Research map / Adversarial robustness and security / Certified and empirical robustness
Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes PART, which uses CAM-identified important pixels to keep the full l_inf adversarial budget there while shrinking it for the rest during AE generation, improving natural accuracy with little robustness loss on CIFAR-10, SVHN and TinyImageNet-200.
Problem
Standard adversarial training assigns the same l_inf perturbation budget to every pixel, which ignores that pixels differ in influence on model outputs, and AT typically trades off natural accuracy against robustness.
Approach
Use CAM (GradCAM) maps to split pixels into important and less important sets, keep budget epsilon for important pixels and reduce it to epsilon_low (default epsilon-1/255) for the rest via an element-wise mask in PGD, then train with existing AT objectives (AT, TRADES, MART) on these pixel-reweighted adversarial examples; a burn-in of 20 epochs of plain AT precedes it.
Key results
- On CIFAR-10 with ResNet-18, PART-M (s=10) improves natural accuracy from 76.82% to 80.00% over MART (+3.18%) with PGD-20 changing by -0.15%.
- On SVHN, PART-T (s=1) raises natural accuracy by 2.44% over TRADES with PGD-20 robustness up 0.59%.
- On TinyImageNet-200, PART (s=10) improves natural accuracy by 2.08% over AT (43.51% to 45.59%) with PGD-20 robustness up 0.11%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use pixel-reweighted adversarial training instead of AT | ResNet-18 · CIFAR-10 | Natural accuracy: 82.58 $\pm$ 0.14 -> 83.42 $\pm$ 0.26 | Helped |
| Use pixel-reweighted adversarial training instead of AT | ResNet-18 · CIFAR-10 | PGD-20 accuracy: 43.69 $\pm$ 0.28 -> 43.65 $\pm$ 0.16 | No clear effect |
| Integrate pixel reweighting with TRADES | ResNet-18 · CIFAR-10 | Natural accuracy: + 1.20 | Helped |
| Integrate pixel reweighting with TRADES | ResNet-18 · SVHN | AA accuracy: 52.21 $\pm$ 0.47 -> 53.07 $\pm$ 0.67 | Helped |
| Integrate pixel reweighting with MART | WideResNet-34-10 · TinyImagenet-200 | AA accuracy: 13.42 $\pm$ 0.16 -> 13.68 $\pm$ 0.13 | Helped |
| Use PART instead of AT against the adaptive attack | ResNet-18 · CIFAR-10 | Adaptive PGD-100 accuracy: 36.72 $\pm$ 0.04 -> 36.84 $\pm$ 0.07 | Helped |
| Lower epsilon-low while holding epsilon at 12/255 (ablation) | PART · Image classification (dataset not specified for the figure) | Natural accuracy | Helped |
| Lower epsilon-low while holding epsilon at 12/255 (ablation) | PART · Image classification (dataset not specified for the figure) | Adversarial robustness | Hurt |
| Lower epsilon-low to 11/255 or 10/255 when epsilon is 12/255 (ablation) | PART · Image classification (dataset not specified for the figure) | Natural accuracy | Helped |
| Change the mask save frequency from s = 1 to s = 10 (ablation) | PART and its TRADES/MART variants · CIFAR-10, SVHN, and TinyImagenet-200 | Adversarial robustness: PART-M (s = 1) AA: 45.19 $\pm$ 0.04 -> PART-M (s = 10) AA: 44.61 $\pm$ 0.24 | Mixed |
| Replace GradCAM with XGradCAM or LayerCAM (ablation) | PART · Image classification (Appendix experiments) | Performance | No clear effect |
| Vary the number of attack iterations (ablation) | PART-based methods · Image classification (Appendix experiments) | Performance | No clear effect |
Surprising findings
- Moving a single 6/255 budget region to a different location, with the same overall budget, raised both natural accuracy and adversarial robustness, suggesting pixel-level budget allocation can help both at once.
Limitations
- Default epsilon_low = epsilon - 1/255 is set heuristically without a search algorithm.
- Theoretical analysis is limited to a 2D linear toy model and does not cover the effect of pixel importance on AT dynamics.
- Under adaptive PGD and adaptive MMA attacks, robustness drops overall, and gains are modest on some metrics such as AA for PART-M.
Experimental setup
Datasets: CIFAR-10 SVHN TinyImageNet-200
Benchmarks: CIFAR-10 SVHN TinyImageNet-200 CIFAR-10-C
Metrics: natural accuracy PGD-20 robust accuracy MMA accuracy AutoAttack accuracy adaptive PGD robustness
Baselines: AT TRADES MART MMA GAIRAT
Builds on: adversarial training TRADES MART GradCAM PGD
Closest papers by meaning
- Geometry-aware Instance-reweighted Adversarial Training (ICLR 2021 · similarity 0.90)
- On Adversarial Training without Perturbing all Examples (ICLR 2024 · similarity 0.89)
- Bag of Tricks for Adversarial Training (ICLR 2021 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Doubly Robust Instance-Reweighted Adversarial Training (ICLR 2024 · similarity 0.88)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.