Pith. sign in

REVIEW 3 major objections 5 minor 54 references

Are Fast Methods Stable in Adversarially Robust Transfer Learning?

T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that the fast gradient sign method (FGSM) avoids catastrophic overfitting during adversarial fine-tuning of robustly pretrained models, matching 7-step PGD performance within 1.4% robustness while using a quarter of the…

desk verdict Useful empirical claim that FGSM is stable in adversarially robust fine-tuning, but the missing standard-pretrained control and single-run numbers keep the headline from being fully established. read the letter →

arxiv 2506.22602 v1 pith:YQK2SGBH submitted 2025-06-27 cs.LG stat.ML

Joshua C. Zhao , Saurabh Bagchi This is my paper · ORCID
classification cs.LGstat.ML
keywords fastgradientsignmethodadversarialfine-tuningcatastrophicoverfittingrobusttransferlearningparameter-efficientlinearprobingrobustnessPGD
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that the fast gradient sign method (FGSM), a single-step attack that usually suffers catastrophic overfitting when training adversarial models from scratch, is stable when used for adversarial fine-tuning of a robustly pretrained model. At the standard perturbation budgets $\varepsilon=4$ and $\varepsilon=8$, FGSM fine-tuning does not collapse under evaluation with a stronger 10-step PGD attack. Restricting updates to a small parameter set, as in linear probing, extends this stability to perturbation budgets as large as $\varepsilon=32$. Compared with 7-step PGD fine-tuning, FGSM loses only 0.39% ($\varepsilon=4$) and 1.39% ($\varepsilon=8$) average PGD-10 robustness across five datasets while needing about a quarter of the training time. If true, this makes the cheap single-step attack a practical default for adversarially robust transfer learning rather than a speed trick that requires extra regularization.

What carries the argument

The mechanism the paper identifies is the combination of a robust pretrained initialization with restricted parameter updates during fine-tuning. FGSM generates each adversarial example in a single large step ($\alpha=\varepsilon$) rather than PGD's multiple smaller steps, which is what makes it roughly $4\times$ faster, and the paper shows that the usual failure mode — convergence to the degenerate minimum that triggers catastrophic overfitting — does not occur when the starting weights are already robust and only a limited set of parameters is updated. The feature-restricting nature of parameter-efficient fine-tuning (PEFT) acts as a regularizer: linear probing tunes only the classification head, BitFit only the biases, and Adapter only added bottleneck layers, and the paper maps the stability ceiling to the degree of parameter restriction (linear probing stable at $\varepsilon=32$, BitFit at $\varepsilon=16$, Adapter at $\varepsilon=12$, full fine-tuning at $\varepsilon=8$). A cosine-similarity comparison between the perturbations produced by FGSM and PGD-7 quantifies the residual performance gap: the two attacks produce nearly aligned examples at small $\varepsilon$, and the divergence grows with $\varepsilon$, which is how the paper separates attack-strength differences from overfitting.

What would settle it

Fine-tune an ImageNet-pretrained ViT-B/16 that has NOT been adversarially pretrained (standard non-robust weights) on CIFAR-10 with plain FGSM at $\varepsilon=8$, monitor PGD-10 test robustness over epochs, and compare to the same setup with the robustly pretrained backbone; a collapse to near-zero robustness by the end of training would show that the stability is inherited from robust pretraining, not from fine-tuning itself.

Watch

Extended reading notes

Core claim

The central discovery is that FGSM is stable in adversarially robust transfer learning, in contrast to its well-known catastrophic overfitting when training from scratch. On robustly pretrained Swin-B and ViT-B/16 transformers, FGSM fine-tuning at $\varepsilon=4$ and $\varepsilon=8$ maintains PGD-10 test robustness throughout training, with no sudden collapse, across full fine-tuning, linear probing, BitFit, and Adapter. The paper shows the stability is not an artifact of FGSM-specific regularization: plain FGSM matches FGSM with random initialization or GradAlign regularization while using less time. When combined with parameter-efficient fine-tuning, the stability ceiling rises — linear probing stays stable up to $\varepsilon=32$, BitFit up to $\varepsilon=16$, and Adapter up to $\varepsilon=12$. The remaining gap to PGD at large $\varepsilon$ is attributed to attack strength rather than instability: FGSM's single-step adversarial examples become increasingly dissimilar and weaker relative to PGD's iterated ones as $\varepsilon$ grows, yet at the standard $\varepsilon \le 8$ the gap is small (on average 0.39% and 1.39% robustness at $\varepsilon=4$ and $\varepsilon=8$, respectively).

