Research map / Adversarial robustness and security / Certified and empirical robustness
Exploring Adversarial Robustness of Deep State Space Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Evaluates adversarial training on deep SSM variants (S4, DSS, S5, Mega, Mamba) and finds pure SSMs benefit little while attention helps but causes robust overfitting, then proposes a low-cost Adaptive Scaling module that matches attention-level gains without overfitting.
Problem
Adversarial training of deep state space models is poorly understood: it is unclear whether SSM component designs that help standard training also improve adversarial robustness, and how they affect the robustness-generalization trade-off and robust overfitting.
Approach
Empirically compares SSM structural variants under PGD-AT, TRADES, FreeAT, and YOPO, derives output-error bounds for fixed versus input-dependent SSMs under perturbations, and attributes attention's AT gains to adaptive output scaling; proposes a lightweight Adaptive Scaling (AdS) module added after the SSM output.
Key results
- On CIFAR-10, S4 clean accuracy dropped nearly 15% from standard training to PGD-AT; Mega showed the least clean-accuracy degradation among SSMs.
- Mega under PGD-AT on CIFAR-10 reached best RA 40.53% under PGD-10 at epoch 39 but fell to 30.68% at the end, showing robust overfitting.
- Adding AdS with ReLU to DSS under TRADES on CIFAR-10 improved clean accuracy by 4.1% and robust accuracy by 3.97%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add Adaptive Scaling after fixed-parameterized SSMs (ablation) | S4 and DSS · CIFAR-10 | PGD-10 and AA accuracy: more than a 2% improvement in RA | Helped |
| Add ReLU Adaptive Scaling after DSS under TRADES (ablation) | DSS · CIFAR-10 | PGD-10 accuracy: 37.44 -> 41.24 | Helped |
| Add ReLU Adaptive Scaling after DSS under TRADES (ablation) | DSS · CIFAR-10 | AA accuracy: 32.55 -> 37.56 | Mixed |
| Add ReLU Adaptive Scaling after S4 under TRADES (ablation) | S4 · CIFAR-10 | PGD-10 accuracy: 36.00 -> 40.22 | Helped |
| Use Tanh rather than no Adaptive Scaling after S4 under PGD-AT (ablation) | S4 · CIFAR-10 | PGD-10 accuracy: 36.19 -> 39.13 | Helped |
| Add Adaptive Scaling to DSS under TRADES (ablation) | DSS · MNIST | AA accuracy: 89.46 -> 90.34 | Mixed |
| Add ReLU Adaptive Scaling after DSS under YOPO (ablation) | DSS · Tiny-ImageNet | PGD-10 accuracy: 5.28 -> 5.92 | Helped |
| Add ReLU Adaptive Scaling after DSS under FreeAT (ablation) | DSS · Tiny-ImageNet | clean accuracy: 24.32 -> 25.48 | Helped |
| Add Attention to the SSM structure under adversarial training | SSM models · CIFAR-10 | clean and adversarial accuracy: Mega achieves improvements of 4.21% and 2.68% in CA degradation under PGD-AT and TRADES | Helped |
| Add Attention to Mega under PGD-AT | Mega · CIFAR-10 | PGD-10 test accuracy during training: 40.53% -> 30.68% | Hurt |
| Use MIMO-only S5 instead of SISO SSMs with linear layers | S5 · CIFAR-10 | robust accuracy | Hurt |
| Use data-dependent SSM parameterization | Mamba · CIFAR-10 | clean and robust accuracy | Hurt |
Surprising findings
- On MNIST, models trained with PGD-AT showed a marked clean accuracy drop and near-zero AutoAttack robustness, while TRADES did not.
- Mamba's output error under TRADES rose over 40 times on train and test sets, consistent with its input-dependent parameterization causing error explosion.
Limitations
- Experiments are limited to small-scale image and sequence classification models with 2-4 layers and hidden dimension 128.
- YOPO failed to converge on MNIST for all architectures, so its comparison is incomplete.
- AdS was only evaluated on S4 and DSS, and only on the three image datasets.
Experimental setup
Datasets: MNIST CIFAR-10 Tiny-ImageNet
Benchmarks: MNIST CIFAR-10 Tiny-ImageNet
Metrics: clean accuracy robust accuracy under PGD-10 robust accuracy under AutoAttack robust overfitting gap (best vs last) KL divergence and MSE of feature sequences
Baselines: S4 DSS S5 Mega Mamba FreeAT YOPO
Builds on: PGD-AT TRADES S4 Mamba Mega
Closest papers by meaning
- On the Duality Between Sharpness-Aware Minimization and Adversarial Training (ICML 2024 · similarity 0.88)
- Enhancing Adversarial Robustness in SNNs with Sparse Gradients (ICML 2024 · similarity 0.87)
- Robust NAS under adversarial training: benchmark, theory, and beyond (ICLR 2024 · similarity 0.87)
- Explaining the role of Intrinsic Dimensionality in Adversarial Training (ICML 2025 · similarity 0.87)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.86)
- Efficient Adversarial Training in LLMs with Continuous Attacks (NeurIPS 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.