The second is a Margin Calibration Classifier, or MCC, which begins as a copy of the target classifier that the defender wants to protect.
The SPN now processes adversarial examples and hands the resulting purified images to the Margin Calibration Classifier, which uses them to recalibrate its own decision geometry.
The evaluation focused on transferable adversarial attacks, the most realistic threat model for black-box defense.
Subject of Research: Black-box adversarial defense for deep neural networks using joint image purification and decision margin calibration Article Title: MAPLE: manifold-aligned purification with logit-edge calibration for robust black-box adversarial defense Article References: Zhou, N., & Yi, P. (2026).
MAPLE: manifold-aligned purification with logit-edge calibration for robust black-box adversarial defense.