Research map / Adversarial robustness and security / Certified and empirical robustness
Learn2Perturb: An End-to-End Feature Perturbation Learning to Improve Adversarial Robustness
Check your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add learned feature perturbations and alternating updates of network and noise parameters | ResNet-V1(20), versus vanilla PGD adversarial training · CIFAR-10 | PGD accuracy: 39.1±0.1 -> 51.13±0.08 | Helped |
| add learned feature perturbations and alternating updates of network and noise parameters | ResNet-V1(20), versus vanilla PGD adversarial training · CIFAR-10 | FGSM accuracy: 46.6 -> 58.41±0.07 | Helped |
| add both network gradients and the regularizer when updating perturbation modules (ablation) | Learn2Perturb-R · CIFAR-10, ResNet-V1(20) | PGD accuracy: 50.23±0.14 -> 51.13±0.08 | Helped |
| add both network gradients and the regularizer when updating perturbation modules (ablation) | Learn2Perturb-R · CIFAR-10, ResNet-V1(20) | clean accuracy: 81.15±0.02 -> 83.62±0.02 | Helped |
| use regularizer-only updates for perturbation modules, omitting network gradients (ablation) | Learn2Perturb · CIFAR-10, ResNet-V1(20) | PGD accuracy: 51.13±0.08 -> 50.23±0.14 | Hurt |
| use regularizer-only updates for perturbation modules, omitting network gradients (ablation) | Learn2Perturb · CIFAR-10, ResNet-V1(20) | clean accuracy: 83.62±0.02 -> 81.15±0.02 | Hurt |
| increase network width from ResNet-V1(20) to ResNet-V1(20)[4×] (ablation) | Learn2Perturb · CIFAR-10 | PGD accuracy: 51.13±0.08 -> 55.75±0.07 | Helped |
| increase network depth from ResNet-V1(20) to ResNet-V1(56) (ablation) | Learn2Perturb · CIFAR-10 | FGSM accuracy: 58.41±0.07 -> 61.53±0.04 | Helped |
| use Learn2Perturb instead of PNI | ResNet-V2(18) · CIFAR-10, C&W attack, κ=5.0 | accuracy: 0.8 -> 34.8 | Helped |
| use Learn2Perturb instead of Adv-BNN | ResNet-V2(18) · CIFAR-10, C&W attack, κ=0.0 | accuracy: 78.9 -> 83.6 | Helped |
| use Learn2Perturb instead of Adv-BNN | ResNet-V2(18) · CIFAR-10, 1-pixel attack | accuracy: 68.60 vs 64.45 | Hurt |
| use Learn2Perturb instead of Adv-BNN | ResNet-V1(20) · CIFAR-10, 1-pixel attack | accuracy: 58.40 -> 70.15 | Helped |
Closest papers by meaning
- Wide Two-Layer Networks can Learn from Adversarial Perturbations (NeurIPS 2024 · similarity 0.90)
- Defense Against Universal Adversarial Perturbations (CVPR 2018 · similarity 0.90)
- Learning perturbation sets for robust machine learning (ICLR 2021 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization (NeurIPS 2025 · similarity 0.89)
- Contrasting Adversarial Perturbations: The Space of Harmless Perturbations (AAAI 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.