Research map / Adversarial robustness and security / Certified and empirical robustness

Towards Fairness-Aware Adversarial Learning

CVPR 2024 · Adversarial robustness and security › Certified and empirical robustness · approach: Robustness-accuracy trade-off analysis · 7 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes FAAL, a min-max-max adversarial training paradigm that inserts a KL-DRO class-wise distributionally adversarial reweighting step to improve worst-class robust accuracy, fine-tuning robust models in as few as two epochs.

Problem

Adversarially trained models show large disparities in robust accuracy across classes (robust fairness), and existing fixes are heuristic reweighting methods that are slow or need validation sets.

Approach

Reformulate adversarial training as min-max-max, where the intermediate maximization learns class-wise weights under a KL-divergence ball around the uniform class distribution (distributionally robust optimization), using CW margin loss per class; it plugs into any AT method and needs no validation set.

Key results

• On CIFAR-10 WRN-34-10 PGD-AT, fine-tuning with FAAL for 2 epochs raises worst-class AutoAttack accuracy from 24.40% to 35.70% vs 33.10% for FRL-RWRM0.05 (80 epochs), with clean accuracy 86.23%.
• Training PreAct-ResNet-18 from scratch, FAAL-TRADES reaches 68.90% worst-class clean accuracy vs 66.10% for TRADES, with AutoAttack worst-class accuracy 33.60% vs 20.70%.
• On CIFAR-100 ResNet-18, FAAL matches FRL-RWRM worst-class AutoAttack-level results with 2 epochs vs 80 epochs of fine-tuning.

Measured effects reported in the paper

Surprising findings

• Applying DRO directly to robust learning can be overly pessimistic and underperform ERM-based adversarial training, motivating the constrained KL ambiguity set.
• Stronger adversarial perturbations (via AWP) improve worst-class robustness more than enlarging the perturbation radius, which the authors argue is not required.

Limitations

• Comparisons to FRL on CIFAR-100 are described as comparable rather than superior; worst-class gains are modest and noisy on small class sets.
• Evaluated only on CIFAR-10 and CIFAR-100 with a few architectures.

Experimental setup

Datasets: CIFAR-10 CIFAR-100

Benchmarks: CIFAR-10 CIFAR-100

Metrics: clean accuracy PGD-20 accuracy CW-20 accuracy AutoAttack accuracy average accuracy worst-class accuracy

Baselines: FRL-RWRM CFA WAT PGD-AT TRADES MART AWP TRADES-AWP

Builds on: PGD adversarial training TRADES MART AWP KL-DRO FRL

Closest papers by meaning

• DAFA: Distance-Aware Fair Adversarial Training (ICLR 2024 · similarity 0.93)
• On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness (ICML 2025 · similarity 0.91)
• Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillation (NeurIPS 2024 · similarity 0.90)
• On the Fairness ROAD: Robust Optimization for Adversarial Debiasing (ICLR 2024 · similarity 0.89)
• Enhancing Robust Fairness via Confusional Spectral Regularization (ICLR 2025 · similarity 0.87)
• Can Private Machine Learning Be Fair? (AAAI 2025 · similarity 0.86)