Damped Filtering for Representation Conditioned Adversarial Robustness

Adversarial training typically applies a single ambient geometry to all local input directions, while manifold-aware defenses often require an unavailable hard tangent–normal decomposition. We propose Representation-Conditioned Complementary Damped-Filter Regularization (R-CDFR), which uses the singular spectrum of the classifier's representation Jacobian to allocate regularization according to local representation gain. Complementary damped filters define a high-gain pass branch and a low-gain residual branch. Although the exact Jacobian-null component of the input loss gradient vanishes, finite damping yields a nontrivial row-space residual that emphasizes low-gain directions. R-CDFR combines spectrum-wide inverse-metric slope control, concentrated residual-gradient suppression, and finite-step predictive consistency along pass-filtered perturbations. All operators are computed matrix-free using Jacobian–vector and vector–Jacobian products. We derive a local loss-growth bound for the induced perturbation family and relate the three regularizers to complementary local and finite-step quantities. Extensive experiments show consistent robustness gains across datasets, training recipes, convolutional and transformer backbones, and analytic tasks with known directional geometry.