Identifying and Understanding Cross-Class Features in Adversarial Training

Yisen Wang; Yiwen Guo; Zeming Wei

REVIEW 3 major objections 6 minor 56 references

Identifying and Understanding Cross-Class Features in Adversarial Training

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that during adversarial training, models learn features shared across classes up to their most robust checkpoint, then progressively abandon those features, and that this abandonment is the mechanism behind robust…

desk verdict A plausible and well-theorized mechanism for robust overfitting, but the empirical measure (CAS) is unvalidated and plausibly confounded; the core hypothesis needs a control experiment before it should be taken as established. read the letter →

arxiv 2506.05032 v1 pith:HYCJ7HKP submitted 2025-06-05 cs.LG cs.AIcs.CRcs.CVmath.OC

Zeming Wei , Yiwen Guo , Yisen Wang This is my paper

classification cs.LGcs.AIcs.CRcs.CVmath.OC

keywords adversarialtrainingrobustoverfittingcross-classfeaturesfeatureattributionclasssimilarityknowledgedistillationrobustness

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Adversarial training (AT) makes networks robust by training on adversarial examples, but late in training the model's test robustness often declines while its training robustness keeps improving—a phenomenon called robust overfitting. This paper argues that the decline happens because the model progressively abandons features shared by several classes (cross-class features) and comes to rely on class-specific features. The paper measures cross-class feature usage with the Class Attribution Similarity (CAS), a cosine similarity of class-averaged attribution vectors on adversarial examples, and shows that CAS peaks at the most robust checkpoint and falls as overfitting develops across datasets, architectures, and perturbation norms. It also shows that soft-label methods such as knowledge distillation preserve cross-class features and therefore mitigate overfitting, and it supports the story with a simple linear model in which shared features are more fragile under robust loss yet more helpful for robust classification. If the account is right, robust overfitting and the advantage of soft labels are two faces of the same mechanism: the model trades away useful shared features to squeeze the training robust loss.

What carries the argument

The central object is the class attribution vector $A_i(x) = g(x) \odot W[i]$, the elementwise product of the feature extractor's output with the $i$-th row of the linear classifier, which attributes each feature's contribution to class $i$'s logit. The paper averages these vectors over adversarial test examples within each class, computes the cosine-similarity matrix $C[i,j]$, and defines CAS as the sum of the positive off-diagonal entries; high CAS means the model uses more features shared between classes. The theoretical side rests on a three-class linear model with class-specific features $x_E \sim N(\mu, \sigma^2)$ and cross-class features $x_C$, weights $w_1$ (class-specific) and $w_2$ (shared), an $\ell_\infty$ perturbation bound $\epsilon$, and a hinge-style robust loss, which simplifies to a quadratic objective in $(w_1,w_2)$. That simplification is what allows the proofs of Theorem 1 ($w_2$ vanishes for large $\epsilon$), Theorem 2 (larger $w_2$ improves robust classification), and Theorem 3/Corollary 1 (label smoothing keeps $w_2$ positive for a wider $\epsilon$ range).

What would settle it

Train two models with identical data and architecture, but add a regularizer that keeps CAS fixed at the best-checkpoint level in one model and forces CAS down in the other; if the model with pinned CAS still shows the same late-training decline in robust test accuracy, then the forgetting of cross-class features is not the mechanism of robust overfitting, while if the forced-CAS-down model loses robustness early, the causal direction is supported.

Watch

Extended reading notes

Core claim

The central claim is a proposed training dynamics for adversarial training: in the early phase the model learns both class-specific and cross-class features, and the use of cross-class features grows up to the best robustness checkpoint; afterward, because cross-class features raise positive logits on other classes and thus keep the robust training loss above zero under one-hot labels, the model progressively discards them and shifts to class-specific features. This abandonment of shared features is presented as the mechanism of robust overfitting, and the success of soft-label training is explained by its ability to keep cross-class information in the labels. Empirically, the paper finds that the CAS score rises to its maximum at the best checkpoint and then drops sharply, that the drop is larger for larger perturbation bounds, that it appears across CIFAR-10, CIFAR-100, Tiny ImageNet, residual and transformer architectures, and $\ell_\infty$ and $\ell_2$ attacks, and that fast adversarial training's catastrophic overfitting coincides with CAS plunging to near zero. Theoretically, in a three-class linear model with independent class-specific and shared features, the paper proves that the shared-feature weight $w_2$ is driven to zero for robust loss with large $\epsilon$ while the class-specific weight $w_1$ survives, that increasing $w_2$ raises the probability of correct robust classification, and that label smoothing preserves a positive $w_2$ over a larger $\epsilon$ range.

