Research map / Adversarial robustness and security / Certified and empirical robustness
Perceptual Adversarial Robustness: Defense Against Unseen Threat Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Train with PAT instead of the strongest reported multi-attack baseline | ResNet-50 on CIFAR-10 · CIFAR-10 | union accuracy: 21.4 -> 27.8 | Helped |
| Train with PAT instead of manifold regularization | ResNet-50 on CIFAR-10 · CIFAR-10 | unseen mean accuracy: 36.2 -> 48.5 | Helped |
| Use pretrained AlexNet rather than the classifier itself to define LPIPS during PAT (ablation) | PAT on ResNet-50 · CIFAR-10 | union accuracy: 21.9 -> 27.8 | Helped |
| Use pretrained AlexNet rather than the classifier itself to define LPIPS during PAT (ablation) | PAT on ResNet-50 · CIFAR-10 | accuracy against PPGD: 13.1 -> 26.6 | Helped |
| Use the classifier itself rather than pretrained AlexNet to define LPIPS during PAT (ablation) | PAT on ResNet-50 · ImageNet-100 | union accuracy: 25.5 -> 32.5 | Helped |
| Use the classifier itself rather than pretrained AlexNet to define LPIPS during PAT (ablation) | PAT on ResNet-50 · ImageNet-100 | accuracy against LPA: 1.6 -> 2.4 | Helped |
| Train with PAT rather than L2 adversarial training | ResNet-50 · ImageNet-100 | union accuracy: 12.3 -> 32.5 | Helped |
| Train with PAT rather than L2 adversarial training | ResNet-50 · ImageNet-100 | unseen mean accuracy: 31.5 -> 46.4 | Helped |
| Use LPA rather than the narrow attacks in the perceptual study | Attacks against adversarially trained classifiers · ImageNet-100, medium perceptibility bound | attack success rate: 98.4% | Helped |
| Use LPA rather than PPGD | Attacks against adversarially trained classifiers · ImageNet-100, medium perceptibility bound | attack success rate: 68.6% -> 98.4% | Helped |
Closest papers by meaning
- On the Vulnerability of Adversarially Trained Models Against Two-faced Attacks (ICLR 2024 · similarity 0.89)
- Adversarial Feature Desensitization (NeurIPS 2021 · similarity 0.89)
- Increasing Confidence in Adversarial Robustness Evaluations (NeurIPS 2022 · similarity 0.88)
- How Many Perturbations Break This Model? Evaluating Robustness Beyond Adversarial Accuracy (ICML 2023 · similarity 0.88)
- Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature (AAAI 2025 · similarity 0.87)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.