Research map / Adversarial robustness and security / Certified and empirical robustness
Enhancing the Adversarial Robustness via Manifold Projection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes integrating a pretrained autoencoder as a manifold projection operator into adversarial training (PGD-AT, TRADES) and adversarial distillation (ARD, RSLAD, AdaAD, KD) to improve adversarial robustness on CIFAR-10, CIFAR-100 and Tiny ImageNet.
Problem
Adversarial training and adversarial distillation learn sample-to-label mappings without modeling the clean data distribution, while adversarial examples deviate from that distribution; AT also needs high-capacity models and AD suffers from teacher-student capacity gaps.
Approach
Train a simple autoencoder on clean samples to model their prior distribution and insert it as a manifold projection step before the classifier (and before the teacher/student in distillation) inside the inner maximization and outer minimization, pulling adversarial examples toward the clean manifold so attacks are weaker and the mapping is easier to learn.
Key results
- On CIFAR-10 with ResNet-18, PGD-AT (AE) reaches 82.20% AutoAttack accuracy versus 48.45% for PGD-AT, a gain of up to 33.75 points.
- AdaAD (AE) improves AutoAttack accuracy by 34.00 points on CIFAR-10 ResNet-18 and reduces the AA gap between ResNet-18 and WRN-34-20 from 6.58% to 0.66%.
- On Tiny ImageNet with ResNet-18, PGD-AT (AE) improves AutoAttack accuracy from 19.18% to 33.68%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add AE manifold projection to PGD-AT, TRADES, ARD, RSLAD, AdaAD | adversarial training and distillation methods · CIFAR-10 ResNet-18 and MobileNetV2 | AutoAttack accuracy: up to +33.75 (PGD-AT) and +34.00 (AdaAD) points | Helped |
| add AE manifold projection to AT/AD methods | adversarial training and distillation methods · CIFAR-10 ResNet-18 clean accuracy | clean accuracy: -1.41 (PGD-AT), -1.25 (TRADES), -0.18 (AdaAD), +0.19 (RSLAD) | No clear effect |
| add AE manifold projection to PGD-AT | PGD-AT on Tiny ImageNet · Tiny ImageNet ResNet-18 | AutoAttack accuracy: +14.50 | Helped |
| add AE manifold projection to PGD-AT (ablation) | PGD-AT transfer-based attacks · CIFAR-10 ResNet-18 transfer attacks | AutoAttack accuracy under transfer: 63.96 to 68.02 (ResNet-34 surrogate); 66.61 to 71.09 (VGG-16 surrogate) | Helped |
| add AE manifold projection to PGD-AT on CIFAR-10 (worst-class robustness) (ablation) | TRADES and AdaAD · CIFAR-10 robust fairness | worst-class AA accuracy: +43.30 (TRADES), +48.60 (AdaAD) | Helped |
| AE-based PGD-AT versus diffusion purification | PGD-AT (AE) · CIFAR-10 WRN-70-16 PGD | PGD accuracy: 84.02 vs 51.13 for DiffPure | Helped |
| add AE manifold projection to Tiny ImageNet AD and AT methods | ARD, RSLAD, TRADES on Tiny ImageNet · Tiny ImageNet clean accuracy | clean accuracy: -0.64 to +0.05 | No clear effect |
Surprising findings
- PGD-AT (AE) on CIFAR-10 outperforms DiffPure and RE-DiffPure purification baselines under PGD and AutoAttack.
Limitations
- The defense relies on keeping the autoencoder undetected by adversaries; if detected, an adaptive attacker can target the AE plus classifier jointly.
- Preventive and remedial measures (random AE interference group, reserve AEs) are engineering-oriented rather than formally analyzed.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 Tiny ImageNet
Benchmarks: CIFAR-10 CIFAR-100 Tiny ImageNet
Metrics: clean accuracy robust accuracy worst-class accuracy transfer attack accuracy
Baselines: PGD-AT TRADES KD ARD RSLAD AdaAD DiffPure RE-DiffPure
Builds on: PGD-AT TRADES ARD RSLAD AdaAD
Closest papers by meaning
- Dual Manifold Adversarial Robustness: Defense against Lp and non-Lp Adversarial Attacks (NeurIPS 2020 · similarity 0.92)
- Adversarial Purification with the Manifold Hypothesis (AAAI 2024 · similarity 0.90)
- Adversarial Robustness without Adversarial Training: A Teacher-Guided Curriculum Learning Approach (NeurIPS 2021 · similarity 0.89)
- Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Data (ICLR 2025 · similarity 0.89)
- Explaining the role of Intrinsic Dimensionality in Adversarial Training (ICML 2025 · similarity 0.89)
- Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinement (CVPR 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.