{"id":"https://openalex.org/W7214647767","doi":"https://doi.org/10.48550/arxiv.2609.31310","title":"Revisiting Certified Defense with Differential Privacy on Vision Transformers","display_name":"Revisiting Certified Defense with Differential Privacy on Vision Transformers","publication_year":2026,"publication_date":"2026-09-25","ids":{"openalex":"https://openalex.org/W7214647767","doi":"https://doi.org/10.48550/arxiv.2609.31310"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2609.31310","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.31310","pdf_url":"https://arxiv.org/pdf/2609.31310","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2609.31310","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5153202984","display_name":"Jun Yan","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yan, Jun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153214228","display_name":"Weiquan Huang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Huang, Weiquan","raw_affiliation_strings":["Tongji University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tongji University","institution_ids":["https://openalex.org/I116953780"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153358745","display_name":"Qixian Zhang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I116953780","display_name":"Tongji University","ror":"https://ror.org/03rc6as71","country_code":"CN","type":"education","lineage":["https://openalex.org/I116953780"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhang, Qixian","raw_affiliation_strings":["Tongji University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tongji University","institution_ids":["https://openalex.org/I116953780"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5153232642","display_name":"Yan Bai","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Bai, Yan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5153372154","display_name":"Shutai Zhang","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Shutai","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.611299991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.611299991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.37790000438690186,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.0013000000035390258,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/certified-robustness","display_name":"certified robustness","score":0.8059999942779541},{"id":"https://openalex.org/keywords/differential-privacy","display_name":"differential privacy","score":0.9829999804496765},{"id":"https://openalex.org/keywords/vision-transformer","display_name":"vision transformer","score":0.8999999761581421},{"id":"https://openalex.org/keywords/laplace-mechanism","display_name":"Laplace mechanism","score":0.8659999966621399},{"id":"https://openalex.org/keywords/gaussian-mechanism","display_name":"Gaussian mechanism","score":0.9729999899864197},{"id":"https://openalex.org/keywords/sensitivity-bounds","display_name":"sensitivity limits","score":0.5789999961853027},{"id":"https://openalex.org/keywords/spectral-norm","display_name":"spectral norm","score":0.5490000247955322},{"id":"https://openalex.org/keywords/random-matrix-theory","display_name":"random matrix theory","score":0.5950000286102295},{"id":"https://openalex.org/keywords/self-attention","display_name":"self-attention","score":0.5590000152587891}],"concepts":[{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6636999845504761},{"id":"https://openalex.org/C23130292","wikidata":"https://www.wikidata.org/wiki/Q5275358","display_name":"Differential privacy","level":2,"score":0.6017000079154968},{"id":"https://openalex.org/C81363708","wikidata":"https://www.wikidata.org/wiki/Q17084460","display_name":"Convolutional neural network","level":2,"score":0.5817000269889832},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5145999789237976},{"id":"https://openalex.org/C97937538","wikidata":"https://www.wikidata.org/wiki/Q199691","display_name":"Laplace transform","level":2,"score":0.4747999906539917},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4169999957084656},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.40290001034736633},{"id":"https://openalex.org/C46304622","wikidata":"https://www.wikidata.org/wiki/Q374814","display_name":"Certification","level":2,"score":0.3984000086784363},{"id":"https://openalex.org/C4199805","wikidata":"https://www.wikidata.org/wiki/Q2725903","display_name":"Gaussian noise","level":2,"score":0.3946000039577484},{"id":"https://openalex.org/C183057437","wikidata":"https://www.wikidata.org/wiki/Q671617","display_name":"Laplace distribution","level":3,"score":0.3937999904155731},{"id":"https://openalex.org/C152062344","wikidata":"https://www.wikidata.org/wiki/Q818888","display_name":"Computability","level":2,"score":0.3529999852180481},{"id":"https://openalex.org/C137822555","wikidata":"https://www.wikidata.org/wiki/Q2587068","display_name":"Information sensitivity","level":2,"score":0.3443000018596649},{"id":"https://openalex.org/C163716315","wikidata":"https://www.wikidata.org/wiki/Q901177","display_name":"Gaussian","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.3221000134944916},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.3206999897956848},{"id":"https://openalex.org/C24326235","wikidata":"https://www.wikidata.org/wiki/Q126095","display_name":"Electronic