Research map / Adversarial robustness and security / Black-box and transfer attacks
Towards Accurate and Robust Architectures via Neural Architecture Search
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ARNAS, a differentiable NAS that searches accurate and robust architectures for adversarial training using a cell-placement search space and an MGDA-based multi-objective search strategy.
Problem
Adversarial training accuracy and robustness are limited by the architecture, yet existing robust NAS methods reuse standard-training search spaces and fix a regularization coefficient between natural and adversarial loss.
Approach
Designs a search space with Accurate Cells near the input and Robust Cells near the output (separated by a Reduction Cell, with a modified filter-doubling rule), and a differentiable multi-objective strategy that uses MGDA to dynamically weight natural and adversarial losses to find a common descent direction.
Key results
- On CIFAR-10, ARNAS achieves 52.66% AutoAttack accuracy and 55.87% PGD20 accuracy with 85.92% natural accuracy, the highest robustness among compared architectures.
- Ablation: the proposed search space (A-A-R, filters 1-2-2) improves natural accuracy by 2.23% and PGD20 by 2.78% over the conventional A-A-A, 1-2-4 setting.
- On Tiny-ImageNet-200, ARNAS reaches 50.00% FGSM accuracy, 22.18% higher than WideResNet-34-12, though its PGD20 accuracy (21.49%) is lower than WideResNet-34-12 (24.83%).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use ARNAS instead of the strongest reported baseline | adversarially trained architectures · CIFAR-10 | AA: 50.44% -> 52.66% | Helped |
| transfer ARNAS to CIFAR-100 | ARNAS · CIFAR-100 | PGD20: 25.83% -> 29.54% | Helped |
| transfer ARNAS to SVHN | ARNAS · SVHN | PGD20: 89.58% -> 92.02% | Helped |
| transfer ARNAS to Tiny-ImageNet-200 | ARNAS · Tiny-ImageNet-200 | PGD20: 24.83% -> 21.49% | Hurt |
| place Accurate Cells before Robust Cells (A-A-R) instead of R-A-A (ablation) | ARNAS search space · CIFAR-10 | PGD20: 52.51% -> 55.87% | Helped |
| place Accurate Cells before Robust Cells (A-A-R) instead of A-R-A (ablation) | ARNAS search space · CIFAR-10 | PGD20: 50.74% -> 55.87% | Helped |
| use filter setting 1-2-2 instead of 1-2-3 (ablation) | ARNAS search space with A-A-R placement · CIFAR-10 | PGD20: 53.03% -> 55.87% | Helped |
| use filter setting 1-2-2 instead of 1-2-4 (ablation) | ARNAS search space with A-A-R placement · CIFAR-10 | PGD20: 52.36% -> 55.87% | Helped |
| use A-A-R placement instead of A-A-A placement (ablation) | ARNAS search space · CIFAR-10 | PGD20: 51.82% -> 55.87% | Helped |
| use multi-objective adversarial training instead of fixed-coefficient optimization (ablation) | ARNAS · CIFAR-10 | PGD20: 53.72% -> 55.87% | Helped |
Surprising findings
- ABanditNAS-10 has high natural accuracy (90.64%) and FGSM accuracy but collapses under PGD100 (45.73%) and AutoAttack (16.03%), indicating it is not truly robust.
- ARNAS has notably higher FLOPs (1.27G) than peers with similar parameter counts, which the authors argue contributes to robustness.
Limitations
- Searched architecture has much higher FLOPs (1.27G) than peers, confounding the comparison.
- On Tiny-ImageNet-200, PGD20 accuracy of ARNAS is below WideResNet-34-12.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 SVHN Tiny-ImageNet-200
Benchmarks: CIFAR-10 CIFAR-100 SVHN Tiny-ImageNet-200
Metrics: natural accuracy adversarial accuracy under FGSM PGD20 PGD100 AutoAttack transfer-based black-box attack success rate
Baselines: ResNet-18 DenseNet-121 DARTS PDARTS RobNet-free AdvRush RACL DSRNA NADAR ABanditNAS-10 WideResNet-34-12
Builds on: DARTS MGDA PGD adversarial training RobNet
Closest papers by meaning
- Robust NAS under adversarial training: benchmark, theory, and beyond (ICLR 2024 · similarity 0.93)
- When NAS Meets Robustness: In Search of Robust Architectures Against Adversarial Attacks (CVPR 2020 · similarity 0.91)
- DSRNA: Differentiable Search of Robust Neural Architectures (CVPR 2021 · similarity 0.91)
- Neural Architecture Search for Wide Spectrum Adversarial Robustness (AAAI 2023 · similarity 0.91)
- First Line of Defense: A Robust First Layer Mitigates Adversarial Attacks (AAAI 2025 · similarity 0.88)
- Robustifying and Boosting Training-Free Neural Architecture Search (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.