Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Training Should Be Cast as a Non-Zero-Sum Game
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that surrogate-loss zero-sum adversarial training voids robustness guarantees and proposes a non-zero-sum bilevel formulation (BETA attack and BETA-AT training) that avoids robust overfitting and matches AutoAttack.
Problem
Surrogate-loss (cross-entropy) zero-sum adversarial training does not optimize the true adversarial classification error, yielding weak attacks, ineffective defenses, and robust overfitting.
Approach
Decouple the game: the attacker maximizes the continuous negative margin (an exact characterization of misclassification, no relaxation needed), while the defender minimizes a surrogate loss on the margin-selected perturbation, giving a non-zero-sum bilevel formulation solved with generic optimizers.
Key results
- BETA-AT with 10 steps keeps robust accuracy stable at the last checkpoint (PGD40 last 45.00%) while PGD-10 AT drops to 39.45%, showing no robust overfitting.
- On RobustBench top CIFAR-10 models, 30-step BETA with RMSprop lies within 0.03-0.17 points of AutoAttack robust accuracy.
- BETA is reported to be 5.11x faster than AutoAttack on average.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use non-zero-sum BETA-AT instead of standard adversarial training | ResNet-18 · CIFAR-10, PGD$^{40}$ attack on the last checkpoint | test accuracy: 41.55 -> 45.00 | Helped |
| Use non-zero-sum BETA-AT instead of standard adversarial training | ResNet-18 · CIFAR-10, APGD attack on the last checkpoint | test accuracy: 42.90 -> 44.12 | Helped |
| Use BETA instead of AutoAttack for robustness evaluation | CIFAR-10 robust classifiers · CIFAR-10, $\ell_\infty$ robustness | robust test accuracy: 70.78 vs 70.69 | No clear effect |
| Use BETA instead of AutoAttack for evaluation | CIFAR-10 robust classifiers · CIFAR-10 adversarial evaluation | evaluation speed: 5.11 times faster | Helped |
| Train with BETA-AT instead of PGD adversarial training | ResNet-18 · CIFAR-10 robust test accuracy over training | robust test accuracy | Helped |
Surprising findings
- Maximizing the cross-entropy surrogate can fail to find an adversarial example even at its optimum, as shown by a linear three-class counterexample.
- BETA-AT's clean accuracy and robustness trade-off is worse than PGD at best checkpoints, so gains are mainly at the last iterate.
Limitations
- BETA-AT is substantially more computationally expensive than PGD and TRADES training.
- Experiments limited to CIFAR-10 with l_inf budget 8/255 and ResNet-18.
- Best-checkpoint accuracy of BETA-AT is comparable to, not better than, baselines; theoretical consistency properties of BETA are not analyzed.
Experimental setup
Datasets: CIFAR-10
Benchmarks: CIFAR-10 RobustBench
Metrics: robust test accuracy clean accuracy robust overfitting gap wall-clock time
Baselines: FGSM PGD TRADES MART APGD AutoAttack
Builds on: PGD adversarial training TRADES AutoAttack FastAT
Closest papers by meaning
- Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspective (NeurIPS 2023 · similarity 0.90)
- Convergence of Adversarial Training in Overparametrized Neural Networks (NeurIPS 2019 · similarity 0.90)
- Robustness Guarantees for Adversarially Trained Neural Networks (NeurIPS 2023 · similarity 0.90)
- Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionality (NeurIPS 2020 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.