Research map / Adversarial robustness and security / Certified and empirical robustness
Focus on Hiders: Exploring Hidden Threats for Enhancing Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Hider-Focused Adversarial Training (HFAT), which defends against "hiders" (samples correctly defended in earlier epochs but later broken) using an auxiliary model and adaptive weighting on top of standard adversarial training methods.
Problem
Standard min-max adversarial training focuses only on worst-case adversarial examples, causing repeated confusion where previously defended or correctly classified samples (hiders) become vulnerable in later epochs, hurting robustness and accuracy.
Approach
Defines hiders as samples defended/correct at epoch i but failing at a later epoch j, models their relative position with a Gaussian prior, uses an auxiliary model trained on sampled hider-region inputs to supply an extra adversarial-training gradient (momentum), and adaptively weights this branch against standard adversarial training using a KL-divergence-based weight.
Key results
- On CIFAR-10 with PreAct ResNet-18, ATHF raises PGD20 robust accuracy from 52.64% (ATPGD) to 56.39% and natural accuracy from 81.66% to 81.88%.
- On WideResNet34-10, TRADESHF reaches 61.12% PGD20 robust accuracy versus 59.31% for TRADES.
- HFAT improved robust and natural accuracy for all five baselines (ATPGD, TRADES, MART, AWP, HELP) under FGSM, PGD, CW, MIM and AutoAttack evaluations on CIFAR-10.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| apply HFAT to ATPGD | ATPGD, PreAct ResNet-18 · CIFAR-10 | AA accuracy: 48.25 -> 50.61 | Helped |
| apply HFAT to ATPGD | ATPGD, WideResNet34-10 · CIFAR-10 | AA accuracy: 52.06 -> 55.58 | Helped |
| directly include sampled hider examples in training rather than use an auxiliary model (ablation) | ATPGD, PreAct ResNet-18 · CIFAR-10 | PGD20 accuracy: 52.64 -> 48.90 | Hurt |
| directly include sampled hider examples in training rather than use an auxiliary model (ablation) | ATPGD, PreAct ResNet-18 · CIFAR-10 | Natural accuracy: 81.66 -> 85.73 | Helped |
| use Mixup data augmentation (ablation) | ATPGD, PreAct ResNet-18 · CIFAR-10 | PGD20 accuracy: 52.64 -> 52.92 | Helped |
| vary auxiliary-model attack generation from step 1 to step 5 (ablation) | HFAT, PreAct ResNet-18 · CIFAR-10 | PGD20 accuracy: 53.52 -> 56.39 | Helped |
| increase auxiliary-model attack generation steps from 5 to 7 (ablation) | HFAT, PreAct ResNet-18 · CIFAR-10 | Natural accuracy: 81.88 -> 81.13 | Hurt |
| use adaptive auxiliary-branch weighting instead of static weights (ablation) | HFAT · CIFAR-10 | robust accuracy under PGD20 and MIM | Helped |
Surprising findings
- Directly adding hider samples as training data (AThiders) raises natural accuracy to 85.73% but lowers robust accuracy to 48.90%, below the ATPGD baseline.
- Mixup gives only marginal robustness gains over ATPGD (52.92% vs 52.64%).
Limitations
- Hider distribution is modeled by empirical Gaussian fitting rather than a learned or principled detector.
- Training cost increases because an auxiliary model must be trained each epoch.
- Evaluated only on CIFAR-10, CIFAR-100 and SVHN with ResNet-style models at a single 8/255 budget.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN
Benchmarks: CIFAR-10 CIFAR-100 SVHN
Metrics: natural accuracy robust accuracy hider proportion training time
Baselines: ATPGD TRADES MART AWP HELP Mixup AThiders
Builds on: PGD adversarial training TRADES MART AWP HELP
Closest papers by meaning
- Bag of Tricks for Adversarial Training (ICLR 2021 · similarity 0.88)
- Adversarial Attack Generation Empowered by Min-Max Optimization (NeurIPS 2021 · similarity 0.87)
- Clarifying the Behavior and the Difficulty of Adversarial Training (AAAI 2024 · similarity 0.86)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.86)
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.86)
- Enhancing Adversarial Robustness with Conformal Prediction: A Framework for Guaranteed Model Reliability (ICML 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.