mlsanityData to 14 Oct 2026

CFA: Class-wise Calibrated Fair Adversarial Training

arXiv 2303.14460 ↗First posted 25 Mar 2023cs.LG cs.CVcited by 53

Not on the map. Why?

Abstract (arXiv)

Adversarial training has been widely acknowledged as the most effective method to improve the adversarial robustness against adversarial examples for Deep Neural Networks (DNNs). So far, most existing works focus on enhancing the overall model robustness, treating each class equally in both the training and testing phases. Although revealing the disparity in robustness among classes, few works try to make adversarial training fair at the class level without sacrificing overall robustness. In this paper, we are the first to theoretically and empirically investigate the preference of different classes for adversarial configurations, including perturbation margin, regularization, and weight averaging. Motivated by this, we further propose a Class-wise calibrated Fair Adversarial training framework, named CFA, which customizes specific training configurations for each class automatically. Experiments on benchmark datasets demonstrate that our proposed CFA can improve both overall robustness and fairness notably over other state-of-the-art methods. Code is available at urlhttps://github.com/PKU-ML/CFA.

Key facts. Cited by 53 papers in the map (data through 14 Oct 2026). Builds on 28 of its 32 references that are in the map. First posted on arXiv 25 Mar 2023.

Builds on

28 of 32 references.

References · 28

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  6. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  7. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  8. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  9. 2018Robustness May Be at Odds with Accuracycited by 880
  10. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  11. 2020Overfitting in adversarially robust deep learningcited by 506
  12. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
16 more
  1. 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
  2. 2015DeepDriving: Learning Affordance for Direct Perception in Autonomous Drivingcited by 231
  3. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  4. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 172
  5. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 153
  6. 2020To be Robust or to be Fair: Towards Fairness in Adversarial Trainingcited by 137
  7. 2021On the Convergence and Robustness of Adversarial Trainingcited by 130
  8. 2018Curriculum Adversarial Trainingcited by 89
  9. 2017Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compressioncited by 87
  10. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  11. 2020CAT: Customized Adversarial Training for Improved Robustnesscited by 61
  12. 2019Instance adaptive adversarial training: Improved accuracy tradeoffs in neural netscited by 55
  13. 2020Robustness May Be at Odds with Fairness: An Empirical Study on Class-wise Accuracycited by 45
  14. 2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
  15. 2021Analysis and Applications of Class-wise Robustness in Adversarial Trainingcited by 33
  16. 2023Generalist: Decoupling Natural and Robust Generalizationcited by 14

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 9; 2024: 23; 2025: 15; 2026: 6.

53 papers.

Sort:

By area:

  1. 2023Robust Classification via a Single Diffusion Modelcited by 79
  2. 2024Fight Back Against Jailbreaking via Prompt Adversarial Tuningcited by 67
  3. 2024On the Duality Between Sharpness-Aware Minimization and Adversarial Trainingcited by 24
  4. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  5. 2023Adversarial Examples Are Not Real Featurescited by 16
  6. 2023Sharpness-Aware Minimization Alone can Improve Adversarial Robustnesscited by 14
  7. 2024Exploring the Robustness of In-Context Learning with Noisy Labelscited by 14
  8. 2024Revisiting Adversarial Training under Long-Tailed Distributionscited by 13
  9. 2024Adversarial Representation Engineering: A General Model Editing Framework for Large Language Modelscited by 12
  10. 2024DAFA: Distance-Aware Fair Adversarial Trainingcited by 11
  11. 2024Towards Fairness-Aware Adversarial Learningcited by 11
  12. 2024Robustly Optimized Deep Feature Decoupling Network for Fatty Liver Diseases Detectioncited by 11
38 more
  1. 2025Enhancing Robust Fairness via Confusional Spectral Regularizationcited by 11
  2. 2025Fast Adversarial Training with Weak-to-Strong Spatial-Temporal Consistency in the Frequency Domain on Videoscited by 9
  3. 2023Improving Adversarial Robust Fairness via Anti-Bias Soft Label Distillationcited by 8
  4. 2023Indirect Gradient Matching for Adversarial Robust Distillationcited by 6
  5. 2024Robust Overfitting Does Matter: Test-Time Adversarial Purification With FGSMcited by 6
  6. 2023Diffused Redundancy in Pre-trained Representationscited by 5
  7. 2024Towards Adversarial Robustness via Debiased High-Confidence Logit Alignmentcited by 5
  8. 2024FAIR-TAT: Improving Model Fairness Using Targeted Adversarial Trainingcited by 5
  9. 2025Long-tailed Adversarial Training with Self-Distillationcited by 5
  10. 2023Generating Less Certain Adversarial Examples Improves Robust Generalizationcited by 3
  11. 2024Exploring Frequencies via Feature Mixing and Meta-Learning for Improving Adversarial Transferabilitycited by 3
  12. 2024Mitigating Low-Frequency Bias: Feature Recalibration and Frequency Attention Regularization for Adversarial Robustnesscited by 3
  13. 2024Interpretability-Guided Test-Time Adversarial Defensecited by 3
  14. 2024Towards Class-wise Robustness Analysiscited by 3
  15. 2026FragileFlow: Spectral Control of Correct-but-Fragile Predictions for Foundation Model Robustnesscited by 3
  16. 2024Improving Fast Adversarial Training via Self-Knowledge Guidancecited by 2
  17. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  18. 2024Combining Machine Learning Defenses without Conflictscited by 2
  19. 2025Towards Fair Class-wise Robustness: Class Optimal Distribution Adversarial Trainingcited by 2
  20. 2025An Investigation of Visual Foundation Models Robustnesscited by 2
  21. 2023Enhancing Adversarial Attacks: The Similar Target Methodcited by 1
  22. 2024Improving Adversarial Training using Vulnerability-Aware Perturbation Budgetcited by 1
  23. 2024On the Adversarial Transferability of Generalized "Skip Connections"cited by 1
  24. 2025Parameter Interpolation Adversarial Training for Robust Image Classificationcited by 1
  25. 2026Taming the Long Tail: Rebalancing Adversarial Training via Adaptive Perturbationcited by 1
  26. 2024Towards Trustworthy Unsupervised Domain Adaptation: A Representation Learning Perspective for Enhancing Robustness, Discrimination, and Generalizationcited by 0
  27. 2024Improving Fast Adversarial Training Paradigm: An Example Taxonomy Perspectivecited by 0
  28. 2024Unrevealed Threats: A Comprehensive Study of the Adversarial Robustness of Underwater Image Enhancement Modelscited by 0
  29. 2025Improving Adversarial Robustness via Phase and Amplitude-aware Promptingcited by 0
  30. 2025Principal Eigenvalue Regularization for Improved Worst-Class Certified Robustness of Smoothed Classifierscited by 0
  31. 2025Identifying and Understanding Cross-Class Features in Adversarial Trainingcited by 0
  32. 2025Towards Class-wise Fair Adversarial Training via Anti-Bias Soft Label Distillationcited by 0
  33. 2025TRIX- Trading Adversarial Fairness via Mixed Adversarial Trainingcited by 0
  34. 2025Sy-FAR: Symmetry-based Fair Adversarial Robustnesscited by 0
  35. 2025Revisiting Adversarial Training under Hyperspectral Imagecited by 0
  36. 2025Stabilizing Multi-Attack Adversarial Training via Bandit Optimizationcited by 0
  37. 2025Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillationcited by 0
  38. 2026Adaptive Causal Alignment for High-Confidence Adversarial Trainingcited by 0

50 most cited of 53 All 53 (JSON)