REVIEW 5 major objections 7 minor 17 references
Adapting to Evolving Adversaries with Regularized Continual Robust Training
T0 review · 5 major / 7 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read Penalizing adversarial logit displacement lets a model keep old defenses while adapting to new attack types.
desk verdict A useful regularizer and a clean ablation, but the headline Union-accuracy gain rests on single-seed runs and a possibly biased epoch selection. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the adversarial logit-distance bound of Theorem 3.1: for a loss that is $M_1$-Lipschitz in the logits and bounded by $M_2$, the difference in adversarial loss between two attacks is bounded, with high probability, by $M_1$ times the average over samples of the sum of the two attacks' maximal logit displacements, plus a statistical term $D$. The proposed regularizer ALR, defined as the average over samples of the maximum $\ell^2$ distance between a sample's logits and its adversarially perturbed logits, directly targets the quantities appearing in that bound. It is applied both in initial training (against the initially known attack) and during fine-tuning (against the attack selected by the fine-tuning strategy), which the paper argues should lower both the known-vs-unforeseen loss gap and the union-vs-clean loss gap.
What would settle it
Compute, for a fixed model and across many attack pairs, the average maximum logit distance and the 0-1 accuracy gap; if the accuracy gap can change substantially while the logit distance stays flat (or vice versa), the bound does not explain the reported robustness transfer, and ALR's benefit would need another mechanism.
Extended reading notes
Core claim
The central claim is that the gap in a model's robust loss between any two attacks is bounded by the sum of the maximal $\ell^2$ distances that each attack induces between clean and adversarial logits (Theorem 3.1), so directly minimizing those logit distances during both initial adversarial training and subsequent fine-tuning should narrow the robustness gap across attacks. The paper introduces adversarial $\ell^2$ regularization (ALR), which penalizes the per-sample worst-case logit distance within each attack's constraint set, and shows empirically that it improves robustness on known, previously seen, and held-out unforeseen attacks, reduces catastrophic forgetting of earlier attacks after fine-tuning, and does so with modest computational overhead. Regularized CRT on CIFAR-10 achieves a 5.48% gain in Union accuracy over unregularized CRT, and in some settings outperforms training from scratch on all attacks at a fraction of the cost.
Load-bearing premise
The load-bearing premise is that the logit-distance bound, proved for Lipschitz and bounded losses, also governs the 0-1 accuracy that the paper reports; but 0-1 accuracy is not Lipschitz in logits (and the surrogate cross-entropy used in training is unbounded), so the theorem does not formally connect the regularizer to the measured gains.
Editorial extensions
If this is right
- ALR in initial training raises robustness to unforeseen attacks, giving fine-tuning a better starting point; the paper shows all four regularization variants (ALR, VR, uniform, Gaussian) improve union accuracy at this stage.
- ALR during fine-tuning shrinks the drop in accuracy on previous attacks: on CIFAR-10, fine-tuning only on StAdv with ALR drops $\ell^2$ accuracy by 7.62% instead of 24.25% without it.
- Regularized CRT improves Union accuracy on known attacks by up to 7.85% compared to unregularized fine-tuning across 144 initial/new attack pairs on ImageNette.
- On CIFAR-10, regularized CRT beats training from scratch on all four attacks (4.35% higher average accuracy) while using roughly half the training time (26.86 vs over 50 hours).
- Random noise-based regularization helps in initial training but hurts during fine-tuning, so the adversarial (worst-case) form of the regularizer is the one that preserves prior robustness.
Reading between the lines
- If the logit-distance bound is the operative mechanism, then the first attack chosen for initial training determines a geometry of logit sensitivity that constrains how easily later attacks can be absorbed; choosing an initial attack that most broadly compresses logit displacements could matter more than the specific fine-tuning schedule.
- The success of ALR during fine-tuning but failure of noise regularization suggests the worst-case maximization over the attack's constraint set is what preserves old defenses; a testable consequence is that single-step ALR should degrade gracefully compared to multi-step ALR as attack strength grows.
