Pith. sign in

REVIEW 4 major objections 5 minor 80 references

TRIX- Trading Adversarial Fairness via Mixed Adversarial Training

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read TRIX claims that a class-aware mix of targeted and untargeted adversarial training, steered by softmax-based feature similarity, improves worst-case class accuracy and reduces inter-class robustness disparity without sacrificing overall…

desk verdict Consistent worst-class gains and a genuinely mixed adversarial policy, but the targeted KL divergence is reversed between Eq. (4) and Eq. (9), and baseline tuning is favorable. read the letter →

arxiv 2507.07768 v1 pith:XALGMG4W submitted 2025-07-10 cs.LG cs.CV

Tejaswini Medi , Steffen Jung , Margret Keuper This is my paper · ORCID
classification cs.LGcs.CV
keywords adversarialtrainingclass-wiserobustnessfairnesstargetedattacksuntargetedworst-classaccuracyfeaturesimilarityTRADES
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial training normally applies the same attack recipe to every class, but classes are not equally hard to attack: classes with overlapping or fragile features stay disproportionately vulnerable. TRIX (TRades-based mIXed adversarial training) claims this disparity should be handled by choosing the type of adversary per class, sending weaker targeted adversaries toward uniformly sampled wrong labels for strong classes and stronger untargeted adversaries for weak classes, with per-class loss weights and perturbation scaling derived from the model's clean-sample confidence. The paper reports that this mixed objective improves worst-case class accuracy on both clean and adversarial samples across CIFAR-10, CIFAR-100, STL-10, and Tiny-ImageNet, while keeping average accuracy close to the TRADES baseline. If those results hold, adversarial defenses can be fairer across classes without the usual sacrifice in overall robustness.

What carries the argument

The load-bearing mechanism is the mixed TRADES objective with a class-conditional policy. Adaptive class weights $w_c$ are computed from the class similarity matrix $S$, whose rows are the average softmax predictions $\bar p_c$ on clean samples; Eq. (7) upweights classes with low self-confidence and high inter-class overlap. Each sample is then assigned either a targeted adversarial KL term toward a uniformly sampled wrong label or an untargeted adversarial KL term, depending on whether its class weight is below or above the batch average, and the same weights scale the cross-entropy loss and perturbation radius in Eq. (10). This couples the choice of adversary type and strength to a learned estimate of class difficulty.

What would settle it

A direct test: at the warm-up epoch, record TRIX's per-class weights and correlate them with end-of-training class-wise robust accuracies; if they do not select the classes that end up weakest, the mechanism is not doing the claimed work. A second decisive check is to replace the softmax proxy with ground-truth class difficulty; if worst-class gains vanish, the mixed objective alone is not the cause.

Watch

Extended reading notes

Core claim

The central claim is that the type of adversary used during adversarial training should be a per-class decision, not a global constant. The authors build a class weight from the matrix of average predicted distributions on clean samples, upweighting classes with low self-confidence and high overlap with others, and use that weight to split training: weak classes receive untargeted adversarial perturbations with larger strength and higher loss weight, while strong classes receive targeted perturbations toward uniformly sampled wrong labels. In their experiments this policy raises worst-class robust accuracy under PGD and AutoAttack on several benchmarks and improves the reported fairness metric $\varrho$ relative to TRADES and fairness-oriented baselines, while maintaining average accuracy. The explanation offered is asymmetric suppression of non-robust features: strong classes shed non-robust features early in training, whereas weak classes need broader untargeted pressure to separate from their confusing neighbors.

Load-bearing premise

The policy assumes that a class's average softmax confidence on clean samples marks it as weak or strong, so early-training noise, mislabeled examples, or poor calibration could push stronger untargeted attacks to classes that do not actually need them.

