Adversarial Detection for Pre-trained Classifiers via Lipschitz-Margin Analysis with Certification

Deep classifiers deployed in safety-critical services like autonomous-driving perception remain vulnerable to small adversarial perturbations. Certified ${\mathrm{\ell }}_2$ defenses today face a costly trade-off: randomized smoothing (RS) requires hundreds of noisy queries per input, while Lipschitz networks (LN) constrain the architecture and sacrifice clean accuracy. We take a detection-oriented approach instead: rather than certifying that predictions are invariant inside an ${\mathrm{\ell }}_2$ ball, we certify that adversarial inputs within an ${\mathrm{\ell }}_2$ ball are \emph{detected} — a guarantee aligned with security-critical deployments where missing an attack is costlier than flagging a clean input. To realize this, we prove a Lipschitz-margin reduction from certified ${\mathrm{\ell }}_2$ robustness to certified detection, which reduces the problem to handling a single Lipschitz constant $L$. We introduce two detector families: ${\mathbb{D}}_{Adv}$, which estimates $L$ from a single defender-side perturbed pair, and ${\mathbb{D}}_{lc}$, which augments that pair with a local margin centroid to keep the estimate above what the certificate requires. Both deploy on any pretrained classifier without retraining. With a valid global bound, the detector is fully certified at that radius; with a local estimate $L^{\mathrm{\prime }}$, certification is sample-wise and applies only when our certified condition holds. Across MNIST, CIFAR-10, and ImageNet-1k on four backbones (LeNet-5, VGG16, ResNet-50, ViT-B/16), our detectors match or outperform five baselines (CTT, SortNet, CRM, ContraNet, A${}^2$D). For CIFAR-10 with 1-Lipschitz SortNet, our reduction delivers $100\mathrm{\%}$ certified detection at the lowest FPR among compared certified detectors; on the standard CIFAR-10 VGG16, our detectors reject all evaluated in-budget adversarial examples, with 62-82% both rejected and formally certified.