Load-bearing premise

The load-bearing premise is that the cosine similarity of class-averaged attribution vectors, CAS, faithfully measures how much a model actually uses features shared across classes, and the paper does not validate this metric against an external ground truth or rule out confounds such as logit scale, prediction confidence, or the choice of adversarial examples used for attribution.

Editorial extensions

If this is right

Models at their most robust checkpoint use more cross-class features than the final overfitted checkpoint, so interventions that preserve cross-class features (such as knowledge distillation or label smoothing) should raise both peak robust accuracy and end-of-training robustness.
Because larger perturbation bounds make cross-class features harder to learn and easier to discard, the theory explains why robust overfitting worsens as $\epsilon$ increases up to common values and then diminishes at extremely large $\epsilon$, where few shared features are ever learned.
Catastrophic overfitting in fast adversarial training and standard robust overfitting share a common signature: a collapse in cross-class feature usage, with CAS dropping to near zero when robust accuracy collapses.
Standard training uses far fewer cross-class features than adversarial training and shows no late-training CAS decline, so the forgetting mechanism is specific to the one-hot-label robust-loss objective rather than to ordinary training.
Soft-label methods mitigate robust overfitting specifically because their labels retain cross-class information; accordingly, the CAS gap between best and final checkpoints should be much smaller for knowledge-distilled AT than for vanilla AT.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial extension: if CAS is a valid proxy, the same attribution-similarity lens could explain why fine-tuning a robust model on a new task erodes adversarial robustness—fine-tuning may discard shared features just as late-stage AT does—and a CAS-preserving regularizer during fine-tuning could be tested for robustness retention.
Editorial extension: the synthetic theory predicts a sharp threshold $\epsilon_0 = (\mu - \sigma/\sqrt{\pi})/2$ where the shared-feature weight $w_2$ switches from positive to zero; sweeping $\epsilon$ while measuring CAS on real models should reveal a corresponding transition, which would distinguish this mechanism from memorization-based accounts of robust overfitting.
Editorial extension: the paper's own admission that learned features do not always align with human intuition (Appendix D) implies CAS captures functional sharing rather than semantic similarity; a natural check is whether CAS correlates with robustness gains specifically on class pairs that share recognizable parts.
Editorial extension: the cross-class feature view reframes the robust/non-robust feature decomposition by adding a sharedness axis, suggesting that data augmentation or resampling based on shared-part structure could transfer robustness between similar classes more efficiently than current label-agnostic augmentation.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Two things to know. The central claim is clear and worth taking seriously: during adversarial training, models increasingly lean on features shared between classes until the best robust checkpoint, then abandon those features as robust overfitting sets in; and soft-label training works, at least partly, because it preserves those features. That is a clean, testable hypothesis, and the toy-model analysis in Section 4 backs the relevant parts of it: under the stated Gaussian assumptions, cross-class features are more easily eliminated by the robust loss, yet they help robust classification, and label smoothing retains them. The derivations are correct as far as I can tell, with no hidden free parameters, and the prediction about soft labels is tested on knowledge distillation, an external method, so there is no fitting-to-the-data circularity.

The empirical sweep is broad: the CAS metric peaks at the best checkpoint and drops when robust accuracy declines, across CIFAR-10, CIFAR-100, Tiny ImageNet, l2-AT, ViT, fast adversarial training, and several perturbation bounds. That breadth is the paper's best evidence.

The soft spot is the metric itself. CAS is the cosine similarity between class-averaged attribution vectors, and it is computed on all test examples, including misclassified ones. As robust accuracy falls, more successful attacks enter the average; the true-class attribution on a successful attack does not reflect the decision the model actually made, so the drop in CAS from best to last checkpoint could be a mechanical effect of a growing misclassified fraction rather than evidence that shared features are forgotten. The uncentered cosine also means that a constant common component (a bias-like feature) inflates all similarities and may shift over training. The paper neither validates CAS against a ground-truth model where feature sharing is known (the Section 4 linear model would do) nor reports error bars over seeds, and the Grad-CAM examples, while suggestive, are anecdotal. The causal claim therefore overreaches the current evidence; what is demonstrated is a consistent correlation.

The right fix is straightforward: restrict the CAS computation to correctly classified adversarial examples, center the attribution vectors, and show that the trend survives, ideally on the synthetic model where w2 is known. If those controls hold, the paper becomes a solid contribution. As is, it deserves serious peer review and careful revision, not rejection. I would send it to a strong venue with a request for exactly those experiments.