Load-bearing premise

The generalization that FGSM is stable in adversarial fine-tuning rests on two transformer backbones (Swin-B and ViT-B/16) that were both robustly pretrained on ImageNet with $\varepsilon=4$; the paper provides no evidence for other architectures or for models pretrained without robustness, so if the stability depends on the geometry of these robust features, the claim would not extend beyond them.

Editorial extensions

If this is right

  • Robust transfer learning can use plain FGSM instead of PGD-7 as the default adversarial fine-tuning procedure, cutting training time by roughly $4\times$ while sacrificing less than 1.4% average PGD-10 robustness at standard budgets.
  • No additional single-step regularization such as random initialization or gradient alignment is needed during adversarial fine-tuning, removing their extra compute cost.
  • Linear probing with FGSM, stable up to $\varepsilon=32$, offers a practical way to build robust classifiers at very high perturbation budgets without catastrophic overfitting.
  • The gap between FGSM and PGD at large $\varepsilon$ is an attack-estimation weakness rather than a training instability, so improving the adversarial example quality of a single-step attack is the route to closing that gap.
  • The two-stage RoLI robust initialization method works with FGSM in either stage with negligible robustness loss and up to $4\times$ lower total time.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the stability mechanism is the robust pretrained weight geometry, then a directly testable extension is that FGSM fine-tuning on non-robustly pretrained backbones would re-introduce catastrophic overfitting; the paper does not test this case, and its claim should not be read as covering it.
  • The same stability may transfer to other fast single-step attack variants (for example, versions with momentum or improved step-size schedules), potentially making the whole family cheap for robust transfer learning; this is an untested extrapolation.
  • The stability ceiling mapped to parameter restriction suggests a further, untested prediction: interpolation methods that update an intermediate number of parameters, such as LoRA with varying rank, should exhibit a stability threshold between full fine-tuning and linear probing.
  • The $4\times$ speedup matters most at deployment scale — large models and large datasets — so scaling these experiments to ImageNet-scale fine-tuning would be a natural next test of the paper's practical significance.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies FGSM as a cheap alternative to PGD-7 for adversarially fine-tuning robustly pretrained transformer models. It reports that FGSM does not exhibit catastrophic overfitting at epsilon=4 and epsilon=8 for full fine-tuning, and remains stable up to epsilon=32 with linear probing, with PEFT methods (BitFit, Adapter) lying between. It compares FGSM and PGD across five datasets and four fine-tuning methods, reporting roughly 4x lower training time for FGSM at a small robustness cost (average PGD-10 robustness 0.39% and 1.39% lower for epsilon=4 and epsilon=8, respectively). It also compares FGSM variants, analyzes the FGSM/PGD attack-strength gap via cosine similarity, extends experiments to RoLI, and validates robustness with AutoAttack on two datasets.

Significance. If the stability result holds in general, the paper identifies a practically useful regime: FGSM adversarial fine-tuning is substantially cheaper than PGD and nearly as robust, which matters because adversarial fine-tuning is a major computational bottleneck. The paper has concrete strengths: it reports full 40-epoch training curves for the stability claims, validates against PGD-10 and AutoAttack rather than relying on FGSM training robustness, and makes a falsifiable prediction that FGSM does not catastrophically overfit at standard budgets in robust transfer learning. The manuscript does not yet ship code or provide seeds/confidence intervals, so the quantitative equivalence claims rest on single-run, best-epoch numbers. The main risk is the breadth of the stability claim relative to the evidence, which is confined to robustly pretrained transformers.

