Making neural networks robust against adversarial inputs has resulted in an arms race between new defenses and attacks. The most promising defenses, adversarially robust training and verifiably robust training, have limitations that restrict their practical applications. The adversarially robust training only makes the…
On-device research index
arXiv research
A locally-built, LLM-digested index of recent arXiv papers in quant finance, geometry/topology, and statistical ML — keyword search served straight from SQLite on this machine.
168,657 papers · 148 categories
Trend · papers per month
48 results for “Robust training”
ClusTR improves clustering-based models' robustness without adversarial training.
problem Improving clustering-based models' robustness.
method Proposes ClusTR, a clustering-based training framework for robust models without adversarial training.
result ClusTR outperforms adversarially-trained models by up to 4% under strong PGD attacks.
This work improves certifiably robust models by distilling knowledge from adversarially robust teachers.
problem Certifiably robust models suffer from poor standard performance.
method Knowledge distillation from adversarially robust teachers to improve standard performance.
result Distillation from adversarially robust teachers consistently improves certified training performance.
Adaptive networks improve model robustness through conditional normalization.
problem Limited robustness of adversarial-trained networks due to network capacity and training samples.
method Proposes a conditional normalization module to adapt networks during adversarial training.
result Adaptive networks outperform both clean validation accuracy and robustness compared to non-adaptive counterparts.
In safety-critical but computationally resource-constrained applications, deep learning faces two key challenges: lack of robustness against adversarial attacks and large neural network size (often millions of parameters). While the research community has extensively explored the use of robust training and network prun…
New method improves adversarial training efficiency and robustness.
problem High computational costs and lack of stability in adversarial training.
method Backward smoothing for randomized smoothing of random initialization.
result Our method achieves similar model robustness as state-of-the-art methods but with significantly less training time.
New method improves neural network robustness without sacrificing generalization.
problem Robustness and generalization are often at odds in neural networks.
method Distributionally robust loss function bridging robustness and generalization.
result Certified robustness against data evasion and poisoning attacks with guaranteed generalization.
Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecs.LG
Paper explains adversarial training's robust overfitting through a minimax game perspective.
problem Adversarial training suffers from robust overfitting after learning rate decay.
method Viewing adversarial training as a dynamic minimax game, analyzing how LR decay breaks balance and leads to overfitting.
result ReBalanced Adversarial Training (ReBAT) alleviates robust overfitting without sacrificing robustness.
In deep reinforcement learning (RL), adversarial attacks can trick an agent into unwanted states and disrupt training. We propose a system called Robust Student-DQN (RS-DQN), which permits online robustness training alongside Q networks, while preserving competitive performance. We show that RS-DQN can be combined with…
Adversarial training leads to clean data generalization with significant robust overfitting gap.
problem Significant robust generalization gap in adversarial training.
method Two theoretical views: representation complexity and training dynamics.
result ReLU nets with extra parameters can achieve CGRO.
Adversarial robustness has become a central goal in deep learning, both in the theory and the practice. However, successful methods to improve the adversarial robustness (such as adversarial training) greatly hurt generalization performance on the unperturbed data. This could have a major impact on how the adversarial …
An Overview and Prospective Outlook on Robust Training and Certification of Machine Learning Modelscs.LG
Paper reviews robustness in machine learning models and discusses training and certification methods.
problem Ensuring reliability of machine learning models in safety-critical systems.
method Reviews formalisms and discusses training and certification techniques.
result Identifies future research directions in robust machine learning.
Framework combines adversarial training and provable robustness for neural networks.
problem Training certifiably robust neural networks with provable robustness guarantees.
method Formulates joint optimization problem with adversarial and provable robustness objectives; develops gradient-descent technique.
result Consistently matches or outperforms prior approaches for provable l infinity robustness on MNIST and CIFAR-10.
Theoretical study shows adversarial training improves robustness in deep learning models.
problem Ensuring robustness in pre-trained deep learning models.
method Theoretical analysis of adversarial training and feature purification in two-layer neural networks.
result Adversarial training leads to feature purification, making models more robust to attacks.
RATIO improves neural network robustness and explainability.
problem Neural networks' lack of robustness to adversarial changes and uncertainty on out-distribution samples.
method RATIO: Adversarial Training on In- and Out-distribution.
result RATIO leads to robust models with reliable confidence estimates on out-distribution samples.
Adversarial training improves robustness of halfspaces in noisy data.
problem Learning robust halfspaces in the presence of label noise.
method Adversarial training with binary cross-entropy or nonconvex sigmoidal loss.
result Adversarial training yields robust halfspaces with improved classification error.
