Neural Network Robustness under Adversarial and Distribution Shifts

Research-attempt provenance

Definitions and mathematical statement

Shared notation.

Standard number systems are $\mathbb N,\mathbb Z,\mathbb Q,\mathbb R,\mathbb C$. Specialized notation and index ranges follow the cited source and the definitions below.

A reconstruction model consists of a measurement map $A:\mathcal X\to\mathcal Y$ and a learned reconstruction map $R:\mathcal Y\to\mathcal X$. Given a signal $x$ and perturbed measurement $Ax+\eta$, a worst-case loss over perturbations $\mathcal U$ is $\sup_{\eta\in\mathcal U}\ell(R(Ax+\eta),x)$. Distribution shift replaces the training joint distribution $P$ of signals and measurements by a test distribution $Q$; its reconstruction risk is $\mathbb E_{(X,Y)\sim Q}[\ell(R(Y),X)]$. These describe different robustness criteria, each requiring its own signal class, perturbation or distribution family, and loss.

Record scope and qualifications.

The catalogue title is retained as metadata. Named certificates, contracts, bounds or frameworks in that title are not asserted as results of the original source extract. Source-record limitation: The reconstruction model, perturbation set, distribution-shift class, loss and requested robustness guarantee are unspecified.

Statement recorded in the supplied source.

Characterize the robustness of neural-network signal reconstruction under worst-case perturbations and distribution shifts. [S2]

Source status.

The supplied catalogue labels this source record open; that metadata was checked against the supplied snapshot on 2026-10-11. The label is preserved for provenance and is not an independent verification of present open status or mathematical correctness. The catalogue literature assessment is dated 2026-08-22.

Short English statement

The source asks about neural Network Robustness under Adversarial and Distribution Shifts.

Sources

• S1 Ulam AI and the UnsolvedMath Contributors, UnsolvedMath: A Curated Collection of Open Mathematics Problems, record 30005249 (OWR-11695855-002). Catalogue curation and metadata: CC BY 4.0. The source extract is retained; definitions, English summaries and qualifications are editorial additions. https://huggingface.co/datasets/ulamai/UnsolvedMath.
• S2 Mini-Workshop: Mathematical Foundations of Robust and Generalizable Learning $2023$, Oberwolfach Reports, DOI 10.4171/owr/2022/46, pp. 2659--2686 https://doi.org/10.4171/owr/2022/46.
• Source-specific Oberwolfach Reports licences, including CC BY-SA 4.0 where applicable, are retained; see THIRD_PARTY_NOTICES.md.

Preparation and review.

The original source and UnsolvedMath contributors retain attribution for the source extract. Codex (GPT-6; exact serving revision not exposed) assisted with definitions, English summaries, scope notes and formatting. No new human mathematical authorship or independently verified solution is asserted. Permanent source ID 30005249 and code OWR-11695855-002 checked against the complete supplied registry and current repository. Distinct upstream records, including repeated questions and broad or damaged extracts, are retained for complete coverage of the source CS category. A repeated record is not a new independent conjecture. Complete mathematical-equivalence and current-literature review has not been performed. Preparation and final review follow contribution prompts C and D, with source gaps disclosed. Structural and rendering checks do not establish a new theorem or open status.

Literature and context check

I read Heckel's discussion on pages 2666--2667 of the primary report. It separates perturbation robustness from distribution-shift behavior and describes restricted positive results. The broad catalogue statement supplies no fixed architecture or signal class, so the following theorem and counterexamples state their own auxiliary models and do not purport to refute those restricted results.

Research attempt: Indistinguishability lower bounds and risk-order reversal under small shifts

A measurement obstruction that applies to every reconstruction map.

Let $\mathcal X$ be a subset of a normed signal space and let $A$ be a map into a normed measurement space. If $x_0,x_1\in\mathcal X$ satisfy $\|Ax_0-Ax_1\|\leq2\delta$, the common observation $y=(Ax_0+Ax_1)/2$ is within $\delta$ of both exact measurements. For any deterministic reconstruction $R$, \[ \max\{\|R(y)-x_0\|,\|R(y)-x_1\|\} \geq\frac12\|x_0-x_1\|, \] by the triangle inequality. Taking the supremum over such pairs gives the minimax lower bound $\frac12\omega(2\delta)$, where $\omega(t)=\sup\{\|x-x'\|:x,x'\in\mathcal X,\|Ax-Ax'\|\leq t\}$, with a supremum rather than an assumed maximizing pair. For squared norm loss, square each pairwise bound before taking the supremum. This has nothing specifically neural about it: indistinguishable noisy data preclude robustness for every estimator.