- The bound is stated for logits, but the same reasoning applies to internal representations (the paper experiments with feature-space ALR in the appendix); one could extend the approach to regularize intermediate layers, trading clean accuracy differently.
- Because CAR assumes the defender knows when a new attack has appeared, deployment would require an attack-monitoring component; ALR's benefit would then be measured end-to-end including the delay between an attack's emergence and its detection.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper studies continual robust training (CRT), in which a model is first adversarially trained against an initial attack and then fine-tuned as new attack types are discovered, with the goal of retaining robustness on previously seen attacks while adapting to new ones. The proposed method, adversarial L2 regularization (ALR), penalizes the L2 distance between clean and adversarially perturbed logits during both initial training and fine-tuning. The authors prove a bound (Theorem 3.1) on the gap between two adversarial losses in terms of logit-space distances, adapt it to internal representations (Corollary C.1), and evaluate the method on CIFAR-10, CIFAR-100, and ImageNette across sequences of Lp, StAdv, ReColor, and ImageNet-UA attacks. The headline claims are a 5.48% improvement in Union accuracy over unregularized CRT on CIFAR-10 (Table 1, time step 3) and reduced degradation on previously seen attacks, together with an extensive ablation study separating the effects of regularization in initial training and in fine-tuning.
Significance. If the empirical claims hold, this is a genuine practical contribution to an under-studied problem: sequential adaptation to newly discovered attack types. The paper's strengths are the clean two-stage experimental design, the fine-tuning ablation over 144 initial-attack/new-attack pairs (Figure 3), the consistency of the main trends across CIFAR-10 and ImageNette, the open-source code, the clear formal relationship drawn between ALR and variation regularization (RALR <= RVR <= 2RALR, Appendix D), and an honest limitations section that concedes the method is not universally better. The theoretical result is correctly proved as a statement about adversarial losses, and the representation-space corollary broadens its scope. However, the theory does not formally cover the reported accuracy metric, the headline quantitative claims rest on single runs without error bars, and the abstract's scope is broader than the evidence in the paper's own appendix, so the strength of the central claim is not yet at the level the paper presents.
major comments (5)
- [§4.2, Table 1] The headline gain of 5.48% in Union(all) accuracy (Table 1, time step 3: FT Croce + ALR 34.92 vs FT Croce 29.44) conflates two simultaneous changes: the ALR runs start from the time-step-0 model AT + ALR (lambda = 1), while the baseline runs start from AT, and the ALR runs also use ALR during fine-tuning. This comparison therefore does not isolate the effect of the proposed fine-tuning regularizer. The paper does isolate the two effects elsewhere (Table 3 for initial-training regularization and Figure 3 for fine-tuning regularization), and I credit those ablations, but the abstract and Section 4.2 present the 5.48% figure as the method's gain without decomposition. The paper should either report the unregularized fine-tune starting from the AT + ALR initial model or explicitly decompose the headline number into the initial-training and fine-tuning contributions.
- [§4.1–§4.4] All reported results appear to come from a single training run per configuration: no seeds, standard deviations, or significance tests are reported in the main text or appendices. The quantitative claims (5.48% in Table 1, 7.7% and 6.72% in Section 4.2, up to 7.85% and 8.66% in Section 4.4) are therefore point estimates of unknown reliability. The direction of the effect is supported by the consistency of Figure 3 and Table 3, but the magnitudes cannot be assessed, and the 'up to' claims in Section 4.4 are selections over 144 grid cells, where single-run noise is amplified by the selection itself. I would ask for at least 2–3 seeds for the main Table 1 comparisons and for the headline magnitudes, or a clear statement that the magnitudes are single-run estimates.
