Recent Advances in Adversarial Training for Adversarial Robustness

“Su et al. (2018) evaluated the recent SOTA ImageNet-based DNN models on multiple robustness metrics.”

“However, it is found [Andriushchenko and Flammarion, 2020] that the above fast training methods [Shafahi et al.”

“The adversarial counterpart x ′ of x is expressed as There are some common attacks following this formulation like Fast Gradient Sign Method (FGSM) [Goodfellow et al. , 2015], iterative FGSM [Kurakin et al. , 2016], and Projected Gradient Descent (PGD) attack [Madry et al. , 2018].”

“Current adversarial training methods [Madry et al. , 2018] can produce a robust model with worst-case accuracy of around 90% on MNIST.”

“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al., 2018] and early stopping, where early stopping is found to be the most effective.”

“, 2015], iterative FGSM [Kurakin et al., 2016], and Projected Gradient Descent (PGD) attack [Madry et al.”

“(2020) empirically investigated various techniques like `1 and `2 regularization, cutout [DeVries and Taylor, 2017], mixup [Zhang et al.”

“Kurakin et al. (2017) extended this FGSM-based regularization term by controlling the ratio of adversarial examples in batches so that it can scale up to ImageNet.”

“In fact, the popular RE benchmark, robustbench [39], only has 2 and ∞ leaderboards, and the most studied adversarial attack model is the ∞ attack [41].”

“We use a training set as it provides more challenging targets and is more relevant to Adversarial Training (Bai et al., 2021).”

“The harms brought on by AEs have prompted ongoing efforts to increase DNN’s adversarial robustness (i.e., the accuracy on AEs), among which adversarial training (AT) has been largely acknowledged as the most promising defensive strategy [5], [6], [7].”

“Among various defense strategies, adversarial training currently proves to be the most effective against adversarial attacks [11]–[14] and it is one of the few defenses that withstands against strong adversarial attacks [31].”

“Luo et al. (2021) proposed pruning as a topological denoising applied on graph neural networks (powerful tools for graph analytics).”

“Several new defense mechanisms have recently been proposed in the literature (e.g., [26], [45], [55]), but were often countered by more potent attacks that are capable of bypassing these defenses.”

“Researchers have also proposed defence techniques to increase the adversarial robustness against adversary method attacks such as adversarial training [17] this involves training a model on a mixture of normal and adversarial examples to improve its resilience.”

“Adversarialtraining[16],[18]isoneofthe mosteffectivemethodstoresistadversarialattacks[46],[47], [48],[49],[50].”

“∗ , y ) , (17) and the optimization problem can be formulated as the min-max problem: which is equivalent to the form of adversarial training [31], [32], [33].”

“Adversarial models are well-known for their unstable training (Bai et al., 2021), which can be exacerbated with the large-scale diffusion models.”

“Among these, adversarial training (Goodfellow et al., 2014; Madry et al., 2017) has proven to be one of the most effective methods for enhancing model robustness (Pang et al., 2020; Bai et al., 2021a; Wei et al., 2023).”

“Still, the effectiveness of retraining in limiting the impact of attacks suggests that defenses like adversarial training [5] and, more generally, concept drift adaptations are promising for securing FDSs against adaptive attackers.”

“[22, 119].”

“Adversarial training is another method which is studied to increase robustness of DNNs, however adversarial training often fails to perform well especially under various attack configurations [2].”

“Although adversarial training is widely regarded as one of the most effective approaches to defending against adversarial examples [38], and as seen in Table XII, it reduces the ASR of the attacks, it has several drawbacks compared to our PS-enabled defenses.”

“…of the model’s loss function with respect to each pixel, then perturbs the input data to maximize the loss function: Given that FGSM relies on the model’s parameters, it is generally considered a white-box attack , indicating the attacker has full access to the model’s architecture and parameters.”

“Another relevant aspect is adversarial training [2].”

“One can think of this as providing some form of adversarial training [6] to these defenses, which make them very powerful.”

“The research in the field of adversarial robustness for deep learning aims to increase the robustness of models to adversarial attacks [3, 6, 10].”

“The objective is for the trained model to exhibit comparable behavior for perturbed and benign examples [44].”

“For the second one [41], the key problem is that even if the input has been slightly perturbed, the models can still predict the original output.”

“Among numerous methods to mitigate this vulnerability, adversarial training (AT) is the most effective which takes adversarial examples into the training process [2, 3, 4, 5].”

“However, even with the adversarial CAPTCHAs, the security cannot be guaranteed when the techniques such as perturbation removal and adversarial training[12, 13] are adopted.”

