Pith. sign in

REVIEW 9 cited by

Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2010.03593 v3 pith:SBEEHKI5 submitted 2020-10-07 stat.ML cs.AIcs.LG

Sven Gowal , Chongli Qin , Jonathan Uesato , Timothy Mann , Pushmeet Kohli This is my paper · ORCID
classification stat.MLcs.AIcs.LG
keywords adversarialperturbationssizetrainingaccuracyadditionalattackcifar-10
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
abstract

Adversarial training and its variants have become de facto standards for learning robust deep neural networks. In this paper, we explore the landscape around adversarial training in a bid to uncover its limits. We systematically study the effect of different training losses, model sizes, activation functions, the addition of unlabeled data (through pseudo-labeling) and other factors on adversarial robustness. We discover that it is possible to train robust models that go well beyond state-of-the-art results by combining larger models, Swish/SiLU activations and model weight averaging. We demonstrate large improvements on CIFAR-10 and CIFAR-100 against $\ell_\infty$ and $\ell_2$ norm-bounded perturbations of size $8/255$ and $128/255$, respectively. In the setting with additional unlabeled data, we obtain an accuracy under attack of 65.88% against $\ell_\infty$ perturbations of size $8/255$ on CIFAR-10 (+6.35% with respect to prior art). Without additional data, we obtain an accuracy under attack of 57.20% (+3.46%). To test the generality of our findings and without any additional modifications, we obtain an accuracy under attack of 80.53% (+7.62%) against $\ell_2$ perturbations of size $128/255$ on CIFAR-10, and of 36.88% (+8.46%) against $\ell_\infty$ perturbations of size $8/255$ on CIFAR-100. All models are available at https://github.com/deepmind/deepmind-research/tree/master/adversarial_robustness.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 9 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. OpenAlex reports about 144 citations worldwide. Full citation record

  1. Adversarial Robustness in One-Stage Learning-to-Defer

    stat.ML 2025-10 unverdicted novelty 7.0 of 10

    New adversarial surrogate losses and claimed consistency guarantees for one-stage learning-to-defer in classification and regression, with experiments suggesting improved robustness.

  2. Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillation

    cs.CV 2025-06 conditional novelty 6.0 of 10

    A label-based adversarial robustness distillation method, ABSLD, re-temperates teacher soft labels per class to shrink the student's class-wise robust error gap and improves worst-class robustness and normalized stand...

  3. Exploring Visual Prompting: Robustness Inheritance and Beyond

    cs.CV 2025-06 conditional novelty 6.0 of 10

    Visual prompts built on robust source models inherit adversarial robustness but lose standard accuracy; a max-pooling over logit blocks (PBL) improves accuracy while keeping most robustness.

  4. Monitoring Robustness and Individual Fairness

    cs.AI 2025-05 conditional novelty 6.0 of 10

    Runtime monitoring of input-output robustness, covering adversarial robustness, semantic robustness, and individual fairness, is implemented as online fixed-radius nearest-neighbor search in the tool Clemont.

  5. Adversarial Robustness in Two-Stage Learning-to-Defer: Algorithms and Guarantees

    stat.ML 2025-02 reject novelty 6.0 of 10

    Adversarial attacks on Learning-to-Defer routers are formalized, and a convex robust surrogate loss, SARD, is proposed with empirical robustness gains and incomplete consistency guarantees.

  6. Wasserstein distributional adversarial training for deep neural networks

    cs.LG 2025-02 conditional novelty 5.0 of 10

    Extends TRADES to a Wasserstein distributional threat with an efficient budgeted attack, and fine-tunes pre-trained robust models to improve a self-defined distributional robustness metric.

  7. Theoretical Analysis of Relative Errors in Gradient Computations for Adversarial Attacks with CE Loss

    cs.LG 2025-07 conditional novelty 4.0 of 10

    T-MIFPE adaptively rescales logits with a theoretically motivated t* per attack phase to reduce floating-point gradient errors, edging out MIFPE in PGD robustness evaluation.

  8. Improving Adversarial Robustness Through Adaptive Learning-Driven Multi-Teacher Knowledge Distillation

    cs.CV 2025-07 conditional novelty 4.0 of 10

    A multi-teacher adversarial robustness distillation method (MTKD-AR) trains a clean-data student using cosine-similarity-weighted logits from adversarially trained teachers, reporting improved robustness on MNIST and ...

  9. RCR-AF: Enhancing Model Generalization via Rademacher Complexity Reduction Activation Function

    cs.LG 2025-07 reject novelty 2.0 of 10

    RCR-AF, a clipped scaled-softplus activation, is claimed to improve CIFAR-10 accuracy and robustness, but the evidence is undermined by test-set tuning and a flawed complexity derivation.

Pith tools