Understanding Adversarial Training with Energy-based Models
Not on the map. Why?
Abstract (arXiv)
We aim at using Energy-based Model (EBM) framework to better understand adversarial training (AT) in classifiers, and additionally to analyze the intrinsic generative capabilities of robust classifiers. By viewing standard classifiers through an energy lens, we begin by analyzing how the energies of adversarial examples, generated by various attacks, differ from those of the natural samples. The central focus of our work is to understand the critical phenomena of Catastrophic Overfitting (CO) and Robust Overfitting (RO) in AT from an energy perspective. We analyze the impact of existing AT approaches on the energy of samples during training and observe that the behavior of the ``delta energy' -- change in energy between original sample and its adversarial counterpart -- diverges significantly when CO or RO occurs. After a thorough analysis of these energy dynamics and their relationship with overfitting, we propose a novel regularizer, the Delta Energy Regularizer (DER), designed to smoothen the energy landscape during training. We demonstrate that DER is effective in mitigating both CO and RO across multiple benchmarks. We further show that robust classifiers, when being used as generative models, have limits in handling trade-off between image quality and variability. We propose an improved technique based on a local class-wise principal component analysis (PCA) and energy-based guidance for better class-specific initialization and adaptive stopping, enhancing sample diversity and generation quality. Considering that we do not explicitly train for generative modeling, we achieve a competitive Inception Score (IS) and Fr'echet inception distance (FID) compared to hybrid discriminative-generative models.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Builds on 60 of its 82 references that are in the map. First posted on arXiv 28 May 2025.
Builds on
60 of 82 references.
References · 60
- 2020Denoising Diffusion Probabilistic Modelscited by 21,076
- 2021Diffusion Models Beat GANs on Image Synthesiscited by 8,255
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2013Intriguing properties of neural networkscited by 5,155
- 2019Generative Modeling by Estimating Gradients of the Data Distributioncited by 4,101
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
- 2016Improved Techniques for Training GANscited by 2,970
- 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
- 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
- 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
- 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,209
38 more
- 2017Ensemble Adversarial Training: Attacks and Defensescited by 840
- 2020Fast is better than free: Revisiting adversarial trainingcited by 727
- 2019Square Attack: a query-efficient black-box adversarial attack via random searchcited by 685
- 2020RobustBench: a standardized adversarial robustness benchmarkcited by 661
- 2019Adversarial Training for Free!cited by 643
- 2020Overfitting in adversarially robust deep learningcited by 506
- 2019Unlabeled Data Improves Adversarial Robustnesscited by 416
- 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 405
- 2018Adversarially Robust Generalization Requires More Datacited by 318
- 2020Attacks Which Do Not Kill Training Make Adversarial Learning Strongercited by 243
- 2021Improving Robustness using Generated Datacited by 234
- 2018Adversarial Logit Pairingcited by 224
- 2020Understanding and Improving Fast Adversarial Trainingcited by 214
- 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
- 2020Geometry-aware Instance-reweighted Adversarial Trainingcited by 198
- 2018MMA Training: Direct Input Space Margin Maximization through Adversarial Trainingcited by 172
- 2019Are Labels Required for Improving Adversarial Robustness?cited by 163
- 2020Learning Energy-Based Models by Diffusion Recovery Likelihoodcited by 123
- 2019Adversarially Robust Generalization Just Requires More Unlabeled Datacited by 76
- 2020Understanding Catastrophic Overfitting in Single-step Adversarial Trainingcited by 76
- 2023Diffusion-Based Adversarial Sample Generation for Improved Stealthiness and Controllabilitycited by 66
- 2020Guided Adversarial Attack for Evaluating and Enhancing Adversarial Defensescited by 62
- 2023Decoupled Kullback-Leibler Divergence Losscited by 58
- 2021Relating Adversarially Robust Generalization to Flat Minimacited by 57
- 2021Probabilistic Margins for Instance Reweighting in Adversarial Trainingcited by 57
- 2021Exploring Memorization in Adversarial Trainingcited by 55
- 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 51
- 2023Robust Principles: Architectural Design Principles for Adversarially Robust CNNscited by 46
- 2022Make Some Noise: Reliable and Efficient Single-Step Adversarial Trainingcited by 43
- 2020Single-step Adversarial training with Dropout Schedulingcited by 41
- 2021Subspace Adversarial Trainingcited by 41
- 2022Sparsity Winning Twice: Better Robust Generalization from More Efficient Trainingcited by 41
- 2021Low Curvature Activations Reduce Overfitting in Adversarial Trainingcited by 29
- 2021Reliably fast adversarial training via latent adversarial perturbationcited by 29
- 2021JEM++: Improved Techniques for Training JEMcited by 28
- 2021Towards Understanding the Generative Capability of Adversarially Robust Classifierscited by 26
- 2022Fast Adversarial Training with Adaptive Step Sizecited by 25
- 2023On the Over-Memorization During Natural, Robust and Catastrophic Overfittingcited by 20
50 most cited of 60 All 60 (JSON)
Built on by
Citing papers per year: 2026: 2.
2 papers.