Research map / Adversarial robustness and security / Certified and empirical robustness
Learning Bregman Divergences with Application to Robustness
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Learns input-convex-network base functions to make Bregman divergences over pixel-space images, then uses mirror-descent attacks in adversarial training to improve robustness to CIFAR-10-C corruptions.
Problem
Pixel-space Lp or LPIPS similarity measures do not match realistic image corruptions, so adversarial training with them fails to improve robustness to contrast and fog corruptions, and no Bregman divergence had been learned end-to-end on raw images.
Approach
Model the Bregman base function as an input convex neural network trained self-supervisedly (with a Bregman softmax loss and a learned approximate inverse mirror map) so that corrupted images are close and noisy images far; use the learned Bregman ball as the threat model and a mirror-descent attack for adversarial training.
Key results
- Mirror-descent AT with the contrast-trained Bregman divergence raises average contrast-corruption accuracy from 63.92% (PGD AT) to 87.40% on CIFAR-10-C.
- The corruption-oblivious BD trained on BAPPS reaches 79.57% on the CNN-based 2AFC category versus 72.10% for LPIPS, and outperforms LPIPS on 5 of 6 categories.
- Learned BD gives mean distance 3.8 for corrupted images versus 8385 for noisy images, with noisy images matched in L2 distance.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use mirror-descent adversarial training with the contrast-trained Bregman divergence instead of L2 PGD adversarial training | PreAct ResNet-18 · CIFAR-10-C Contrast average | accuracy: 63.92 -> 87.40 | Helped |
| Use mirror-descent adversarial training with the zoom-blur-trained divergence instead of L2 PGD adversarial training | PreAct ResNet-18 · CIFAR-10-C Contrast average | accuracy: 63.92 -> 90.03 | Helped |
| Use the BAPPS-trained corruption-oblivious Bregman divergence for adversarial training instead of L2 PGD | PreAct ResNet-18 · CIFAR-10-C Contrast | accuracy: 63.19 -> 77.70 | Helped |
| Use the BAPPS-trained corruption-oblivious Bregman divergence for adversarial training instead of L2 PGD | PreAct ResNet-18 · CIFAR-10-C Fog | accuracy: 77.18 -> 88.00 | Helped |
| Train a Bregman divergence to mimic human perceptual similarity judgments instead of using LPIPS | Image similarity measure · BAPPS 2AFC Traditional, CNN-based, Super Resolution, Video deblur, and Colorization | accuracy: 51.41 -> 63.65; 72.10 -> 79.57; 60.46 -> 61.04; 54.25 -> 56.95; 55.18 -> 61.63 | Helped |
| Train a Bregman divergence to mimic human perceptual similarity judgments instead of using LPIPS | Image similarity measure · BAPPS 2AFC Frame Interpolation | accuracy: 55.55 -> 53.73 | Hurt |
| Use a zoom-blur-trained divergence rather than a contrast-trained divergence for mirror-descent adversarial training | PreAct ResNet-18 · CIFAR-10-C Zoom blur | accuracy: 80.81 -> 79.59 | Hurt |
| Use a corruption-specific Bregman divergence for mirror-descent adversarial training | PreAct ResNet-18 · CIFAR-10-C Contrast, Fog, Zoom blur, and Brightness | accuracy: 63.92 -> 87.40; 77.47 -> 90.87; 85.87 -> 79.59; 91.88 -> 93.31 | Mixed |
Surprising findings
- The learned divergence does not generalize across all corruptions: AT did not improve over prior work on 6 of 10 corruptions with learned BDs, attributed to small ICNN scale.
- BD training failed to converge for 4 of the 14 CIFAR-10-C corruptions, and not for all corruptions simultaneously.
Limitations
- Projection onto the Bregman ball uses a heuristic binary search along a line segment that is not guaranteed optimal.
- Small ICNN scale; BD training failed for some CIFAR-10-C corruptions and AT did not improve on prior work for several corruptions.
- No error bars due to the cost of repeated adversarial training.
Experimental setup
Datasets: CIFAR-10 CIFAR-10-C BAPPS ImageNet
Benchmarks: CIFAR-10-C BAPPS 2AFC
Metrics: accuracy average corruption accuracy across severities 2AFC accuracy noise-vs-corruption distance ratio
Baselines: PGD adversarial training RLAT LPIPS DINO UniCom MoCo v2
Builds on: Bregman divergence mirror descent projected gradient descent adversarial training input convex neural networks LPIPS
Closest papers by meaning
- Bregman Divergence for Stochastic Variance Reduction: Saddle-Point and Adversarial Prediction (NeurIPS 2017 · similarity 0.89)
- Towards Achieving Adversarial Robustness by Enforcing Feature Consistency Across Bit Planes (CVPR 2020 · similarity 0.87)
- Neural Bregman Divergences for Distance Learning (ICLR 2023 · similarity 0.87)
- Deep Divergence Learning (ICML 2020 · similarity 0.86)
- Training on Foveated Images Improves Robustness to Adversarial Attacks (NeurIPS 2023 · similarity 0.86)
- Towards Understanding the Robustness of Diffusion-Based Purification: A Stochastic Perspective (ICLR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.