A persistent challenge in text classification (TC) is that enhancing model robustness against adversarial attacks typically degrades performance on clean data. We argue that this challenge can be resolved by modeling the distribution of clean samples in the encoder embedding manifold. To this end, we propose the Manifold-Correcting Causal Flow (MC^2F), a two-module system that operates directly on sentence embeddings. A Stratified Riemannian Continuous Normalizing Flow (SR-CNF) learns the density of the clean data manifold. It identifies out-of-distribution embeddings, which are then corrected by a Geodesic Purification Solver. This solver projects adversarial points back onto the learned manifold via the shortest path, restoring a clean, semantically coherent representation. We conducted extensive evaluations on text classification (TC) across three datasets and multiple adversarial attacks. The results demonstrate that our method, MC^2F, not only establishes a new state-of-the-art in adversarial robustness but also fully preserves performance on clean data, even yielding modest gains in accuracy.

翻译：文本分类领域长期存在一个挑战：提升模型对抗攻击的鲁棒性通常会降低其在干净数据上的性能。我们认为，通过在编码器嵌入流形中对干净样本的分布进行建模，可以解决这一挑战。为此，我们提出了流形校正因果流（MC^2F），这是一个直接在句子嵌入上运行的双模块系统。其中，分层黎曼连续归一化流（SR-CNF）学习干净数据流形的密度，并识别出分布外的嵌入。随后，一个测地线净化求解器将这些对抗点通过最短路径投影回学习到的流形上，从而恢复一个干净且语义连贯的表示。我们在三个数据集上针对多种对抗攻击进行了广泛的文本分类评估。结果表明，我们的方法MC^2F不仅在对抗鲁棒性上达到了新的最先进水平，而且完全保留了在干净数据上的性能，甚至在准确率上带来了小幅提升。