Pith. sign in

REVIEW 3 major objections 6 minor 24 references

Learning from Peers: Collaborative Ensemble Adversarial Training

T0 review · 3 major / 6 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Peer-disagreement reweighting lifts CIFAR-10 robustness to 51.75%

desk verdict Strong empirical gains for a plug-in ensemble adversarial training reweighting scheme, but the core 'disparity as boundary proxy' assumption is asserted, not validated — worth refereeing with required revisions. read the letter →

arxiv 2509.00089 v1 pith:6CLQZSSI submitted 2025-08-27 cs.LG

Li Dengjin , Guo Yanming , Xie Yuxiang , Li Zheng , Chen Jiangming , Li Xiaolong , Lao Mingrui This is my paper · ORCID
classification cs.LG MSC 68T07
keywords ensembleadversarialtrainingrobustnesssamplereweightingcollaborativelearningdistanceregularizationAutoAttackCIFAR-10plug-and-playmodule
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Ensemble adversarial training usually trains each sub-model in isolation. This paper argues that the samples that matter most for robustifying the ensemble are those on which peer sub-models disagree, because they sit closest to the ensemble's decision boundary. The proposed Collaborative Ensemble Adversarial Training (CEAT) adds a calibrating distance regularization that upweights these disputed samples when training the remaining sub-model. The result is a reported state-of-the-art robustness boost—51.75% AutoAttack accuracy on CIFAR-10 and 27.72% on CIFAR-100—while preserving clean accuracy. The extra loss term is model-agnostic and plugs into prior EAT methods to improve them as well.

What carries the argument

The central object is the exponential predictive-disparity coefficient e_D = exp(μ|h_b(x_i)-h_c(x_i)|), computed from two peer sub-models' true-class probabilities, multiplied by a 'calibrating distance regularization' on the trained sub-model's outputs. The distance terms penalize movement of the sub-model's output between clean and adversarial inputs and between clean output and the one-hot label. The disparity coefficient acts as a continuous, differentiable surrogate for the discrete 0-1 disagreement risk, so that gradient-based training automatically concentrates weight on samples where the peers disagree.

What would settle it

Compute a per-sample margin for the ensemble (e.g., the gap between the top two class probabilities) or the minimum perturbation needed to flip the ensemble's prediction, and correlate it with |h_b-h_c|. If the correlation is weak or absent, the exponential disparity term is not selecting boundary-close samples. A second test: construct a batch where two peers both predict the same label with high confidence but differ greatly in confidence (0.99 vs 0.51); the method would upweight samples that are not near the boundary, so robustness should not improve as predicted.

Watch

Extended reading notes

Core claim

The paper claims that samples with large predictive disparities between two peer sub-models are close to the ensemble decision boundary and therefore have a disproportionate influence on ensemble robustness. CEAT formalizes this by replacing the discontinuous 0-1 disagreement risk with a continuous exponential weighting e_D = exp(μ|h_b(x_i)-h_c(x_i)|), where h_m is the sub-model's probability for the true class. This weight multiplies a distance regularization ||f_a(x_i+δ)-f_a(x_i)||^2 on the adversarial sample and a similar term ||f_a(x_i)-y_i||^2 on the clean sample, and the total loss for sub-model a is L_ce + λ LD_nat + μ LD_adv. Training each sub-model with this collaborative loss is re

Load-bearing premise

The whole reweighting mechanism rests on the premise that the difference in two peers' true-class probabilities reliably flags samples near the ensemble decision boundary; the paper asserts this without measuring the actual decision-boundary distance.

