mlsanityData to 14 Oct 2026

Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspective

arXiv 2310.19360 ↗First posted 30 Oct 2023cs.LG cs.AI cs.CVcited by 18

Not on the map. Why?

Abstract (arXiv)

Adversarial Training (AT) has become arguably the state-of-the-art algorithm for extracting robust features. However, researchers recently notice that AT suffers from severe robust overfitting problems, particularly after learning rate (LR) decay. In this paper, we explain this phenomenon by viewing adversarial training as a dynamic minimax game between the model trainer and the attacker. Specifically, we analyze how LR decay breaks the balance between the minimax game by empowering the trainer with a stronger memorization ability, and show such imbalance induces robust overfitting as a result of memorizing non-robust features. We validate this understanding with extensive experiments, and provide a holistic view of robust overfitting from the dynamics of both the two game players. This understanding further inspires us to alleviate robust overfitting by rebalancing the two players by either regularizing the trainer's capacity or improving the attack strength. Experiments show that the proposed ReBalanced Adversarial Training (ReBAT) can attain good robustness and does not suffer from robust overfitting even after very long training. Code is available at https://github.com/PKU-ML/ReBAT.

Key facts. Cited by 18 papers in the map (data through 14 Oct 2026). Builds on 50 of its 59 references that are in the map. First posted on arXiv 30 Oct 2023.

Builds on

50 of 59 references.

References · 50

  1. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  2. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2018MobileNetV2: Inverted Residuals and Linear Bottleneckscited by 4,795
  7. 2020Bootstrap your own latent: A new approach to self-supervised Learningcited by 4,750
  8. 2016Wide Residual Networkscited by 3,070
  9. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  10. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
38 more
  1. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  2. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  3. 2017Visualizing the Loss Landscape of Neural Netscited by 1,130
  4. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  5. 2018Robustness May Be at Odds with Accuracycited by 880
  6. 2020Overfitting in adversarially robust deep learningcited by 506
  7. 2017Train longer, generalize better: closing the generalization gap in large batch training of neural networkscited by 279
  8. 2020Bag of Tricks for Adversarial Trainingcited by 200
  9. 2021Data Augmentation Can Improve Robustnesscited by 194
  10. 2021Unlearnable Examples: Making Personal Data Unexploitablecited by 193
  11. 2019Towards Explaining the Regularization Effect of Initial Large Learning Rate in Training Neural Networkscited by 162
  12. 2019Adversarial Robustness through Local Linearizationcited by 146
  13. 2021On the Convergence and Robustness of Adversarial Trainingcited by 130
  14. 2021Adversarial Examples Make Strong Poisonscited by 119
  15. 2018Curriculum Adversarial Trainingcited by 89
  16. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  17. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  18. 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
  19. 2021Exploring Memorization in Adversarial Trainingcited by 55
  20. 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
  21. 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 51
  22. 2023Data Augmentation Alone Can Improve Adversarial Trainingcited by 43
  23. 2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
  24. 2020Randomization matters. How to defend against strong adversarial attackscited by 37
  25. 2020Adversarial Example Gamescited by 34
  26. 2022Understanding and Combating Robust Overfitting via Input Loss Landscape Analysis and Regularizationcited by 22
  27. 2020A Game Theoretic Analysis of Additive Adversarial Attacks and Defensescited by 21
  28. 2022Scaling Adversarial Training to Large Perturbation Boundscited by 20
  29. 2023Rethinking the Effect of Data Augmentation in Adversarial Contrastive Learningcited by 20
  30. 2021A Unified Game-Theoretic Interpretation of Adversarial Robustnesscited by 17
  31. 2023Adversarial Examples Are Not Real Featurescited by 16
  32. 2023Generalist: Decoupling Natural and Robust Generalizationcited by 14
  33. 2021Fooling Adversarial Training with Inducing Noisecited by 13
  34. 2022A Unified Contrastive Energy-based Model for Understanding the Generative Ability of Adversarial Trainingcited by 13
  35. 2016Randomized Prediction Games for Adversarial Machine Learningcited by 11
  36. 2022Nash Equilibria and Pitfalls of Adversarial Training in Adversarial Robustness Gamescited by 8
  37. 2022Strength-Adaptive Adversarial Trainingcited by 3
  38. 2020Decoder-free Robustness Disentanglement without (Additional) Supervisioncited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 11; 2025: 5; 2026: 2.

18 papers.

Sort:

By area:

  1. 2024Pre-trained Model Guided Fine-Tuning for Zero-Shot Adversarial Robustnesscited by 48
  2. 2024On the Duality Between Sharpness-Aware Minimization and Adversarial Trainingcited by 24
  3. 2024Bidirectional Consistency Modelscited by 18
  4. 2024Layer-Aware Analysis of Catastrophic Overfitting: Revealing the Pseudo-Robust Shortcut Dependencycited by 10
  5. 2024Soften to Defend: Towards Adversarial Robustness via Self-Guided Label Refinementcited by 9
  6. 2024On Using Certified Training towards Empirical Robustnesscited by 3
  7. 2024Can't Slow me Down: Learning Robust and Hardware-Adaptive Object Detectors against Latency Attacks for Edge Devicescited by 3
  8. 2025Failure Cases Are Better Learned But Boundary Says Sorry: Facilitating Smooth Perception Change for Accuracy-Robustness Trade-Off in Adversarial Trainingcited by 3
  9. 2024SGW-based Multi-Task Learning in Vision Taskscited by 2
  10. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  11. 2025Robustness Feature Adapter for Efficient Adversarial Trainingcited by 2
  12. 2024ZeroPur: Succinct Training-Free Adversarial Purificationcited by 1
6 more
  1. 2024Leveraging Group Classification with Descending Soft Labeling for Deep Imbalanced Regressioncited by 1
  2. 2025Provable Robust Overfitting Mitigation in Wasserstein Distributionally Robust Optimizationcited by 0
  3. 2025Identifying and Understanding Cross-Class Features in Adversarial Trainingcited by 0
  4. 2025Sample-wise Adaptive Weighting for Transfer Consistency in Adversarial Distillationcited by 0
  5. 2026Expanding the Role of Diffusion Models for Robust Classifier Trainingcited by 0
  6. 2026Robust Alignment: Harmonizing Clean Accuracy and Adversarial Robustness in Adversarial Trainingcited by 0