Decision boundary (as a codimension-1 hypersurface)

structures / Manifolds / Decision boundary (as a codimension-1 hypersurface)

Decision boundary (as a codimension-1 hypersurface)

OBJECTgeometric-objectsubsetK:variableimplicitmanifoldintermediatehow it's classified →

The codimension-1 level set $\{x : f(x) = 0\}$ separating two predicted classes in a classifier's input (or feature) space — a distinct geometric object at the function level, as opposed to the activation-cloud/representation-level manifolds this map otherwise catalogs.

Replicationcomputed from the corpus — never hand-assigned

7 papers · no shared authors3 architecture classes · across papers3 domains · across papers13 model families · across papers

Filled = two or more values reported by papers that share no author — replication. Outlined = two or more values, but all from a single study — breadth, not replication. Grey = a single value. Derived from paper authorship and each model's architecture class, domain and family; it updates itself when a paper is added.

Definition

For a binary (or one-vs-rest) classifier $f: \mathbb{R}^n \to \mathbb{R}$ , the decision boundary is the level set $\{x : f(x) = 0\}$ — a codimension-1 hypersurface (under mild regularity) partitioning input space into predicted-class regions. Its geometry (local curvature, surface volume/area, flatness near data points) is a distinct object from the activation-cloud manifolds this map otherwise catalogs: the latter describe the shape of representations a network produces for a population of inputs, while the decision boundary describes the shape of the function itself — where the classifier’s output crosses a threshold.

Relative to the linear region arrangement

This node catalogs a single codimension-1 level set of the classifier’s output. The full combinatorial partition of input space into piecewise-linear “linear regions” — induced by every unit’s breakpoint at every layer, not just the ones on the eventual output threshold — is a distinct, larger object; see Linear region arrangement (polyhedral tessellation of input space).

Relative to activation-space manifolds

Every other geometric-object node in this map (manifolds-sphere, manifolds-affine, linear-subspace, etc.) describes a set of points in representation space — activations produced by feeding inputs through (part of) a network. The decision boundary instead lives in input (or feature) space and is defined by the network’s output crossing a threshold; it is a property of the function the network computes, not of the population of activations it produces. A network with highly structured (e.g. linearly-separable) representations can still have a decision boundary of arbitrary curvature at the output layer, and vice versa — the two are related but not identical objects.

Key evidence

Burfitt, Brodzki & Dłotko (2026) measure decision-boundary geometry via a computable proxy for Weyl’s (1939) tube-formula volume: for small $\varepsilon$ , the volume of an $\varepsilon$ -tubular neighborhood of a codimension-1 hypersurface is approximately linear in the hypersurface’s own volume $k_0(M)$ . They estimate this via Monte Carlo sampling — uniformly sampling points $x$ in a region $\mathcal{U}$ and testing whether an FGSM adversarial example lies within $\varepsilon$ of $x$ — defining three region-specific volume measures: Bvol (whole input cube), TrainBvol ( $\delta$ -balls around training points), and LAdvBvol ( $\delta$ -balls around bisection-located points between opposite-class training pairs). Across CNN architectures on MNIST, Fashion-MNIST and CIFAR-10 (varying dropout rate 0-0.5, 10 random inits each), a local minimum in TrainBvol consistently coincides with (or slightly precedes) peak test accuracy — smaller local decision-boundary volume tracks better generalization. For fully-connected architectures on the same datasets, this relationship is markedly less stable: for Fashion-MNIST FC, the roles of TrainBvol and LAdvBvol are reversed, and the accuracy peak aligns with a local maximum (not minimum) in LAdvBvol — architecture-dependent instability rather than a clean universal law. No causal intervention on boundary volume itself is performed (dropout rate is the manipulated hyperparameter; volume and accuracy are both measured observationally).

Curvature, as distinct from volume

Sun (2025) measures a different local property of the same decision boundary — curvature rather than surface volume — via a query-efficient black-box method (Dynamic Curvature Estimation) that tracks a “curvature dynamic trajectory” during an adversarial attack’s own query process, built on the CGBA attack. Across a wide range of standard and adversarially-robust image classifiers on CIFAR-10 and ImageNet (RobustBench models), estimated boundary curvature is statistically significantly related to adversarial-robustness metrics (robust accuracy, certified accuracy), and the curvature estimate is folded back into the attack itself to produce a more query-efficient variant (CDBA). See decision-boundary-curvature-predicts-adversarial-robustness-across-robustbench-classifiers.

