# Label Smoothing and Adversarial Robustness

arXiv: https://arxiv.org/abs/2009.08233 · HTML: https://mlsanity.com/paper/2009.08233/

## Key facts

- Cited by 10 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 17 Sep 2020.

## Built on by (most cited first, 10 of 10)

- [RobustART: Benchmarking Robustness on Architecture Design and Training Techniques](https://mlsanity.com/paper/2109.05211/) (2021)
- [AutoAdvExBench: Benchmarking autonomous exploitation of adversarial example defenses](https://mlsanity.com/paper/2503.01811/) (2025)
- [Real World Robustness from Systematic Noise](https://mlsanity.com/paper/2109.00864/) (2021)
- [In and Out-of-Domain Text Adversarial Robustness via Label Smoothing](https://mlsanity.com/paper/2212.10258/) (2022)
- [Masked Spatial-Spectral Autoencoders Are Excellent Hyperspectral Defenders](https://mlsanity.com/paper/2207.07803/) (2022)
- [Understanding the Logit Distributions of Adversarially-Trained Deep Neural Networks](https://mlsanity.com/paper/2108.12001/) (2021)
- [Adversarial Ensemble Training by Jointly Learning Label Dependencies and Member Models](https://mlsanity.com/paper/2206.14477/) (2022)
- [Guidance Through Surrogate: Towards a Generic Diagnostic Attack](https://mlsanity.com/paper/2212.14875/) (2022)
- [Impact of Regularization on Calibration and Robustness: from the Representation Space Perspective](https://mlsanity.com/paper/2410.03999/) (2024)
- [Batch-in-Batch: a new adversarial training framework for initial perturbation and sample selection](https://mlsanity.com/paper/2406.04070/) (2024)

## Abstract (arXiv)

Recent studies indicate that current adversarial attack methods are flawed and easy to fail when encountering some deliberately designed defense. Sometimes even a slight modification in the model details will invalidate the attack. We find that training model with label smoothing can easily achieve striking accuracy under most gradient-based attacks. For instance, the robust accuracy of a WideResNet model trained with label smoothing on CIFAR-10 achieves 75% at most under PGD attack. To understand the reason underlying the subtle robustness, we investigate the relationship between label smoothing and adversarial robustness. Through theoretical analysis about the characteristics of the network trained with label smoothing and experiment verification of its performance under various attacks. We demonstrate that the robustness produced by label smoothing is incomplete based on the fact that its defense effect is volatile, and it cannot defend attacks transferred from a naturally trained model. Our study enlightens the research community to rethink how to evaluate the model's robustness appropriately.