Research map / Adversarial robustness and security / Certified and empirical robustness
Towards Compositional Adversarial Robustness: Generalizing Adversarial Training to Composite Semantic Perturbations
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with GAT on composite semantic perturbations | ResNet50 · CIFAR-10, semantic attacks, scheduled | robust accuracy: 21.3 -> 66.6 | Helped |
| Train with GAT on composite semantic and ℓ∞ perturbations | ResNet50 · CIFAR-10, full attacks, scheduled | robust accuracy: 3.7 -> 21.8 | Helped |
| Train with GAT on semantic attacks | ResNet50 · ImageNet, semantic attacks, random | robust accuracy: 14.0 -> 43.5 | Helped |
| Train with GAT on full composite attacks | ResNet50 · ImageNet, full attacks, random | robust accuracy: 7.1 -> 18.5 | Helped |
| Use scheduled rather than random order during GAT training (ablation) | GAT (ResNet50) · CIFAR-10, full attacks, scheduled evaluation | robust accuracy: 18.8 -> 21.8 | Helped |
| Use scheduled rather than random order during GAT training (ablation) | GAT (ResNet50) · CIFAR-10, semantic attacks, scheduled evaluation | robust accuracy: 69.9 -> 66.6 | Mixed |
| Replace component-wise sequential optimization with joint Ensemble-PGD (ablation) | CAA · CIFAR-10 composite attacks | attack success rate | Hurt |
| Replace gradient-based component optimization with grid search (ablation) | CAA · Five semantic attacks | attack success rate | Hurt |
| Remove attack-order scheduling and Comp-PGD, training on randomly perturbed samples (ablation) | GAT (WideResNet34) · CIFAR-10, semantic attacks, random | robust accuracy: 71.6 ± 0.1 vs. 22.8 ± 0.2 | Hurt |
| Remove attack-order scheduling and Comp-PGD, training on randomly perturbed samples (ablation) | GAT (WideResNet34) · CIFAR-10, full attacks, random | robust accuracy: 31.2 ± 0.4 vs. 6.7 ± 0.3 | Hurt |
| Use fine-tuning rather than training from scratch (ablation) | GAT · CIFAR-10 | clean accuracy | Helped |
| Use Madry loss rather than TRADES loss (ablation) | Fine-tuned GAT · Semantic and full attacks | robust accuracy | Helped |
Closest papers by meaning
- Exploring the Relationship Between Architectural Design and Adversarially Robust Generalization (CVPR 2023 · similarity 0.89)
- Adversarial Robustness without Adversarial Training: A Teacher-Guided Curriculum Learning Approach (NeurIPS 2021 · similarity 0.89)
- Adversarial Training and Robustness for Multiple Perturbations (NeurIPS 2019 · similarity 0.88)
- Towards Million-Scale Adversarial Robustness Evaluation With Stronger Individual Attacks (CVPR 2025 · similarity 0.87)
- Mixture of Adversarial LoRAs: Boosting Robust Generalization in Meta-Tuning (NeurIPS 2024 · similarity 0.87)
- GREAT Score: Global Robustness Evaluation of Adversarial Perturbation using Generative Models (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.