Brandon, Chadwick & Pellegrino (2025) measure a hidden-activation-space analog of the same curvature phenomenon, using a genuine Riemannian pullback metric (see Manifolds‘s Key papers, and this map’s riemannian-pullback-curvature-analysis method) rather than an input-space adversarial-query estimator: in small real MLPs trained on Boolean functions over synthetic toroidal/planar inputs, the pullback metric becomes highly localized close to class boundaries and Gaussian curvature diverges near class centers, with the effective dimension (participation ratio) of the hidden representation collapsing further in a “rich” training regime than a “lazy” one. Purely observational (only training-time hyperparameters, not the network’s fixed representation, are manipulated). See a-real-toy-mlps-hidden-layer-pullback-metric-becomes-highly-localized-near-class-boundaries-with-diverging-gaussian-curvature-and-participation-ratio-collapses-more-in-the-rich-than-lazy-training-regime.

Categorical warping in representation space, as distinct from input-space boundary volume/curvature

Cacioli (2026) measures a related but distinct phenomenon: not the input-space classifier boundary’s volume or curvature, but a categorical-perception-style metric warping of real hidden-state representation-space distances at digit-count category boundaries (e.g. crossing from single- to double-digit numbers), across five real instruction-tuned LLMs (Llama-3-8B-Instruct, Mistral-7B-Instruct-v0.3, Gemma-2-9B-IT, Qwen2.5-7B-Instruct, Phi-3.5-mini-instruct). An RSA-style distance model that adds a categorical-boundary term beats a purely continuous (Weber’s-law) null model at 100% of primary layers, and a local-precision metric spikes specifically at the boundary (1.42-2.29x baseline) with local PC1 rotating 82-90 degrees there. Causal activation patching along a ridge-regression category direction (in Llama-3-8B-Instruct) shifts model confidence 70x more than random-direction controls — a geometry-tied causal intervention, unlike the purely observational Burfitt et al. and Sun (2025) entries above. See hidden-state-distances-in-five-real-llms-warp-categorically-at-digit-count-boundaries-and-causal-patching-along-a-category-direction-shifts-confidence-70x-more-than-random.

Boundary-mask reconfiguration and junction topology under quantization

Kiseleva (2026) measures yet another distinct local property of the input-space decision boundary — neither surface volume (Burfitt et al.) nor curvature (Sun 2025; Brandon et al. 2025) — but the boundary’s own rasterized shape and multiclass-junction topology under a model-weight perturbation (quantization) rather than an adversarial attack. Laying a regular grid over prescribed 2D affine slices of input space, a boundary mask $S_\Pi(\theta)$ is defined from vertices whose predicted labels disagree, and a boundary-mask Jaccard distance $J_\Delta$ quantifies how much this mask reconfigures under post-training weight quantization, post-training weight+activation quantization, and quantization-aware training, across a small tanh MLP and small/reduced-residual CNNs (MNIST, Fashion-MNIST, CIFAR-10). Multiclass junctions — points where three or more class regions meet — are tracked separately via a node-retention radius, with parameter interpolation between adjacent quantization levels localizing exact junction-reconfiguration events, dissociating boundary-shape change from accuracy change. Purely observational. See kiseleva-2026-a-decision-boundarys-rasterized-mask-and-multiclass-junction-topology-measurably-reconfigure-under-quantization-independent-of-accuracy.

Directional decomposition of margin, as distinct from an aggregate scalar

Ortiz-Jiménez, Modas, Moosavi-Dezfooli & Frossard (2020) measure yet another distinct property of the same decision boundary — not aggregate volume (Burfitt et al.), curvature (Sun 2025; Brandon et al. 2025), categorical warping (Cacioli 2026), or rasterized-mask topology (Kiseleva 2026) — but how the margin (distance to the boundary, via a subspace-constrained DeepFool variant) decomposes across an orthogonal DCT-frequency basis of input space. Across real LeNet classifiers on MNIST, DenseNet-121 on CIFAR-10, and ResNet-50 on ImageNet, the margin is small (high sensitivity) along low-frequency, discriminative directions and large (high invariance) along high-frequency directions — a directional profile invisible to any single aggregate margin number. Causally, training on a low-pass-filtered version of the dataset reshapes which frequencies the margin profile is sensitive to, directly tying the boundary’s directional geometry to which features the network was trained to rely on. See frequency-subspace-margin- decomposition and ortiz-jimenez-etal-2020-decision-boundary-margin-is-small-along-low-frequency-discriminative-directions-and-large-along-high-frequency-directions-across-real-lenet-densenet-and-resnet50-classifiers.

