# Bridging the Performance Gap between FGSM and PGD Adversarial Training

arXiv: https://arxiv.org/abs/2011.05157 · HTML: https://mlsanity.com/paper/2011.05157/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 7 Nov 2020.

## Built on by (most cited first, 9 of 9)

- [Recent Advances in Adversarial Training for Adversarial Robustness](https://mlsanity.com/paper/2102.01356/) (2021)
- [On the effectiveness of adversarial training against common corruptions](https://mlsanity.com/paper/2103.02325/) (2021)
- [Enhancing Adversarial Training via Reweighting Optimization Trajectory](https://mlsanity.com/paper/2306.14275/) (2023)
- [Improving Robustness Against Adversarial Attacks with Deeply Quantized Neural Networks](https://mlsanity.com/paper/2304.12829/) (2023)
- [Calibrated Adversarial Training](https://mlsanity.com/paper/2110.00623/) (2021)
- [Towards Sustainable SecureML: Quantifying Carbon Footprint of Adversarial Machine Learning](https://mlsanity.com/paper/2403.19009/) (2024)
- [Statistical Detection of Adversarial examples in Blockchain-based Federated Forest In-vehicle Network Intrusion Detection Systems](https://mlsanity.com/paper/2207.04843/) (2022)
- [Quantitative Analysis of Deeply Quantized Tiny Neural Networks Robust to Adversarial Attacks](https://mlsanity.com/paper/2503.08973/) (2025)
- [SOLAR: Switchable Output Layer for Accuracy and Robustness in Once-for-All Training](https://mlsanity.com/paper/2509.16833/) (2025)

## Abstract (arXiv)

Deep learning achieves state-of-the-art performance in many tasks but exposes to the underlying vulnerability against adversarial examples. Across existing defense techniques, adversarial training with the projected gradient decent attack (adv.PGD) is considered as one of the most effective ways to achieve moderate adversarial robustness. However, adv.PGD requires too much training time since the projected gradient attack (PGD) takes multiple iterations to generate perturbations. On the other hand, adversarial training with the fast gradient sign method (adv.FGSM) takes much less training time since the fast gradient sign method (FGSM) takes one step to generate perturbations but fails to increase adversarial robustness. In this work, we extend adv.FGSM to make it achieve the adversarial robustness of adv.PGD. We demonstrate that the large curvature along FGSM perturbed direction leads to a large difference in performance of adversarial robustness between adv.FGSM and adv.PGD, and therefore propose combining adv.FGSM with a curvature regularization (adv.FGSMR) in order to bridge the performance gap between adv.FGSM and adv.PGD. The experiments show that adv.FGSMR has higher training efficiency than adv.PGD. In addition, it achieves comparable performance of adversarial robustness on MNIST dataset under white-box attack, and it achieves better performance than adv.PGD under white-box attack and effectively defends the transferable adversarial attack on CIFAR-10 dataset.