Transfer learning, in which a network is trained on one task and re-purposed on another, is often used to produce neural network classifiers when data is scarce or full-scale training is too costly. When the goal is to produce a model that is not only accurate but also adversarially robust, data scarcity and computatio…
New method speeds up training of deep networks robust to adversarial attacks.
problem Deep networks are sensitive to adversarial perturbations, compromising security and interpretability.
method Fast adversarial training using Euclidean norm approximation and distributed computing.
result Robust feature representations and reduced training time achieved.
Generative models improve adversarial robustness by adding synthetic data.
problem Improving robustness in machine learning models trained on limited data.
method Using synthetic data generated from a large dataset to augment the original training set.
result Generative models can significantly reduce the robust-accuracy gap compared to models trained with additional real data.
New approach improves robustness of deep neural networks without overfitting.
problem Adversarial vulnerability of deep neural networks.
method Non-zero-sum bilevel formulation of adversarial training.
result Algorithm matches and outperforms state-of-the-art attacks, maintains robustness, and avoids overfitting.
Adversarial training can lead to unfair accuracy disparities between different groups.
problem Adversarial training algorithms introduce unfair accuracy disparities between different groups of data.
method Propose a Fair-Robust-Learning (FRL) framework to mitigate unfairness in adversarial defenses.
result Empirical and theoretical validation of FRL's effectiveness in mitigating unfairness.
AAT separates robust and non-robust features without supervision.
problem Adversarial vulnerability and accuracy reduction in machine learning models.
method Adversarial Asymmetric Training (AAT) algorithm.
result Preserves accuracy and achieves better disentanglement than previous methods.
This work benchmarks and theorizes robust NAS under adversarial training.
problem Lack of benchmark evaluations and theoretical guarantees for robust NAS architectures under adversarial training.
method Released a comprehensive data set and established a generalization theory using the neural tangent kernel.
result Established a generalization theory for robust NAS architectures under adversarial training.
Can we have it all? On the Trade-off between Spatial and Adversarial Robustness of Neural Networkscs.LG
(Non-)robustness of neural networks to small, adversarial pixel-wise perturbations, and as more recently shown, to even random spatial transformations (e.g., translations, rotations) entreats both theoretical and empirical understanding. Spatial robustness to random translations and rotations is commonly attained via e…
Adversarially trained transformers can learn robustly across tasks with minimal tuning.
problem Adversarial attacks and the high cost of adversarial training.
method Adversarial pretraining followed by in-context learning.
result Single-layer linear transformers can generalize robustly to unseen tasks.
This paper investigates how network width and depth affect adversarially robust DNNs.
problem Understanding architectural configurations for adversarially robust DNNs.
method Comprehensive investigation on the impact of network width and depth on adversarial robustness.
result Optimal architectural configuration for adversarial robustness exists and can improve robustness.
ORAT improves model robustness against outliers and adversarial attacks.
problem Challenges of training data like outliers and adversarial samples.
method Bi-level optimization with robust rank-based loss function.
result ORAT achieves theoretical consistency and uniform convergence rates.
A new method improves adversarial robustness by optimizing importance weights.
problem Adversarial training's non-uniform robustness across different data points.
method Doubly-robust instance reweighted adversarial training using distributionally robust optimization.
result Improves robustness against attacks on the weakest data points.
Neural networks are vulnerable to small adversarial perturbations. Existing literature largely focused on understanding and mitigating the vulnerability of learned models. In this paper, we demonstrate an intriguing phenomenon about the most popular robust training method in the literature, adversarial training: Advers…
The paper proposes a method to train NNs with a small Lipschitz constant to improve robustness.
problem Neural networks' susceptibility to adversarial perturbations in safety-critical applications.
method The paper introduces a framework to train multi-layer NNs by minimizing their Lipschitz constant, using an optimization scheme based on the Alternating Direction Method of Multipliers.
result The proposed training procedure successfully increases the robustness of neural networks.
Data augmentation improves robustness in adversarial training.
problem Adversarial training robust overfitting.
method Common data augmentation schemes combined with model weight averaging.
result Significant boost in robust accuracy, up to +2.93%.
New method certifies global robustness of neural networks efficiently.
problem Adversarial examples threaten certifiably robust neural networks.
method Formalized global robustness, adapted widely-used architectures with efficient global Lipschitz bounds.
result Certifiable robust models achieve state-of-the-art verifiable accuracy with negligible costs.
A new method reduces adversarial training time without overfitting.
problem Catastrophic overfitting in single-step adversarial training.
method FGSMPR: FGSM with PGD Regularization.
result Reduces the gap to multi-step adversarial training.
