mlsanityData to 14 Oct 2026

Sharpness-Aware Minimization Alone can Improve Adversarial Robustness

arXiv 2305.05392 ↗First posted 9 May 2023cs.LG cs.AIcited by 14

Not on the map. Why?

Abstract (arXiv)

Sharpness-Aware Minimization (SAM) is an effective method for improving generalization ability by regularizing loss sharpness. In this paper, we explore SAM in the context of adversarial robustness. We find that using only SAM can achieve superior adversarial robustness without sacrificing clean accuracy compared to standard training, which is an unexpected benefit. We also discuss the relation between SAM and adversarial training (AT), a popular method for improving the adversarial robustness of DNNs. In particular, we show that SAM and AT differ in terms of perturbation strength, leading to different accuracy and robustness trade-offs. We provide theoretical evidence for these claims in a simplified model. Finally, while AT suffers from decreased clean accuracy and computational overhead, we suggest that SAM can be regarded as a lightweight substitute for AT under certain requirements. Code is available at https://github.com/weizeming/SAM_AT.

Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Builds on 32 of its 43 references that are in the map. First posted on arXiv 9 May 2023.

Builds on

32 of 43 references.

References · 32

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  5. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  6. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  7. 2016On Large-Batch Training for Deep Learning: Generalization Gap and Sharp Minimacited by 1,352
  8. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  9. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  10. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  11. 2018Robustness May Be at Odds with Accuracycited by 880
  12. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
20 more
  1. 2019Adversarial Training for Free!cited by 643
  2. 2017Exploring Generalization in Deep Learningcited by 600
  3. 2017Computing Nonvacuous Generalization Bounds for Deep (Stochastic) Neural Networks with Many More Parameters than Training Datacited by 533
  4. 2016Entropy-SGD: Biasing Gradient Descent Into Wide Valleyscited by 359
  5. 2018Feature Denoising for Improving Adversarial Robustnesscited by 314
  6. 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 153
  7. 2020To be Robust or to be Fair: Towards Fairness in Adversarial Trainingcited by 137
  8. 2021Efficient Sharpness-aware Minimization for Improved Training of Neural Networkscited by 137
  9. 2021On the Convergence and Robustness of Adversarial Trainingcited by 130
  10. 2022Towards Efficient and Scalable Sharpness-Aware Minimizationcited by 129
  11. 2021Sharpness-Aware Minimization Improves Language Model Generalizationcited by 108
  12. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  13. 2022Fisher SAM: Information Geometry and Sharpness Aware Minimisationcited by 84
  14. 2022Make Sharpness-Aware Minimization Stronger: A Sparsified Perturbation Approachcited by 70
  15. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  16. 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
  17. 2022Improving Sharpness-Aware Minimization with Fisher Mask for Better Generalization on Language Modelscited by 42
  18. 2022Robust Weight Perturbation for Adversarial Trainingcited by 25
  19. 2023Generalist: Decoupling Natural and Robust Generalizationcited by 14
  20. 2023Using Z3 for Formal Modeling and Verification of FNN Global Robustnesscited by 5

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2023: 2; 2024: 3; 2025: 7; 2026: 2.

14 papers.

Sort:

By area:

  1. 2025Towards LLM Unlearning Resilient to Relearning Attacks: A Sharpness-Aware Minimization Perspective and Beyondcited by 79
  2. 2023Normalization Layers Are All That Sharpness-Aware Minimization Needscited by 27
  3. 2024Exploring the Robustness of In-Context Learning with Noisy Labelscited by 14
  4. 2025FORCE: Transferable Visual Jailbreaking Attacks via Feature Over-Reliance CorrEctioncited by 11
  5. 2024Stabilizing Sharpness-aware Minimization Through A Simple Renormalization Strategycited by 8
  6. 2025SAFE: Finding Sparse and Flat Minima to Improve Pruningcited by 5
  7. 2025When Flatness Does (Not) Guarantee Adversarial Robustnesscited by 3
  8. 2025Dual-Space Smoothness for Robust and Balanced LLM Unlearningcited by 2
  9. 2023Enhancing Adversarial Attacks: The Similar Target Methodcited by 1
  10. 2026Beyond Superficial Unlearning: Sharpness-Aware Robust Erasure of Hallucinations in Multimodal LLMscited by 1
  11. 2024Enhancing generalization in high energy physics using white-box adversarial attackscited by 0
  12. 2025Sharpness-Aware Geometric Defense for Robust Out-Of-Distribution Detectioncited by 0
2 more
  1. 2025Sharpness-Aware Minimization Can Hallucinate Minimizerscited by 0
  2. 2026Improving Adversarial Robustness of Attribution via Implicit Regularizationcited by 0