Margin’s own trajectory across training, as distinct from a single-snapshot measurement

Mickisch, Assion, Greßner, Günther & Motta (2020) measure the same DeepFool-estimated margin used by Ortiz-Jiménez et al. above, but as a function of training epoch rather than at one fixed (fully-trained) state, on real LeNet classifiers trained on MNIST and Fashion-MNIST. The margin of both training and test points continues shrinking well past the point where classification error has plateaued — the boundary keeps moving closer to the data even once accuracy looks converged — and adversarial (PGD) training reverses this trend, roughly doubling MNIST margin relative to standard training. Purely observational with respect to the network’s own representation (only the training regime, standard vs. adversarial, is manipulated). See Margin evolution during training and mickisch-etal-2020-decision-boundary-margin-continues-shrinking-well-past-the-error-plateau-during-standard-training-and-adversarial-training-roughly-doubles-mnist-margin.

How to detect it

Fit or take a trained classifier; pick a region $\mathcal{U}$ of input space (whole domain, neighborhoods of training points, or neighborhoods of points located between opposite-class pairs); Monte Carlo sample points in $\mathcal{U}$ and use an adversarial-example-finding method (e.g. FGSM) as a cheap nearest-point-on-the-boundary oracle; estimate the probability that a sampled point’s boundary distance is within $\varepsilon$ , which (via the Weyl tube formula, for small $\varepsilon$ ) is proportional to the region’s local decision-boundary volume.

Key papers

Burfitt, M., Brodzki, J. & Dłotko, P. (2026). Understanding the Geometry of Deep Learning with Decision Boundary Volume. arXiv:2603.14768 — origin of the Monte-Carlo/Weyl-tube-formula decision-boundary-volume measure, and its architecture-dependent relationship to generalization.
Ortiz-Jiménez, G., Modas, A., Moosavi-Dezfooli, S.-M. & Frossard, P. (2020). Hold Me Tight! Influence of Discriminative Features on Deep Network Boundaries. NeurIPS 2020, arXiv:2002.06349 — origin of the DCT-frequency margin decomposition, and its causal link to a network’s trained-on feature content.
Mickisch, D., Assion, F., Greßner, F., Günther, W. & Motta, M. (2020). Understanding the Decision Boundary of Deep Neural Networks: An Empirical Study. arXiv:2002.01810 — origin of the margin-vs-training- epoch trajectory measurement, and adversarial training’s reversal of the shrinking-margin trend.

Found in (7 observations · 13 families)

Brandon, Chadwick & Pellegrino (2025) Boolean-Function MLPs

Emergent Riemannian Geometry over Learning Discrete Computations on Continuous Manifolds (2025)measured

Toy MLP's pullback metric localizes at class boundaries

Details

- In a toy tanh MLP trained on Boolean functions over a flat-torus embedding, the Riemannian pullback metric of the hidden layer stretches space near class boundaries and compresses it elsewhere, effectively discretizing the input. [brandon-etal-2025-emergent-riemannian-geometry-discrete-computations] - Gaussian curvature peaks and diverges near the class centres (where the embedding circles fold, cos(theta)=0), distinct from where the metric localizes. [brandon-etal-2025-emergent-riemannian-geometry-discrete-computations] - The participation ratio (effective dimensionality) collapses more in the rich regime (SMALL initial weights) than the lazy regime (LARGE initial weights); rich networks also tend to generalize better. [brandon-etal-2025-emergent-riemannian-geometry-discrete-computations] - Analytic/observational on a small toy model (mainly 4 hidden tanh units); init scale is the controlled knob (rich = small-init, lazy = large-init). [brandon-etal-2025-emergent-riemannian-geometry-discrete-computations]

models: Small tanh MLP (AND/OR/XOR on synthetic toroidal/planar input manifolds, rich vs. lazy regimes) · method: Riemannian pullback-metric curvature analysis, Participation-ratio spectral signal (per-head effective rank over training)