Editorial extensions

If this is right

  • On CIFAR-10, TRIX lifts worst-class robust accuracy under AutoAttack from 23.11% with TRADES to 32.65%, while average robust accuracy stays essentially unchanged at 49.09% versus 49.74%.
  • On CIFAR-100 and STL-10 the same pattern holds: worst robust accuracy rises to 2.89% and 10.97% respectively, and the fairness score $\varrho_{\text{robust}}$ reaches 0.92 and 0.44, indicating the worst-class gain is not bought by average accuracy.
  • The ablations show each component contributes: turning off loss and perturbation weighting or using uniform weights lowers worst robust accuracy, and full TRIX reaches 38.9% worst robust accuracy under PGD on CIFAR-10, above the closest fairness baseline DAFA at 36.5%.
  • The improvement transfers to other architectures, including PreActResNet-18 and WideResNet-28-10, and to Tiny-ImageNet, where TRIX raises the minimum 20% worst-class robust accuracy from 1.19% to 2.96% on ResNet-18.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Recomputing class weights from adversarial predictions throughout training, rather than only at the warm-up epoch, could track shifts in class difficulty and is a natural variant the paper does not test.
  • Because targeted targets are drawn uniformly, a confusion-guided target selection for strong classes could push the same idea further; the paper's one-vs-one versus one-vs-all justification suggests targeted losses only need to refine a few close neighbors, so choosing those neighbors explicitly should concentrate capacity.
  • The softmax-similarity proxy is architecture- and data-dependent, so a portable version would need a calibration or normalization step before the method is applied to datasets with very different class priors or label noise.
  • A stress test for the fairness claim would evaluate TRIX under distribution shift, since weights are estimated on clean training samples and a shifted evaluation set could have a different set of genuinely weak classes.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes TRIX, an adversarial training method built on TRADES that adaptively assigns targeted adversarial perturbations to strong classes and untargeted perturbations to weak classes, based on class weights derived from average softmax predictions. It combines this selection with per-class loss weighting and perturbation-radius scaling, and evaluates the method on CIFAR-10, CIFAR-100, STL-10, and Tiny-ImageNet across ResNet-18, PreActResNet-18, and WideResNet-28-10. The central empirical claim is that TRIX improves worst-class clean and robust accuracy and reduces inter-class robustness disparities while preserving average accuracy.

Significance. If the empirical claims hold, TRIX is a useful contribution to the adversarial-fairness literature: it demonstrates that a class-dependent mix of targeted and untargeted TRADES objectives can improve worst-class robustness, and the evaluation across datasets, architectures, and AutoAttack/PGD is broad. The method is simple enough for others to build on, and the ablations in Tables 2 and 6 give some evidence that the components matter. The paper also provides code and reports multiple seeds. However, the significance is currently limited by an ambiguity in whether Eq. (9) implements the stated objective, the absence of significance testing for the claimed improvements, and an under-specified class-weight rule that drives the method's core policy; these issues must be resolved before the central claims can be assessed.

