Research map / Adversarial robustness and security / Certified and empirical robustness
DAFA: Distance-Aware Fair Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DAFA, a TRADES-based adversarial training method that assigns class-wise loss weights and adversarial margins based on inter-class similarity (softmax class-wise probabilities) to improve worst-class robust accuracy.
Problem
Robust fairness in adversarial training: the accuracy gap between classes widens under adversarial training, with the worst class often confused with similar classes rather than easy ones.
Approach
Instead of penalizing easy classes uniformly, DAFA uses inter-class similarity (average class-wise softmax probabilities on adversarial examples) to shift weights and adversarial margins between a hard class and its neighboring classes, pushing decision boundaries away from the hard class.
Key results
- On CIFAR-10, TRADES+DAFA raises worst-class robust accuracy from 21.31% to 30.53% while average robust accuracy is 49.05% vs 49.80% for TRADES.
- On CIFAR-100, worst robust accuracy improves from 1.33% to 2.33% with average robust accuracy 25.08% vs 25.60% baseline (reported as best rho_rob 0.73).
- On STL-10, worst robust accuracy improves from 7.73% to 10.73% and rho_rob reaches 0.34.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add DAFA to TRADES | TRADES · CIFAR-10 | robust worst accuracy: 21.31 $\pm$ 1.19 -> 30.53 $\pm$ 1.04 | Helped |
| add DAFA to TRADES | TRADES · CIFAR-10 | robust average accuracy: 49.80 $\pm$ 0.18 -> 49.05 $\pm$ 0.14 | No clear effect |
| add DAFA to TRADES | TRADES · CIFAR-100 | robust worst accuracy: 1.33 $\pm$ 0.94 -> 2.33 $\pm$ 0.47 | Helped |
| add DAFA to TRADES | TRADES · CIFAR-100 | robust average accuracy: 25.60 $\pm$ 0.14 -> 25.08 $\pm$ 0.10 | No clear effect |
| add DAFA to TRADES | TRADES · STL-10 | robust worst accuracy: 7.73 $\pm$ 0.99 -> 10.73 $\pm$ 1.31 | Helped |
| add DAFA to TRADES | TRADES · STL-10 | robust average accuracy: 31.36 $\pm$ 0.51 -> 29.98 $\pm$ 0.46 | Hurt |
| add class-wise loss weighting (ablation) | DAFA on TRADES · CIFAR-10 | robust worst accuracy: 21.31 $\pm$ 1.19 -> 28.10 $\pm$ 1.26 | Helped |
| add class-wise adversarial margins (ablation) | DAFA on TRADES · CIFAR-10 | robust worst accuracy: 21.31 $\pm$ 1.19 -> 23.64 $\pm$ 0.85 | Helped |
| combine class-wise loss weighting and adversarial margins (ablation) | DAFA on TRADES · CIFAR-10 | robust worst accuracy: 21.31 $\pm$ 1.19 -> 30.53 $\pm$ 1.04 | Helped |
Surprising findings
- Robust fairness deteriorates as inter-class distance decreases, so the worst class suffers mainly from similar classes rather than from easy classes.
- Class-wise accuracy correlates with class-wise distance but not with class variance in the adversarial setting.
Limitations
- Gains in worst-class accuracy remain small in absolute terms on CIFAR-100 and STL-10 (worst robust accuracy around 2-11%).
- Theoretical analysis uses a simplified binary Gaussian mixture model.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 STL-10
Benchmarks: CIFAR-10 CIFAR-100 STL-10
Metrics: average robust accuracy worst-class robust accuracy rho fairness metric clean accuracy
Baselines: TRADES FRL CFA BAT WAT
Builds on: TRADES FRL CFA PGD adversarial training
Closest papers by meaning
- Towards Fairness-Aware Adversarial Learning (CVPR 2024 · similarity 0.93)
- On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness (ICML 2025 · similarity 0.92)
- On the Fairness ROAD: Robust Optimization for Adversarial Debiasing (ICLR 2024 · similarity 0.91)
- Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillation (NeurIPS 2024 · similarity 0.90)
- Can Private Machine Learning Be Fair? (AAAI 2025 · similarity 0.88)
- Enhancing Robust Fairness via Confusional Spectral Regularization (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.