Research map / Adversarial robustness and security / Certified and empirical robustness
Better Safe Than Sorry: Preventing Delusive Adversaries with Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply adversarial training to delusive training data | ResNet-18 · CIFAR-10 P1–P5 and L2C | natural accuracy: 15.70 -> 84.18; 61.35 -> 86.74; 9.40 -> 86.37; 13.58 -> 83.18; 10.12 -> 84.57; 15.76 -> 82.84 | Helped |
| Use FAT instead of standard training | ResNet-18 · CIFAR-10 P1–P5 and L2C | natural accuracy: 15.70 -> 86.05; 61.35 -> 88.98; 9.40 -> 84.39; 13.58 -> 84.22; 10.12 -> 87.78; 15.76 -> 85.51 | Helped |
| Train with random noise within the epsilon-ball instead of adversarial training | ResNet-18 · CIFAR-10 P1–P5 | natural accuracy: 17.32 vs 84.18; 63.36 vs 86.74; 10.52 vs 86.37; 14.37 vs 83.18; 27.56 vs 84.57 | Hurt |
| Increase the defender's adversarial-training budget from too small to an appropriate value (ablation) | ResNet-18 · CIFAR-10 delusive attacks | natural accuracy | Helped |
| Use an overly large defender budget (ablation) | ResNet-18 · CIFAR-10 delusive attacks | natural accuracy | Hurt |
| Add clean examples to the training set (ablation) | ResNet-18 with standard or adversarial training · SVHN | natural accuracy | Helped |
| Use customized AT that perturbs MNIST features while prohibiting CIFAR-feature perturbations (ablation) | VGG-16 · MNIST-randomized test | accuracy: 51.6 -> 91.2 | Helped |
| Use customized AT instead of standard training (ablation) | VGG-16 · MNIST-CIFAR test | test accuracy: 99.9 -> 91.3 | Hurt |
Closest papers by meaning
- Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attacks (AAAI 2021 · similarity 0.91)
- Can Adversarial Training Be Manipulated By Non-Robust Features? (NeurIPS 2022 · similarity 0.90)
- Attacks Which Do Not Kill Training Make Adversarial Learning Stronger (ICML 2020 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Adversaries With Incentives: A Strategic Alternative to Adversarial Robustness (ICLR 2025 · similarity 0.88)
- On the Scalability of Certified Adversarial Robustness with Generated Data (NeurIPS 2024 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.