311.06103</a>","mla":"Prach, Bernd, and Christoph Lampert. “1-Lipschitz Neural Networks Are More Expressive with N-Activations.” <i>ArXiv</i>, 2311.06103, doi:<a href=\"https://doi.org/10.48550/ARXIV.2311.06103\">10.48550/ARXIV.2311.06103</a>.","ama":"Prach B, Lampert C. 1-Lipschitz neural networks are more expressive with N-activations. <i>arXiv</i>. doi:<a href=\"https://doi.org/10.48550/ARXIV.2311.06103\">10.48550/ARXIV.2311.06103</a>","chicago":"Prach, Bernd, and Christoph Lampert. “1-Lipschitz Neural Networks Are More Expressive with N-Activations.” <i>ArXiv</i>, n.d. <a href=\"https://doi.org/10.48550/ARXIV.2311.06103\">https://doi.org/10.48550/ARXIV.2311.06103</a>.","ista":"Prach B, Lampert C. 1-Lipschitz neural networks are more expressive with N-activations. arXiv, 2311.06103.","short":"B. Prach, C. Lampert, ArXiv (n.d.)."},"language":[{"iso":"eng"}],"publication":"arXiv","title":"1-Lipschitz neural networks are more expressive with N-activations","_id":"15039","date_created":"2024-02-28T17:59:32Z","year":"2023","OA_place":"repository","date_published":"2023-11-10T00:00:00Z","date_updated":"2026-04-07T11:49:51Z","month":"11","day":"10","abstract":[{"text":"A crucial property for achieving secure, trustworthy and interpretable deep learning systems is their robustness: small changes to a system's inputs should not result in large changes to its outputs. Mathematically, this means one strives for networks with a small Lipschitz constant. Several recent works have focused on how to construct such Lipschitz networks, typically by imposing constraints on the weight matrices. In this work, we study an orthogonal aspect, namely the role of the activation function. We show that commonly used activation functions, such as MaxMin, as well as all piece-wise linear ones with two segments unnecessarily restrict the class of representable functions, even in the simplest one-dimensional setting. We furthermore introduce the new N-activation function that is provably more expressive than currently popular activation functions. We provide code at this https URL.","lang":"eng"}],"status":"public","doi":"10.48550/ARXIV.2311.06103","related_material":{"record":[{"relation":"dissertation_contains","id":"19759","status":"public"}]},"oa_version":"Preprint","user_id":"8b945eb4-e2f2-11eb-945a-df72226e66a9","author":[{"last_name":"Prach","first_name":"Bernd","id":"2D561D42-C427-11E9-89B4-9C1AE6697425","full_name":"Prach, Bernd"},{"first_name":"Christoph","last_name":"Lampert","full_name":"Lampert, Christoph","orcid":"0000-0001-8622-7887","id":"40C20FD2-F248-11E8-B48F-1D18A9856A87"}],"arxiv":1,"tmp":{"image":"/images/cc_by.png","legal_code_url":"https://creativecommons.org/licenses/by/4.0/legalcode","short":"CC BY (4.0)","name":"Creative Commons Attribution 4.0 International Public License (CC-BY 4.0)"},"article_processing_charge":"No","article_number":"2311.06103","publication_status":"draft","corr_author":"1","external_id":{"arxiv":["2311.06103"]},"type":"preprint"},{"citation":{"ama":"Prach B, Lampert C. Almost-orthogonal layers for efficient general-purpose Lipschitz networks. In: <i>Computer Vision – ECCV 2022</i>. Vol 13681. Springer Nature; 2022:350-365. doi:<a href=\"https://doi.org/10.1007/978-3-031-19803-8_21\">10.1007/978-3-031-19803-8_21</a>","ieee":"B. Prach and C. Lampert, “Almost-orthogonal layers for efficient general-purpose Lipschitz networks,” in <i>Computer Vision – ECCV 2022</i>, Tel Aviv, Israel, 2022, vol. 13681, pp. 350–365.","mla":"Prach, Bernd, and Christoph Lampert. “Almost-Orthogonal Layers for Efficient General-Purpose Lipschitz Networks.” <i>Computer Vision – ECCV 2022</i>, vol. 13681, Springer Nature, 2022, pp. 350–65, doi:<a href=\"https://doi.org/10.1007/978-3-031-19803-8_21\">10.1007/978-3-031-19803-8_21</a>.","apa":"Prach, B., &#38; Lampert, C. (2022). Almost-orthogonal layers for efficient general-purpose Lipschitz