mlsanityData to 14 Oct 2026

Probabilistic Margins for Instance Reweighting in Adversarial Training

arXiv 2106.07904 ↗First posted 15 Jun 2021cs.LGcited by 57

Not on the map. Why?

Abstract (arXiv)

Reweighting adversarial data during training has been recently shown to improve adversarial robustness, where data closer to the current decision boundaries are regarded as more critical and given larger weights. However, existing methods measuring the closeness are not very reliable: they are discrete and can take only a few values, and they are path-dependent, i.e., they may change given the same start and end points with different attack paths. In this paper, we propose three types of probabilistic margin (PM), which are continuous and path-independent, for measuring the aforementioned closeness and reweighting adversarial data. Specifically, a PM is defined as the difference between two estimated class-posterior probabilities, e.g., such the probability of the true label minus the probability of the most confusing label given some natural data. Though different PMs capture different geometric properties, all three PMs share a negative correlation with the vulnerability of data: data with larger/smaller PMs are safer/riskier and should have smaller/larger weights. Experiments demonstrate that PMs are reliable measurements and PM-based reweighting methods outperform state-of-the-art methods.

Key facts. Cited by 57 papers in the map (data through 14 Oct 2026). Builds on 38 of its 67 references that are in the map. First posted on arXiv 15 Jun 2021.

Builds on

38 of 67 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 52,096
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Wide Residual Networkscited by 3,070
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2016Adversarial examples in the physical worldcited by 1,769
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  8. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  10. 2017A Survey on Deep Learning in Medical Image Analysiscited by 1,186
  11. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  12. 2018Robustness May Be at Odds with Accuracycited by 880
26 more
  1. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  2. 2019On Evaluating Adversarial Robustnesscited by 447
  3. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  4. 2018Adversarially Robust Generalization Requires More Datacited by 318
  5. 2018Adversarial Attacks and Defences: A Surveycited by 259
  6. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
  7. 2020Understanding and Improving Fast Adversarial Trainingcited by 214
  8. 2020Bag of Tricks for Adversarial Trainingcited by 200
  9. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  10. 2018Robustness via curvature regularization, and vice versacited by 175
  11. 2020Adversarial Robustness: From Self-Supervised Pre-Training to Fine-Tuningcited by 153
  12. 2018Query-Efficient Hard-label Black-box Attack:An Optimization-based Approachcited by 130
  13. 2019Imperceptible, Robust, and Targeted Adversarial Examples for Automatic Speech Recognitioncited by 124
  14. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  15. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  16. 2018Adversarial examples from computational constraintscited by 80
  17. 2020What Can Be Transferred: Unsupervised Domain Adaptation for Endoscopic Lesions Segmentationcited by 50
  18. 2020Once-for-All Adversarial Training: In-Situ Tradeoff between Robustness and Accuracy for Freecited by 48
  19. 2020Maximum Mean Discrepancy Test is Aware of Adversarial Attackscited by 44
  20. 2020Improving Query Efficiency of Black-box Adversarial Attackcited by 34
  21. 2021Towards Defending against Adversarial Examples via Attack-Invariant Featurescited by 25
  22. 2018PAC-learning in the presence of evasion adversariescited by 23
  23. 2020Projection & Probability-Driven Black-Box Attackcited by 19
  24. 2019Semantic-Transferable Weakly-Supervised Endoscopic Lesions Segmentationcited by 14
  25. 2021Learning Diverse-Structured Networks for Adversarial Robustnesscited by 12
  26. 2020PCAL: A Privacy-preserving Intelligent Credit Risk Modeling Framework Based on Adversarial Learningcited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2021: 1; 2022: 13; 2023: 12; 2024: 15; 2025: 12; 2026: 4.

57 papers.