Referee Report

3 major / 6 minor

Summary. This paper studies adversarial training (AT) through the lens of class-wise feature attributions. It defines cross-class features as features shared by multiple classes and introduces a Class Attribution Similarity (CAS) metric based on the cosine similarity of class-averaged attribution vectors (Eqs. 6-7). Empirically, the paper reports that CAS rises during the initial phase of AT, peaks near the best robust checkpoint, and then drops as robust overfitting occurs; this pattern is reported across CIFAR-10/CIFAR-100/Tiny-ImageNet, l_infinity and l_2 threat models, and CNN/Transformer architectures. It also reports that knowledge-distillation-based soft-label AT preserves CAS and mitigates robust overfitting. A Gaussian three-class toy model with class-specific and cross-class features supports Theorems 1-3: cross-class features are more sensitive to the robust loss than class-specific features, yet positive cross-class weights improve robust classification, and label smoothing enlarges the perturbation range that admits positive cross-class weights. Extended studies cover large perturbation bounds, fast adversarial training, an instance-wise metric, and standard training.

Significance. If the central claim holds, the paper would offer a unified mechanistic account of robust overfitting and of the benefit of soft labels in AT, with concrete implications for algorithm design. The theoretical section is a genuine strength: the toy model assumptions are explicit, and the proofs of Theorems 1-3 in Appendix E are self-contained and have no fitted parameters. The empirical breadth is also commendable, and the public code release supports reproducibility. However, the central empirical support rests on the CAS metric, whose validity as a measure of genuine shared-feature usage is not established. Because the paper's interpretational claims are built on this metric, the contribution will be fully convincing only after the metric is validated and the confounds identified below are controlled.

major comments (3)

[§3.1, Eq. (6), Algorithm 1] The CAS metric is the load-bearing instrument for the paper's central empirical claim, but it is not validated against any ground truth. Eq. (6) computes cosine similarity between class-averaged attribution vectors without centering, so any component common to all classes (e.g., a bias in W or a shared background feature) inflates CAS even though such a component is not a discriminative cross-class feature of the kind the theory discusses. In addition, Algorithm 1 averages attributions over all test adversarial examples, including those the model misclassifies; as robust accuracy falls from the best to the last checkpoint, the fraction of misclassified samples in the average increases, and for a misclassified example the attribution with respect to the true class does not reflect the features driving the model's decision. This alone could produce the observed drop in CAS without any change in shared-feature usage. I recommend: (1) centering the attribution vectors before computing the cosine similarity; (2) restricting the computation to correctly classified examples or conditioning on attack success; and (3) validating CAS on the synthetic model of Section 4, where the true cross-class weight w2 is known. Without these controls, the correlation between CAS and robust accuracy does not support the causal story.
[§4.2, Theorem 2] Theorem 2 shows that, for fixed w1, the probability in Eq. (11) is monotonically increasing in w2 over [0, w1]. This does not by itself establish the paper's statement that "using a positive w2 is always more beneficial for robust classification than simply setting w2 to 0," because the AT solution also adjusts w1 through the regularized objective in Eq. (9). A comparison between the optimizer of the robust loss (which Theorem 1 drives to w2 = 0 for larger epsilon) and a model retaining w2 > 0 requires an analysis of the w1-w2 trade-off under the same regularization. As stated, the theorem is a useful intuition but not a proof that the model minimizing the training objective while keeping w2 > 0 has better robust test accuracy.
[§4, Theorems 1 and 3] The theoretical results characterize global minimizers of the expected robust loss for different epsilon (and for the smoothed loss), not the trajectory of iterative adversarial training. The central temporal hypothesis--that the model first learns cross-class features and then gradually abandons them--therefore receives only indirect support from these theorems. To connect the toy model to the observed dynamics, the paper would need either a direct analysis of the training trajectory or an empirical test showing that the CAS trajectory of an actual training run tracks the predicted phase transition. As it stands, the theory is consistent with the observation but does not uniquely predict it.

minor comments (6)

