Research map / Adversarial robustness and security / Certified and empirical robustness
Unlabeled Data Improves Adversarial Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add 500K unlabeled Tiny Images via robust self-training (adversarial) (ablation) | TRADES · CIFAR-10, best l_inf attack eps=8/255 | robust accuracy: 55.4 -> 62.5 ±0.1 | Helped |
| add 500K unlabeled images via stability-based robust self-training (ablation) | stability training baseline · CIFAR-10 certified l_inf eps=2/255 | certified accuracy: 58.6 ± 0.4 -> 63.8 ± 0.5 | Helped |
| use standard self-training instead of robust self-training (ablation) | RST · CIFAR-10, best attack | robust accuracy: 62.5 -> 0 | Hurt |
| standard self-training on unlabeled data | intermediate model · CIFAR-10 | standard accuracy: +0.4% | Helped |
| use virtual adversarial training instead of robust self-training (ablation) | RST · CIFAR-10 | robust accuracy: RST 3-6% higher | Hurt |
| add Cutout or AutoAugment to labeled-data baselines (ablation) | fully supervised robust baselines · CIFAR-10 | robust accuracy | No clear effect |
| reduce relevant fraction of unlabeled data to 50% (ablation) | RST · CIFAR-10 | robust accuracy | Mixed |
| use 100K instead of 500K unlabeled images (ablation) | RST · CIFAR-10 | robust accuracy | Hurt |
| use only 8K labels with 500K unlabeled (ablation) | RST · CIFAR-10 | robust accuracy | No clear effect |
| add 531K unlabeled SVHN extra images via RST (ablation) | adversarial training baseline · SVHN, PG eps=4/255 | robust accuracy: 75.3 ± 0.4 -> 86.0 ± 0.1 | Helped |
| use true labels for SVHN extra data instead of pseudo-labels (ablation) | RSTadv · SVHN, PG eps=4/255 | robust accuracy: 86.0 -> 86.4 | No clear effect |
Closest papers by meaning
- Are Labels Required for Improving Adversarial Robustness? (NeurIPS 2019 · similarity 0.94)
- Adversarial Self-Supervised Contrastive Learning (NeurIPS 2020 · similarity 0.90)
- Robustness to Adversarial Perturbations in Learning from Incomplete Data (NeurIPS 2019 · similarity 0.90)
- Adversarially Robust Generalization Requires More Data (NeurIPS 2018 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.