mlsanityData to 7 Oct 2026

On the Convergence and Robustness of Adversarial Training

arXiv 2112.08304 ↗First posted 15 Dec 2021cs.LGcited by 127

Not on the map. Why?

Abstract (arXiv)

Improving the robustness of deep neural networks (DNNs) to adversarial examples is an important yet challenging problem for secure deep learning. Across existing defense techniques, adversarial training with Projected Gradient Decent (PGD) is amongst the most effective. Adversarial training solves a min-max optimization problem, with the textitinner maximization generating adversarial examples by maximizing the classification loss, and the textitouter minimization finding model parameters by minimizing the loss on adversarial examples generated from the inner maximization. A criterion that measures how well the inner maximization is solved is therefore crucial for adversarial training. In this paper, we propose such a criterion, namely First-Order Stationary Condition for constrained optimization (FOSC), to quantitatively evaluate the convergence quality of adversarial examples found in the inner maximization. With FOSC, we find that to ensure better robustness, it is essential to use adversarial examples with better convergence quality at the textitlater stages of training. Yet at the early stages, high convergence quality adversarial examples are not necessary and may even lead to poor robustness. Based on these observations, we propose a textitdynamic training strategy to gradually increase the convergence quality of the generated adversarial examples, which significantly improves the robustness of adversarial training. Our theoretical and empirical results show the effectiveness of the proposed method.

Key facts. Cited by 127 papers in the map (data through 7 Oct 2026). Builds on 34 of its 46 references that are in the map. First posted on arXiv 15 Dec 2021.

Builds on

34 of 46 references.

References · 34

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2015Batch Normalization: Accelerating Deep Network Training by Reducing Internal Covariate Shiftcited by 6,979
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Wide Residual Networkscited by 3,057
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2016Adversarial examples in the physical worldcited by 1,762
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  10. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  11. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  12. 2015The Limitations of Deep Learning in Adversarial Settingscited by 784
22 more
  1. 2018A Convergence Theory for Deep Learning via Over-Parameterizationcited by 784
  2. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  3. 2018Gradient Descent Finds Global Minima of Deep Neural Networkscited by 572
  4. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  5. 2017Countering Adversarial Images using Input Transformationscited by 517
  6. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  7. 2018Defense-GAN: Protecting Classifiers Against Adversarial Attacks Using Generative Modelscited by 362
  8. 2017Defense against Adversarial Attacks Using High-Level Representation Guided Denoisercited by 329
  9. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 288
  10. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  11. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  12. 2015DeepDriving: Learning Affordance for Direct Perception in Autonomous Drivingcited by 229
  13. 2017Formal Guarantees on the Robustness of a Classifier against Adversarial Manipulationcited by 182
  14. 2014Towards Deep Neural Network Architectures Robust to Adversarial Examplescited by 146
  15. 2018Stochastic Gradient Descent Optimizes Over-parameterized Deep ReLU Networkscited by 139
  16. 2018Curriculum Adversarial Trainingcited by 89
  17. 2018Generalizable Adversarial Training via Spectral Normalizationcited by 68
  18. 2018Deep Defense: Training DNNs with Improved Adversarial Robustnesscited by 41
  19. 2018A Frank-Wolfe Framework for Efficient and Effective Adversarial Attackscited by 29
  20. 2018Defend Deep Neural Networks Against Adversarial Examples via Fixed and Dynamic Quantized Activation Functionscited by 17
  21. 2018Security Analysis and Enhancement of Model Compressed Deep Learning Systems under Adversarial Attackscited by 8
  22. 2015Improving Back-Propagation by Adding an Adversarial Gradientcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 40; 2023: 39; 2024: 26; 2025: 17; 2026: 4.

127 papers.

