Recent Advances in Adversarial Training for Adversarial Robustness

“Su et al. (2018) evaluated the recent SOTA ImageNet-based DNN models on multiple robustness metrics.”

“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al.”

“The adversarial counterpart x ′ of x is expressed as There are some common attacks following this formulation like Fast Gradient Sign Method (FGSM) [Goodfellow et al. , 2015], iterative FGSM [Kurakin et al. , 2016], and Projected Gradient Descent (PGD) attack [Madry et al. , 2018].”

“Current adversarial training methods [Madry et al. , 2018] can produce a robust model with worst-case accuracy of around 90% on MNIST.”

“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al., 2018] and early stopping, where early stopping is found to be the most effective.”

“, 2015], iterative FGSM [Kurakin et al., 2016], and Projected Gradient Descent (PGD) attack [Madry et al.”

“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al.”

“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”

“Most of these studies classify from the perspective of goals, or focus on the progress of adversarial attack strategies (Guidotti et al. 2018; Bodria et al. 2021; Bai et al. 2021) and formal verification techniques (Meng et al. 2022).”

“Adversarial training could also be loosely related to collaborative AI as they intentionally mislead the AI models with the input on which the model is trained to make it more robust and resistant [23].”

“Since its introduction a significant body of literature has evolved around adversarial training, both focusing on its empirical performance and improvement (see the survey [5]), and its theoretical understanding.”

“From the result, we can conclude that RVPT still successfully defends against backdoor attacks with different handcrafted prompts.”

“Adversarial training is one of the most effective approaches to defend against adversarial examples in both image and audio domains [31, 45].”

“How can a dishonest model provider mislead the verifier into falsely believing that the model no longer retains any influence from the forgotten data?”

“Finally, there is a large body of work applying adversarial training to improve worst-case model performance (Bai et al., 2021; Goodfellow et al., 2014; Ilyas et al., 2019), especially in the context of language models (Madry, 2017; Liu et al., 2020).”

“In addition, various kinds of AI models, including LLMs and MLLMs, as victim models, have been certified to possess adversarial vulnerabilities [51], [52], [53], [54].”

“Because the proposed attack method in this paper is the gradient-based, several defense methods such as adversarial training [60], gradient masking [61], defensive distillation [62] can be used to improve the robustness of the forecasting model.”

“Under small but carefully crafted perturbations to the inputs, the models can make severely wrong predictions on the adversarial examples [3], [48].”

“Hence, a number of dedicated defense mechanisms 46 and training methodologies 47 computationally expensive for practical deployment 48 .”

“These methods range from adversarial training [2, 4, 31, 39] and defensive distillation [6, 35, 36] to approaches like feature squeezing [52], input transformations [17, 18], and the use of auxiliary models for detection purposes [27, 37, 55].”

“Accuracy improvement is faced via adversarial training [12] which incorporates perturbed (i.e., adversarial) inputs into the training process, in order to mitigate overfitting and improve generalization [13].”

“Furthermore, Bai et al. [5] examine the generalization capability of adversarial training under three perspectives: standard generalization, adversarially robust generalization, and generalization on unseen attacks.”

“, 2020) as well as defense strategies such as the popular adversarial training (Madry et al., 2018; Bai et al., 2021).”

“It is widely recognized that neural networks (NNs) are susceptible to unpredictable behaviors when dealing with O.O.D inputs.”

“These methods involve scrutinizing, filtering, validating, or transforming the generated text to detect or mitigate potential robustness failures, such as harmful content, factual inaccuracies, biases, or outputs resulting from successful attacks that bypassed earlier defences.”

“Adversarial training (AT) is one of the most effective methods to defend against adversarial attacks [24].”

“Thus, the optimal perturbation δ ∗ can be optimized as follows [47]: where (cid:5) denotes an upper bound on (cid:6) p -norm, ensuring that the perturbation δ remains imperceptible (or quasi-imperceptible) to the human vision, and p can take values of 0, 1, 2, or ∞ depending on the specific…”

“There have been a number of studies exploring how to secure the deep learning models against adversarial examples [10, 11], but surprisingly, protecting continual learning from adversarial attacks has not been fully studied.”

“Adversarial training improves the model’s immunity to adversarial examples by adding adversarial examples in its training set [126].”

