Research map / Adversarial robustness and security / Certified and empirical robustness
Towards Stable and Efficient Adversarial Training against $l_1$ Bounded Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace coordinate-descent (K-hot SLIDE-style) attack with Euclidean-geometry gradient step (Fast-EG-l1) | one-step l1 adversarial training · CIFAR10, CIFAR100, ImageNet100 | AA robust accuracy (%): 50.27 vs 48.35 (NuAT best baseline) on CIFAR10; 38.03 vs 36.46 on CIFAR100; 46.74 vs 45.82 on ImageNet100 | Helped |
| use multi-epsilon training budget (ϵtrain=2ϵ) instead of ϵtrain=ϵ (ablation) | Fast-EG-l1 · CIFAR10 (ϵ=12) | AA robust accuracy (%): 50.27 vs 38.15 | Helped |
| multi-epsilon training budget larger than ϵ (1.5ϵ to 3ϵ) (ablation) | Fast-EG-l1 · CIFAR10 (ϵ=12) | clean accuracy (%): clean 78.35 at 1.5ϵ vs 70.05 at 3ϵ; large ϵtrain lowers clean accuracy | Hurt |
| add nuclear norm regularization to Fast-EG-l1 with small weight (ablation) | Fast-EG-l1 · CIFAR10, CIFAR100, ImageNet100 | AA robust accuracy (%): CIFAR10 50.27 to 51.37 (λ=1); CIFAR100 38.03 to 39.75 (λ=0.1); ImageNet100 46.74 to 48.82 (λ=0.1) | Helped |
| large nuclear norm regularization weight (λ=3) (ablation) | Fast-EG-l1 + nuclear norm · CIFAR10, CIFAR100 | AA robust accuracy (%): CIFAR10 49.43 and CIFAR100 31.29 at λ=3, below λ=0 | Hurt |
| use coordinate descent with small K (K-hot SLIDE) instead of larger K (ablation) | 10-step SLIDE adversarial training · CIFAR10 (ϵ=12) | AA-free robust accuracy of best checkpoint (%): catastrophic overfitting at small K; e.g. best 27.70 at K=... with step 6.0 and K=20 vs 53.47 at K=100 with step 4.5 | Hurt |
| existing one-step fast AT methods (FreeAT, FGSM-RS, AdaAT, Grad-Align, N-FGSM, ATTA) with small K (ablation) | one-step l1 adversarial training with coordinate descent · CIFAR10 (ϵ=12) | robust accuracy (%): all suffer catastrophic overfitting at small K; best robust accuracies remain below SLIDE | Hurt |
| step size α=√ϵ in Fast-EG-l1 vs 0.5√ϵ, 0.75√ϵ, 1.25√ϵ (ablation) | Fast-EG-l1 · CIFAR10 across ϵ 3 to 24 | AA robust accuracy (%): performance comparable across step sizes close to √ϵ | No clear effect |
Closest papers by meaning
- Understanding and Improving Fast Adversarial Training against $l_0$ Bounded Perturbations (NeurIPS 2025 · similarity 0.92)
- Towards Efficient Training and Evaluation of Robust Models against $l_0$ Bounded Adversarial Perturbations (ICML 2024 · similarity 0.89)
- Uniformly Stable Algorithms for Adversarial Training and Beyond (ICML 2024 · similarity 0.89)
- Stability and Generalization of Adversarial Training for Shallow Neural Networks with Smooth Activation (NeurIPS 2024 · similarity 0.88)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.88)
- Quadratic Upper Bound for Boosting Robustness (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.