major comments (3)
  1. [Section 3.1 and Supplementary Section 7] All fine-tuning experiments use Swin-B and ViT-B/16 weights from ARES 2.0, which are robustly pretrained on ImageNet-1K with epsilon=4. The paper's central claim that 'FGSM is stable in adversarial fine-tuning' is therefore demonstrated only for robustly pretrained transformers. Add at least one standard (non-robust) ImageNet-pretrained control, or explicitly restrict the abstract, introduction, and conclusion to robustly pretrained transfer learning. Without such a control, the broad generalization to the common practice of fine-tuning standard pretrained models is unsupported.
  2. [Section 3.1 and Supplementary Figure 9] The from-scratch comparison that motivates the claim 'FGSM is much more stable in fine-tuning than from scratch' is confounded by architecture: catastrophic overfitting is shown for a ResNet-50 trained from scratch, while fine-tuning stability is shown for ViT/Swin transformers. The footnote explains the architecture choice for cost reasons, but it does not remove the confound. Please train a from-scratch transformer on the same dataset (even with a reduced budget) or fine-tune a standard-pretrained ResNet, so that the contrast can be attributed to transfer learning rather than to model family.
  3. [Section 4.1, Tables 2 and 3] The headline performance equivalence is quantified by single-run, best-epoch peak PGD-10 robustness, with no seeds, confidence intervals, or an explicit epoch-selection rule. Because the reported gaps are small (e.g., an average 0.39% robustness gap at epsilon=4), the reader cannot distinguish a real PGD advantage from run-to-run variation. Report multiple seeds with standard deviations and final-epoch numbers, and state precisely how the peak-robustness epoch is chosen for each run.
minor comments (5)
  1. [Section 3.1] The sentence 'FGSM has -0.4%, 0.9%, 0.3%, and 3.2% lower peak robustness than PGD' is confusing because a negative 'lower' would mean an improvement; please use signed differences throughout.
  2. [Supplementary Section 7] The experimental details say the learning rate is tuned for each setting, but the specific per-setting values are not reported; please include a table of the final learning rate used for each dataset, fine-tuning method, epsilon, and model.
  3. [Supplementary Section 7] There are small typos: 'trained om ImageNet-1K' should be 'trained on ImageNet-1K', and 'paramter' should be 'parameter' in the caption of Table 8.
  4. [Section 4.1] The AutoAttack evaluation uses a random subset of 1000 images; please report the random seed or provide a detailed protocol so that the subset is reproducible.
  5. [Abstract and Section 6] The claim 'Code will be provided' appears in the text, but no repository or release plan is specified; please include a repository link or state clearly when code will be released, as timing and stability curves are otherwise difficult to reproduce.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the FGSM stability claim is an empirical finding evaluated with external stronger attacks and contains no fitted-input or self-referential derivation.

full rationale

The paper's central claims are empirical rather than derivational: it reports that FGSM adversarial fine-tuning remains stable at epsilon 4 and 8, and compares FGSM against PGD-7 fine-tuning. The robustness numbers are validated with PGD-10 and AutoAttack, both of which are stronger, externally defined attacks that the FGSM training procedure never optimizes. Catastrophic overfitting is therefore detected by an independent yardstick, not by a quantity encoded in the training objective. The paper fits no parameters to the evaluation data, and it does not define stability in terms of the reported accuracy values. Its comparisons among FGSM, FGSM+RI, and FGSM+GradAlign are controlled experiments with the same evaluation protocol. The use of ARES 2.0 robustly pretrained Swin-B and ViT-B/16 weights is an experimental design choice, cited from external authors, and is not a self-citation; the possible limitation that the result may not transfer to standard-pretrained weights is a generalization concern, not circularity. No step in the paper reduces, by construction, to its own inputs, so no circular step is present.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper is empirical. Its conclusions depend on standard assumptions about how to measure robustness and on the representativeness of the two pretrained transformers; no free parameters are fitted to the data and no new entities are postulated.