[Appendix E.5] The higher-dimensional extension is asserted with the statement that it "can be easily derived," but the derivation is not provided. Since the main text relies on this extension for the generality of the theoretical claims, either include the proof or explicitly label the extension as a remark rather than a proven result.
[§3.3 and Appendix A] There are typos: "Notebly" should be "Notably" in Section 3.3, and Algorithm 1 is referred to as "falg" in the first paragraph of Appendix A.
[§3.3 and Appendix D] Appendix D acknowledges that not all saliency-map examples are clearly interpretable; this caveat should appear in the main text when the saliency evidence is presented, since the current wording in Section 3.3 presents the visualizations as stronger support than the appendix allows.
[§5.3, Figure 8] The instance-wise metric selects, for each sample, the most similar sample in the other class; this max-based statistic can be sensitive to outliers. Reporting the full distribution or a more robust summary (e.g., median or quantile) would strengthen the claim.
[Table 1 and Figures 2-6] The central CAS-versus-robust-accuracy comparisons are reported without multiple seeds or confidence intervals; given that the conclusions are empirical and the metric is new, error bars or at least a statement about variance would improve reliability.
[Figure captions] The color scales differ across figures (e.g., [−0.75, 0.75] in Figure 5 versus [0, 1] in Figure 6); this should be stated consistently in captions so that cross-figure comparisons are not misleading.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity; the theoretical results are parameter-free, and the soft-label prediction is tested against an external method, while remaining concerns about the CAS metric are measurement-validity issues rather than derivation circularity.

full rationale

The empirical backbone of the paper is a new metric (CAS, Eqs. 6-7) rather than a fitted parameter, and the central theoretical claims are proved in a self-contained synthetic model (Sec. 4) with explicit assumptions (Eq. 8, sigma<sqrt(pi)mu, epsilon<mu/2). Theorem 1 and Theorem 2 derive the sensitivity and usefulness of w_2 directly from the robust loss, not from the empirical CAS data; Theorem 3 and Corollary 1 derive the label-smoothing effect from the loss expression. The soft-label prediction is validated against an external method, knowledge distillation (Fig. 3 and Eq. 3), so it is not a renamed fit. The self-citations (Bai et al. 2021a; Wang et al. 2024; Wei et al. 2023) support background observations or the interpretation that similar attribution vectors indicate shared features; they are not used as a uniqueness theorem and do not reduce any derivation to a self-citation. The acknowledged limitation in Appendix D that saliency maps are not universally interpretable is a validity caveat, not evidence that a prediction is equivalent to an input. Concerns about whether CAS is confounded by the changing mix of misclassified adversarial examples or by the uncentered cosine similarity are measurement-validity questions that the paper does not fully control, but under the hard rules they do not constitute circularity because no equation or fitted value is shown to reduce to its own input by construction.

Assumptions & free parameters 0 free parameters · 5 assumptions · 1 invented entities

The central claim rests on a small number of explicit assumptions. The toy model and its theorems use a Gaussian data model, a margin-based robust loss, and symmetry simplifications. The empirical claims rest on the CAS metric as a faithful proxy for shared-feature usage, which is assumed rather than validated. No free parameters are fitted to the observed phenomenon; the only adjustable constants appear inside the toy model and do not affect the qualitative conclusions.

assumptions (5)

domain assumption The synthetic data follows the Gaussian model in Eq. 8 with sigma < sqrt(pi) mu.
Used to guarantee epsilon0 is positive and smaller than mu/2 in Theorems 1 and 3. This is a modeling assumption of the toy distribution, not an empirical fact.
ad hoc to paper The adversarial loss in Eq. 10, a margin-based max-over-other-classes difference, represents the training objective.
Theorems 1 to 3 are proven for this margin loss, not for the cross-entropy loss actually used in practical AT. The results may not transfer to the standard objective.
domain assumption Class-averaged attribution vectors and their cosine similarity (Eqs. 5-6) measure the usage of cross-class features.
The empirical metric assumes that shared feature usage manifests as positive cosine similarity between class attribution vectors. This is the load-bearing premise of all empirical claims.
standard math The classifier takes the linear form f = W g with a feature extractor g and linear layer W (Eq. 4).
This structure holds for the final layer of standard deep networks and is used to define the attribution vectors.
ad hoc to paper Symmetric weights and label smoothing with beta < 1/3 capture knowledge distillation.
The paper simplifies knowledge distillation to label smoothing using symmetry assumptions (Appendix E.4), which is a modeling choice.

invented entities (1)

Cross-class features (as an explanatory category) independent evidence
purpose: To explain the dynamics of adversarial training, in particular robust overfitting and the benefit of soft labels.
The paper postulates that features shared by multiple classes are a distinct and causally important type of representation. It provides a quantitative handle through the CAS metric, but the metric is defined by the paper and has not been externally validated, so the independent evidence is partial.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Identifying and Understanding Cross-Class Features in Adversarial Training." pith.science (2026). https://pith.science/paper/HYCJ7HKP