major comments (4)
  1. [§5, Eq. (9); §2, Eq. (4)] The targeted branch in Eq. (9) is written as KL(fθ(x_adv_ti) || fθ(xi)), whereas the objective introduced in Eq. (4) is KL(fθ(xi) || fθ(x_adv_t)). Since KL divergence is not symmetric, these are different losses: Eq. (4) penalizes changes from the clean prediction to the targeted-adversarial prediction, while Eq. (9) penalizes the reverse direction. Because the targeted-versus-untargeted assignment is the paper's central novelty, the authors must state which direction was actually optimized in the experiments, correct Eq. (9) if it is a typographical error, and confirm that the released code implements the corrected objective.
  2. [§6, Tables 1–4; Appendix A.2] The abstract and Section 6 claim that TRIX 'significantly improves' worst-class accuracy, but no significance tests are reported and several key comparisons are within one standard deviation. For example, Table 1b reports CIFAR-100 robust worst-class accuracy of 2.89 ± 0.46 for TRIX versus 2.41 ± 0.45 for DAFA, and Table 1a reports CIFAR-10 average robust accuracy of 49.09 ± 0.24 for TRIX versus 49.74 ± 0.20 for TRADES. Appendix A.2 also states that for non-CIFAR-10 datasets baseline hyperparameters were selected as 'the best obtained,' which leaves the comparison protocol underspecified. The authors should report paired significance tests or confidence intervals over the five seeds and clarify how baseline hyperparameters were selected.
  3. [§5, Eq. (7)] The class-weight rule in Eq. (7) is under-specified. As written, wc = 1 + λ Σ_{j≠c}(Sc,j·Sj,j if Sc,c < Sj,j else −Sj,c·Sc,c) mixes row and column entries of the matrix S, can produce negative updates, and does not correspond to a 'feature similarity distance' as claimed; Eq. (5) defines S from average softmax probabilities, not from feature representations. Since Eq. (8) uses only w to choose targeted versus untargeted training, this ambiguity prevents readers from re-implementing the method and leaves unaddressed the risk that early-training miscalibration of w sends untargeted budget to strong classes. Please provide a precise definition, a worked example, and a sensitivity analysis of the policy with respect to w.
  4. [Algorithm 1 and §6] The training protocol is internally inconsistent. Section 6 says loss weighting and perturbation scaling are applied after a warm-up phase of τ = 70 epochs, but Algorithm 1 labels epochs 1 through τ as the 'Main TRIX Training Phase' and epochs τ+1 through T as the 'Warm-up Phase (TRADES)'; the appendix text then states that the weights used at τ are computed from adversarial examples, while Eq. (5) defines them on clean samples. Please clarify which loss is used in each phase and on which predictions the class weights are computed.
minor comments (5)
  1. [Figures 4 and 5] Figure 4 in the main text and Figure 5 in the appendix appear to be the same figure with the same caption; one should be removed or replaced with a distinct analysis.
  2. [Throughout] There are several typographical errors: 'acheieves' in Section 6, and 'momentunm' and 'SDG' in Appendix A.2; additionally, Algorithm 1 uses LTRADES without defining the weighted form used with class weights.
  3. [§5, Eq. (9)] Eq. (9) states that fθ denotes the model's predicted logits, but KL divergence is defined between probability distributions; the paper should specify that softmax probabilities are used and keep notation consistent with Eq. (4).
  4. [References] Reference [27] appears to cite a different DAFA paper with a different author list and venue from the DAFA method cited as [35] and actually used in the experiments; please correct the citation.
  5. [Appendix A.5] Theorem 1 is presented as a theorem but its proof assumes linear classifiers and equidistant class centers; it should be labeled as an informal motivation rather than a theorem about deep networks, since the paper's empirical claims do not depend on it.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: TRIX's class-weight policy and mixed adversarial loss are self-contained design choices, and the empirical claims are tested against external AutoAttack/PGD benchmarks.

full rationale

I walked the derivation chain from Eq. (5) through Eq. (10). The adaptive class weights w_c are hand-specified functions of the model's average softmax predictions on clean samples; Eq. (8) then thresholds these weights to choose targeted versus untargeted adversaries, and Eq. (10) combines the reweighted CE loss with a mixed KL adversarial loss. None of these equations uses the paper's evaluation quantities (worst-class clean/robust accuracy, average accuracy, or the ρ fairness metric) as a fitted input. The policy therefore does not reduce to the claim by construction: it is a heuristic design that is subsequently measured against TRADES, DAFA, FAIR-TAT, and other baselines under AutoAttack and PGD. The self-citations in the manuscript (e.g., FAIR-TAT [29] and the authors' class-wise robustness analysis [28]) appear as prior context or as comparison methods; no central premise is justified solely by those citations, and no uniqueness theorem is borrowed. The informal Theorem 1 in Appendix A.5 is a motivational OvA/OvO analogy, not a formal derivation of the empirical result, so it cannot be circular; its rigor is a separate correctness question. The Limitations paragraph in Section 7 explicitly concedes that TRIX does not significantly enhance overall robustness and relies on feature-similarity estimates, which is an acknowledged limitation rather than a circular justification. I also note, without treating it as circularity, that Eq. (9) writes the targeted KL term as KL(f_θ(x^{adv}_{ti}) || f_θ(x_i)) whereas Eq. (4) defines the targeted branch as KL(f_θ(x) || f_θ(x^{adv}_t)); because KL is asymmetric, this is an internal consistency/reproducibility issue that should be checked against the released code, but it does not make the derivation circular. Overall, the paper's central claim is supported by external empirical evaluation, not by construction or by self-citation.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