“First, adversarial training (AdvTrain) enhances DL systems by improving their inherent DNNs’ robustness directly [4, 25, 41].”

“As a conceptually intuitive solution, AT [12], [49] improves model robustness by integrating adversarially perturbed inputs into model training.”

“To counter adversarial threats, practitioners often employ defensive strategies such as adversarial training [32], [33].”

“A comprehensive review of recent adversarial training methods was given in [29].”

“Understanding model robustness allows researchers to systematically enhance a model’s resilience against various disturbances through techniques like adversarial training [28], data augmentation [29], and regularization [30].”

“A combination of technical and regulatory safeguards has been proposed to mitigate these risks, e.g., adversarial robustness techniques (Carlini et al. 2019; Croce et al. 2020; Bai et al. 2021; Ghaffari Laleh et al. 2022) and policy-based interventions (Lee et al. 2021).”

“Adversarial-based defenses aim to inject “adversarial perturbations” into traces to mislead the classifier into making incorrect predictions [33], [34], [35], [36], [37], [38], [39], [40], [41], [42], [43], [44], [45].”

“Concurrently, several robustification strategies have been proposed to mitigate these attacks [29, 2].”

“However, the drawbacks of adversarial training are also quite obvious; that is, the cost of such methods should not be neglected, including collecting data and training adversarially on data multiple times larger than original datasets [10].”

“The objective is for the trained model to exhibit comparable behavior for perturbed and benign examples [40].”

“One of the most effective approaches for defending against adversarial attacks is adversarial training [5].”

“Adversarial training algorithms are proposed to keep samples away from decision boundaries, preventing unforseeing changes in model predictions under adversarial perturbations [192], [193].”

“Therefore, people can apply an imperceptible perturbation that maximizes the network’s prediction error to cause misclassification.”

“Among adversarial defense mechanisms, adversarial training is one of the most effective methods to enhance adversarial robustness [2, 31, 40].”

“Adversarial training has been proved as one of the strongest empirical defenses against adversarial attacks [12].”

“most effective defense strategy [18], [19].”

“…robustness of a model is adversarial training, which injects adversarial examples into the training data to increase model robustness intrinsically (Bai et al., 2021 To evaluate the robustness of such an augmented DST model against our proposed attack methods, we next test how well our adversarial…”

“Poor performance of ML models in the presence of adversaries [6, 7, 8, 9, 10], domain and distribution shifts [11, 12, 13, 14, 15], noises [16, 17], uncertainties [18, 19], among others, are still obstacles to secure and confident deployment of ML models, especially, in cases where theoretical and practical guarantees…”

“Adversarial training may defend against AML attacks on supervised learning and DRL [15].”

“Mathematically, adversarial robust training can be written as a min-max problem that searches for the worst-case perturbed version of each sample depending upon the defined set of perturbations.(8) While the concept of adversarial robustness was originally motivated by network security applications, it may have import…”

“Adversarial training [26], [65] is one of the most straight-forward and widely used defense techniques.”

“However, existing AT methods are primarily designed for WCR via the well-established “min-max” optimization [3, 21, 36] (cf. Sec.”

“However, adversarial training has two key drawbacks: 1) it requires prior knowledge of attack strategies, and 2) it demands significant computational resources [1].”

“Adversarial robustness reflects model vulnerability to malicious perturbations, which is commonly quantified by test accuracy under adversarial attacks [3, 39, 46].”

“Despite the progress in defense mechanisms, existing methods still cannot perform well under evolving attacks (Bai et al., 2021).”

“As demonstrated in Table III, our method’s performance is benchmarked against SOTA methods across various defense techniques, such as JPEG [54], Quantization [54], Adversarial Training (AT) [55], and TVM [56].”

“The formulation, which is modified from [9], is shown below: Where L is the loss function, δ is the perturbation, θ is the model parameters, x is the model input, and y is the model output.”

“To improve robustness, adversarial training has been shown to be one of the most effective approaches (Shafahi et al., 2019; Zhang et al., 2019; Paul et al., 2020; Xu et al., 2021; Bai et al., 2021).”

“AACL framework is inspired by – but distinctly different from – the well known and robust adversarial training defense [32], [33] proposed to defend static deep learning models against test (inference) time adversarial samples.”

“AT is known as the most effective approach to defend against adversarial attack [28], [33].”

“They could also be used at training time to find samples which would reduce surrogate predictive uncertainty, (Bai et al. 2021).”

“1: Proposed MDCDANet architecture with Gaussian layer as a dropout in-between the hidden layers for IPAD which is robust under various adversarial noisy inputs test images [25], [26], [27], [28].”