- [§3.2, Theorem 3.1, footnote 3] Theorem 3.1 bounds the gap between two adversarial losses for a loss that is M1-Lipschitz in logits and bounded by M2, and footnote 3 concedes that the cross-entropy used in training is not bounded. The reported evaluation metric, however, is 0-1 accuracy, which is neither Lipschitz in logits nor bounded in the sense needed for the Hoeffding step. The formal content of the theorem is therefore about loss gaps, and the statements in Section 4.2 that results 'align with Theorem 3.1' are heuristic. Moreover, because ALR directly minimizes the right-hand side of the bound, the theory is motivational rather than an independent prediction of the method's success; the empirical evaluation is the actual test. I would suggest stating this division of labor explicitly and avoiding the implication that the theorem formally explains the observed accuracy gains.
- [§4.1, Appendix F (Model selection)] The paper reports metrics at the epoch E* with best performance on the set of known attacks but never specifies whether E* is chosen on a held-out validation split or on the test set used for the reported numbers. If E* is selected on the test set, all reported accuracies are optimistically biased, and methods with higher epoch-level variance benefit differentially from the selection, so the between-method comparisons in Table 1 would not be out-of-sample tests. Appendix F describes the selection criterion but not the data split. The protocol should be clarified; if test-set selection was used, the comparisons should be re-run with a validation split or the implications explicitly acknowledged.
- [Abstract; Appendix G, Tables 8–9] The abstract's claim that experiments on 3 datasets 'demonstrate that the proposed regularization improves robust accuracy' is contradicted by the paper's own appendix. On CIFAR-100 the text states that 'ALR generally does not improve performance over fine-tuning,' and in Table 8 at time step 3, FT Croce + ALR has lower Union(all) accuracy than FT Croce (8.11 vs 10.57) and a much larger drop in StAdv robustness (10.89 vs 19.78). The main-text statement in Section 4.2 that trends are 'generally consistent' sits uneasily with this appendix result. The claim should be scoped to the datasets and attack sequences where the evidence supports it, or the paper should analyze why CIFAR-100 behaves differently.
minor comments (7)
- [§4.2, §4.4] There are typographical errors in the main text: 'within just the the fine-tuning phase' (§4.4) and 'However, but the extent to which' (§4.2) should be corrected.
- [Figure 2 caption] The caption lists the model sequence as 'h0, ht1+Δt, ht3+Δt, ht3+Δt'; the third element should be ht2+Δt.
- [Table 2 caption] The caption attributes the fine-tuning strategy to Croce & Hein (2020b), but the cited fine-tuning method is introduced in Croce & Hein (2022); the reference should be corrected.
- [Abstract] The 5.48% gain is described as being 'across ℓ2, StAdv, and Recolor attacks,' but the sequence in Table 1 includes ℓ∞ as the third attack; the metric definition (the set of attacks over which Union is computed) should be stated precisely.
- [Table 1; §4.2] Initial training uses λ = 1 for ALR while fine-tuning uses λ = 0.5, an asymmetry that is not discussed or justified in the main text; a sentence explaining the choice would clarify the hyperparameter sensitivity of the method.
- [Appendix H; Figures 5–8] Several appendix captions and table headers contain typos: 'Intial Training Ablations' (Tables 10–17) and 'initally trained' (Figures 5–8 captions).
- [§5, Limitations] The acronym 'RCRT' is introduced for the first time in the Limitations paragraph without definition; the paper otherwise uses 'CRT + ALR,' so the terminology should be unified.