TRIX relies on several domain assumptions and hyperparameters, but introduces no new physical or formal entities. The main cost is per-dataset tuning of lambda and warm-up, plus the empirical assumption that softmax similarity identifies weak classes.

free parameters (3)
  • lambda (weight adjustment strength) = 1.0 (CIFAR-10), 1.5 (CIFAR-100, STL-10)
    Selected per dataset and validated on these benchmarks; controls the strength of class reweighting and hence the fairness-robustness trade-off.
  • beta (TRADES trade-off coefficient) = 6
    Set following prior work, not tuned in this paper; balances clean accuracy and adversarial robustness.
  • warm-up threshold tau = 70 epochs
    Adopted from DAFA; before this threshold, loss weighting and perturbation scaling are not applied, which affects the final accuracy values.
assumptions (3)
  • domain assumption Class vulnerability can be inferred from average predicted probability similarity over clean samples (Eq. 5-7).
    The entire targeted/untargeted assignment and loss weighting rest on this proxy; no external validation shows it reliably identifies true class separability.
  • domain assumption Untargeted KL adversaries are stronger than targeted CE adversaries for weak classes, while targeted training helps strong classes.
    This is empirically observed in Figures 1 and 4 and assumed to generalize across datasets and architectures.
  • ad hoc to paper The OvO/OvA linear classifier analogy (Appendix A.5, Theorem 1) captures relevant behavior of deep networks under adversarial training.
    Informal theoretical justification; it is not formally connected to the TRIX objective or to neural feature geometry.

how reviews work

0 comments
Cite this review

Pith. "Pith review of TRIX- Trading Adversarial Fairness via Mixed Adversarial Training." pith.science (2026). https://pith.science/paper/XALGMG4W

@misc{pith2026250707768,
  author       = {Pith},
  title        = {Pith review of: TRIX- Trading Adversarial Fairness via Mixed Adversarial Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XALGMG4W}},
  note         = {Machine review of arXiv:2507.07768}
}
read the original abstract

Adversarial Training (AT) is a widely adopted defense against adversarial examples. However, existing approaches typically apply a uniform training objective across all classes, overlooking disparities in class-wise vulnerability. This results in adversarial unfairness: classes with well distinguishable features (strong classes) tend to become more robust, while classes with overlapping or shared features(weak classes) remain disproportionately susceptible to adversarial attacks. We observe that strong classes do not require strong adversaries during training, as their non-robust features are quickly suppressed. In contrast, weak classes benefit from stronger adversaries to effectively reduce their vulnerabilities. Motivated by this, we introduce TRIX, a feature-aware adversarial training framework that adaptively assigns weaker targeted adversaries to strong classes, promoting feature diversity via uniformly sampled targets, and stronger untargeted adversaries to weak classes, enhancing their focused robustness. TRIX further incorporates per-class loss weighting and perturbation strength adjustments, building on prior work, to emphasize weak classes during the optimization. Comprehensive experiments on standard image classification benchmarks, including evaluations under strong attacks such as PGD and AutoAttack, demonstrate that TRIX significantly improves worst-case class accuracy on both clean and adversarial data, reducing inter-class robustness disparities, and preserves overall accuracy. Our results highlight TRIX as a practical step toward fair and effective adversarial defense.

Figures

Figures reproduced from arXiv: 2507.07768 by the authors.

Figure 1
Figure 1. (a) Class-wise Attack Success Rates (ASR) under PGD attack with epsilon (8/255) for both untargeted and targeted attacks. Weak classes such as cat and bird exhibit higher vulnerability, reflected in elevated ASR values. Targeted attacks, however weaker than the untargeted attacks. (b) Comparison of disparity metrics and accuracy between TRADES and our model. Our method demonstrates lower disparity (Std Dev, Min-Max,… view at source ↗
Figure 2
Figure 2. Features of classes cat (first column) and horse (second column) attacked with PGD and projected to the first three principal components. We show both classes combined at different angles in the remaining four columns. TRADES shows more overlap, indicating higher confusion under perturbation. These visualizations illustrate stronger class-wise feature compactness achieved by TRIX. sampling target labels during targe… view at source ↗
Figure 3
Figure 3. Class-wise performance under PGD attack across increasing [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Comparison of class-wise clean and adversarial (PGD) accuracy for TRADES and TAR [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Comparison of class-wise clean and adversarial (PGD) accuracy for TRADES and TAR [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: We measure the coverage of the feature space of each class by projecting class-wise image [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