Conversely assume $\mathcal X$ is nonempty compact, $A$ is continuous, and $\|Ax-Ax'\|\geq\alpha\|x-x'\|$ on $\mathcal X$ for some $\alpha>0$. Choose $R(y)\in\arg\min_{z\in\mathcal X}\|Az-y\|$, whose existence follows from compactness. If $y=Ax+e$, $\|e\|\leq\delta$, its residual is at most $\delta$, and the triangle inequality gives $\|AR(y)-Ax\|\leq2\delta$, hence $\|R(y)-x\|\leq2\delta/\alpha$. This is an existence bound for a possibly expensive estimator, not a trained network guarantee.

Small training error does not replace a Lipschitz bound.

For a single training signal and measurement $x=y=0$, the scalar ReLU reconstruction $R_K(y)=K\max(y,0)$ has zero training loss for every $K>0$. At the allowed perturbation $e=\delta>0$, its error is $K\delta$. The source's expected worst-perturbation risk on this point distribution is therefore at least $K^2\delta^2$, unbounded while the training risk is fixed. An architecture or training constraint must control such slopes if a robustness claim is to follow from training accuracy.

Close distributions can still reverse estimator rankings.

On two test cases $z_0,z_1$, let the bounded losses of $f$ be $(0,1)$ and those of $g$ be $(1,0)$. For $0<\varepsilon<1/2$, put $P=(1/2+\varepsilon,1/2-\varepsilon)$ and $Q=(1/2-\varepsilon,1/2+\varepsilon)$. Then $R_P(f)<R_P(g)$ but $R_Q(f)>R_Q(g)$, while $\operatorname{TV}(P,Q)=2\varepsilon$ can be arbitrarily small. This can be realized as squared reconstruction loss with target zero at scalar measurements $0,1$, and affine estimators $f(y)=y$, $g(y)=1-y$. Thus it is not merely an abstract loss table. For comparison, if a loss lies in $[0,M]$, one does have $|R_P(f)-R_Q(f)|\leq M\operatorname{TV}(P,Q)$: write its expectation as $\int_0^M P\{\ell>t\}\,dt$ and use the definition $\operatorname{TV}(P,Q)=\sup_E|P(E)-Q(E)|$. A small absolute-risk difference therefore does not imply a monotone relation between the risks of different estimators.

Verification and adversarial audit

The lower bound uses the same observation for both signals, and the upper bound states the compactness needed for a minimizer to exist. The two-point shift example uses bounded squared losses and arbitrarily small positive total variation. Its ranking gap tends to zero with the shift, consistently with the proved absolute-risk bound. The ReLU slope example states $\delta>0$.

Audit corrections.

Separated minimax over signals from the source's expected adversarial risk, using a point distribution only for the explicit slope example. Distinguished absolute shift bounds from preservation of estimator order.

External computation.

None; symbolic arguments and boundary checks only.

Scope and remaining gaps

The conditional inverse bound and counterexamples identify indispensable model information. They do not characterize any specified neural training pipeline, all worst-case perturbation families, or source distribution-shift classes. The original broad agenda remains unresolved; the calculations are elementary auxiliary results, not universal negative results about neural reconstruction.

Integration review.

Codex (GPT-6; exact serving revision not exposed) reviewed the written arguments and expanded layout and source-reference wrappers. Repository metadata and the production web renderer were checked using Python 3.13 and JavaScript with MathJax 3.2.2. This model-assisted review is not independent human proof verification; no PDF compilation or formal proof checking is asserted.

Completion Estimate

COMPLETION: 0% The calculations below the preserved source statement investigate a concrete route, but establish no substantiated new progress toward the entire original target. Known special cases and failed sufficient conditions are not credited as a solution.

References

The original source references and catalogue attribution are preserved in the Sources section above. The following URLs were actually consulted for this attempt; retention of an additional original reference does not claim fresh consultation of it.

• https://ems.press/content/serial-article-files/46984 (consulted 2026-10-11).

Model and contributor disclosure

Codex GPT-6 completed written-proof review of this attempt at its declared scope; this is model-assisted review, not independent human proof checking. OpenAI gpt-6-astra, requested reasoning configuration ultra, generated this research attempt on 2026-10-11. The exact serving revision is not exposed. Codex GPT-6 performed orchestration and repository-format review; its exact serving revision is also not exposed. The mathematical route, boundary checks and final adversarial self-audit followed contribution prompts A then B in docs/contribution_prompts.md, after reading CONTRIBUTING.md. Python 3.14.2 assembled the standalone documents; any mathematical computation is specified in Verification. No theorem prover was used. No human mathematical authorship, substantial human proof correction, or independent human proof checking is asserted. Model-assisted review, source retrieval, and structural checks do not establish correctness or novelty. Full private reasoning transcripts are unavailable as reproducibility artifacts; the complete arguments, inputs and outcomes actually used are stated here or in the companion batch audit.

Final status

Unresolved as a new research contribution. This is a concrete route investigation, not a claim of new complete resolution or a current-status certification. A known answer reproduced for context does not become a new contribution. The catalogue's source-status label is preserved; this attempt status does not assert that a source-labelled solved question is open.