Research map / Adversarial robustness and security / Certified and empirical robustness
Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspective
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's title only (no summary yet). Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply learning-rate decay during adversarial training (ablation) | PGD-AT · CIFAR-10 | test robust accuracy | Hurt |
| Use stronger training perturbations after learning-rate decay (ablation) | PGD-AT · CIFAR-10, PreActResNet-18 | AutoAttack best robust accuracy: 49.89 -> 50.89 -> 50.99 | Helped |
| Increase training perturbation budget to ε=16/255 (ablation) | PGD-AT · CIFAR-10, PreActResNet-18 | AutoAttack best robust accuracy: 50.99 -> 49.58 | Hurt |
| Add the BoAT KL prediction-alignment loss (ablation) | adversarial training with online and weight-averaged models · CIFAR-10 | best-epoch robust accuracy | Helped |
| Use a smaller learning-rate decay factor (d=2 rather than d=10) (ablation) | WA adversarial training · CIFAR-10 | best test robustness | Helped |
| Combine BoAT with a smaller learning-rate decay factor (ablation) | ReBAT · CIFAR-10, CIFAR-100, Tiny-ImageNet | robust overfitting | Helped |
| Add the stronger training attacker to ReBAT (ablation) | ReBAT++ · CIFAR-10 | natural accuracy: 81.86 -> 78.71 | Hurt |
| Add CutMix to ReBAT (ablation) | ReBAT · CIFAR-10, WideResNet-34-10 | AutoAttack final robust accuracy: 54.80 -> 55.72 | Helped |
| Add CutMix to ReBAT (ablation) | ReBAT · CIFAR-10, PreActResNet-18 | AutoAttack final robust accuracy: 51.22 -> 50.22 | Hurt |
| Extend ReBAT+CutMix training from 200 to 500 epochs (ablation) | ReBAT+CutMix · CIFAR-10, PreActResNet-18 | AutoAttack final robust accuracy: 50.22% to 51.32% | Helped |
| Extend WA+CutMix training from 200 to 500 epochs (ablation) | WA+CutMix · CIFAR-10, PreActResNet-18 | AutoAttack final robust accuracy: 49.59% (200 epochs) v.s. 49.70% (500 epochs) | No clear effect |
| Increase the strength of injected non-robust training features (ablation) | adversarial training with learning-rate decay · synthetic training data | test robust accuracy | Hurt |
Closest papers by meaning
- Adversarial Training Should Be Cast as a Non-Zero-Sum Game (ICLR 2024 · similarity 0.90)
- Taming the Long Tail: Rebalancing Adversarial Training via Adaptive Perturbation (CVPR 2026 · similarity 0.90)
- Conserve-Update-Revise to Cure Generalization and Robustness Trade-off in Adversarial Training (ICLR 2024 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
- The Effectiveness of Random Forgetting for Robust Generalization (ICLR 2024 · similarity 0.88)
- Revisiting Adversarial Training Under Long-Tailed Distributions (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.