mlsanityData to 7 Oct 2026

Seasoning Model Soups for Robustness to Adversarial and Natural Distribution Shifts

arXiv 2302.10164 ↗First posted 20 Feb 2023cs.LG cs.CVcited by 23

Not on the map. Why?

Abstract (arXiv)

Adversarial training is widely used to make classifiers robust to a specific threat or adversary, such as ℓp-norm bounded perturbations of a given p-norm. However, existing methods for training classifiers robust to multiple threats require knowledge of all attacks during training and remain vulnerable to unseen distribution shifts. In this work, we describe how to obtain adversarially-robust model soups (i.e., linear combinations of parameters) that smoothly trade-off robustness to different ℓp-norm bounded adversaries. We demonstrate that such soups allow us to control the type and level of robustness, and can achieve robustness to all threats without jointly training on all of them. In some cases, the resulting model soups are more robust to a given ℓp-norm adversary than the constituent model specialized against that same adversary. Finally, we show that adversarially-robust model soups can be a viable tool to adapt to distribution shifts from a few examples.

Key facts. Cited by 23 papers in the map (data through 7 Oct 2026). Builds on 49 of its 61 references that are in the map. First posted on arXiv 20 Feb 2023.

Builds on

49 of 61 references.

References · 49

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Masked Autoencoders Are Scalable Vision Learnerscited by 7,339
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016Wide Residual Networkscited by 3,057
  7. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,875
  8. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  9. 2019RandAugment: Practical automated data augmentation with a reduced search spacecited by 2,261
  10. 2020The Many Faces of Robustness: A Critical Analysis of Out-of-Distribution Generalizationcited by 1,842
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  12. 2019Do ImageNet Classifiers Generalize to ImageNet?cited by 1,507
37 more
  1. 2017Accurate, Large Minibatch SGD: Training ImageNet in 1 Hourcited by 1,479
  2. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  3. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  4. 2019Natural Adversarial Examplescited by 1,401
  5. 2022Model soups: averaging weights of multiple fine-tuned models improves accuracy without increasing inference timecited by 1,366
  6. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  7. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,194
  8. 2020In Search of Lost Domain Generalizationcited by 1,042
  9. 2019Learning Robust Global Representations by Penalizing Local Predictive Powercited by 1,010
  10. 2016Deep Networks with Stochastic Depthcited by 973
  11. 2019AugMix: A Simple Data Processing Method to Improve Robustness and Uncertaintycited by 897
  12. 2021Robust fine-tuning of zero-shot modelscited by 785
  13. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  14. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  15. 2020Overfitting in adversarially robust deep learningcited by 504
  16. 2022Efficient Test-Time Model Adaptation without Forgettingcited by 467
  17. 2020Improving robustness against common corruptions by covariate shift adaptationcited by 427
  18. 2017Snapshot Ensembles: Train 1, get M for freecited by 349
  19. 2020Are we done with ImageNet?cited by 329
  20. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  21. 2019Adversarial Examples Improve Image Recognitioncited by 283
  22. 2020Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examplescited by 275
  23. 2018Generalisation in humans and deep neural networkscited by 237
  24. 2021Improving Robustness using Generated Datacited by 233
  25. 2021Data Augmentation Can Improve Robustnesscited by 193
  26. 2022Patching open-vocabulary models by interpolating weightscited by 187
  27. 2019Adversarial Training and Robustness for Multiple Perturbationscited by 182
  28. 2022Diverse Weight Averaging for Out-of-Distribution Generalizationcited by 148
  29. 2022(Certified!!) Adversarial Robustness for Free!cited by 130
  30. 2019Adversarial Robustness Against the Union of Multiple Perturbation Modelscited by 88
  31. 2021On the effectiveness of adversarial training against common corruptionscited by 71
  32. 2021Mind the box: l1-APGD for sparse adversarial attacks on image classifierscited by 50
  33. 2021Pyramid Adversarial Training Improves ViT Performancecited by 39
  34. 2022How to Robustify Black-Box ML Models? A Zeroth-Order Optimization Perspectivecited by 39
  35. 2021Defending Against Image Corruptions Through Adversarial Augmentationscited by 28
  36. 2021Adversarial Robustness against Multiple and Single lp-Threat Models via Quick Fine-Tuning of Robust Classifierscited by 23
  37. 2020Learning to Generate Noise for Multi-Attack Robustnesscited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 10; 2025: 6; 2026: 2.

23 papers.

Sort:

By area:

  1. 2024Model Merging in LLMs, MLLMs, and Beyond: Methods, Theories, Applications and Opportunitiescited by 247
  2. 2023Rewarded soups: towards Pareto-optimal alignment by interpolating weights fine-tuned on diverse rewardscited by 232
  3. 2024WARM: On the Benefits of Weight Averaged Reward Modelscited by 145
  4. 2023Deep Model Fusion: A Surveycited by 89
  5. 2023UnIVAL: Unified Model for Image, Video, Audio and Language Taskscited by 44
  6. 2023Sparse Model Soups: A Recipe for Improved Pruning via Model Averagingcited by 20
  7. 2024Rethinking Weight-Averaged Model-mergingcited by 8
  8. 2023Towards Robust Pruning: An Adaptive Knowledge-Retention Pruning Strategy for Language Modelscited by 7
  9. 2024Adversarial Training: A Surveycited by 6
  10. 2025FCOS: A Two-Stage Recoverable Model Pruning Framework for Automatic Modulation Recognitioncited by 4
  11. 2025A Systematic Study of In-the-Wild Model Merging for Large Language Modelscited by 4
  12. 2024Benchmarking Out-of-Distribution Generalization Capabilities of DNN-based Encoding Models for the Ventral Visual Cortexcited by 3
11 more
  1. 2024Learning Scalable Model Soup on a Single GPU: An Efficient Subspace Training Strategycited by 3
  2. 2024Hyper Adversarial Tuning for Boosting Adversarial Robustness of Pretrained Large Vision Modelscited by 2
  3. 2025Merge Now, Regret Later: The Hidden Cost of Model Merging Is Adversarial Transferabilitycited by 2
  4. 2025Private Zeroth-Order Optimization with Public Datacited by 2
  5. 2024The Risk of Federated Learning to Skew Fine-Tuning Features and Underperform Out-of-Distribution Robustnesscited by 1
  6. 2024RADIN: Souping on a Budgetcited by 1
  7. 2024Test-time Adversarial Defense with Opposite Adversarial Path and High Attack Time Costcited by 1
  8. 2026Self-Soupervision: Cooking Model Soups without Labelscited by 1
  9. 2025Enhanced Soups for Graph Neural Networkscited by 0
  10. 2025Exploring Synergistic Ensemble Learning: Uniting CNNs, MLP-Mixers, and Vision Transformers to Enhance Image Classificationcited by 0
  11. 2026RoME: Robust Mixture of Low-Rank Experts against Multiple Adversarial Perturbationscited by 0