mlsanityData to 14 Oct 2026

Bilateral Adversarial Training: Towards Fast Training of More Robust Models Against Adversarial Attacks

arXiv 1811.10716 ↗First posted 26 Nov 2018cs.CVcited by 48

Not on the map. Why?

Abstract (arXiv)

In this paper, we study fast training of adversarially robust models. From the analyses of the state-of-the-art defense method, i.e., the multi-step adversarial training, we hypothesize that the gradient magnitude links to the model robustness. Motivated by this, we propose to perturb both the image and the label during training, which we call Bilateral Adversarial Training (BAT). To generate the adversarial label, we derive an closed-form heuristic solution. To generate the adversarial image, we use one-step targeted attack with the target label being the most confusing class. In the experiment, we first show that random start and the most confusing target attack effectively prevent the label leaking and gradient masking problem. Then coupled with the adversarial label part, our model significantly improves the state-of-the-art results. For example, against PGD100 white-box attack with cross-entropy loss, on CIFAR10, we achieve 63.7% versus 47.2%; on SVHN, we achieve 59.1% versus 42.1%. At last, the experiment on the very (computationally) challenging ImageNet dataset further demonstrates the effectiveness of our fast method.

Key facts. Cited by 48 papers in the map (data through 14 Oct 2026). First posted on arXiv 26 Nov 2018.

Builds on

No reference list yet.

Built on by

Cited by year

Citing papers per year: 2021: 21; 2022: 8; 2023: 14; 2024: 4; 2025: 1.

48 papers.

Sort:

By area:

  1. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 279
  2. 2021Advances in adversarial attacks and defenses in computer vision: A surveycited by 127
  3. 2022SegPGD: An Effective and Efficient Adversarial Attack for Evaluating and Boosting Segmentation Robustnesscited by 74
  4. 2023How Deep Learning Sees the World: A Survey on Adversarial Attacks & Defensescited by 66
  5. 2022A Survey of Robust Adversarial Training in Pattern Recognition: Fundamental, Theory, and Methodologiescited by 44
  6. 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
  7. 2022DISCO: Adversarial Defense with Local Implicit Functionscited by 34
  8. 2023Randomized Adversarial Training via Taylor Expansioncited by 28
  9. 2022Investigating Top-k White-Box and Transferable Black-box Attackcited by 26
  10. 2022Understanding and Combating Robust Overfitting via Input Loss Landscape Analysis and Regularizationcited by 22
  11. 2023Improving the Accuracy-Robustness Trade-Off of Classifiers via Adaptive Smoothingcited by 18
  12. 2023Fast Adversarial Training with Smooth Convergencecited by 14
36 more
  1. 2021Fooling Adversarial Training with Inducing Noisecited by 13
  2. 2021AGKD-BML: Defense Against Adversarial Attack by Attention Guided Knowledge Distillation and Bi-directional Metric Learningcited by 10
  3. 2022Enhancing Adversarial Robustness for Deep Metric Learningcited by 10
  4. 2021Improving Model Robustness with Latent Distribution Locally and Globallycited by 9
  5. 2021Adversarial Attack and Defense in Deep Rankingcited by 8
  6. 2024Real World Federated Learning with a Knowledge Distilled Transformer for Cardiac CT Imagingcited by 8
  7. 2023Adversarial Finetuning with Latent Representation Constraint to Mitigate Accuracy-Robustness Tradeoffcited by 7
  8. 2023Provable Unrestricted Adversarial Training without Compromise with Generalizabilitycited by 6
  9. 2024Adversarial Training: A Surveycited by 6
  10. 2021All You Need is RAW: Defending Against Adversarial Attacks with Camera Image Pipelinescited by 5
  11. 2023Adversarial Attacks and Defenses in Machine Learning-Powered Networks: A Contemporary Surveycited by 5
  12. 2023Towards Robust and Accurate Visual Promptingcited by 5
  13. 2021Towards Speeding up Adversarial Training in Latent Spacescited by 4
  14. 2021Adversarial Attacks and Defenses for Social Network Text Processing Applications: Techniques, Challenges and Future Research Directionscited by 4
  15. 2022A3T: Accuracy Aware Adversarial Trainingcited by 4
  16. 2023Exploring Robust Features for Improving Adversarial Robustnesscited by 4
  17. 2021Adaptive Feature Alignment for Adversarial Trainingcited by 3
  18. 2021Adversarial Attacks on ML Defense Models Competitioncited by 3
  19. 2021Tightening the Approximation Error of Adversarial Risk with Auto Loss Function Searchcited by 3
  20. 2024Adversarial Attacks and Defenses in Multivariate Time-Series Forecasting for Smart and Connected Infrastructurescited by 3
  21. 2021Adversarial Machine Learning in Text Analysis and Generationcited by 2
  22. 2021Dynamic Efficient Adversarial Training Guided by Gradient Magnitudecited by 2
  23. 2023DaMSTF: Domain Adversarial Learning Enhanced Meta Self-Training for Domain Adaptationcited by 2
  24. 2024PushPull-Net: Inhibition-driven ResNet robust to image corruptionscited by 2
  25. 2021Balancing Robustness and Sensitivity using Feature Contrastive Learningcited by 1
  26. 2021Robustness-via-Synthesis: Robust Training with Generative Adversarial Perturbationscited by 1
  27. 2021A Hierarchical Assessment of Adversarial Severitycited by 1
  28. 2023Do we need entire training data for adversarial training?cited by 1
  29. 2023IRAD: Implicit Representation-driven Image Resampling against Adversarial Attackscited by 1
  30. 2021Audio Attacks and Defenses against AED Systems -- A Practical Studycited by 0
  31. 2021Deep Bayesian Image Set Classification: A Defence Approach against Adversarial Attackscited by 0
  32. 2021Adv-4-Adv: Thwarting Changing Adversarial Perturbations via Adversarial Domain Adaptationcited by 0
  33. 2021Associative Adversarial Learning Based on Selective Attackcited by 0
  34. 2023Masking and Mixing Adversarial Trainingcited by 0
  35. 2023Parameter-Saving Adversarial Training: Reinforcing Multi-Perturbation Robustness via Hypernetworkscited by 0
  36. 2025Exploring Visual Prompting: Robustness Inheritance and Beyondcited by 0