mlsanityData to 14 Oct 2026

Preventing Catastrophic Overfitting in Fast Adversarial Training: A Bi-level Optimization Perspective

arXiv 2407.12443 ↗First posted 17 Jul 2024cs.LG cs.CVcited by 13

Not on the map. Why?

Abstract (arXiv)

Adversarial training (AT) has become an effective defense method against adversarial examples (AEs) and it is typically framed as a bi-level optimization problem. Among various AT methods, fast AT (FAT), which employs a single-step attack strategy to guide the training process, can achieve good robustness against adversarial attacks at a low cost. However, FAT methods suffer from the catastrophic overfitting problem, especially on complex tasks or with large-parameter models. In this work, we propose a FAT method termed FGSM-PCO, which mitigates catastrophic overfitting by averting the collapse of the inner optimization problem in the bi-level optimization process. FGSM-PCO generates current-stage AEs from the historical AEs and incorporates them into the training process using an adaptive mechanism. This mechanism determines an appropriate fusion ratio according to the performance of the AEs on the training model. Coupled with a loss function tailored to the training framework, FGSM-PCO can alleviate catastrophic overfitting and help the recovery of an overfitted model to effective training. We evaluate our algorithm across three models and three datasets to validate its effectiveness. Comparative empirical studies against other FAT algorithms demonstrate that our proposed method effectively addresses unresolved overfitting issues in existing algorithms.

Key facts. Cited by 13 papers in the map (data through 14 Oct 2026). Builds on 37 of its 45 references that are in the map. First posted on arXiv 17 Jul 2024.

Builds on

37 of 45 references.

References · 37

  1. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  3. 2013Intriguing properties of neural networkscited by 5,155
  4. 2016Wide Residual Networkscited by 3,070
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  6. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  7. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  8. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  9. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  11. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,106
  12. 2019Deep Leakage from Gradientscited by 1,021
25 more
  1. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  2. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  3. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  4. 2019Adversarial Training for Free!cited by 643
  5. 2015Cyclical Learning Rates for Training Neural Networkscited by 629
  6. 2020Overfitting in adversarially robust deep learningcited by 506
  7. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  8. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
  9. 2020Backdoor Learning: A Surveycited by 426
  10. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  11. 2018Adversarial Attacks and Defences: A Surveycited by 259
  12. 2020Understanding and Improving Fast Adversarial Trainingcited by 214
  13. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  14. 2020Bag of Tricks for Adversarial Trainingcited by 200
  15. 2019You Only Propagate Once: Accelerating Adversarial Training via Maximal Principlecited by 183
  16. 2018Robustness via curvature regularization, and vice versacited by 175
  17. 2019Adversarial Robustness through Local Linearizationcited by 146
  18. 2019Metric Learning for Adversarial Robustnesscited by 77
  19. 2020Understanding Catastrophic Overfitting in Single-step Adversarial Trainingcited by 76
  20. 2021Revisiting and Advancing Fast Adversarial Training Through The Lens of Bi-Level Optimizationcited by 76
  21. 2021Adversarial Laser Beam: Effective Physical-World Attack to DNNs in a Blinkcited by 75
  22. 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 43
  23. 2022Prior-Guided Adversarial Initialization for Fast Adversarial Trainingcited by 35
  24. 2023Fast Adversarial Training with Smooth Convergencecited by 14
  25. 2024Efficient local linearity regularization to overcome catastrophic overfittingcited by 8

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 5; 2026: 7.

13 papers.

Sort:

By area:

  1. 2025PR-Attack: Coordinated Prompt-RAG Attacks on Retrieval-Augmented Generation in Large Language Models via Bilevel Optimizationcited by 32
  2. 2026SafeNeuron: Neuron-Level Safety Alignment for Large Language Modelscited by 10
  3. 2025Token-Level Constraint Boundary Search for Jailbreaking Text-to-Image Modelscited by 9
  4. 2024Adversarial Training: A Surveycited by 6
  5. 2026Multilingual Safety Alignment Via Sparse Weight Editingcited by 6
  6. 2026DTVI: Dual-Stage Textual and Visual Intervention for Safe Text-to-Image Generationcited by 1
  7. 2026FastAT Benchmark: A Comprehensive Framework for Fair Evaluation of Fast Adversarial Training Methodscited by 1
  8. 2025Are Fast Methods Stable in Adversarially Robust Transfer Learning?cited by 0
  9. 2025Lipschitz-aware Linearity Grafting for Certified Robustnesscited by 0
  10. 2025Vulnerability-Aware Robust Multimodal Adversarial Trainingcited by 0
  11. 2026Unveiling the Backdoor Mechanism Hidden Behind Catastrophic Overfitting in Fast Adversarial Trainingcited by 0
  12. 2026SORA: Free Second-Order Attacks in Fast Adversarial Trainingcited by 0
1 more
  1. 2026MAPE: Defending Against Transferable Adversarial Attacks Using Multi-Source Adversarial Perturbations Eliminationcited by 0