2026· IEEE Transactions on Information Forensics and Security· Vol 21, pp. 7259-7273· 0 citations· 36 references
Abstract
Adversarial training (AT) is a widely adopted defense against adversarial attacks, but its multi-step optimization process for generating adversarial examples leads to substantial computational overhead. To mitigate this, various single-step adversarial training methods have been proposed. However, these models often suffer from catastrophic overfitting under larger perturbations and exhibit degraded robustness. The core issue is that certain single-step adversarial examples, although successfully learned and correctly classified, fail to expose the true vulnerabilities of models. We refer to these misleading examples as “fakers”. Specifically, we find that fakers exhibit three distinct characteristics compared to standard adversarial examples: 1) they unexpectedly degrade the model robustness rather than improve it; 2) they make it harder for the model to learn their robust features; and 3) they show significantly greater divergence from their clean counterparts. These observations motivate us to proactively reduce the impact of fakers during training. To this end, we propose the Faker-Alleviating Single-step adversarial Training method (FAST), a general and effective framework designed to enhance both accuracy and robustness. Concretely, FAST consists of two main components. First, it dynamically adjusts the label-smoothing level for adversarial examples according to their learning difficulty, making fakers easier for the model to learn. Second, it introduces an auxiliary sample with a weak adversarial effect, derived from the single-step adversarial example, which is used to dynamically ease the alignment with clean data and stabilize the optimization process. We demonstrate the effectiveness of FAST through extensive experiments, showing that our method achieves superior clean accuracy and robustness against various types of adversarial attacks. The code is available at https://github.com/mesunhlf/FAST.
Adversarial robustness optimization aims to preserve correct prediction under adversarial perturbations, and has produced substantial robustness gains through methods such as adversarial training and adversarial purification. However, we identify a new security risk: these gains can create shared vulnerabilities across defenses. Once one representative robustness-optimized defense is effectively breached, the broader family may become exposed. Studying this risk requires separating genuine transferability from distortion-induced degradation and from the algorithmic gains of sophisticated attacks. We therefore introduce stricter transfer-only protocols and a deliberately simple adaptive attack, PGDTransfer, to test whether robustness-optimized defenses share transfer-only vulnerability under controlled conditions. We further introduce Adversarial Sensitivity Maps (AdvSMs) to visualize and quantify shared alignment beyond differentiable classifiers, including stochastic and non-differentiable defenses. Across adversarially trained classifiers, purification-based defenses, and LVLMs with robust visual encoders, we identify natural transferability within each robustness family, i.e., transfer that arises even with simple PGD-style optimization rather than specialized transferable-attack design. The risk is already severe for purification: PGDTransfer reaches an average transfer attack success rate of $80.4\%$ across filtering-, compression-, and diffusion-based purifiers under $\epsilon=4/255$, suggesting that purifier defenses may no longer provide reliable protection. As attacks improve, currently stronger robustness families may face the same risk. Future defenses should therefore treat vulnerability diversity and transfer-only isolation as security objectives, rather than optimizing only individual robustness.
Hanrui Wang, Ruihao Zheng, Shuo Wang et al.· 0 citations
Adversarial training has emerged as a leading strategy for enhancing the robustness of machine learning models against adversarial attacks. Its effectiveness often wanes when faced with unseen adversarial examples, resulting in suboptimal robust generalization. To address this issue, we introduce a novel energy-based optimization strategy to improve the robust generalization by incorporating the principles of energy-based models. Our framework models the energy of natural and adversarial examples, where natural samples are assigned to lower energy and adversarial samples to higher energy. During the inference phase, the influence of adversarial perturbation can be alleviated by energy minimization. Theoretically, we show that the proposed energy-based optimization strategy yields a tighter robust-generalization bound through an explicit energy-discrepancy term; this analysis provides an explanatory bound and should not be interpreted as certified robustness. Empirically, a series of evaluations provide evidence for the efficacy of the proposed methodology under the specified threat models and evaluation protocols, showing strong and competitive performance across three extensively utilized datasets. Specifically, EM-AT achieves 77.71% standard-AA robustness on CIFAR-10 and remains highly competitive under comparable lightweight settings. The source codes are available at https://github.com/LitterQ/EM-AT.
