Research map / Adversarial robustness and security / Certified and empirical robustness

Adapting to Evolving Adversaries with Regularized Continual Robust Training

ICML 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training recipes · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes continual robust training (CRT), fine-tuning an adversarially trained model on new attacks, and adds an attack-level logit/representation distance regularizer (ALR) to reduce catastrophic forgetting and improve robustness to evolving attacks.

Problem

Robust training defends against specific fixed attack types, but defenders encounter new attacks over time; naive fine-tuning on new attacks can cause loss of robustness to previously seen attacks.

Approach

Fine-tune the defended model sequentially on new attacks (continual robust training) with a regularizer that maximizes the distance between representations/logits of perturbed and clean inputs per attack (ALR), motivated by a generalization bound on adversarial loss gap across attacks (based on Nern et al.).

Key results

• Regularized CRT (ALR) reduces forgetting of previously seen attacks compared with plain fine-tuning across sequences of attacks including L2, L-infinity, StAdv, ReColor and UAR attacks.
• Regularized CRT can outperform training from scratch for multi-attack robustness while being computationally cheaper, as reported on CIFAR-10 and other datasets.

Measured effects reported in the paper

Surprising findings

• EWC did not help in this setting and could hurt final robust accuracy.

Limitations

• Fine-tuning may be insufficient when new attacks differ greatly from known attacks, requiring training from scratch or tailored defenses.
• Model capacity may limit long-term robustness as attack space grows.
• Assumes a monitoring system already detects new attacks; choice of initial attack is not studied.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 ImageNette

Benchmarks: CIFAR-10 CIFAR-100 ImageNette

Metrics: robust accuracy union accuracy clean accuracy

Baselines: FT MAX FT Croce FT Single training from scratch

Builds on: Nern et al. multi-robust learning bound Croce and Hein multiple-attack adversarial training elastic weight consolidation

Closest papers by meaning

• Formulating Robustness Against Unforeseen Attacks (NeurIPS 2022 · similarity 0.89)
• Theory of Continual Learning Against Data Poisoning Attacks (ICML 2026 · similarity 0.88)
• Tuning for Two Adversaries: Enhancing the Robustness Against Transfer and Query-Based Attacks Using Hyperparameter Tuning (AAAI 2026 · similarity 0.88)
• On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.86)
• Efficient Robustness Evaluation via Constraint Relaxation (AAAI 2025 · similarity 0.86)
• Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyond (ICML 2025 · similarity 0.86)