Research map / Adversarial robustness and security / Certified and empirical robustness
On the Convergence and Robustness of Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| FOSC-based dynamic training (gradually decreasing FOSC threshold, weak adversaries early and strong later) | PGD adversarial training on CIFAR-10 (8-layer CNN) · CIFAR-10 white-box | PGD-10 accuracy: 44.39 -> 48.06 | Helped |
| FOSC-based dynamic training | Madry's WideResNet adversarial training on CIFAR-10 · CIFAR-10 WideResNet white-box | PGD-20 accuracy: 45.8 -> 48.70 | Helped |
| FOSC-based dynamic training | PGD adversarial training on MNIST · MNIST white-box | PGD-20 accuracy: 90.62 -> 91.27 | Helped |
| FOSC-based dynamic training | PGD adversarial training on CIFAR-10 (8-layer CNN) · CIFAR-10 black-box | PGD-20 accuracy: 65.60 -> 72.02 | Helped |
| curriculum adversarial training (increasing PGD steps) | WideResNet adversarial training on CIFAR-10 · CIFAR-10 WideResNet white-box | C&W-inf accuracy: 46.8 -> 42.28 | Hurt |
| using weaker FGSM adversaries for the first 20 epochs before PGD (ablation) | PGD-eps/4 adversarial training on CIFAR-10 · CIFAR-10 8-layer CNN | FOSC density in [0,0.1] at later stage: under 30% -> above 35% | Helped |
| training with FGSM-then-PGD (weak early adversaries) instead of PGD from start (ablation) | PGD-eps/4 adversarial training on CIFAR-10 · CIFAR-10 8-layer CNN | final robustness: qualitative: robustness significantly improved per Figure 3b | Helped |
| curriculum adversarial training (increasing PGD steps) | adversarial training on CIFAR-10 (8-layer CNN) · CIFAR-10 white-box | FGSM accuracy: 48.65 -> 50.47 (vs Standard) | Helped |
| Dynamic training vs Curriculum on large-epsilon attacks | adversarial training on CIFAR-10 (8-layer CNN) with varying test epsilon · CIFAR-10 white-box PGD-10 at eps 8/255 | robustness: qualitative: Dynamic better than Curriculum against stronger attacks | Helped |
Closest papers by meaning
- Towards Deep Learning Models Resistant to Adversarial Attacks (ICLR 2018 · similarity 0.89)
- Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (ICML 2020 · similarity 0.89)
- Robustness Guarantees for Adversarially Trained Neural Networks (NeurIPS 2023 · similarity 0.89)
- Finding Actual Descent Directions for Adversarial Training (ICLR 2023 · similarity 0.89)
- Convergence of Adversarial Training in Overparametrized Neural Networks (NeurIPS 2019 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.