assumptions (3)
  • domain assumption PGD-10 robustness is an adequate measure of catastrophic overfitting and of downstream robustness.
    Used throughout (Figures 2-3, Tables 2-6) to define both stability and performance; this follows the adversarial training literature but is an external assumption about attack strength.
  • domain assumption ARES 2.0 robustly pretrained Swin-B and ViT-B/16 are representative starting points for robust transfer learning.
    Section 4 uses only these two backbones; the central empirical generalization goes beyond the tested architectures and pretraining conditions.
  • domain assumption Best-epoch selection from a single run estimates typical fine-tuning performance.
    Tables report peak PGD-10 robustness over epochs from single runs, without seeds or confidence intervals, which can overstate performance.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Are Fast Methods Stable in Adversarially Robust Transfer Learning?." pith.science (2026). https://pith.science/paper/YQK2SGBH

@misc{pith2026250622602,
  author       = {Pith},
  title        = {Pith review of: Are Fast Methods Stable in Adversarially Robust Transfer Learning?},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YQK2SGBH}},
  note         = {Machine review of arXiv:2506.22602}
}
abstract

Transfer learning is often used to decrease the computational cost of model training, as fine-tuning a model allows a downstream task to leverage the features learned from the pre-training dataset and quickly adapt them to a new task. This is particularly useful for achieving adversarial robustness, as adversarially training models from scratch is very computationally expensive. However, high robustness in transfer learning still requires adversarial training during the fine-tuning phase, which requires up to an order of magnitude more time than standard fine-tuning. In this work, we revisit the use of the fast gradient sign method (FGSM) in robust transfer learning to improve the computational cost of adversarial fine-tuning. We surprisingly find that FGSM is much more stable in adversarial fine-tuning than when training from scratch. In particular, FGSM fine-tuning does not suffer from any issues with catastrophic overfitting at standard perturbation budgets of $\varepsilon=4$ or $\varepsilon=8$. This stability is further enhanced with parameter-efficient fine-tuning methods, where FGSM remains stable even up to $\varepsilon=32$ for linear probing. We demonstrate how this stability translates into performance across multiple datasets. Compared to fine-tuning with the more commonly used method of projected gradient descent (PGD), on average, FGSM only loses 0.39% and 1.39% test robustness for $\varepsilon=4$ and $\varepsilon=8$ while using $4\times$ less training time. Surprisingly, FGSM may not only be a significantly more efficient alternative to PGD in adversarially robust transfer learning but also a well-performing one.

Figures

Figures reproduced from arXiv: 2506.22602 by the authors.

Figure 1
Figure 1. Adversarial fine-tuning using FGSM and PGD for 40 [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 3
Figure 3. Natural accuracy (solid line) and robustness (dashed [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 2
Figure 2. FGSM vs. PGD (a) full fine-tuning and (b) linear prob [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Average cosine distance between FGSM and PGD ad [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: Natural accuracy (solid line) and robustness (dashed [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 8
Figure 8. Figure 8: Natural accuracy (solid line) and robustness (dashed [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Adversarial training with FGSM and PGD from scratch [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 42 canonical work pages

  1. [1]

    Under- standing and improving fast adversarial training

    Maksym Andriushchenko and Nicolas Flammarion. Under- standing and improving fast adversarial training. Advances in Neural Information Processing Systems, 33:16048–16059,

    work page

  2. [2]

    Square attack: a query-efficient black-box adversarial attack via random search

    Maksym Andriushchenko, Francesco Croce, Nicolas Flam- marion, and Matthias Hein. Square attack: a query-efficient black-box adversarial attack via random search. InEuropean conference on computer vision , pages 484–501. Springer,

    work page

  3. [3]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International confer- ence on machine learning, pages 274–283. PMLR, 2018. 1

    work page 2018

  4. [4]

    Bit- Fit: Simple parameter-efficient fine-tuning for transformer- based masked language-models

