Research map / Adversarial robustness and security / Certified and empirical robustness
Intriguing Properties of Adversarial Training at Scale
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Remove clean images from adversarial training (ablation) | ResNet-152 adversarial training · ImageNet | PGD-2000 accuracy: 20.9 -> 39.2 | Helped |
| Add adversarial logits pairing (ablation) | ResNet-152 with clean and adversarial training images · ImageNet | PGD-2000 accuracy: +2.1% | Helped |
| Use separate BN statistics for clean and adversarial images (ablation) | ResNet-152 trained with clean and adversarial images · ImageNet | PGD-2000 accuracy: 20.9 -> 38.3 | Helped |
| Replace BN with group normalization (ablation) | ResNet-152 trained with clean and adversarial images · ImageNet | PGD-2000 accuracy: 20.9 -> 39.0 | Helped |
| Use running BN statistics in the last 10 training epochs (ablation) | ResNet-152 adversarial training · ImageNet | PGD-2000 accuracy: 39.2 -> 42.2 | Helped |
| Use running BN statistics in the last 10 training epochs (ablation) | MBN_adv with clean and adversarial images · ImageNet | PGD-2000 accuracy: 38.3 -> 39.9 | Helped |
| Increase depth from ResNet-152 to ResNet-338 (ablation) | Adversarial-only ResNet training · ImageNet | PGD-2000 accuracy: +2.4% | Helped |
| Increase depth from ResNet-152 to ResNet-638 (ablation) | Adversarial-only ResNet training · ImageNet | PGD-2000 accuracy: ResNet-152: 39.2; ResNet-638: 46.7 | Helped |
| Reduce training attacker from PGD-30 to PGD-10 (ablation) | ALP training · ImageNet | PGD-2000 accuracy: 23.0 -> 3.3 | Hurt |
| Reduce training attacker iterations from PGD-30 to PGD-5 (ablation) | 100% adv + 100% clean training · ImageNet | PGD-2000 accuracy: 20.9; -20.9 | Hurt |
| Reduce training attacker iterations from PGD-30 to PGD-5 (ablation) | 100% adv + 0% clean training · ImageNet | PGD-2000 accuracy: 39.2; -3.3 | Hurt |
| Use a smaller training batch size, 1024 or 2048 rather than 4096 (ablation) | Adversarial-only ResNet-152 training · ImageNet | PGD-2000 accuracy: 4096: 42.2; 1024: 43.1; 2048: 43.3 | Helped |
Closest papers by meaning
- Removing Batch Normalization Boosts Adversarial Training (ICML 2022 · similarity 0.92)
- Generalizable Adversarial Training via Spectral Normalization (ICLR 2019 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.90)
- Robust Models are less Over-Confident (NeurIPS 2022 · similarity 0.89)
- Understanding Batch Normalization (NeurIPS 2018 · similarity 0.89)
- Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.