@misc{pith2026250605032,
  author       = {Pith},
  title        = {Pith review of: Identifying and Understanding Cross-Class Features in Adversarial Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HYCJ7HKP}},
  note         = {Machine review of arXiv:2506.05032}
}

read the original abstract

Adversarial training (AT) has been considered one of the most effective methods for making deep neural networks robust against adversarial attacks, while the training mechanisms and dynamics of AT remain open research problems. In this paper, we present a novel perspective on studying AT through the lens of class-wise feature attribution. Specifically, we identify the impact of a key family of features on AT that are shared by multiple classes, which we call cross-class features. These features are typically useful for robust classification, which we offer theoretical evidence to illustrate through a synthetic data model. Through systematic studies across multiple model architectures and settings, we find that during the initial stage of AT, the model tends to learn more cross-class features until the best robustness checkpoint. As AT further squeezes the training robust loss and causes robust overfitting, the model tends to make decisions based on more class-specific features. Based on these discoveries, we further provide a unified view of two existing properties of AT, including the advantage of soft-label training and robust overfitting. Overall, these insights refine the current understanding of AT mechanisms and provide new perspectives on studying them. Our code is available at https://github.com/PKU-ML/Cross-Class-Features-AT.

Figures

Figures reproduced from arXiv: 2506.05032 by the authors.

**Figure 1.** Train and test robust accuracy of AT on CIFAR-10 dataset with ℓ∞-norm bound ϵ ∈ {2, 4, 6, 8}/255. perturbation bound ϵ (e.g. [0, 8/255] for ℓ∞-norm) in AT, a relatively large ϵ suffers from more severe robust overfitting. By contrast, for a small ϵ = 2/255, this effect is relatively less pronounced. To address the robust overfitting issue in AT, several techniques have been introduced from various perspectives, li… view at source ↗

**Figure 2.** Feature Attribution Correlation Matrix of models at different stages in AT, with their test robust accuracy (RA) and CAS. Class index: airplane (0), automobile (1), bird (2), cat (3), deer (4), dog (5), frog (6), horse (7), ship (8), truck (9). Numerical Metric. To further support our claims, we propose a numerical metric named Class Attribution Similarity (CAS) defined on the correlation matrix C: CAS(C) = X i̸=j … view at source ↗

**Figure 3.** (a), (b): matrices for the best and the last checkpoint of AT with knowledge distillation, and their test Robust Accuracy (RA) and CAS. (c): Visualization of saliency map with GradCAM. The top row shows the original sample, and the middle and bottom rows show the saliency map on adversarial examples of the best and the last checkpoint, respectively. then converts the one-hot label into a more precise one by consider… view at source ↗

Figures from the paper (8 more)

**Figure 4.** Figure 4: The differences between the feature attribution correlation matrices (Cbest − Clast) and CAS of the best and the last checkpoint with various training perturbation bound ϵ. 5 [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]

**Figure 6.** Figure 6: Feature attribution correlation matrices on ℓ2-norm AT and Visual Transformer architecture. Color bar scaled to [0, 1]. Overall, these empirical findings provide a solid justification for our main hypothesis for the learning dynamics of crossclass features during AT. …

**Figure 5.** Figure 5: Feature attribution correlation matrices on CIFAR-100 and Tiny-ImageNet datasets. Color bar scaled to [−0.75, 0.75]. ℓ2-norm AT. We show the comparison of the feature attribution correlation matrices of the best and last checkpoints of ℓ2-norm AT (ϵ = 128/255) on CIFA…

**Figure 7.** Figure 7: Feature attribution correlation matrices for fast adversarial training at different stages, including epoch 10, best checkpoint, and after catastrophic overfitting (CO). We conduct experiments using the FAT method on the CIFAR-10 dataset, with other settings the same…

**Figure 8.** Figure 8: Instance-wise feature attribution correlation matrices. Consistent with the results for class-wise attribution vectors, it is still observed that there is a significant decrease in the usage of cross-class features from the best checkpoint to the last for both ℓ∞ and ℓ…

**Figure 9.** Figure 9: Feature attribution correlation matrices for standard training at different stages. Color bar scaled to [0, 0.5]. 5.5. Discussion on future applications Finally, building on our comprehensive study on the critical role of cross-class features in AT, we discuss their po…

**Figure 10.** Figure 10: Feature attribution correlation matrices, and their corresponding robust accuracy (RA), CAS at different epochs. D. More saliency map visualizations We include more visualization examples (ordered by original sample ID) in [PITH_FULL_IMAGE:figures/full_fig_p013_10.png]

