Fast adversarial training (FAT) makes robust training affordable by replacing the multi-step attack with a single-step one, but it suffers from catastrophic overfitting (CO): partway through training,...
arXiv:2606. 00738v1 Announce Type: cross Abstract: Adversarial Training (AT) is a leading defense against adversarial examples but often suffers from Catastrophic Overfitting (CO) in efficient single-step variants, where robustness to multi-step attacks collapses despite high single-step performance.
arXiv:2505. 02360v3 Announce Type: replace-cross Abstract: Adversarial training is a cornerstone of robust deep learning, but fast methods like the Fast Gradient Sign Method (FGSM) often suffer from Catastrophic Overfitting (CO), where models become robust to single-step attacks but fail against multi-step variants.
arXiv:2607. 23777v1 Announce Type: cross Abstract: The discovery of scaling laws has motivated training neural networks on ever increasing quantities of data.
The paper introduces Median Temporal Ensembling, a training‑free aggregation method for action‑chunked visuomotor policies that replaces the standard exponential weighted mean with a coordinate‑wise median. This approach remains robust against adversarial corruption, maintaining a high recovery rate even as attack strength increases, and performs at least as well as the mean across numerous configurations while improving in many cases. It also handles non‑adversarial failures such as blank camera frames and shows limited impact on clean data, though it cannot counteract uniform shifts applied to all predictions.
arXiv:2608. 06177v1 Announce Type: new Abstract: Binary neural networks are very attractive for constrained deployment, enabling small footprint and low-power inference.
SecPO introduces a principled adversarial training framework to defend large language models against prompt injection attacks. By approximating an ideal injection‑invariant reference model and employing a new SecPO loss, the authors improve security while preserving utility. Combined with an efficient adversarial training pipeline that synthesizes strong injected inputs, the resulting SecPO + AT model significantly reduces attack success rates compared to existing defenses and maintains performance across multiple benchmarks.
ExGrad introduces explicit clean‑gradient subtraction in adversarial training by constructing clean‑input, adversarial‑input, and adversarial‑weight‑perturbed gradients and solving a globally solvable three‑variable problem to select coefficients. Across CIFAR‑10, CIFAR‑100, and ImageNet‑100, ExGrad consistently outperforms AWP and PGD‑AT, with the strongest gains at larger affine radii. The method demonstrates that negative clean coefficients, when properly tuned, improve robust accuracy without sacrificing clean performance.
arXiv:2609.10002v1 Announce Type: new Abstract: Deepfake detectors remain vulnerable to transfer-based black-box attacks, in which adversarial examples are generated on a source surrogate model and t...
arXiv:2410. 07719v4 Announce Type: replace Abstract: Despite being widely adopted as a canonical framework for learning robust models, adversarial training suffers from robust overfitting.
arXiv:2606. 31653v1 Announce Type: cross Abstract: Certified training aims to produce models whose predictions can be formally verified against adversarial perturbations, typically by optimising upper bounds on the worst-case loss over an allowed perturbation set.
arXiv:2607. 09800v1 Announce Type: new Abstract: Training in reduced floating-point precision can silently halt learning: when a gradient-descent weight update falls below half the unit in the last place (ULP) of the weight, it rounds away and that coordinate freezes while its gradient is still nonzero.