mlsanityData to 7 Oct 2026

Make Some Noise: Reliable and Efficient Single-Step Adversarial Training

arXiv 2202.01181 ↗First posted 2 Feb 2022cs.LG cs.CVcited by 42

Not on the map. Why?

Abstract (arXiv)

Recently, Wong et al. showed that adversarial training with single-step FGSM leads to a characteristic failure mode named Catastrophic Overfitting (CO), in which a model becomes suddenly vulnerable to multi-step attacks. Experimentally they showed that simply adding a random perturbation prior to FGSM (RS-FGSM) could prevent CO. However, Andriushchenko and Flammarion observed that RS-FGSM still leads to CO for larger perturbations, and proposed a computationally expensive regularizer (GradAlign) to avoid it. In this work, we methodically revisit the role of noise and clipping in single-step adversarial training. Contrary to previous intuitions, we find that using a stronger noise around the clean sample combined with textitnot clipping is highly effective in avoiding CO for large perturbation radii. We then propose Noise-FGSM (N-FGSM) that, while providing the benefits of single-step adversarial training, does not suffer from CO. Empirical analyses on a large suite of experiments show that N-FGSM is able to match or surpass the performance of previous state-of-the-art GradAlign, while achieving 3x speed-up. Code can be found in https://github.com/pdejorge/N-FGSM

Key facts. Cited by 42 papers in the map (data through 7 Oct 2026). Builds on 30 of its 53 references that are in the map. First posted on arXiv 2 Feb 2022.

Builds on

30 of 53 references.

References · 30

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2015Delving Deep into Rectifiers: Surpassing Human-Level Performance on ImageNet Classificationcited by 3,590
  7. 2016Wide Residual Networkscited by 3,057
  8. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  10. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  11. 2016Adversarial Machine Learning at Scalecited by 934
  12. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
18 more
  1. 2020Fast is better than free: Revisiting adversarial trainingcited by 723
  2. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
  3. 2019Adversarial Training for Free!cited by 638
  4. 2020Overfitting in adversarially robust deep learningcited by 504
  5. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411
  6. 2017Parseval Networks: Improving Robustness to Adversarial Examplescited by 288
  7. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  8. 2020Understanding and Improving Fast Adversarial Trainingcited by 213
  9. 2019Adversarial Examples Are a Natural Consequence of Test Error in Noisecited by 114
  10. 2020Understanding Catastrophic Overfitting in Single-step Adversarial Trainingcited by 75
  11. 2020Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defensescited by 61
  12. 2020Single-step Adversarial training with Dropout Schedulingcited by 40
  13. 2020Towards Understanding Fast Adversarial Trainingcited by 32
  14. 2021Reliably fast adversarial training via latent adversarial perturbationcited by 29
  15. 2019Simple Physical Adversarial Examples against End-to-End Autonomous Driving Modelscited by 17
  16. 2021ZeroGrad : Mitigating and Explaining Catastrophic Overfitting in FGSM Adversarial Trainingcited by 14
  17. 2018Robustness via Deep Low-Rank Representationscited by 11
  18. 2021Understanding Catastrophic Overfitting in Adversarial Trainingcited by 11

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 4; 2023: 8; 2024: 20; 2025: 4; 2026: 6.

42 papers.

Sort:

By area:

  1. 2024One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Modelscited by 48
  2. 2022The Enemy of My Enemy is My Friend: Exploring Inverse Adversaries for Improving Adversarial Trainingcited by 22
  3. 2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Modelscited by 19
  4. 2022Revisiting adapters with adversarial trainingcited by 18
  5. 2023Revisiting and Exploring Efficient Fast Adversarial Training via LAW: Lipschitz Regularization and Auto Weight Averagingcited by 14
  6. 2024Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspectivecited by 12
  7. 2024Eliminating Catastrophic Overfitting Via Abnormal Adversarial Examples Regularizationcited by 11
  8. 2022Adversarial Coreset Selection for Efficient Robust Trainingcited by 9
  9. 2024Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependencycited by 9
  10. 2024Efficient local linearity regularization to overcome catastrophic overfittingcited by 7
  11. 2024Robust NAS under adversarial training: benchmark, theory, and beyondcited by 6
  12. 2024Adversarial Training: A Surveycited by 6
30 more
  1. 2023Focus on Hiders: Exploring Hidden Threats for Enhancing Adversarial Trainingcited by 5
  2. 2024Catastrophic Overfitting: A Potential Blessing in Disguisecited by 4
  3. 2024Sparse-PGD: A Unified Framework for Sparse Adversarial Perturbations Generationcited by 4
  4. 2023Sharpness-Aware Graph Collaborative Filteringcited by 3
  5. 2024A Random Ensemble of Encrypted Vision Transformers for Adversarially Robust Defensecited by 3
  6. 2024On Using Certified Training towards Empirical Robustnesscited by 3
  7. 2024Filtered Randomized Smoothing: A New Defense for Robust Modulation Classificationcited by 3
  8. 2025RIVAL: Reinforcement Learning with Iterative and Adversarial Optimization for Machine Translationcited by 3
  9. 2022Catastrophic overfitting can be induced with discriminative non-robust featurescited by 2
  10. 2023Certifying Ensembles: A General Certification Theory with S-Lipschitznesscited by 2
  11. 2023Hindering Adversarial Attacks with Multiple Encrypted Patch Embeddingscited by 2
  12. 2024Improving Fast Adversarial Training via Self-Knowledge Guidancecited by 2
  13. 2024Enhancing Adversarial Robustness via Uncertainty-Aware Distributional Adversarial Trainingcited by 2
  14. 2025Understanding Adversarial Training with Energy-based Modelscited by 2
  15. 2023Efficient Key-Based Adversarial Defense for ImageNet by Using Pre-trained Modelcited by 1
  16. 2026Learning Better Certified Models from Empirically-Robust Teacherscited by 1
  17. 2026Mitigating Error Amplification in Fast Adversarial Trainingcited by 1
  18. 2023Revisiting and Advancing Adversarial Training Through A Simple Baselinecited by 0
  19. 2023Blacksmith: Fast Adversarial Training of Vision Transformers via a Mixture of Single-step and Multi-step Methodscited by 0
  20. 2024ADAPT to Robustify Prompt Tuning Vision Transformerscited by 0
  21. 2024Towards Understanding Dual BN In Hybrid Adversarial Trainingcited by 0
  22. 2024Batch-in-Batch: a new adversarial training framework for initial perturbation and sample selectioncited by 0
  23. 2024Improving Fast Adversarial Training Paradigm: An Example Taxonomy Perspectivecited by 0
  24. 2024Sustainable Self-evolution Adversarial Trainingcited by 0
  25. 2025Fast Adversarial Training against Sparse Attacks Requires Loss Smoothingcited by 0
  26. 2025Catastrophic Overfitting, Entropy Gap and Participation Ratio: A Noiseless lp Norm Solution for Fast Adversarial Trainingcited by 0
  27. 2026Quadratic Upper Bound for Boosting Robustnesscited by 0
  28. 2026FastAT Benchmark: A Comprehensive Framework for Fair Evaluation of Fast Adversarial Training Methodscited by 0
  29. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0
  30. 2026Margin-Drop Coordinates for Cross-Budget Robustness Evaluationcited by 0