**Figure 11.** Figure 11: More saliency maps visualization ordered by sample ID in CIFAR-10. Overall, the loss function can be formulated as L(fw) = Ei [Ex∼Di max ∥δ∥∞≤ϵ (max j̸=i fw(x + δ)j − fw(x + δ)i)] + λ 2 ∥w∥ 2 2 . (17) E.2. Proof for Theorem 1 Theorem 1 There exists a ϵ0 ∈ (0, 1 2 µ), …

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

56 extracted references · 49 canonical work pages

[1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...
[2]

and Flammarion, N

Andriushchenko, M. and Flammarion, N. Understanding and improving fast adversarial training. NeurIPS, 2020

work page 2020
[3]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018

work page 2018
[4]

Clustering effect of adversarial robust models

Bai, Y., Yan, X., Jiang, Y., Xia, S.-T., and Wang, Y. Clustering effect of adversarial robust models. In NeurIPS, 2021 a

work page 2021
[5]

Improving adversarial robustness via channel-wise activation suppressing

Bai, Y., Zeng, Y., Jiang, Y., Xia, S.-T., Ma, X., and Wang, Y. Improving adversarial robustness via channel-wise activation suppressing. In ICLR, 2021 b

work page 2021
[6]

Robust classification via a single diffusion model

Chen, H., Dong, Y., Wang, Z., Yang, X., Duan, C., Su, H., and Zhu, J. Robust classification via a single diffusion model. In ICML, 2024

work page 2024
[7]

Robust overfitting may be mitigated by properly learned smoothening

Chen, T., Zhang, Z., Liu, S., Chang, S., and Wang, Z. Robust overfitting may be mitigated by properly learned smoothening. In ICLR, 2021

work page 2021
[8]

Cat: Customized adversarial training for improved robustness

Cheng, M., Lei, Q., Chen, P.-Y., Dhillon, I., and Hsieh, C.-J. Cat: Customized adversarial training for improved robustness. In IJCAI, 2022

work page 2022

Show all 56 references

[9]

M., Rosenfeld, E., and Kolter, J

Cohen, J. M., Rosenfeld, E., and Kolter, J. Z. Certified adversarial robustness via randomized smoothing. In ICML, 2019

2019
[10]

Label noise in adversarial training: A novel perspective to study robust overfitting

Dong, C., Liu, L., and Shang, J. Label noise in adversarial training: A novel perspective to study robust overfitting. In Oh, A. H., Agarwal, A., Belgrave, D., and Cho, K. (eds.), NeurIPS, 2022 a

2022
[11]

Exploring memorization in adversarial training

Dong, Y., Xu, K., Yang, X., Pang, T., Deng, Z., Su, H., and Zhu, J. Exploring memorization in adversarial training. In ICLR, 2022 b

2022
[12]

On the role of discrete tokenization in visual representation learning

Du, T., Wang, Y., and Wang, Y. On the role of discrete tokenization in visual representation learning. arXiv preprint arXiv:2407.09087, 2024

2024 arXiv
[14]

A., and Mann, T

Gowal, S., Rebuffi, S.-A., Wiles, O., Stimberg, F., Calian, D. A., and Mann, T. A. Improving robustness using generated data. In NeurIPS, 2021

2021
[15]

Contranorm: A contrastive learning perspective on oversmoothing and beyond

Guo, X., Wang, Y., Du, T., and Wang, Y. Contranorm: A contrastive learning perspective on oversmoothing and beyond. arXiv preprint arXiv:2303.06562, 2023

2023 arXiv
[16]

Identity mappings in deep residual networks

He, K., Zhang, X., Ren, S., and Sun, J. Identity mappings in deep residual networks. In ECCV, 2016

2016
[17]

Distilling the knowledge in a neural network

Hinton, G., Vinyals, O., and Dean, J. Distilling the knowledge in a neural network. arXiv preprint arXiv:1503.02531, 2015

2015 arXiv
[18]

Boosting accuracy and robustness of student models via adaptive adversarial distillation

Huang, B., Chen, M., Wang, Y., Lu, J., Cheng, M., and Wang, W. Boosting accuracy and robustness of student models via adaptive adversarial distillation. In CVPR, 2023

2023
[19]

M., Gu, Q., Bailey, J., and Ma, X

Huang, H., Wang, Y., Erfani, S. M., Gu, Q., Bailey, J., and Ma, X. Exploring architectural ingredients of adversarially robust deep neural networks. In NeurIPS, 2021

2021
[20]

