Research map / Adversarial robustness and security / Certified and empirical robustness
Revisiting Adversarial Training for ImageNet: Architectures, Training and Generalization across Threat Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace PatchStem with ConvStem (ablation) | ImageNet-1k adversarially trained ConvNeXt-T · ImageNet-1k | ℓ2 robust accuracy: 28.9 -> 40.2 | Helped |
| Replace PatchStem with ConvStem (ablation) | ImageNet-1k adversarially trained ViT-S · ImageNet-1k | ℓ∞ robust accuracy: 31.8 -> 34.4 | Helped |
| Initialize adversarial training with strong clean pre-training (ablation) | ConvNeXt-T + ConvStem · ImageNet-1k | ℓ∞ robust accuracy: 37.6 -> 42.2 | Helped |
| Add heavy augmentations after strong clean pre-training (ablation) | ConvNeXt-T + ConvStem · ImageNet-1k | ℓ∞ robust accuracy: 42.2 -> 47.5 | Helped |
| Add heavy augmentations after strong clean pre-training (ablation) | ViT-S + ConvStem · ImageNet-1k | ℓ∞ robust accuracy: 44.3 -> 44.0 | Hurt |
| Train for 300 instead of 50 epochs (ablation) | ViT-S + ConvStem · ImageNet-1k | ℓ∞ robust accuracy: 44.0 -> 48.1 | Helped |
| Use 1-step instead of 2-step APGD (ablation) | ConvNeXt-T + ConvStem with pre-training and heavy augmentation · ImageNet-1k | ℓ∞ robust accuracy: 47.5 -> 46.4 | Hurt |
| Use 3-step instead of 2-step APGD (ablation) | ConvNeXt-T + ConvStem · ImageNet-1k | ℓ∞ robust accuracy: 49.5 -> 50.2 | Helped |
| Replace PatchStem with ConvStem (ablation) | InternImage-T · ImageNet-1k | ℓ2 robust accuracy: 47.2 -> 48.5 | Helped |
| Replace APGD with PGD for training (ablation) | ConvNeXt-T, 2-step training · ImageNet-1k | ℓ∞ robust accuracy: 45.4 -> 46.5 | Hurt |
| Increase test-time resolution from 224 to 256 (ablation) | ConvNeXt-B + ConvStem · ImageNet-1k, ε∞=4/255 | ℓ∞ robust accuracy: 56.1 -> 57.3 | Helped |
| Increase test-time resolution from 224 to 288 (ablation) | ConvNeXt-B + ConvStem · ImageNet-1k, ε∞=8/255 | ℓ∞ robust accuracy: 30.4 -> 29.8 | Hurt |
Closest papers by meaning
- When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecture (NeurIPS 2022 · similarity 0.91)
- Exploring the Relationship Between Architectural Design and Adversarially Robust Generalization (CVPR 2023 · similarity 0.91)
- Vision Transformers Beat WideResNets on Small Scale Datasets Adversarial Robustness (AAAI 2025 · similarity 0.90)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
- Revisiting Adversarial Training at Scale (CVPR 2024 · similarity 0.88)
- Explaining the role of Intrinsic Dimensionality in Adversarial Training (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.