Circularity Check
No significant circularity: Theorem 3.1 is an independently derived bound, ALR is deliberately designed to target that bound, and the headline 5.48% accuracy gain is an out-of-sample empirical comparison rather than an algebraic consequence of the regularizer.
full rationale
I found no circular step that reduces the paper's central claim to its own inputs. Theorem 3.1 is a genuine upper bound on the adversarial-loss gap, proved in Appendix C and explicitly adapted from the external result of Nern et al. (2023). The proof is self-contained given its Lipschitz and boundedness assumptions. Section 3.3 then defines R_ALR to match the logit-distance term appearing in that bound; choosing a regularizer that minimizes a bound is standard method design, and the paper only claims the theorem 'suggests' the regularizer, not that the theorem by itself proves the empirical accuracy gains. The headline improvement (Table 1: FT Croce + ALR Union-all 34.92 vs. FT Croce 29.44 at time step 3, i.e., 5.48%) is an out-of-sample experimental comparison on held-out attack combinations, and no constants are fitted to those test results. Self-citations are not load-bearing in the derivation: Dai et al. (2024b) supplies the CAR problem definition, and Dai et al. (2022) is cited for the VR baseline and a related bound; no uniqueness theorem or ansatz is imported from the authors' prior work. The acknowledged equivalence R_ALR ≤ R_VR ≤ 2 R_ALR (Appendix D) is a novelty/positioning issue, not circularity. The paper even states limitations, e.g., that the approach 'does not outperform existing baselines in all settings.' The main legitimate concerns are statistical (single-seed runs, test-set-based epoch selection) and a theory-practice gap (the reported 0-1 accuracy is not covered by the M1-Lipschitz assumption on the loss); these are correctness risks, not circularity.
Assumptions & free parameters
free parameters (4)
- ALR regularization strength lambda =
0.5 in main CRT, 1.0 for initial AT in Table 1
- Uniform noise scale sigma (UR) =
2
- Gaussian noise scale sigma (GR) =
0.2
- Noise regularization strength lambda (UR/GR) =
1 or 5 depending on ablation
assumptions (4)
- domain assumption Loss ell is M1-Lipschitz in logits and bounded by M2
- standard math Training data points are drawn i.i.d. from distribution D
- domain assumption Each attack is the maximizer of the loss within an adversarial constraint C
- domain assumption The defender's knowledge set K(t) grows monotonically and new attacks can be detected
Cite this review
Pith. "Pith review of Adapting to Evolving Adversaries with Regularized Continual Robust Training." pith.science (2026). https://pith.science/paper/L2VVN3NE
@misc{pith2026250204248,
author = {Pith},
title = {Pith review of: Adapting to Evolving Adversaries with Regularized Continual Robust Training},
year = {2026},
howpublished = {\url{https://pith.science/paper/L2VVN3NE}},
note = {Machine review of arXiv:2502.04248}
}
read the original abstract
Robust training methods typically defend against specific attack types, such as Lp attacks with fixed budgets, and rarely account for the fact that defenders may encounter new attacks over time. A natural solution is to adapt the defended model to new adversaries as they arise via fine-tuning, a method which we call continual robust training (CRT). However, when implemented naively, fine-tuning on new attacks degrades robustness on previous attacks. This raises the question: how can we improve the initial training and fine-tuning of the model to simultaneously achieve robustness against previous and new attacks? We present theoretical results which show that the gap in a model's robustness against different attacks is bounded by how far each attack perturbs a sample in the model's logit space, suggesting that regularizing with respect to this logit space distance can help maintain robustness against previous attacks. Extensive experiments on 3 datasets (CIFAR-10, CIFAR-100, and ImageNette) and over 100 attack combinations demonstrate that the proposed regularization improves robust accuracy with little overhead in training time. Our findings and open-source code lay the groundwork for the deployment of models robust to evolving attacks.
