MAPLE: manifold-aligned purification with logit-edge calibration for robust black-box adversarial defense

Deep neural networks have achieved remarkable success in visual recognition tasks, yet they remain highly vulnerable to adversarial examples. Existing black-box defenses are mainly based on input transformation, including denoising and purification networks that attempt to remove adversarial perturbations before classification. However, their effectiveness is limited by the complexity of high-dimensional image manifolds and the difficulty of perfectly recovering clean images. To address this issue, this paper proposes MAPLE (Manifold-Aligned Purification with Logit-Edge Calibration), a robust black-box adversarial defense framework that jointly enhances semantic purification and margin calibration. MAPLE consists of a Semantic Purification Network (SPN), implemented as a fully convolutional purification network, and a Margin Calibration Classifier (MCC), initialized from the target classifier. During training, the MCC first guides the SPN to purify adversarial examples into classification-consistent images. Then, the trained SPN provides purified adversarial examples for MCC calibration, allowing the classifier to reshape its local decision geometry around residual adversarial regions. These two phases are performed through cyclic co-calibration, enabling the defense pipeline to progressively suppress adversarial perturbations while enlarging the local classification margin. Extensive experiments on CIFAR-10 and Mini-ImageNet demonstrate that MAPLE consistently outperforms previous mainstream methods under diverse black-box attacks, providing an effective and practical defense paradigm for transferable adversarial attacks.