Adversarial examples are not bugs, they are features

Ilyas, A., Santurkar, S., Tsipras, D., Engstrom, L., Tran, B., and Madry, A. Adversarial examples are not bugs, they are features. In NeruIPS, 2019

2019
[21]

Fantastic generalization measures and where to find them

Jiang, Y., Neyshabur, B., Mobahi, H., Krishnan, D., and Bengio, S. Fantastic generalization measures and where to find them. In ICLR, 2020

2020
[22]

Understanding catastrophic overfitting in single-step adversarial training

Kim, H., Lee, W., and Lee, J. Understanding catastrophic overfitting in single-step adversarial training. In AAAI, 2021

2021
[23]

Learning multiple layers of features from tiny images

Krizhevsky, A., Hinton, G., et al. Learning multiple layers of features from tiny images. 2009

2009
[24]

and Aila, T

Laine, S. and Aila, T. Temporal ensembling for semi-supervised learning. In ICLR, 2017

2017
[25]

Adversarial examples are not real features

Li, A., Wang, Y., Guo, Y., and Wang, Y. Adversarial examples are not real features. In NeurIPS, 2023

2023
[26]

and Li, Y

Li, B. and Li, Y. Adversarial training can provably improve robustness: Theoretical analysis of feature learning process under structured data. In Mathematics of Modern Machine Learning Workshop at NeurIPS 2024., 2024

2024
[27]

and Spratling, M

Li, L. and Spratling, M. Data augmentation alone can improve adversarial training. ICLR, 2023

2023
[28]

Towards deep learning models resistant to adversarial attacks

Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018

2018
[29]

mnmoustafa, M. A. Tiny imagenet, 2017. URL https://kaggle.com/competitions/tiny-imagenet

2017
[30]

When adversarial training meets vision transformers: Recipes from training to architecture

Mo, Y., Wu, D., Wang, Y., Guo, Y., and Wang, Y. When adversarial training meets vision transformers: Recipes from training to architecture. In NeurIPS, 2022

2022
[31]

Bag of tricks for adversarial training

Pang, T., Yang, X., Dong, Y., Su, H., and Zhu, J. Bag of tricks for adversarial training. In ICLR, 2021

2021
[32]

Distillation as a defense to adversarial perturbations against deep neural networks

Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A. Distillation as a defense to adversarial perturbations against deep neural networks. In SP, 2016

2016
[33]

A., Stimberg, F., Wiles, O., and Mann, T

Rebuffi, S.-A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., and Mann, T. A. Data augmentation can improve robustness. In NeurIPS, 2021

2021
[34]

Overfitting in adversarially robust deep learning

Rice, L., Wong, E., and Kolter, Z. Overfitting in adversarially robust deep learning. In ICML, 2020

2020
[35]

R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D

Selvaraju, R. R., Cogswell, M., Das, A., Vedantam, R., Parikh, D., and Batra, D. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, 2017

2017
[36]

A., Xu, Z., Dickerson, J., Studer, C., Davis, L

Shafahi, A., Najibi, M., Ghiasi, M. A., Xu, Z., Dickerson, J., Studer, C., Davis, L. S., Taylor, G., and Goldstein, T. Adversarial training for free! NeurIPS, 32, 2019

2019
[37]

Training data-efficient image transformers & distillation through attention

Touvron, H., Cord, M., Douze, M., Massa, F., Sablayrolles, A., and J \'e gou, H. Training data-efficient image transformers & distillation through attention. In ICML, 2021

2021
[38]

Robustness may be at odds with accuracy

Tsipras, D., Santurkar, S., Engstrom, L., Turner, A., and Madry, A. Robustness may be at odds with accuracy. In ICLR, 2019

2019
[39]

and Wang, Y

Wang, H. and Wang, Y. Self-ensemble adversarial training for improved robustness. In ICLR, 2022

2022
[40]

On the convergence and robustness of adversarial training

Wang, Y., Ma, X., Bailey, J., Yi, J., Zhou, B., and Gu, Q. On the convergence and robustness of adversarial training. In ICML, 2019

2019
[41]

Improving adversarial robustness requires revisiting misclassified examples

Wang, Y., Zou, D., Yi, J., Bailey, J., Ma, X., and Gu, Q. Improving adversarial robustness requires revisiting misclassified examples. In ICLR, 2020

2020
[42]

Balance, imbalance, and rebalance: Understanding robust overfitting from a minimax game perspective

Wang, Y., Li, L., Yang, J., Lin, Z., and Wang, Y. Balance, imbalance, and rebalance: Understanding robust overfitting from a minimax game perspective. In NeurIPS, 2024

2024
[43]

