mlsanityData to 14 Oct 2026

Identifying and Understanding Cross-Class Features in Adversarial Training

arXiv 2506.05032 ↗First posted 5 Jun 2025cs.LG cs.AI cs.CRcited by 0

Not on the map. Why?

Abstract (arXiv)

Adversarial training (AT) has been considered one of the most effective methods for making deep neural networks robust against adversarial attacks, while the training mechanisms and dynamics of AT remain open research problems. In this paper, we present a novel perspective on studying AT through the lens of class-wise feature attribution. Specifically, we identify the impact of a key family of features on AT that are shared by multiple classes, which we call cross-class features. These features are typically useful for robust classification, which we offer theoretical evidence to illustrate through a synthetic data model. Through systematic studies across multiple model architectures and settings, we find that during the initial stage of AT, the model tends to learn more cross-class features until the best robustness checkpoint. As AT further squeezes the training robust loss and causes robust overfitting, the model tends to make decisions based on more class-specific features. Based on these discoveries, we further provide a unified view of two existing properties of AT, including the advantage of soft-label training and robust overfitting. Overall, these insights refine the current understanding of AT mechanisms and provide new perspectives on studying them. Our code is available at https://github.com/PKU-ML/Cross-Class-Features-AT.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 44 of its 52 references that are in the map. First posted on arXiv 5 Jun 2025.

Builds on

44 of 52 references.

References · 44

  1. 2015Distilling the Knowledge in a Neural Networkcited by 10,324
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  3. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2020Training data-efficient image transformers & distillation through attentioncited by 4,586
  6. 2016Identity Mappings in Deep Residual Networkscited by 1,965
  7. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,517
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  9. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,268
  10. 2016Temporal Ensembling for Semi-Supervised Learningcited by 1,057
  11. 2019Adversarial Examples Are Not Bugs, They Are Featurescited by 953
  12. 2018Robustness May Be at Odds with Accuracycited by 880
32 more
  1. 2020Fast is better than free: Revisiting adversarial trainingcited by 727
  2. 2015Distillation as a Defense to Adversarial Perturbations against Deep Neural Networkscited by 678
  3. 2019Adversarial Training for Free!cited by 643
  4. 2019Fantastic Generalization Measures and Where to Find Themcited by 513
  5. 2020Overfitting in adversarially robust deep learningcited by 506
  6. 2021Improving Robustness using Generated Datacited by 234
  7. 2020Understanding and Improving Fast Adversarial Trainingcited by 214
  8. 2023Better Diffusion Models Further Improve Adversarial Trainingcited by 208
  9. 2020Bag of Tricks for Adversarial Trainingcited by 200
  10. 2021Data Augmentation Can Improve Robustnesscited by 194
  11. 2021On the Convergence and Robustness of Adversarial Trainingcited by 130
  12. 2021Revisiting Adversarial Robustness Distillation: Robust Soft Labels Make Student Bettercited by 79
  13. 2023Robust Classification via a Single Diffusion Modelcited by 79
  14. 2020Understanding Catastrophic Overfitting in Single-step Adversarial Trainingcited by 76
  15. 2021Improving Adversarial Robustness via Channel-wise Activation Suppressingcited by 76
  16. 2021Exploring Architectural Ingredients of Adversarially Robust Deep Neural Networkscited by 74
  17. 2022When Adversarial Training Meets Vision Transformers: Recipes from Training to Architecturecited by 64
  18. 2020CAT: Customized Adversarial Training for Improved Robustnesscited by 61
  19. 2021Reliable Adversarial Distillation with Unreliable Teacherscited by 56
  20. 2021Exploring Memorization in Adversarial Trainingcited by 55
  21. 2023CFA: Class-wise Calibrated Fair Adversarial Trainingcited by 53
  22. 2022Understanding Robust Overfitting of Adversarial Training and Beyondcited by 51
  23. 2023Data Augmentation Alone Can Improve Adversarial Trainingcited by 43
  24. 2023ContraNorm: A Contrastive Learning Perspective on Oversmoothing and Beyondcited by 39
  25. 2022Self-Ensemble Adversarial Training for Improved Robustnesscited by 38
  26. 2022Robust Weight Perturbation for Adversarial Trainingcited by 25
  27. 2024On the Duality Between Sharpness-Aware Minimization and Adversarial Trainingcited by 24
  28. 2023Balance, Imbalance, and Rebalance: Understanding Robust Overfitting from a Minimax Game Perspectivecited by 18
  29. 2023Adversarial Examples Are Not Real Featurescited by 16
  30. 2021Label Noise in Adversarial Training: A Novel Perspective to Study Robust Overfittingcited by 14
  31. 2024Adversarial Training Can Provably Improve Robustness: Theoretical Analysis of Feature Learning Process Under Structured Datacited by 12
  32. 2023Annealing Self-Distillation Rectification Improves Adversarial Trainingcited by 7

Built on by

Not cited yet.