80 extracted references · 72 canonical work pages

  1. [1]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. 16

    work page 2016

  2. [2]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, et al. An image is worth 16x16 words: Transformers for image recognition at scale. In International Conference on Learning Representations (ICLR), 2021

    work page 2021

  3. [3]

    Bert: Pre-training of deep bidi- rectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidi- rectional transformers for language understanding. In North American Chapter of the Association for Computational Linguistics (NAACL), pages 4171–4186, 2019

    work page 2019

  4. [4]

    Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, et al

    Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, et al. Language models are few-shot learners. In Advances in Neural Information Processing Systems (NeurIPS), pages 1877–1901, 2020

    work page 1901

  5. [5]

    Mastering the game of go without human knowledge

    David Silver, Julian Schrittwieser, Karen Simonyan, et al. Mastering the game of go without human knowledge. Nature, 550(7676):354–359, 2017

    work page 2017

  6. [6]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014

    2014

  7. [7]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR), 2015

    work page 2015

  8. [8]

    To- wards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. To- wards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018

    work page 2018

Show all 80 references
  1. [9]

    Adversarial examples in the physical world

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In International Conference on Learning Representations (ICLR) Workshop, 2017

    2017

  2. [10]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy, pages 39–57, 2017

    2017

  3. [11]

    Semsegbench & detecbench: Benchmarking reliability and generalization beyond classification, 2025

    Shashank Agnihotri, David Schader, Jonas Jakubassa, Nico Sharei, Simon Kral, Mehmet Ege Kaçar, Ruben Weber, and Margret Keuper. Semsegbench & detecbench: Benchmarking reliability and generalization beyond classification, 2025

    2025

  4. [12]

    Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML), pages 274–283, 2018

    2018

  5. [13]

    Improving adver- sarial robustness requires revisiting misclassified examples

    Yisen Wang, Difan Zou, Jinfeng Yi, James Bailey, Xingjun Ma, and Quanquan Gu. Improving adver- sarial robustness requires revisiting misclassified examples. In International Conference on Learning Representations, 2020

    2020

  6. [14]

    Prior-guided adversarial initialization for fast adversarial training

    Xiaojun Jia, Yong Zhang, Xingxing Wei, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Prior-guided adversarial initialization for fast adversarial training. In European Conference on Computer Vision, pages 567–584. Springer, 2022

    2022

  7. [15]

    Improving feature stability during upsampling – spectral artifacts and the importance of spatial context

    Shashank Agnihotri, Julia Grabinski, and Margret Keuper. Improving feature stability during upsampling – spectral artifacts and the importance of spatial context. In Aleš Leonardis, Elisa Ricci, Stefan Roth, Olga Russakovsky, Torsten Sattler, and Gül Varol, editors, Computer V...

    2024

  8. [16]

    Cospgd: a unified white-box adversarial attack for pixel-wise prediction tasks

    Shashank Agnihotri, Steffen Jung, and Margret Keuper. Cospgd: a unified white-box adversarial attack for pixel-wise prediction tasks. arXiv preprint arXiv:2302.02213, 2023

    2023 arXiv

  9. [17]

    On the unreasonable vulnerability of transformers for image restoration-and an easy fix

    Shashank Agnihotri, Kanchana Vaishnavi Gandikota, Julia Grabinski, Paramanand Chandramouli, and Margret Keuper. On the unreasonable vulnerability of transformers for image restoration-and an easy fix. In Proceedings of the IEEE/CVF International Conference on Computer Vision, ...