Figures
Figures from the paper (9 more)
Reference graph
Works this paper leans on
-
[1]
Additional related work (Appendix A)
-
[2]
Future directions (Appendix B)
-
[4]
Connection to variation regularization (Appendix D)
-
[5]
USENIX Association. ISBN 978-1-939133-37-3. URL https://www.usenix.org/conference/ usenixsecurity23/presentation/song. 10 Adapting to Evolving Adversaries with Regularized Continual Robust Training Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I. J., and Fergus, R. Intriguing prop- erties of neural networks. In Bengio, Y . and...
arXiv 2014
-
[6]
Additional experimental setup details (training and attack parameters, model selection, regularization setup) (Ap- pendix F)
-
[7]
Additional experiments • Longer attack sequences and different datasets (CIFAR-100 and ImageNette) (Appendix G) • Ablations on initial training (attack choice, regularization parameters) (Appendix H) • Ablations on fine-tuning (attack choice, regularization parameters) ((Appendix I)) A. Additional Related Work Adversarial Attacks and Defenses: ML models a...
work page 2014
-
[9]
doi: 10.1109/CVPR.2018.00068. URL http: //openaccess.thecvf.com/content_cvpr_ 2018/html/Zhang_The_Unreasonable_ Effectiveness_CVPR_2018_paper.html. 11 Adapting to Evolving Adversaries with Regularized Continual Robust Training This appendix is organized as follows:
-
[13]
Experimental verification of theoretical results (Appendix E)
Show all 17 references
-
[33]
Howard, J
URL https://www.sciencedirect.com/ science/article/pii/S0167865521001288. Howard, J. Imagewang. URL https://github.com/ fastai/imagenette/. 9 Adapting to Evolving Adversaries with Regularized Continual Robust Training Jin, C. and Rinard, M. Manifold regularization for lo- call...
2003 arXiv
-
[2016]
Zhang, H., Yu, Y ., Jiao, J., Xing, E
URL http://www.bmva.org/bmvc/2016/ papers/paper087/index.html. Zhang, H., Yu, Y ., Jiao, J., Xing, E. P., Ghaoui, L. E., and Jordan, M. I. Theoretically principled trade-off be- tween robustness and accuracy. In Chaudhuri, K. and Salakhutdinov, R. (eds.), Proceedings of the 36...
2016
-
[2018]
Ye, Y ., Le, T., and Lee, D
URL https://openreview.net/forum? id=HyydRMZC-. Ye, Y ., Le, T., and Lee, D. Noisyhate: Benchmark- ing content moderation machine learning models with human-written perturbations online. arXiv preprint arXiv:2303.10430, 2023. Zagoruyko, S. and Komodakis, N. Wide residual netwo...
2023 arXiv
-
[2019]
Croce, F
URL http://proceedings.mlr.press/ v97/cohen19c.html. Croce, F. and Hein, M. Provable robustness against all ad- versarial $l p$-perturbations for $p\geq 1$. In 8th Inter- national Conference on Learning Representations, ICLR 2020, Addis Ababa, Ethiopia, April 26-30, 2020. Open...
2020 arXiv
-
[2020]
as well as attacks based on distances that are more aligned with human perception such as SSIM (Gragnaniello et al.,
-
[2021]
+ ALR feature
and LPIPS distances (Laidlaw et al., 2021; Ghazanfari et al., 2023). Despite the wide variety of attacks that have been introduced, defenses against adversarial examples focus mainly on ℓ∞ or ℓ2-norm bounded perturbations (Cohen et al., 2019; Zhang et al., 2020; Madry et al., ...
2020
-
[2023]
Dai, S., Ding, W., Bhagoji, A
URL https://proceedings.mlr.press/ v202/dai23c.html. Dai, S., Ding, W., Bhagoji, A. N., Cullina, D., Zheng, H., Zhao, B., and Mittal, P. Characterizing the optimal 0 − 1 loss for multi-class classification with a test-time attacker. Advances in Neural Information Processing Sy...
2009 arXiv
-
[7482]
URL http://proceedings
PMLR, 2019. URL http://proceedings. mlr.press/v97/zhang19p.html. Zhang, H., Chen, H., Xiao, C., Gowal, S., Stanforth, R., Li, B., Boning, D. S., and Hsieh, C. Towards stable and efficient training of verifiably robust neural net- works. In 8th International Conference on Learn...
2019
-
[8655]
doi: https://doi.org/10.1016/j.patrec.2021.03
2021 doi
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.