mlsanityData to 7 Oct 2026

Subspace Adversarial Training

arXiv 2111.12229 ↗First posted 24 Nov 2021cs.LGcited by 41

Not on the map. Why?

Abstract (arXiv)

Single-step adversarial training (AT) has received wide attention as it proved to be both efficient and robust. However, a serious problem of catastrophic overfitting exists, i.e., the robust accuracy against projected gradient descent (PGD) attack suddenly drops to 0% during the training. In this paper, we approach this problem from a novel perspective of optimization and firstly reveal the close link between the fast-growing gradient of each sample and overfitting, which can also be applied to understand robust overfitting in multi-step AT. To control the growth of the gradient, we propose a new AT method, Subspace Adversarial Training (Sub-AT), which constrains AT in a carefully extracted subspace. It successfully resolves both kinds of overfitting and significantly boosts the robustness. In subspace, we also allow single-step AT with larger steps and larger radius, further improving the robustness performance. As a result, we achieve state-of-the-art single-step AT performance. Without any regularization term, our single-step AT can reach over 51% robust accuracy against strong PGD-50 attack of radius 8/255 on CIFAR-10, reaching a competitive performance against standard multi-step PGD-10 AT with huge computational advantages. The code is released at https://github.com/nblt/Sub-AT.

Key facts. Cited by 41 papers in the map (data through 7 Oct 2026). Builds on 38 of its 47 references that are in the map. First posted on arXiv 24 Nov 2021.

Builds on

38 of 47 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2016Wide Residual Networkscited by 3,057
  6. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  7. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  12. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
26 more
  1. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  2. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  3. 2019Adversarial Training for Free!cited by 638
  4. 2015Cyclical Learning Rates for Training Neural Networkscited by 627
  5. 2017Exploring Generalization in Deep Learningcited by 595
  6. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  7. 2015Train faster, generalize better: Stability of stochastic gradient descentcited by 547
  8. 2019Fantastic Generalization Measures and Where to Find Themcited by 507
  9. 2020Overfitting in adversarially robust deep learningcited by 504
  10. 2018Measuring the Intrinsic Dimension of Objective Landscapescited by 364
  11. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  12. 2017PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examplescited by 243
  13. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  14. 2020Understanding and Improving Fast Adversarial Trainingcited by 213
  15. 2018Gradient Descent Happens in a Tiny Subspacecited by 208
  16. 2018Robustness via curvature regularization, and vice versacited by 174
  17. 2020Implicit Gradient Regularizationcited by 145
  18. 2020Understanding Catastrophic Overfitting in Single-step Adversarial Trainingcited by 75
  19. 2021Stochastic Training is Not Necessary for Generalizationcited by 63
  20. 2020Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defensescited by 61
  21. 2017Efficient Defenses Against Adversarial Attackscited by 53
  22. 2020Single-step Adversarial training with Dropout Schedulingcited by 40
  23. 2020Improving Neural Network Training in Low Dimensional Random Basescited by 19
  24. 2021Understanding Catastrophic Overfitting in Adversarial Trainingcited by 11
  25. 2021Low Dimensional Landscape Hypothesis is True: DNNs can be Trained in Tiny Subspacescited by 5
  26. 2020Quasi-Newton's method in the class gradient defined high-curvature subspacecited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 7; 2023: 9; 2024: 18; 2025: 2; 2026: 5.

41 papers.

Sort:

By area:

  1. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  2. 2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 34
  3. 2022One-Pixel Shortcut: on the Learning Preference of Deep Neural Networkscited by 29
  4. 2022Fast Adversarial Training with Adaptive Step Sizecited by 24
  5. 2023Fine-tuning Happens in Tiny Subspaces: Exploring Intrinsic Task-specific Subspaces of Pre-trained Language Modelscited by 19
  6. 2024Flat-LoRA: Low-Rank Adaptation over a Flat Loss Landscapecited by 19
  7. 2022Adversarial Attack on Attackers: Post-Process to Mitigate Black-Box Score-Based Query Attackscited by 18
  8. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  9. 2023Subspace based Federated Unlearningcited by 13
  10. 2024Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularizationcited by 11
  11. 2024Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependencycited by 9
  12. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
29 more
  1. 2024Efficient local linearity regularization to overcome catastrophic overfittingcited by 7
  2. 2023RobArch: Designing Robust Architectures against Adversarial Attackscited by 6
  3. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  4. 2024Adversarial Training: A Surveycited by 6
  5. 2023Investigating Catastrophic Overfitting in Fast Adversarial Training: A Self-fitting Perspectivecited by 5
  6. 2024Identifying Policy Gradient Subspacescited by 5
  7. 2024Catastrophic Overfitting: A Potential Blessing in Disguisecited by 4
  8. 2022Robust Federated Learning against both Data Heterogeneity and Poisoning Attack via Aggregation Optimizationcited by 3
  9. 2024Learning Scalable Model Soup on a Single GPU: An Efficient Subspace Training Strategycited by 3
  10. 2024On Using Certified Training towards Empirical Robustnesscited by 3
  11. 2024The Effectiveness of Random Forgetting for Robust Generalizationcited by 2
  12. 2024Edge Detectors Can Make Deep Convolutional Neural Networks More Robustcited by 2
  13. 2024Improving Fast Adversarial Training via Self-Knowledge Guidancecited by 2
  14. 2025Understanding Adversarial Training with Energy-based Modelscited by 2
  15. 2022Unifying Gradients to Improve Real-world Robustness for Deep Networkscited by 1
  16. 2023Topology-preserving Adversarial Training for Alleviating Natural Accuracy Degradationcited by 1
  17. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  18. 2024Label Augmentation for Neural Networks Robustnesscited by 1
  19. 2025Accelerating Learned Image Compression Through Modeling Neural Training Dynamicscited by 1
  20. 2026Mitigating Error Amplification in Fast Adversarial Trainingcited by 1
  21. 2022Stable and Efficient Adversarial Training through Local Linearizationcited by 0
  22. 2023Improving the Robustness of Deep Convolutional Neural Networks Through Feature Learningcited by 0
  23. 2024Unraveling Attacks in Machine Learning-based IoT Ecosystems: A Survey and the Open Libraries Behind Themcited by 0
  24. 2024Improving Fast Adversarial Training Paradigm: An Example Taxonomy Perspectivecited by 0
  25. 2024Adversarial Detection with a Dynamically Stable Systemcited by 0
  26. 2026Quadratic Upper Bound for Boosting Robustnesscited by 0
  27. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0
  28. 2026Random Logit Scaling: Defending Deep Neural Networks Against Black-Box Score-Based Adversarial Example Attackscited by 0
  29. 2026Adversarial Training Without Input Gradients via Low-Rank Householder Expansionscited by 0