Research map / Adversarial robustness and security / Certified and empirical robustness
Why adversarial training can hurt robust accuracy
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| adversarial training with budget matched to test attack (directed attacks) | linear max-margin classifier on noiseless separable data · synthetic linear model, small sample size n<d-1 | robust error | Hurt |
| adversarial training with directed (signal-direction) attacks | ResNet18 on subsampled CIFAR10 with 2x2 mask attack · CIFAR10 mask attack, small sample size | robust error | Hurt |
| adversarial training with adversarial illumination budget | ResNet50 on Waterbirds · Waterbirds adversarial illumination, n=20 | robust error | Hurt |
| larger sample size (n=50 vs n=20) with adversarial training | Waterbirds with adversarial training · Waterbirds motion blur / illumination | robust error | Helped |
| stronger adversarial search during training (more mask locations K) (ablation) | adversarial training with mask attacks · CIFAR10 mask attack, small sample size | robust error | Hurt |
| weaker adversarial attack during training | adversarial training for directed attacks · low-sample regime, directed attacks | robust error | Helped |
| adversarial training increases standard error more than susceptibility decreases | adversarial logistic regression / Waterbirds motion blur n=20 · Waterbirds n=20 robust error decomposition | susceptibility vs standard error | Mixed |
| standard regularization (early stopping) added to adversarial training | adversarial training for directed attacks · small sample regime | robust error | No clear effect |
Closest papers by meaning
- Adversarially Robust Generalization Requires More Data (NeurIPS 2018 · similarity 0.91)
- Robustness May Be at Odds with Accuracy (ICLR 2019 · similarity 0.91)
- Adversarial vulnerability for any classifier (NeurIPS 2018 · similarity 0.91)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.90)
- Theoretical Understanding of Learning from Adversarial Perturbations (ICLR 2024 · similarity 0.89)
- Wide Two-Layer Networks can Learn from Adversarial Perturbations (NeurIPS 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.