Radial–Angular Feature Shaping with an eXtra-Node and Prototype-Based Cosine Similarity Under Adversarial Perturbations

Adversarial perturbations can alter neural-network predictions, motivating closer analysis of the geometry of learned feature representations. For a given local displacement in feature space, small-norm feature vectors can undergo larger first-order directional changes than larger-norm vectors. This study examines this geometric effect in a two-dimensional (2D) bottleneck and proposes a composite objective that regulates feature radius and class-aligned direction. A norm-dependent auxiliary eXtra-node contributes a direct outward feature-gradient component for nonzero features near the origin, whereas a prototype-based cosine similarity (PCS) term aligns features with normalized classifier-weight directions. An exact comparison with semantic cross-entropy further shows that auxiliary softmax normalization introduces an additional semantic-normalization coupling term with generally mixed radial and tangential components. Experiments on a 10-class subset of ImageNet with six matched CNN and Transformer backbones show that the proposed objective increases both the mean feature radius and the mean similarity to the ground-truth class prototype. Under the FGSM, PGD, FDA, UAP, and DeepFool settings used in the experiments, post-attack accuracy is higher in 26 of 30 backbone–procedure comparisons, while mean clean accuracy changes from 98.69% to 98.15%. These results show that the eXtra-node–PCS objective reshapes the 2D representation in the intended radial and angular directions and support further investigation in standard high-dimensional feature spaces and under adaptive attack evaluation.