mlsanityData to 7 Oct 2026

Understanding Catastrophic Overfitting in Single-step Adversarial Training

arXiv 2010.01799 ↗First posted 5 Oct 2020cs.LG eess.IV stat.MLcited by 75

Not on the map. Why?

Abstract (arXiv)

Although fast adversarial training has demonstrated both robustness and efficiency, the problem of "catastrophic overfitting" has been observed. This is a phenomenon in which, during single-step adversarial training, the robust accuracy against projected gradient descent (PGD) suddenly decreases to 0% after a few epochs, whereas the robust accuracy against fast gradient sign method (FGSM) increases to 100%. In this paper, we demonstrate that catastrophic overfitting is very closely related to the characteristic of single-step adversarial training which uses only adversarial examples with the maximum perturbation, and not all adversarial examples in the adversarial direction, which leads to decision boundary distortion and a highly curved loss surface. Based on this observation, we propose a simple method that not only prevents catastrophic overfitting, but also overrides the belief that it is difficult to prevent multi-step adversarial attacks with single-step adversarial training.

Key facts. Cited by 75 papers in the map (data through 7 Oct 2026). First posted on arXiv 5 Oct 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 11; 2022: 15; 2023: 17; 2024: 16; 2025: 11; 2026: 5.

75 papers.

Sort:

  1. 2021Recent Advances in Adversarial Training for Adversarial Robustnesscited by 276
  2. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 109
  3. 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 42
  4. 2021Subspace Adversarial Trainingcited by 41
  5. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  6. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  7. 2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 34
  8. 2021Reliably fast adversarial training via latent adversarial perturbationcited by 29
  9. 2022Towards Efficient Adversarial Training on Vision Transformerscited by 29
  10. 2022FrequencyLowCut Pooling -- Plug & Play against Catastrophic Overfittingcited by 28
  11. 2022Safe Control Under Input Limits with Neural Control Barrier Functionscited by 27
  12. 2022Fast Adversarial Training with Adaptive Step Sizecited by 24
38 more
  1. 2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 22
  2. 2022Understanding and Combating Robust Overfitting via Input Loss Landscape Analysis and Regularizationcited by 22
  3. 2023On the Over-Memorization During Natural, Robust and Catastrophic Overfittingcited by 19
  4. 2022REAP: A Large-Scale Realistic Adversarial Patch Benchmarkcited by 17
  5. 2021ZeroGrad : Mitigating and Explaining Catastrophic Overfitting in FGSM Adversarial Trainingcited by 14
  6. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  7. 2023Fast Adversarial Training with Smooth Convergencecited by 14
  8. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  9. 2023Less is More: Data Pruning for Faster Adversarial Trainingcited by 13
  10. 2024Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspectivecited by 12
  11. 2021Understanding Catastrophic Overfitting in Adversarial Trainingcited by 11
  12. 2024Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularizationcited by 11
  13. 2023Exploring the Effect of Multi-step Ascent in Sharpness-Aware Minimizationcited by 9
  14. 2024Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependencycited by 9
  15. 2025Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videoscited by 9
  16. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  17. 2025Zero-shot Meta-learning for Tabular Prediction Tasks with Adversarially Pre-trained Transformercited by 8
  18. 2022Fast Adversarial Training with Noise Augmentation: A Unified Perspective on RandStart and GradAligncited by 7
  19. 2024Efficient local linearity regularization to overcome catastrophic overfittingcited by 7
  20. 2024Keeping Deep Learning Models in Check: A History-Based Approach to Mitigate Overfittingcited by 6
  21. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  22. 2024Characterizing Model Robustness via Natural Input Gradientscited by 6
  23. 2024Adversarial Training: A Surveycited by 6
  24. 2023Investigating Catastrophic Overfitting in Fast Adversarial Training: A Self-fitting Perspectivecited by 5
  25. 2024Stability and Generalization in Free Adversarial Trainingcited by 5
  26. 2021Multi-stage Optimization based Adversarial Trainingcited by 4
  27. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  28. 2024Towards Robust Vision Transformer via Masked Adaptive Ensemblecited by 4
  29. 2021Bridged Adversarial Trainingcited by 3
  30. 2024On Using Certified Training towards Empirical Robustnesscited by 3
  31. 2021Smoothness Analysis of Adversarial Trainingcited by 2
  32. 2022Catastrophic overfitting can be induced with discriminative non-robust featurescited by 2
  33. 2022Bag of Tricks for FGSM Adversarial Trainingcited by 2
  34. 2024Improving Fast Adversarial Training via Self-Knowledge Guidancecited by 2
  35. 2025Rethinking Audio-Visual Adversarial Vulnerability from Temporal and Modality Perspectivescited by 2
  36. 2025Adversarially Pretrained Transformers May Be Universally Robust In-Context Learnerscited by 2
  37. 2025Understanding Adversarial Training with Energy-based Modelscited by 2
  38. 2021Single-Step Adversarial Training for Semantic Segmentationcited by 1

50 most cited of 75 All 75 (JSON)