Research map / Continual learning / Online and replay-based
Defense without Forgetting: Continual Adversarial Defense with Anisotropic & Isotropic Pseudo Replay
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces continual adversarial defense over attack sequences and proposes AIR, a memory-free self-distillation pseudo-replay method (isotropic and anisotropic replay plus an R-Drop-style regularizer) that mitigates catastrophic forgetting of previous attacks.
Problem
Adversarial defenses are typically designed for a one-shot setting, but new attacks arrive as sequences, and adapting to them causes catastrophic forgetting of robustness against earlier attacks.
Approach
Replay-free self-distillation from the previous model on pseudo-replay data built from current adversarial samples: isotropic replay (Gaussian perturbation plus random augmentation) and anisotropic mixup-style replay, combined with an R-Drop consistency regularizer that aligns new-attack features to a shared cluster across attacks.
Key results
- On CIFAR10 with None to FGSM to PGD sequences, AIR reaches 75.75 on Task 1 and 43.12 on Task 3 in Table 3, close to Joint Training's 70.62 and 44.36.
- On CIFAR10 PGD-to-FGSM-to-None, AIR achieves 42.35 on Task 1 versus 21.87 for vanilla AT, a large reduction in forgetting of the earlier PGD attack.
- On MNIST two-attack sequences, AIR attains 98.89/94.26 on FGSM-to-PGD and exceeds Joint Training on some tasks (e.g., 99.37 on Task 1 of None-to-FGSM).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add isotropic replay (ablation) | AIR · CIFAR10, PGD→FGSM→None | Robustness (%) | Helped |
| add anisotropic replay (ablation) | AIR · CIFAR10, PGD→FGSM→None | Robustness (%) | Helped |
| add the composite regularizer (ablation) | AIR · CIFAR10, PGD→FGSM→None | Robustness (%) | Helped |
| use AIR instead of vanilla adversarial training | CIFAR10 · PGD→FGSM→None, Task 1 | Robustness (%): 21.87 -> 42.35 | Helped |
| use AIR instead of vanilla adversarial training | CIFAR10 · PGD→FGSM→None, Task 2 | Robustness (%): 36.80 -> 52.44 | Helped |
| use AIR instead of vanilla adversarial training | CIFAR10 · PGD→FGSM→None, Task 3 | Robustness (%): 84.59 -> 76.66 | Hurt |
| use AIR instead of Joint Training | CIFAR10 · None→FGSM→PGD, Task 1 | Robustness (%): 70.62 -> 75.75 | Helped |
| use AIR instead of Joint Training | CIFAR10 · PGD→FGSM→None, Task 3 | Robustness (%): 70.62 -> 76.66 | Helped |
Surprising findings
- AIR sometimes exceeds the Joint Training upper bound on some tasks, which the authors attribute to earlier attacks acting as pre-training for later ones.
- Attack sequences ordered from difficult to easy (PGD to FGSM) cause more severe forgetting than easy-to-difficult sequences.
Limitations
- Overlooks the regularization effect of previous knowledge on new tasks, which may act as pre-training.
- Performance on new tasks fluctuates and can degrade relative to vanilla training; the paper relies on online monitoring to select models.
- Evaluated only on MNIST, CIFAR10 and CIFAR100 with FGSM and PGD attacks; AutoAttack was not used for training.
Experimental setup
Datasets: MNIST CIFAR10 CIFAR100
Benchmarks: MNIST CIFAR10 CIFAR100
Metrics: robust accuracy
Baselines: Vanilla AT EWC Feature Extraction LFL Joint Training
Builds on: adversarial training mixup R-Drop knowledge distillation EWC
Closest papers by meaning
- Robustness Under Data Scarcity: Few-Shot Continual Adversarial Training for Evolving Threats (CVPR 2026 · similarity 0.85)
- Embodied Active Defense: Leveraging Recurrent Feedback to Counter Adversarial Patches (ICLR 2024 · similarity 0.83)
- Theory of Continual Learning Against Data Poisoning Attacks (ICML 2026 · similarity 0.83)
- Retrospective Adversarial Replay for Continual Learning (NeurIPS 2022 · similarity 0.82)
- Attack on Prompt: Backdoor Attack in Prompt-Based Continual Learning (AAAI 2025 · similarity 0.81)
- AAKR: Adversarial Attack-based Knowledge Retention for Continual Semantic Segmentation (AAAI 2025 · similarity 0.80)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.