mlsanityData to 7 Oct 2026

Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustness

arXiv 2302.03015 ↗First posted 6 Feb 2023cs.LGcited by 35

Not on the map. Why?

Abstract (arXiv)

The robustness of a deep classifier can be characterized by its margins: the decision boundary's distances to natural data points. However, it is unclear whether existing robust training methods effectively increase the margin for each vulnerable point during training. To understand this, we propose a continuous-time framework for quantifying the relative speed of the decision boundary with respect to each individual point. Through visualizing the moving speed of the decision boundary under Adversarial Training, one of the most effective robust training algorithms, a surprising moving-behavior is revealed: the decision boundary moves away from some vulnerable points but simultaneously moves closer to others, decreasing their margins. To alleviate these conflicting dynamics of the decision boundary, we propose Dynamics-aware Robust Training (DyART), which encourages the decision boundary to engage in movement that prioritizes increasing smaller margins. In contrast to prior works, DyART directly operates on the margins rather than their indirect approximations, allowing for more targeted and effective robustness improvement. Experiments on the CIFAR-10 and Tiny-ImageNet datasets verify that DyART alleviates the conflicting dynamics of the decision boundary and obtains improved robustness under various perturbation sizes compared to the state-of-the-art defenses. Our code is available at https://github.com/Yuancheng-Xu/Dynamics-Aware-Robust-Training.

Key facts. Cited by 35 papers in the map (data through 7 Oct 2026). Builds on 38 of its 55 references that are in the map. First posted on arXiv 6 Feb 2023.

Builds on

38 of 55 references.

References · 38

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2020Denoising Diffusion Probabilistic Modelscited by 20,851
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016SGDR: Stochastic Gradient Descent with Warm Restartscited by 4,993
  6. 2016Wide Residual Networkscited by 3,057
  7. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 2,994
  8. 2016Identity Mappings in Deep Residual Networkscited by 1,960
  9. 2018Group Normalizationcited by 1,514
  10. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  11. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  12. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
26 more
  1. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,194
  2. 2014Deep Neural Networks are Easily Fooled: High Confidence Predictions for Unrecognizable Imagescited by 774
  3. 2019Adversarial Training for Free!cited by 638
  4. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  5. 2020Overfitting in adversarially robust deep learningcited by 504
  6. 2018Efficient Neural Network Robustness Certification with General Activation Functionscited by 439
  7. 2021Opacus: User-Friendly Differential Privacy Library in PyTorchcited by 375
  8. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  9. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  10. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  11. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 242
  12. 2021Improving Robustness using Generated Datacited by 233
  13. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  14. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
  15. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  16. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  17. 2018Large Margin Deep Networks for Classificationcited by 110
  18. 2020Learnable Boundary Guided Adversarial Trainingcited by 93
  19. 2019Controlling Neural Level Setscited by 76
  20. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
  21. 2020Fundamental Tradeoffs between Invariance and Sensitivity to Adversarial Perturbationscited by 55
  22. 2018Provable Robustness of ReLU networks via Maximization of Linear Regionscited by 51
  23. 2019Robustness to Adversarial Perturbations in Learning from Incomplete Datacited by 49
  24. 2019Characterizing the Decision Boundary of Deep Neural Networkscited by 32
  25. 2020Hold me tight! Influence of discriminative features on deep network boundariescited by 31
  26. 2020Are Adversarial Examples Created Equal? A Learnable Weighted Minimax Risk for Robustness under Non-uniform Attackscited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 12; 2024: 13; 2025: 5; 2026: 5.

35 papers.

Sort:

By area:

  1. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Modelscited by 48
  2. 2023Certified Robustness via Dynamic Margin Maximization and Improved Lipschitz Regularizationcited by 19
  3. 2025One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIPcited by 15
  4. 2024Detecting Brittle Decisions for Free: Leveraging Margin Consistency in Deep Robust Classifierscited by 10
  5. 2024Shedding More Light on Robust Classifiers under the lens of Energy-based Modelscited by 9
  6. 2024Efficient local linearity regularization to overcome catastrophic overfittingcited by 7
  7. 2024σ-zero: Gradient-based Optimization of ℓ0-norm Adversarial Examplescited by 7
  8. 2023Adapting Static Fairness to Sequential Decision-Making: Bias Mitigation Strategies towards Equal Long-term Benefit Ratecited by 6
  9. 2023SoK: Unintended Interactions among Machine Learning Defenses and Riskscited by 6
  10. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  11. 2026Do Images Speak Louder than Words? Investigating the Effect of Textual Misinformation in VLMscited by 6
  12. 2025Adversarial Training for Defense Against Label Poisoning Attackscited by 5
23 more
  1. 2025When Data-Free Knowledge Distillation Meets Non-Transferable Teacher: Escaping Out-of-Distribution Trap is All You Needcited by 5
  2. 2023Splitting the Difference on Adversarial Trainingcited by 4
  3. 2023OODRobustBench: a Benchmark and Large-Scale Analysis of Adversarial Robustness under Distribution Shiftcited by 4
  4. 2023The Best Defense is Attack: Repairing Semantics in Textual Adversarial Examplescited by 3
  5. 2023Generating Less Certain Adversarial Examples Improves Robust Generalizationcited by 3
  6. 2024Compositional Curvature Bounds for Deep Neural Networkscited by 3
  7. 2024On Using Certified Training towards Empirical Robustnesscited by 3
  8. 2024TIMA: Text-Image Mutual Awareness for Balancing Zero-Shot Adversarial Robustness and Generalization Abilitycited by 2
  9. 2024On the Robustness of Adversarial Training Against Uncertainty Attackscited by 2
  10. 2024Robust image classification with multi-modal large language modelscited by 2
  11. 2023Rapid Plug-in Defenderscited by 1
  12. 2023Post-train Black-box Defense via Bayesian Boundary Correctioncited by 1
  13. 2024Adversarial Training of Two-Layer Polynomial and ReLU Activation Networks via Convex Optimizationcited by 1
  14. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
  15. 2023Adaptive Certified Training: Towards Better Accuracy-Robustness Tradeoffscited by 0
  16. 2023Learn from the Past: A Proxy Guided Adversarial Defense Framework with Self Distillation Regularizationcited by 0
  17. 2023F2AT: Feature-Focusing Adversarial Training via Disentanglement of Natural and Perturbed Patternscited by 0
  18. 2025Does simple trump complex? Comparing strategies for adversarial robustness in DNNscited by 0
  19. 2025Tight Robustness Certificates and Wasserstein Distributional Attacks for Deep Neural Networkscited by 0
  20. 2026Uncovering and Understanding FPR Manipulation Attack in Industrial IoT Networkscited by 0
  21. 2026Margin-Consistent Deep Subtyping of Invasive Lung Adenocarcinoma via Perturbation Fidelity in Whole-Slide Image Analysiscited by 0
  22. 2026VanillaBench: The Hidden Accuracy Cost of Adversarial Robustnesscited by 0
  23. 2026Adversarial Frontiers: Minimum-Norm Attack Ensembles for Robustness Evaluationcited by 0