    2023

  10. [18]

    As large as it gets-studying infinitely large convolutions via neural implicit frequency filters

    Julia Grabinski, Janis Keuper, and Margret Keuper. As large as it gets-studying infinitely large convolutions via neural implicit frequency filters. Transactions on Machine Learning Research, 2024:1–42, 2024

    2024

  11. [19]

    Frequencylowcut pooling - plug and play against catastrophic overfitting

    Julia Grabinski, Steffen Jung, Janis Keuper, and Margret Keuper. Frequencylowcut pooling - plug and play against catastrophic overfitting. In Computer Vision - ECCV 2022 - 17th European Conference, Tel Aviv, Israel, October 23-27, 2022, Proceedings, Part XIV, pages 36–57. Spri...

    2022

  12. [20]

    Aliasing and adversarial robust generalization of cnns

    Julia Grabinski, Janis Keuper, and Margret Keuper. Aliasing and adversarial robust generalization of cnns. Machine Learning, 111(11):3925–3951, 2022. 17

    2022

  13. [21]

    Robust models are less over-confident

    Julia Grabinski, Paul Gavrikov, Janis Keuper, and Margret Keuper. Robust models are less over-confident. Advances in Neural Information Processing Systems, 35:39059–39075, 2022

    2022

  14. [22]

    Neural architecture design and robustness: A dataset

    Steffen Jung, Jovita Lukasik, and Margret Keuper. Neural architecture design and robustness: A dataset. In ICLR, 2023

    2023

  15. [23]

    Improving native cnn robustness with filter frequency regularization

    Jovita Lukasik, Paul Gavrikov, Janis Keuper, and Margret Keuper. Improving native cnn robustness with filter frequency regularization. Transactions on Machine Learning Research, 2023:1–36, 2023

    2023

  16. [24]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P Xing, Laurent El Ghaoui, and Michael I Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), pages 7472–7482, 2019

    2019

  17. [26]

    Robust fairness: A robust optimization framework for fair classification

    Depeng Xu, Sen Yuan, Hongying Zhang, and Xintao Wu. Robust fairness: A robust optimization framework for fair classification. In IEEE International Conference on Data Mining (ICDM), pages 721–730, 2021

    2021

  18. [27]

    Dafa: Differentiated adversarial training for fairness and accuracy

    Zhilu Zhang, Tong Xu, Hanghang Zhang, Jundong Wang, and Xia Hu Huang. Dafa: Differentiated adversarial training for fairness and accuracy. In International Conference on Learning Representations (ICLR), 2021

    2021

  19. [28]

    Towards class-wise robustness analysis, 2024

    Tejaswini Medi, Julia Grabinski, and Margret Keuper. Towards class-wise robustness analysis, 2024

    2024

  20. [29]

    Fair-tat: Improving model fairness using targeted adversarial training

    Tejaswini Medi, Steffen Jung, and Margret Keuper. Fair-tat: Improving model fairness using targeted adversarial training. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 7827–7836. IEEE, 2025

    2025

  21. [30]

    Cfa: Class-wise calibrated fair adversarial training

    Zeming Wei, Yifei Wang, Yiwen Guo, and Yisen Wang. Cfa: Class-wise calibrated fair adversarial training. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 8193–8201, 2023

    2023

  22. [31]

    Gupta and L

    A. Gupta and L. Tan. Decomposing fairness in adversarial settings: Source vs. target bias. In International Conference on Machine Learning (ICML), 2023

    2023

  23. [32]

    Wat: improve the worst-class robustness in adversarial training

    Boqi Li and Weiwei Liu. Wat: improve the worst-class robustness in adversarial training. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pages 14982–14990, 2023

    2023

  24. [33]

    Liu and H

    T. Liu and H. Zhao. Theoretical analysis of class-wise risk in adversarial training. In Advances in Neural Information Processing Systems (NeurIPS), 2022

    2022

  25. [34]

    Understanding ad- versarial attacks on deep learning based medical image analysis systems

    Xingjun Ma, Yuhao Niu, Lin Gu, Yisen Wang, Yitian Zhao, James Bailey, and Feng Lu. Understanding ad- versarial attacks on deep learning based medical image analysis systems. Pattern Recognition, 110:107332, 2021

    2021

  26. [35]