SPAT improves adversarial robustness by preserving semantics in adversarial training.
problem Adversarial examples often have different semantics than original data, introducing unintended biases.
method Semantics-preserving adversarial training (SPAT) that encourages pixel perturbation shared among all classes.
result SPAT improves adversarial robustness and achieves state-of-the-art results in CIFAR-10 and CIFAR-100.
Defenses against adversarial examples, such as adversarial training, are typically tailored to a single perturbation type (e.g., small -noise). For other perturbations, these defenses offer no guarantees and, at times, even increase the model's vulnerability. Our aim is to understand the reasons underlying…
Proposes a sample selection algorithm for fair and robust AI training.
problem Balancing fairness and robustness in AI models, especially with corrupted data.
method Formulates and solves a combinatorial optimization problem for unbiased sample selection, proposing a greedy algorithm.
result Improves fairness and robustness compared to state-of-the-art techniques, both synthetically and on real datasets.
Proposes robust model through Wasserstein geodesic interpolation of training data.
problem Improving model robustness through data augmentation.
method Augment data by finding worst-case Wasserstein barycenter on geodesic path.
result Improves robustness on CIFAR-10 up to 7.7% and on CIFAR-100 up to 16.8%.
Paper improves robustness and sparsity in adversarially trained DNNs.
problem Developing efficient compression algorithms for robustly trained DNNs.
method Pruning weights using relaxed augmented Lagrangian algorithms for both structured and unstructured levels, leveraging Feynman-Kac formalism.
result At least doubles channel sparsity of adversarially trained ResNet20 for CIFAR10 classification.
Paper explores why overfitted DNNs in adversarial training can generalize.
problem Understanding why overfitted DNNs in adversarial training can generalize despite poor robust generalization.
method An approximation viewpoint to analyze the robust overfitting of over-parameterized DNNs.
result Existence of infinitely many overfitted DNNs that achieve good robust generalization under certain conditions.
State-of-the art vision models can achieve superhuman performance on image classification tasks when testing and training data come from the same distribution. However, when models are tested on corrupted images (e.g. due to scale changes, translations, or shifts in brightness or contrast), performance degrades signifi…
Develops fair classifiers robust to training distribution perturbations.
problem Ensuring fairness in classifiers robust to training data perturbations.
method Formulates a min-max objective function to minimize distributionally robust training loss while maintaining fairness for perturbed distributions. Uses an iterative online learning algorithm to find a fair and robust classifier.
result Our classifier maintains fairness and accuracy for a wide range of perturbations compared to state-of-the-art fair classifiers.
Neural networks classify OOD images by their nearest neighbor in training data.
problem Understanding out-of-distribution prediction behavior of neural networks.
method Nearest category generalization (NCG) measure to assess OOD prediction accuracy.
result Adversarially robust networks have higher NCG accuracy than natural training, indicating local regularization impacts decision regions.
The paper introduces boundary thickness as a measure for improving model robustness.
problem Improving the robustness of machine learning models to adversarial and non-adversarial corruptions.
method Introducing boundary thickness as a measure and showing how various procedures can increase it.
result Thicker decision boundaries lead to improved robustness against adversarial and out-of-distribution transforms.
This paper proposes BAT to balance accuracy and robustness in adversarial training.
problem Balancing accuracy and robustness in adversarial training models.
method Blind adversarial training (BAT) uses a cutoff-scale strategy to adaptively estimate a nonuniform budget for AEs.
result BAT improves the overall robustness of adversarial training models.
BN helps learn fragile features, which can improve adversarial robustness.
problem The role of batch normalization in adversarial training and its impact on robustness.
method Investigated the expressiveness of BN in learning robust features compared to random features.
result Adversarially fine-tuning BN layers can result in non-trivial adversarial robustness.
Adversarial training has become one of the most effective methods for improving robustness of neural networks. However, it often suffers from poor generalization on both clean and perturbed data. In this paper, we propose a new algorithm, named Customized Adversarial Training (CAT), which adaptively customizes the pert…
Doubly robust self-training improves semi-supervised learning by balancing labeled and pseudo-labeled data.
problem Improving semi-supervised learning performance with limited labeled data.
method Introduces doubly robust self-training, a method that combines labeled and pseudo-labeled data to balance between labeled-only and pseudo-labeled-only training.
result Demonstrates superior performance of doubly robust self-training on ImageNet and nuScenes datasets.
Certified training improves robustness against adversarial attacks.
problem Certified training's gap with empirical robustness limits its practical utility.
method Combining adversarial attacks with network over-approximations.
result Certified training can prevent catastrophic overfitting and bridge the gap to multi-step baselines.