# Improved robustness to adversarial examples using Lipschitz regularization of the loss

arXiv: https://arxiv.org/abs/1810.00953 · HTML: https://mlsanity.com/paper/1810.00953/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 1 Oct 2018.

## Built on by (most cited first, 13 of 13)

- [Improving Adversarial Robustness via Channel-wise Activation Suppressing](https://mlsanity.com/paper/2103.08307/) (2021)
- [The Geometry of Adversarial Training in Binary Classification](https://mlsanity.com/paper/2111.13613/) (2021)
- [Quantifying and Enhancing Multi-modal Robustness with Modality Preference](https://mlsanity.com/paper/2402.06244/) (2024)
- [Boosting Black-box Attack to Deep Neural Networks with Conditional Diffusion Models](https://mlsanity.com/paper/2310.07492/) (2023)
- [ECLipsE: Efficient Compositional Lipschitz Constant Estimation for Deep Neural Networks](https://mlsanity.com/paper/2404.04375/) (2024)
- [LRS: Enhancing Adversarial Transferability through Lipschitz Regularized Surrogate](https://mlsanity.com/paper/2312.13118/) (2023)
- [Learning Globally Smooth Functions on Manifolds](https://mlsanity.com/paper/2210.00301/) (2022)
- [Multimodal Negative Learning](https://mlsanity.com/paper/2510.20877/) (2025)
- [Coarse-Grained Smoothness for RL in Metric Spaces](https://mlsanity.com/paper/2110.12276/) (2021)
- [Random Projections for Improved Adversarial Robustness](https://mlsanity.com/paper/2102.09230/) (2021)
- [ECLipsE-Gen-Local: Efficient Compositional Local Lipschitz Estimates for Deep Neural Networks](https://mlsanity.com/paper/2510.05261/) (2025)
- [A Learning Paradigm for Interpretable Gradients](https://mlsanity.com/paper/2404.15024/) (2024)
- [Latent Danger Zone: Distilling Unified Attention for Cross-Architecture Black-box Attacks](https://mlsanity.com/paper/2509.19044/) (2025)

## Abstract (arXiv)

We augment adversarial training (AT) with worst case adversarial training (WCAT) which improves adversarial robustness by 11% over the current state-of-the-art result in the ℓ2 norm on CIFAR-10. We obtain verifiable average case and worst case robustness guarantees, based on the expected and maximum values of the norm of the gradient of the loss. We interpret adversarial training as Total Variation Regularization, which is a fundamental tool in mathematical image processing, and WCAT as Lipschitz regularization.