    Dafa: Distance- aware fair adversarial training

    Hyungyu Lee, Saehyung Lee, Hyemi Jang, Junsung Park, Ho Bae, and Sungroh Yoon. Dafa: Distance- aware fair adversarial training. In 12th International Conference on Learning Representations, ICLR 2024, 2024

    2024

  27. [36]

    On the tradeoff between robustness and fairness

    Xinsong Ma, Zekai Wang, and Weiwei Liu. On the tradeoff between robustness and fairness. Advances in Neural Information Processing Systems, 35:26230–26241, 2022

    2022

  28. [37]

    Improving adversarial robust fairness via anti-bias soft label distillation

    Shiji Zhao, Xizhe Wang, and Xingxing Wei. Improving adversarial robust fairness via anti-bias soft label distillation. arXiv preprint arXiv:2312.05508, 2023

    2023 arXiv

  29. [38]

    Adversarial training can provably improve robustness: Theoretical analysis of feature learning process under structured data

    Binghui Li and Yuanzhi Li. Adversarial training can provably improve robustness: Theoretical analysis of feature learning process under structured data. arXiv preprint arXiv:2410.08503, 2024

    2024 arXiv

  30. [39]

    Jordan, and Jacob Steinhardt

    Gauri Ding, Yuzhe Liu, Michael I. Jordan, and Jacob Steinhardt. Mma training: Direct input space margin maximization through adversarial training. In International Conference on Learning Representations (ICLR), 2020

    2020

  31. [40]

    Kumar and R

    S. Kumar and R. Singh. On the trade-off between robustness and fairness in adversarial settings. In International Conference on Machine Learning (ICML), 2022

    2022

  32. [41]

    Understanding the impact of adversarial robustness on accuracy disparity

    Yuzheng Hu, Fan Wu, Hongyang Zhang, and Han Zhao. Understanding the impact of adversarial robustness on accuracy disparity. In International Conference on Machine Learning, pages 13679–13709. PMLR, 2023. 18

    2023

  33. [42]

    Analysis and applications of class-wise robustness in adversarial training

    Qi Tian, Kun Kuang, Kelu Jiang, Fei Wu, and Yisen Wang. Analysis and applications of class-wise robustness in adversarial training. In Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, pages 1561–1570, 2021

    2021

  34. [43]

    Robustness may be at odds with fairness: An empirical study on class-wise accuracy

    Philipp Benz, Chaoning Zhang, Adil Karjauv, and In So Kweon. Robustness may be at odds with fairness: An empirical study on class-wise accuracy. In NeurIPS 2020 Workshop on Pre-registration in Machine Learning, pages 325–342. PMLR, 2021

    2020

  35. [44]

    A. Xu, B. Li, and Y . Wang. Towards fair robust learning: Adjusting adversarial margins and weights. In Advances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  36. [45]

    C. Ma, Y . Zhang, and L. Lyu. Fair adversarial training via risk variance regularization. In Advances in Neural Information Processing Systems (NeurIPS), 2021

    2021

  37. [46]

    Y . Sun, M. Long, and J. Wang. Balanced adversarial training for source and target class fairness. In International Conference on Learning Representations (ICLR), 2021

    2021

  38. [47]

    X. Wu, Y . Zhang, and J. Zou. Entropy regularization improves fairness in adversarial learning. In International Conference on Learning Representations (ICLR), 2021

    2021

  39. [48]

    Z. Yue, Y . Zhang, and B. Han. Fair-ard: Reweighting based on class vulnerability for robust fairness. In International Conference on Machine Learning (ICML), 2023

    2023

  40. [49]

    Zhao and Q

    J. Zhao and Q. Huang. Validation-guided fairness-aware adversarial training. In Advances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  41. [50]

    Cifar-10 (canadian institute for advanced research)

    Alex Krizhevsky, Vinod Nair, and Geoffrey Hinton. Cifar-10 (canadian institute for advanced research). Dataset, 2009

    2009

  42. [51]

    An analysis of single-layer networks in unsupervised feature learning

    Adam Coates, Andrew Y Ng, and Honglak Lee. An analysis of single-layer networks in unsupervised feature learning. In Proceedings of the fourteenth international conference on artificial intelligence and statistics, pages 215–223. JMLR Workshop and Conference Proceedings, 2011

