Radial–Angular Feature Shaping with an eXtra-Node and Prototype-Based Cosine Similarity Under Adversarial Perturbations
- 1Department of Computer Engineering, Korea National University of Transportation, Chungju-si 27469, Republic of Korea
Abstract
Adversarial perturbations can alter neural-network predictions, motivating closer analysis of the geometry of learned feature representations. For a given local displacement in feature space, small-norm feature vectors can undergo larger first-order directional changes than larger-norm vectors. This study examines this geometric effect in a two-dimensional (2D) bottleneck and proposes a composite objective that regulates feature radius and class-aligned direction. A norm-dependent auxiliary eXtra-node contributes a direct outward feature-gradient component for nonzero features near the origin, whereas a prototype-based cosine similarity (PCS) term aligns features with normalized classifier-weight directions. An exact comparison with semantic cross-entropy further shows that auxiliary softmax normalization introduces an additional semantic-normalization coupling term with generally mixed radial and tangential components. Experiments on a 10-class subset of ImageNet with six matched CNN and Transformer backbones show that the proposed objective increases both the mean feature radius and the mean similarity to the ground-truth class prototype. Under the FGSM, PGD, FDA, UAP, and DeepFool settings used in the experiments, post-attack accuracy is higher in 26 of 30 backbone–procedure comparisons, while mean clean accuracy changes from 98.69% to 98.15%. These results show that the eXtra-node–PCS objective reshapes the 2D representation in the intended radial and angular directions and support further investigation in standard high-dimensional feature spaces and under adaptive attack evaluation.
Related
- Certifying Lower Bounds for Risk-Sensitive Reinforcement Learning under Adversarial State Perturbations
- Certified Spherical MUSIC for 3D Localization under Adversarial Subspace Perturbations
- Quadrature Perturbations and High-Order Time Discretization for Prescribed-Feature Evolutionary GTransNet Galerkin Systems
- Promoting Generalization for Exact Combinatorial Solvers via Adversarial Instance Augmentation
- KINDER: Kernel-based Independence for Fair Representation Learning via Prototype-space Erasure
BibTeX
@article{lee2026radialangular,
title = {{Radial–Angular Feature Shaping with an eXtra-Node and Prototype-Based Cosine Similarity Under Adversarial Perturbations}},
author = {Eun-Sung Lee and Hyun-Cheol Park},
journal = {Mathematics},
year = {2026},
month = oct,
doi = {10.3390/math14203746},
url = {https://www.mdpi.com/2227-7390/14/20/3746},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Radial–Angular Feature Shaping with an eXtra-Node and Prototype-Based Cosine Similarity Under Adversarial Perturbations
AU - Eun-Sung Lee
AU - Hyun-Cheol Park
PY - 2026
DA - 2026/10/15
JO - Mathematics
DO - 10.3390/math14203746
UR - https://www.mdpi.com/2227-7390/14/20/3746
AB - Adversarial perturbations can alter neural-network predictions, motivating closer analysis of the geometry of learned feature representations. For a given local displacement in feature space, small-norm feature vectors can undergo larger first-order directional changes than larger-norm vectors. This study examines this geometric effect in a two-dimensional (2D) bottleneck and proposes a composite objective that regulates feature radius and class-aligned direction. A norm-dependent auxiliary eXtra-node contributes a direct outward feature-gradient component for nonzero features near the origin, whereas a prototype-based cosine similarity (PCS) term aligns features with normalized classifier-weight directions. An exact comparison with semantic cross-entropy further shows that auxiliary softmax normalization introduces an additional semantic-normalization coupling term with generally mixed radial and tangential components. Experiments on a 10-class subset of ImageNet with six matched CNN and Transformer backbones show that the proposed objective increases both the mean feature radius and the mean similarity to the ground-truth class prototype. Under the FGSM, PGD, FDA, UAP, and DeepFool settings used in the experiments, post-attack accuracy is higher in 26 of 30 backbone–procedure comparisons, while mean clean accuracy changes from 98.69% to 98.15%. These results show that the eXtra-node–PCS objective reshapes the 2D representation in the intended radial and angular directions and support further investigation in standard high-dimensional feature spaces and under adaptive attack evaluation.
SN - 2227-7390
ER -