# On the Benefits of Models with Perceptually-Aligned Gradients

arXiv: https://arxiv.org/abs/2005.01499 · HTML: https://mlsanity.com/paper/2005.01499/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 4 May 2020.

## Built on by (most cited first, 13 of 13)

- [Enhancing Diffusion-Based Image Synthesis with Robust Classifier Guidance](https://mlsanity.com/paper/2208.08664/) (2022)
- [Robust Models Are More Interpretable Because Attributions Look Normal](https://mlsanity.com/paper/2103.11257/) (2021)
- [Which Models have Perceptually-Aligned Gradients? An Explanation via Off-Manifold Robustness](https://mlsanity.com/paper/2305.19101/) (2023)
- [Do Perceptually Aligned Gradients Imply Adversarial Robustness?](https://mlsanity.com/paper/2207.11378/) (2022)
- [CLIPAG: Towards Generator-Free Text-to-Image Generation](https://mlsanity.com/paper/2306.16805/) (2023)
- [Non-generative Generalized Zero-shot Learning via Task-correlated Disentanglement and Controllable Samples Synthesis](https://mlsanity.com/paper/2203.05335/) (2022)
- [BIGRoC: Boosting Image Generation via a Robust Classifier](https://mlsanity.com/paper/2108.03702/) (2021)
- [Inverting Adversarially Robust Networks for Image Synthesis](https://mlsanity.com/paper/2106.06927/) (2021)
- [MAGIC: Mask-Guided Image Synthesis by Inverting a Quasi-Robust Classifier](https://mlsanity.com/paper/2209.11549/) (2022)
- [Exploring the Connection between Robust and Generative Models](https://mlsanity.com/paper/2304.04033/) (2023)
- [Theoretical Understanding of Learning from Adversarial Perturbations](https://mlsanity.com/paper/2402.10470/) (2024)
- [Enhancing Consistency-Based Image Generation via Adversarialy-Trained Classification and Energy-Based Discrimination](https://mlsanity.com/paper/2405.16260/) (2024)
- [Adversarially robust segmentation models learn perceptually-aligned gradients](https://mlsanity.com/paper/2204.01099/) (2022)

## Abstract (arXiv)

Adversarial robust models have been shown to learn more robust and interpretable features than standard trained models. As shown in [citetsipras2018robustness], such robust models inherit useful interpretable properties where the gradient aligns perceptually well with images, and adding a large targeted adversarial perturbation leads to an image resembling the target class. We perform experiments to show that interpretable and perceptually aligned gradients are present even in models that do not show high robustness to adversarial attacks. Specifically, we perform adversarial training with attack for different max-perturbation bound. Adversarial training with low max-perturbation bound results in models that have interpretable features with only slight drop in performance over clean samples. In this paper, we leverage models with interpretable perceptually-aligned features and show that adversarial training with low max-perturbation bound can improve the performance of models for zero-shot and weakly supervised localization tasks.