Research map / Adversarial robustness and security / Certified and empirical robustness
Interpreting Adversarially Trained Convolutional Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Adversarially train with norm-constrained PGD | ResNet-18 classifiers · Stylized Caltech-256 and Stylized Tiny ImageNet | Accuracy on correctly classified images: 16.83 -> 21.10; 7.25 -> 20.51 | Helped |
| Adversarially train with norm-constrained PGD | ResNet-18 classifiers · Caltech-256 low-frequency filtered | Accuracy on correctly classified images: 15.8 -> 71.1 | Helped |
| Adversarially train with norm-constrained PGD | ResNet-18 classifiers · Caltech-256 high-frequency filtered | Accuracy on correctly classified images: 16.5 -> 3.6 | Hurt |
| Adversarially train with norm-constrained PGD | ResNet-18 classifiers · Caltech-256 and Tiny ImageNet, patch-shuffling 2 × 2 | Accuracy on correctly classified images: 84.76 -> 58.13; 66.73 -> 41.08 | Hurt |
| Adversarially train with PGD | ResNet-18 classifiers · CIFAR-10, Tiny ImageNet, and Caltech-256 clean test sets | Accuracy: 94.52 -> 86.27; 72.02 -> 54.42; 83.32 -> 66.41 | Hurt |
| Adversarially train with PGD | ResNet-18 classifiers · CIFAR-10, Tiny ImageNet, and Caltech-256 under PGD attack | Robustness: 0 -> 44.81; 0.01 -> 14.25; 0 -> 31.16 | Helped |
| Increase adversarial-training robustness | Adversarially trained CNNs · Caltech-256, Tiny ImageNet, and CIFAR-10 saturated test sets | Accuracy on correctly classified images: Caltech-256 1024: 20.03 -> 51.91; Tiny ImageNet 1024: 1.93 -> 33.96; CIFAR-10 1024: 31.06 -> 64.64 | Helped |
| Decrease saturation below the original-image level | Adversarially trained and standard CNNs · Saturated image datasets | Accuracy on correctly classified images | No clear effect |
| Use spatially transformed adversarial training instead of norm-constrained perturbations | CNN classifier · PGD robustness and salience-map comparison | Salience-map difference from Standard | No clear effect |
| Increase patch-shuffling severity to 8 × 8 | Standard and adversarially trained CNNs · Caltech-256 and Tiny ImageNet patch-shuffled tests | Accuracy on correctly classified images | No clear effect |
Closest papers by meaning
- Shape or Texture: Understanding Discriminative Features in CNNs (ICLR 2021 · similarity 0.92)
- The Origins and Prevalence of Texture Bias in Convolutional Neural Networks (NeurIPS 2020 · similarity 0.91)
- ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustness (ICLR 2019 · similarity 0.90)
- Shape-Texture Debiased Neural Network Training (ICLR 2021 · similarity 0.89)
- ImageNet-trained CNNs are not biased towards texture: Revisiting feature reliance through controlled suppression (NeurIPS 2025 · similarity 0.88)
- Structured Gradient-based Interpretations via Norm-Regularized Adversarial Training (CVPR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.