Editorial extensions

If this is right

  • CEAT reports higher white-box robustness than prior ensemble AT methods, e.g., 51.75% AutoAttack on CIFAR-10 and 27.72% on CIFAR-100.
  • The λ and μ coefficients let users trade off clean accuracy against robustness: larger λ favors accuracy, larger μ favors adversarial robustness.
  • The calibrating distance loss works as a standalone plug-in module: adding it to ADP, GAL, TRS, DVERGE, LAFED, and FASTEN improves their robustness on CIFAR-10.
  • The method generalizes to heterogeneous sub-models (ResNet-20/26/32) and to four sub-models, with robustness increasing though at higher training cost.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not directly verify that true-class probability disparity correlates with distance to the ensemble decision boundary; a natural extension is to compare e_D against a margin- or perturbation-based boundary-distance measure on a sample-by-sample basis.
  • Because e_D is based on true-class probability, two models that agree on the label but differ strongly in confidence (e.g., 0.99 vs 0.51) would be treated as a disagreement; switching to a full-probability divergence (e.g., KL or total variation) may be a more faithful proxy and is testable.
  • The collaborative weighting resembles a boosting-style focus on samples where peer models disagree; if the mechanism is the key driver, CEAT could be combined with curriculum learning or self-paced reweighting for further gains.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes Collaborative Ensemble Adversarial Training (CEAT), an ensemble adversarial training method in which each sub-model's training loss reweights samples according to the predictive disparity between the other two sub-models. The method augments the standard cross-entropy loss with two distance regularizers: one on adversarial examples, L^D_adv = exp(µ|h_b−h_c|) ||f_a(x+δ)−f_a(x)||², and one on clean examples, L^D_nat = exp(λ|h_b−h_c|) ||f_a(x)−y||². The authors motivate this by a 0-1 risk decomposition that separates samples where two peer sub-models disagree (F1∪F2) from samples where they agree (F3∪F4), then replace this discrete risk with a continuous exponential reweighting. Experiments on CIFAR-10 and CIFAR-100 compare CEAT with ADP, GAL, TRS, DVERGE, LAFED, and FASTEN, reporting state-of-the-art robustness, e.g., 51.75% AutoAttack accuracy on CIFAR-10 for CEAT(1,5). The paper also shows that the regularizer can be plugged into prior EAT methods (Table 2), studies heterogeneous and four-model ensembles (Table 3), and provides ablations (Table 4, Figures 4–6).

Significance. If the empirical results are reproducible, CEAT is a simple and effective contribution to ensemble adversarial training. Its plug-and-play loss can be combined with existing EAT methods, and the reported gains on CIFAR-10/100 are substantial compared with the included baselines. The paper also provides a relatively complete experimental package: multiple datasets, multiple architectures, homogeneous and heterogeneous ensembles, black-box evaluation, and training-time comparison. The main weakness is that the theoretical motivation, based on a 0-1 disagreement risk, is only loosely connected to the final loss, and the key premise that |h_b−h_c| separates agreeing from disagreeing peers is not validated. The core mechanism is therefore not yet established; the improvements could plausibly come from the distance regularization alone. Because the method itself is empirical and the ablations are informative, the central claim is defensible but needs additional analysis before publication.

