Research map / Adversarial robustness and security / Certified and empirical robustness
Universal Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace iDeepFool with stochastic-gradient universal perturbation optimization | ImageNet InceptionV1 and VGG16 · ImageNet validation, universal perturbation | top-1 accuracy: 40.7% -> 19.8%; 36.0% -> 22.5% | Helped |
| Replace iDeepFool with stochastic-gradient universal perturbation optimization | ImageNet InceptionV1 and VGG16 · ImageNet universal attack generation | time: 9856 -> 482; 6076 -> 953 | Helped |
| Train with universal adversarial perturbations using alternating updates | AlexNet · ImageNet validation with universal attack | top-1 accuracy: 3.9 % -> 42.0% | Helped |
| Use simultaneous low-cost updates instead of alternating universal-training updates (ablation) | AlexNet universal adversarial training · ImageNet validation with universal attack | top-1 accuracy: 42.0% -> 28.3% | Hurt |
| Use simultaneous low-cost updates instead of alternating universal-training updates (ablation) | CIFAR-10 universal adversarial training · CIFAR-10 validation with universal perturbation | accuracy: 91.8% -> 86.1% | Hurt |
| Use FGSM rather than SGD for universal perturbation updates during training (ablation) | Universal adversarial training · CIFAR-10, universal perturbation | accuracy: 57.0% -> 91.8% | Helped |
| Use a clipped loss with beta=9 rather than an unclipped loss (ablation) | Inception-V3 universal attack · ImageNet validation | accuracy | Helped |
| Use normalized-gradient optimizers (ADAM, PGD) rather than SGD for universal attack generation (ablation) | WRN 32-10 · CIFAR-10 test with universal perturbation, epsilon=8 | accuracy: 42.56% -> 13.30%; 42.56% -> 13.79% | Helped |
| Use FGSM rather than ADAM for universal perturbation updates during training (ablation) | Universal adversarial training · CIFAR-10, per-instance 20-step PGD attack | accuracy: 2.57% -> 17.21% | Helped |
| Use universal adversarial training rather than natural training | WideResNet 32-10 · CIFAR-10 validation with universal perturbation | accuracy: 9.2% -> 91.8% | Helped |
| Use universal adversarial training rather than PGD per-instance adversarial training | WideResNet 32-10 · CIFAR-10 validation, natural images | accuracy: 87.25% -> 94.28% | Helped |
| Use more than one class-count worth of training samples to construct the universal attack (ablation) | Inception-V3 universal attack · ImageNet validation | accuracy | Helped |
Closest papers by meaning
- Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization (AAAI 2025 · similarity 0.90)
- Generate Universal Adversarial Perturbations for Few-Shot Learning (NeurIPS 2024 · similarity 0.90)
- Democratic Training Against Universal Adversarial Perturbations (ICLR 2025 · similarity 0.90)
- Wide Two-Layer Networks can Learn from Adversarial Perturbations (NeurIPS 2024 · similarity 0.87)
- Data-free Universal Adversarial Perturbation with Pseudo-semantic Prior (CVPR 2025 · similarity 0.87)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.