Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Robustness against Multiple and Single $l_p$-Threat Models via Quick Fine-Tuning of Robust Classifiers
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use E-AT, training with the two extreme norms l1 and l∞ rather than all three norms | CIFAR-10 PreAct ResNet-18 trained from random initialization · CIFAR-10 | union robust accuracy: 6.3 -> 42.4 | Helped |
| Use MAX rather than E-AT | CIFAR-10 PreAct ResNet-18 trained from random initialization · CIFAR-10 | union robust accuracy: 42.4 -> 44.0 | Helped |
| Fine-tune an existing l∞-robust RN-18 with E-AT for 3 epochs | RN-18 l∞-AT · CIFAR-10 | union robust accuracy: 7.7 -> 42.2 ± 0.8 | Helped |
| Fine-tune an l∞-robust WRN-70-16 using E-AT | WRN-70-16 l∞ · CIFAR-10 | union robust accuracy: 8.1 -> 51.2 | Helped |
| Fine-tune an l∞-robust WRN-70-16 for l1 robustness | WRN-70-16 l∞ · CIFAR-10 | l1 robust accuracy: 8.1 -> 70.2 | Helped |
| Fine-tune an l∞-robust XCiT-S for l1 robustness | XCiT-S l∞ · ImageNet-1k | l1 robust accuracy: 2.7 -> 33.9 | Helped |
| Use adaptive rather than uniform sampling of l1 and l∞ attacks (ablation) | E-AT fine-tuning of an l2-robust RN-18 · CIFAR-10 | union robust accuracy: 38.9 ± 0.8 -> 39.4 ± 0.7 | Helped |
| Use adaptive rather than uniform sampling of l1 and l∞ attacks (ablation) | E-AT fine-tuning of an l1-robust RN-18 · CIFAR-10 | union robust accuracy: 39.6 ± 0.5 -> 40.3 ± 0.3 | Helped |
| Extend E-AT fine-tuning of RN-18 l∞ from 3 to 5 epochs (ablation) | RN-18 l∞ · CIFAR-10 | union robust accuracy: 41.2 -> 43.1 | Helped |
| Extend E-AT fine-tuning of RN-18 l∞ from 3 to 15 epochs (ablation) | RN-18 l∞ · CIFAR-10 | union robust accuracy: 41.2 -> 43.2 | Helped |
| Start E-AT fine-tuning from a naturally trained rather than an l_p-robust RN-18 (ablation) | RN-18 · CIFAR-10 | union robust accuracy: 41.2 -> 29.8 | Hurt |
| Fine-tune with E-AT instead of SAT | RN-50 l∞-AT · ImageNet-1k | union robust accuracy: 19.4 -> 21.7 | Helped |
Closest papers by meaning
- Large Norms of CNN Layers Do Not Hurt Adversarial Robustness (AAAI 2021 · similarity 0.90)
- Adversarial Robustness Across Representation Spaces (CVPR 2021 · similarity 0.90)
- Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models (NeurIPS 2023 · similarity 0.90)
- RAMP: Boosting Adversarial Robustness Against Multiple $l_p$ Perturbations for Universal Robustness (NeurIPS 2024 · similarity 0.89)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.