ResNet

Curvature Dynamic Black-box Attack: Revisiting Adversarial Robustness via Dynamic Curvature Estimation (2025)measured

Standard classifiers have higher decision-boundary curvature than robust ones

Details

- Estimating decision-boundary curvature via a dynamic-curvature trajectory (built into a black-box attack, CDBA on CGBA) shows standard non-robust classifiers consistently have higher curvature than robust ones (log-curvature WideResNet-28-10 standard -0.63 vs l2-robust -3.32; ResNet-50 standard 3.24 vs l-inf-robust 0.17). [sun-2025-curvature-dynamic-black-box-attack] - The curvature-robustness link is a qualitative/ordinal ordering only: the paper reports no correlation coefficient, p-value, or hypothesis test for curvature vs robustness (its only ANOVA, F=4.88, p=0.002, concerns the number of initial queries). [sun-2025-curvature-dynamic-black-box-attack] - Evaluated on RobustBench standard and robust variants: WideResNet-28-10 (CIFAR-10), ResNet-101 (CIFAR-10, randomized-smoothing certified) and ResNet-50 (ImageNet). [sun-2025-curvature-dynamic-black-box-attack] - Observational/comparative; no causal intervention. [sun-2025-curvature-dynamic-black-box-attack]

models: WideResNet-28-10 (CIFAR-10), ResNet-101 (CIFAR-10), ResNet-50 (supervised, ImageNet) · method: Dynamic curvature estimation (query-efficient decision-boundary curvature)

Hold Me Tight! Influence of Discriminative Features on Deep Network Boundaries (2020)measured

Decision-boundary margin is small along low-frequency discriminative directions

Details

- Measuring margins along frequency subspaces (a 2D-DCT-basis decomposition via subspace-constrained DeepFool) shows the decision boundary hugs the data closely along low-frequency discriminative directions and lies far away along high-frequency directions. [ortiz-jimenez-etal-2020-hold-me-tight] - The quantitative margins (median 2.50 along the discriminative direction vs 12.36 orthogonal, 102.0 random-orthogonal, 27.90 random) come from a synthetic overparameterized MLP on a toy dataset (T_1), not from the real classifiers. [ortiz-jimenez-etal-2020-hold-me-tight] - The low-frequency-small / high-frequency-large pattern holds for MNIST (LeNet) and ImageNet (ResNet-50), but CIFAR-10 (DenseNet-121, ResNet-18, VGG-19) is an exception with more uniformly distributed margins. [ortiz-jimenez-etal-2020-hold-me-tight] - Frequency-flip and low-pass-filter interventions swap or remove the margins accordingly, showing discriminative data features causally shape boundary geometry. [ortiz-jimenez-etal-2020-hold-me-tight]

models: ResNet-50 (supervised, ImageNet) · method: Frequency-subspace margin decomposition

Custom CNN/FC image classifiers (Burfitt, Brodzki & Dłotko 2026)

Understanding the Geometry of Deep Learning with Decision Boundary Volume (2026)measured

Boundary volume tracks generalization for CNNs but not FC nets

Details

- Decision-boundary volume is estimated via Weyl's tube formula (small-neighbourhood volume proportional to boundary volume) using Monte-Carlo sampling with FGSM as a fast distance-to-boundary oracle, in three variants (Bvol, TrainBvol, LAdvBvol). [burfitt-brodzki-dlotko-2026-decision-boundary-volume] - For CNNs, optimal test accuracy consistently coincides with a local minimum of boundary volume (smaller/smoother boundaries track better generalization). [burfitt-brodzki-dlotko-2026-decision-boundary-volume] - For fully-connected networks the volume-generalization relationship is unstable, varying with dataset and even training algorithm, so the link is architecture-dependent. [burfitt-brodzki-dlotko-2026-decision-boundary-volume] - Custom CNN and FC classifiers on MNIST, Fashion-MNIST and CIFAR-10; observational (results are graphs, no correlation statistics). [burfitt-brodzki-dlotko-2026-decision-boundary-volume]

models: Custom small CNN classifier (MNIST/Fashion-MNIST/CIFAR-10), Custom fully-connected classifier (MNIST/Fashion-MNIST/CIFAR-10) · method: Decision-boundary volume estimation (Weyl tube formula + Monte Carlo)