Sort:

By area:

  1. 2023Cross-Entropy Loss Functions: Theoretical Analysis and Applicationscited by 206
  2. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  3. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  4. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuningcited by 63
  5. 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
  6. 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
  7. 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
  8. 2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
  9. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 34
  10. 2022Minimax Regret Optimization for Robust Machine Learning under Distribution Shiftcited by 31
  11. 2022Stability Analysis and Generalization Bounds of Adversarial Trainingcited by 30
  12. 2023Towards Trustworthy and Aligned Machine Learning: A Data-centric Survey with Causality Perspectivescited by 30
38 more
  1. 2022Revisiting Residual Networks for Adversarial Robustness: An Architectural Perspectivecited by 28
  2. 2023CUDA: Convolution-based Unlearnable Datasetscited by 26
  3. 2024TERD: A Unified Framework for Safeguarding Diffusion Models Against Backdoorscited by 25
  4. 2022Exploring the Relationship between Architecture and Adversarially Robust Generalizationcited by 23
  5. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
  6. 2023Rethinking the Effect of Data Augmentation in Adversarial Contrastive Learningcited by 20
  7. 2024MeanSparse: Post-Training Robustness Enhancement Through Mean-Centered Feature Sparsificationcited by 20
  8. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  9. 2022Improving Out-of-Distribution Generalization by Adversarial Training with Structured Priorscited by 17
  10. 2023Adversarial Examples Are Not Real Featurescited by 16
  11. 2023Outlier-Robust Wasserstein DROcited by 16
  12. 2022Existence and Minimax Theorems for Adversarial Surrogate Risks in Binary Classificationcited by 15
  13. 2022Approximate Nearest Neighbor Search under Neural Similarity Metric for Large-Scale Recommendationcited by 14
  14. 2023Generalist: Decoupling Natural and Robust Generalizationcited by 14
  15. 2023Sharpness-Aware Minimization Alone can Improve Adversarial Robustnesscited by 14
  16. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  17. 2023Defenses in Adversarial Machine Learning: A Surveycited by 14
  18. 2022A Unified Contrastive Energy-based Model for Understanding the Generative Ability of Adversarial Trainingcited by 13
  19. 2022Fast and Reliable Evaluation of Adversarial Robustness with Minimum-Margin Attackcited by 13
  20. 2022Pruning Adversarially Robust Neural Networks without Adversarial Examplescited by 12
  21. 2021Benign Overfitting in Adversarially Robust Linear Classificationcited by 11
  22. 2022RoCourseNet: Distributionally Robust Training of a Prediction Aware Recourse Modelcited by 11
  23. 2024ProTIP: Probabilistic Robustness Verification on Text-to-Image Diffusion Models against Stochastic Perturbationcited by 10
  24. 2022Distributed Adversarial Training to Robustify Deep Neural Networks at Scalecited by 9
  25. 2022Backdoor Attacks on Crowd Countingcited by 9
  26. 2022Adaptive Smoothness-weighted Adversarial Training for Multiple Perturbations with Its Stability Analysiscited by 9
  27. 2022Hierarchical Distribution-Aware Testing of Deep Learningcited by 8
  28. 2022Building Robust Ensembles via Margin Boostingcited by 8
  29. 2023Nash Equilibria, Regularization and Computation in Optimal Transport-Based Distributionally Robust Optimizationcited by 8
  30. 2023ChatGPT-Like Large-Scale Foundation Models for Prognostics and Health Management: A Survey and Roadmapscited by 8
  31. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  32. 2023DSRM: Boost Textual Adversarial Training with Distribution Shift Risk Minimizationcited by 7
  33. 2023Perturbation-Invariant Adversarial Training for Neural Ranking Models: Improving the Effectiveness-Robustness Trade-Offcited by 7
  34. 2024AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuningcited by 7
  35. 2025DuPO: Enabling Reliable LLM Self-Verification via Dual Preference Optimizationcited by 7
  36. 2022Adversarial Neon Beam: A Light-based Physical Attack to DNNscited by 6
  37. 2022Generalization Bounds of Nonconvex-(Strongly)-Concave Stochastic Minimax Optimizationcited by 6
  38. 2023RobArch: Designing Robust Architectures against Adversarial Attackscited by 6

50 most cited of 127 All 127 (JSON)