Research map / Adversarial robustness and security / Certified and empirical robustness
Enhancing Robust Fairness via Confusional Spectral Regularization
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Derives a PAC-Bayesian robust generalization bound for worst-class robust error via the spectral norm of the empirical robust confusion matrix, and proposes a differentiable surrogate regularizer on that spectral norm to improve robust fairness in adversarial training and fine-tuning.
Problem
Robust fairness: adversarially trained DNNs show large variation in robust accuracy across classes, and explicit class reweighting based on training-set robust performance fails to transfer to the test set.
Approach
A PAC-Bayesian bound shows worst-class robust error is controlled by the spectral norm of the empirical robust margin confusion matrix plus a model/data complexity term; the paper regularizes that spectral norm directly using a differentiable KL-based surrogate matrix instead of explicit class reweighting.
Key results
- On CIFAR-10 l_inf with WRN-34-10 fine-tuning, Ours(gamma=0.0) raises worst-class AA accuracy from 23.20% (TRADES) to 36.30%, versus 35.40% for FRL-RWRM_0.05 and FAAL_AWP.
- Training Preact-ResNet18 from scratch on CIFAR-10 under l_inf with TRADES base, Ours(gamma=0.1) achieves worst-class AA of 34.90% vs 33.60% for FAAL_TRADES and 20.70% for TRADES.
- On CIFAR-10 l_2 DDPM-data fine-tuning with WRN-70-16, worst-class clean accuracy improves from 89.30% to 91.30% while average clean accuracy drops slightly (95.54 to 94.98).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add confusional spectral regularization | WRN-34-10 fine-tuning from TRADES · CIFAR-10 ℓ∞, AutoAttack | worst-class accuracy: 35.30 -> 36.30 | Helped |
| add confusional spectral regularization with γ=0.1 | WRN-34-10 fine-tuning from TRADES-AWP · CIFAR-10 ℓ∞, AutoAttack | worst-class accuracy: 37.00 -> 37.60 | Helped |
| add confusional spectral regularization with γ=0.1 | DDPM-pretrained WRN models · CIFAR-10 ℓ∞, AutoAttack worst-class accuracy | worst-class accuracy: 33.80 -> 37.80; 35.10 -> 39.30 | Helped |
| add confusional spectral regularization with γ=0.1 | DDPM-pretrained WRN models · CIFAR-10 ℓ2, AutoAttack worst-class accuracy | worst-class accuracy: 64.50 -> 67.80; 67.00 -> 69.70 | Helped |
| add confusional spectral regularization with γ=0.1 | DDPM-pretrained WRN-28-10 · Tiny-ImageNet ℓ∞, AutoAttack | worst-class accuracy: 0.00 -> 4.00 | Helped |
| add confusional spectral regularization with γ=0.1 | Preact-ResNet18 trained from scratch · CIFAR-10 ℓ∞, AutoAttack | worst-class accuracy: 33.60 -> 34.90 | Helped |
| add confusional spectral regularization with γ=0.1 | Preact-ResNet18 trained from scratch · CIFAR-100 ℓ∞, AutoAttack | worst-class accuracy: 3.00 -> 4.00 | Helped |
| add confusional spectral regularization | WRN-34-10 fine-tuning from TRADES · CIFAR-10 ℓ∞, PGD-20 | worst-class accuracy: 43.30 -> 44.60 | Helped |
| add confusional spectral regularization with γ=0.1 | WRN-34-10 fine-tuning from TRADES-AWP · CIFAR-10 ℓ∞, CW-20 | worst-class accuracy: 40.10 -> 41.80 | Helped |
| add confusional spectral regularization with γ=0.1 | Preact-ResNet18 trained from scratch · CIFAR-10 ℓ2, AutoAttack | worst-class accuracy: 46.40 -> 48.40 | Helped |
| remove spectral regularization (α=0.0) (ablation) | Preact-ResNet18 trained from scratch with γ=0.0 · CIFAR-10 ℓ∞, AutoAttack | worst-class accuracy: 33.80 -> 12.90 | Hurt |
| increase α from 0.0 to 0.3 with γ=0.0 (ablation) | Preact-ResNet18 trained from scratch · CIFAR-10 ℓ∞, AutoAttack | worst-class accuracy: 12.90 -> 33.80 | Helped |
Surprising findings
- Training-set worst-class robust performance does not consistently align with test-set worst-class performance, and explicit reweighting methods (FRL, FAAL) can exacerbate this divergence.
- Reported 'worst-class' robust gains come with small drops in average accuracy in several fine-tuning settings (e.g., WRN-34-10 AWP AA drops from 56.18 to 54.65 in the Ours row).
Limitations
- Regularizer relies on a heuristic sign approximation of discrete confusion-matrix gradients, lacking formal guarantees.
- The bound's constant nu is only empirically checked via random confusion matrices, and bound constants involve O(.) terms without explicit tightness evaluation.
- Worst-class robust accuracy remains low in absolute terms (e.g., 0-4% on Tiny-ImageNet under AA).
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny-ImageNet ImageNet DDPM-generated data (1M/50M)
Benchmarks: CIFAR-10 CIFAR-100 Tiny-ImageNet ImageNet
Metrics: average accuracy worst-class accuracy clean accuracy AutoAttack accuracy PGD-20 accuracy CW-20 accuracy
Baselines: PGD-AT TRADES TRADES-AWP FRL-RWRM FAAL CFA WAT
Builds on: TRADES FRL FAAL AWP PAC-Bayes generalization bound over confusion matrices
Closest papers by meaning
- DAFA: Distance-Aware Fair Adversarial Training (ICLR 2024 · similarity 0.87)
- Towards Fairness-Aware Adversarial Learning (CVPR 2024 · similarity 0.87)
- Optimal Fair Learning Robust to Adversarial Distribution Shift (ICML 2025 · similarity 0.87)
- Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillation (NeurIPS 2024 · similarity 0.87)
- On the Alignment between Fairness and Accuracy: from the Perspective of Adversarial Robustness (ICML 2025 · similarity 0.87)
- On the Fairness ROAD: Robust Optimization for Adversarial Debiasing (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.