Research map / Adversarial robustness and security / Certified and empirical robustness
Robustness Reprogramming for Representation Learning
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes Nonlinear Robust Pattern Matching (LAD-based Newton-IRLS reweighting replacing linear dot products) and three Robustness Reprogramming paradigms that improve adversarial robustness of pretrained MLP, LeNet, and ResNet models, with the frozen-parameter paradigms leaving the original weights unchanged.
Problem
Improving adversarial and noise robustness of a well-trained deep model without modifying its parameters, given that linear pattern matching is highly sensitive to input perturbations.
Approach
Reformulates the linear feature transformation as an ordinary least squares estimate and replaces it with a least-absolute-deviation (LAD) estimate solved by Newton-IRLS, which gives an instance-wise reweighting of the dot product; a hybrid of linear and robust layers with weights lambda is then controlled by three reprogramming paradigms (fixed lambda, learned lambda, full fine-tuning).
Key results
- On MNIST with 3-layer MLP under FGSM, Paradigm 3 raises accuracy at eps=0.3 from 9.1% (adversarial training) to 39.8%, with 86.1% natural accuracy.
- On CIFAR10 with narrow ResNet18, Paradigm 3 reaches 64.03% average robust accuracy across PGD, FGSM, C&W and AutoAttack, above the AWP baseline's 50.45%.
- Paradigm 1 (no tuning) on CIFAR10 ResNet18 trades clean accuracy for robustness, e.g., natural accuracy drops from 67.89% to 40.79% at lambda=0.8.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace LPM with NRPM | 3-layer MLP · MNIST, FGSM ε=0.3 | accuracy: 0.0 -> 21.1 | Helped |
| Tune λ while freezing model parameters instead of using fixed λ | Robustness Reprogramming, 3-layer MLP · MNIST, FGSM ε=0.3 | accuracy: 12.4 -> 20.1 | Helped |
| Tune λ and model parameters instead of tuning λ alone | Robustness Reprogramming, 3-layer MLP · MNIST, FGSM ε=0.3 | accuracy: 20.1 -> 39.8 | Helped |
| Tune λ and model parameters | Robustness Reprogramming, narrow ResNet18 · CIFAR10, PGD ε=32/255 | accuracy: 12.63 -> 30.03 | Helped |
| Tune λ and model parameters rather than use TRADES-0.2 | ResNet18 · CIFAR10, AutoAttack | accuracy: 19.00 -> 64.60 | Helped |
| Tune λ and model parameters rather than use TRADES-0.2 | ResNet18 · CIFAR10, clean | accuracy: 85.74 -> 80.43 | Hurt |
| Replace LPM with NRPM | MLP-Mixer-2 · CIFAR10, PGD ε=8/255 | accuracy: 0.0 -> 15.73 | Helped |
| Replace LPM with NRPM | LeNet · SVHN, PGD ε=32/255 | accuracy: 1.9 -> 11.8 | Helped |
| Replace LPM with NRPM | LeNet · ImageNet10, PGD ε=8/255 | accuracy: 3.89 -> 12.50 | Helped |
| Increase the unrolled iteration count from K=0 to K=4 (ablation) | Hybrid model, 3-layer MLP, λ=0.9 · MNIST, ε=0.3 | accuracy: 0.0 -> 18.0 | Helped |
| Increase the unrolled iteration count from K=0 to K=4 (ablation) | Hybrid model, 3-layer MLP, λ=0.8 · MNIST, ε=0.3 | accuracy: 0.0 -> 22.0 | Helped |
| Increase the unrolled iteration count from K=0 to K=4 (ablation) | Hybrid model, 3-layer MLP, λ=0.7 · MNIST, ε=0.3 | accuracy: 0.0 -> 21.4 | Helped |
Surprising findings
- Paradigm 1 with lambda=1.0 keeps natural accuracy but gives almost no robustness, while lower lambda sharply trades clean accuracy for robustness in deep ResNets.
- Under AutoAttack on CIFAR10 ResNet18 at 8/255, the NRPM variant reaches 51.6% robust accuracy versus 30.5% for the linear baseline, without the clean-accuracy loss seen in Paradigm 1.
Limitations
- Clean accuracy drops for deeper models under the robust layers, especially in Paradigm 1 with ResNets.
- Robust NRPM underperforms under L-infinity attacks on basic MLPs, according to the authors' own note.
- Theoretical analysis covers only a single-step (K=1) influence-function argument with approximations for large D.
Experimental setup
Datasets: MNIST SVHN CIFAR10 ImageNet10
Benchmarks: MNIST SVHN CIFAR10 ImageNet10
Metrics: natural accuracy robust accuracy certified accuracy
Baselines: PGD-AT TRADES MART SAT AWP normal training adversarial training LPM
Builds on: adversarial training MLP-Mixer randomized smoothing
Closest papers by meaning
- Endowing Visual Reprogramming with Adversarial Robustness (ICLR 2025 · similarity 0.90)
- Understanding Robust Learning through the Lens of Representation Similarities (NeurIPS 2022 · similarity 0.89)
- Adversarial Robustness of Supervised Sparse Coding (NeurIPS 2020 · similarity 0.88)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.86)
- Representation-Based Robustness in Goal-Conditioned Reinforcement Learning (AAAI 2024 · similarity 0.86)
- Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.