    Elad Ben Zaken, Yoav Goldberg, and Shauli Ravfogel. Bit- Fit: Simple parameter-efficient fine-tuning for transformer- based masked language-models. In Proceedings of the 60th Annual Meeting of the Association for Computational Lin- guistics (Volume 2: Short Papers) , pages 1–9, Dublin, Ire- land, 2022. Association for Computational Linguistics. 2, 3, 6

    work page 2022

  5. [5]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017. 1

    2017

  6. [6]

    Unlabeled data improves adver- sarial robustness

    Yair Carmon, Aditi Raghunathan, Ludwig Schmidt, John C Duchi, and Percy S Liang. Unlabeled data improves adver- sarial robustness. Advances in neural information processing systems, 32, 2019. 3

    work page 2019

  7. [7]

    Minimally distorted adversarial examples with a fast adaptive boundary attack

    Francesco Croce and Matthias Hein. Minimally distorted adversarial examples with a fast adaptive boundary attack. In International conference on machine learning, pages 2196–

    work page

  8. [8]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. In International conference on ma- chine learning, pages 2206–2216. PMLR, 2020. 7, 8

    work page 2020

Show all 54 references
  1. [9]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 6, 1

    2009

  2. [10]

    Bert: Pre-training of deep bidirectional trans- formers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional trans- formers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the asso- ciation for computational linguistics: human l...

    2019

  3. [11]

    Benchmarking adversar- ial robustness on image classification

    Yinpeng Dong, Qi-An Fu, Xiao Yang, Tianyu Pang, Hang Su, Zihao Xiao, and Jun Zhu. Benchmarking adversar- ial robustness on image classification. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 321–331, 2020. 3, 6, 1

    2020

  4. [12]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Syl- vain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition ...

    2021

  5. [13]

    Explaining and harnessing adversarial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014. 1, 2, 3

    2014 arXiv

  6. [14]

    Safer: Sharpness aware layer-selective finetuning for enhanced robustness in vision transformers

    Bhavna Gopal, Huanrui Yang, Mark Horton, and Yiran Chen. Safer: Sharpness aware layer-selective finetuning for enhanced robustness in vision transformers. arXiv preprint arXiv:2501.01529, 2025. 4, 2

    2025 arXiv

  7. [15]

    Caltech- 256 object category dataset

    Gregory Griffin, Alex Holub, Pietro Perona, et al. Caltech- 256 object category dataset. Technical report, Technical Report 7694, California Institute of Technology Pasadena,

  8. [16]

    Countering adversarial images using input transformations

    Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens van der Maaten. Countering adversarial images using input transformations. In International Conference on Learning Representations, 2018. 1

    2018

  9. [17]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 1

    2016

  10. [18]

    Us- ing pre-training can improve model robustness and uncer- tainty

    Dan Hendrycks, Kimin Lee, and Mantas Mazeika. Us- ing pre-training can improve model robustness and uncer- tainty. In International conference on machine learning , pages 2712–2721. PMLR, 2019. 1, 3

    2019

  11. [19]

    Parameter-efficient transfer learning for nlp

    Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin De Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly. Parameter-efficient transfer learning for nlp. In International conference on machine learning, pages 2790–2799. PMLR, 2019. 2, 3, 4, 6, 1

    2019

  12. [20]

    Lora: Low-rank adaptation of large language models

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685, 2021. 3

    2021 arXiv

  13. [21]

    Initialization matters for adversarial transfer learning

    Andong Hua, Jindong Gu, Zhiyu Xue, Nicholas Carlini, Eric Wong, and Yao Qin. Initialization matters for adversarial transfer learning. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pages 24831–24840, 2024. 1, 3, 4, 7, 8

    2024

  14. [22]

    Prior-guided adversarial initialization for fast adversarial training

    Xiaojun Jia, Yong Zhang, Xingxing Wei, Baoyuan Wu, Ke Ma, Jue Wang, and Xiaochun Cao. Prior-guided adversarial initialization for fast adversarial training. In European Con- ference on Computer Vision, pages 567–584. Springer, 2022. 8

    2022

  15. [23]

    Novel dataset for fine-grained image categorization: Stanford dogs

    Aditya Khosla, Nityananda Jayadevaprakash, Bangpeng Yao, and Fei-Fei Li. Novel dataset for fine-grained image categorization: Stanford dogs. In Proc. CVPR workshop on fine-grained visual categorization (FGVC), 2011. 6, 1