“The foundation of adversarial training lies in a min-max optimization framework, which can be formalized as:”

“Adversarial training is an effective technique to reduce the robust error of a model (Wong, Rice, and Kolter 2020; Bai and Luo 2021).”

“To penetrate the defense, the attacker introduces AT to enhance his website classifier [22], [23], [24].”

“Additionally, techniques like input sanitization and ensemble learning are employed to mitigate the impact of adversarial perturbations [7, 8].”

“Mathematically, AT is usually formulated as a min-max problem [15], where the inner maximization problem aims to generate an optimum adversarial example within the allowable budget and the outer minimization problem is employed to achieve the best solution to such worst-case data.”

“Adversarial training is an effective technique to reduce the robust errors of deep learning models [1], [2].”

“Adversarial training [2, 3, 15, 23] is one of the most effective methods for enhancing neural network robustness against adversarial examples.”

“For the second one [1], the key problem is that if the input has been slightly perturbed, then whether the models can still predict the original output.”

“We emphasize that producing certificates is more challenging than traditional defence mechanisms (e.g, adversarial training, see (Bai et al., 2021) and references therein) since they do not target defence against a specific attack method.”

“In the experiments, the defended robust models are constructed using adversarial training (Madry et al., 2018; Goodfellow et al., 2014), which proves to be the most effective method against adversarial attacks (Bai et al., 2021; Pang et al., 2020; Maini et al., 2020).”

“Adversarial training is an e ff ective means [85], where adversarial or intentionally perturbed samples are incorporated into training to improve the large model’s resilience [86].”

“During the adversarial fine-tuning stage, we apply basic data pre-processing by resizing each input image to 224 × 224 pixels and performing a center crop for consistency.”

“CPE [45] applies adversarial training [103] combined with lightweight residual attention gates (ResAGs) to perturb attention responses tied to sensitive concepts, enhancing model resilience while maintaining generation quality.”

“Adversarial training [24], [25] seeks to enhance model robustness by integrating adversarial examples into the training phase, which can be formulated as a min-max optimization problem.”

“Adopting uncertainty-aware loss functions [25, 26, 27] and early uncertainty estimation strategies [28] can help prioritize reliable predictions for high-stakes variables.”

“The goal of this process is to create a more robust model capable of generalizing effectively to both clean and perturbed data, thereby reducing its vulnerability to adversarial attacks [43].”

“Our main contributions are summarized as follows:”

“Some of the recent works have performed extensive evaluation on how to generate data samples for training/retraining [22], [23].”

“ApartialrepresentativestudiesincludesFree-AT[68], YOPO[85],Fast-AT[71],etc. MorerecentadvancesinATare reviewed in [5], [59].”

“It reinforces the neural network through the proactive inclusion of adversarial samples in the training data and can be seen through the perspective of a robust optimisation for a min-max problem [27].”

“Numerous of adversarial training methods [189] have been proposed for standalone training systems.”

“Adversarial training has proven effective in both natural language and computer vision domains 59–63 , significantly improving model robustness against real-world attacks.”

“Among these defense, full-parameter adversarial training is a commonly researched and proven effective method (Ganin et al. 2016; Bai et al. 2021) to increase a model’s robustness.”

“Adversarial training (AT) [8]: AT is widely accepted as the most effective defense method against adversarial attacks [26].”

“Previous studies on video classification using DNNs are developed in two ways: using 2D or 3D-based convolution neural networks (CNN).”

“Likewise, many defense mechanisms have been proposed, such as adversarial training [15], data pre-processing [16], or manipulation detection [17].”

“, the norm vector of the noise), the attacker tries to find a noise vector σ ∈ C to maximize the loss function ` output [8].”

“In a concurrent work, Qian et al. (2021) utilized the idea of exploiting local and global data information, and suggested to generate the adversarial examples by attacking an additional domain classifier.”

“Exploring such attacks is crucial for evaluating and enhancing the robustness of deep point cloud classifiers (Bai et al. 2021; Tang et al. 2024d).”

“The interaction set between the users and items in our problem.”

“Different defense methods have been proposed by researchers over the past few years to protect image classification systems from adversarial attacks [13], such as modification of the DNNs [29,33], adversarial training [2], input transformation [21,38], and input reconstruction [11,17].”

