Purifying adversarial attacks with topology
A walkthrough of the intuition behind TopoReformer and topological purification for OCR-based attacks.
A text image can look readable to us while an OCR model transcribes something else. Adversarial perturbations exploit that gap: a small change to the image can push the model toward a very different answer.
Can we preserve what makes a character itself?
TopoReformer studies purification before recognition. Rather than retrain each downstream recognizer, it learns a transformation of the input. The extra prior is topology: the organization of data, including connectivity and loops, that can survive some changes in appearance.
The paper was accepted at the AAAI 2026 AI for Cyber Security workshop. Here is the intuition, the pipeline, and what its experiments actually tell us.
01 — An intuition you can move
What survives as the scale changes?
Each dot represents a sample. Connect samples whose distance is at most ε. Close neighbors merge first; separated groups remain distinct for longer. The barcode records exactly when each component joins another.
Samples & merge connections
Component lifetimes
Latest merge: at ε = 34.67, component G joins E. Its highlighted bar ends there; its samples stay in the merged group.
Black bars cross the current threshold; pale bars have ended. The highlighted row marks the latest merge. A’s arrow denotes the one component that persists indefinitely.
Short bars capture merges among nearby samples. Longer bars reflect groups that stay separate across more distance scales. Persistence measures that lifetime; it does not by itself tell us which features are noise.
An exact H₀ calculation on an illustrative point cloud, not OCR embeddings. Lines show the merge connections needed to preserve connectivity. All components start at zero, so ties are resolved alphabetically. Inspired by Moor et al., Figure 1.
Preserve these relationships when compressing the input
The autoencoder has two jobs: reconstruct its inputs and preserve their topological relationships in the latent representation. The topology loss compares selected distances from persistence pairings in both spaces. It encourages the encoding to retain how samples are organized across scales.
02 — Inside TopoReformer
Reconstruct the image. Preserve the relationships.
A Topological Autoencoder learns a reconstruction and a representation constrained by persistent homology. Its output feeds a variational Reformer, while an Auxiliary module carries the topological latent representation into the Reformer’s bottleneck. A frozen classifier reads the result.
01 / Learn structureTrain the Topological Autoencoder on unperturbed data, balancing reconstruction with preservation of relationships in latent space.
02 / ReformFix the Topological Autoencoder and train the Reformer and Auxiliary path. The classifier’s weights remain frozen.
03 / Balance the pathsA freeze–flow warm-up initially freezes the Reformer encoder so the Auxiliary path can contribute, before joint refinement.
The OCR experiment uses a lighter variant: it leaves out the Reformer for efficiency, purifies character crops, and recombines them into word images. That distinction matters when comparing the OCR results with the digit and character classification experiments.
03 — A closer look
Where does the model look?
These Grad-CAM panels come from Figure 3 of the paper. They visualize model attention on the letter “i” before and after reformation. The colors are retained from the original figure.
Drag to compare · Arrow keys work too
Figure 3, TopoReformer. Labels show predicted character and confidence for this example. Grad-CAM maps are qualitative visualizations, not segmentation masks or a dataset-level accuracy measurement.
04 — Reading the results
One defense, different tests
All values are percentages from the paper. Attack success rate (ASR) should fall; F1 and precision should rise. OCR character accuracy measures correctly recognized characters and is distinct from whole-word attack success.
| Attack / setting | ASR ↓ | F1 ↑ | Precision ↑ |
|---|---|---|---|
| EOTNo defense | 99.05 | 3.38 | 5.21 |
| EOTTopoReformer | 9.19 | 90.73 | 91.07 |
| EOT + BPDANo defense | 99.70 | 3.21 | 4.89 |
| EOT + BPDATopoReformer | 36.59 | 64.71 | 66.65 |
| BPDANo defense | 99.60 | 4.44 | 7.28 |
| BPDATopoReformer | 81.14 | 15.65 | 40.98 |
Table 2. EOT accounts for randomness; BPDA approximates the backward pass through a defense. Their combined evaluation tests both. Full paper ↗
The strongest result depends on the test. Under EOT on MNIST, ASR falls from 99.05% to 9.19%. Under BPDA alone it remains 81.14%, with an F1 of 15.65%. Those numbers are an important limit on the robustness claim.
In the classical-attack ablations, adding every module does not improve every score: on EMNIST under PGD and FGSM, the Reformer-only stage can outperform the final warm-up configuration. The value of topology is something to test under a defined threat model, not a guarantee that every perturbation will disappear.
Figures and results: Bhagyesh Kumar, A S Aravinthakashan, Akshat Satyanarayan, Ishaan Gakhar, and Ujjwal Verma. TopoReformer, arXiv:2511.15807. Figures © 2026 Association for the Advancement of Artificial Intelligence. The point-cloud explorer is an educational illustration created for this article.