Research map / Adversarial robustness and security / Certified and empirical robustness
Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add rotation augmentation up to 180 degrees to natural training | StdCNN/VGG16 · CIFAR10 VGG16 | spatial accuracy (%): 33.99$\pm$0.54 -> 83.78$\pm$0.95 | Helped |
| add rotation augmentation up to 180 degrees to natural training | StdCNN/VGG16 · CIFAR10 VGG16 | natural accuracy (%): 92.89$\pm$0.34 -> 85.00$\pm$1.36 | Hurt |
| add rotation augmentation (180) to PGD training | StdCNN/VGG16 · CIFAR10 VGG16 | PGD adversarial accuracy (%): 44.88$\pm$0.22 -> 32.79$\pm$0.73 | Hurt |
| add rotation augmentation (180) to PGD training | StdCNN/VGG16 · CIFAR10 VGG16 | spatial accuracy (%): 33.07$\pm$0.81 -> 53.69$\pm$0.48 | Helped |
| sequential PGD then Aug 180 retraining (no curriculum) (ablation) | StdCNN/VGG16 · CIFAR10 VGG16 | PGD adversarial accuracy (%): 44.88$\pm$0.22 -> 00.00$\pm$0.00 | Hurt |
| sequential Aug 180 then PGD (Aug 0) (ablation) | StdCNN/VGG16 · CIFAR10 VGG16 | spatial accuracy (%): 83.78$\pm$0.95 -> 33.19$\pm$0.33 | Hurt |
| CuSP curriculum instead of PGD (Aug 180) from scratch | StdCNN/VGG16 · CIFAR10 VGG16 | PGD adversarial accuracy (%): 32.79$\pm$0.73 -> 36.01$\pm$0.36 | Helped |
| CuSP curriculum instead of PGD (Aug 180) from scratch | StdCNN/VGG16 · CIFAR10 VGG16 | spatial accuracy (%): 53.69$\pm$0.48 -> 61.41$\pm$0.61 | Helped |
| CuSP instead of sequential Aug 180 -> PGD (Aug 180) | StdCNN/VGG16 · CIFAR10 VGG16 | natural accuracy (%): 60.27$\pm$0.39 -> 66.58$\pm$0.12 | Helped |
| collapse CuSP curriculum to a single stage at 180 (ablation) | CuSP · CIFAR10 VGG16 | spatial accuracy (%): 61.41$\pm$0.61 -> 61.07$\pm$0.43 | Hurt |
| collapse CuSP curriculum to a single stage at 180 (ablation) | CuSP · CIFAR10 VGG16 | PGD adversarial accuracy (%): 36.01$\pm$0.36 -> 33.63$\pm$0.38 | Hurt |
| use only eps 8/255 instead of progressive eps {2,4,8}/255 (ablation) | CuSP · CIFAR10 VGG16 | natural accuracy (%): 64.96$\pm$0.10 -> 58.08$\pm$0.26 | Hurt |
Closest papers by meaning
- Exploring the Landscape of Spatial Robustness (ICML 2019 · similarity 0.93)
- Invariance-inducing regularization using worst-case transformations suffices to boost accuracy and spatial robustness (NeurIPS 2019 · similarity 0.90)
- Provable Adversarial Robustness for Group Equivariant Tasks: Graphs, Point Clouds, Molecules, and More (NeurIPS 2023 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.87)
- Bridging Symmetry and Robustness: On the Role of Equivariance in Enhancing Adversarial Robustness (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.