{
  "abstract": "Certified defenses that incorporate differential privacy have proven effective on Convolutional Neural Networks (CNNs), furnishing rigorous robustness guarantees against norm-bounded adversaries. However, the certified robustness behavior of Pixel Differential Privacy (PixelDP) remains largely unexplored with the self-attention architecture now dominating the deep-learning landscape. Given that the Transformer has a profound impact on our daily applications from the digital world to the physical world, it is crucial to study certified robustness through differential-privacy-style stability. To fill this research gap, we revisit this construction in Vision Transformers and identify a failure mode that is largely hidden in the convolutional setting. When noise is injected after the patch embedding, the Laplace mechanism with the inherited grouped $\\ell_1$ sensitivity bound collapses to chance-level accuracy across noise scales, whereas the Gaussian mechanism remains trainable. This contrast isolates the source of failure: not the injected noise itself, but the geometry of the sensitivity constraint. We show that the attenuation induced by the inherited $Δ_{1,1}$ projection increases with layer width and kernel size according to a random-matrix scale $C/(\\sqrt{M}+\\sqrt{N})$. Replacing the $\\ell_1$-type constraint with a spectral-norm constraint eliminates the collapse across datasets and architectures, but creates a fundamental obstacle: the repaired models no longer satisfy the sensitivity condition required by the standard Laplace certificate. We resolve this mismatch by deriving a dimension-free $(\\varepsilon,\\ δ)$-privacy guarantee for the Laplace mechanism under $\\ell_2$ sensitivity through concentration of the privacy loss.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": "2609.31310",
  "author_total": 5,
  "authors": [
    {
      "name": "Jun Yan"
    },
    {
      "name": "Weiquan Huang"
    },
    {
      "name": "Qixian Zhang"
    },
    {
      "name": "Yan Bai"
    },
    {
      "name": "Shutai Zhang"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/d823kmg41j7js.bib",
  "cited_by": 0,
  "doi": "10.48550/arxiv.2609.31310",
  "fulltext_url": null,
  "id": "d823kmg41j7js",
  "issns": [],
  "landing_url": "https://arxiv.org/abs/2609.31310",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "http://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": "CC0-1.0",
  "native_subjects": [
    [
      "arxiv",
      "cs.CR"
    ],
    [
      "arxiv",
      "stat.AP"
    ],
    [
      "openalex",
      "1702|Adversarial Robustness in Machine Learning"
    ]
  ],
  "openalex": "W7214647767",
  "pdf_url": "https://arxiv.org/pdf/2609.31310",
  "pmcid": null,
  "pmid": null,
  "published": "2026-09-25",
  "publisher": null,
  "ris": "https://research.draconitic.com/paper/d823kmg41j7js.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:25:03Z",
      "native_id": "2609.31310",
      "source": "arxiv",
      "url": "https://arxiv.org/abs/2609.31310"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "arxiv:stat.AP",
      "subfield": "statistics"
    }
  ],
  "title": "Revisiting Certified Defense with Differential Privacy on Vision Transformers",
  "title_text": "Revisiting Certified Defense with Differential Privacy on Vision Transformers",
  "type": "preprint",
  "updated_at": "2026-11-05T15:20:35Z",
  "url": "https://research.draconitic.com/paper/d823kmg41j7js",
  "venue": "arXiv",
  "versions": []
}