Research map / Adversarial robustness and security / Certified and empirical robustness

One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancy

ICML 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Regularized defenses against attacks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes DAD, a two-pronged adversarial defense that uses an optimized MMD statistic (MMD-OPT) both to detect adversarial batches and to train a denoiser that minimizes distributional discrepancy plus cross-entropy, improving clean and robust accuracy on CIFAR-10 and ImageNet-1K.

Problem

Statistical adversarial data detection (SADD) methods discard detected adversarial examples, losing useful information, while denoiser-based purification hurts clean accuracy and relies on density estimation; the paper seeks a defense that keeps all inputs and defends against adaptive white-box atta

Approach

Optimize the test power of kernel MMD (MMD-OPT) and use it twice: as a loss term guiding a denoiser to reduce distributional discrepancy between clean and adversarial batches, and as a batch-level discriminator routing detected clean batches straight to the classifier and detected adversarial batches through the denoiser.

Key results

• On CIFAR-10 under adaptive white-box PGD+EOT l_inf (8/255) with WRN-28-10, DAD reports 94.16% clean and 67.53% robust accuracy, exceeding the listed AT and AP baselines on both metrics.
• On ImageNet-1K (l_inf 4/255, RN-50), DAD reports 78.61% clean and 53.85% robust accuracy, versus best AP baseline 71.48% clean and 42.15% robust.
• Against BPDA+EOT on CIFAR-10 (l_inf 8/255), DAD reaches 90.65 average accuracy (87.13% robust), the best among compared methods.

Measured effects reported in the paper

Surprising findings

• Denoiser-only variant achieves higher robust accuracy (71.76%) than denoiser plus MMD-OPT (67.53%) under PGD+EOT l_inf, while the full pipeline gives much higher clean accuracy (94.16% vs 85.07%).
• Varying the MMD-OPT threshold changes l_2 robust accuracy substantially but leaves l_inf results nearly unchanged in several settings.

Limitations

• Requires batches of data (batch size around 100) for MMD-based detection; performance degrades with small batches, and mixed batches of clean and adversarial examples reduce accuracy.
• Relies on adversarial examples generated during training (MMA attack), and the denoiser training uses a pre-trained classifier.

Experimental setup

Datasets: CIFAR-10 ImageNet-1K

Benchmarks: CIFAR-10 ImageNet-1K

Metrics: clean accuracy robust accuracy mixed accuracy

Baselines: MagNet adversarial training methods from RobustBench adversarial purification methods Vanilla AT TRADES MART TRADES-AWP

Builds on: maximum mean discrepancy MagNet DUNET adversarial purification MMD test power optimization

Closest papers by meaning

• Generating Distributional Adversarial Examples to Evade Statistical Detectors (ICML 2022 · similarity 0.89)
• Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks (AAAI 2021 · similarity 0.88)
• Strong Transferable Adversarial Attacks via Ensembled Asymptotically Normal Distribution Learning (CVPR 2024 · similarity 0.87)
• Enhancing the Adversarial Robustness via Manifold Projection (AAAI 2025 · similarity 0.87)
• Detecting Adversarial Data Using Perturbation Forgery (CVPR 2025 · similarity 0.87)
• Adversarial Robustness via Deformable Convolution with Stochasticity (ICML 2025 · similarity 0.86)