# Learning More Robust Features with Adversarial Training

arXiv: https://arxiv.org/abs/1804.07757 · HTML: https://mlsanity.com/paper/1804.07757/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Apr 2018.

## Built on by (most cited first, 8 of 8)

- [How to Certify Machine Learning Based Safety-critical Systems? A Systematic Literature Review](https://mlsanity.com/paper/2107.12045/) (2021)
- [Inspect, Understand, Overcome: A Survey of Practical Methods for AI Safety](https://mlsanity.com/paper/2104.14235/) (2021)
- [Physical Knowledge Enhanced Deep Neural Network for Sea Surface Temperature Prediction](https://mlsanity.com/paper/2304.09376/) (2023)
- [Adversarial Training: A Survey](https://mlsanity.com/paper/2410.15042/) (2024)
- [Adversarial Attack Driven Data Augmentation for Accurate And Robust Medical Image Segmentation](https://mlsanity.com/paper/2105.12106/) (2021)
- [A Comprehensive Methodological Survey of Human Activity Recognition Across Divers Data Modalities](https://mlsanity.com/paper/2409.09678/) (2024)
- [Enhancing Protein Predictive Models via Proteins Data Augmentation: A Benchmark and New Directions](https://mlsanity.com/paper/2403.00875/) (2024)
- [Optimizing the AI Development Process by Providing the Best Support Environment](https://mlsanity.com/paper/2305.00136/) (2023)

## Abstract (arXiv)

In recent years, it has been found that neural networks can be easily fooled by adversarial examples, which is a potential safety hazard in some safety-critical applications. Many researchers have proposed various method to make neural networks more robust to white-box adversarial attacks, but an effective method have not been found so far. In this short paper, we focus on the robustness of the features learned by neural networks. We show that the features learned by neural networks are not robust, and find that the robustness of the learned features is closely related to the resistance against adversarial examples of neural networks. We also find that adversarial training against fast gradients sign method (FGSM) does not make the leaned features very robust, even if it can make the trained networks very resistant to FGSM attack. Then we propose a method, which can be seen as an extension of adversarial training, to train neural networks to learn more robust features. We perform experiments on MNIST and CIFAR-10 to evaluate our method, and the experiment results show that this method greatly improves the robustness of the learned features and the resistance to adversarial attacks.