    2011

  43. [52]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. ISSN: 1063-6919

    2016

  44. [53]

    Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks

    Minhao Huang, Yinpeng Dong, Hang Su, and Jun Zhu. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In Advances in Neural Information Processing Systems (NeurIPS), 2020

    2020

  45. [54]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. https://www.cs.toronto.edu/ kriz/learning-features-2009-TR.pdf, 2009

    2009

  46. [55]

    Deep residual learning for image recognition, 2015

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition, 2015

    2015

  47. [56]

    Identity mappings in deep residual networks

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Identity mappings in deep residual networks. In Computer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part IV 14, pages 630–645. Springer, 2016

    2016

  48. [57]

    Wide residual networks

    Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. arXiv preprint arXiv:1605.07146, 2016

    2016 arXiv

  49. [58]

    Is robustbench/autoattack a suitable benchmark for adversarial robustness? In The AAAI-22 Workshop on Adversarial Machine Learning and Beyond, 2022

    Peter Lorenz, Dominik Strassel, Margret Keuper, and Janis Keuper. Is robustbench/autoattack a suitable benchmark for adversarial robustness? In The AAAI-22 Workshop on Adversarial Machine Learning and Beyond, 2022

    2022

  50. [59]

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), 2019

    2019

  51. [60]

    Adversarial machine learning at scale, 2017

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial machine learning at scale, 2017

    2017

  52. [61]

    Le and X

    Y . Le and X. Yang. Tiny imagenet visual recognition challenge.https://tiny-imagenet.herokuapp. com/, 2015

    2015

  53. [62]

    Autoaugment: Learning augmentation strategies from data

    Ekin D Cubuk, Barret Zoph, Dandelion Mane, Vijay Vasudevan, and Quoc V Le. Autoaugment: Learning augmentation strategies from data. In CVPR, 2019. 19

    2019

  54. [63]

    Improved regularization of convolutional neural networks with cutout

    Terrance DeVries and Graham W Taylor. Improved regularization of convolutional neural networks with cutout. In arXiv preprint arXiv:1708.04552, 2017

    2017 arXiv

  55. [64]

    mixup: Beyond empirical risk minimization

    Hongyi Zhang, Moustapha Cisse, Yann N Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In International Conference on Learning Representations (ICLR), 2018

    2018

  56. [65]

    Schomaker, and Marco A

    Pornntiwa Pawara, Emmanuel Okafor, Marc Groefsema, Sheng He, Lambert R.B. Schomaker, and Marco A. Wiering. One-vs-one classification for deep neural networks. Pattern Recognition, 108:107528, 2020. 20 NeurIPS Paper Checklist

    2020

  57. [66]

    Claims Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope? Answer: [Yes] Justification: See Sec.1

  58. [67]

    Limitations Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: See below Sec.7

  59. [68]

    Theory assumptions and proofs Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof? Answer: [NA]

  60. [69]

    6 and Appendix A.2

    Experimental result reproducibility Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and da...

  61. [70]

    Open access to data and code Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material? Answer: [Yes] Justification: The code is available at su...

  62. [71]

    6 and Appendix A.2

    Experimental setting/details Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results? Answer: [Yes] Justification: See Sec. 6 and Appendix A.2

  63. [72]

    Experiment statistical significance Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments? Answer: [Yes] Justification: We include mean and standard deviation

  64. [73]

    Experiments compute resources Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments? Answer: [Yes] Justification: See Appendix A.2

  65. [74]

    Code of ethics Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines? Answer: [Yes] 21

  66. [75]

    Broader impacts Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed? Answer: [Yes] Justification: See Sec.7

  67. [76]

    Safeguards Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)? Answer: [NA]

  68. [77]

    Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected? Answer: [Yes]

  69. [78]

    New assets Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets? Answer: [NA]

  70. [79]

    Crowdsourcing and research with human subjects Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)? A...

  71. [80]

    Institutional review board (IRB) approvals or equivalent for research with human subjects Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals...

  72. [81]

    Answer: [No] 22

    Declaration of LLM usage Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the ...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.