Research map / Adversarial robustness and security / Certified and empirical robustness
Adversarial Robustness through Local Linearization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use local linearity regularization instead of adversarial training | ResNet-152 · ImageNet, 4/255 | Untargeted adversarial accuracy: 39.70% -> 47.00% | Helped |
| Use local linearity regularization instead of adversarial training | ResNet-152 · ImageNet, 4/255 | PGD steps used for training: 30 -> 2 | Helped |
| Use LLR rather than ADV | ImageNet training on 128 TPUv3 cores · ImageNet, 4/255 | Training wall time: 36 hours -> 7 hours; 5× speed up | Helped |
| Use LLR rather than TRADES(R) | Wide-ResNet-40-8 · CIFAR-10, 8/255 | Multi-Targeted adversarial accuracy: 50.84% -> 52.81% | Helped |
| Increase attack strength from Untargeted to Multi-Targeted | LLR and ADV · CIFAR-10, 8/255 | Adversarial accuracy: LLR: 53.32% -> 51.14% (-2.18%); ADV: 54.43% -> 48.79% (-5.64%) | Mixed |
| Add the gradient magnitude term |δ_LLRᵀ∇xℓ(x)| to γ regularization (ablation) | LLR · CIFAR-10, Wide-ResNet-28-8, 8/255 | Multi-Targeted adversarial accuracy: 49.38% -> 51.13% | Helped |
| Add the gradient magnitude term |δ_LLRᵀ∇xℓ(x)| to γ regularization (ablation) | LLR · ImageNet, ResNet-152, 4/255 | Untargeted adversarial accuracy: 41.30% -> 47.00% | Helped |
| Use LLR with 2 PGD steps instead of 2-step adversarial training (ablation) | Wide-ResNet-28-8 · CIFAR-10, 8/255 | Multi-Targeted adversarial accuracy: 0.00% -> 44.50% | Helped |
| Train LLR using 1 PGD step instead of 2 (ablation) | Wide-ResNet-28-8 · CIFAR-10, 8/255 | Multi-Targeted adversarial accuracy: 44.50% -> 1.60% | Hurt |
| Train adversarially with fewer PGD steps (ablation) | Wide-ResNet-28-10 · CIFAR-10, 8/255 | Multi-Targeted adversarial accuracy: 45.91% (4 steps) -> 0.0% (2 steps); 46.03% (8 steps) | Hurt |
| Increase the ImageNet perturbation radius from 4/255 to 16/255 | LLR · ImageNet, ResNet-152 | Nominal accuracy: 72.70% -> 51.20% | Hurt |
| Increase the ImageNet perturbation radius from 4/255 to 16/255 | LLR · ImageNet, ResNet-152 | Untargeted adversarial accuracy: 47.00% -> 6.10% | Hurt |
Closest papers by meaning
- Improving Adversarial Robustness by Putting More Regularizations on Less Robust Samples (ICML 2023 · similarity 0.92)
- Regularization properties of adversarially-trained linear regression (NeurIPS 2023 · similarity 0.91)
- Implicit Bias of Gradient Descent based Adversarial Training on Separable Data (ICLR 2020 · similarity 0.91)
- Towards Understanding the Regularization of Adversarial Robustness on Neural Networks (ICML 2020 · similarity 0.91)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.90)
- $\sigma$-zero: Gradient-based Optimization of $\ell_0$-norm Adversarial Examples (ICLR 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.