    2011

  16. [24]

    Understanding catastrophic overfitting in single-step adversarial training

    Hoki Kim, Woojin Lee, and Jaewook Lee. Understanding catastrophic overfitting in single-step adversarial training. In Proceedings of the AAAI Conference on Artificial Intelli- gence, pages 8119–8127, 2021. 2, 3

    2021

  17. [25]

    Learning multiple layers of features from tiny images

    Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009. 6, 1

    2009

  18. [26]

    Swin transformer: Hierarchical vision transformer using shifted windows

    Ze Liu, Yutong Lin, Yue Cao, Han Hu, Yixuan Wei, Zheng Zhang, Stephen Lin, and Baining Guo. Swin transformer: Hierarchical vision transformer using shifted windows. In Proceedings of the IEEE/CVF international conference on computer vision, pages 10012–10022, 2021. 2, 3, 6

    2021

  19. [27]

    Twins: A fine-tuning framework for improved transferability of ad- versarial robustness and generalization

    Ziquan Liu, Yi Xu, Xiangyang Ji, and Antoni B Chan. Twins: A fine-tuning framework for improved transferability of ad- versarial robustness and generalization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 16436–16446, 2023. 1, 3

    2023

  20. [28]

    Towards deep learn- ing models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learn- ing models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. 1, 2, 3, 5

    2018

  21. [29]

    Automated flower classification over a large number of classes

    Maria-Elena Nilsback and Andrew Zisserman. Automated flower classification over a large number of classes. In 2008 Sixth Indian conference on computer vision, graphics & im- age processing, pages 722–729. IEEE, 2008. 6, 1

    2008

  22. [30]

    Distillation as a defense to adver- sarial perturbations against deep neural networks

    Nicolas Papernot, Patrick McDaniel, Xi Wu, Somesh Jha, and Ananthram Swami. Distillation as a defense to adver- sarial perturbations against deep neural networks. In 2016 IEEE symposium on security and privacy (SP) , pages 582–

    2016

  23. [31]

    Reliably fast adversar- ial training via latent adversarial perturbation

    Geon Yeong Park and Sang Wan Lee. Reliably fast adversar- ial training via latent adversarial perturbation. In Proceed- ings of the IEEE/CVF international conference on computer vision, pages 7758–7767, 2021. 2

    2021

  24. [32]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 1

    2022

  25. [33]

    Do adversarially robust im- agenet models transfer better? Advances in Neural Informa- tion Processing Systems, 33:3533–3545, 2020

    Hadi Salman, Andrew Ilyas, Logan Engstrom, Ashish Kapoor, and Aleksander Madry. Do adversarially robust im- agenet models transfer better? Advances in Neural Informa- tion Processing Systems, 33:3533–3545, 2020. 1, 3, 4

    2020

  26. [34]

    Adversarially robust gener- alization requires more data

    Ludwig Schmidt, Shibani Santurkar, Dimitris Tsipras, Kunal Talwar, and Aleksander Madry. Adversarially robust gener- alization requires more data. Advances in neural information processing systems, 31, 2018. 3

    2018

  27. [35]

    Adversarial training for free! Advances in neural information processing systems , 32, 2019

    Ali Shafahi, Mahyar Najibi, Mohammad Amin Ghiasi, Zheng Xu, John Dickerson, Christoph Studer, Larry S Davis, Gavin Taylor, and Tom Goldstein. Adversarial training for free! Advances in neural information processing systems , 32, 2019. 3, 8

    2019

  28. [36]

    Adver- sarially robust transfer learning

    Ali Shafahi, Parsa Saadatpanah, Chen Zhu, Amin Ghiasi, Christoph Studer, David Jacobs, and Tom Goldstein. Adver- sarially robust transfer learning. In International Conference on Learning Representations, 2020. 1, 3, 8

    2020

  29. [37]

