Research map / Adversarial robustness and security / Attacks on text and graphs

Phase and Amplitude-aware Prompting for Enhancing Adversarial Robustness

ICML 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Adversarial prompts for language models

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Phase and Amplitude-aware Prompting (PAP), learning per-class phase-level and amplitude-level prompts with adaptively weighted amplitude prompts and label-based prompt selection at test time to defend classifiers against adversarial attacks.

Problem

Prompt-based adversarial defenses rely on mixed pixel or frequency patterns that do not explicitly capture object-related structure and texture, and existing methods are costly at test time when they traverse all class prompts.

Approach

Decouple images into phase spectra (structure) and amplitude spectra (texture), learn one phase prompt and one amplitude prompt per class, weight the amplitude prompt by the ratio of robust accuracies under amplitude vs. phase prompting, and select prompts by predicted label at test time with a data-prompt mismatching loss.

Key results

• On CIFAR-10 with naturally pre-trained ResNet18, PAP raises AutoAttack robust accuracy from 0.00% to 37.34% and C&W from 0.00% to 80.27%, while natural accuracy drops to 87.12%.
• On CIFAR-10 with AT-trained ResNet18, PAP achieves 52.31% under AutoAttack versus 44.94% for the AT baseline and 45.79% for C-AVP.
• PAP transfers from ResNet18 to WRN28-10, VGG19 and Swin Transformer without retraining, and keeps higher robustness than C-AVP and Freq under AdaA20/AdaA40 adaptive attacks in most settings.

Measured effects reported in the paper

Surprising findings

• Replacing the amplitude spectrum of adversarial examples with the natural amplitude spectrum yields higher robustness on AT models than replacing the phase spectrum, showing the two spectra contribute differently to robustness.
• Removing the weighting strategy reduces average robust accuracy on CIFAR-10 from 59.57% to 57.27%, and on Tiny-ImageNet from 31.39% to 28.70%.

Limitations

• Sacrifices natural accuracy on naturally pre-trained models (e.g., 87.12% vs 94.83% for NAT on CIFAR-10).
• Not evaluated on ImageNet due to limited computational resources; only CIFAR-10 and Tiny-ImageNet are used.
• Prompts could be leaked, and adaptive attack evaluation is limited to AdaA variants with fixed iteration counts.

Experimental setup

Datasets: CIFAR-10 Tiny-ImageNet

Benchmarks: CIFAR-10 Tiny-ImageNet

Metrics: natural accuracy robust accuracy

Baselines: C-AVP Frequency Prompting NAT AT TRADES MART Universal prompts

Builds on: C-AVP Frequency Prompting PGD adversarial training TRADES MART

Closest papers by meaning

• One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models (CVPR 2024 · similarity 0.87)
• DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain (NeurIPS 2024 · similarity 0.87)
• Fight Back Against Jailbreaking via Prompt Adversarial Tuning (NeurIPS 2024 · similarity 0.86)
• TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Models (CVPR 2025 · similarity 0.85)
• AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.84)
• Few-Shot Adversarial Prompt Learning on Vision-Language Models (NeurIPS 2024 · similarity 0.84)