Better diffusion models further improve adversarial training

Wang, Z., Pang, T., Du, C., Lin, M., Liu, W., and Yan, S. Better diffusion models further improve adversarial training. In ICML, 2023

2023
[44]

Cfa: Class-wise calibrated fair adversarial training

Wei, Z., Wang, Y., Guo, Y., and Wang, Y. Cfa: Class-wise calibrated fair adversarial training. In CVPR, 2023

2023
[45]

Wong, E., Rice, L., and Kolter, J. Z. Fast is better than free: Revisiting adversarial training. In ICLR, 2020

2020
[46]

Adversarial weight perturbation helps robust generalization

Wu, D., Xia, S.-T., and Wang, Y. Adversarial weight perturbation helps robust generalization. In NeurIPS, 2020

2020
[47]

Annealing self-distillation rectification improves adversarial training

Wu, Y.-Y., Wang, H.-J., and Chen, S.-T. Annealing self-distillation rectification improves adversarial training. In ICLR, 2024

2024
[48]

Robust weight perturbation for adversarial training

Yu, C., Han, B., Gong, M., Shen, L., Ge, S., Du, B., and Liu, T. Robust weight perturbation for adversarial training. In IJCAI, 2022 a

2022
[49]

Understanding robust overfitting of adversarial training and beyond

Yu, C., Han, B., Shen, L., Yu, J., Gong, C., Gong, M., and Liu, T. Understanding robust overfitting of adversarial training and beyond. In ICML, 2022 b

2022
[50]

Revisiting adversarial robustness distillation from the perspective of robust fairness

Yue, X., Mou, N., Wang, Q., and Zhao, L. Revisiting adversarial robustness distillation from the perspective of robust fairness. In NeurIPS, 2023

2023
[51]

Theoretically principled trade-off between robustness and accuracy

Zhang, H., Yu, Y., Jiao, J., Xing, E., El Ghaoui, L., and Jordan, M. Theoretically principled trade-off between robustness and accuracy. In ICML, 2019

2019
[52]

On the duality between sharpness-aware minimization and adversarial training

Zhang, Y., He, H., Zhu, J., Chen, H., Wang, Y., and Wei, Z. On the duality between sharpness-aware minimization and adversarial training. In ICML, 2024

2024
[53]

Reliable adversarial distillation with unreliable teachers

Zhu, J., Yao, J., Han, B., Zhang, J., Liu, T., Niu, G., Zhou, J., Xu, J., and Yang, H. Reliable adversarial distillation with unreliable teachers. In ICML, 2022

2022
[54]

Revisiting adversarial robustness distillation: Robust soft labels make student better

Zi, B., Zhao, S., Ma, X., and Jiang, Y.-G. Revisiting adversarial robustness distillation: Robust soft labels make student better. In ICCV, 2021

2021
[55]

@esa (Ref

\@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...
[56]

\@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...
[57]

Notations Let N( , ) be the normal distribution with mean and variance ^2

@open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

2023 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [1]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

[2] [2]

and Flammarion, N

Andriushchenko, M. and Flammarion, N. Understanding and improving fast adversarial training. NeurIPS, 2020

work page 2020

[3] [3]

Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples

Athalye, A., Carlini, N., and Wagner, D. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In ICML, 2018

work page 2018

[4] [4]

Clustering effect of adversarial robust models

Bai, Y., Yan, X., Jiang, Y., Xia, S.-T., and Wang, Y. Clustering effect of adversarial robust models. In NeurIPS, 2021 a

work page 2021

[5] [5]

Improving adversarial robustness via channel-wise activation suppressing

Bai, Y., Zeng, Y., Jiang, Y., Xia, S.-T., Ma, X., and Wang, Y. Improving adversarial robustness via channel-wise activation suppressing. In ICLR, 2021 b

work page 2021

[6] [6]

Robust classification via a single diffusion model

Chen, H., Dong, Y., Wang, Z., Yang, X., Duan, C., Su, H., and Zhu, J. Robust classification via a single diffusion model. In ICML, 2024

work page 2024

[7] [7]

Robust overfitting may be mitigated by properly learned smoothening

Chen, T., Zhang, Z., Liu, S., Chang, S., and Wang, Z. Robust overfitting may be mitigated by properly learned smoothening. In ICLR, 2021

work page 2021

[8] [8]

Cat: Customized adversarial training for improved robustness

Cheng, M., Lei, Q., Chen, P.-Y., Dhillon, I., and Hsieh, C.-J. Cat: Customized adversarial training for improved robustness. In IJCAI, 2022

work page 2022