mlsanityData to 7 Oct 2026

Improving Accuracy-robustness Trade-off via Pixel Reweighted Adversarial Training

arXiv 2406.00685 ↗First posted 2 Jun 2024cs.CV cs.LGcited by 6

Not on the map. Why?

Abstract (arXiv)

Adversarial training (AT) trains models using adversarial examples (AEs), which are natural images modified with specific perturbations to mislead the model. These perturbations are constrained by a predefined perturbation budget ε and are equally applied to each pixel within an image. However, in this paper, we discover that not all pixels contribute equally to the accuracy on AEs (i.e., robustness) and accuracy on natural images (i.e., accuracy). Motivated by this finding, we propose Pixel-reweighted AdveRsarial Training (PART), a new framework that partially reduces ε for less influential pixels, guiding the model to focus more on key regions that affect its outputs. Specifically, we first use class activation mapping (CAM) methods to identify important pixel regions, then we keep the perturbation budget for these regions while lowering it for the remaining regions when generating AEs. In the end, we use these pixel-reweighted AEs to train a model. PART achieves a notable improvement in accuracy without compromising robustness on CIFAR-10, SVHN and TinyImagenet-200, justifying the necessity to allocate distinct weights to different pixel regions in robust classification.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Builds on 41 of its 49 references that are in the map. First posted on arXiv 2 Jun 2024.

Builds on

41 of 49 references.

References · 41

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2013Intriguing properties of neural networkscited by 5,114
  6. 2016"Why Should I Trust You?": Explaining the Predictions of Any Classifiercited by 5,040
  7. 2016Wide Residual Networkscited by 3,057
  8. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  9. 2015Learning Deep Features for Discriminative Localizationcited by 2,430
  10. 2020Shortcut Learning in Deep Neural Networkscited by 1,928
  11. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
29 more
  1. 2018ImageNet-trained CNNs are biased towards texture; increasing shape bias improves accuracy and robustnesscited by 1,430
  2. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  3. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 682
  4. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  5. 2020Overfitting in adversarially robust deep learningcited by 504
  6. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  7. 2022Diffusion Models for Adversarial Purificationcited by 469
  8. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 333
  9. 2018Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionalitycited by 280
  10. 2019Approximating CNNs with Bag-of-local-Features models works surprisingly well on ImageNetcited by 260
  11. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  12. 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
  13. 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 171
  14. 2020Axiom-based Grad-CAM: Towards Accurate Visualization and Explanation of CNNscited by 151
  15. 2021Adversarial purification with Score-based generative modelscited by 132
  16. 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
  17. 2020What shapes feature representations? Exploring datasets, architectures, and trainingcited by 125
  18. 2018Curriculum Adversarial Trainingcited by 89
  19. 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
  20. 2021Online Adversarial Purification based on Self-Supervisioncited by 45
  21. 2020Maximum Mean Discrepancy Test is Aware of Adversarial Attackscited by 44
  22. 2022Optimizing Relevance Maps of Vision Transformers Improves Robustnesscited by 41
  23. 2023Detecting Adversarial Data by Probing Multiple Perturbations Using Expected Perturbation Scorecited by 20
  24. 2021Removing Adversarial Noise in Class Activation Feature Spacecited by 18
  25. 2019Learning from weakly dependent data under Dobrushin's conditioncited by 13
  26. 2022Fast and Reliable Evaluation of Adversarial Robustness with Minimum-Margin Attackcited by 13
  27. 2021Black-box Adversarial Attacks in Autonomous Vehicle Technologycited by 9
  28. 2021Modeling Adversarial Noise for Adversarial Trainingcited by 8
  29. 2018Attention, Please! Adversarial Defense via Activation Rectification and Preservationcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 3; 2026: 2.

6 papers.

  1. 2025One Stone, Two Birds: Enhancing Adversarial Defense Through the Lens of Distributional Discrepancycited by 3
  2. 2024New Paradigm of Adversarial Training: Releasing Accuracy-Robustness Trade-Off via Dummy Classcited by 2
  3. 2025Sample-Specific Noise Injection For Diffusion-Based Adversarial Purificationcited by 2
  4. 2025Generalist++: A Meta-learning Framework for Mitigating Trade-off in Adversarial Trainingcited by 1
  5. 2026Information Theoretic Adversarial Training of Large Language Modelscited by 0
  6. 2026USAD: Uncertainty-aware Statistical Adversarial Detectioncited by 0