mlsanityData to 7 Oct 2026

Scaling Adversarial Training to Large Perturbation Bounds

arXiv 2210.09852 ↗First posted 18 Oct 2022cs.LG cs.CR cs.CVcited by 20

Not on the map. Why?

Abstract (arXiv)

The vulnerability of Deep Neural Networks to Adversarial Attacks has fuelled research towards building robust models. While most Adversarial Training algorithms aim at defending attacks constrained within low magnitude Lp norm bounds, real-world adversaries are not limited by such constraints. In this work, we aim to achieve adversarial robustness within larger bounds, against perturbations that may be perceptible, but do not change human (or Oracle) prediction. The presence of images that flip Oracle predictions and those that do not makes this a challenging setting for adversarial robustness. We discuss the ideal goals of an adversarial defense algorithm beyond perceptual limits, and further highlight the shortcomings of naively extending existing training algorithms to higher perturbation bounds. In order to overcome these shortcomings, we propose a novel defense, Oracle-Aligned Adversarial Training (OA-AT), to align the predictions of the network with that of an Oracle during adversarial training. The proposed approach achieves state-of-the-art performance at large epsilon bounds (such as an L-inf bound of 16/255 on CIFAR-10) while outperforming existing defenses (AWP, TRADES, PGD-AT) at standard bounds (8/255) as well.

Key facts. Cited by 20 papers in the map (data through 7 Oct 2026). Builds on 36 of its 47 references that are in the map. First posted on arXiv 18 Oct 2022.

Builds on

36 of 47 references.

References · 36

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,029
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Wide Residual Networkscited by 3,057
  7. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  8. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  9. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  10. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  11. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  12. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,194
24 more
  1. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  2. 2018Robustness May Be at Odds with Accuracycited by 873
  3. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  4. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  5. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  6. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  7. 2020Overfitting in adversarially robust deep learningcited by 504
  8. 2019On Evaluating Adversarial Robustnesscited by 442
  9. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  10. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  11. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  12. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  13. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  14. 2020Bag of Tricks for Adversarial Trainingcited by 199
  15. 2020Perceptual Adversarial Robustness: Defense Against Unseen Threat Modelscited by 137
  16. 2020RayS: A Ray Searching Method for Hard-label Adversarial Attackcited by 94
  17. 2019Functional Adversarial Attackscited by 82
  18. 2020Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defensescited by 61
  19. 2016Defensive Distillation is Not Robust to Adversarial Examplescited by 60
  20. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  21. 2019Instance adaptive adversarial training: Improved accuracy tradeoffs in neural netscited by 55
  22. 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
  23. 2021Evaluating the Robustness of Geometry-Aware Instance-Reweighted Adversarial Trainingcited by 12
  24. 2020Towards Deep Learning Models Resistant to Large Perturbationscited by 8

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 1; 2023: 5; 2024: 9; 2025: 3; 2026: 2.

20 papers.

Sort:

  1. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  2. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  3. 2023Fast Adversarial Training with Smooth Convergencecited by 14
  4. 2024DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domaincited by 12
  5. 2025Explain Yourself, Briefly! Self-Explaining Neural Networks with Concise Sufficient Reasonscited by 11
  6. 2024Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifierscited by 10
  7. 2023PubDef: Defending Against Transfer Attacks From Public Modelscited by 7
  8. 2024Efficient local linearity regularization to overcome catastrophic overfittingcited by 7
  9. 2024Adversarial Training: A Surveycited by 6
  10. 2024Robustness-Congruent Adversarial Training for Secure Machine Learning Model Updatescited by 4
  11. 2024Catastrophic Overfitting: A Potential Blessing in Disguisecited by 4
  12. 2024Interpretability-Guided Test-Time Adversarial Defensecited by 3
8 more
  1. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  2. 2024On the Robustness of Adversarial Training Against Uncertainty Attackscited by 2
  3. 2023Understanding Robust Overfitting from the Feature Generalization Perspectivecited by 1
  4. 2025Boosting Adversarial Robustness and Generalization with Dictionary Structurecited by 1
  5. 2025Rethinking Robustness in Machine Learning: A Posterior Agreement Approachcited by 1
  6. 2026Solving adversarial examples requires solving exponential misalignmentcited by 1
  7. 2023Enhancing Robust Representation in Adversarial Training: Alignment and Exclusion Criteriacited by 0
  8. 2026Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluationcited by 0