Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Training on Purification (AToP): Advancing Both Robustness and Generalization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes AToP, which combines random transforms (masking plus Gaussian noise) with adversarial fine-tuning of a pre-trained generative purifier (DeepFill GAN or AE) using a classifier-derived adversarial loss, achieving state-of-the-art robust accuracy on CIFAR-10/100 and ImageNette.
Problem
Adversarial training generalizes poorly to unseen attacks and hurts clean accuracy, while adversarial purification generalizes but has lower robustness against known attacks; both degrade standard accuracy.
Approach
Decouple adversarial purification into random transforms that destroy perturbation structure and a supervised adversarial fine-tuning of the purifier (classifier frozen) using a classification adversarial loss plus the original generative loss, so the purifier learns to reconstruct robust, correctly classified images.
Key results
- On CIFAR-10 with WideResNet-28-10 under AutoAttack l_inf (eps=8/255), AToP reaches 90.62% standard and 72.85% robust accuracy without extra data, improving robust accuracy by 2.21% over the second-best method without extra data.
- On CIFAR-10 with ResNet-50, AToP achieves 89.1% standard accuracy and 71.2% / 73.4% / 56.4% robust accuracy under AutoAttack l_inf, l_2 and StAdv, outperforming DiffPure and adversarial training baselines.
- Ablation with ResNet-18 on CIFAR-10 shows AToP with RT2 raises PGD-20 robust accuracy from 70.90% to 84.57% (l_inf, eps=8/255).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply AToP rather than DiffPure | ResNet-50 purifier pipeline · CIFAR-10, AutoAttack l∞ (ε=8/255) | robust accuracy: 70.0 -> 71.2 | Helped |
| Apply AToP rather than DiffPure | ResNet-50 purifier pipeline · CIFAR-10, AutoAttack l2 (ε=1) | robust accuracy: 70.9 -> 73.4 | Helped |
| Apply AToP rather than DiffPure | ResNet-50 purifier pipeline · CIFAR-10, StAdv (ε=0.05) | robust accuracy: 55.0 -> 56.4 | Helped |
| Add AToP fine-tuning to RT1 (ablation) | ResNet-18 purifier pipeline · CIFAR-10, FGSM (ε=8/255) | robust accuracy: 16.60 -> 91.99 | Helped |
| Add AToP fine-tuning to RT1 (ablation) | ResNet-18 purifier pipeline · CIFAR-10, PGD-10 (ε=8/255) | robust accuracy: 0.00 -> 43.55 | Helped |
| Add AToP fine-tuning to RT2 (ablation) | ResNet-18 purifier pipeline · CIFAR-10, PGD-10 (ε=8/255) | robust accuracy: 72.27 -> 84.77 | Helped |
| Add AToP fine-tuning to RT3 (ablation) | ResNet-18 purifier pipeline · CIFAR-10, PGD-10 (ε=8/255) | robust accuracy: 70.51 -> 73.05 | Helped |
| Add AToP fine-tuning to RT2 (ablation) | ResNet-34 purifier pipeline · ImageNette, FGSM (ε=8/255) | robust accuracy: 67.19 -> 75.20 | Helped |
| Add AToP fine-tuning to RT2 (ablation) | ResNet-34 purifier pipeline · ImageNette, PGD-10 (ε=8/255) | robust accuracy: 77.34 -> 83.20 | Helped |
| Use stronger random transforms (RT1 to RT2 to RT3) (ablation) | AToP purifier pipeline · CIFAR-10 and ImageNette | standard accuracy | Hurt |
| Use stronger random transforms (RT1 to RT2 to RT3) (ablation) | AToP purifier pipeline · CIFAR-10 and ImageNette | robust accuracy | Helped |
| Use adversarial examples rather than clean examples for AToP training (ablation) | GAN-based purifier · CIFAR-10 and ImageNette | robust accuracy | Helped |
Surprising findings
- Random transforms alone (without AToP fine-tuning) on RT1 yield 0% PGD robustness, showing the purifier needs adversarial fine-tuning to be robust.
- Stronger random transforms (RT3) destroy more perturbations but lose semantic information, lowering standard accuracy and capping robust accuracy.
Limitations
- Training cost grows with purifier complexity; diffusion purifier fine-tuning is far slower (144 min vs 62 s).
- Stronger random transforms trade off standard accuracy against robustness, limiting further robustness gains.
- Robust evaluation uses only 512 randomly selected test images, following guidance from prior work.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNette
Benchmarks: AutoAttack l_inf AutoAttack l_2 StAdv FGSM PGD CW RobustBench
Metrics: standard accuracy robust accuracy
Baselines: PAT-self Adv. CRAIG DiffPure RobustBench AT entries Adv. Training with l_inf Adv. Training with all
Builds on: adversarial purification DeepFill PAT EOT BPDA
Closest papers by meaning
- Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSM (CVPR 2024 · similarity 0.90)
- Instant Adversarial Purification with Adversarial Consistency Distillation (CVPR 2025 · similarity 0.90)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.88)
- Adversarial Purification with the Manifold Hypothesis (AAAI 2024 · similarity 0.88)
- DiffHammer: Rethinking the Robustness of Diffusion-Based Adversarial Purification (NeurIPS 2024 · similarity 0.87)
- Conserve-Update-Revise to Cure Generalization and Robustness Trade-off in Adversarial Training (ICLR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.