major comments (3)
  1. [§3.3, Eqs. (16) and (22)] The final loss is not derived from the risk reformulation. Eq. (16) partitions samples into F1∪F2 and F3∪F4 and assigns different 0-1 risks to the two sets, but Eq. (22) applies the same form of exponential reweighting to all samples. Even if eD ≈ 1 on F3∪F4, those samples still receive the distance regularization Ladv, which Eq. (16) does not prescribe for that set. The text calls eD a 'continuous calibrating distance regularization' to replace the discontinuous 0-1 loss, but no formal connection is shown between optimizing Eq. (22) and minimizing Eq. (16). Since the paper's motivation rests on this decomposition, the heuristic nature of the replacement should be stated explicitly, or the derivation should be supplied.
  2. [§3.3, Eq. (18)] The claim that eD is near 1 for both-correct and both-incorrect pairs and large for one-correct/one-incorrect pairs is not a mathematical consequence of |h_b−h_c|. Two models that both classify a sample correctly can have true-class probabilities 0.99 and 0.51, giving |h_b−h_c| = 0.48 and eD ≈ 11 for µ = 5; conversely, one correct and one incorrect model can give probabilities 0.60 and 0.55, yielding eD ≈ 1.28. The proxy therefore does not reliably separate F1∪F2 from F3∪F4. No experiment measures the distribution of |h_b−h_c| across these four sets, nor compares eD weighting against oracle 0-1 disagreement weighting. This is load-bearing for the claimed collaborative mechanism: ablation row 2 of Table 4 already shows a +3.4 PGD improvement from Ladv alone, so the additional benefit of eD could be due to its overall scaling rather than to the identification of disagreement samples. I rec
  3. [Eqs. (18), (21), (22), §4.4] The hyperparameters λ and µ each play two roles: they multiply the regularizers in Eq. (22) and appear inside the exponential in Eqs. (18) and (21). The reported configurations CEAT(5,1) and CEAT(1,5) therefore conflate the multiplier effect with the exponent effect. The sensitivity analysis in Figures 4 and 5 varies λ with µ fixed and vice versa, but because each symbol appears twice, the observed trends cannot be attributed uniquely to either role. This makes the accuracy-robustness trade-off claim harder to interpret. The authors should either separate the coefficients from the exponents (e.g., use different symbols) or provide an additional experiment that isolates the two roles.
minor comments (6)
  1. [Abstract] Typo: 'we find that that samples' should read 'we find that samples'.
  2. [§2, References] Reference numbering is inconsistent. In the Related Work section, DVERGE is cited as [7] but the reference list assigns [7] to GAL and [8] to DVERGE; TRS is cited as [8] in the text but as [9] elsewhere; FASTEN is cited as [10] in Related Work but [10] in the reference list is Tramer et al., while FASTEN is [11]. Please reconcile all citations with the bibliography.
  3. [§3.2, Eq. (12)] The notation R(θ1_a) and R(θ2_a) is confusing: Eq. (12) defines R(θ1_a) as an indicator expression, while Eq. (16) treats it as a function to be summed over F1+F2. The authors should define these as set-based sums or use explicit indicator functions throughout.
  4. [§4.1, Table 1] The evaluation protocol should state whether the reported robustness numbers are for the ensemble under attacks generated against the ensemble or against individual sub-models. Equation (3) suggests ensemble-gradient attacks are used for training, but the white-box evaluation section does not specify the attack model for the reported accuracies. This is important for reproducibility and for comparing with prior EAT works.
  5. [Table 4] The first column appears to be row labels, but the table header is ambiguous ('eD Ladv Lnat NAT PGD20 MIM'). The row '1' has no checkmarks and likely denotes the baseline; please clarify the table format. Also, the figure captions for Figures 4 and 5 should state which metric is plotted on the y-axis and whether the curves are for PGD20, MIM, CW, or AA.
  6. [§3.2, Figure 2] Figure 2 is referenced in the text but not described in detail. The caption should explain what is plotted (e.g., training curves, robustness curves) and what 'optimization process slows down' refers to quantitatively.

Circularity Check

0 steps flagged · score 0.0 of 10

No circular derivation: CEAT's loss is a constructed reweighting scheme, not a quantity forced by its own inputs.

full rationale

The paper's claimed derivation chain is not circular. The final loss (Eq. 22) is a designed combination of a cross-entropy term, a clean-sample distance regularizer, and an adversarial distance regularizer weighted by eD = exp(μ|hb−hc|). This weighting is defined in terms of peer sub-models' true-class probabilities (Eq. 18) and then multiplied onto distance losses (Eqs. 19 and 21); it is not obtained by solving for the reported robustness numbers, and no fitted parameter is renamed as a prediction. The earlier 0–1 risk reformulation (Eqs. 10–16) is an independent motivation, not an equation that the final loss satisfies by construction. The self-citations [22,23] are used only to say that reweighting has been explored elsewhere and that the EAT setting is new; they do not carry the argument. The core empirical premise—that |hb−hc| separates samples where peers disagree from those where they agree—is asserted rather than proven, and the paper does not validate this proxy directly. That is a correctness/validity weakness, not a circularity: an unsupported assumption does not make the derivation reduce to its inputs. The robustness gains are measured against standard external benchmarks (PGD, MIM, CW, AA), and the ablation study (Table 4) compares variants of the loss, so the central claims are empirically testable rather than definitionally forced. Therefore no specific circular step can be exhibited.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central method adds two tuned scalars and three domain assumptions about disagreement as a training signal. It introduces no new physical or conceptual entities beyond the loss terms.

