Prototype classifiers gain attack resistance from smoother image embeddings—but not guarantees

Why prototypes need a stable embedding

In the November 6, 2026 preprint Robust Deep Prototype Classifiers via Lipschitz Training, Adia Khalid Khan, Lukas Gehring and Benjamin Paaßen investigate a gap between robustness theory and practical image classification.

A prototype classifier assigns an image to the class of its closest learned representative. Generalized Learning Vector Quantization, or GLVQ, learns these representatives through optimization. Distances to correct-class and competing prototypes provide a margin: a region in which the prediction is protected against changes.

For complex images, however, comparing pixels directly is often ineffective. A deep network first converts each image into an embedding—a compact numerical representation. The prototype classifier then compares those representations rather than raw images.

That creates a problem. A safety margin in embedding space does not automatically protect the original image. If the embedding network amplifies a small input change enough, the representation can cross a classification boundary despite that margin.

A conditional guarantee, a sampled training rule

The paper describes the connection using Lipschitz continuity, which bounds how much a function can amplify distances. If an embedding increases distances by at most a factor L, and its classifier tolerates embedding changes of size ε, the combined model tolerates input changes of size ε/L, provided the required bound holds over the relevant region.

This is a conditional mathematical statement, not proof that the trained networks satisfy its assumptions. The experiments use Euclidean distances for the training constraint; their attack evaluations also include a different distance measure.

To encourage the bound, training adds Gaussian noise to each training image and compares the original and perturbed embeddings. An extra loss penalizes cases where the squared embedding displacement exceeds L² times the squared input displacement. Neighbors are resampled during training.

The method avoids the repeated attack optimization used in adversarial training, although it still requires additional computation. Three settings control its behavior: the target L, the penalty weight and the noise scale. Lowering L does not automatically enlarge protection, because compressing embeddings can also shrink the classifier’s margin.

How the comparison worked

The researchers crossed two embedding-training approaches, standard and Lipschitz-penalized, with three classification heads: a conventional linear layer, a linear support vector machine and GLVQ.

First, they trained the embedding with a linear classification head. They then froze the embedding, retained that head and fitted the alternatives. Consequently, heads within each training configuration shared identical features. GLVQ used one prototype per class, initialized from a training image and optimized in image space.

Experiments covered MNIST handwritten digits, CIFAR-10 color images and Imagenette-160, with Imagenette images resized to 64 by 64 pixels. Lightweight convolutional networks received matched 50-epoch embedding-training budgets. Results were averaged across five cross-validation folds drawn from the training splits, rather than evaluated on the official test sets.

The attacks were single-step FGSM, iterative PGD and Carlini–Wagner, or C&W. FGSM and PGD limited the maximum change to each pixel; C&W sought small total Euclidean changes. Attack budgets were applied in raw pixel space before channel normalization.

Improvements, with important exceptions

MNIST produced the clearest result. Under PGD with a maximum per-pixel change of 0.20 on the zero-to-one pixel scale, Lipschitz-GLVQ retained about 52.9% accuracy. All unconstrained models fell to approximately zero. Its clean accuracy was 98.09%.

The combined model also performed strongly on CIFAR-10, but it was not universally best. On Imagenette, Lipschitz-SVM led under PGD over the range where accuracies remained substantial. Lipschitz-GLVQ led under FGSM beyond a small attack threshold.

C&W results were mixed. For GLVQ on MNIST, the mean distortion needed to change a label increased from 1.57 to 2.93 with Lipschitz training. On CIFAR-10, both variants scored 0.194. Imagenette’s increase from 0.387 to 0.414 was within one standard deviation.

Clean accuracy also carried a cost. GLVQ accuracy fell from 79.18% to 76.49% on CIFAR-10 and from 76.40% to 67.19% on Imagenette. The authors identify slower convergence under the fixed training budget as a concern.

Why this is not certification

The target bound remained violated on sampled training pairs: about 25.2% on MNIST, 95.2% on CIFAR-10 and 55.1% on Imagenette at the default settings. Sampling cannot rule out more sensitive directions elsewhere. These are empirical attack results, not certified input-space robustness.

Evaluation covered only three attacks, with a single PGD random restart and no AutoAttack ensemble. C&W results also varied between runs. Stronger testing could expose additional weaknesses.

Finally, image-shaped prototypes make comparisons inspectable, but do not establish human-understandable reasoning. The paper’s proposed connection between robustness and interpretability remains tentative, particularly on color images. The evidence supports a useful training approach in some settings—not a general guarantee of secure or interpretable classification.