Research map / Adversarial robustness and security / Attacks on text and graphs
DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Dual Adversarial Training (DAT), which mixes training images' amplitude spectra with an adversarially optimized Adversarial Amplitude Generator so the model focuses on phase patterns, improving adversarial robustness on CIFAR-10/100 and Tiny ImageNet.
Problem
Adversarial attacks disproportionately corrupt phase patterns of an image's frequency spectrum, so standard adversarial training does not fully exploit robust phase semantics; choosing distractor images for amplitude mix-up is hard.
Approach
An optimized Adversarial Amplitude Generator (AAG) synthesizes an adversarial amplitude spectrum that is mixed with the training sample's amplitude, forcing the robust model to rely on phase patterns; combined with an efficient 5-step AE generation loss (CE + KL) and a JS consistency term between benign and recombined samples.
Key results
- On CIFAR-10 with ResNet-18, DAT reaches 57.55% PGD-20 and 51.36% AA robust accuracy versus 51.30% and 47.63% for PGD-AT.
- On CIFAR-100 with ResNet-18, DAT improves PGD-20 robust accuracy to 33.37% vs 30.83% for the best prior common method (SCARL).
- Averaged over datasets, DAT improves robustness by about 2.1% on CIFAR-10, 2.2% on CIFAR-100, and 2.3% on Tiny ImageNet.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add JS consistency loss between benign and recombined samples (ablation) | DAT · CIFAR-10 | PGD-20 accuracy: 57.06±0.51 -> 57.55±0.15 | Helped |
| add JS consistency loss between benign and recombined samples (ablation) | DAT · CIFAR-100 | PGD-20 accuracy: 32.83±0.47 -> 33.37±0.15 | Helped |
| mix generated and original amplitude instead of replacing original amplitude with generated amplitude (ablation) | DAT · CIFAR-10 | PGD-20 accuracy: 55.64±0.54 -> 57.55±0.15 | Helped |
| mix generated and original amplitude instead of replacing original amplitude with generated amplitude (ablation) | DAT · CIFAR-100 | PGD-20 accuracy: 30.83±0.46 -> 33.37±0.15 | Helped |
| use separate BNs for benign and recombined data (ablation) | DAT · CIFAR-10 | AA accuracy: 46.53±0.32 -> 51.36±0.14 | Helped |
| use separate BNs for benign and recombined data (ablation) | DAT · CIFAR-100 | AA accuracy: 24.91±0.39 -> 27.11±0.15 | Helped |
| use an adversarial amplitude generator instead of selected training-sample amplitudes (ablation) | DAT · CIFAR-10 | PGD-20 accuracy: 55.32±0.62 -> 57.55±0.15 | Helped |
| use an adversarial amplitude generator instead of selected training-sample amplitudes (ablation) | DAT · CIFAR-100 | PGD-20 accuracy: 30.27±0.66 -> 33.37±0.15 | Helped |
Surprising findings
- Standard models completely fail on adversarial examples, while adversarial amplitude mix-up with a random distractor further improves robust phase-level accuracy without hurting amplitude-level robustness.
- A single shared BatchNorm is shown to hinder DAT convergence because BN gammas and betas differ strongly between benign and recombined data.
Limitations
- Mixing amplitude with a generated adversarial amplitude can damage phase patterns and semantic integrity, requiring a mix-up step to retain original amplitude.
- Results are sensitive to the mix-up range parameter mu and to the hyperparameters beta and omega.
- Comparison with complex-strategy methods relies on combining with AWP and SWA.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny ImageNet
Benchmarks: CIFAR-10 CIFAR-100 Tiny ImageNet
Metrics: natural accuracy robust accuracy
Baselines: PGD-AT TRADES MART ST SCARL LAS-AT OA-AT DAJAT
Builds on: PGD-AT TRADES AWP SWA
Closest papers by meaning
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- On Adversarial Training without Perturbing all Examples (ICLR 2024 · similarity 0.89)
- Phase-aware Adversarial Defense for Improving Adversarial Robustness (ICML 2023 · similarity 0.89)
- Improving Adversarial Robustness Requires Revisiting Misclassified Examples (ICLR 2020 · similarity 0.88)
- A Direct Approach to Robust Deep Learning Using Adversarial Networks (ICLR 2019 · similarity 0.88)
- Taxonomy Driven Fast Adversarial Training (AAAI 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.