networks. In <i>Computer Vision – ECCV 2022</i> (Vol. 13681, pp. 350–365). Tel Aviv, Israel: Springer Nature. <a href=\"https://doi.org/10.1007/978-3-031-19803-8_21\">https://doi.org/10.1007/978-3-031-19803-8_21</a>","short":"B. Prach, C. Lampert, in:, Computer Vision – ECCV 2022, Springer Nature, 2022, pp. 350–365.","chicago":"Prach, Bernd, and Christoph Lampert. “Almost-Orthogonal Layers for Efficient General-Purpose Lipschitz Networks.” In <i>Computer Vision – ECCV 2022</i>, 13681:350–65. Springer Nature, 2022. <a href=\"https://doi.org/10.1007/978-3-031-19803-8_21\">https://doi.org/10.1007/978-3-031-19803-8_21</a>.","ista":"Prach B, Lampert C. 2022. Almost-orthogonal layers for efficient general-purpose Lipschitz networks. Computer Vision – ECCV 2022. ECCV: European Conference on Computer Vision, LNCS, vol. 13681, 350–365."},"publication":"Computer Vision – ECCV 2022","department":[{"_id":"GradSch"},{"_id":"ChLa"}],"publisher":"Springer Nature","main_file_link":[{"open_access":"1","url":" https://doi.org/10.48550/arXiv.2208.03160"}],"title":"Almost-orthogonal layers for efficient general-purpose Lipschitz networks","_id":"11839","date_updated":"2026-04-07T11:49:51Z","alternative_title":["LNCS"],"day":"23","quality_controlled":"1","publication_identifier":{"isbn":["9783031198021"],"eisbn":["9783031198038"]},"doi":"10.1007/978-3-031-19803-8_21","status":"public","related_material":{"record":[{"id":"19759","relation":"dissertation_contains","status":"public"}]},"page":"350-365","scopus_import":"1","user_id":"317138e5-6ab7-11ef-aa6d-ffef3953e345","oa_version":"Preprint","conference":{"start_date":"2022-10-23","name":"ECCV: European Conference on Computer Vision","location":"Tel Aviv, Israel","end_date":"2022-10-27"},"type":"conference","article_processing_charge":"No","arxiv":1,"language":[{"iso":"eng"}],"oa":1,"isi":1,"intvolume":"     13681","year":"2022","date_published":"2022-10-23T00:00:00Z","date_created":"2022-08-12T15:09:47Z","volume":13681,"abstract":[{"text":"It is a highly desirable property for deep networks to be robust against\r\nsmall input changes. One popular way to achieve this property is by designing\r\nnetworks with a small Lipschitz constant. In this work, we propose a new\r\ntechnique for constructing such Lipschitz networks that has a number of\r\ndesirable properties: it can be applied to any linear network layer\r\n(fully-connected or convolutional), it provides formal guarantees on the\r\nLipschitz constant, it is easy to implement and efficient to run, and it can be\r\ncombined with any training objective and optimization method. In fact, our\r\ntechnique is the first one in the literature that achieves all of these\r\nproperties simultaneously. Our main contribution is a rescaling-based weight\r\nmatrix parametrization that guarantees each network layer to have a Lipschitz\r\nconstant of at most 1 and results in the learned weight matrices to be close to\r\northogonal. Hence we call such layers almost-orthogonal Lipschitz (AOL).\r\nExperiments and ablation studies in the context of image classification with\r\ncertified robust accuracy confirm that AOL layers achieve results that are on\r\npar with most existing methods. Yet, they are simpler to implement and more\r\nbroadly applicable, because they do not require computationally expensive\r\nmatrix orthogonalization or inversion steps as part of the network\r\narchitecture. We provide code at https://github.com/berndprach/AOL.","lang":"eng"}],"month":"10","author":[{"full_name":"Prach, Bernd","id":"2D561D42-C427-11E9-89B4-9C1AE6697425","first_name":"Bernd","last_name":"Prach"},{"last_name":"Lampert","first_name":"Christoph","id":"40C20FD2-F248-11E8-B48F-1D18A9856A87","full_name":"Lampert, Christoph","orcid":"0000-0001-8622-7887"}],"corr_author":"1","external_id":{"isi":["000904104000021"],"arxiv":["2208.03160"]},"publication_status":"published"}]