Generating Less Certain Adversarial Examples Improves Robust Generalization
Not on the map. Why?
Abstract (arXiv)
This paper revisits the robust overfitting phenomenon of adversarial training. Observing that models with better robust generalization performance are less certain in predicting adversarially generated training inputs, we argue that overconfidence in predicting adversarial examples is a potential cause. Therefore, we hypothesize that generating less certain adversarial examples improves robust generalization, and propose a formal definition of adversarial certainty that captures the variance of the model's predicted logits on adversarial examples. Our theoretical analysis of synthetic distributions characterizes the connection between adversarial certainty and robust generalization. Accordingly, built upon the notion of adversarial certainty, we develop a general method to search for models that can generate training-time adversarial inputs with reduced certainty, while maintaining the model's capability in distinguishing adversarial examples. Extensive experiments on image benchmarks demonstrate that our method effectively learns models with consistently improved robustness and mitigates robust overfitting, confirming the importance of generating less certain adversarial examples for robust generalization. Our implementations are available as open-source code at: https://github.com/TrustMLRG/AdvCertainty.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 48 of its 56 references that are in the map. First posted on arXiv 6 Oct 2023.
Builds on
48 of 56 references.
References · 48
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2013Intriguing properties of neural networkscited by 5,114
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
- 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
- 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 950
- 2018Robustness May Be at Odds with Accuracycited by 873
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
36 more
- 2020Fast is better than free: Revisiting adversarial trainingcited by 723
- 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 675
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
- 2019Adversarial Training for Free!cited by 638
- 2020Overfitting in adversarially robust deep learningcited by 504
- 2019Unlabeled Data Improves Adversarial Robustnesscited by 415
- 2018Feature Denoising for Improving Adversarial Robustnesscited by 312
- 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
- 2015DeepDriving: Learning Affordance for Direct Perception in Autonomous Drivingcited by 229
- 2020Understanding and Improving Fast Adversarial Trainingcited by 213
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 207
- 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 201
- 2018Spatially Transformed Adversarial Examplescited by 195
- 2019Are Labels Required for Improving Adversarial Robustness?cited by 162
- 2019AdvHat: Real-world adversarial attack on ArcFace Face ID systemcited by 161
- 2019Understanding Adversarial Attacks on Deep Learning Based Medical Image Analysis Systemscited by 151
- 2018Optimistic mirror descent in saddle-point problems: Going the extra (gradient) milecited by 132
- 2018The Limit Points of (Optimistic) Gradient Descent in Min-Max Optimizationcited by 98
- 2020Efficient Methods for Structured Nonconvex-Nonconcave Min-Max Optimizationcited by 94
- 2020Reevaluating Adversarial Examples in Natural Languagecited by 83
- 2019Convergence of Adversarial Training in Overparametrized Neural Networkscited by 58
- 2018On the Suitability of Lp-norms for Creating and Preventing Adversarial Examplescited by 57
- 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
- 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
- 2020The limits of min-max optimization algorithms: convergence to spurious non-critical setscited by 50
- 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 50
- 2017Geometric robustness of deep networks: analysis and improvementcited by 45
- 2021Consistency Regularization for Adversarial Robustnesscited by 42
- 2022Enhancing Adversarial Training with Second-Order Statistics of Weightscited by 42
- 2020Over-parameterized Adversarial Training: An Analysis Overcoming the Curse of Dimensionalitycited by 36
- 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 35
- 2018Theoretical Analysis of Adversarial Learning: A Minimax Approachcited by 31
- 2023Escaping limit cycles: Global convergence for constrained nonconvex-nonconcave minimax problemscited by 21
- 2022Adversarial Unlearning: Reducing Confidence Along Adversarial Directionscited by 14
- 2019Convergence of Gradient Methods on Bilinear Zero-Sum Gamescited by 12
- 2020Adversarial Training with Stochastic Weight Averagecited by 12
Built on by
Citing papers per year: 2024: 1; 2025: 0; 2026: 2.
3 papers.