Research map / Adversarial robustness and security / Certified and empirical robustness
Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add KL invariance regularization to robust training | ResNet-32 · CIFAR-10 | test grid accuracy: 71.17% to 77.47% | Helped |
| Add KL invariance regularization to robust training | ResNet-32 · SVHN | test grid accuracy: 90.35% to 92.71% | Helped |
| Add invariance regularization to random spatial augmentation | ResNet-32 · SVHN | natural test accuracy: 93.97 to 96.34 | Helped |
| Add invariance regularization to random spatial augmentation | ResNet-32 · CIFAR-10 | natural test accuracy: 89.93 to 87.80 | Hurt |
| Use KL regularization rather than ℓ₂ regularization (ablation) | Regularized robust training · CIFAR-10 | test grid accuracy: 75.64 to 77.34 | Helped |
| Train the loss on robust examples rather than natural examples (ablation) | KL-regularized training with Wo-10 · CIFAR-10 | test grid accuracy: 77.34 to 77.47 | Helped |
| Increase worst-of-k search from k=1 to k=10 (ablation) | KL-regularized training · CIFAR-10 | test grid accuracy: 73.40 to 77.34 | Helped |
| Increase worst-of-k search from k=10 to k=20 (ablation) | KL-regularized training · CIFAR-10 | test grid accuracy: 77.34 to 77.52 | No clear effect |
| Use spatial PGD rather than worst-of-10 search (ablation) | KL-regularized training · CIFAR-10 | test grid accuracy: 77.47 to 78.89 | Helped |
| Use a mixed natural-and-adversarial loss batch rather than a robust-only batch (ablation) | Adversarial training · CIFAR-10 | test grid accuracy: 71.17 to 68.14 | Hurt |
| Use a mixed batch rather than a robust-only batch (ablation) | ALP regularization · CIFAR-10 | test grid accuracy: 75.90 to 75.89 | No clear effect |
| Add random rotations to standard augmentation (ablation) | ResNet-32 · SVHN | natural test accuracy: 95.48 to 93.97 | Hurt |
Closest papers by meaning
- Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks (NeurIPS 2021 · similarity 0.90)
- Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.89)
- Exploring the Landscape of Spatial Robustness (ICML 2019 · similarity 0.89)
- Tilt your Head: Activating the Hidden Spatial-Invariance of Classifiers (ICML 2024 · similarity 0.86)
- Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization (NeurIPS 2025 · similarity 0.86)
- Explaining the role of Intrinsic Dimensionality in Adversarial Training (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.