Research map / Adversarial robustness and security / Certified and empirical robustness
Doubly Robust Instance-Reweighted Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DONE, a doubly robust instance-reweighted adversarial training framework that sets instance weights via KL-regularized DRO, cast as a compositional bilevel problem solved by a new CID algorithm with convergence guarantees.
Problem
Instance-reweighted adversarial training relies on heuristic weights without theoretical grounding, and adversarial training yields highly non-uniform robustness across classes (weak classes/imbalanced data).
Approach
Determine instance weights by maximizing a KL-regularized weighted adversarial loss (DRO), which yields a compositional bilevel objective (log-sum-exp outer over inner attack problems); a log-barrier penalty makes the inner solution differentiable so implicit differentiation applies, solved by Compositional Implicit Differentiation (CID) with running averages of the composed function.
Key results
- On balanced CIFAR10, DONE-PGD reaches 58.71% RA-PGD vs 49.29% for AT and 54.81% for GAIRAT, with RA-Tail-30 of about 40% vs 28.35% for AT.
- On imbalanced CIFAR10 (0.2 ratio), DONE-GD reaches 48.29% RA-PGD and 17.19% RA-Tail-30 versus 42.37% and 6.25% for AT.
- Under fast AT setting on CIFAR10, DONE gets 55.17% RA-PGD and 37.13% RA-Tail-30 versus 49.13% and 26.05% for Fast-BAT.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use DONE-PGD instead of MAIL | Adversarial training on CIFAR10 balanced · CIFAR10 balanced | RA-PGD: 55.12 -> 58.71 | Helped |
| use DONE-GD instead of AT | Adversarial training on CIFAR10 balanced · CIFAR10 balanced | RA-AA: 45.22 -> 45.58 | Helped |
| use DONE-GD instead of MAIL | Adversarial training on CIFAR10 unbalanced (0.2) · CIFAR10 unbalanced (0.2) | RA-PGD: 45.64 -> 48.29 | Helped |
| use DONE-GD instead of GAIRAT | Adversarial training on CIFAR10 unbalanced (0.2) · CIFAR10 unbalanced (0.2) | RA-Tail-30: 16.9 -> 17.19 | Helped |
| use DONE-PGD instead of MAIL | Adversarial training on SVHN balanced · SVHN balanced | RA-Tail-30: 52.23 -> 55.84 | Helped |
| use DONE-ADAM instead of AT | Adversarial training on SVHN balanced · SVHN balanced | RA-AA: 46.27 -> 49.13 | Helped |
| use DONE-ADAM instead of GAIRAT | Adversarial training on SVHN unbalanced (0.2) · SVHN unbalanced (0.2) | RA-PGD: 53.79 -> 55.90 | Helped |
| use DONE-PGD instead of MAIL | Adversarial training on STL10 · STL10 | RA-PGD: 38.20 -> 40.23 | Helped |
| use DONE-ADAM instead of MAIL | Adversarial training on STL10 · STL10 | RA-AA: 32.86 -> 34.59 | Helped |
| use DONE-PGD instead of AT | Adversarial training on GTSRB · GTSRB | RA-AA: 57.83 -> 57.25 | Hurt |
| use DONE-PGD instead of DONE-ADAM for the inner-loop optimizer (ablation) | DONE on CIFAR10 balanced · CIFAR10 balanced | RA-PGD: 58.51 -> 58.71 | Helped |
| use DONE-GD instead of DONE-PGD for the inner-loop optimizer (ablation) | DONE on CIFAR10 unbalanced (0.2) · CIFAR10 unbalanced (0.2) | RA-PGD: 48.13 -> 48.29 | Mixed |
Surprising findings
- Instance-reweighted heuristic baselines (GAIRAT, MAIL, WMMR) achieve lower AutoAttack robustness than standard AT despite higher PGD robustness, suggesting heuristic weights overfit to PGD metrics.
Limitations
- Convergence analysis relies on strong convexity and smoothness assumptions that do not hold for deep ReLU networks; the Hessian term is neglected in practice.
- Requires multiple inner PGD steps and tuning of the KL regularization schedule r and log-barrier constant c.
- Gains on SVHN RA-PGD are modest and the method's SA is sometimes lower than baselines (e.g., 79.17 SA in fast AT setting).
Experimental setup
Datasets: CIFAR10 SVHN STL10 GTSRB
Benchmarks: CIFAR10 SVHN STL10 GTSRB AutoAttack
Metrics: standard accuracy robust accuracy under PGD-20 robust accuracy under AutoAttack RA-Tail-30 (robust accuracy on 30% most vulnerable classes)
Baselines: AT FAT WMMR MAIL GAIRAT Fast-AT Fast-AT-GA Fast-BAT
Builds on: GAIRAT TRADES Projected gradient descent adversarial training Stochastic compositional gradient descent (SCGD) Approximate implicit differentiation for bilevel optimization
Closest papers by meaning
- Geometry-aware Instance-reweighted Adversarial Training (ICLR 2021 · similarity 0.91)
- Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks (AAAI 2021 · similarity 0.89)
- Improving Adversarial Robustness with Self-Paced Hard-Class Pair Reweighting (AAAI 2023 · similarity 0.89)
- Bag of Tricks for Adversarial Training (ICLR 2021 · similarity 0.88)
- Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training (ICML 2024 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.