Research map / Adversarial robustness and security / Certified and empirical robustness

Enhancing Robustness in Incremental Learning with Adversarial Training

AAAI 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Adversarial training refinements · 3 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Investigates adversarially robust class incremental learning (ARCIL) and proposes FLAIR, which combines separated-logit adversarial distillation, flatness-preserving distillation of clean-vs-adversarial output differences, and data augmentation to reduce robustness forgetting.

Problem

Adversarial robustness is hard to maintain in class incremental learning: naive combinations of adversarial training and incremental learning conflict between learning new and retaining old knowledge, and the flat loss landscape of robust models disappears as new tasks are learned.

Approach

Use binary cross-entropy on separated logits so new-task training does not disturb past-class logits, distill the clean-vs-adversarial output difference of the previous model (a Taylor-approximation proxy for gradient and Hessian, preserving flatness), and add RandAugment/AutoAugment augmentation.

Key results

• On S-CIFAR10 with a 2000-sample buffer, FLAIR reaches 63.81% clean and 27.65% AutoAttack accuracy, and FLAIR+ reaches 30.06% AA, versus 26.12% for the best baseline R-LUCIR.
• On S-SVHN without a buffer, FLAIR+ reaches 66.26% clean and 27.21% AA, compared with 58.02% clean and 3.20% AA for R-LwF-MC on the same setting (the best clean baseline shown; AA of R-LwF-MC is the one listed).
• FLAIR yields the lowest gradient and Hessian forgetting among compared methods on S-CIFAR10 and S-CIFAR100, with FLAIR+ lowest overall.

Measured effects reported in the paper

Surprising findings

• Naively applying adversarial distillation (I-AD) to incremental learning yields high robust backward transfer loss and fails to resolve forgetting, indicating conflict between new-task adversarial learning and distillation.
• The authors report that the original TABA's boundary augmentation hurts performance in their reimplementation, with optimal lambda near 0.

Limitations

• Results without a memory buffer are low in absolute robustness, and performance drops substantially in the no-buffer setting.
• TABA could not be reproduced from public code, so its reported numbers come from the authors' reimplementation.
• Hyperparameters chosen by grid search over the test-reported setting; only ResNet-18 used in main experiments.

Experimental setup

Datasets: CIFAR-10 CIFAR-100 SVHN Tiny ImageNet

Benchmarks: S-CIFAR10 S-CIFAR100 S-SVHN S-TinyImageNet

Metrics: clean accuracy PGD-20 accuracy AutoAttack accuracy R-BWT gradient forgetting hessian forgetting

Baselines: PGD-AT TRADES MART I-ARD I-RSLAD I-AdaAD R-EWC-on R-LwF R-LwF-MC R-SI R-ER R-ER-ACE

Builds on: TRADES MART ARD RSLAD AdaAD TABA iCaRL LUCIR DER

Closest papers by meaning

• Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.88)
• Adversarial Training for Improving Model Robustness? Look at Both Prediction and Interpretation (AAAI 2022 · similarity 0.87)
• Improving Sustainability of Adversarial Examples in Class-Incremental Learning (AAAI 2026 · similarity 0.87)
• Bag of Tricks for Adversarial Training (ICLR 2021 · similarity 0.87)
• Robust Pre-Training by Adversarial Contrastive Learning (NeurIPS 2020 · similarity 0.87)
• Learning Better Certified Models from Empirically-Robust Teachers (NeurIPS 2026 · similarity 0.86)