free parameters (2)
  • lambda (clean-sample disparity coefficient and exponent) = 1 for the final robustness-focused configuration; 5 for the accuracy-focused configuration; swept over 1-5 in Fig 4
    Controls the weight of LD_nat and also appears inside the exponential e^{lambda * |hb-hc|}. Selected on the CIFAR-10 test set in the sensitivity study of Section 4.4.
  • mu (adversarial-sample disparity coefficient and exponent) = 5 for the final configuration; swept over 2-6 in Fig 5
    Controls the weight of LD_adv and also appears inside the exponential e^{mu * |hb-hc|}. Selected on the CIFAR-10 test set in Section 4.4.
assumptions (4)
  • domain assumption Samples with classification disparities between sub-models lie close to the ensemble decision boundary and have greater influence on ensemble robustness.
    Stated in Section 3.2 first paragraph and Figure 1; no quantitative evidence or measurement is provided.
  • domain assumption The true-class probability disparity |hb(xi) - hc(xi)| is a valid soft proxy for classification disparity between sub-models.
    Introduced in Section 3.3 near Eq (18). The text claims both-correct and both-incorrect pairs give very small disparities, which is not true in general.
  • domain assumption The discontinuity of 0-1 loss is the reason optimization slows, and exponential soft weighting resolves it.
    Asserted in Section 3.3 after Figure 2; no proof, diagnostic, or formal argument is given.
  • standard math Standard adversarial training min-max formulation and PGD sign-gradient perturbations.
    Used in Section 3.1 Eqs (2)-(5) as the baseline training objective.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Learning from Peers: Collaborative Ensemble Adversarial Training." pith.science (2026). https://pith.science/paper/6CLQZSSI

@misc{pith2026250900089,
  author       = {Pith},
  title        = {Pith review of: Learning from Peers: Collaborative Ensemble Adversarial Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6CLQZSSI}},
  note         = {Machine review of arXiv:2509.00089}
}
read the original abstract

Ensemble Adversarial Training (EAT) attempts to enhance the robustness of models against adversarial attacks by leveraging multiple models. However, current EAT strategies tend to train the sub-models independently, ignoring the cooperative benefits between sub-models. Through detailed inspections of the process of EAT, we find that that samples with classification disparities between sub-models are close to the decision boundary of ensemble, exerting greater influence on the robustness of ensemble. To this end, we propose a novel yet efficient Collaborative Ensemble Adversarial Training (CEAT), to highlight the cooperative learning among sub-models in the ensemble. To be specific, samples with larger predictive disparities between the sub-models will receive greater attention during the adversarial training of the other sub-models. CEAT leverages the probability disparities to adaptively assign weights to different samples, by incorporating a calibrating distance regularization. Extensive experiments on widely-adopted datasets show that our proposed method achieves the state-of-the-art performance over competitive EAT methods. It is noteworthy that CEAT is model-agnostic, which can be seamlessly adapted into various ensemble methods with flexible applicability.

Figures

Figures reproduced from arXiv: 2509.00089 by the authors.

