mlsanityData to 14 Oct 2026

DAT: Improving Adversarial Robustness via Generative Amplitude Mix-up in Frequency Domain

arXiv 2410.12307 ↗First posted 16 Oct 2024cs.LG cs.CVcited by 12

Not on the map. Why?

Abstract (arXiv)

To protect deep neural networks (DNNs) from adversarial attacks, adversarial training (AT) is developed by incorporating adversarial examples (AEs) into model training. Recent studies show that adversarial attacks disproportionately impact the patterns within the phase of the sample's frequency spectrum -- typically containing crucial semantic information -- more than those in the amplitude, resulting in the model's erroneous categorization of AEs. We find that, by mixing the amplitude of training samples' frequency spectrum with those of distractor images for AT, the model can be guided to focus on phase patterns unaffected by adversarial perturbations. As a result, the model's robustness can be improved. Unfortunately, it is still challenging to select appropriate distractor images, which should mix the amplitude without affecting the phase patterns. To this end, in this paper, we propose an optimized Adversarial Amplitude Generator (AAG) to achieve a better tradeoff between improving the model's robustness and retaining phase patterns. Based on this generator, together with an efficient AE production procedure, we design a new Dual Adversarial Training (DAT) strategy. Experiments on various datasets show that our proposed DAT leads to significantly improved robustness against diverse adversarial attacks.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Builds on 51 of its 64 references that are in the map. First posted on arXiv 16 Oct 2024.

Builds on

51 of 64 references.

References · 51

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2017Mask R-CNNcited by 7,277
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2013Intriguing properties of neural networkscited by 5,155
  6. 2022Elucidating the Design Space of Diffusion-Based Generative Modelscited by 3,045
  7. 2015Fast R-CNNcited by 2,933
  8. 2019CutMix: Regularization Strategy to Train Strong Classifiers with Localizable Featurescited by 2,884
  9. 2014Conditional Generative Adversarial Netscited by 2,162
  10. 2016Adversarial examples in the physical worldcited by 1,769
  11. 2017Improved Regularization of Convolutional Neural Networks with Cutoutcited by 1,628
  12. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
38 more
  1. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  2. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
  3. 2016Practical Black-Box Attacks against Machine Learningcited by 903
  4. 2018Robustness May Be at Odds with Accuracycited by 880
  5. 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
  6. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 666
  7. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
  8. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
  9. 2020Overfitting in adversarially robust deep learningcited by 506
  10. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 501
  11. 2019Minimally distorted Adversarial Examples with a Fast Adaptive Boundary Attackcited by 334
  12. 2019High Frequency Component Helps Explain the Generalization of Convolutional Neural Networkscited by 310
  13. 2021A Fourier-based Framework for Domain Generalizationcited by 290
  14. 2019A Fourier Perspective on Model Robustness in Computer Visioncited by 288
  15. 2021Improving Robustness using Generated Datacited by 234
  16. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  17. 2021Fixing Data Augmentation to Improve Adversarial Robustnesscited by 204
  18. 2018Robustness via curvature regularization, and vice versacited by 175
  19. 2019Improving Black-box Adversarial Attacks with a Transfer-based Priorcited by 121
  20. 2022Robustness and Accuracy Could Be Reconcilable by (Proper) Definitioncited by 111
  21. 2018A Kernel Theory of Modern Data Augmentationcited by 106
  22. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 95
  23. 2019NATTACK: Learning the Distributions of Adversarial Examples for an Improved Black-Box Attack on Deep Neural Networkscited by 94
  24. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 89
  25. 2020Backpropagating Linearly Improves Transferability of Adversarial Examplescited by 79
  26. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  27. 2021Amplitude-Phase Recombination: Rethinking Robustness of Convolutional Neural Networks in Frequency Domaincited by 71
  28. 2020Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defensescited by 62
  29. 2023Decoupled Kullback-Leibler Divergence Losscited by 58
  30. 2021Targeted Attack against Deep Neural Networks via Flipping Limited Weight Bitscited by 49
  31. 2022Efficient and Effective Augmentation Strategy for Adversarial Trainingcited by 43
  32. 2023Data Augmentation Alone Can Improve Adversarial Trainingcited by 43
  33. 2020Targeted Attack for Deep Hashing based Retrievalcited by 35
  34. 2019Data Augmentation Revisited: Rethinking the Distribution Gap between Clean and Augmented Datacited by 33
  35. 2020Practical No-box Adversarial Attacks against DNNscited by 32
  36. 2022Scaling Adversarial Training to Large Perturbation Boundscited by 20
  37. 2022Squeeze Training for Adversarial Robustnesscited by 10
  38. 2023Domain Generalisation via Domain Adaptation: An Adversarial Fourier Amplitude Approachcited by 8

50 most cited of 51 All 51 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 8.

12 papers.

  1. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Modelscited by 13
  2. 2025From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledgecited by 9
  3. 2025AdPO: Enhancing the Adversarial Robustness of Large Vision-Language Models with Preference Optimizationcited by 8
  4. 2026Time Is All It Takes: Spike-Retiming Attacks on Event-Driven Spiking Neural Networkscited by 5
  5. 2026AEGIS: Adversarial Target-Guided Retention-Data-Free Robust Concept Erasure from Diffusion Modelscited by 5
  6. 2025Unsupervised Robust Domain Adaptation: Paradigm, Theory and Algorithmcited by 3
  7. 2026Full spectrum Unlearnable Examples via Spectral Equalizationcited by 3
  8. 2026FeatDistill: A Feature Distillation Enhanced Multi-Expert Ensemble Framework for Robust AI-generated Image Detectioncited by 1
  9. 2026Low-Cost Hard-Label Adversarial Attack with Theoretical Foundationscited by 0
  10. 2026Zero-Sacrifice Persistent-Robustness Adversarial Defense for Pre-Trained Encoderscited by 0
  11. 2026TaFD: Threat-Aware Frequency Decoupling for Adversarial Robustness against Heterogeneous Attackscited by 0
  12. 2026When Modalities Fail to Tango: Conformal Backdoor Detection in Multimodal Contrastive Learningcited by 0