Research map / Adversarial robustness and security / Certified and empirical robustness
Efficient and Effective Augmentation Strategy for Adversarial Training
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add complex augmentation branch (AutoAugment) with split BN and JS loss to TRADES-AWP-style training | DAJAT vs TRADES-AWP-WA · CIFAR-10 ResNet-18 | AutoAttack robust accuracy: 49.67 -> 51.48 | Helped |
| add DAJAT to TRADES-AWP-WA | CIFAR-100 ResNet-18 · CIFAR-100 | clean accuracy: 59.88 -> 66.84 | Helped |
| add DAJAT to TRADES-AWP-WA | ImageNette ResNet-18 · ImageNette | AutoAttack robust accuracy: 56.89 -> 62.31 | Helped |
| train with AutoAugment instead of Base augmentations in plain adversarial training (ablation) | ACAT · CIFAR-10 ResNet-18 | robust accuracy (no-aug test): 50.00 -> 48.11 | Hurt |
| add JS divergence term (ablation) | DAJAT (Base, 3*AA) · CIFAR-10 ResNet-18 | clean accuracy: 85.31 -> 86.67 | Helped |
| add JS divergence term (ablation) | DAJAT (Base, AA) · CIFAR-10 ResNet-18 | robust accuracy: 51.45 -> 51.27 | No clear effect |
| use separate BN layers per augmentation instead of single BN (ablation) | DAJAT (Base, 3*AA) · CIFAR-10 ResNet-18 | GAMA robust accuracy: 43.57 -> 51.81 | Helped |
| add JS term when using single BN (ablation) | DAJAT single BN · CIFAR-10 ResNet-18 | GAMA robust accuracy: 4.20 -> 43.57 | Helped |
| mix simple and complex augmentations instead of two complex only (ablation) | DAJAT · CIFAR-10 ResNet-18 | clean accuracy: 84.68 -> 85.60 | Helped |
| mix simple and complex augmentations instead of two simple only (ablation) | DAJAT · CIFAR-10 ResNet-18 | clean accuracy: 83.93 -> 85.60 | Helped |
| increase number of AutoAugment instances from 2 to 3 (ablation) | DAJAT · CIFAR-10 ResNet-18 | AutoAttack robust accuracy: 51.48 -> 51.56 | No clear effect |
| replace 10-step TRADES-AWP with 2-step ACAT (increasing epsilon, cosine LR) | adversarial training · CIFAR-10 ResNet-18 | AutoAttack robust accuracy: 49.87 -> 49.80 | Mixed |
Closest papers by meaning
- Data augmentation alone can improve adversarial training (ICLR 2023 · similarity 0.91)
- AugMax: Adversarial Composition of Random Augmentations for Robust Training (NeurIPS 2021 · similarity 0.91)
- Adversarial AutoAugment (ICLR 2020 · similarity 0.90)
- Jointly Optimize Data Augmentation and Network Training: Adversarial Data Augmentation in Human Pose Estimation (CVPR 2018 · similarity 0.89)
- Rethinking Invariance Regularization in Adversarial Training to Improve Robustness-Accuracy Trade-off (ICLR 2025 · similarity 0.87)
- Revisiting Adversarial Training at Scale (CVPR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.