Figure 1
Figure 1. Lines a, b, and c are decision boundaries of sub-models in the ensemble. The green indicates correct classification and the red indicates incorrect classification in ensemble. The purple arrow represents the classification performance after training with collaborative strategy. address the urgent need for robustness, ensemble adversarial training (EAT) [5] incorporates multiple sub-models into the training process. … view at source ↗
Figure 2
Figure 2. Comparison between standard adversarial training and introducing distance regularization on adversarial samples with consistent and inconsistent classification between sub-models. gap. We define the prediction probability of model on real class of the sample as hm (xei) = pm(xei , yi), where yi represents the real class of sample. To measure the prediction disparities between sub-models on real class of the sample, … view at source ↗
Figure 3
Figure 3. The success rate (%) of adversarial attacks generated by each sub-model on itself and other sub-models. The lower the value, the better the defense of sub-models and the lower the transferability of the attack. sub-models, testing its own defense capabilities, and assessing its attack trans￾ferability to other sub-models. CEAT adopts LEAT, with independent optimizer, achieving the lowest success rate for attacks, wh… view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Sensitivity to parameter λ [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 6
Figure 6. Figure 6: Black box robustness and Training time. Black box attacks cannot access the structure and parameters of the mod￾els. They use the transferability of the adversarial samples to attack by testing the proxy model. As shown in [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

24 extracted references · 24 canonical work pages

  1. [1]

    International Conference on Learning Represen- tations (ICLR), 2015

    Goodfellow, Ian J and Shlens, Jonathon and Szegedy, Christian: Explaining and Harnessing Adversarial Examples. International Conference on Learning Represen- tations (ICLR), 2015

    work page 2015

  2. [2]

    Madry, Aleksander and Makelov, Aleksandar, Schmidt and Ludwig: Towards Deep Learning Models Resistant to Adversarial Attacks, International Conference on Learning Representations (ICLR), 2018

    work page 2018

  3. [3]

    Kong, Qiuyu and Chen, Jiangming and Jiang, Jie and Ruan, Zanxi and Kang, Lai: Dual-Branch Fusion with Style Modulation for Cross-Domain Few-Shot Semantic Segmentation, ACM International Conference on Multimedia (ACM MM), 2024

    work page 2024

  4. [4]

    J. C. Costa, T. Roxo, H. Proen¸ ca and P. R. M. In´ acio: How Deep Learning Sees the World: A Survey on Adversarial Attacks and Defenses. in IEEE Access, vol. 12, pp. 61113-61136, 2024

    work page 2024

  5. [5]

    International Conference on Learning Rep- resentations (ICLR), 2018

    Kurakin, Boneh, Tramr, Goodfellow, Papernot, and McDaniel: Ensemble adver- sarial training: Attacks and defenses. International Conference on Learning Rep- resentations (ICLR), 2018

    work page 2018

  6. [6]

    International Conference on Machine Learning (ICML), 2019

    Pang, Tianyu and Xu, Kun and Du, Chao and Chen, Ning and Zhu, Jun: Improving adversarial robustness via promoting ensemble diversity. International Conference on Machine Learning (ICML), 2019. 14 Authors Suppressed Due to Excessive Length

    work page 2019

  7. [7]

    Improving Adversarial Robustness of Ensembles with Diversity Training

    Kariyappa, Sanjay and Qureshi, Moinuddin K: Improving adversarial robustness of ensembles with diversity training. arXiv preprint arXiv:1901.09981, 2019

    work page Pith review arXiv 1901

  8. [8]

    Neural Information Processing Systems (NeurIPS), 2020

    Yang, Huanrui and Zhang, Jingyang and Dong, Hongliang and Inkawhich: Dverge: Diversifying vulnerabilities for enhanced robust generation of ensembles. Neural Information Processing Systems (NeurIPS), 2020

    work page 2020

Show all 24 references
  1. [9]

    Neural Informa- tion Processing Systems (NeurIPS), 2021

    Yang, Zhuolin and Li, Linyi and Xu, Xiaojun: TRS: Transferability Reduced En- semble via Promoting Gradient Diversity and Model Smoothness. Neural Informa- tion Processing Systems (NeurIPS), 2021

    2021

  2. [10]

    Neural Information Processing Systems (NeurIPS), 2020

    Tramer, Florian and Carlini, Nicholas and Brendel, Wieland and Madry, Alek- sander: On adaptive attacks to adversarial example defenses. Neural Information Processing Systems (NeurIPS), 2020