“The vulnerability of deep neural networks to adversarial examples [18, 46, 52, 59] has led to numerous defense methods [2, 5], with adversarial training emerging as the most effective approach [14, 15, 28, 31, 32, 36, 37, 57].”

“3528934 It has been pointed out that one of the keys to addressing this issue is finding strong adversarial examples [2] which has sparked a growing interest in finding such images using attack algorithms.”

“To further enhance TrapNet’s adversarial robustness, future work could explore integrating adversarial training techniques [7] into the defense framework.”

“This highlights the importance of devising resilient strategies for the generation of adversarial images—an emerging and vital research domain facilitating thorough evaluation and thus improvement of DNN robustness [7].”

“AT [20,29,2] is a widely used empirical approach for improving robustness, typically formulated as a “min-max” optimisation.”

“Training time approaches seek to improve the model robustness by adversarial training (Bai et al., 2021; Wong et al., 2020) or efficiently learn models whose output is provably robust to input perturbations up to certain magnitude (Raghu-nathan et al., 2018).”

“Adversarial Training, Robustness Testing [41, 42] Highly effective method for protecting deep learning models from adversarial examples by reducing the malicious effect caused by adversarial attacks.”

“In this section, we explore defense strategies against TOUAP, focusing on adversarial training [40] and DW [41].”

“Throughout the years, standard adversarial training was enhanced in various ways [7] – with changes in the regularization terms [28,38,40,42,44,80,96], model ensemble [50,72,90], adversarial training with adaptive attack budget [15, 23], curriculum adversarial training [9, 79, 97], utilizing…”

“In contrast, biologically-inspired defenses seek to make DNNs robust by integrating into them biological mechanisms that would bring their behavior more in line with human/animal vision [16, 17, 18, 19, 20, 21, 22].”

“To address the relatively small amount of training data, we used both data augmentation [35] and adversarial training approaches [36].”

“We followed a similar approach to [16, 33] when generating our taxonomy, although our classification of defence methods is slightly different from the previously reported taxonomies.”

“Adversarial training, where a malware detector is trained with adversarial examples, is one of the most commonly used approaches to improve adversarial robustness (Bai et al., 2021; Grosse et al., 2017; Zhang et al., 2021; Al-Dujaili et al., 2018b).”

“Some methods rely on retraining the entire classifier using attacks generated with the known attack methods [52].”

“On account of catastrophic failures caused by adversarial examples, a massive number of methods have been proposed to build trustworthy deep learning-based systems for natural images [16], [45], [121], [122], [123].”

“While we do not explicitly address adversarial examples, integrating adversarial robustness techniques [14] could enhance resilience.”

“…of modern machine learning applications, such as generative modeling [Goodfellow et al., 2014], reinforcement learning [Daskalakis et al., 2020, Bai and Jin, 2020, Wei et al., 2021], and adversarial robustness [Madry et al., 2018, Cohen et al., 2019, Bai et al., 2021, Car-lini et al., 2019].”

“After the pre-training stage, the pre-trained model has learned more robust and generalized features [20], [21] to gain both high accuracy and robustness.”

“Two main categories are adversarial training [3,58] and certified training [35,45], both of which aim to improve a model’s accuracy in the presence of adversarial examples.”

“In real-world scenarios where attackers may employ diverse and unknown strategies, this advantage is not guaranteed [25], [26].”

“To improve the models’ robustness, a range of adversarial training techniques have been introduced [1], [35], along with fine-tuning on dataset or models [36], [37], [38].”

“Although AT has made significant improvement in adversarial defense, the model robustness is still far from satisfactory [4, 30, 33].”

“Introduced by Goodfellow et al. [20], Adversarial Training (AT) is widely acknowledged as the most effective method to enhance the robustness of deep learning models [4], [5].”

“Therefore, adversarial training [17], [38] is tested as a defense strategy against adversarial attacks by injecting adversarial samples into the training data during the training process to enhance the robustness of the DNN against these attacks.”

“Adversarial training is a recent advance in deep learning, so far mainly applied to image and text inputs, that results in more robust and gener-alizable models (Bai et al. 2021; Yi et al. 2021).”