Research map / Adversarial robustness and security / Certified and empirical robustness
Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Free
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Condition one model on λ and use dual batch normalization to separate clean and adversarial feature statistics | OAT · SVHN test, PGD-7 | SA/RA trade-off: 94.43% SA and 62.16% RA -> 97.07% SA and 37.32% RA as λ varies from 1 to 0.1 | Helped |
| Replace dual BN with normal BN (ablation) | OAT · SVHN test, PGD-7 | SA-RA trade-off: 61.81% to 62.62% RA; SA less than 94% | Hurt |
| Train with a denser λ set S2 instead of sparse S1 (ablation) | OAT · SVHN | SA/RA | Mixed |
| Train on sparse λ values and evaluate at unseen λ values | OAT · SVHN, unseen λ set S3 | SA/RA | Helped |
| Sample λ continuously from [0,1] instead of the sparse discrete set (ablation) | OAT · SVHN | SA/RA: within ±0.2% for SA/RA | No clear effect |
| Use continuous λ sampling rather than the discrete sparse set (ablation) | OAT · SVHN training | epochs to converge: 10% more epochs | Hurt |
| Omit λ=0 during normal-BN training (ablation) | OAT · CIFAR-10, λ>0 | SA/RA: within ±0.5% SA/RA | No clear effect |
| Use normal BN and omit λ=0 instead of using dual BN (ablation) | OAT · CIFAR-10 | best achievable SA: 91.5% -> 93.1% | Hurt |
| Encode λ with RO-16 or RO-128 instead of leaving it unencoded (ablation) | OAT · CIFAR-10 | best achievable SA: 92.53% -> 93.16%; 92.53% -> 93.68% | Helped |
| Increase random orthogonal λ encoding dimension from 16 to 128 (ablation) | OAT · CIFAR-10 | best achievable SA: 93.16% -> 93.68% | Helped |
| Condition on channel width as well as λ | OATS · CIFAR-10, width 0.5, 0.75, and 1.0 | SA-RA trade-off | No clear effect |
Closest papers by meaning
- Bag of Tricks for Adversarial Training (ICLR 2021 · similarity 0.91)
- Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Boosting Adversarial Robustness with CLAT: Criticality Leveraged Adversarial Training (ICML 2025 · similarity 0.88)
- Kernel Learning with Adversarial Features: Numerical Efficiency and Adaptive Regularization (NeurIPS 2025 · similarity 0.88)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.