Research map / Adversarial robustness and security / Certified and empirical robustness
Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes TPAP, a test-time pixel-level adversarial purification method that uses a FGSM robust-overfitting network and one FGSM-style purification step guided by the model's pre-predicted label to defend against unseen attacks.
Problem
Adversarial defenses trained for one attack (usually PGD) generalize poorly to unseen attack types, and many defenses trade off clean accuracy for robustness.
Approach
Exploit FGSM robust overfitting: a FGSM-adversarially-trained network is highly accurate on clean and FGSM examples but weak to other attacks, so applying an FGSM-style purification step (using the predicted label's loss) at test time pulls other adversarial examples back to correct classification.
Key results
- On CIFAR-10 with ResNet-18, TPAP reaches 86.25% clean accuracy and 79.06% PGD-20, 76.34% AutoAttack, and 31.4% STA, versus 84.54% clean and 48.91% PGD-20 for PGD-AT.
- TPAP is weaker than adversarial training against 8/255 FGSM examples (61.41% vs 55.11% for PGD-AT, and far below on other FGSM settings), which the authors acknowledge as a limitation.
- Test-time cost rises (test FLOPs 44.4T/epoch vs 11.1T for PGD-AT) while training time per epoch drops from 273.89s to 66.26s.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add test-time FGSM purification (ablation) | FGSM-RO-DNN · CIFAR-10 | PGD-20 accuracy: 0.18 -> 79.06 | Helped |
| add test-time FGSM purification (ablation) | FGSM-RO-DNN · CIFAR-10 | clean accuracy: 86.33 -> 86.25 | Hurt |
| replace FGSM training attack with CW2 (ablation) | TPAP training · CIFAR-10 | clean accuracy: 86.25 -> 68.19 | Hurt |
| replace FGSM training attack with CW2 (ablation) | TPAP training · CIFAR-10 | PGD-20 accuracy: 79.06 -> 37.4 | Hurt |
| replace FGSM training attack with PGD-10 (ablation) | TPAP training · CIFAR-10 | clean accuracy: 86.25 -> 56.17 | Hurt |
| replace FGSM training attack with PGD-10 (ablation) | TPAP training · CIFAR-10 | PGD-20 accuracy: 79.06 -> 42.74 | Hurt |
| train with both 8/255 and 16/255 FGSM examples instead of 8/255 only (ablation) | TPAP · CIFAR-10 | clean accuracy: 86.25 -> 82.11 | Hurt |
| train with both 8/255 and 16/255 FGSM examples instead of 8/255 only (ablation) | TPAP · CIFAR-10 | FGSM accuracy: 61.41 -> 73.23 | Helped |
| apply TPAP instead of TRADES | ResNet-18 · CIFAR-10 | PGD-20 accuracy: 54.97 -> 79.06 | Helped |
| apply TPAP instead of PGD-AT | ResNet-18 · SVHN | PGD-20 accuracy: 63.86 -> 83.62 | Helped |
Surprising findings
- A FGSM-adversarially trained network that is non-robust to other attacks can be turned into a strong defense by purifying inputs with FGSM steps at test time.
- Using both 8/255 and 16/255 FGSM examples in training boosts robustness to FGSM and other attacks but lowers clean accuracy from 86.25% to 82.11%.
Limitations
- Weak against 8/255 FGSM adversarial examples compared with standard adversarial training.
- Fails on attacks with very large perturbations (e.g., epsilon 0.3 on MNIST), since purification must grow and destroys semantics.
- Adds test-time inference cost from the purification step.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN Tiny-ImageNet Caltech-101 MNIST
Benchmarks: CIFAR-10 CIFAR-100 SVHN Tiny-ImageNet Caltech-101
Metrics: classification accuracy (clean) robust accuracy under FGSM, PGD-20, PGD-100, CW2, DDN2, Auto FLOPs training and test time per epoch
Baselines: PGD-AT TRADES MART SOAP Yang et al. 2019 Hill et al. 2021 Wang et al. 2023
Builds on: FGSM adversarial training catastrophic overfitting TRADES MART
Closest papers by meaning
- Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization (ICLR 2024 · similarity 0.90)
- Adversary Aware Optimization for Robust Defense (NeurIPS 2025 · similarity 0.89)
- Adversarial Robustness via Runtime Masking and Cleansing (ICML 2020 · similarity 0.89)
- Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.89)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.87)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.