“Against those adversarial attacks, adversarial training is explored to improve the robustness of DNNs, typically by feeding adversarial examples to the model during the training stage[1, 4, 9].”

“Although Logs2Graphs is shown to be robust to very small contamination in the training data, it is critical to improve the model robustness by using techniques such as adversarial training [51] in the future.”

“…as hyperparameter optimization (Feurer & Hutter, 2019), meta learning (Finn et al., 2017; Rajeswaran et al., 2019), adversarially robust learning (Bai et al., 2021), data reweighting (Holstege et al., 2024), neural architecture search (Elsken et al., 2019), speech recognition (Saif et al.,…”

“Third, they tend to overfit to specific perturbation types used during training, limiting generalization to novel or unseen attacks (Bai et al. 2021).”

“By also comparing the values generated from the benign image, we overcome the common trade-off between improving the adversarial robustness and maintaining high benign performance (Bai et al. 2021).”

“The representative method of this mechanism is adversarial training (AT) [22].”

“For adversarial robustness [2, 4], another difference is that we consider robustness against epistemic uncertainty (resulting from, for example, distribution shift), instead of robustness against manipulations of the (in that case typically continuous) features.”

“The traditional AT can be conceptually formulated as the following min-max game [3, 28, 46]: where P X,Y is the joint distribution of natural sample X and its label Y , and l ( X ′ , X, Y ) is the loss on both natural and adversarial data of target classifier C .”

“…loss computations: A CNN model is used to abstract images to high-level semantics and perform classification operations: Adversarial loss [41] balances the dynamic equilibrium between CNN training phase and Mamba-CNN training phase, with alternating updates of the model’s parameter…”

“A straightforward solution to these issues is to apply existing adversarial training (AT) techniques [2], generating adversarial samples and using them to fine-tune the target model.”

“Because the success rate of adversarial examples is related to model robustness, attackers can utilize adversarial training (Bai et al., 2021) to evade these fingerprinting methods’ detection.”

“Outside of the RL community, Adversarial Training and Generative Adversarial Networks (GANs) are popular methods that leverage adversarial models in order to improve model robustness [18, 19].”

“Addressing the current issue, Bai et al. [31] effectively validated the model's capacity to accurately mimic the unpredictability of stock attributes using adversarial training on financial time-series data.”

“Existing methods for addressing this threat include randomizing inference input data, [55], purposefully including adversarial examples in training data, [7] regularizing models to prevent input data sensitivity, [32] or simply attempting to detect adversarial inputs directly.”

“Ad-versarial training posits a robust modified loss function, and then iteratively perturbs a randomly selected training sample to have large loss before updating model parameters during training [Bai et al. , 2021].”

“The former involves learning from feedback [6], [11] or adapting to distributional shifts [26], [27], while the latter ensures alignment through evaluation and assurance [28], [29].”

“Adversarial learning approaches are a class of methods that emerged within the field of deep learning for improving the robustness of neural networks [9].”

“…note that while there has been enormous progress in training AI models robust to different types of failures, such as adversarial or natural noise [18], [19], this body of work treats AI models in isolation, overlooking the overall system and the recovery of the system’s critical function…”

“…attacks and building defense systems (Biggio & Roli, 2017; Chakraborty et al., 2018), such as detection (Shen et al., 2019; Raina & Gales, 2022; Shaham et al., 2018; Hendrycks & Gimpel, 2016; Smith & Gal, 2018) or adversarial training (Qian et al., 2022; Bai et al., 2021; Muhammad & Bae, 2022).”

“Because of its fewconstraints hypothesis, particular endeavour is directed towards refining adversarial training (AT) methods [4, 36].”

“For instance, the method Instance Adaptive Adversarial Training (IAAT) from the type Adversarial Training with Adaptive ϵ [7].”

“, 2018) are currently state-of-theart algorithms among empirical defenses (Bai et al., 2021; Kireev et al., 2021).”

“Our contribution could be easily used for this purpose, i.e. by including the generated AEs in the training data, as in the adversarial training paradigm (Bai et al., 2021).”

“Towards defense, adversarial training is the most widely used method to improve adversarial robustness [3, 34].”

“Specifically, boundary error occurs when the specific data point is sufficiently close to the decision boundary that can easily cross it under slight perturbation, which is believed as one reason for the existence of adversarial samples (Bai et al. , 2021; Wang et al. , 2024a).”

“Adversarial training is widely accepted as the most effective method to improve the adversarial robustness of deep learning models [73], which typically augments training data with adversarial examples.”