Adversarial training is one of the most effective defenses against adversarial attacks, yet the computational cost remains prohibitive at modern scales, especially for large language models (LLMs). While existing mitigation strategies, e.g., latent adversarial training (LAT), have been developed, they still incur a high computational cost. In this work, we comprehensively investigate computation-efficient strategies to speed up LAT from two complementary perspectives: (1) Defense-side optimization: We explore the representation fine-tuning (ReFT) within LAT, and reveal a potential issue if there is a mismatch on which tokens to apply ReFT and the attack. (2) Attack-side optimization: When computing adversarial attacks in each LAT iteration, we extract only the relevant circuits from the LLM to construct a lightweight surrogate model, avoiding the computation in the forward-backward passes through the full model during the attack generation. For both perspectives, we provide theoretical justifications and numerical evidence to illustrate the effectiveness of the proposed strategies. Ultimately, compared to standard LAT with full fine-tuning, our method on average reduces per-step adversarial-training FLOPs by 48.1% while requiring only 0.0118% trainable parameters.
Weiyi He, Yuping Lin, Jiliang Tang et al.· 0 citations
Adversarial attacks guide and provide additional training and test data for both adversarial training and adversarial robustness validation, and expose the'piecewise linearity'of deep learning based models. Since adversarial attacks and adversarial robustness are mathematically defined problems that can be optimised directly with end-to-end differentiable search, adversarial robustness is more widely applicable than other robustness metrics such as corruption and perturbation robustness, and new kinds of adversarial attacks are beneficial for robustness testing. Attacks are targeted or non-targeted depending on whether the image is modified to misclassify to a particular class or to any incorrect class; we focus on the non-targeted setting. Finding the optimal input data points and hyper-parameters for generating non-targeted adversarial attacks remains a challenge for current methods like the Fast Gradient Method, Basic Iterative Method and Virtual Adversarial Method. We propose a new method, the"Binary Iterative Method"(BinIM), which uses a divide-and-conquer paradigm to optimise parameters and hyper-parameters for the generation of non-targeted attacks. We compare our method to other gradient-based adversarial attacks evaluated over pre-trained networks (InceptionV3, InceptionV2, ResNet V2 152) on classification tasks. On 1000 randomly-sampled images from the standard ImageNet dataset, the Binary Iterative Method outperforms all other gradient-based methods, qualitatively making the classifier misclassify with confidence up to 0.995 while reducing the probability of the true label to 2.21e-09 (approximately 0).
Adversarial attacks pose a significant threat to the reliability and security of Artificial Intelligence (AI) systems, especially as AI integrates into critical fields like healthcare and finance. This work specifically addresses adversarial evasion attacks conducted during the testing phase. In this study, attacks are designed to be untargeted (misleading the model to any wrong class) and white-box (attacker has access to the model), using small perturbations to cause incorrect classifications. To counter these threats, this research investigates adversarial training, a defense mechanism where models are trained using data generated by attacks. The study systematically compares two distinct adversarial training strategies: ‘pre-train’, where adversarial examples are generated beforehand, and ‘in-train’, where perturbations are introduced dynamically during the training process. This comparison aims to understand the advantages and limitations of each approach in enhancing model robustness. Using a Fully Connected Neural Network (FCNN) and the MNIST dataset, experiments were conducted with attacks like FGSM and BIM at varying perturbation strengths $\epsilon $ . The results provide a controlled comparison of adversarial training strategies, highlighting key trade-offs between robustness and generalization. We observe that the ‘in-train’ strategy provides superior robustness in the evaluated setting against white-box, untargeted attacks compared to the ‘pre-train’ method. However, the findings are derived from experiments on the MNIST dataset using FCNNs, and therefore should be interpreted as foundational insights. Extending the analysis to more complex datasets and architectures remains an important direction for future work.
José María Jorquera Valero, Ibon Bengoechea Cazorla, Manuel Gil Pérez· IEEE Access· 0 citations
This work proposes Universal Continual Adversarial Defense (UCAD), a universal framework that enables both standard and robust models to perform effective defense under the CAD setting and observes that as the number of encountered attacks increases, UCAD becomes increasingly robust, consistently enhancing the defense capability of existing robust models until saturation.
Qian Wang, Hefei Ling, Yingwei Li et al.· 0 citations