Research map / Adversarial robustness and security / Certified and empirical robustness
Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace FAT's sign-linearized attack with FBAT's smooth lower-level objective and implicit-gradient update | Fast adversarial training · CIFAR-10, CIFAR-100, and Tiny-ImageNet, PreActResNet-18 | RA-PGD (%): CIFAR-10 ε=16/255: 26.01 -> 27.69; CIFAR-100 ε=16/255: 12.27 -> 13.97; Tiny-ImageNet ε=16/255: 6.79 -> 8.83 | Helped |
| Add the implicit-gradient update rather than using the FATGA baseline | Fast adversarial training · CIFAR-10, PreActResNet-18, ε=16/255 | SA (%): 58.29 -> 68.16 | Helped |
| Use the Hessian in the implicit-gradient calculation (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | Time (s/epoch): 61.4 -> 82.6 | Hurt |
| Use the Hessian in the implicit-gradient calculation (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | RA-PGD (%): 27.69 -> 27.82 | No clear effect |
| Set the attack step 1/λ to 500 (/255), rather than 2500 (/255) (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | RA-PGD (%): 27.69 -> 19.02 | Hurt |
| Set α₂ to 0.008α₁ rather than 0.0125α₁ (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | RA-PGD (%): 27.69 -> 20.53 | Hurt |
| Use uniformly random noise as the linearization point instead of one-step PGD without sign (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | RA-PGD (%): 27.69 -> 21.25 | Hurt |
| Use a random corner as the linearization point instead of one-step PGD without sign (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | RA-PGD (%): 27.69 -> 16.5 | Hurt |
| Use one-step PGD with sign as the linearization point instead of one-step PGD without sign (ablation) | FBAT · CIFAR-10, PreActResNet-18, ε=16/255 | RA-PGD (%): 27.69 -> 19.42 | Hurt |
| Replace FAT with FBAT | Fast adversarial training · ImageNet, ResNet-50, ε=2/255 | RA-PGD (%): 43.43 -> 44.64 | Helped |
Closest papers by meaning
- Understanding and Increasing Efficiency of Frank-Wolfe Adversarial Training (CVPR 2022 · similarity 0.90)
- Adversarial Initialization with Universal Adversarial Perturbation: A New Approach to Fast Adversarial Training (AAAI 2024 · similarity 0.88)
- Taxonomy Driven Fast Adversarial Training (AAAI 2024 · similarity 0.88)
- Adversarial Training Should Be Cast as a Non-Zero-Sum Game (ICLR 2024 · similarity 0.87)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.87)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.