Cofilling-Shattering Robustness Regularizer

Integrate the regularizer at a representation bottleneck or classifier interface. Let the network produce z in R^n, define syndrome coordinates y=Az with A in R^(m x n), and let the downstream head consume y. Constrain each row of A to have bounded norm, for example by weight normalization, because otherwise the loss can be reduced by trivial rescaling. At each training step, sample q independent syndrome directions b_1,...,b_q in R^m from the current batch or from learned directions. For q<=3, enumerate every nonzero coefficient vector c in {-1,0,1}^q, form y_c=sum_i c_i b_i, and normalize y_c. Estimate the relaxed minimum perturbation by solving min_delta ||delta||_1 +(rho/2)||A delta-y_c||_2^2 using 10-30 unrolled FISTA iterations. Denote the result by lambda_A^(1)(y_c), then add softplus(tau*(s-lambda_A^(1)(y_c))) to the task loss. Add the soft support penalty sum_j(1-exp(-gamma max_c |(y_c)_j|)) if compact syndrome support is desired. On binary toy data, exhaustively enumerate all x with Hamming weight below s to evaluate lambda_A exactly. The exact mathematical condition is the minimum-preimage constraint for every nonzero subspace combination; large-model experiments use relaxed optimization and sampled subspaces. First test on MNIST or CIFAR-10 using an MLP or small ResNet with n=32-64 bottleneck features, m=16, and q=2 or 3. Compare cross-entropy alone, per-direction Jacobian regularization, and adversarial training at equal compute. Measure clean accuracy, attack success for l0 perturbations of weights 1 through s-1, the empirical minimum lambda over all sampled combinations, and active syndrome coordinates. Success means a higher worst-combination sparse-attack threshold without substantial clean-accuracy loss.