# Attribute-Guided Adversarial Training for Robustness to Natural Perturbations

arXiv: https://arxiv.org/abs/2012.01806 · HTML: https://mlsanity.com/paper/2012.01806/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 Dec 2020.

## Built on by (most cited first, 23 of 23)

- [Recent Advances in Adversarial Training for Adversarial Robustness](https://mlsanity.com/paper/2102.01356/) (2021)
- [Enhance the Visual Representation via Discrete Adversarial Training](https://mlsanity.com/paper/2209.07735/) (2022)
- [Adversarial Bayesian Augmentation for Single-Source Domain Generalization](https://mlsanity.com/paper/2307.09520/) (2023)
- [Improving Diversity with Adversarially Learned Transformations for Domain Generalization](https://mlsanity.com/paper/2206.07736/) (2022)
- [Incremental Verification of Neural Networks](https://mlsanity.com/paper/2304.01874/) (2023)
- [Semantically Distributed Robust Optimization for Vision-and-Language Inference](https://mlsanity.com/paper/2110.07165/) (2021)
- [Benchmark Generation Framework with Customizable Distortions for Image Classifier Robustness](https://mlsanity.com/paper/2310.18626/) (2023)
- [Mixture of Robust Experts (MoRE):A Robust Denoising Method towards multiple perturbations](https://mlsanity.com/paper/2104.10586/) (2021)
- [Improving Shift Invariance in Convolutional Neural Networks with Translation Invariant Polyphase Sampling](https://mlsanity.com/paper/2404.07410/) (2024)
- [On the Connection between Invariant Learning and Adversarial Training for Out-of-Distribution Generalization](https://mlsanity.com/paper/2212.09082/) (2022)
- [DOEPatch: Dynamically Optimized Ensemble Model for Adversarial Patches Generation](https://mlsanity.com/paper/2312.16907/) (2023)
- [Tell, Don't Show!: Language Guidance Eases Transfer Across Domains in Images and Videos](https://mlsanity.com/paper/2403.05535/) (2024)
- [Addressing Mistake Severity in Neural Networks with Semantic Knowledge](https://mlsanity.com/paper/2211.11880/) (2022)
- [TIDE: Training Locally Interpretable Domain Generalization Models Enables Test-time Correction](https://mlsanity.com/paper/2411.16788/) (2024)
- [PL-DCP: A Pairwise Learning framework with Domain and Class Prototypes for EEG emotion recognition under unseen target conditions](https://mlsanity.com/paper/2412.00082/) (2024)
- [Closing the sim-to-real gap in guided wave damage detection with adversarial training of variational auto-encoders](https://mlsanity.com/paper/2202.00570/) (2022)
- [Semantic Image Attack for Visual Model Diagnosis](https://mlsanity.com/paper/2303.13010/) (2023)
- [textrmA^textrm2RNet: Adversarial Attack Resilient Network for Robust Infrared and Visible Image Fusion](https://mlsanity.com/paper/2412.09954/) (2024)
- [Unsupervised Pairwise Learning Optimization Framework for Cross-Corpus EEG-Based Emotion Recognition Based on Prototype Representation](https://mlsanity.com/paper/2508.11663/) (2025)
- [Enhanced countering adversarial attacks via input denoising and feature restoring](https://mlsanity.com/paper/2111.10075/) (2021)
- [Robust Deep Learning Models Against Semantic-Preserving Adversarial Attack](https://mlsanity.com/paper/2304.03955/) (2023)
- [Semantically Guided Action Anticipation](https://mlsanity.com/paper/2411.15557/) (2024)
- [Adversarial Training Improves Generalization Under Distribution Shifts in Bird Sound Classification](https://mlsanity.com/paper/2507.13727/) (2025)

## Abstract (arXiv)

While existing work in robust deep learning has focused on small pixel-level norm-based perturbations, this may not account for perturbations encountered in several real-world settings. In many such cases although test data might not be available, broad specifications about the types of perturbations (such as an unknown degree of rotation) may be known. We consider a setup where robustness is expected over an unseen test domain that is not i.i.d. but deviates from the training domain. While this deviation may not be exactly known, its broad characterization is specified a priori, in terms of attributes. We propose an adversarial training approach which learns to generate new samples so as to maximize exposure of the classifier to the attributes-space, without having access to the data from the test domain. Our adversarial training solves a min-max optimization problem, with the inner maximization generating adversarial perturbations, and the outer minimization finding model parameters by optimizing the loss on adversarial perturbations generated from the inner maximization. We demonstrate the applicability of our approach on three types of naturally occurring perturbations -- object-related shifts, geometric transformations, and common image corruptions. Our approach enables deep neural networks to be robust against a wide range of naturally occurring perturbations. We demonstrate the usefulness of the proposed approach by showing the robustness gains of deep neural networks trained using our adversarial training on MNIST, CIFAR-10, and a new variant of the CLEVR dataset.