Research map / Adversarial robustness and security / Certified and empirical robustness
Data Augmentation Can Improve Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add CutMix and weight averaging to adversarial training | WRN-70-16 · CIFAR-10 ℓ∞ 8/255, AA+MT | robust accuracy: 57.14% -> 60.07% | Helped |
| Add CutMix to external-data training | WRN-28-10 · CIFAR-10 ℓ∞ 8/255, 500K external images | robust accuracy: 63.05% -> 62.06% | Hurt |
| Add CutMix to external-data training | WRN-70-16 · CIFAR-10 ℓ∞ 8/255, 500K external images | robust accuracy: 65.88% -> 66.56%; +0.68% | Helped |
| Add CutMix to external-data training | WRN-70-16 · CIFAR-10 ℓ2 128/255, 500K external images | robust accuracy: 81.04% -> 82.23%; +1.19% | Helped |
| Exclude Invert, Posterize, and Solarize from RandAugment (ablation) | RandAugment with WA · CIFAR-10 ℓ∞ 8/255, AA+MT | robust accuracy: 55.46% -> 56.51%; +1.05% | Helped |
| Add CutMix to curated RandAugment (ablation) | Curated RandAugment with WA · CIFAR-10 ℓ∞ 8/255, AA+MT | robust accuracy: 58.09%; +0.59% over CutMix alone | Helped |
| Use Invert as the sole RandAugment operation (ablation) | Adversarial training · CIFAR-10 validation, RandAugment N=1 M=3 | robust accuracy delta from median: -6.84% | Hurt |
| Use Invert as the sole RandAugment operation (ablation) | Adversarial training · CIFAR-10 validation, RandAugment N=1 M=5 | robust accuracy delta from median: -5.18% | Hurt |
| Use Posterize as the sole RandAugment operation (ablation) | Adversarial training · CIFAR-10 validation, RandAugment N=1 M=5 | robust accuracy delta from median: -4.20% | Hurt |
| Use Solarize as the sole RandAugment operation (ablation) | Adversarial training · CIFAR-10 validation, RandAugment N=1 M=3 | robust accuracy delta from median: -2.15% | Hurt |
| Apply augmentation before rather than after the adversarial attack (ablation) | Adversarial training with data augmentation · Adversarial training | robust accuracy | Helped |
Closest papers by meaning
- Data augmentation alone can improve adversarial training (ICLR 2023 · similarity 0.93)
- Consistency Regularization for Adversarial Robustness (AAAI 2022 · similarity 0.92)
- AugMax: Adversarial Composition of Random Augmentations for Robust Training (NeurIPS 2021 · similarity 0.90)
- Understanding and Mitigating the Tradeoff between Robustness and Accuracy (ICML 2020 · similarity 0.90)
- Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training (ICML 2024 · similarity 0.88)
- Revisiting Adversarial Training Under Long-Tailed Distributions (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.