    On the adversarial robustness of vision trans- formers

    Rulin Shao, Zhouxing Shi, Jinfeng Yi, Pin-Yu Chen, and Cho-Jui Hsieh. On the adversarial robustness of vision trans- formers. arXiv preprint arXiv:2103.15670, 2021. 3, 4, 2

    2021 arXiv

  30. [38]

    Intriguing properties of neural networks

    C Szegedy. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. 1, 2

    2013 arXiv

  31. [39]

    Transfer learning

    Lisa Torrey and Jude Shavlik. Transfer learning. In Hand- book of research on machine learning applications and trends: algorithms, methods, and techniques , pages 242–

  32. [40]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth´ee Lacroix, Baptiste Rozi`ere, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. 1

    2023 arXiv

  33. [41]

    Ensemble adversarial training: Attacks and defenses

    Florian Tram `er, Alexey Kurakin, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. Ensemble adversarial training: Attacks and defenses. In International Conference on Learning Representations, 2018. 2, 3, 4

    2018

  34. [42]

    Autonomous vehicle perception: The technology of today and tomorrow

    Jessica Van Brummelen, Marie O’brien, Dominique Gruyer, and Homayoun Najjaran. Autonomous vehicle perception: The technology of today and tomorrow. Transportation re- search part C: emerging technologies, 89:384–406, 2018. 1

    2018

  35. [43]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszko- reit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017. 1

    2017

  36. [44]

    Better diffusion models further improve adversarial training

    Zekai Wang, Tianyu Pang, Chao Du, Min Lin, Weiwei Liu, and Shuicheng Yan. Better diffusion models further improve adversarial training. InInternational Conference on Machine Learning, pages 36246–36263. PMLR, 2023. 3

    2023

  37. [45]

    Preventing catastrophic overfitting in fast adversarial train- ing: A bi-level optimization perspective

    Zhaoxin Wang, Handing Wang, Cong Tian, and Yaochu Jin. Preventing catastrophic overfitting in fast adversarial train- ing: A bi-level optimization perspective. In European Con- ference on Computer Vision, pages 144–160. Springer, 2024. 2

    2024

  38. [46]

    A survey of transfer learning

    Karl Weiss, Taghi M Khoshgoftaar, and DingDing Wang. A survey of transfer learning. Journal of Big data , 3:1–40,

  39. [47]

    Zico Kolter

    Eric Wong, Leslie Rice, and J. Zico Kolter. Fast is better than free: Revisiting adversarial training. In International Conference on Learning Representations, 2020. 2, 3, 4, 5, 8, 1

    2020

  40. [48]

    Towards efficient adversarial training on vision transformers

    Boxi Wu, Jindong Gu, Zhifeng Li, Deng Cai, Xiaofei He, and Wei Liu. Towards efficient adversarial training on vision transformers. In European Conference on Computer Vision, pages 307–325. Springer, 2022. 3, 4, 2

    2022

  41. [49]

    Au- tolora: An automated robust fine-tuning framework

    Xilie Xu, Jingfeng Zhang, and Mohan Kankanhalli. Au- tolora: An automated robust fine-tuning framework. In The Twelfth International Conference on Learning Representa- tions, 2024. 1, 3

    2024

  42. [50]

    Theoretically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Lau- rent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR,

  43. [53]

    The models are trained om ImageNet- 1K [9] with ε = 4

    Experimental details We use the Swin-B and ViT-B/16 models from ARES 2.0 [11] in this paper. The models are trained om ImageNet- 1K [9] with ε = 4. In order to ensure that the downstream dataset images match the pre-training model specifications, images are also resized to 224...

  44. [54]

    Varying epsilon

    Additional results We include some additional experimental results along with individual numbers here. Varying epsilon. Figure 5 shows the natural accuracy and robustness curves for FGSM full fine-tuning on Caltech256 with multiple ε. Catastrophic overfitting begins at ε = 12,...

  45. [264]

    IGI global, 2010. 1, 3

    2010

  46. [2019]

    3 Are Fast Methods Stable in Adversarially Robust Transfer Learning? Supplementary Material

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.