Pith. sign in

REVIEW 19 cited by

Robustness May Be at Odds with Accuracy

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 1805.12152 v5 pith:7RGZ5QJU submitted 2018-05-30 stat.ML cs.CVcs.LGcs.NE

Dimitris Tsipras , Shibani Santurkar , Logan Engstrom , Alexander Turner , Aleksander Madry This is my paper · ORCID
classification stat.MLcs.CVcs.LGcs.NE
keywords standardaccuracyrobustrobustnessadversarialclassifiersmodelsphenomenon
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

We show that there may exist an inherent tension between the goal of adversarial robustness and that of standard generalization. Specifically, training robust models may not only be more resource-consuming, but also lead to a reduction of standard accuracy. We demonstrate that this trade-off between the standard accuracy of a model and its robustness to adversarial perturbations provably exists in a fairly simple and natural setting. These findings also corroborate a similar phenomenon observed empirically in more complex settings. Further, we argue that this phenomenon is a consequence of robust classifiers learning fundamentally different feature representations than standard classifiers. These differences, in particular, seem to result in unexpected benefits: the representations learned by robust models tend to align better with salient data characteristics and human perception.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 19 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. OpenAlex reports about 373 citations worldwide. Full citation record

  1. Direct Search Methods for Online Nonconvex Optimization Under Inexact Bandit Feedback

    math.OC 2026-08 conditional novelty 6.0 of 10

    A randomized two-point direct-search algorithm for nonconvex time-varying optimization with inexact bandit feedback reaches epsilon-stationarity in O(p/epsilon^2) iterations under constant probing, and O(p/epsilon^2 l...

  2. Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detection

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A jointly optimized gradient-mask plus band-aid patch reportedly bypasses visible-infrared fused face detectors with >90% attack success in both digital and physical settings.

  3. Adversarial Examples Are Not Bugs, They Are Superposition

    cs.LG 2025-08 unverdicted novelty 6.0 of 10

    The paper argues that adversarial examples arise from superposition, and shows that changing superposition changes robustness and vice versa in toy models and ResNet18.

  4. Adversarial Training Improves Generalization Under Distribution Shifts in Bioacoustics

    cs.LG 2025-07 conditional novelty 6.0 of 10

    Output-space adversarial training improved clean-data performance and adversarial robustness of two bird sound classifiers across seven soundscape test sets, and stabilized prototype-based explanations.

  5. Exploring Visual Prompting: Robustness Inheritance and Beyond

    cs.CV 2025-06 conditional novelty 6.0 of 10

    Visual prompts built on robust source models inherit adversarial robustness but lose standard accuracy; a max-pooling over logit blocks (PBL) improves accuracy while keeping most robustness.

  6. When Maximum Entropy Misleads Policy Optimization

    cs.LG 2025-06 reject novelty 6.0 of 10

    Maximum entropy RL can be formally steered into arbitrary suboptimal policies at convergence by adding entropy trap states, while standard RL is unaffected.

  7. Grounding Functional Similarity by Invariance-Aware Model Stitching

    cs.LG 2025-05 conditional novelty 6.0 of 10

    FuLA, a task-agnostic stitching objective that aligns intermediate features through the frozen end network, is claimed to be a more reliable functional similarity metric than task-based stitching.

  8. DROP: Poison Dilution via Knowledge Distillation for Federated Learning

    cs.LG 2025-02 conditional novelty 6.0 of 10

    DROP combines clustering, client reputation tracking, and GAN-guided knowledge distillation to suppress targeted backdoor attacks in federated learning, reporting under 2% attack success in most tested IID settings.

  9. Double Visual Defense: Adversarial Pre-training and Instruction Tuning for Improving Vision-Language Model Robustness

    cs.CV 2025-01 conditional novelty 6.0 of 10

    Adversarial training at both the CLIP pre-training stage and the LLaVA instruction-tuning stage produces vision-language models with state-of-the-art robustness and near-baseline clean performance.

  10. Evaluating the Robustness of the "Ensemble Everything Everywhere" Defense

    cs.LG 2024-11 conditional novelty 6.0 of 10

    Adaptive attacks reduce the robust accuracy of the 'Ensemble Everything Everywhere' defense to 11% on CIFAR-10 and 14% on CIFAR-100 under an l-infinity bound of 8/255.

  11. MEGL: Multimodal Explanation-Guided Learning

    cs.CV 2024-11 conditional novelty 6.0 of 10

    A multimodal explanation-guided learning framework that jointly uses visual saliency maps and textual rationales to train image classifiers, improving accuracy, visual explanation overlap, and text explanation scores ...

  12. A principled approach for generating adversarial images under non-smooth dissimilarity metrics

    cs.LG 2019-08 conditional novelty 6.0 of 10

    ProxLogBarrier extends the LogBarrier adversarial attack to non-smooth metrics via proximal gradient, achieving state-of-the-art ℓ0 perturbation results.

  13. Evaluation of Adversarial Robustness in Arabic Language Models

    cs.CL 2026-07 conditional novelty 5.0 of 10

    Arabic BERT-family sentiment models lose up to 92% accuracy under diacritics and 58% under conjunction attacks; paraphrase attacks cut accuracy by 76% on average, and adversarial training only partially helps.

  14. RobQFL: Robust Quantum Federated Learning in Adversarial Environment

    quant-ph 2025-09 conditional novelty 5.0 of 10

    Partial adversarial coverage in simulated quantum federated learning improves small-perturbation robustness with little clean-accuracy loss, but label-sorted non-IID data removes about half the robustness benefit.

  15. DUMB and DUMBer: Is Adversarial Training Worth It in the Real World?

    cs.CR 2025-06 conditional novelty 5.0 of 10

    Across 240 model configurations and 13 attacks, adaptive and curriculum adversarial training give the largest robustness gains, but 20.53% of evaluations show negative gains, mostly under mismatched source-target mode...

  16. Mitigating Spurious Negative Pairs for Robust Industrial Anomaly Detection

    cs.CV 2025-01 conditional novelty 5.0 of 10

    A contrastive anomaly detector trained on pseudo-anomalies and opposite-pair repulsion raises average robust AUROC under PGD-1000 from 39.7% (best prior) to 65.8%.

  17. Cross-Entropy Attacks to Language Models via Rare Event Simulation

    cs.CL 2025-01 conditional novelty 5.0 of 10

    A cross-entropy optimization attack (CEA) with sememe- and MLM-based candidate words improves black-box adversarial attacks on classifiers and machine translation models.

  18. Distilling Vision-Language Models for Robust Traffic Sign Perception in Autonomous Vehicles

    cs.LG 2026-08 conditional novelty 4.0 of 10

    Training traffic sign classifiers with two frozen text-prototype losses, built from VLM-generated descriptions and class names, improves accuracy under shadows, natural light, and printed patches, with no inference-ti...

  19. PRM-Free Security Alignment of Large Models via Red Teaming and Adversarial Training

    cs.CR 2025-07 reject novelty 3.0 of 10

    A PRM-free alignment pipeline combining genetic algorithm red teaming and multi-objective adversarial training is claimed to beat PRM-based methods at 61% lower cost, but the experiments are unverifiable.

Pith tools