Sort:

By area:

  1. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
  2. 2022Harnessing Out-Of-Distribution Examples via Augmenting Content and Stylecited by 43
  3. 2023Learning to Augment Distributions for Out-of-Distribution Detectioncited by 38
  4. 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 36
  5. 2023Robust Generalization against Photon-Limited Corruptions via Worst-Case Sharpness Minimizationcited by 29
  6. 2022Watermarking for Out-of-distribution Detectioncited by 28
  7. 2023Teaching Language Models to Self-Improve through Interactive Demonstrationscited by 26
  8. 2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 23
  9. 2023Certified Robustness via Dynamic Margin Maximization and Improved Lipschitz Regularizationcited by 21
  10. 2025Dynamic Loss-Based Sample Reweighting for Improved Large Language Model Pretrainingcited by 16
  11. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  12. 2022Improving Robustness with Adaptive Weight Decaycited by 13
38 more
  1. 2022Can Adversarial Training Be Manipulated By Non-Robust Features?cited by 12
  2. 2023Outlier Robust Adversarial Trainingcited by 10
  3. 2024Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifierscited by 10
  4. 2024Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinementcited by 9
  5. 2024Shedding More Light on Robust Classifiers under the lens of Energy-based Modelscited by 9
  6. 2024RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guaranteescited by 8
  7. 2024The Pitfalls and Promise of Conformal Inference Under Adversarial Attackscited by 8
  8. 2022One-vs-the-Rest Loss to Focus on Important Samples in Adversarial Trainingcited by 7
  9. 2022Learning Sample Reweighting for Accuracy and Adversarial Robustnesscited by 6
  10. 2022Improving Adversarial Robustness with Self-Paced Hard-Class Pair Reweightingcited by 6
  11. 2024Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Trainingcited by 6
  12. 2023Improving Model Generalization by On-manifold Adversarial Augmentation in the Frequency Domaincited by 5
  13. 2024Improving Generalization via Meta-Learning on Hard Samplescited by 5
  14. 2022Boosting Adversarial Robustness From The Perspective of Effective Margin Regularizationcited by 4
  15. 2024Data-Dependent Stability Analysis of Adversarial Trainingcited by 4
  16. 2024Dynamic Label Adversarial Training for Deep Learning Robustness Against Adversarial Attackscited by 4
  17. 2021Bridged Adversarial Trainingcited by 3
  18. 2022Strength-Adaptive Adversarial Trainingcited by 3
  19. 2024On Using Certified Training towards Empirical Robustnesscited by 3
  20. 2025One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancycited by 3
  21. 2025LoReUn: Data Itself Implicitly Provides Cues to Improve Machine Unlearningcited by 3
  22. 2025Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Trainingcited by 3
  23. 2022Adversarial Attack and Defense for Non-Parametric Two-Sample Testscited by 2
  24. 2022Selective classification using a robust meta-learning approachcited by 2
  25. 2023Vulnerability-Aware Instance Reweighting For Adversarial Trainingcited by 2
  26. 2023Doubly Robust Instance-Reweighted Adversarial Trainingcited by 2
  27. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  28. 2025Understanding Adversarial Training with Energy-based Modelscited by 2
  29. 2025Sample-Specific Noise Injection For Diffusion-Based Adversarial Purificationcited by 2
  30. 2023Understanding Robust Overfitting from the Feature Generalization Perspectivecited by 1
  31. 2024Improving Adversarial Training using Vulnerability-Aware Perturbation Budgetcited by 1
  32. 2024Improving Clean Accuracy via a Tangent-Space Perspective on Adversarial Trainingcited by 1
  33. 2025Reinforced Embodied Active Defense: Exploiting Adaptive Interaction for Robust Visual Perception in Adversarial 3D Environmentscited by 1
  34. 2025Parameter Interpolation Adversarial Training for Robust Image Classificationcited by 1
  35. 2023Cooperation or Competition: Avoiding Player Domination for Multi-Target Robustness via Adaptive Budgetscited by 0
  36. 2024Adversarial Training in Low-Label Regimes with Margin-Based Interpolationcited by 0
  37. 2024Standard-Deviation-Inspired Regularization for Improving Adversarial Robustnesscited by 0
  38. 2025Feature Statistics with Uncertainty Help Adversarial Robustnesscited by 0

50 most cited of 57 All 57 (JSON)