Research map / Adversarial robustness and security / Certified and empirical robustness
The Best Defense Is a Good Offense: Adversarial Augmentation Against Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Preemptively robustify CIFAR10 inputs using ground truth | CROWN-IBP classifier · CIFAR10 | certified error: 66.94 -> 49.74 | Helped |
| Use a learned robustifier without ground-truth labels | CROWN-IBP classifier · CIFAR10 | certified error: 66.94 -> 57.75 | Helped |
| Co-train the robustifier and classifier | A^5 · CIFAR10 | certified error: 66.94 -> 42.76 | Helped |
| Co-train the robustifier and classifier rather than use a frozen legacy classifier | A^5/R · FashionMNIST | certified error: 15.75% -> 15.53% | Helped |
| Use ground-truth-guided offline robustification | CROWN-IBP classifier · TinyImageNet | verified error: 84.80 -> 25.08 | Helped |
| Co-train the robustifier and classifier | A^5 · TinyImageNet | clean error: 75.33 -> 71.50 | Helped |
| Robustify physical character shapes and train the classifier | CROWN-IBP · OCR 62-character set | certified error: 13.85% -> 4.20% | Helped |
| Increase defensive perturbation magnitude | A^5/O · MNIST | certified error: 100.00 -> 0.60 | Helped |
| Apply A^5/O to a classifier trained with epsilon_A^C=0.0 | MNIST · MNIST | certified error: 100.00 | No clear effect |
| Set robustification training attack magnitude above the target attack magnitude | A^5 on CIFAR10 · CIFAR10 | clean error: No specific paired value reported | Hurt |
| Add data augmentation during A^5/RC co-training (ablation) | A^5/RC · MNIST | certified error: 12.41 -> 6.42 | Helped |
| Remove data augmentation during co-training (ablation) | A^5/RC · MNIST | certified error: 6.42 -> 12.41 | Hurt |
Closest papers by meaning
- Certified Adversarial Robustness with Additive Noise (NeurIPS 2019 · similarity 0.89)
- Practical Evaluation of Adversarial Robustness via Adaptive Auto Attack (CVPR 2022 · similarity 0.89)
- Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks (ICML 2020 · similarity 0.89)
- Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training (NeurIPS 2021 · similarity 0.89)
- Understanding the Robustness of Randomized Feature Defense Against Query-Based Adversarial Attacks (ICLR 2024 · similarity 0.88)
- Provably Cost-Sensitive Adversarial Defense via Randomized Smoothing (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.