mlsanityData to 13 Oct 2026

Label Noise in Adversarial Training: A Novel Perspective to Study Robust Overfitting

arXiv 2110.03135 ↗First posted 7 Oct 2021cs.LG cs.AI stat.MLcited by 14

Not on the map. Why?

Abstract (arXiv)

We show that label noise exists in adversarial training. Such label noise is due to the mismatch between the true label distribution of adversarial examples and the label inherited from clean examples - the true label distribution is distorted by the adversarial perturbation, but is neglected by the common practice that inherits labels from clean examples. Recognizing label noise sheds insights on the prevalence of robust overfitting in adversarial training, and explains its intriguing dependence on perturbation radius and data quality. Also, our label noise perspective aligns well with our observations of the epoch-wise double descent in adversarial training. Guided by our analyses, we proposed a method to automatically calibrate the label to address the label noise and robust overfitting. Our method achieves consistent performance improvements across various models and datasets without introducing new hyper-parameters or additional tuning.

Key facts. Cited by 14 papers in the map (data through 13 Oct 2026). Builds on 43 of its 59 references that are in the map. First posted on arXiv 7 Oct 2021.

Builds on

43 of 59 references.

References · 43

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,321
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,180
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,336
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,379
  5. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,170
  6. 2013Intriguing properties of neural networkscited by 5,137
  7. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 5,021
  8. 2017On Calibration of Modern Neural Networkscited by 4,902
  9. 2016Wide Residual Networkscited by 3,063
  10. 2016Identity Mappings in Deep Residual Networkscited by 1,962
  11. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,627
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,511
31 more
  1. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,445
  2. 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,344
  3. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,265
  4. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,202
  5. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  6. 2016Adversarial Machine Learning at Scalecited by 935
  7. 2018Reconciling modern machine learning practice and the bias-variance trade-offcited by 920
  8. 2018Robustness May Be at Odds with Accuracycited by 878
  9. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 684
  10. 2019Deep Double Descent: Where Bigger Models and More Data Hurtcited by 670
  11. 2015Cyclical Learning Rates for Training Neural Networkscited by 627
  12. 2017Exploring Generalization in Deep Learningcited by 596
  13. 2020Overfitting in adversarially robust deep learningcited by 505
  14. 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
  15. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 277
  16. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  17. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  18. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 203
  19. 2018Robustness via curvature regularization, and vice versacited by 174
  20. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  21. 2019Are Labels Required for Improving Adversarial Robustness?cited by 163
  22. 2018Is Robustness the Cost of Accuracy? -- A Comprehensive Study on the Robustness of 18 Deep Image Classification Modelscited by 135
  23. 2020Rethinking Bias-Variance Trade-off for Generalization of Neural Networkscited by 107
  24. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
  25. 2016Towards the Science of Security and Privacy in Machine Learningcited by 89
  26. 2015Learning with a Strong Adversarycited by 68
  27. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  28. 2021Exploring Memorization in Adversarial Trainingcited by 55
  29. 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
  30. 2020Concentration Inequalities for Multinoulli Random Variablescited by 12
  31. 2021Understanding Generalization in Adversarial Training via the Bias-Variance Decompositioncited by 10

Built on by

Cited by year

Citing papers per year: 2023: 7; 2024: 4; 2025: 3.

14 papers.

Sort:

By area:

  1. 2023Over-training with Mixup May Hurt Generalizationcited by 13
  2. 2023It Is All About Data: A Survey on the Effects of Data on Adversarial Robustnesscited by 9
  3. 2024Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinementcited by 9
  4. 2023Annealing Self-Distillation Rectification Improves Adversarial Trainingcited by 7
  5. 2024PeerAiD: Improving Adversarial Distillation from a Specialized Peer Tutorcited by 6
  6. 2023Generalized Uncertainty of Deep Neural Networks: Taxonomy and Applicationscited by 2
  7. 2025FrameShield: Adversarially Robust Video Anomaly Detectioncited by 2
  8. 2023Understanding Robust Overfitting from the Feature Generalization Perspectivecited by 1
  9. 2024Can overfitted deep neural networks in adversarial training generalize? -- An approximation viewpointcited by 1
  10. 2024Revisiting Semi-supervised Adversarial Robustness via Noise-aware Online Robust Distillationcited by 1
  11. 2023Omnipotent Adversarial Training in the Wildcited by 0
  12. 2023Learn from the Past: A Proxy Guided Adversarial Defense Framework with Self Distillation Regularizationcited by 0
2 more
  1. 2025Revisiting the Relationship between Adversarial and Clean Training: Why Clean Training Can Make Adversarial Training Bettercited by 0
  2. 2025Identifying and Understanding Cross-Class Features in Adversarial Trainingcited by 0