Research map / Adversarial robustness and security / Certified and empirical robustness
Understanding Catastrophic Overfitting in Single-step Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Select the earliest misclassified checkpoint along each image's adversarial direction instead of always using the maximum perturbation | Single-step adversarial training · CIFAR10 test | PGD50 accuracy (%): 0.1±0.1 -> 33.9±2.3 | Helped |
| Select the earliest misclassified checkpoint along each image's adversarial direction instead of always using the maximum perturbation | Single-step adversarial training · Tiny ImageNet test | PGD50 accuracy (%): 0.0±0.0 -> 7.8±0.1 | Helped |
| Use image-specific checkpoint selection rather than a uniform epsilon schedule matched to the average perturbation | Fast adversarial training · CIFAR10 training | PGD7 robustness during training | Helped |
| Increase checkpoint count from 2 to 3 (ablation) | Ours · CIFAR10 test | standard accuracy (%): 86.8±0.3 -> 87.7±0.8 | Helped |
| Increase checkpoint count from 3 to 4 (ablation) | Ours · CIFAR10 test | standard accuracy (%): 87.7±0.8 -> 87.8±0.9 | No clear effect |
| Vary checkpoint count (ablation) | Ours · CIFAR10 test | PGD50 robustness | No clear effect |
| Increase checkpoint count from 2 to 4 (ablation) | Ours · CIFAR10 | training time (h): 3.5 -> 4.4 | Hurt |
| Use a cyclic rather than stepwise learning-rate schedule (ablation) | Ours · CIFAR10 test | PGD50 accuracy (%): 33.9±2.3 -> 37.8±0.5 | Mixed |
| Raise GradAlign regularization parameter β to 2 (ablation) | GradAlign · Tiny ImageNet training | PGD7 robustness | Hurt |
| Vary GradAlign β from 0.2 to 0.02 (ablation) | GradAlign · Tiny ImageNet training | PGD7 robustness | No clear effect |
| Increase maximum perturbation ε across the tested settings (ablation) | FGSM and Fast Adv. · CIFAR10 training | PGD7 robustness | Hurt |
| Use the proposed checkpoint method while increasing ε (ablation) | Ours · CIFAR10 training | PGD7 robustness | Helped |
Closest papers by meaning
- Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependency (ICML 2024 · similarity 0.89)
- Taxonomy Driven Fast Adversarial Training (AAAI 2024 · similarity 0.88)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.87)
- Efficient local linearity regularization to overcome catastrophic overfitting (ICLR 2024 · similarity 0.87)
- Benign Overfitting in Adversarial Training of Neural Networks (ICML 2024 · similarity 0.86)
- Adversarial Training Should Be Cast as a Non-Zero-Sum Game (ICLR 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.