    2020

  3. [11]

    and Huang, Q

    Huang, L. and Huang, Q. and Qiu, P. and Wei, S. and Gao, C.: F ASTEN: Fast Ensemble Learning for Improved Adversarial Robustness. IEEE Transactions on Information Forensics and Security, 2023

    2023

  4. [12]

    Advances in Neural Information Processing Systems(NeurIPS), 2024

    Deng, Yian, and Tingting Mu: Understanding and improving ensemble adversarial defense. Advances in Neural Information Processing Systems(NeurIPS), 2024

    2024

  5. [13]

    Advances in Neural Infor- mation Processing Systems(NeurIPS), 2022

    Cui, S., Zhang, J., Liang, J., Han, B., Sugiyama, M., and Zhang, C.: Synergy-of- experts: Collaborate to improve adversarial robustness. Advances in Neural Infor- mation Processing Systems(NeurIPS), 2022

    2022

  6. [14]

    Pattern Recognition(PR), 2024

    Zhuang, W and Huang, L and Gao, C: LAFED: Towards robust ensemble models via Latent Feature Diversification. Pattern Recognition(PR), 2024

    2024

  7. [15]

    Interna- tional Conference on Machine Learning (ICML), 2022

    Pang, Tianyu and Lin, Min and Yang, Xiao and Zhu, Jun and Yan, Shuicheng: Robustness and Accuracy Could Be Reconcilable by (Proper) Definition. Interna- tional Conference on Machine Learning (ICML), 2022

    2022

  8. [16]

    robustness trade-off

    Rade, Rahul, and Seyed-Mohsen Moosavi-Dezfooli: Reducing excessive margin to achieve a better accuracy vs. robustness trade-off. International Conference on Learning Representations(ICLR), 2022

    2022

  9. [17]

    Proceedings of the IEEE conference on Computer Vision and Pattern Recognition(CVPR), 2018

    Yinpeng Dong and Fangzhou Liao and Tianyu Pang and Hang Su and Jun Zhu and Xiaolin Hu and Jianguo Li and Xiaojun Xu: Boosting adversarial attacks with momentum. Proceedings of the IEEE conference on Computer Vision and Pattern Recognition(CVPR), 2018

    2018

  10. [18]

    2017 ieee symposium on Security and Privacy (SP), 2017

    Carlini, Nicholas, and David Wagner.: Towards Evaluating the Robustness of Neu- ral Networks. 2017 ieee symposium on Security and Privacy (SP), 2017

    2017

  11. [19]

    International Conference on Machine Learn- ing(ICLM), 2020

    Federico Croce and Matthias Hein: Minimally distorted adversarial examples with a fast adaptive boundary attack. International Conference on Machine Learn- ing(ICLM), 2020

    2020

  12. [20]

    International Conference on Machine Learning(ICML), 2020

    Federico Croce and Matthias Hein: Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. International Conference on Machine Learning(ICML), 2020

    2020

  13. [21]

    European conference on Computer Vision

    Mykhailo Andriushchenko and Federico Croce and Nicolas Flammarion and Matthias Hein: Square attack: A query-efficient black-box adversarial attack via random search. European conference on Computer Vision. Cham: Springer Inter- national Publishing, 2020

    2020

  14. [22]

    Lao, M and Pu, N and Liu, Y and others: Coca: Collaborative causal regularization for audio-visual question answering, AAAI Conference on Artificial Intelligence (AAAI), 2023

    2023

  15. [23]

    Lao, M and Guo, Y and Liu, Y and others: From superficial to deep: Language bias driven curriculum learning for visual question answering, ACM International Conference on Multimedia (ACM MM), 2021

    2021

  16. [24]

    arxiv preprint arxiv:2010.01736, 2020

    Zhang, J., Zhu, J., Niu, G., Han, B., Sugiyama, M., Kankanhalli: Geometry-aware instance-reweighted adversarial training. arxiv preprint arxiv:2010.01736, 2020

    2010 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.