engineering","level":1,"score":0.3084999918937683},{"id":"https://openalex.org/C21200559","wikidata":"https://www.wikidata.org/wiki/Q7451068","display_name":"Sensitivity (control systems)","level":2,"score":0.30570000410079956},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.29019999504089355},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.2890999913215637},{"id":"https://openalex.org/C184652730","wikidata":"https://www.wikidata.org/wiki/Q2357982","display_name":"Attenuation","level":2,"score":0.2831000089645386},{"id":"https://openalex.org/C160633673","wikidata":"https://www.wikidata.org/wiki/Q355198","display_name":"Pixel","level":2,"score":0.28029999136924744},{"id":"https://openalex.org/C123201435","wikidata":"https://www.wikidata.org/wiki/Q456632","display_name":"Information privacy","level":2,"score":0.25859999656677246},{"id":"https://openalex.org/C169334058","wikidata":"https://www.wikidata.org/wiki/Q353292","display_name":"Additive white Gaussian noise","level":3,"score":0.2581000030040741},{"id":"https://openalex.org/C86251818","wikidata":"https://www.wikidata.org/wiki/Q816754","display_name":"Benchmarking","level":2,"score":0.2554999887943268},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.25360000133514404},{"id":"https://openalex.org/C99498987","wikidata":"https://www.wikidata.org/wiki/Q2210247","display_name":"Noise (video)","level":3,"score":0.25290000438690186},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.25220000743865967}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2609.31310","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.31310","pdf_url":"https://arxiv.org/pdf/2609.31310","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2609.31310","doi":"https://doi.org/10.48550/arxiv.2609.31310","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2609.31310","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2609.31310","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2609.31310","pdf_url":"https://arxiv.org/pdf/2609.31310","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7214647767.pdf","grobid_xml":"https://content.openalex.org/works/W7214647767.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4226410575","https://openalex.org/W4380993783","https://openalex.org/W4319220891","https://openalex.org/W2883108656","https://openalex.org/W3165388686","https://openalex.org/W4378767032","https://openalex.org/W3111630915","https://openalex.org/W4399197724","https://openalex.org/W4417275496","https://openalex.org/W4285061747"],"abstract_inverted_index":{"Certified":[0],"defenses":[1],"that":[2,44,90,150],"incorporate":[3],"differential":[4],"privacy":[5,229],"have":[6],"proven":[7],"effective":[8],"on":[9,51],"Convolutional":[10],"Neural":[11],"Networks":[12],"(CNNs),":[13],"furnishing":[14],"rigorous":[15],"robustness":[16,24,69],"guarantees":[17],"against":[18],"norm-bounded":[19],"adversaries.":[20],"However,":[21],"the":[22,35,40,45,56,60,95,103,106,110,124,132,137,142,145,151,155,173,181,192,198,203,219,228],"certified":[23,68],"behavior":[25],"of":[26,134,144,227],"Pixel":[27],"Differential":[28],"Privacy":[29],"(PixelDP)":[30],"remains":[31,127],"largely":[32,92],"unexplored":[33],"with":[34,109,160,176],"self-attention":[36],"architecture":[37],"now":[38],"dominating":[39],"deep-learning":[41],"landscape.":[42],"Given":[43],"Transformer":[46],"has":[47],"a":[48,87,168,177,189,213],"profound":[49],"impact":[50],"our":[52],"daily":[53],"applications":[54],"from":[55],"digital":[57],"world":[58],"to":[59,66,117,167],"physical":[61],"world,":[62],"it":[63],"is":[64,91,100],"crucial":[65],"study":[67],"through":[70,225],"differential-privacy-style":[71],"stability.":[72],"To":[73],"fill":[74],"this":[75,80,209],"research":[76],"gap,":[77],"we":[78],"revisit":[79],"construction":[81],"in":[82,94],"Vision":[83],"Transformers":[84],"and":[85,163,185],"identify":[86],"failure":[88],"mode":[89],"hidden":[93],"convolutional":[96],"setting.":[97],"When":[98],"noise":[99,121,139],"injected":[101,138],"after":[102],"patch":[104],"embedding,":[105],"Laplace":[107,205,220],"mechanism":[108,126,221],"inherited":[111,156],"grouped":[112],"$\\ell_1$":[113],"sensitivity":[114,146,199,224],"bound":[115],"collapses":[116],"chance-level":[118],"accuracy":[119],"across":[120,183],"scales,":[122],"whereas":[123],"Gaussian":[125],"trainable.":[128],"This":[129],"contrast":[130],"isolates":[131],"source":[133],"failure:":[135],"not":[136],"itself,":[140],"but":[141,187],"geometry":[143],"constraint.":[147],"We":[148,207],"show":[149],"attenuation":[152],"induced":[153],"by":[154,202,211],"$\u0394_{1,1}$":[157],"projection":[158],"increases":[159],"layer":[161],"width":[162],"kernel":[164],"size":[165],"according":[166],"random-matrix":[169],"scale":[170],"$C/(\\sqrt{M}+\\sqrt{N})$.":[171],"Replacing":[172],"$\\ell_1$-type":[174],"constraint":[175,179],"spectral-norm":[178],"eliminates":[180],"collapse":[182],"datasets":[184],"architectures,":[186],"creates":[188],"fundamental":[190],"obstacle:":[191],"repaired":[193],"models":[194],"no":[195],"longer":[196],"satisfy":[197],"condition":[200],"required":[201],"standard":[204],"certificate.":[206],"resolve":[208],"mismatch":[210],"deriving":[212],"dimension-free":[214],"$(\\varepsilon,\\":[215],"\u03b4)$-privacy":[216],"guarantee":[217],"for":[218],"under":[222],"$\\ell_2$":[223],"concentration":[226],"loss.":[230]},"counts_by_year":[],"updated_date":"2026-11-05T12:25:35.769452","created_date":"2026-09-29T00:00:00"}